@zackbart/connecta 0.8.0 → 0.8.1

package/dist/routes/shared.js

@@ -1,4 +1,3 @@
-import { resolveIdentityBinding } from "../toolkits.js";
 import { operatorPageForPath } from "../ui.js";
 export function msg(err) {
     return err instanceof Error ? err.message : String(err);
@@ -12,21 +11,19 @@ export function privateJson(body, init = {}) {
 }
 const MAX_LOGGED_VALUE_LENGTH = 64;
 /**
- * Bounded, escaped form of a caller-influenced value (a rejected toolkit name,
- * identity id, or OAuth callback connector id) for the operator log. Goes
+ * Bounded, escaped form of a caller-influenced value (an identity id or OAuth
+ * callback connector id) for the operator log. Goes
  * through JSON.stringify so a caller-controlled newline or control character
  * cannot forge a log line, plus a hand-rolled escape for U+2028/U+2029, which
  * JSON.stringify leaves raw even though a log reader treats them as line
- * terminators. Truncated to a small shared cap (also the toolkit response's echo
- * limit), so an oversized value cannot flood the log either.
+ * terminators. Truncated to a small shared cap so an oversized value cannot
+ * flood the log either.
  */
 export function loggableValue(requested) {
     const bounded = requested.slice(0, MAX_LOGGED_VALUE_LENGTH);
     const escaped = JSON.stringify(bounded).replace(/[\u2028\u2029]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16)}`);
     return escaped + (bounded.length < requested.length ? " (truncated)" : "");
 }
-/** Length beyond which a rejected toolkit name is not echoed back. */
-export const MAX_ECHOED_TOOLKIT_NAME = MAX_LOGGED_VALUE_LENGTH;
 const ACTIVITY_ACTOR_NAMESPACE_RE = /^[\x21-\x7e]{1,256}$/;
 export function activityActorNamespace(provider) {
     return typeof provider.activityActorNamespace === "string" &&
@@ -34,16 +31,7 @@ export function activityActorNamespace(provider) {
         ? provider.activityActorNamespace
         : undefined;
 }
-/**
- * Refusal for an identity whose toolkit binding cannot be trusted — a malformed
- * declaration, or a malformed per-identity binding out of `authorize`. The
- * caller is authenticated, so this is a 403, and it is deliberately opaque: the
- * cause is an operator bug, and the operator reads it in the log, not the client.
- */
-function unusableBinding() {
-    return privateJson({ error: "forbidden" }, { status: 403 });
-}
-export async function authorize(request, baseUrl, auth, logger) {
+export async function authorize(request, baseUrl, auth) {
     if (auth.length === 0) {
         return { ok: true, actor: { kind: "anonymous" } };
     }
@@ -52,19 +40,6 @@ export async function authorize(request, baseUrl, auth, logger) {
         const result = await provider.authorize(request, baseUrl);
         if (result.ok) {
             const subjectId = result.subjectId ?? result.userId;
-            // Re-validate both halves and cap the per-identity one by the provider's
-            // declaration (see resolveIdentityBinding). A binding that does not
-            // type-check at runtime refuses the request rather than evaporating:
-            // dropping it would hand the caller the full registry, which is the one
-            // outcome a binding exists to prevent.
-            const binding = resolveIdentityBinding(provider.toolkitBinding, result.toolkitBinding);
-            if (!binding.ok) {
-                logger.warn(`[connecta] refused a request admitted by inbound auth provider ` +
-                    `"${provider.kind}" with 403: ${binding.reason}. Until it is fixed ` +
-                    "this provider cannot admit anyone, because connecta cannot tell " +
-                    "which toolkits the identity may use.");
-                return { ok: false, response: unusableBinding() };
-            }
             const actorNamespace = activityActorNamespace(provider);
             return {
                 ok: true,
@@ -78,7 +53,6 @@ export async function authorize(request, baseUrl, auth, logger) {
                 ...(result.userId && provider.uiAuth?.kind === "clerk"
                     ? { uiAdminEligible: true }
                     : {}),
-                ...(binding.binding ? { toolkitBinding: binding.binding } : {}),
             };
         }
         lastResponse = result.response;
@@ -95,35 +69,15 @@ export async function authorize(request, baseUrl, auth, logger) {
             }),
     };
 }
-/**
- * True when this identity is confined to one or more toolkits — bound, without
- * `unscoped`. Such a credential belongs to a team's agent, not to the operator
- * running the deployment, so the deployment-wide operator surfaces (`/ui/data`,
- * `/ui/activity`, the credential API) refuse it: their payloads describe every
- * connector in the org, which is exactly what the binding exists to withhold.
