@zackbart/connecta 0.7.9 → 0.8.1

package/CHANGELOG.md

@@ -2,6 +2,141 @@
 
 All notable changes to this package are documented here.
 
+## 0.8.1 — 2026-07-29
+
+0.8.1 hardens agent routing, response efficiency, and credential recovery while
+making deployment boundaries the audience-scoping model. It removes toolkits
+and proactive credential liveness probing: deployments still using either
+retired configuration must migrate, and stale configuration fails at startup
+instead of silently widening access. Deployments that use neither retired
+feature need no configuration or storage migration; orphaned credential-health
+records and old toolkit columns can remain unused.
+
+Against the pre-0.8.1 release-audit baseline, all 21 task scenarios still pass,
+discovery remains at 89.7% top-1 accuracy and 100% positive/default-page recall,
+and discovery mean precision improves from 46.4% to 73.5%. The same 55 round
+trips take 225.6 ms versus 228.4 ms of summed local-call latency (effectively
+flat). Definition tokens move from 2,164 to 2,174 and request tokens from 1,144
+to 1,145, while response tokens fall from 68,765 to 16,343 (-76.2%) and the
+complete measured surface falls from 72,073 to 19,662 tokens (-72.7%).
+
+### Added
+
+- **A current-version release audit and independently authored discovery
+  holdout** (#189). It exercises every meta-tool, destructive routing, OAuth
+  and static-credential recovery, result paging, client compatibility, and the
+  payload-free activity invariant on Node 20 and 22. Its evidence stays under
+  `eval/` and is excluded from the published package.
+
+### Changed
+
+- **Lexical discovery ignores conservative conversational framing and defaults
+  to eight results instead of 25** (#190). Action terms such as `get`, `list`,
+  `search`, `find`, and `create` remain significant; cleanup that removes every
+  term falls back to the original query. Explicit `limit` still supports up to
+  100 results, and `total`, `hasMore`, and `nextOffset` preserve complete
+  pagination. On the holdout, mean results fall from 14.0 to 2.853 and negative
+  false positives from 80% to 20%, without losing positive or default-page
+  recall.
+- **`execute_code` is advertised only with a configured live executor** (#193).
+  The existing capability boundary is now explicit in instructions,
+  documentation, and regression coverage: deployments without code mode expose
+  the nine base meta-tools; deployments with it expose ten.
+- **The `usage` guide is slimmer and fetched on demand** (#194). The
+  `skills` meta-tool and per-connector guide delivery remain unchanged, while
+  the generic guide drops redundant examples and keeps only routing, probe,
+  recovery, and code-mode rules. Server instructions now recommend fetching it
+  when the routing workflow is unfamiliar instead of once per task.
+- **Structured results now serialize compactly in text compatibility content**
+  (#191). `structuredContent` remains the canonical full-fidelity object and
+  `content` remains complete JSON for text-only clients, but indentation no
+  longer inflates discovery, call, paging, batch, authorization, or code-mode
+  responses. Replacing the compatibility copy with a summary remains deferred
+  until host-forwarding measurements justify departing from MCP's compatibility
+  guidance.
+- **Credential recovery has one agent-facing route** (#192).
+  `auth_required` errors now name the connector, failed operation, recovery
+  class, `authorize_connector` call, operator handoff, and retry. Calling
+  `authorize_connector` returns `recovery: "oauth"`, `"operator_config"`, or
+  `"unavailable"`; static handoffs expose only declared field names and
+  guidance plus the Clerk-protected `/credentials` URL, never credential
+  values. A missing `credentials.encryptionKey` now boots with an explicit
+  unavailable recovery state instead of preventing the deployment from
+  explaining the problem.
