@zackbart/connecta 0.5.0 → 0.6.1

package/dist/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,eAAO,MAAM,qBAAqB,+qBACmoB,CAAC;AAEtqB,eAAO,MAAM,WAAW,wzEAkDvB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,odAIpC,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAI5E;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAInE;AAED,eAAO,MAAM,gBAAgB;;;;EAOnB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAGvE;AAwDD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,YAAY,EAAE,CAc3E;AAED,MAAM,MAAM,WAAW,GACrB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,WAAW,CAsCb"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,eAAO,MAAM,qBAAqB,+qBACmoB,CAAC;AAEtqB,eAAO,MAAM,WAAW,4hFAkDvB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,odAIpC,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAI5E;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAInE;AAED,eAAO,MAAM,gBAAgB;;;;EAOnB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAGvE;AAwDD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,YAAY,EAAE,CAc3E;AAED,MAAM,MAAM,WAAW,GACrB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,WAAW,CAsCb"}

package/dist/skills.js

@@ -12,7 +12,7 @@ export const USAGE_SKILL = `# Connecta usage
 - Truncated result: retry with \`fields\` when possible; otherwise page it with \`get_result\`.
 - \`auth_required\`: use \`authorize_connector\`, have the operator complete consent, then confirm with \`list_connectors\`.
 
-Use \`list_connectors({ probe: false })\` for a fast inventory. Use \`probe: true\` only when diagnosing live health or authorization.
+Use \`list_connectors({ probe: false })\` for a fast inventory. Use \`probe: true\` only when diagnosing live health or authorization. The fast inventory already reports a connector whose stored credential failed a proactive check as \`auth_required\` (with \`credentialCheck\` and the URL to open), so trust it and authorize up front rather than probing to confirm.
 
 ## Code mode
 
@@ -208,13 +208,13 @@ export function resolveSkill(name, connectors) {
         return {
             found: false,
             message: connectorGuide(bare)
-                ? `Unknown skill "${name}". Connector guides are fetched as "${connectorSkillName(name)}". Available: ${available()}.`
+                ? `Unknown skill "${name}". Connector guides are fetched as "${connectorSkillName(name)}". Available skills: ${available()}.`
                 : `Connector "${name}" has no usage guide. Available skills: ${available()}.`,
         };
     }
     return {
         found: false,
-        message: `Unknown skill "${name}". Available: ${available()}.`,
+        message: `Unknown skill "${name}". Available skills: ${available()}.`,
     };
 }
 //# sourceMappingURL=skills.js.map

package/dist/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAChC,mqBAAmqB,CAAC;AAEtqB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;CAIvC,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,UAAgC;IACjE,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,SAAS,CACvD,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,UAAgC;IACzD,OAAO,kBAAkB,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,WAAW,GAAG,wBAAwB;QACxC,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EACT,0FAA0F;QAC5F,OAAO,EAAE,UAAU;KACpB;CACO,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAEnD,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,GAAG,sBAAsB,GAAG,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAAoB;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC;IACnC,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,8EAA8E;AAC9E,MAAM,OAAO,GAAG,gCAAgC,CAAC;AAEjD,uCAAuC;AACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAEnC;;;;GAIG;AACH,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAExE,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,KAAe;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IACnE,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAoB,EAAE,KAAa;IACzD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,OAAO,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,OAAO;YAAE,SAAS;QACtB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5D,MAAM,IAAI,GAAG,GAAG;YACd,wEAAwE;YACxE,qDAAqD;aACpD,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;aAC3B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,OAAO,IAAI,CAAC,MAAM,IAAI,cAAc;YAClC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,WAAW,IAAI,oBAAoB,SAAS,CAAC,EAAE,IAAI,CAAC;AACvE,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,UAAgC;IACzD,MAAM,OAAO,GAAmB,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,UAAgC;IAEhC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,UAAU,CAAC,UAAU,CAAC;SACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,SAAS,EAAE,GAAG;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,cAAc,EAAE,2CAA2C,SAAS,EAAE,GAAG;aACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,kBAAkB,IAAI,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,iBAAiB,SAAS,EAAE,GAAG;gBACtH,CAAC,CAAC,cAAc,IAAI,2CAA2C,SAAS,EAAE,GAAG;SAChF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,kBAAkB,IAAI,iBAAiB,SAAS,EAAE,GAAG;KAC/D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAChC,mqBAAmqB,CAAC;AAEtqB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;CAIvC,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,UAAgC;IACjE,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,SAAS,CACvD,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,UAAgC;IACzD,OAAO,kBAAkB,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,WAAW,GAAG,wBAAwB;QACxC,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EACT,0FAA0F;QAC5F,OAAO,EAAE,UAAU;KACpB;CACO,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAEnD,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,GAAG,sBAAsB,GAAG,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAAoB;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC;IACnC,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,8EAA8E;AAC9E,MAAM,OAAO,GAAG,gCAAgC,CAAC;AAEjD,uCAAuC;AACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAEnC;;;;GAIG;AACH,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAExE,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,KAAe;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IACnE,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAoB,EAAE,KAAa;IACzD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,OAAO,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,OAAO;YAAE,SAAS;QACtB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5D,MAAM,IAAI,GAAG,GAAG;YACd,wEAAwE;YACxE,qDAAqD;aACpD,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;aAC3B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,OAAO,IAAI,CAAC,MAAM,IAAI,cAAc;YAClC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,WAAW,IAAI,oBAAoB,SAAS,CAAC,EAAE,IAAI,CAAC;AACvE,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,UAAgC;IACzD,MAAM,OAAO,GAAmB,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,UAAgC;IAEhC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,UAAU,CAAC,UAAU,CAAC;SACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,SAAS,EAAE,GAAG;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,cAAc,EAAE,2CAA2C,SAAS,EAAE,GAAG;aACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,kBAAkB,IAAI,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,wBAAwB,SAAS,EAAE,GAAG;gBAC7H,CAAC,CAAC,cAAc,IAAI,2CAA2C,SAAS,EAAE,GAAG;SAChF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,kBAAkB,IAAI,wBAAwB,SAAS,EAAE,GAAG;KACtE,CAAC;AACJ,CAAC"}