- */
-export function isToolkitRestricted(binding) {
-    return Boolean(binding && !binding.unscoped);
-}
-/** The refusal the deployment-wide operator surfaces give a bound identity. */
-export function restrictedOperatorSurface() {
-    return privateJson({
-        error: "this credential is bound to a toolkit and may not read " +
-            "deployment-wide operator data",
-    }, { status: 403 });
-}
-export async function authorizeUiAdmin(request, baseUrl, auth, logger, purpose = "credential management") {
+export async function authorizeUiAdmin(request, baseUrl, auth, purpose = "credential management") {
     // Operator mutation is intentionally narrower than /mcp and /ui/data: only
     // an interactive Clerk provider may admit it. A static bearer token is useful
     // for headless tool calls but must not become a deployment-admin key.
     //
-    // EVERY Clerk provider gets a turn, the way the /mcp gate does, because the
-    // documented per-team pattern is several `clerkAuth(...)`s that differ only in
-    // `gate` and `toolkits` (documentation/toolkits.md). Stopping at the first would make
-    // admission depend on config order: the team-bound provider listed first
-    // would refuse the operator outright, and a refusal here — a failed gate, a
-    // missing user, a toolkit-bound identity — is exactly the case where a later
-    // provider is the one meant to admit. The last refusal is returned if none do.
+    // Every Clerk provider gets a turn, the way the /mcp gate does. Stopping at
+    // the first would make admission depend on config order: a failed gate or
+    // missing user may simply mean a later provider is the one meant to admit.
+    // The last refusal is returned if none do.
     const providers = auth.filter((candidate) => candidate.uiAuth?.kind === "clerk");
     if (providers.length === 0) {
         return {
@@ -142,19 +96,6 @@ export async function authorizeUiAdmin(request, baseUrl, auth, logger, purpose =
             lastResponse = privateJson({ error: "authenticated user required" }, { status: 403 });
             continue;
         }
-        const binding = resolveIdentityBinding(provider.toolkitBinding, result.toolkitBinding);
-        if (!binding.ok) {
-            logger.warn(`[connecta] refused an operator-mutation request admitted by inbound auth ` +
-                `provider "${provider.kind}" with 403: ${binding.reason}.`);
-            lastResponse = unusableBinding();
-            continue;
-        }
-        // A toolkit-bound identity is a team's credential, not a vault admin key:
-        // credentials are deployment-wide, so writing one reaches every toolkit.