+- **Toolkits are removed** (#178). `ConnectaConfig.toolkits`, toolkit bindings
+  on `bearerToken` and `clerkAuth`, `?toolkit=` routing, scoped registries, and
+  the operator UI's toolkit projection no longer exist. Passing `toolkits` or
+  `unscoped` to any of those construction surfaces throws instead of silently
+  widening access, and an `/mcp` request still carrying `?toolkit=` — a URL
+  minted before the retirement — gets an explicit 404 naming #178, never a
+  silent widening to the full registry.
+- **Activity events no longer carry `toolkitId`.** The Worker D1 example drops
+  its `toolkit_id` column; existing columns may be left in place unused.
+- **Proactive credential liveness is removed** (#179), reverting the feature
+  introduced in #24. `credentials.health`, legacy `credentialHealth`,
+  `Connecta.checkCredentials`, scheduled sweep wiring, persisted verdict reads
+  and writes, and `credentialCheck` response/UI fields no longer exist.
+  Operator-triggered credential tests and local stored-shape drift detection
+  remain. A drifted connector now reports `auth_required` directly from the
+  drift check — `list_connectors` with `probe: true` and `/ui/data` no longer
+  live-probe a connector whose stored credential cannot be consumed anyway.
+  Existing `credhealth:*` KV records are harmless orphaned data: they are
+  never read or rewritten, and no cleanup migration runs.
+
+### Fixed
+
+- **Missing credential-vault configuration now fails at use with a typed,
+  actionable recovery envelope** (#192) instead of preventing the deployment
+  from starting before an agent or operator can diagnose it.
+
+## 0.8.0 — 2026-07-28
+
+0.8.0 is consolidation before capability growth (#157): the semantics that were
+independently implemented across call paths — invocation, catalog access,
+discovery bounds, timeouts — now live in shared services, the oversized modules
+(`server.ts`, the operator UI) are split into typed, tested units, and the dev
+loop gained correctness-only linting, an unused-code gate, strict indexed and
+optional property checks, and an automated Workers test-partition guard. A
+deployment can take this release without touching its config: entrypoints,
+options, storage formats, and the tool surface are unchanged. The docs were
+restructured — the old numbered manual is retired in favor of a terse
+[`ethos.md`](./ethos.md) and stub guides in `documentation/` — and the
+temporary `@hono/node-server` override is gone now that the SDK (1.30.0)
+depends on a patched version upstream.
+
+### Added
+
+- **`ethos.md`** — what connecta is, what it refuses to be, a decisions table,
+  and the invariants, each enforced or reviewer-owned (#175, PR #180). CI caps
+  its length; terseness is the point.
+- **Route-contract and operator-UI browser tests** pinning server behavior
+  before extraction (#148 PR #168, #149 PR #169).
+- **Automated Workers test-partition guard** — every suite must be classified
+  portable or Node-bound, with a reason (#150, PR #161).
+
+### Changed
+
+- **Tool invocation and catalog access are shared services** used by direct,
+  batch, and code-mode paths alike (#144, PR #162); code-mode dispatch is lazy
+  (#145, PR #163); catalog discovery is deduplicated and bounded (#146,
+  PR #164); persisted catalogs are chunked with bounded I/O (#147/#167,
+  PRs #166/#172).
+- **`server.ts` is a composition root** over extracted route modules (#148,
+  PR #170); the operator UI is typed, bundled browser source (#149, PR #169).
+- **Strict indexed access and exact optional property types** are on across
+  src and tests (#151, PR #181); Oxlint correctness and Knip unused-code gates
+  run in `npm run check` (#155, PR #171).
+- **`@modelcontextprotocol/sdk` 1.30.0** with the `@hono/node-server` override
+  removed (#40, PR #174).
+- **Docs restructure** — `docs/` retired; `README.md` is a short overview and
+  per-subsystem guides will be rewritten in `documentation/` (#175, PR #180).
+  Toolkits (#178) and proactive credential liveness (#179) are recorded as
+  retired decisions; their code remains in this release pending removal.
+
+### Fixed
+
+- Nothing user-visible; behavior-preserving consolidation throughout.