package/dist/timeout.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generous default bound for a single downstream probe/catalog call. High enough
+ * to trip only on a pathological hang, not a realistically slow probe.
+ */
+export declare const DEFAULT_PROBE_TIMEOUT_MS = 30000;
+/** A finite, positive integer number of milliseconds, or undefined. */
+export declare function normalizeTimeoutMs(value: number | undefined): number | undefined;
+/**
+ * Reject `promise` after `ms` if it has not settled, so one hung downstream
+ * cannot stall a whole fan-out. NOTE: this bounds only the caller-facing wait —
+ * the registry probe methods take no AbortSignal, so the underlying fetch is
+ * NOT cancelled and keeps running in the background. Real cancellation
+ * (AbortSignal plumbed through the registry) is a deferred follow-up.
+ */
+export declare function withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T>;
+//# sourceMappingURL=timeout.d.ts.map

package/dist/timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAC3B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CAgBZ"}

package/dist/timeout.js

@@ -0,0 +1,38 @@
+// The deadline vocabulary shared by every non-call downstream probe: the
+// discovery meta-tools' catalog fan-out (src/meta-tools.ts) and the credential
+// liveness checks (src/credential-health.ts). One definition so a "probe" means
+// the same thing, and is bounded the same way, wherever one is issued.
+/**
+ * Generous default bound for a single downstream probe/catalog call. High enough
+ * to trip only on a pathological hang, not a realistically slow probe.
+ */
+export const DEFAULT_PROBE_TIMEOUT_MS = 30_000;
+/** A finite, positive integer number of milliseconds, or undefined. */
+export function normalizeTimeoutMs(value) {
+    if (value === undefined || !Number.isFinite(value) || !(value > 0)) {
+        return undefined;
+    }
+    return Math.max(1, Math.trunc(value));
+}
+/**
+ * Reject `promise` after `ms` if it has not settled, so one hung downstream
+ * cannot stall a whole fan-out. NOTE: this bounds only the caller-facing wait —
+ * the registry probe methods take no AbortSignal, so the underlying fetch is
+ * NOT cancelled and keeps running in the background. Real cancellation
+ * (AbortSignal plumbed through the registry) is a deferred follow-up.
+ */
+export function withTimeout(promise, ms, label) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`${label} timed out after ${ms}ms`));
+        }, ms);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+}
+//# sourceMappingURL=timeout.js.map

package/dist/timeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeout.js","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AAEvE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAChC,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,OAAmB,EACnB,EAAU,EACV,KAAa;IAEb,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/toolkits.d.ts