-        if (isToolkitRestricted(binding.binding)) {
-            lastResponse = restrictedOperatorSurface();
-            continue;
-        }
         return { ok: true, userId: result.userId };
     }
     return {

package/dist/routes/shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,sBAAsB,EAAgB,MAAM,gBAAgB,CAAC;AAQtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAkD/C,MAAM,UAAU,GAAG,CAAC,GAAY;IAC9B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAa,EACb,OAAqB,EAAE;IAEvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAC7C,iBAAiB,EACjB,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAC9C,CAAC;IACF,OAAO,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAE/D,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAE3D,MAAM,UAAU,sBAAsB,CACpC,QAAqB;IAErB,OAAO,OAAO,QAAQ,CAAC,sBAAsB,KAAK,QAAQ;QACxD,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACjE,CAAC,CAAC,QAAQ,CAAC,sBAAsB;QACjC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe;IACtB,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAgB,EAChB,OAAe,EACf,IAAmB,EACnB,MAAc;IAYd,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,GAAoB,IAAI,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC;YACpD,yEAAyE;YACzE,oEAAoE;YACpE,qEAAqE;YACrE,wEAAwE;YACxE,uCAAuC;YACvC,MAAM,OAAO,GAAG,sBAAsB,CACpC,QAAQ,CAAC,cAAc,EACvB,MAAM,CAAC,cAAc,CACtB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CACT,iEAAiE;oBAC/D,IAAI,QAAQ,CAAC,IAAI,eAAe,OAAO,CAAC,MAAM,sBAAsB;oBACpE,kEAAkE;oBAClE,sCAAsC,CACzC,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,CAAC;YACpD,CAAC;YACD,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YACxD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,SAAS,IAAI,cAAc;wBAC7B,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE;wBAC/B,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;oBACpD,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;oBAC3B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EACN,YAAY;YACZ,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;gBACtD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,QAAQ;iBAC7B;aACF,CAAC;KACL,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAmC;IAEnC,OAAO,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB;IACvC,OAAO,WAAW,CAChB;QACE,KAAK,EACH,yDAAyD;YACzD,+BAA+B;KAClC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,OAAe,EACf,IAAmB,EACnB,MAAc,EACd,OAAO,GAAG,uBAAuB;IAEjC,2EAA2E;IAC3E,8EAA8E;IAC9E,sEAAsE;IACtE,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,sFAAsF;IACtF,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAC3B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAClD,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,WAAW,CACnB,EAAE,KAAK,EAAE,GAAG,OAAO,gCAAgC,EAAE,EACrD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,GAAoB,IAAI,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,YAAY,GAAG,WAAW,CACxB,EAAE,KAAK,EAAE,6BAA6B,EAAE,EACxC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CACpC,QAAQ,CAAC,cAAc,EACvB,MAAM,CAAC,cAAc,CACtB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CACT,2EAA2E;gBACzE,aAAa,QAAQ,CAAC,IAAI,eAAe,OAAO,CAAC,MAAM,GAAG,CAC7D,CAAC;YACF,YAAY,GAAG,eAAe,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,YAAY,GAAG,yBAAyB,EAAE,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EACN,YAAY;YACZ,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,OAAe;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAkB,EAClB,UAAe,EACf,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAChD,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AA4C/C,MAAM,UAAU,GAAG,CAAC,GAAY;IAC9B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAa,EACb,OAAqB,EAAE;IAEvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAC7C,iBAAiB,EACjB,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAC9C,CAAC;IACF,OAAO,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAE3D,MAAM,UAAU,sBAAsB,CACpC,QAAqB;IAErB,OAAO,OAAO,QAAQ,CAAC,sBAAsB,KAAK,QAAQ;QACxD,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACjE,CAAC,CAAC,QAAQ,CAAC,sBAAsB;QACjC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAgB,EAChB,OAAe,EACf,IAAmB;IAUnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,GAAoB,IAAI,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC;YACpD,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YACxD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,SAAS,IAAI,cAAc;wBAC7B,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE;wBAC/B,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;oBACpD,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;oBAC3B,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EACN,YAAY;YACZ,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;gBACtD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,QAAQ;iBAC7B;aACF,CAAC;KACL,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,OAAe,EACf,IAAmB,EACnB,OAAO,GAAG,uBAAuB;IAEjC,2EAA2E;IAC3E,8EAA8E;IAC9E,sEAAsE;IACtE,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAC3B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAClD,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,WAAW,CACnB,EAAE,KAAK,EAAE,GAAG,OAAO,gCAAgC,EAAE,EACrD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,GAAoB,IAAI,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,YAAY,GAAG,WAAW,CACxB,EAAE,KAAK,EAAE,6BAA6B,EAAE,EACxC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACF,SAAS;QACX,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EACN,YAAY;YACZ,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,OAAe;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAkB,EAClB,UAAe,EACf,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAChD,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../src/routes/ui.ts"],"names":[],"mappings":"AAQA,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AAuCrB,wBAAsB,OAAO,CAC3B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAiG1B"}
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../src/routes/ui.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AAuCrB,wBAAsB,OAAO,CAC3B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyF1B"}

package/dist/routes/ui.js

@@ -1,6 +1,6 @@
 import { CONNECTA_FAVICON_ICO } from "../favicon.js";
 import { buildUiData, CONNECTA_FAVICON_SVG, credentialManagementCapability, operatorPageForPath, renderUiHtml, } from "../ui.js";
-import { authorize, isToolkitRestricted, privateJson, restrictedOperatorSurface, } from "./shared.js";
+import { authorize, privateJson, } from "./shared.js";
 /**
  * Headers that make an operator-supplied favicon body inert on this origin.