+
 ## 0.7.9 — 2026-07-28
 
 0.7.9 adds opt-in, connector-scoped admission for downstream tool calls. Direct

package/README.md

@@ -2,130 +2,44 @@
 
 ![A monochrome clay Connecta hub joining many tools](./assets/connecta-clay-hero.png)
 
-One MCP endpoint in front of all your connectors. Agents see nine tools instead
-of hundreds, and each client is configured once instead of once per integration.
-
-## The problem
-
-An agent connected to N MCP servers pays for all N before it does anything. Every
-server's tool list is injected into the context window at connect time — hundreds
-of definitions and their schemas, nearly all irrelevant to the task actually at
-hand. That budget is spent whether the model calls one of them or none, and it
-comes out of the same window the work needs.
-
-The second cost is configuration. Every client — Claude, Cursor, whatever comes
-next — has to be pointed at each server separately, with its own auth for each.
-Adding an integration means touching every client; rotating one token means
-finding every place it was pasted.
+One MCP endpoint in front of every integration you've deliberately chosen.
+Agents see a handful of meta-tools instead of hundreds of definitions, and each
+client is configured once instead of once per integration.
 
 ## What connecta is
 
-One MCP endpoint you deploy — Cloudflare Worker, Node, or Docker — that
-aggregates your downstream connectors behind a fixed set of **nine meta-tools**.
-A connector is either a remote MCP server that connecta proxies, or a plain HTTP
-API with hand-written tool definitions and a fetch handler.
+An agent connected to N MCP servers pays for all N before it does anything:
+every server's full tool list lands in the context window at connect time, and
+every client is pointed at every server separately, each with its own auth.
+Connecta is one endpoint you deploy instead — a Cloudflare Worker or a Node
+process, same code either way — aggregating your connectors behind nine
+meta-tools. A connector is a remote MCP server connecta proxies or a plain
+HTTP API with hand-written tool definitions; both come out identical,
+addressed as `<connectorId>.<toolName>`.
 
 ```
                                         ┌── remoteMcp("notion")   → mcp.notion.com
 Claude / Cursor ── MCP ──▶  connecta ───┼── remoteMcp("linear")   → mcp.linear.app
-   sees 9 tools            /mcp         ├── api("resend")         → fetch(...)
+  sees 9 tools             /mcp         ├── api("resend")         → fetch(...)
                                         └── api("internal")       → fetch(...)
 ```
 
-Rather than receiving every tool up front, the agent discovers what it needs.
-`search_tools` returns ranked matches for a query and `describe_tools` returns
-schemas — compact by default, raw JSON Schema on request — for only the
-addresses it is about to call. `call_tool`,
-`batch_call`, and `call_destructive_tool` invoke them by address
-(`<connectorId>.<toolName>`). `list_connectors` reports what exists and whether
-it is reachable, `authorize_connector` starts a downstream OAuth flow,
-`get_result` pages through a result too large to return inline, and `skills`
-hands the model a short guide to choosing among the rest.
-
-That is the entire surface. The agent's context holds nine tool definitions
-whether ten tools sit behind them or a thousand — and the client holds one URL
-and one credential, no matter how many services that URL fans out to.
-
-An optional tenth meta-tool, `execute_code`, runs model-written async JavaScript
-in a sandbox with no network, filesystem, or environment access — only the
-explicitly read-only tools as callable globals — turning a loop, a join across
-connectors, or a filter over a large response into one round trip instead of a
-dozen. The built-in Node executor runs QuickJS in bounded, replaceable child
-processes so guest CPU never occupies the HTTP event loop. Configure no
-`executor` and connecta is exactly the nine-tool server.
-
-## Why it's shaped this way
-
-**Config as code, one deployment per tenant.** Connectors are declared in
-TypeScript. Adding one is a code change and a deploy — no database of
-integrations, no registration API, no runtime admin. A deployment is a small
-config file you can read in one sitting and review in a pull request, not a
-platform to administer.