@@ -1,4 +1,4 @@
-import type { Connector } from "./types.js";
+import type { Connector, InboundAuth, ToolkitBinding } from "./types.js";
 /** Toolkit names share the connector-id grammar: URL-safe, no separators. */
 export declare const TOOLKIT_NAME_RE: RegExp;
 /** One named scope, declared in `ConnectaConfig.toolkits` (config as code). */
@@ -41,4 +41,98 @@ export declare function splitAddress(address: string): {
  * current (unscoped) behavior.
  */
 export declare function resolveToolkits(toolkits: ToolkitConfig | undefined, connectors: readonly Connector[]): ReadonlyMap<string, Toolkit> | undefined;
+/**
+ * The binding half of an inbound-auth adapter's options — the shape every
+ * shipped adapter (`bearerToken`, `clerkAuth`) mixes into its own options so an
+ * operator writes one thing in one style, next to the credential it binds.
+ */
+export interface ToolkitBindingOptions {
+    /**
+     * Toolkit names this credential may select with `?toolkit=<name>`. Present ⇒
+     * the identity is BOUND: any other toolkit, and (unless `unscoped`) a
+     * connection with no `?toolkit=`, is refused at connect time. Absent ⇒
+     * unbound, exactly as before bindings existed.
+     */
+    toolkits?: readonly string[];
+    /**
+     * Also allow a connection with no `?toolkit=` (the full registry, and the
+     * deployment-wide operator surfaces). Only meaningful beside `toolkits`.
+     */
+    unscoped?: boolean;
+}
+/**
+ * Validate one adapter's binding options into a `ToolkitBinding`, or undefined
+ * when the adapter declares none. Structural mistakes THROW where the operator
+ * wrote them (adapter construction), for the same reason toolkit definitions do:
+ * a binding that does not say what its author meant is worse than none, because
+ * it is invisible until the day it denies — or admits — the wrong caller.
+ *
+ * Names are only checked against the *grammar* here; cross-checking them
+ * against the configured toolkits happens in `validateToolkitBindings`, which
+ * runs in `createConnecta` where both halves are finally in scope.
+ */
+export declare function resolveToolkitBinding(source: string, options: ToolkitBindingOptions): ToolkitBinding | undefined;
+/**
+ * Coerce an arbitrary value into a `ToolkitBinding`, or null when it is not one.
+ *
+ * The shipped adapters build bindings through `resolveToolkitBinding` above, but
+ * `InboundAuth` is an open interface and `AuthResult.toolkitBinding` arrives at
+ * REQUEST time from code connecta does not own — a custom adapter, or one
+ * mapping an IdP claim. Every field is therefore re-checked here rather than
+ * trusted from the type, because each way of being wrong fails OPEN if it is
+ * merely believed:
+ *
+ * - `unscoped` is compared to `true` by identity, so a truthy non-boolean (the
+ *   string `"false"` out of an env var, say) cannot grant the full registry;
+ * - `toolkits` must be a real array — a bare string would otherwise reach
+ *   `String.prototype.includes`, where `?toolkit=sup` would "match" `"support"`
+ *   by substring;
+ * - a missing/!array `toolkits` is not treated as an empty binding, because the
+ *   caller of a null return refuses the request outright.
+ *
+ * Returns a frozen, deduplicated copy: nothing downstream can be mutated by the
+ * adapter after the check, and every name is known to fit the grammar.
+ */
+export declare function normalizeToolkitBinding(value: unknown): ToolkitBinding | null;
+/**
+ * Resolve the binding one admitted identity is actually held to, from the
+ * provider's static declaration and whatever its `authorize` returned.
+ *
+ * - Neither ⇒ unbound (undefined), the pre-binding behavior.
+ * - Declaration only ⇒ the declaration.
+ * - Per-identity only ⇒ that binding, validated. This is the custom-adapter
+ *   seam: a provider that declares nothing is asserting it resolves membership
+ *   itself, so there is nothing to check it against.
+ * - Both ⇒ the **intersection**. The declaration is a CEILING, not a default: an
+ *   adapter that maps a user-writable IdP claim to toolkits must not be able to
+ *   widen the credential's own binding, which would turn "support token" into
+ *   "any toolkit, plus the full registry" for anyone who can set that claim.
+ *   Narrowing is fine and useful (per-user subsets of the team's view).
+ *
+ * A malformed binding on either side is not silently ignored — it returns
+ * `{ ok: false }` and the caller refuses the request, because the alternative
+ * (dropping it) is the fail-open reading.
+ */
+export declare function resolveIdentityBinding(declared: unknown, perIdentity: unknown): {
+    ok: true;
+    binding?: ToolkitBinding;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Cross-check every statically declared binding against the deployment's
+ * toolkits, in `createConnecta`. A name that no toolkit declares is a typo, and
+ * a typo here fails CLOSED — the credential would be refused every connection
+ * with a 403 the client reads as a transport failure — so it throws at
+ * construction rather than becoming a support ticket. A structurally malformed
+ * declaration (only reachable from a hand-written `InboundAuth`, since the
+ * shipped adapters validate their own options) throws here too, rather than
+ * waiting to refuse every request at runtime.
+ *
+ * Bindings a provider mints per-identity (`AuthResult.toolkitBinding`) do not
+ * exist yet and cannot be checked here; they are validated on arrival and capped
+ * by the declaration (`resolveIdentityBinding`).
+ */
+export declare function validateToolkitBindings(auth: readonly InboundAuth[], toolkits: ReadonlyMap<string, Toolkit> | undefined): void;
 //# sourceMappingURL=toolkits.d.ts.map

