@zackbart/connecta 0.6.1 → 0.7.0

package/CHANGELOG.md

@@ -2,6 +2,262 @@
 
 All notable changes to this package are documented here.
 
+## 0.7.0 — 2026-07-27
+
+0.7.0 is the surface settlement: one release that finishes moving connecta's
+public shape so that it can stop moving. It arrives from two directions at once.
+A controlled qualification pass against 0.6.1 (issue #86) measured four ways a
+deployment could be worn down — an unbounded cache, an enumerable callback, a
+session leak, and a credential that reports itself usable and then isn't — and
+those are fixed here. Meanwhile the config surface had accumulated eleven flat
+tuning fields, the reference manual had reached 2,600 lines, and the operator UI
+was one page pretending to be three. Those are settled here too, and settling
+them breaks things, which is the argument for doing it in one release instead of
+spreading it across three.
+
+**What breaks.** Three things, and each is a compile error or a loud refusal
+rather than a behavior change you have to notice on your own. Every flat 0.6.x
+tuning option is removed in favour of four grouped ones. A connector that
+implements `finishAuth` without `verifyState` can no longer complete OAuth. And
+`/`, `/credentials`, and `/activity` are now core-owned routes, so a connector
+`handleRequest` that served any of them is shadowed. The first is mechanical:
+`createConnecta` throws once, before it reads anything else, naming every legacy
+path it found and its replacement.
+
+**What a deployment can ignore.** The defaults and runtime behavior of every
+config option are unchanged — only the paths moved. `/ui` bookmarks keep working
+through a permanent redirect, and all 17 documentation anchors still resolve
+even though the manual is now nine files. If you configure connecta with a
+literal object, do not paginate a downstream MCP server, and write your own
+connectors against `remoteMcp`/`api` rather than hand-rolling `finishAuth`, the
+whole migration is a mechanical rewrite of one config block.
+
+### Breaking
+
+- **`ConnectaConfig` tuning is grouped by subsystem for 0.7.0** (issue #28).
+  The flat 0.6.x options are removed rather than deprecated: TypeScript rejects
+  them, and JavaScript callers get one fail-fast error from `createConnecta`
+  listing every legacy own property it finds and its replacement. Supplying
+  both an old and a new path is still an error; there is no precedence rule or
+  compatibility alias. Migrate configuration as follows:
+
+  | 0.6.x | 0.7.0 |
+  |---|---|
+  | `activity` | `activity.store` |
+  | `activityReadGate` | `activity.readGate` |
+  | `activityDeploymentId` | `activity.deploymentId` |
+  | `credentialEncryptionKey` | `credentials.encryptionKey` |
+  | `credentialHealth` | `credentials.health` |
+  | `toolCacheTtlSeconds` | `discovery.catalogTtlSeconds` |
+  | `persistToolCatalog` | `discovery.persistCatalog` |
+  | `toolCatalogStaleSeconds` | `discovery.staleCatalogSeconds` |
+  | `probeTimeoutMs` | `discovery.probeTimeoutMs` |
+  | `defaultToolTimeoutMs` | `calls.defaultTimeoutMs` |
+  | `maxResultBytes` | `calls.maxResultBytes` |
+
+  For example:
+
+  ```ts
+  // 0.6.x
+  createConnecta({
+    connectors,
+    storage,
+    activity,
+    credentialEncryptionKey: env.CONNECTA_CREDENTIAL_KEY,
+    toolCacheTtlSeconds: 300,
+    defaultToolTimeoutMs: 30_000,
+    maxResultBytes: 50_000,
+  });
+
+  // 0.7.0
+  createConnecta({
+    connectors,
+    storage,
+    activity: { store: activity },
+    credentials: { encryptionKey: env.CONNECTA_CREDENTIAL_KEY },
+    discovery: { catalogTtlSeconds: 300 },
+    calls: { defaultTimeoutMs: 30_000, maxResultBytes: 50_000 },
+  });
+  ```
+
+  The defaults and runtime behavior of each option are unchanged. Connector
+  definitions keep their per-connector `maxResultBytes`, and structural seams
+  such as `storage`, `auth`, `connectors`, `toolkits`, and `executor` remain at
+  the top level.
+- **A connector implementing `finishAuth` without `verifyState` can no longer
+  complete OAuth** (issue #62). Such a connector previously exchanged the
+  authorization code with no CSRF guard at all — connecta had no way to
+  establish that it had started the flow being completed. The callback now
+  refuses with the same opaque 400 as every other refusal, exchanges no code,
+  and logs one operator-grade line naming the connector and the missing hook.
+  `verifyState` stays optional in the type system and is required in practice
+  wherever `finishAuth` is present. The shipped `remoteMcp` OAuth provider has
+  always implemented it, so this reaches hand-written connectors only.
+- **`/`, `/credentials`, and `/activity` are now core-owned routes** (issue
+  #57). They previously fell through to connector `handleRequest` and then to a
+  404, so a connector serving any of the three is now shadowed without warning.
+  `GET /` returns the operator shell where 0.6.1 returned 404, and non-GET on
+  those routes and on `/ui` returns 405 rather than falling through.
