@zackbart/connecta 0.7.8 → 0.8.0

package/CHANGELOG.md

@@ -2,6 +2,100 @@
 
 All notable changes to this package are documented here.
 
+## 0.8.0 — 2026-07-28
+
+0.8.0 is consolidation before capability growth (#157): the semantics that were
+independently implemented across call paths — invocation, catalog access,
+discovery bounds, timeouts — now live in shared services, the oversized modules
+(`server.ts`, the operator UI) are split into typed, tested units, and the dev
+loop gained correctness-only linting, an unused-code gate, strict indexed and
+optional property checks, and an automated Workers test-partition guard. A
+deployment can take this release without touching its config: entrypoints,
+options, storage formats, and the tool surface are unchanged. The docs were
+restructured — the old numbered manual is retired in favor of a terse
+[`ethos.md`](./ethos.md) and stub guides in `documentation/` — and the
+temporary `@hono/node-server` override is gone now that the SDK (1.30.0)
+depends on a patched version upstream.
+
+### Added
+
+- **`ethos.md`** — what connecta is, what it refuses to be, a decisions table,
+  and the invariants, each enforced or reviewer-owned (#175, PR #180). CI caps
+  its length; terseness is the point.
+- **Route-contract and operator-UI browser tests** pinning server behavior
+  before extraction (#148 PR #168, #149 PR #169).
+- **Automated Workers test-partition guard** — every suite must be classified
+  portable or Node-bound, with a reason (#150, PR #161).
+
+### Changed
+
+- **Tool invocation and catalog access are shared services** used by direct,
+  batch, and code-mode paths alike (#144, PR #162); code-mode dispatch is lazy
+  (#145, PR #163); catalog discovery is deduplicated and bounded (#146,
+  PR #164); persisted catalogs are chunked with bounded I/O (#147/#167,
+  PRs #166/#172).
+- **`server.ts` is a composition root** over extracted route modules (#148,
+  PR #170); the operator UI is typed, bundled browser source (#149, PR #169).
+- **Strict indexed access and exact optional property types** are on across
+  src and tests (#151, PR #181); Oxlint correctness and Knip unused-code gates
+  run in `npm run check` (#155, PR #171).
+- **`@modelcontextprotocol/sdk` 1.30.0** with the `@hono/node-server` override
+  removed (#40, PR #174).
+- **Docs restructure** — `docs/` retired; `README.md` is a short overview and
+  per-subsystem guides will be rewritten in `documentation/` (#175, PR #180).
+  Toolkits (#178) and proactive credential liveness (#179) are recorded as
+  retired decisions; their code remains in this release pending removal.
+
+### Fixed
+
+- Nothing user-visible; behavior-preserving consolidation throughout.
+
+## 0.7.9 — 2026-07-28
+
+0.7.9 adds opt-in, connector-scoped admission for downstream tool calls. Direct
+calls, batch children, and code-mode host calls to the same connector now share
+one per-runtime limiter, including through toolkit-scoped views. Connectors
+without a `callAdmission` policy behave as before. Dependencies, storage
+formats, and package entrypoints are unchanged.
+
+The policy is exact within one Node process or Worker isolate. Concurrency
+limits fully contain one request's fan-out; rolling budgets remain best-effort
+across multiple isolates, replicas, or restarts. This release deliberately
+does not add a distributed coordinator.
+
+### Added
+
+- **Connector-scoped downstream admission** (issue #138, PR #143).
+  `api()`, `remoteMcp()`, and custom connectors accept a plural-ready
+  `callAdmission.rules` policy. The single rule supported today can bound
+  concurrency, queue size and wait, and rolling-window calls, optionally
+  partitioned by a bounded operator-derived key.
+- **Payload-free admission telemetry.** `/health` reports connector aggregates
+  for live partitions, active and queued calls, admission outcomes, and queue
+  waits without exposing partition keys, arguments, or results.
+- **Explicit cancelled Activity outcomes.** Caller cancellation is represented
+  separately from provider errors and timeouts in the public Activity event
+  union, the operator UI, and the Worker D1 example.
+
+### Changed
+
+- **Retries reacquire admission per attempt.** Backoff does not retain a
+  concurrency permit, and each actual retry consumes a fresh rolling-budget
+  entry. Short proactive `rate_limited` windows continue to use the existing
+  safe retry contract.
+- **Queue and connector deadlines are separate.** `queueTimeoutMs` bounds only
+  permit wait; the per-attempt tool deadline begins after admission.
+  `diagnostics: true` reports the phases separately as `admissionMs` and
+  `connectorMs`.
+
+### Fixed
+
+- **Caller cancellation no longer retries an abandoned attempt or degrades
+  connector health.** A call already cancelled avoids connector dispatch.
+  Queued cancellation still releases its place without spending a
+  rolling-budget entry, while active cancellation releases its permit and
+  records a non-retryable `cancelled` result.
+
 ## 0.7.8 — 2026-07-28
 