package/dist/toolkits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toolkits.d.ts","sourceRoot":"","sources":["../src/toolkits.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,eAAe,QAAkB,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,6DAA6D;AAC7D,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAE9D,kFAAkF;AAClF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3C,2EAA2E;IAC3E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CACzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,GACd;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOlD;AAgID;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,aAAa,GAAG,SAAS,EACnC,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAsB1C"}
+{"version":3,"file":"toolkits.d.ts","sourceRoot":"","sources":["../src/toolkits.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzE,6EAA6E;AAC7E,eAAO,MAAM,eAAe,QAAkB,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,6DAA6D;AAC7D,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAE9D,kFAAkF;AAClF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3C,2EAA2E;IAC3E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CACzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,GACd;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOlD;AAgID;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,aAAa,GAAG,SAAS,EACnC,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAsB1C;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,qBAAqB,GAC7B,cAAc,GAAG,SAAS,CA2C5B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAmB7E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,OAAO,EACjB,WAAW,EAAE,OAAO,GAElB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoChC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,WAAW,EAAE,EAC5B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACjD,IAAI,CA2BN"}

package/dist/toolkits.js

@@ -4,8 +4,14 @@
 // A connecta deployment belongs to an ORG; a toolkit is the view a GROUP OF
 // TEAM MEMBERS inside that org gets — a "support" toolkit seeing Zendesk and
 // Notion, an "exec" toolkit that also sees Gmail. This module only *defines and
-// validates* scopes. Enforcement lives in one place: `ScopedRegistry`
-// (src/registry.ts), which every meta-tool inherits through `RegistryView`.
+// validates* scopes and the identity bindings that gate them. Enforcement lives
+// in two places, each with one job:
+//
+//   - WHICH toolkit an identity may open: the connect-time binding check in
+//     `resolveToolkitScope` (src/server.ts), run after the auth gate and before
+//     any scoped registry exists.
+//   - WHAT a selected toolkit may see: `ScopedRegistry` (src/registry.ts),
+//     which every meta-tool inherits through `RegistryView`.
 /** Toolkit names share the connector-id grammar: URL-safe, no separators. */
 export const TOOLKIT_NAME_RE = /^[a-z0-9_-]+$/;
 /**
@@ -67,9 +73,9 @@ function toolFilter(name, addresses, connectorIds, staticTools, field) {
  *
  * Structural mistakes THROW at construction rather than warn: a typo'd id in
  * an allowlist is a scope the operator did not write, and a scope nobody wrote
- * is not one an operator can reason about. (A toolkit scopes visibility, not
- * identity — it is not itself an access check; see the module header and
- * documentation.md §16.) Tool names are checked only for connectors that expose
+ * is not one an operator can reason about. (A definition scopes visibility only;
+ * WHICH identity may select it is the separate binding below — see the module
+ * header and documentation.md §16.) Tool names are checked only for connectors that expose
  * `staticTools` (i.e. `api()`); a remote connector's catalog is fetched lazily
  * over the network and is unknown at construction time.
  */
@@ -131,4 +137,183 @@ export function resolveToolkits(toolkits, connectors) {
     }
     return resolved;
 }
+/**
+ * Validate one adapter's binding options into a `ToolkitBinding`, or undefined
+ * when the adapter declares none. Structural mistakes THROW where the operator
+ * wrote them (adapter construction), for the same reason toolkit definitions do:
+ * a binding that does not say what its author meant is worse than none, because
+ * it is invisible until the day it denies — or admits — the wrong caller.
+ *
+ * Names are only checked against the *grammar* here; cross-checking them
+ * against the configured toolkits happens in `validateToolkitBindings`, which
+ * runs in `createConnecta` where both halves are finally in scope.
+ */
+export function resolveToolkitBinding(source, options) {
+    const { toolkits, unscoped } = options;
+    if (toolkits === undefined) {
+        if (unscoped !== undefined) {
+            // `unscoped` alone reads like a permission but grants nothing an unbound
+            // identity does not already have, so it is almost certainly a half-written
+            // binding — the one shape here that would silently fail OPEN.
+            throw new Error(`${source}: \`unscoped\` only means something beside \`toolkits\`. ` +
+                "List the toolkits this credential may open, or drop `unscoped` to " +
+                "leave the credential unbound.");
+        }
+        return undefined;
+    }
+    if (!Array.isArray(toolkits)) {
+        throw new Error(`${source}: \`toolkits\` must be an array of toolkit names.`);
+    }
+    const names = [];
+    for (const name of toolkits) {
+        if (typeof name !== "string" || !TOOLKIT_NAME_RE.test(name)) {
+            // A name outside the grammar can never match a declared toolkit, so this
+            // would bind the credential to nothing selectable.
+            throw new Error(`${source}: \`toolkits\` entry ${JSON.stringify(name)} is not a ` +
+                `toolkit name (must match ${TOOLKIT_NAME_RE.source}).`);
+        }
+        if (!names.includes(name))
+            names.push(name);
+    }
+    if (names.length === 0 && unscoped !== true) {
+        throw new Error(`${source}: binds no toolkits and no unscoped access, so this credential ` +
+            "could authenticate but never connect. List at least one toolkit, or " +
+            "pass `unscoped: true` to bind it to the full registry only.");
+    }
+    return Object.freeze({
+        toolkits: Object.freeze(names),
+        ...(unscoped === true ? { unscoped: true } : {}),