-
-**Credentials stay server-side.** Downstream tokens live in an AES-GCM encrypted
-vault over the deployment's own storage, with the key held outside it. A
-connector reaches its own credential through `ctx.credential`; the operator
-pages, meta-tools, and code sandbox never expose a secret value. Rotating a token
-at `/credentials` is an operator action rather than a redeploy — though writing
-to the vault is deliberately narrower than everything else, requiring a
-Clerk-authenticated operator on a same-origin request, so a bearer-only
-deployment cannot administer credentials from the browser. Which tools exist
-is still code either way.
-
-**Read-only is fail-closed.** Only tools explicitly annotated `readOnlyHint:
-true` are reachable through `call_tool`, `batch_call`, and the sandbox. Missing,
-false, or contradictory annotations do not get the benefit of the doubt: they
-require `call_destructive_tool`, which is itself annotated so the MCP host can
-put the question to a human. Connecta makes the boundary visible; approval is
-the host's job.
-
-**Toolkits scope what a team sees.** A deployment belongs to an org; a toolkit
-is a named view over its registry for one group inside that org — support sees
-Zendesk and Notion, exec also sees Gmail. A client selects one with
-`?toolkit=support` on the MCP URL, and a credential can be bound so it opens
-that view and nothing else. Inside a scoped session an out-of-scope address
-fails exactly as a nonexistent one does. Two teams, one deployment. Who gets in
-at all is the prior question: a static bearer token, or Clerk — where
-`allowedDomains: ["acme.com"]` admits anyone whose verified primary email is on
-your domain without enumerating users, and a `gate` hook handles what a domain
-rule cannot express. Both fail closed, and each one configured must pass.
-
-**Activity records the fact, not the payload.** The optional activity store logs
-which resolved tool ran, for whom, and how it went — never arguments, results,
-generated code, search text, or raw error messages. The exclusion is structural
-rather than a redaction pass: the event type has nowhere to put a payload, which
-is what keeps an operations log from becoming something worth stealing.
-
-**Operator pages that cannot administer the deployment.** Connections at `GET /`
-shows connector health, tool counts, downstream authorization links, and a
-read-only map of the toolkit views declared in deployment config;
-`/credentials` rotates stored secrets; and `/activity` shows the optional
-payload-free ledger. They share one data-free shell with no build step and use
-authenticated private APIs for deployment data. They cannot add a connector,
-change policy, or alter what an agent may call. Credentials connecta stores are
-also probed for liveness
-proactively — using each connector's own test or status hook, never a downstream
-tool call — so a dead token surfaces as `auth_required` with the URL to open on
-Connections and in `list_connectors` before an agent's real call trips over it.
-
-## When not to use it
-
-Connecta is deliberately small, and declines several tempting shapes.
-It is **not multi-tenant** — one deployment is one tenant, with one registry and
-one credential store, and toolkits are scoped views rather than tenants. There
-is **no policy engine**, no approvals, and no pauses — access decisions are
-fixed ones connecta already knows how to answer (is this tool read-only, may
-this credential open this toolkit), not rules you author. There is **no runtime
-administration** — you cannot add a connector from a browser or an API. It
-aggregates **tools only**, not MCP resources or prompts, and it will not ingest
-a **GraphQL** schema, because generating hundreds of low-quality tool
-definitions is the problem the nine meta-tools exist to solve. OpenAPI is a
-softer no: not built in today, not refused either, and tracked as
-[issue #26](https://github.com/zackbart/connecta/issues/26). If you want a
-hosted multi-tenant integration platform with an approval workflow, this is the
-wrong shape; the
-[non-goals](https://github.com/zackbart/connecta/blob/main/docs/decisions.md#non-goals)
-say so at more length.