 0.7.8 makes dependency-free tool discovery recover from natural-language

package/README.md

@@ -2,130 +2,59 @@
 
 ![A monochrome clay Connecta hub joining many tools](./assets/connecta-clay-hero.png)
 
-One MCP endpoint in front of all your connectors. Agents see nine tools instead
-of hundreds, and each client is configured once instead of once per integration.
+One MCP endpoint in front of every integration you've deliberately chosen.
+Agents see a handful of meta-tools instead of hundreds of definitions, and each
+client is configured once instead of once per integration.
 
 ## The problem
 
-An agent connected to N MCP servers pays for all N before it does anything. Every
-server's tool list is injected into the context window at connect time — hundreds
-of definitions and their schemas, nearly all irrelevant to the task actually at
-hand. That budget is spent whether the model calls one of them or none, and it
-comes out of the same window the work needs.
-
-The second cost is configuration. Every client — Claude, Cursor, whatever comes
-next — has to be pointed at each server separately, with its own auth for each.
-Adding an integration means touching every client; rotating one token means
-finding every place it was pasted.
+An agent connected to N MCP servers pays for all N before it does anything:
+every server's full tool list lands in the context window at connect time,
+nearly all of it irrelevant to the task at hand. The second cost is
+configuration — every client has to be pointed at every server separately,
+each with its own auth, and rotating one token means finding every place it
+was pasted.
 
 ## What connecta is
 
-One MCP endpoint you deploy — Cloudflare Worker, Node, or Docker — that
-aggregates your downstream connectors behind a fixed set of **nine meta-tools**.
-A connector is either a remote MCP server that connecta proxies, or a plain HTTP
-API with hand-written tool definitions and a fetch handler.
+One MCP endpoint you deploy — a Cloudflare Worker or a Node process in a
+Docker stack, same code either way — aggregating your downstream connectors
+behind a small, fixed set of meta-tools. A connector is either a remote MCP
+server that connecta proxies, or a plain HTTP API with hand-written tool
+definitions and a fetch handler. Both come out identical: same two-segment
+addresses (`<connectorId>.<toolName>`), same catalog, same safety rules.
 
 ```
                                         ┌── remoteMcp("notion")   → mcp.notion.com
 Claude / Cursor ── MCP ──▶  connecta ───┼── remoteMcp("linear")   → mcp.linear.app
-   sees 9 tools            /mcp         ├── api("resend")         → fetch(...)
+  sees 9 tools             /mcp         ├── api("resend")         → fetch(...)
                                         └── api("internal")       → fetch(...)
 ```
 