+    });
+}
+/**
+ * Coerce an arbitrary value into a `ToolkitBinding`, or null when it is not one.
+ *
+ * The shipped adapters build bindings through `resolveToolkitBinding` above, but
+ * `InboundAuth` is an open interface and `AuthResult.toolkitBinding` arrives at
+ * REQUEST time from code connecta does not own — a custom adapter, or one
+ * mapping an IdP claim. Every field is therefore re-checked here rather than
+ * trusted from the type, because each way of being wrong fails OPEN if it is
+ * merely believed:
+ *
+ * - `unscoped` is compared to `true` by identity, so a truthy non-boolean (the
+ *   string `"false"` out of an env var, say) cannot grant the full registry;
+ * - `toolkits` must be a real array — a bare string would otherwise reach
+ *   `String.prototype.includes`, where `?toolkit=sup` would "match" `"support"`
+ *   by substring;
+ * - a missing/!array `toolkits` is not treated as an empty binding, because the
+ *   caller of a null return refuses the request outright.
+ *
+ * Returns a frozen, deduplicated copy: nothing downstream can be mutated by the
+ * adapter after the check, and every name is known to fit the grammar.
+ */
+export function normalizeToolkitBinding(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return null;
+    }
+    const { toolkits, unscoped } = value;
+    if (!Array.isArray(toolkits))
+        return null;
+    if (unscoped !== undefined && typeof unscoped !== "boolean")
+        return null;
+    const names = [];
+    for (const name of toolkits) {
+        if (typeof name !== "string" || !TOOLKIT_NAME_RE.test(name))
+            return null;
+        if (!names.includes(name))
+            names.push(name);
+    }
+    return Object.freeze({
+        toolkits: Object.freeze(names),
+        ...(unscoped === true ? { unscoped: true } : {}),
+    });
+}
+/**
+ * Resolve the binding one admitted identity is actually held to, from the
+ * provider's static declaration and whatever its `authorize` returned.
+ *
+ * - Neither ⇒ unbound (undefined), the pre-binding behavior.
+ * - Declaration only ⇒ the declaration.
+ * - Per-identity only ⇒ that binding, validated. This is the custom-adapter
+ *   seam: a provider that declares nothing is asserting it resolves membership
+ *   itself, so there is nothing to check it against.
+ * - Both ⇒ the **intersection**. The declaration is a CEILING, not a default: an
+ *   adapter that maps a user-writable IdP claim to toolkits must not be able to
+ *   widen the credential's own binding, which would turn "support token" into
+ *   "any toolkit, plus the full registry" for anyone who can set that claim.
+ *   Narrowing is fine and useful (per-user subsets of the team's view).
+ *
+ * A malformed binding on either side is not silently ignored — it returns
+ * `{ ok: false }` and the caller refuses the request, because the alternative
+ * (dropping it) is the fail-open reading.
+ */
+export function resolveIdentityBinding(declared, perIdentity) {
+    const ceiling = declared === undefined ? undefined : normalizeToolkitBinding(declared);
+    if (declared !== undefined && !ceiling) {
+        return {
+            ok: false,
+            reason: "the toolkit binding declared on the provider is malformed " +
+                "(`toolkits` must be an array of toolkit names, `unscoped` a boolean)",
+        };
+    }
+    if (perIdentity === undefined) {
+        return ceiling ? { ok: true, binding: ceiling } : { ok: true };
+    }
+    const identity = normalizeToolkitBinding(perIdentity);
+    if (!identity) {
+        return {
+            ok: false,
+            reason: "the toolkit binding its authorize() returned for this identity is " +
+                "malformed (`toolkits` must be an array of toolkit names, `unscoped` " +
+                "a boolean)",
+        };
+    }
+    if (!ceiling)
+        return { ok: true, binding: identity };
+    return {
+        ok: true,
+        binding: Object.freeze({
+            toolkits: Object.freeze(identity.toolkits.filter((name) => ceiling.toolkits.includes(name))),
+            ...(identity.unscoped === true && ceiling.unscoped === true
+                ? { unscoped: true }
+                : {}),
+        }),
+    };
+}
+/**
+ * Cross-check every statically declared binding against the deployment's
+ * toolkits, in `createConnecta`. A name that no toolkit declares is a typo, and
+ * a typo here fails CLOSED — the credential would be refused every connection
+ * with a 403 the client reads as a transport failure — so it throws at
+ * construction rather than becoming a support ticket. A structurally malformed
+ * declaration (only reachable from a hand-written `InboundAuth`, since the
+ * shipped adapters validate their own options) throws here too, rather than
+ * waiting to refuse every request at runtime.
+ *
+ * Bindings a provider mints per-identity (`AuthResult.toolkitBinding`) do not
+ * exist yet and cannot be checked here; they are validated on arrival and capped
+ * by the declaration (`resolveIdentityBinding`).
+ */
+export function validateToolkitBindings(auth, toolkits) {
+    for (const provider of auth) {
+        if (provider.toolkitBinding === undefined)
+            continue;
+        const binding = normalizeToolkitBinding(provider.toolkitBinding);
+        if (!binding) {
+            throw new Error(`Inbound auth provider "${provider.kind}" declares a malformed ` +
+                "toolkitBinding: `toolkits` must be an array of toolkit names " +
+                `(matching ${TOOLKIT_NAME_RE.source}) and \`unscoped\` a boolean.`);
+        }
+        if (!toolkits || toolkits.size === 0) {
+            throw new Error(`Inbound auth provider "${provider.kind}" binds toolkits ` +
+                `(${binding.toolkits.join(", ")}) but this deployment configures no ` +
+                "toolkits. Declare them in `toolkits`, or drop the binding.");
+        }
+        for (const name of binding.toolkits) {
+            if (!toolkits.has(name)) {
+                throw new Error(`Inbound auth provider "${provider.kind}" binds unknown toolkit ` +
+                    `"${name}". Configured toolkits: ${[...toolkits.keys()].join(", ")}.`);
+            }
+        }
+    }
+}
 //# sourceMappingURL=toolkits.js.map