+The agent discovers instead of preloading: `search_tools` ranks matches,
+`describe_tools` returns schemas for only the addresses about to be called,
+`call_tool` / `batch_call` / `call_destructive_tool` invoke them, and
+`list_connectors`, `authorize_connector`, `get_result`, and `skills` round out
+the nine. An optional tenth, `execute_code`, runs model-written JavaScript in
+a sandbox with no network, filesystem, or environment access — only the
+read-only tools in scope. Context holds nine definitions whether ten tools sit
+behind them or a thousand.
+
+Three properties are load-bearing enough to name here; the rest live in the
+[ethos](./ethos.md). **Read-only is fail-closed**: anything not explicitly
+annotated read-only crosses `call_destructive_tool`, which is annotated so the
+MCP host can ask a human. **Credentials stay server-side**: an encrypted
+vault, rotated from an operator page, and no surface ever returns a secret.
+**Config is code**: adding a connector is an edit and a deploy you can review
+in a pull request.
 
 ## Getting started
 
@@ -164,42 +78,27 @@ listen(connecta, 8787); // MCP at /mcp; Connections at http://localhost:8787/
 ```
 
 Point an MCP client at `http://localhost:8787/mcp` with an
-`Authorization: Bearer` header and it will see the nine meta-tools, with
-`time.get_now` discoverable through `search_tools`.
+`Authorization: Bearer` header and `time.get_now` is discoverable through
+`search_tools`.
 
 Runnable deployments live in
-[`examples/`](https://github.com/zackbart/connecta/tree/main/examples):
-[`worker/`](https://github.com/zackbart/connecta/tree/main/examples/worker) is a
-free-tier-compatible Cloudflare Worker with KV and D1 adapters, and the template
-to copy for a real deployment; adding one Worker Loader binding opts it into
-paid Dynamic Worker code mode without changing its TypeScript;
-[`node/`](https://github.com/zackbart/connecta/tree/main/examples/node) adds
-toolkits and code mode to the server above;
-[`docker/`](https://github.com/zackbart/connecta/tree/main/examples/docker) is a
-single-service compose stack. Anything beyond the core is installed only by the
-deployments that use it: `@clerk/backend` and `quickjs-emscripten` are optional
-peer dependencies, reached through the `/auth/clerk` and `/quickjs` subpaths,
-and a Worker using code mode brings its own `@cloudflare/codemode`. Connecta
-ships no service-specific connectors:
-endpoint, credential, and tool choices stay in your project, declared with
-`remoteMcp()` and `api()`.
+[`examples/`](https://github.com/zackbart/connecta/tree/main/examples): a
+free-tier-compatible Cloudflare Worker with KV and D1 adapters, a Node server
+extending the one above, and a single-service Docker compose stack.
+Heavyweight extras are optional peers behind subpaths (`/auth/clerk`,
+`/quickjs`), and connecta ships no service-specific connectors — endpoint,
+credential, and tool choices stay in your project.
+
+A candid note on maturity: connecta is built for its author's deployments
+first and published openly. Breaking changes are cheap and the version number
+signals change, not stability — the [ethos](./ethos.md) says so on purpose.
 
 ## Learn more
 
-- **[Documentation](https://github.com/zackbart/connecta/blob/main/docs/documentation.md)**
-  — the reference index for architecture, connectors, inbound auth and
-  downstream OAuth, storage, Clerk setup, testing, and troubleshooting. Start
-  with the [meta-tools reference](https://github.com/zackbart/connecta/blob/main/docs/meta-tools.md#meta-tools-reference),
-  the [config options](https://github.com/zackbart/connecta/blob/main/docs/operations.md#running-it),
-  [request admission](https://github.com/zackbart/connecta/blob/main/docs/request-admission.md#request-admission-and-backpressure),
-  [code mode](https://github.com/zackbart/connecta/blob/main/docs/code-mode.md#code-mode-execute_code),
-  [toolkits](https://github.com/zackbart/connecta/blob/main/docs/toolkits.md#toolkits-scoped-views),
-  [operator pages](https://github.com/zackbart/connecta/blob/main/docs/operator-ui.md#status-ui),
-  or [credential health](https://github.com/zackbart/connecta/blob/main/docs/storage-and-credentials.md#credential-health-proactive-liveness-checks).