-Rather than receiving every tool up front, the agent discovers what it needs.
-`search_tools` returns ranked matches for a query and `describe_tools` returns
-schemas — compact by default, raw JSON Schema on request — for only the
-addresses it is about to call. `call_tool`,
-`batch_call`, and `call_destructive_tool` invoke them by address
-(`<connectorId>.<toolName>`). `list_connectors` reports what exists and whether
-it is reachable, `authorize_connector` starts a downstream OAuth flow,
-`get_result` pages through a result too large to return inline, and `skills`
-hands the model a short guide to choosing among the rest.
-
-That is the entire surface. The agent's context holds nine tool definitions
-whether ten tools sit behind them or a thousand — and the client holds one URL
-and one credential, no matter how many services that URL fans out to.
-
-An optional tenth meta-tool, `execute_code`, runs model-written async JavaScript
-in a sandbox with no network, filesystem, or environment access — only the
-explicitly read-only tools as callable globals — turning a loop, a join across
-connectors, or a filter over a large response into one round trip instead of a
-dozen. The built-in Node executor runs QuickJS in bounded, replaceable child
-processes so guest CPU never occupies the HTTP event loop. Configure no
-`executor` and connecta is exactly the nine-tool server.
-
-## Why it's shaped this way
-
-**Config as code, one deployment per tenant.** Connectors are declared in
-TypeScript. Adding one is a code change and a deploy — no database of
-integrations, no registration API, no runtime admin. A deployment is a small
-config file you can read in one sitting and review in a pull request, not a
-platform to administer.
-
-**Credentials stay server-side.** Downstream tokens live in an AES-GCM encrypted
-vault over the deployment's own storage, with the key held outside it. A
-connector reaches its own credential through `ctx.credential`; the operator
-pages, meta-tools, and code sandbox never expose a secret value. Rotating a token
-at `/credentials` is an operator action rather than a redeploy — though writing
-to the vault is deliberately narrower than everything else, requiring a
-Clerk-authenticated operator on a same-origin request, so a bearer-only
-deployment cannot administer credentials from the browser. Which tools exist
-is still code either way.
-
-**Read-only is fail-closed.** Only tools explicitly annotated `readOnlyHint:
-true` are reachable through `call_tool`, `batch_call`, and the sandbox. Missing,
-false, or contradictory annotations do not get the benefit of the doubt: they
-require `call_destructive_tool`, which is itself annotated so the MCP host can
-put the question to a human. Connecta makes the boundary visible; approval is
-the host's job.
-
-**Toolkits scope what a team sees.** A deployment belongs to an org; a toolkit
-is a named view over its registry for one group inside that org — support sees
-Zendesk and Notion, exec also sees Gmail. A client selects one with
-`?toolkit=support` on the MCP URL, and a credential can be bound so it opens
-that view and nothing else. Inside a scoped session an out-of-scope address
-fails exactly as a nonexistent one does. Two teams, one deployment. Who gets in
-at all is the prior question: a static bearer token, or Clerk — where
-`allowedDomains: ["acme.com"]` admits anyone whose verified primary email is on
-your domain without enumerating users, and a `gate` hook handles what a domain
-rule cannot express. Both fail closed, and each one configured must pass.
-
-**Activity records the fact, not the payload.** The optional activity store logs
-which resolved tool ran, for whom, and how it went — never arguments, results,