package/dist/toolkits.js.map

@@ -1 +1 @@
-{"version":3,"file":"toolkits.js","sourceRoot":"","sources":["../src/toolkits.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,sEAAsE;AACtE,4EAA4E;AAI5E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AA+B/C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe;IAEf,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAClC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CACjB,IAAY,EACZ,SAA+B,EAC/B,YAAiC,EACjC,WAAqD,EACrD,KAAsC;IAEtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,2EAA2E;QAC3E,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,KAAK,KAAK,4DAA4D,CACvF,CAAC;IACJ,CAAC;IACD,IACE,SAAS,KAAK,SAAS;QACvB,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,KAAK,KAAK,cAAc,EACxB,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,mCAAmC;QACnC,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,0GAA0G,CAC3H,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,KAAK,KAAK,WAAW,OAAO,+DAA+D,CAC5G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,wEAAwE;YACxE,8DAA8D;YAC9D,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,KAAK,KAAK,WAAW,OAAO,sBAAsB,KAAK,CAAC,WAAW,oDAAoD,CACxI,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,KAAK,KAAK,WAAW,OAAO,iCAAiC,KAAK,CAAC,WAAW,IAAI,CACnG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACtE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CACrB,IAAY,EACZ,UAA6B,EAC7B,KAA0B,EAC1B,WAAqD;IAErD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,iBAAiB,eAAe,CAAC,MAAM,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QACrC,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,0EAA0E,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,mCAAmC,EAAE,IAAI,CAC1D,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CACzB,IAAI,EACJ,UAAU,CAAC,YAAY,EACvB,YAAY,EACZ,WAAW,EACX,cAAc,CACf,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,CACzB,IAAI,EACJ,UAAU,CAAC,YAAY,EACvB,YAAY,EACZ,WAAW,EACX,cAAc,CACf,CAAC;IACF,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,YAAY,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5D,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAmC,EACnC,UAAgC;IAEhC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,yEAAyE;IACzE,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC3D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1B,WAAW,CAAC,GAAG,CACb,SAAS,CAAC,EAAE,EACZ,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"toolkits.js","sourceRoot":"","sources":["../src/toolkits.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,oCAAoC;AACpC,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,kCAAkC;AAClC,2EAA2E;AAC3E,6DAA6D;AAI7D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AA+B/C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe;IAEf,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAClC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CACjB,IAAY,EACZ,SAA+B,EAC/B,YAAiC,EACjC,WAAqD,EACrD,KAAsC;IAEtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,2EAA2E;QAC3E,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,KAAK,KAAK,4DAA4D,CACvF,CAAC;IACJ,CAAC;IACD,IACE,SAAS,KAAK,SAAS;QACvB,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,KAAK,KAAK,cAAc,EACxB,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,mCAAmC;QACnC,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,0GAA0G,CAC3H,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,KAAK,KAAK,WAAW,OAAO,+DAA+D,CAC5G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,wEAAwE;YACxE,8DAA8D;YAC9D,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,KAAK,KAAK,WAAW,OAAO,sBAAsB,KAAK,CAAC,WAAW,oDAAoD,CACxI,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,KAAK,KAAK,WAAW,OAAO,iCAAiC,KAAK,CAAC,WAAW,IAAI,CACnG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACtE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CACrB,IAAY,EACZ,UAA6B,EAC7B,KAA0B,EAC1B,WAAqD;IAErD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,iBAAiB,eAAe,CAAC,MAAM,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QACrC,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,0EAA0E,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,mCAAmC,EAAE,IAAI,CAC1D,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CACzB,IAAI,EACJ,UAAU,CAAC,YAAY,EACvB,YAAY,EACZ,WAAW,EACX,cAAc,CACf,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,CACzB,IAAI,EACJ,UAAU,CAAC,YAAY,EACvB,YAAY,EACZ,WAAW,EACX,cAAc,CACf,CAAC;IACF,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,YAAY,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5D,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAmC,EACnC,UAAgC;IAEhC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,yEAAyE;IACzE,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC3D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1B,WAAW,CAAC,GAAG,CACb,SAAS,CAAC,EAAE,EACZ,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAsBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,OAA8B;IAE9B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,yEAAyE;YACzE,2EAA2E;YAC3E,8DAA8D;YAC9D,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,2DAA2D;gBAClE,oEAAoE;gBACpE,+BAA+B,CAClC,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,mDAAmD,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,yEAAyE;YACzE,mDAAmD;YACnD,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY;gBAC/D,4BAA4B,eAAe,CAAC,MAAM,IAAI,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,iEAAiE;YACxE,sEAAsE;YACtE,