+
+### Added
+
+- **`Connector.closeScope?(ctx)`** (issue #66) — an optional, best-effort seam
+  for releasing whatever a connector opened for one scope. Called at most once,
+  inside a fixed 100 ms completion window: a hook that is absent, throws, or
+  never settles cannot replace, corrupt, or delay the result of the operation
+  that triggered it. `remoteMcp` implements it, tearing down cached and
+  half-open sessions and fencing late connection races. Connectors that do not
+  implement it are unaffected.
+
+### Changed
+
+- **The operator UI is now a direct-linkable three-page set** (issue #57):
+  Connections at `/`, Credentials at `/credentials`, and Activity at
+  `/activity`. `GET /ui` remains as a permanent `308` compatibility redirect to
+  `/`. The pages use semantic navigation, path-specific titles, direct
+  load/refresh/bookmark and Back/Forward behavior, and the same restrained
+  responsive connector-ledger design. They are three routes over one
+  no-build-step client implementation, not copied applications.
+- **Every canonical operator route serves the same open, data-free shell.** The
+  nonce CSP, framing denial, referrer policy, HSTS behavior, content-type
+  protection, URL gates, and escaping guarantees formerly attached to `/ui`
+  apply equally to `/`, `/credentials`, and `/activity`. Deployment data remains
+  behind the unchanged private APIs: `/ui/data`, `/ui/activity`, and
+  `/ui/credentials/<connectorId>[/test]`.
+- **Vault controls moved out of connector cards and into Credentials.**
+  Connections remains read-only status; Credentials preserves Add/Replace/Test/
+  Remove, masked metadata, stored-shape recovery, and live feedback without ever
+  returning a secret. Its explicit capability states cover eligible Clerk
+  operators, bearer-only sessions, missing vaults, and deployments with no
+  credential slots without broadening the existing Clerk/user-id/toolkit/
+  same-origin mutation boundary. Activity likewise renders an explicit
+  not-configured state when `activity.store.list` is absent. OAuth result pages
+  now return to `/`.
+- **The reference manual is nine documents instead of one** (issue #61).
+  `docs/documentation.md` had reached 2,600 lines; it is now a compatibility
+  index that preserves all 17 `#N-…` anchors, so every existing deep link from
+  the README, the examples, and source comments still resolves. The prose moved
+  to `architecture`, `meta-tools`, `connectors`, `auth`,
+  `storage-and-credentials`, `operations`, `code-mode`, `operator-ui`, and
+  `toolkits`. A new `npm run check:docs` validates local links, fragments,
+  heading slugs, and the legacy-anchor manifest, and runs first in
+  `npm run check`. Contributor-facing only: the published package is unchanged
+  and docs still ship in no tarball.
+
+### Fixed
+
+- **`clerkAuth`'s identity-decision cache is bounded at 1,024 identities per
+  instance** (issue #70). It never evicted: every distinct identity that reached
+  the gate was retained for the lifetime of the isolate. `allowedDomains` made
+  that attacker-reachable on an open-signup Clerk instance, since an
+  authenticated-but-denied identity is still a cache entry — 100,000 denied
+  identities measured at roughly 11.96 MiB retained, with the oldest entry still
+  present. Eviction is LRU, so a small active set stays hot, and the only thing
+  evicting an entry can cause is a fresh check against Clerk: it can never turn
+  a denial into an admission, and it cannot extend an allow past its TTL, since
+  a cache hit re-inserts the same record rather than restamping it. The bound is
+  deliberately fixed rather than an operator knob, and the ~60 s allow / ~30 s
+  deny windows are unchanged.
+- **`/oauth/callback/<id>` no longer lets an unauthenticated caller enumerate
+  configured connector ids** (issue #62). 0.6.1 answered `404 Unknown connector
+  "<id>"` for an id it did not recognise and a distinct 400 for a state
+  mismatch, which made the callback a free directory of every connector a
+  deployment had configured. Unknown ids, non-OAuth connectors, missing or
+  mismatched state, an absent verifier, and a throwing verifier now return one
+  byte-identical 400 — same status, same body, same headers. They also cost the
+  same single storage read, so the clock cannot sort the ids the body refuses to
+  name. That is cost equalisation rather than constant time, and the
+  documentation says so and enumerates what stays distinguishable. The precise
+  diagnosis moved to the operator log, bounded and escaped.
+- **Probe-opened downstream MCP sessions are closed instead of abandoned**
+  (issue #66). Credential-health sweeps, `list_connectors({ probe: true })`, and
+  `/ui/data` each opened downstream sessions and left them for the provider to
+  age out — measured at 200 probes opening 200 sessions and explicitly closing
+  zero, made continuous by the periodic sweep. Closing now ends the session
+  rather than merely dropping the local client: `remoteMcp` issues the
+  specification's `DELETE` carrying `Mcp-Session-Id` *before* the close that
+  would otherwise abort it, feature-detected and best-effort, while a stateless
+  downstream issues none. A downstream that refuses, errors, or never answers is
+  closed anyway. One consequence worth knowing: a probing `list_connectors` now
+  runs on its own scope rather than the request's — it has to, since a request
+  scope cannot be closed — so a request that probes *and* then calls the same
+  connector opens two downstream sessions where it opened one. Per-request
+  `/mcp` scopes are unchanged.