-generated code, search text, or raw error messages. The exclusion is structural
-rather than a redaction pass: the event type has nowhere to put a payload, which
-is what keeps an operations log from becoming something worth stealing.
-
-**Operator pages that cannot administer the deployment.** Connections at `GET /`
-shows connector health, tool counts, downstream authorization links, and a
-read-only map of the toolkit views declared in deployment config;
-`/credentials` rotates stored secrets; and `/activity` shows the optional
-payload-free ledger. They share one data-free shell with no build step and use
-authenticated private APIs for deployment data. They cannot add a connector,
-change policy, or alter what an agent may call. Credentials connecta stores are
-also probed for liveness
-proactively — using each connector's own test or status hook, never a downstream
-tool call — so a dead token surfaces as `auth_required` with the URL to open on
-Connections and in `list_connectors` before an agent's real call trips over it.
-
-## When not to use it
-
-Connecta is deliberately small, and declines several tempting shapes.
-It is **not multi-tenant** — one deployment is one tenant, with one registry and
-one credential store, and toolkits are scoped views rather than tenants. There
-is **no policy engine**, no approvals, and no pauses — access decisions are
-fixed ones connecta already knows how to answer (is this tool read-only, may
-this credential open this toolkit), not rules you author. There is **no runtime
-administration** — you cannot add a connector from a browser or an API. It
-aggregates **tools only**, not MCP resources or prompts, and it will not ingest
-a **GraphQL** schema, because generating hundreds of low-quality tool
-definitions is the problem the nine meta-tools exist to solve. OpenAPI is a
-softer no: not built in today, not refused either, and tracked as
-[issue #26](https://github.com/zackbart/connecta/issues/26). If you want a
-hosted multi-tenant integration platform with an approval workflow, this is the
-wrong shape; the
-[non-goals](https://github.com/zackbart/connecta/blob/main/docs/decisions.md#non-goals)
-say so at more length.
+Rather than receiving every tool up front, the agent discovers what it needs:
+`search_tools` ranks matches, `describe_tools` returns schemas for only the
+addresses about to be called, and `call_tool` / `batch_call` /
+`call_destructive_tool` invoke them by address. `list_connectors` reports what
+exists, `authorize_connector` starts a downstream OAuth flow, `get_result`
+pages through oversized results, and `skills` hands the model a short guide to
+the rest. The agent's context holds nine tool definitions whether ten tools
+sit behind them or a thousand.
+
+An optional tenth, `execute_code`, runs model-written JavaScript in a sandbox
+with no network, filesystem, or environment access — only the explicitly
+read-only tools as callable globals — turning a loop or a cross-connector join
+into one round trip. Configure no executor and connecta is exactly the
+nine-tool server.
+
+Three properties are load-bearing enough to name here; the rest live in the
+[ethos](./ethos.md). **Read-only is fail-closed**: only tools explicitly
+annotated read-only are reachable through `call_tool`, `batch_call`, and the
+sandbox — everything else crosses `call_destructive_tool`, which is annotated
+so the MCP host can ask a human. **Credentials stay server-side**: downstream
+tokens live in an encrypted vault, rotated from an operator page rather than a
+redeploy, and no surface ever returns a secret. **Config is code**: adding a
+connector is an edit and a deploy — no registration API, no admin UI, one
+small file you can review in a pull request.
 