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAsB;QACnD,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAG9B,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAsB;QACnD,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAiB,EACjB,WAAoB;IAIpB,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,4DAA4D;gBAC5D,sEAAsE;SACzE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,oEAAoE;gBACpE,sEAAsE;gBACtE,YAAY;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACrD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,CACrB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC/C;YACtB,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;gBACzD,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA4B,EAC5B,QAAkD;IAElD,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS;YAAE,SAAS;QACpD,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,CAAC,IAAI,yBAAyB;gBAC9D,+DAA+D;gBAC/D,aAAa,eAAe,CAAC,MAAM,+BAA+B,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,CAAC,IAAI,mBAAmB;gBACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC;gBACrE,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,CAAC,IAAI,0BAA0B;oBAC/D,IAAI,IAAI,2BAA2B,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -141,6 +141,19 @@ export interface Connector {
     testCredential?(value: string, ctx: ConnectorContext): Promise<CredentialTestResult>;
     /** Optional multi-field credential check used by /ui's Test action. */
     testCredentials?(values: ConnectorCredentialValues, ctx: ConnectorContext): Promise<CredentialTestResult>;
+    /**
+     * Optional: whether this connector currently holds a stored downstream
+     * credential — an OAuth grant it persisted, typically. Read only by the
+     * credential liveness checks: a connector with nothing stored has no
+     * credential whose liveness could be in question, and probing it anyway would
+     * start an authorization flow nobody asked for.
+     *
+     * Implement it on connectors that manage their own credential storage (the
+     * shipped `remoteMcp` does, for `auth: { type: "oauth" }`). Connectors whose
+     * credential lives in connecta's vault (`credential` above) need not: the
+     * vault answers for them. Must not perform downstream I/O.
+     */
+    hasStoredCredential?(ctx: ConnectorContext): Promise<boolean>;
     /**
      * Statically-known tool defs, exposed by in-code connectors (`api()`) for
      * startup convention checks. Remote connectors omit this — their tools are
@@ -204,11 +217,48 @@ export interface ExecutorProvider {
 export interface Executor {
     execute(code: string, providers: ExecutorProvider[]): Promise<ExecuteResult>;
 }
+/**
+ * Which toolkits one inbound identity may open — the membership half of the
+ * deployment=org / toolkit=team framing (§16). A mapping, never a policy
+ * engine: one identity → the toolkit names it may select, plus whether it may
+ * connect with no `?toolkit=` at all.
+ *
+ * An identity with NO binding is unbound and keeps the pre-binding behavior:
+ * any declared toolkit, or the full registry. A binding is enforced at connect
+ * time, before any scoped registry is constructed.
+ */
+export interface ToolkitBinding {
+    /** Toolkit names this identity may select with `?toolkit=<name>`. */
+    readonly toolkits: readonly string[];
+    /**
+     * Whether this identity may also connect with no `?toolkit=` and see the full
+     * registry (and read the deployment-wide operator surfaces). Defaults to
+     * false: binding a credential to a toolkit means binding it.
+     */
+    readonly unscoped?: boolean;
+}
 /** Result of an inbound-auth check. */
 export type AuthResult = {
     ok: true;
     userId?: string;
     subjectId?: string;
+    /**
+     * Toolkit binding resolved for THIS identity — the seam for an adapter
+     * that maps its own users (or an IdP claim) to views. Omit to inherit the
+     * provider's `toolkitBinding`.
+     *
+     * When the provider also declares one, the declaration is a **CEILING**,
+     * not a default: connecta intersects the two, and grants `unscoped` only
+     * if both do. A per-identity binding can therefore narrow the credential's
+     * view but never widen it — otherwise an adapter reading a user-writable
+     * claim would let the user name their own toolkits. When the provider
+     * declares nothing, this binding is used as given.
+     *
+     * Validated on arrival (a malformed one refuses the request with 403
+     * rather than being ignored), but never checked against the configured
+     * toolkits, which is only possible for the static declaration at startup.
+     */
+    toolkitBinding?: ToolkitBinding;
 } | {
     ok: false;
     response: Response;
@@ -217,8 +267,31 @@ export type AuthResult = {
 export type UiAuthConfig = {
     kind: "clerk";
     publishableKey: string;
+    /**
+     * Origin `/ui` fetches its browser sign-in loader from. **Must be an absolute
+     * `https:` URL** — the value lands in a `<script src>`, so the gate is
+     * stricter than the branding href gate: no `http:`, no loopback exemption, and
+     * no root-relative form (a relative path is rejected, not resolved). The
+     * shipped `clerkAuth` adapter derives this from the publishable key and
+     * Clerk's Frontend API is always https, so nothing legitimate needs a
+     * carve-out. A value that fails the gate reaches neither the loader tag nor