+- **A credential stored under an older declaration no longer reports itself
+  usable and then fails** (issue #69). `/ui`, the credential Test route, and
+  credential health each interpreted the stored shape slightly differently, so a
+  credential could render as configured and testable and then answer 409 with a
+  misleading configure-first message. One pure classifier now answers for all
+  three, and it asks about *containment* rather than equality: a stored set is
+  fine as long as it holds every field the declaration currently names. A
+  missing declared field is drift — which covers every case issue #69 reported,
+  including a rename and a swap between the single-value and named shapes in
+  either direction — and drift is never auto-migrated. Credentials keeps Replace
+  and Remove and hides Test, the test route answers 409 without calling a hook,
+  and health records an explicit error rather than a fabricated verdict, checked
+  before the freshness gate so a stale `ok` cannot mask a redeploy. Leftover
+  keys are explicitly *not* drift: dropping a field from a declaration leaves
+  its secret in the vault, but every accessor keeps returning the right value
+  and every call keeps working, so calling that drift would tell an operator to
+  re-enter a credential that works and that many providers will not reissue in
+  readable form. Credentials prints one non-blocking line naming the leftovers
+  instead. A repeated drift verdict is charged to the freshness budget rather
+  than rewritten on every sweep in every isolate.
+- **A paginated downstream MCP server no longer loses everything after its
+  first `tools/list` page** (issue #77). `tools/list` is cursor-paginated in the
+  MCP specification and the SDK's `Client.listTools()` returns one page,
+  `nextCursor` included, without following it. `remoteMcp()` called it once, so
+  a downstream that paged its catalog was split in half without complaint:
+  page-one tools were counted, searchable, describable and callable, and every
+  tool after them appeared not to exist — missing from `list_connectors` counts,
+  `search_tools`, `describe_tools`, and address resolution alike, with nothing
+  in any log saying a page had been left behind. That is the wrong failure for
+  a product whose premise is progressive discovery over large tool catalogs,
+  since large catalogs are exactly the ones that paginate. A catalog refresh now
+  walks the whole cursor chain on the same request-scoped client before the
+  result is indexed. Cursors are handed back byte-for-byte and never parsed,
+  rewritten, or persisted; an empty-string `nextCursor` is treated as *present*
+  (pagination ends on an absent one, and a truthiness check there would truncate
+  the catalog silently). A downstream that advertises no `nextCursor` is
+  unchanged in both directions: one request, sent with no `cursor` param, and
+  byte-identical tool definitions. Tools are deduplicated by name, first page
+  wins, so an unstable cursor that overlaps pages cannot inflate `toolCount`,
+  double a `search_tools` row, or churn the registry into a persistence write
+  per refresh. A `nextCursor: null` — a common JSON idiom for end-of-pagination
+  that the MCP result schema does not accept — is now reported as a named
+  nonconformance instead of a raw Zod dump. Any page that fails fails the whole
+  refresh rather than publishing a prefix, so the registry keeps serving the
+  last complete catalog through its existing stale fallback.
+
+  The walk is bounded on **tools**, not pages. A page ceiling is the wrong
+  dimension — the server picks the page size, so N pages is N × a number
+  connecta cannot observe, and the common conformant idiom of "advertise a
+  cursor whenever the page came back full, then serve one empty page to
+  terminate" means a well-behaved 10,000-tool server paging at 100 spends 101
+  requests. So a refresh now fails immediately on a cursor handed back twice,
+  fails on two consecutive pages that add nothing while still promising more
+  (one is legal — that empty terminator), caps what it accumulates at
+  `MAX_TOOLS` (100,000, the top of the catalog envelope issue #82 benchmarks),
+  and keeps `MAX_TOOL_PAGES` (raised to 10,000) only as an unreachable runaway
+  backstop. These bounds make an unterminating walk finite and report it as a
+  connector error; they do not cancel one that a probe deadline has already
+  abandoned, because `withTimeout` bounds the caller's wait rather than the
+  work.
+
+- **Downstream output-schema validation now covers every page of a paginated
+  catalog, not just the last one** (issue #77). The MCP SDK's
+  `Client.listTools()` rebuilds its output-schema validators and task-support
+  sets from each page it receives, clearing them first — so walking the cursor
+  chain left the request-scoped client validating the final page alone. A
+  `call_tool` against any earlier-page tool then found no validator and
+  silently skipped both the "declared an `outputSchema` but returned no
+  `structuredContent`" check and the structured-content validation, and lost
+  the required-task guard with them. Enforcement depended on which page a tool
+  happened to land on. A completed walk now re-primes that cache once from the
+  full aggregated catalog; a test asserts the pinned SDK still provides the
+  method it reaches for, so a future bump fails CI rather than quietly
+  restoring the gap.
+
 ## 0.6.1 — 2026-07-26
 
 A patch release: three bug fixes and a documentation overhaul. No new

package/README.md

@@ -62,12 +62,13 @@ platform to administer.