 ## Getting started
 
@@ -164,42 +93,36 @@ listen(connecta, 8787); // MCP at /mcp; Connections at http://localhost:8787/
 ```
 
 Point an MCP client at `http://localhost:8787/mcp` with an
-`Authorization: Bearer` header and it will see the nine meta-tools, with
-`time.get_now` discoverable through `search_tools`.
+`Authorization: Bearer` header and `time.get_now` is discoverable through
+`search_tools`.
 
 Runnable deployments live in
 [`examples/`](https://github.com/zackbart/connecta/tree/main/examples):
-[`worker/`](https://github.com/zackbart/connecta/tree/main/examples/worker) is a
-free-tier-compatible Cloudflare Worker with KV and D1 adapters, and the template
-to copy for a real deployment; adding one Worker Loader binding opts it into
-paid Dynamic Worker code mode without changing its TypeScript;
-[`node/`](https://github.com/zackbart/connecta/tree/main/examples/node) adds
-toolkits and code mode to the server above;
-[`docker/`](https://github.com/zackbart/connecta/tree/main/examples/docker) is a
-single-service compose stack. Anything beyond the core is installed only by the
-deployments that use it: `@clerk/backend` and `quickjs-emscripten` are optional
-peer dependencies, reached through the `/auth/clerk` and `/quickjs` subpaths,
-and a Worker using code mode brings its own `@cloudflare/codemode`. Connecta
-ships no service-specific connectors:
-endpoint, credential, and tool choices stay in your project, declared with
-`remoteMcp()` and `api()`.
+[`worker/`](https://github.com/zackbart/connecta/tree/main/examples/worker) is
+a free-tier-compatible Cloudflare Worker with KV and D1 adapters and the
+template to copy for a real deployment;
+[`node/`](https://github.com/zackbart/connecta/tree/main/examples/node) extends
+the server above;
+[`docker/`](https://github.com/zackbart/connecta/tree/main/examples/docker) is
+a single-service compose stack. Anything beyond the core is installed only by
+the deployments that use it — `@clerk/backend` and `quickjs-emscripten` are
+optional peers behind the `/auth/clerk` and `/quickjs` subpaths — and connecta
+ships no service-specific connectors: endpoint, credential, and tool choices
+stay in your project, declared with `remoteMcp()` and `api()`.
+
+A candid note on maturity: connecta is built for its author's deployments
+first and published openly. Breaking changes are cheap and the version number
+signals change, not stability — the [ethos](./ethos.md) says so on purpose.
 
 ## Learn more
 
-- **[Documentation](https://github.com/zackbart/connecta/blob/main/docs/documentation.md)**
-  — the reference index for architecture, connectors, inbound auth and
-  downstream OAuth, storage, Clerk setup, testing, and troubleshooting. Start
-  with the [meta-tools reference](https://github.com/zackbart/connecta/blob/main/docs/meta-tools.md#meta-tools-reference),
-  the [config options](https://github.com/zackbart/connecta/blob/main/docs/operations.md#running-it),
-  [request admission](https://github.com/zackbart/connecta/blob/main/docs/request-admission.md#request-admission-and-backpressure),
-  [code mode](https://github.com/zackbart/connecta/blob/main/docs/code-mode.md#code-mode-execute_code),
-  [toolkits](https://github.com/zackbart/connecta/blob/main/docs/toolkits.md#toolkits-scoped-views),
-  [operator pages](https://github.com/zackbart/connecta/blob/main/docs/operator-ui.md#status-ui),
-  or [credential health](https://github.com/zackbart/connecta/blob/main/docs/storage-and-credentials.md#credential-health-proactive-liveness-checks).
-- **[Decisions](https://github.com/zackbart/connecta/blob/main/docs/decisions.md)**
-  — what connecta refuses to be, which alternatives lost and why, and the
-  invariants a change must preserve.
-- **[CHANGELOG](https://github.com/zackbart/connecta/blob/main/CHANGELOG.md)** —
-  what changed in each release.
-- **[SECURITY](https://github.com/zackbart/connecta/blob/main/SECURITY.md)** —
-  supported versions and how to report a vulnerability.
+- **[ethos.md](./ethos.md)** — what this is, what it refuses to be, the
+  decisions table, and the invariants every change must preserve. Read this
+  before proposing anything.
+- **[documentation/](./documentation/)** — per-subsystem guides. Currently
+  stubs: the old manual was retired during the phase-1 docs restructure and
+  each guide is being rewritten as the ideas settle; prior text lives in git
+  history.