-- **[Decisions](https://github.com/zackbart/connecta/blob/main/docs/decisions.md)**
-  — what connecta refuses to be, which alternatives lost and why, and the
-  invariants a change must preserve.
-- **[CHANGELOG](https://github.com/zackbart/connecta/blob/main/CHANGELOG.md)** —
-  what changed in each release.
-- **[SECURITY](https://github.com/zackbart/connecta/blob/main/SECURITY.md)** —
-  supported versions and how to report a vulnerability.
+- **[ethos.md](./ethos.md)** — what this is, what it refuses to be, the
+  decisions table, and the invariants. Read it before proposing anything.
+- **[documentation/](./documentation/)** — per-subsystem guides (currently
+  stubs; the prior manual lives in git history).
+- **[CHANGELOG](./CHANGELOG.md)** — what changed in each release.
+- **[SECURITY](./SECURITY.md)** — supported versions and how to report a
+  vulnerability.

package/dist/activity.d.ts

@@ -40,12 +40,6 @@ export interface ToolCallActivityEvent {
     serverName: string;
     serverVersion: string;
     deploymentId?: string;
-    /**
-     * Name of the toolkit this connection selected with `?toolkit=`, when it
-     * selected one. Calls are recorded the same way with or without it; this only
-     * says which scoped view the call came through.
-     */
-    toolkitId?: string;
 }
 export interface ActivityPage {
     events: ToolCallActivityEvent[];
@@ -92,8 +86,6 @@ export interface ActivityRequestContext {
         version: string;
     };
     deploymentId?: string;
-    /** Toolkit this connection is scoped to, when `?toolkit=` selected one. */
-    toolkitId?: string;
     defer?: (promise: Promise<unknown>) => void;
     logger: Logger;
 }

package/dist/activity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,uBAAuB,GACvB,YAAY,GACZ,cAAc,CAAC;AAEnB,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,OAAO,GACP,SAAS,GACT,WAAW,CAAC;AAEhB;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG;IACrE,KAAK,EAAE,iBAAiB,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,IAAI,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,iFAAiF;AACjF,qBAAa,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,SAAgC;;CAK9C;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,KAAK,EAAE,aAAa,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,gFAAgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,qBAAqB,EACnB,aAAa,GACb,UAAU,GACV,SAAS,GACT,QAAQ,GACR,SAAS,GACT,YAAY,GACZ,UAAU,GACV,WAAW,CACd,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,sBAAsB,GAAG,SAAS,EAC3C,KAAK,EAAE,kBAAkB,GACxB,IAAI,CAmCN"}
+{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,uBAAuB,GACvB,YAAY,GACZ,cAAc,CAAC;AAEnB,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,OAAO,GACP,SAAS,GACT,WAAW,CAAC;AAEhB;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG;IACrE,KAAK,EAAE,iBAAiB,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,IAAI,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,iFAAiF;AACjF,qBAAa,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,SAAgC;;CAK9C;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,KAAK,EAAE,aAAa,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,gFAAgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,qBAAqB,EACnB,aAAa,GACb,UAAU,GACV,SAAS,GACT,QAAQ,GACR,SAAS,GACT,YAAY,GACZ,UAAU,GACV,WAAW,CACd,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,sBAAsB,GAAG,SAAS,EAC3C,KAAK,EAAE,kBAAkB,GACxB,IAAI,CAkCN"}

package/dist/activity.js

@@ -32,7 +32,6 @@ export function recordToolActivity(context, input) {
         ...(context.deploymentId
             ? { deploymentId: context.deploymentId }
             : {}),
-        ...(context.toolkitId ? { toolkitId: context.toolkitId } : {}),
     };
     try {
         const result = context.sink.record(event);

package/dist/activity.js.map

@@ -1 +1 @@