 
 **Credentials stay server-side.** Downstream tokens live in an AES-GCM encrypted
 vault over the deployment's own storage, with the key held outside it. A
-connector reaches its own credential through `ctx.credential`; `/ui`, the
-meta-tools, and the code sandbox only ever see masked metadata. Rotating a token
-is an operator action rather than a redeploy — though writing to the vault is
-deliberately narrower than everything else, requiring a Clerk-authenticated
-operator on a same-origin request, so a bearer-only deployment cannot administer
-credentials from the browser. Which tools exist is still code either way.
+connector reaches its own credential through `ctx.credential`; the operator
+pages, meta-tools, and code sandbox never expose a secret value. Rotating a token
+at `/credentials` is an operator action rather than a redeploy — though writing
+to the vault is deliberately narrower than everything else, requiring a
+Clerk-authenticated operator on a same-origin request, so a bearer-only
+deployment cannot administer credentials from the browser. Which tools exist
+is still code either way.
 
 **Read-only is fail-closed.** Only tools explicitly annotated `readOnlyHint:
 true` are reachable through `call_tool`, `batch_call`, and the sandbox. Missing,
@@ -93,14 +94,16 @@ generated code, search text, or raw error messages. The exclusion is structural
 rather than a redaction pass: the event type has nowhere to put a payload, which
 is what keeps an operations log from becoming something worth stealing.
 
-**An operator dashboard that can only look.** `GET /ui` is a read-only status
-page with no build step: connector health, tool counts, downstream authorization
-links, credential controls, and an activity tab when a store is configured. It
-displays state and administers credentials; it cannot change what an agent is
-allowed to call. Credentials connecta stores are also probed for liveness
+**Operator pages that cannot administer the deployment.** Connections at `GET /`
+shows connector health, tool counts, and downstream authorization links;
+`/credentials` rotates stored secrets; and `/activity` shows the optional
+payload-free ledger. They share one data-free shell with no build step and use
+authenticated private APIs for deployment data. They cannot add a connector,
+change policy, or alter what an agent may call. Credentials connecta stores are
+also probed for liveness
 proactively — using each connector's own test or status hook, never a downstream
 tool call — so a dead token surfaces as `auth_required` with the URL to open on
-`/ui` and in `list_connectors` before an agent's real call trips over it.
+Connections and in `list_connectors` before an agent's real call trips over it.
 
 ## When not to use it
 
@@ -154,7 +157,7 @@ const connecta = createConnecta({
   ],
 });
 
-listen(connecta, 8787); // MCP at http://localhost:8787/mcp, status at /ui
+listen(connecta, 8787); // MCP at /mcp; Connections at http://localhost:8787/
 ```
 
 Point an MCP client at `http://localhost:8787/mcp` with an
@@ -180,13 +183,14 @@ endpoint, credential, and tool choices stay in your project, declared with
 ## Learn more
 
 - **[Documentation](https://github.com/zackbart/connecta/blob/main/docs/documentation.md)**
-  — the reference manual: architecture, connectors, inbound auth and downstream
-  OAuth, storage, Clerk setup, testing, and troubleshooting. Start with the
-  [meta-tools reference](https://github.com/zackbart/connecta/blob/main/docs/documentation.md#3-meta-tools-reference),
-  the [config options](https://github.com/zackbart/connecta/blob/main/docs/documentation.md#8-running-it),
-  [code mode](https://github.com/zackbart/connecta/blob/main/docs/documentation.md#13-code-mode-execute_code),
-  [toolkits](https://github.com/zackbart/connecta/blob/main/docs/documentation.md#16-toolkits-scoped-views),
-  or [credential health](https://github.com/zackbart/connecta/blob/main/docs/documentation.md#17-credential-health-proactive-liveness-checks).
+  — the reference index for architecture, connectors, inbound auth and
+  downstream OAuth, storage, Clerk setup, testing, and troubleshooting. Start
+  with the [meta-tools reference](https://github.com/zackbart/connecta/blob/main/docs/meta-tools.md#meta-tools-reference),
+  the [config options](https://github.com/zackbart/connecta/blob/main/docs/operations.md#running-it),
+  [code mode](https://github.com/zackbart/connecta/blob/main/docs/code-mode.md#code-mode-execute_code),
+  [toolkits](https://github.com/zackbart/connecta/blob/main/docs/toolkits.md#toolkits-scoped-views),
+  [operator pages](https://github.com/zackbart/connecta/blob/main/docs/operator-ui.md#status-ui),
+  or [credential health](https://github.com/zackbart/connecta/blob/main/docs/storage-and-credentials.md#credential-health-proactive-liveness-checks).
 - **[Decisions](https://github.com/zackbart/connecta/blob/main/docs/decisions.md)**
   — what connecta refuses to be, which alternatives lost and why, and the
   invariants a change must preserve.

package/dist/auth/bearer.d.ts

@@ -9,9 +9,10 @@ export interface BearerTokenOptions extends ToolkitBindingOptions {
  * against `secret`. Checked BEFORE the Clerk gate in the server; a mismatch
  * falls through so a co-configured Clerk provider can still admit the request.
  *
- * `toolkits` binds the token to named toolkits (§16): one `bearerToken(...)` per
- * team credential, each naming the view that team may open. Omit it and the
- * token stays unbound — every declared toolkit plus the full registry.