+- **[CHANGELOG](./CHANGELOG.md)** — what changed in each release.
+- **[SECURITY](./SECURITY.md)** — supported versions and how to report a
+  vulnerability.

package/dist/activity.d.ts

@@ -1,6 +1,6 @@
 import type { Logger } from "./types.js";
 export type ActivityCallSource = "call_tool" | "call_destructive_tool" | "batch_call" | "execute_code";
-export type ActivityOutcome = "success" | "error" | "timeout";
+export type ActivityOutcome = "success" | "error" | "timeout" | "cancelled";
 /**
  * Authenticated identity attached to an activity event. `id` is intentionally
  * optional: open deployments and shared bearer tokens cannot honestly identify

package/dist/activity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,uBAAuB,GACvB,YAAY,GACZ,cAAc,CAAC;AAEnB,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG;IACrE,KAAK,EAAE,iBAAiB,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,IAAI,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,iFAAiF;AACjF,qBAAa,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,SAAgC;;CAK9C;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,KAAK,EAAE,aAAa,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,gFAAgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,qBAAqB,EACnB,aAAa,GACb,UAAU,GACV,SAAS,GACT,QAAQ,GACR,SAAS,GACT,YAAY,GACZ,UAAU,GACV,WAAW,CACd,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,sBAAsB,GAAG,SAAS,EAC3C,KAAK,EAAE,kBAAkB,GACxB,IAAI,CAmCN"}
+{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,uBAAuB,GACvB,YAAY,GACZ,cAAc,CAAC;AAEnB,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,OAAO,GACP,SAAS,GACT,WAAW,CAAC;AAEhB;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG;IACrE,KAAK,EAAE,iBAAiB,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,IAAI,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,iFAAiF;AACjF,qBAAa,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,SAAgC;;CAK9C;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,KAAK,EAAE,aAAa,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,gFAAgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,qBAAqB,EACnB,aAAa,GACb,UAAU,GACV,SAAS,GACT,QAAQ,GACR,SAAS,GACT,YAAY,GACZ,UAAU,GACV,WAAW,CACd,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,sBAAsB,GAAG,SAAS,EAC3C,KAAK,EAAE,kBAAkB,GACxB,IAAI,CAmCN"}

package/dist/activity.js.map

@@ -1 +1 @@
-{"version":3,"file":"activity.js","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AA2FA,iFAAiF;AACjF,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,4BAA4B,CAAC;IAE7C;QACE,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnC,CAAC;CACF;AA+BD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA2C,EAC3C,KAAyB;IAEzB,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,KAAK,GAA0B;QACnC,aAAa,EAAE,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;QACnC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO;QACzC,GAAG,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAQ,MAA2B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACtD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AA+FA,iFAAiF;AACjF,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,4BAA4B,CAAC;IAE7C;QACE,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnC,CAAC;CACF;AA+BD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA2C,EAC3C,KAAyB;IAEzB,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,KAAK,GAA0B;QACnC,aAAa,EAAE,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;QACnC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO;QACzC,GAAG,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAQ,MAA2B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACtD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/auth/bearer.d.ts

@@ -9,7 +9,7 @@ export interface BearerTokenOptions extends ToolkitBindingOptions {
  * against `secret`. Checked BEFORE the Clerk gate in the server; a mismatch
  * falls through so a co-configured Clerk provider can still admit the request.
  *
- * `toolkits` binds the token to named toolkits (docs/toolkits.md): one
+ * `toolkits` binds the token to named toolkits (documentation/toolkits.md): one
  * `bearerToken(...)` per team credential, each naming the view that team may
  * open. Omit it and the token stays unbound — every declared toolkit plus the
  * full registry.

package/dist/auth/bearer.js

@@ -11,7 +11,7 @@ function timingSafeEqual(a, b) {
     }
     let r = 0;
     for (let i = 0; i < a.length; i++)
-        r |= a[i] ^ b[i];
+        r |= (a[i] ?? 0) ^ (b[i] ?? 0);