-{"version":3,"file":"activity.js","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AA+FA,iFAAiF;AACjF,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,4BAA4B,CAAC;IAE7C;QACE,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnC,CAAC;CACF;AA+BD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA2C,EAC3C,KAAyB;IAEzB,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,KAAK,GAA0B;QACnC,aAAa,EAAE,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;QACnC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO;QACzC,GAAG,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAQ,MAA2B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACtD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AAyFA,iFAAiF;AACjF,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,4BAA4B,CAAC;IAE7C;QACE,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnC,CAAC;CACF;AA6BD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA2C,EAC3C,KAAyB;IAEzB,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,KAAK,GAA0B;QACnC,aAAa,EAAE,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;QACnC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO;QACzC,GAAG,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAQ,MAA2B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACtD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/auth/bearer.d.ts

@@ -1,6 +1,5 @@
-import { type ToolkitBindingOptions } from "../toolkits.js";
 import type { InboundAuth } from "../types.js";
-export interface BearerTokenOptions extends ToolkitBindingOptions {
+export interface BearerTokenOptions {
     /** Stable identity for this credential, used on activity events. */
     subjectId?: string;
 }
@@ -8,11 +7,6 @@ export interface BearerTokenOptions extends ToolkitBindingOptions {
  * Static bearer-token inbound auth. Constant-time compares the Bearer token
  * against `secret`. Checked BEFORE the Clerk gate in the server; a mismatch
  * falls through so a co-configured Clerk provider can still admit the request.
- *
- * `toolkits` binds the token to named toolkits (docs/toolkits.md): one
- * `bearerToken(...)` per team credential, each naming the view that team may
- * open. Omit it and the token stays unbound — every declared toolkit plus the
- * full registry.
  */
 export declare function bearerToken(secret: string, options?: BearerTokenOptions): InboundAuth;
 //# sourceMappingURL=bearer.d.ts.map

package/dist/auth/bearer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB3D,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAC/D,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC/B,WAAW,CAkDb"}
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB3D,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC/B,WAAW,CA6Bb"}

package/dist/auth/bearer.js

@@ -1,4 +1,4 @@
-import { resolveToolkitBinding, } from "../toolkits.js";
+import { assertNoRetiredToolkitOptions } from "../retired-toolkits.js";
 const encoder = new TextEncoder();
 /** Constant-time byte comparison. Differing lengths still iterate to reduce leak. */
 function timingSafeEqual(a, b) {
@@ -11,40 +11,19 @@ function timingSafeEqual(a, b) {
     }
     let r = 0;
     for (let i = 0; i < a.length; i++)
-        r |= a[i] ^ b[i];
+        r |= (a[i] ?? 0) ^ (b[i] ?? 0);
     return r === 0;
 }
 /**
  * Static bearer-token inbound auth. Constant-time compares the Bearer token
  * against `secret`. Checked BEFORE the Clerk gate in the server; a mismatch
  * falls through so a co-configured Clerk provider can still admit the request.
- *
- * `toolkits` binds the token to named toolkits (docs/toolkits.md): one
- * `bearerToken(...)` per team credential, each naming the view that team may
- * open. Omit it and the token stays unbound — every declared toolkit plus the
- * full registry.
  */
 export function bearerToken(secret, options = {}) {
+    assertNoRetiredToolkitOptions("bearerToken", options);
     const secretBytes = encoder.encode(secret);
-    const toolkitBinding = resolveToolkitBinding(options.subjectId
-        ? `bearerToken (subjectId "${options.subjectId}")`
-        : "bearerToken", options);
-    if (toolkitBinding && !options.subjectId) {
-        // A bound token stands for one team, and both surfaces that report on it —
-        // the 403 refusal log (docs/toolkits.md) and activity events
-        // (docs/operator-ui.md) — can only say "bearer" without a subjectId. With
-        // several bound tokens that makes an operator unable to tell which
-        // credential was refused, or whose call succeeded. console.warn (as the
-        // Clerk adapter does) because an adapter is constructed before
-        // `createConnecta` has a logger to hand it.