  * The SVG route is the sharp one: `image/svg+xml` is an *active* content type,
@@ -37,7 +37,7 @@ function uiScriptNonce() {
     return btoa(binary);
 }
 export async function routeUi(context) {
-    const { request, url, path, baseUrl, opts, defer, sweepCredentials } = context;
+    const { request, url, path, baseUrl, opts, defer } = context;
     if (request.method === "GET" && path === "/favicon.svg") {
         return new Response(opts.branding?.favicon?.svg ?? CONNECTA_FAVICON_SVG, {
             headers: {
@@ -96,15 +96,9 @@ export async function routeUi(context) {
     }
     if (path !== "/ui/data")
         return null;
-    const authz = await authorize(request, baseUrl, opts.auth, opts.logger);
+    const authz = await authorize(request, baseUrl, opts.auth);
     if (!authz.ok)
         return authz.response;
-    if (isToolkitRestricted(authz.toolkitBinding)) {
-        return restrictedOperatorSurface();
-    }
-    // After the restriction check, not before: an identity that may not
-    // read this surface should not get to trigger background work from it.
-    sweepCredentials();
     const eligibleClerkOperator = authz.uiAdminEligible === true;
     const credentialManagement = credentialManagementCapability({
         eligibleClerkOperator,
@@ -116,7 +110,7 @@ export async function routeUi(context) {
     const data = await buildUiData(opts.registry, baseUrl, opts.serverInfo, 
     // The static headless bearer may read connector health, but only a
     // Clerk-authenticated operator receives credential metadata.
-    eligibleClerkOperator ? opts.credentialVault : undefined, Boolean(opts.activity?.list), credentialManagement, opts.toolkits, defer, eligibleClerkOperator, opts.discoveryConcurrency);
+    eligibleClerkOperator ? opts.credentialVault : undefined, Boolean(opts.activity?.list), credentialManagement, defer, eligibleClerkOperator, opts.discoveryConcurrency);
     return privateJson(data);
 }
 //# sourceMappingURL=ui.js.map

package/dist/routes/ui.js.map

@@ -1 +1 @@
-{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/routes/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,8BAA8B,EAC9B,mBAAmB,EACnB,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,WAAW,EACX,yBAAyB,GAE1B,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,kBAAkB,GAAG;IACzB,yBAAyB,EACvB,wDAAwD;IAC1D,wBAAwB,EAAE,SAAS;CACpC,CAAC;AAEF,uFAAuF;AACvF,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAClE,OAAO,CAAC;IACV,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,oBAAoB,EAAE;YACvE,OAAO,EAAE;gBACP,cAAc,EAAE,eAAe;gBAC/B,eAAe,EAAE,uBAAuB;gBACxC,GAAG,kBAAkB;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,oBAAoB,EAAE;YACvE,OAAO,EAAE;gBACP,cAAc,EAAE,cAAc;gBAC9B,eAAe,EAAE,uBAAuB;gBACxC,GAAG,kBAAkB;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE;SACzC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CACjB,OAAO,CAAC,MAAM,KAAK,MAAM;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EACpE;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,yBAAyB,EACvB,qBAAqB,KAAK,6CAA6C;oBACvE,4DAA4D;gBAC9D,wBAAwB,EAAE,SAAS;aACpC;SACF,CACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IACrC,IAAI,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,OAAO,yBAAyB,EAAE,CAAC;IACrC,CAAC;IACD,oEAAoE;IACpE,uEAAuE;IACvE,gBAAgB,EAAE,CAAC;IACnB,MAAM,qBAAqB,GAAG,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;IAC7D,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;QAC1D,qBAAqB;QACrB,kBAAkB,EAAE,IAAI,CAAC,QAAQ;aAC9B,cAAc,EAAE;aAChB,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrD,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,QAAQ,EACb,OAAO,EACP,IAAI,CAAC,UAAU;IACf,mEAAmE;IACnE,6DAA6D;IAC7D,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EACxD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC5B,oBAAoB,EACpB,IAAI,CAAC,QAAQ,EACb,KAAK,EACL,qBAAqB,EACrB,IAAI,CAAC,oBAAoB,CAC1B,CAAC;IACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/routes/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,8BAA8B,EAC9B,mBAAmB,EACnB,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,SAAS,EACT,WAAW,GAEZ,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,kBAAkB,GAAG;IACzB,yBAAyB,EACvB,wDAAwD;IAC1D,wBAAwB,EAAE,SAAS;CACpC,CAAC;AAEF,uFAAuF;AACvF,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,oBAAoB,EAAE;YACvE,OAAO,EAAE;gBACP,cAAc,EAAE,eAAe;gBAC/B,eAAe,EAAE,uBAAuB;gBACxC,GAAG,kBAAkB;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,oBAAoB,EAAE;YACvE,OAAO,EAAE;gBACP,cAAc,EAAE,cAAc;gBAC9B,eAAe,EAAE,uBAAuB;gBACxC,GAAG,kBAAkB;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE;SACzC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CACjB,OAAO,CAAC,MAAM,KAAK,MAAM;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EACpE;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,yBAAyB,EACvB,qBAAqB,KAAK,6CAA6C;oBACvE,4DAA4D;gBAC9D,wBAAwB,EAAE,SAAS;aACpC;SACF,CACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IACrC,MAAM,qBAAqB,GAAG,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;IAC7D,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;QAC1D,qBAAqB;QACrB,kBAAkB,EAAE,IAAI,CAAC,QAAQ;aAC9B,cAAc,EAAE;aAChB,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrD,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,QAAQ,EACb,OAAO,EACP,IAAI,CAAC,UAAU;IACf,mEAAmE;IACnE,6DAA6D;IAC7D,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EACxD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC5B,oBAAoB,EACpB,KAAK,EACL,qBAAqB,EACrB,IAAI,CAAC,oBAAoB,CAC1B,CAAC;IACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,GAClB,CACD,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,uBAAuB,KACrC,OAAO,CAAC,QAAQ,CAAC,CA6LrB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,GAClB,CACD,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,uBAAuB,KACrC,OAAO,CAAC,QAAQ,CAAC,CA+JrB"}

package/dist/server.js

@@ -13,7 +13,7 @@ import { routeUi } from "./routes/ui.js";
  * wrapper is applied to every response.
  */
 export function createFetchHandler(opts) {
-    const { registry, auth, publicUrl } = opts;
+    const { auth, publicUrl, registry } = opts;
     const routeMcp = createMcpRoute(opts);
     return async function fetch(request, runtimeContext) {
         const url = new URL(request.url);
@@ -22,35 +22,6 @@ export function createFetchHandler(opts) {
         const defer = runtimeContext
             ? runtimeContext.waitUntil.bind(runtimeContext)
             : undefined;
-        /**
-         * Piggyback a DUE credential liveness sweep on traffic that has already been
-         * authenticated (issue #24). Started beside the request and never awaited by
-         * it: it must not add latency or change a result, so it is handed to
-         * `ctx.waitUntil` where the runtime has one (Workers, and the Node adapter's
-         * shim) to settle after the response. The registry answers `undefined`
-         * unless a sweep is actually due, so the ordinary request pays nothing.
-         */
-        const sweepCredentials = () => {
-            // Belt and braces: a rejected sweep is already absorbed below, and this
-            // catches the synchronous half — arming the gate, or a connector list that
-            // throws while deciding whether anything is due. Nothing about a
-            // background health check may turn a served request into a 500.