     return r === 0;
 }
 /**
@@ -19,7 +19,7 @@ function timingSafeEqual(a, b) {
  * against `secret`. Checked BEFORE the Clerk gate in the server; a mismatch
  * falls through so a co-configured Clerk provider can still admit the request.
  *
- * `toolkits` binds the token to named toolkits (docs/toolkits.md): one
+ * `toolkits` binds the token to named toolkits (documentation/toolkits.md): one
  * `bearerToken(...)` per team credential, each naming the view that team may
  * open. Omit it and the token stays unbound — every declared toolkit plus the
  * full registry.
@@ -31,8 +31,8 @@ export function bearerToken(secret, options = {}) {
         : "bearerToken", options);
     if (toolkitBinding && !options.subjectId) {
         // A bound token stands for one team, and both surfaces that report on it —
-        // the 403 refusal log (docs/toolkits.md) and activity events
-        // (docs/operator-ui.md) — can only say "bearer" without a subjectId. With
+        // the 403 refusal log (documentation/toolkits.md) and activity events
+        // (documentation/operator-ui.md) — can only say "bearer" without a subjectId. With
         // several bound tokens that makes an operator unable to tell which
         // credential was refused, or whose call succeeded. console.warn (as the
         // Clerk adapter does) because an adapter is constructed before

package/dist/auth/bearer.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,qFAAqF;AACrF,SAAS,eAAe,CAAC,CAAa,EAAE,CAAa;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,UAA8B,EAAE;IAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,qBAAqB,CAC1C,OAAO,CAAC,SAAS;QACf,CAAC,CAAC,2BAA2B,OAAO,CAAC,SAAS,IAAI;QAClD,CAAC,CAAC,aAAa,EACjB,OAAO,CACR,CAAC;IACF,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,2EAA2E;QAC3E,6DAA6D;QAC7D,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,+DAA+D;QAC/D,4CAA4C;QAC5C,OAAO,CAAC,IAAI,CACV,8CAA8C;YAC5C,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,eAAe;YACxE,+DAA+D;YAC/D,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,SAAS,CAAC,OAAO;YACf,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;gBACpE,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,kBAAkB,EAAE,QAAQ;qBAC7B;iBACF,CACF;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,qFAAqF;AACrF,SAAS,eAAe,CAAC,CAAa,EAAE,CAAa;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,UAA8B,EAAE;IAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,qBAAqB,CAC1C,OAAO,CAAC,SAAS;QACf,CAAC,CAAC,2BAA2B,OAAO,CAAC,SAAS,IAAI;QAClD,CAAC,CAAC,aAAa,EACjB,OAAO,CACR,CAAC;IACF,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,2EAA2E;QAC3E,sEAAsE;QACtE,mFAAmF;QACnF,mEAAmE;QACnE,wEAAwE;QACxE,+DAA+D;QAC/D,4CAA4C;QAC5C,OAAO,CAAC,IAAI,CACV,8CAA8C;YAC5C,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,eAAe;YACxE,+DAA+D;YAC/D,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,SAAS,CAAC,OAAO;YACf,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;gBACpE,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,kBAAkB,EAAE,QAAQ;qBAC7B;iBACF,CACF;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/clerk.d.ts

@@ -35,7 +35,7 @@ export interface ClerkAuthOptions extends ToolkitBindingOptions {
  * `toolkits` decides WHICH view the admitted user gets.
  *
  * `toolkits` binds every user this provider admits to those toolkits
- * (docs/toolkits.md). For a per-team split, configure one `clerkAuth(...)` per
+ * (documentation/toolkits.md). For a per-team split, configure one `clerkAuth(...)` per
  * team — the same keys, a `gate` naming that team's users, and that team's
  * `toolkits`. The server tries providers in order and the first that admits the
  * user supplies the binding, so a user one gate rejects falls through to the

package/dist/auth/clerk.js

@@ -156,7 +156,7 @@ function emailDomain(email) {
  * `toolkits` decides WHICH view the admitted user gets.
  *
  * `toolkits` binds every user this provider admits to those toolkits
- * (docs/toolkits.md). For a per-team split, configure one `clerkAuth(...)` per
+ * (documentation/toolkits.md). For a per-team split, configure one `clerkAuth(...)` per
  * team — the same keys, a `gate` naming that team's users, and that team's
  * `toolkits`. The server tries providers in order and the first that admits the
  * user supplies the binding, so a user one gate rejects falls through to the

package/dist/call-admission.d.ts

@@ -0,0 +1,81 @@
+import { ConnectorCallError } from "./errors.js";