+ * `toolkits` binds the token to named toolkits (docs/toolkits.md): one
+ * `bearerToken(...)` per team credential, each naming the view that team may
+ * open. Omit it and the token stays unbound — every declared toolkit plus the
+ * full registry.
  */
 export declare function bearerToken(secret: string, options?: BearerTokenOptions): InboundAuth;
 //# sourceMappingURL=bearer.d.ts.map

package/dist/auth/bearer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB3D,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAC/D,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC/B,WAAW,CAiDb"}
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB3D,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAC/D,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC/B,WAAW,CAkDb"}

package/dist/auth/bearer.js

@@ -19,9 +19,10 @@ function timingSafeEqual(a, b) {
  * against `secret`. Checked BEFORE the Clerk gate in the server; a mismatch
  * falls through so a co-configured Clerk provider can still admit the request.
  *
- * `toolkits` binds the token to named toolkits (§16): one `bearerToken(...)` per
- * team credential, each naming the view that team may open. Omit it and the
- * token stays unbound — every declared toolkit plus the full registry.
+ * `toolkits` binds the token to named toolkits (docs/toolkits.md): one
+ * `bearerToken(...)` per team credential, each naming the view that team may
+ * open. Omit it and the token stays unbound — every declared toolkit plus the
+ * full registry.
  */
 export function bearerToken(secret, options = {}) {
     const secretBytes = encoder.encode(secret);
@@ -30,11 +31,12 @@ export function bearerToken(secret, options = {}) {
         : "bearerToken", options);
     if (toolkitBinding && !options.subjectId) {
         // A bound token stands for one team, and both surfaces that report on it —
-        // the 403 refusal log (§16) and activity events (§15) — can only say
-        // "bearer" without a subjectId. With several bound tokens that makes an
-        // operator unable to tell which credential was refused, or whose call
-        // succeeded. console.warn (as the Clerk adapter does) because an adapter is
-        // constructed before `createConnecta` has a logger to hand it.
+        // the 403 refusal log (docs/toolkits.md) and activity events
+        // (docs/operator-ui.md) — can only say "bearer" without a subjectId. With
+        // several bound tokens that makes an operator unable to tell which
+        // credential was refused, or whose call succeeded. console.warn (as the
+        // Clerk adapter does) because an adapter is constructed before
+        // `createConnecta` has a logger to hand it.
         console.warn("[connecta] bearerToken is bound to toolkits " +
             `(${toolkitBinding.toolkits.join(", ") || "unscoped only"}) but has no ` +
             "subjectId: refusal logs and activity events cannot say which " +

package/dist/auth/bearer.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,qFAAqF;AACrF,SAAS,eAAe,CAAC,CAAa,EAAE,CAAa;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,UAA8B,EAAE;IAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,qBAAqB,CAC1C,OAAO,CAAC,SAAS;QACf,CAAC,CAAC,2BAA2B,OAAO,CAAC,SAAS,IAAI;QAClD,CAAC,CAAC,aAAa,EACjB,OAAO,CACR,CAAC;IACF,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,2EAA2E;QAC3E,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,4EAA4E;QAC5E,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CACV,8CAA8C;YAC5C,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,eAAe;YACxE,+DAA+D;YAC/D,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,SAAS,CAAC,OAAO;YACf,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;gBACpE,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,kBAAkB,EAAE,QAAQ;qBAC7B;iBACF,CACF;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,qFAAqF;AACrF,SAAS,eAAe,CAAC,CAAa,EAAE,CAAa;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,UAA8B,EAAE;IAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,qBAAqB,CAC1C,OAAO,CAAC,SAAS;QACf,CAAC,CAAC,2BAA2B,OAAO,CAAC,SAAS,IAAI;QAClD,CAAC,CAAC,aAAa,EACjB,OAAO,CACR,CAAC;IACF,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,2EAA2E;QAC3E,6DAA6D;QAC7D,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,+DAA+D;QAC/D,4CAA4C;QAC5C,OAAO,CAAC,IAAI,CACV,8CAA8C;YAC5C,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,eAAe;YACxE,+DAA+D;YAC/D,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,SAAS,CAAC,OAAO;YACf,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;gBACpE,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,kBAAkB,EAAE,QAAQ;qBAC7B;iBACF,CACF;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/clerk.d.ts

@@ -23,9 +23,9 @@ export interface ClerkAuthOptions extends ToolkitBindingOptions {
     gate?: (userId: string, clerk: ClerkClient) => boolean | Promise<boolean>;
     /** Advertised scopes in protected-resource metadata. */
     scopes?: string[];
-    /** Optional hosted Account Portal sign-in URL for `/ui`. Absolute https only. */
+    /** Optional hosted Account Portal sign-in URL for operator pages. Absolute https only. */
     signInUrl?: string;
-    /** Optional hosted Account Portal sign-up URL for `/ui`. Absolute https only. */
+    /** Optional hosted Account Portal sign-up URL for operator pages. Absolute https only. */
     signUpUrl?: string;
 }
 /**
@@ -34,11 +34,12 @@ export interface ClerkAuthOptions extends ToolkitBindingOptions {
  * `allowedDomains` and `gate` decide WHO is admitted (both must pass);
  * `toolkits` decides WHICH view the admitted user gets.