+     * the page's inline auth config: `/ui` renders without the loader and reports
+     * that Clerk could not load, and `createConnecta` names the drop in a startup
+     * warning.
+     */
     frontendApiUrl: string;
+    /**
+     * Hosted Account Portal sign-in address, handed to `Clerk.load`. **Must be an
+     * absolute `https:` URL** — the same gate `frontendApiUrl` passes, because
+     * this value is where Clerk *navigates* the operator's browser. An Account
+     * Portal address is always https, so the stricter gate costs nothing real: a
+     * value that fails it (a `javascript:`/`data:` payload, a cleartext `http:`
+     * address, a relative path) reaches no part of the page, `/ui` signs in
+     * through Clerk's default instead, and `createConnecta` names the drop in a
+     * startup warning.
+     */
     signInUrl?: string;
+    /** Hosted Account Portal sign-up address. Gated exactly like `signInUrl`. */
     signUpUrl?: string;
 };
 /**
@@ -267,6 +340,14 @@ export interface InboundAuth {
      * provider instead of asking the operator to paste a static bearer secret.
      */
     uiAuth?: UiAuthConfig;
+    /**
+     * Optional toolkit binding for every identity this provider admits (§16).
+     * Declared statically so `createConnecta` can validate the names against
+     * `ConnectaConfig.toolkits` and throw on a typo — a binding nobody wrote is
+     * not one an operator can reason about. An `authorize` result may narrow it
+     * per identity with its own `toolkitBinding`.
+     */
+    toolkitBinding?: ToolkitBinding;
     /** Serve/short-circuit .well-known + OPTIONS. Return null when not handled. */
     handleMetadata?(request: Request, baseUrl: string): Response | null | Promise<Response | null>;
     /** Attempt to authorize a request. */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,+DAA+D;AAC/D,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,MAAM,WAAW,eAAgB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/D,qEAAqE;AACrE,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C,yEAAyE;IACzE,MAAM,IAAI,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CACrD;AAED,iEAAiE;AACjE,MAAM,WAAW,8BAA8B;IAC7C,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;CAC3C;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACxC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,eAAe,GAAG,OAAO,CAAC;AAEpE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0GAA0G;IAC1G,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,4DAA4D;IAC5D,cAAc,CAAC,CACb,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,uEAAuE;IACvE,eAAe,CAAC,CACd,MAAM,EAAE,yBAAyB,EACjC,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;IACxB,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,uEAAuE;IACvE,MAAM,CAAC,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACzD;;;;;OAKG;IACH,SAAS,CAAC,CACR,GAAG,EAAE,gBAAgB,EACrB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACzB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,mFAAmF;IACnF,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,CACZ,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC7B;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC9E;AAED,uCAAuC;AACvC,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtC,yEAAyE;AACzE,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE;QACR,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,UAAU,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,+EAA+E;IAC/E,cAAc,CAAC,CACb,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC9C,sCAAsC;IACtC,SAAS,CACP,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,+DAA+D;AAC/D,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,MAAM,WAAW,eAAgB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/D,qEAAqE;AACrE,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C,yEAAyE;IACzE,MAAM,IAAI,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CACrD;AAED,iEAAiE;AACjE,MAAM,WAAW,8BAA8B;IAC7C,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;CAC3C;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACxC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,eAAe,GAAG,OAAO,CAAC;AAEpE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0GAA0G;IAC1G,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,4DAA4D;IAC5D,cAAc,CAAC,CACb,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,uEAAuE;IACvE,eAAe,CAAC,CACd,MAAM,EAAE,yBAAyB,EACjC,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;IACxB,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,uEAAuE;IACvE,MAAM,CAAC,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACzD;;;;;OAKG;IACH,SAAS,CAAC,CACR,GAAG,EAAE,gBAAgB,EACrB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACzB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,mFAAmF;IACnF,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,CACZ,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC7B;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC9E;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,uCAAuC;AACvC,MAAM,MAAM,UAAU,GAClB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtC,yEAAyE;AACzE,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE;QACR,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,UAAU,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,+EAA+E;IAC/E,cAAc,CAAC,CACb,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC9C,sCAAsC;IACtC,SAAS,CACP,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACrC"}