-        console.warn("[connecta] bearerToken is bound to toolkits " +
-            `(${toolkitBinding.toolkits.join(", ") || "unscoped only"}) but has no ` +
-            "subjectId: refusal logs and activity events cannot say which " +
-            "credential they came from. Pass { subjectId: \"<team>\" }.");
-    }
     return {
         kind: "bearer",
-        ...(toolkitBinding ? { toolkitBinding } : {}),
         authorize(request) {
             const header = request.headers.get("authorization") ?? "";
             const match = /^Bearer\s+(.+)$/i.exec(header);

package/dist/auth/bearer.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,qFAAqF;AACrF,SAAS,eAAe,CAAC,CAAa,EAAE,CAAa;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,UAA8B,EAAE;IAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,qBAAqB,CAC1C,OAAO,CAAC,SAAS;QACf,CAAC,CAAC,2BAA2B,OAAO,CAAC,SAAS,IAAI;QAClD,CAAC,CAAC,aAAa,EACjB,OAAO,CACR,CAAC;IACF,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,2EAA2E;QAC3E,6DAA6D;QAC7D,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,+DAA+D;QAC/D,4CAA4C;QAC5C,OAAO,CAAC,IAAI,CACV,8CAA8C;YAC5C,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,eAAe;YACxE,+DAA+D;YAC/D,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,SAAS,CAAC,OAAO;YACf,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;gBACpE,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,kBAAkB,EAAE,QAAQ;qBAC7B;iBACF,CACF;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAGvE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,qFAAqF;AACrF,SAAS,eAAe,CAAC,CAAa,EAAE,CAAa;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,UAA8B,EAAE;IAEhC,6BAA6B,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,SAAS,CAAC,OAAO;YACf,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;gBACpE,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,kBAAkB,EAAE,QAAQ;qBAC7B;iBACF,CACF;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/clerk.d.ts

@@ -1,8 +1,7 @@
 import { createClerkClient } from "@clerk/backend";
-import { type ToolkitBindingOptions } from "../toolkits.js";
 import type { InboundAuth } from "../types.js";
 type ClerkClient = ReturnType<typeof createClerkClient>;
-export interface ClerkAuthOptions extends ToolkitBindingOptions {
+export interface ClerkAuthOptions {
     publishableKey: string;
     secretKey: string;
     /** Public base URL of this deployment. Defaults to the request origin. */
@@ -31,15 +30,7 @@ export interface ClerkAuthOptions extends ToolkitBindingOptions {
 /**
  * Clerk inbound auth.
  *
- * `allowedDomains` and `gate` decide WHO is admitted (both must pass);
- * `toolkits` decides WHICH view the admitted user gets.
- *
- * `toolkits` binds every user this provider admits to those toolkits
- * (docs/toolkits.md). For a per-team split, configure one `clerkAuth(...)` per
- * team — the same keys, a `gate` naming that team's users, and that team's
- * `toolkits`. The server tries providers in order and the first that admits the
- * user supplies the binding, so a user one gate rejects falls through to the
- * next.
+ * `allowedDomains` and `gate` decide who is admitted; both must pass.
  */
 export declare function clerkAuth(opts: ClerkAuthOptions): InboundAuth;
 export {};

package/dist/auth/clerk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clerk.d.ts","sourceRoot":"","sources":["../../src/auth/clerk.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAGxD,MAAM,WAAW,gBAAiB,SAAQ,qBAAqB;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA8KD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,CAmV7D"}
+{"version":3,"file":"clerk.d.ts","sourceRoot":"","sources":["../../src/auth/clerk.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAGxD,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAsMD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,CAyT7D"}