  *
- * `toolkits` binds every user this provider admits to those toolkits (§16). For
- * a per-team split, configure one `clerkAuth(...)` per team — the same keys, a
- * `gate` naming that team's users, and that team's `toolkits`. The server tries
- * providers in order and the first that admits the user supplies the binding, so
- * a user one gate rejects falls through to the next.
+ * `toolkits` binds every user this provider admits to those toolkits
+ * (docs/toolkits.md). For a per-team split, configure one `clerkAuth(...)` per
+ * team — the same keys, a `gate` naming that team's users, and that team's
+ * `toolkits`. The server tries providers in order and the first that admits the
+ * user supplies the binding, so a user one gate rejects falls through to the
+ * next.
  */
 export declare function clerkAuth(opts: ClerkAuthOptions): InboundAuth;
 export {};

package/dist/auth/clerk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clerk.d.ts","sourceRoot":"","sources":["../../src/auth/clerk.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAExD,MAAM,WAAW,gBAAiB,SAAQ,qBAAqB;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA0ID;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,CA0O7D"}
+{"version":3,"file":"clerk.d.ts","sourceRoot":"","sources":["../../src/auth/clerk.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAExD,MAAM,WAAW,gBAAiB,SAAQ,qBAAqB;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA+ID;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,CAuP7D"}

package/dist/auth/clerk.js

@@ -28,6 +28,11 @@ function fapiUrl(publishableKey) {
 }
 const GATE_ALLOWED_TTL_MS = 60 * 1000;
 const GATE_FORBIDDEN_TTL_MS = 30 * 1000;
+// Per clerkAuth instance. This is deliberately fixed rather than an operator
+// knob: admission correctness never depends on retaining an entry, and 1,024
+// keeps the common steady identity set hot without letting one-off denied
+// identities define the isolate's lifetime memory footprint.
+const GATE_CACHE_MAX_IDENTITIES = 1_024;
 /**
  * One label of a domain: ASCII letters/digits, interior hyphens only, 63
  * characters at most. ASCII-only is deliberate — an internationalized domain
@@ -127,11 +132,12 @@ function emailDomain(email) {
  * `allowedDomains` and `gate` decide WHO is admitted (both must pass);
  * `toolkits` decides WHICH view the admitted user gets.
  *
- * `toolkits` binds every user this provider admits to those toolkits (§16). For
- * a per-team split, configure one `clerkAuth(...)` per team — the same keys, a
- * `gate` naming that team's users, and that team's `toolkits`. The server tries
- * providers in order and the first that admits the user supplies the binding, so
- * a user one gate rejects falls through to the next.
+ * `toolkits` binds every user this provider admits to those toolkits
+ * (docs/toolkits.md). For a per-team split, configure one `clerkAuth(...)` per
+ * team — the same keys, a `gate` naming that team's users, and that team's
+ * `toolkits`. The server tries providers in order and the first that admits the
+ * user supplies the binding, so a user one gate rejects falls through to the
+ * next.
  */
 export function clerkAuth(opts) {
     const clerk = createClerkClient({
@@ -205,8 +211,16 @@ export function clerkAuth(opts) {
         if (!opts.gate && !allowedDomains)
             return true;
         const hit = gateCache.get(userId);
-        if (hit && Date.now() < hit.exp)
-            return hit.allowed;
+        if (hit) {
+            if (Date.now() < hit.exp) {
+                // Map iteration order is the LRU order. Refreshing a valid hit keeps a
+                // small active identity set resident when one-off identities churn.
+                gateCache.delete(userId);
+                gateCache.set(userId, hit);
+                return hit.allowed;
+            }
+            gateCache.delete(userId);
+        }
         let allowed = false;
         try {
             allowed =
@@ -221,6 +235,11 @@ export function clerkAuth(opts) {
             exp: Date.now() +
                 (allowed ? GATE_ALLOWED_TTL_MS : GATE_FORBIDDEN_TTL_MS),
         });
+        if (gateCache.size > GATE_CACHE_MAX_IDENTITIES) {
+            const oldest = gateCache.keys().next();
+            if (!oldest.done)
+                gateCache.delete(oldest.value);
+        }
         return allowed;
     };
     return {
@@ -269,7 +288,7 @@ export function clerkAuth(opts) {
             let userId;
             try {
                 const state = await clerk.authenticateRequest(request, {
-                    // MCP clients use Clerk OAuth access tokens; the browser dashboard
+                    // MCP clients use Clerk OAuth access tokens; the browser operator UI
                     // uses the signed-in operator's short-lived Clerk session token.