+import type { ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy } from "./types.js";
+export type CallAdmissionFailureKind = "concurrency" | "budget" | "cancelled" | "closed" | "partition";
+/**
+ * A locally-produced connector-call failure. Extending ConnectorCallError
+ * preserves the public error envelope while letting call paths avoid recording
+ * a refusal as evidence that the downstream provider is unhealthy.
+ */
+export declare class CallAdmissionError extends ConnectorCallError {
+    readonly admissionKind: CallAdmissionFailureKind;
+    constructor(admissionKind: CallAdmissionFailureKind, code: ConstructorParameters<typeof ConnectorCallError>[0], message: string, opts?: ConstructorParameters<typeof ConnectorCallError>[2]);
+}
+export declare function isCallAdmissionError(error: unknown): error is CallAdmissionError;
+export interface CallAdmissionPermit {
+    /** Time spent in the concurrency queue. Zero for immediate admission. */
+    readonly waitMs: number;
+    /** Idempotent. */
+    release(): void;
+}
+export interface ConnectorCallAdmissionSnapshot {
+    rules: number;
+    partitions: number;
+    active: number;
+    queued: number;
+    closed: boolean;
+    totals: {
+        admitted: number;
+        queued: number;
+        rejected: number;
+        rateLimited: number;
+        cancelled: number;
+    };
+    queueWaitMs: {
+        count: number;
+        total: number;
+        max: number;
+    };
+}
+/**
+ * Per-runtime, per-connector call admission. State contains only bounded
+ * partition keys, counters, timestamps, signals, and promise continuations;
+ * tool arguments never enter the controller.
+ */
+export declare class ConnectorCallAdmissionController {
+    readonly connectorId: string;
+    private readonly maxConcurrency;
+    private readonly maxQueueSize;
+    private readonly queueTimeoutMs;
+    private readonly retryAfterMs;
+    private readonly maxPartitions;
+    private readonly budget;
+    private readonly partitionKey;
+    private readonly partitions;
+    private closed;
+    private admittedTotal;
+    private queuedTotal;
+    private rejectedTotal;
+    private rateLimitedTotal;
+    private cancelledTotal;
+    private queueWaitCount;
+    private queueWaitTotalMs;
+    private queueWaitMaxMs;
+    constructor(connectorId: string, policy: ConnectorCallAdmissionPolicy);
+    acquire(input: Readonly<ConnectorCallAdmissionInput> & {
+        signal?: AbortSignal;
+    }): Promise<CallAdmissionPermit>;
+    snapshot(): ConnectorCallAdmissionSnapshot;
+    close(): void;
+    private admit;
+    private pump;
+    private pruneBudget;
+    private budgetRetryAfterMs;
+    private evictIdlePartitions;
+    private maybeDeletePartition;
+    private removeWaiter;
+    private cleanupWaiter;
+    private concurrencyLimited;
+    private budgetLimited;
+    private cancelled;
+}
+//# sourceMappingURL=call-admission.d.ts.map

package/dist/call-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-admission.d.ts","sourceRoot":"","sources":["../src/call-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EACV,2BAA2B,EAC3B,4BAA4B,EAE7B,MAAM,YAAY,CAAC;AAUpB,MAAM,MAAM,wBAAwB,GAChC,aAAa,GACb,QAAQ,GACR,WAAW,GACX,QAAQ,GACR,WAAW,CAAC;AAEhB;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,kBAAkB;IAEtD,QAAQ,CAAC,aAAa,EAAE,wBAAwB;gBAAvC,aAAa,EAAE,wBAAwB,EAChD,IAAI,EAAE,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,EACzD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAM;CAKjE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,kBAAkB,CAE7B;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kBAAkB;IAClB,OAAO,IAAI,IAAI,CAAC;CACjB;AAiBD,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAgBD;;;;GAIG;AACH,qBAAa,gCAAgC;IAwBzC,QAAQ,CAAC,WAAW,EAAE,MAAM;IAvB9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAET;IACd,OAAO,CAAC,QAAQ,CAAC,YAAY,CAEf;IACd,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqC;IAChE,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,cAAc,CAAK;gBAGhB,WAAW,EAAE,MAAM,EAC5B,MAAM,EAAE,4BAA4B;IAsEtC,OAAO,CACL,KAAK,EAAE,QAAQ,CAAC,2BAA2B,CAAC,GAAG;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACtE,OAAO,CAAC,mBAAmB,CAAC;IAqI/B,QAAQ,IAAI,8BAA8B;IA4B1C,KAAK,IAAI,IAAI;IAiBb,OAAO,CAAC,KAAK;IAyBb,OAAO,CAAC,IAAI;IA0BZ,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,oBAAoB;IAe5B,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,SAAS;CAQlB"}