                     // authorizedParties must NOT be passed here: OAuth access tokens may
                     // be JWTs without an azp claim, and Clerk rejects azp=undefined when

package/dist/auth/clerk.js.map

@@ -1 +1 @@
-{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../../src/auth/clerk.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,gFAAgF;AAChF,yBAAyB;AAEzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAgCxB,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAC5B,mDAAmD;CACtD,CAAC;AAEF,oEAAoE;AACpE,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IACpD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,cAAsB;IACrC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO,WAAW,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAElE;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,CACL,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,MAAM,IAAI,GAAG;QACpB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,KAAoC;IAEpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,yEAAyE;QACzE,yEAAyE;QACzE,+CAA+C;QAC/C,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mBAAmB,CAChF,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC/B,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY;gBACtE,+CAA+C,IAAI,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAC7C,iBAAiB,EACjB,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAC9C,CAAC;IACF,OAAO,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,IAAsB;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEvE,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAEnE,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,YAAqB,EAAY,EAAE;QACxE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,uCAAuC,CAAC;QAC5E,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,UAAU,KAAK,sBAAsB,IAAI,GAAG;aACjE;SACF,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,GAAa,EAAE,CAC/B,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IAEJ;;;;;OAKG;IACH,MAAM,WAAW,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE;QAC7D,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CACvC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,qBAAqB,CACvD,CAAC;YACF,IAAI,OAAO,EAAE,YAAY,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjD,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,4CAA4C,MAAM,KAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,YAAY,CACb,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,uBAAuB;YACvB,OAAO,CAAC,IAAI,CACV,yBAAyB,MAAM,wCAAwC;gBACrE,8BAA8B,CACjC,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,yEAAyE;YACzE,mEAAmE;YACnE,OAAO,CAAC,IAAI,CACV,yBAAyB,MAAM,wBAAwB;gBACrD,GAAG,cAAc,CAAC,MAAM,CAAC,2BAA2B,CACvD,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACpD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO;gBACL,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;oBAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE;YACpB,OAAO;YACP,GAAG,EACD,IAAI,CAAC,GAAG,EAAE;gBACV,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC;SAC1D,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;QAED,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO;YACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEvD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,IACE,QAAQ,KAAK,uCAAuC;gBACpD,QAAQ,KAAK,2CAA2C,EACxD,CAAC;gBACD,OAAO,QAAQ,CAAC,IAAI,CAClB;oBACE,QAAQ,EAAE,GAAG,IAAI,MAAM;oBACvB,qBAAqB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBACrD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;oBACpC,gBAAgB,EAAE,MAAM;iBACzB,EACD,EAAE,OAAO,EAAE,YAAY,EAAE,CAC1B,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,KAAK,yCAAyC,EAAE,CAAC;gBAC3D,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,yCAAyC,CACzE,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,oDAAoD,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CACvC,CAAC;oBACJ,CAAC;oBACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,oDAAoD,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CACvC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO;YAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;YACnE,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE;oBACrD,mEAAmE;oBACnE,iEAAiE;oBACjE,qEAAqE;oBACrE,qEAAqE;oBACrE,+DAA+D;oBAC/D,mEAAmE;oBACnE,YAAY,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;iBAC/C,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;oBAC3B,4DAA4D;oBAC5D,uDAAuD;oBACvD,MAAM,MAAM,GAAG,KAA8C,CAAC;oBAC9D,OAAO,CAAC,IAAI,CACV,6CAA6C,KAAK,CAAC,MAAM,EAAE;wBACzD,WAAW,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE;wBACjE,eAAe,UAAU,CAAC,OAAO,CAAC,EAAE,CACvC,CAAC;oBACF,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC;qBAC9C,CAAC;gBACJ,CAAC;gBACD,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,MAAM,KAAK,GAAG,IAIb,CAAC;gBACF,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC;oBACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;oBACpD,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;wBAC1B,OAAO,CAAC,IAAI,CACV,8CAA8C,GAAG,aAAa,MAAM,EAAE,CACvE,CAAC;wBACF,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC;yBAC9C,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CACV,+CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,eAAe,UAAU,CAAC,OAAO,CAAC,EAAE,CACrC,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../../src/auth/clerk.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,gFAAgF;AAChF,yBAAyB;AAEzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAgCxB,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAC5B,mDAAmD;CACtD,CAAC;AAEF,oEAAoE;AACpE,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IACpD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,cAAsB;IACrC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO,WAAW,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,6DAA6D;AAC7D,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAElE;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,CACL,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,MAAM,IAAI,GAAG;QACpB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,KAAoC;IAEpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,yEAAyE;QACzE,yEAAyE;QACzE,+CAA+C;QAC/C,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mBAAmB,CAChF,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC/B,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY;gBACtE,+CAA+C,IAAI,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAC7C,iBAAiB,EACjB,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAC9C,CAAC;IACF,OAAO,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CAAC,IAAsB;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEvE,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAEnE,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,YAAqB,EAAY,EAAE;QACxE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,uCAAuC,CAAC;QAC5E,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,UAAU,KAAK,sBAAsB,IAAI,GAAG;aACjE;SACF,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,GAAa,EAAE,CAC/B,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IAEJ;;;;;OAKG;IACH,MAAM,WAAW,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE;QAC7D,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CACvC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,qBAAqB,CACvD,CAAC;YACF,IAAI,OAAO,EAAE,YAAY,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjD,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,4CAA4C,MAAM,KAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,YAAY,CACb,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,uBAAuB;YACvB,OAAO,CAAC,IAAI,CACV,yBAAyB,MAAM,wCAAwC;gBACrE,8BAA8B,CACjC,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,yEAAyE;YACzE,mEAAmE;YACnE,OAAO,CAAC,IAAI,CACV,yBAAyB,MAAM,wBAAwB;gBACrD,GAAG,cAAc,CAAC,MAAM,CAAC,2BAA2B,CACvD,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;gBACzB,uEAAuE;gBACvE,oEAAoE;gBACpE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzB,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC3B,OAAO,GAAG,CAAC,OAAO,CAAC;YACrB,CAAC;YACD,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO;gBACL,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;oBAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE;YACpB,OAAO;YACP,GAAG,EACD,IAAI,CAAC,GAAG,EAAE;gBACV,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;QAED,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO;YACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEvD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,IACE,QAAQ,KAAK,uCAAuC;gBACpD,QAAQ,KAAK,2CAA2C,EACxD,CAAC;gBACD,OAAO,QAAQ,CAAC,IAAI,CAClB;oBACE,QAAQ,EAAE,GAAG,IAAI,MAAM;oBACvB,qBAAqB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBACrD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;oBACpC,gBAAgB,EAAE,MAAM;iBACzB,EACD,EAAE,OAAO,EAAE,YAAY,EAAE,CAC1B,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,KAAK,yCAAyC,EAAE,CAAC;gBAC3D,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,yCAAyC,CACzE,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,oDAAoD,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CACvC,CAAC;oBACJ,CAAC;oBACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,oDAAoD,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CACvC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO;YAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;YACnE,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE;oBACrD,qEAAqE;oBACrE,iEAAiE;oBACjE,qEAAqE;oBACrE,qEAAqE;oBACrE,+DAA+D;oBAC/D,mEAAmE;oBACnE,YAAY,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;iBAC/C,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;oBAC3B,4DAA4D;oBAC5D,uDAAuD;oBACvD,MAAM,MAAM,GAAG,KAA8C,CAAC;oBAC9D,OAAO,CAAC,IAAI,CACV,6CAA6C,KAAK,CAAC,MAAM,EAAE;wBACzD,WAAW,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE;wBACjE,eAAe,UAAU,CAAC,OAAO,CAAC,EAAE,CACvC,CAAC;oBACF,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC;qBAC9C,CAAC;gBACJ,CAAC;gBACD,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,MAAM,KAAK,GAAG,IAIb,CAAC;gBACF,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC;oBACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;oBACpD,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;wBAC1B,OAAO,CAAC,IAAI,CACV,8CAA8C,GAAG,aAAa,MAAM,EAAE,CACvE,CAAC;wBACF,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC;yBAC9C,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CACV,+CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,eAAe,UAAU,CAAC,OAAO,CAAC,EAAE,CACrC,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/connector-scope.d.ts

@@ -0,0 +1,13 @@
+import type { Connector, ConnectorContext } from "./types.js";
+/**
+ * Tell a connector that a scope owned by the core has ended.
+ *
+ * Scope teardown is deliberately best-effort: a missing hook is a no-op and a
+ * rejected hook is swallowed so cleanup can never replace the probe result that
+ * caused it. The hook gets a small, fixed completion window so edge runtimes do
+ * not cut off a real close as the response ends, but one that never settles
+ * cannot hold the completed probe open indefinitely. Callers own the
+ * at-most-once guarantee and must not use the scope again after this returns.
+ */
+export declare function closeConnectorScope(connector: Connector, ctx: ConnectorContext): Promise<void>;
+//# sourceMappingURL=connector-scope.d.ts.map

package/dist/connector-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-scope.d.ts","sourceRoot":"","sources":["../src/connector-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAK9D;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,IAAI,CAAC,CAsBf"}

package/dist/connector-scope.js

@@ -0,0 +1,35 @@
+/** Enough for local transport abort/close without letting cleanup own latency. */
+const CONNECTOR_SCOPE_CLOSE_BUDGET_MS = 100;
+/**
+ * Tell a connector that a scope owned by the core has ended.
+ *
+ * Scope teardown is deliberately best-effort: a missing hook is a no-op and a
+ * rejected hook is swallowed so cleanup can never replace the probe result that
+ * caused it. The hook gets a small, fixed completion window so edge runtimes do
+ * not cut off a real close as the response ends, but one that never settles
+ * cannot hold the completed probe open indefinitely. Callers own the
+ * at-most-once guarantee and must not use the scope again after this returns.
+ */
+export async function closeConnectorScope(connector, ctx) {
+    try {
+        const closing = connector.closeScope?.(ctx);
+        if (!closing)
+            return;
+        await new Promise((resolve) => {
+            const timer = setTimeout(resolve, CONNECTOR_SCOPE_CLOSE_BUDGET_MS);
+            // Both handlers stay attached after the timer wins, so a late rejection
+            // is still consumed rather than becoming an unhandled rejection.
+            closing.then(() => {
+                clearTimeout(timer);
+                resolve();
+            }, () => {
+                clearTimeout(timer);
+                resolve();
+            });
+        });
+    }
+    catch {
+        // The scope is over whether or not the connector managed to clean it up.
+    }
+}
+//# sourceMappingURL=connector-scope.js.map

package/dist/connector-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-scope.js","sourceRoot":"","sources":["../src/connector-scope.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAoB,EACpB,GAAqB;IAErB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;YACnE,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,CAAC,IAAI,CACV,GAAG,EAAE;gBACH,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,EACD,GAAG,EAAE;gBACH,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC"}