-            try {
-                const sweep = registry.sweepCredentialHealthIfDue(baseUrl, defer);
-                if (!sweep)
-                    return;
-                const settled = sweep.then(() => { }, (err) => {
-                    opts.logger.warn("[connecta] credential health sweep failed", err);
-                });
-                if (defer)
-                    defer(settled);
-                else
-                    void settled;
-            }
-            catch (err) {
-                opts.logger.warn("[connecta] credential health sweep failed", err);
-            }
-        };
         // Container and orchestrator probes reach /health over plain HTTP on
         // loopback, where no proxy has set X-Forwarded-Proto. Redirecting them to
         // the public origin would make an internal liveness check depend on
@@ -85,7 +56,6 @@ export function createFetchHandler(opts) {
             opts,
             defer,
             runtimeContext,
-            sweepCredentials,
         };
         const route = async () => {
             // Private mutations own OPTIONS so they never inherit wildcard CORS.

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,GAIpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAIzC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAmB;IAKnB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEtC,OAAO,KAAK,UAAU,KAAK,CACzB,OAAgB,EAChB,cAAwC;QAExC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,KAAK,GAAG,cAAc;YAC1B,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC;QAEd;;;;;;;WAOG;QACH,MAAM,gBAAgB,GAAG,GAAS,EAAE;YAClC,wEAAwE;YACxE,2EAA2E;YAC3E,iEAAiE;YACjE,gEAAgE;YAChE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAClE,IAAI,CAAC,KAAK;oBAAE,OAAO;gBACnB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,GAAG,EAAE,EAAE;oBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBACrE,CAAC,CACF,CAAC;gBACF,IAAI,KAAK;oBAAE,KAAK,CAAC,OAAO,CAAC,CAAC;;oBACrB,KAAK,OAAO,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC;QAEF,qEAAqE;QACrE,0EAA0E;QAC1E,oEAAoE;QACpE,yEAAyE;QACzE,mEAAmE;QACnE,oDAAoD;QACpD,IACE,SAAS;YACT,IAAI,KAAK,SAAS;YAClB,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,KAAK,QAAQ;YACxC,GAAG,CAAC,QAAQ,KAAK,OAAO,EACxB,CAAC;YACD,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,YAAY;YACZ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtD,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO,mBAAmB,CACxB,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACjB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE;aACzC,CAAC,EACF,GAAG,EACH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAiB;YAC5B,OAAO;YACP,GAAG;YACH,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,KAAK;YACL,cAAc;YACd,gBAAgB;SACjB,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,IAAuB,EAAE;YAC1C,qEAAqE;YACrE,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YAEpC,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAC;YAE5C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC5B,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;wBAC5B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBACjE,IAAI,QAAQ;4BAAE,OAAO,QAAQ,CAAC;oBAChC,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC5B,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;wBAC5B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBACjE,IAAI,QAAQ;4BAAE,OAAO,QAAQ,CAAC;oBAChC,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,GACjB,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACjD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE;oBACrC,CAAC,CAAC,SAAS,CAAC;gBAChB,OAAO,QAAQ,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM;oBAC5C,MAAM,EAAE,IAAI,CAAC,UAAU;oBACvB,SAAS,EAAE;wBACT,MAAM,EAAE,aAAa;wBACrB,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE;wBAC1C,IAAI,EAAE,IAAI,CAAC,QAAQ;4BACjB,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;4BAChD,CAAC,CAAC,IAAI;wBACR,eAAe,EAAE;4BACf,MAAM,EAAE,mCAAmC;4BAC3C,UAAU,EAAE,QAAQ,CAAC,qBAAqB,EAAE;yBAC7C;wBACD,cAAc,EAAE;4BACd,SAAS;4BACT,GAAG;4BACH,cAAc;4BACd,WAAW;4BACX,KAAK;4BACL,OAAO;yBACR;qBACF;oBACD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,aAAa;gBAAE,OAAO,aAAa,CAAC;YAExC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;YAElB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YAEpB,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,+BAA+B;YAC/B,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;gBAClD,IAAI,CAAC,SAAS,CAAC,aAAa;oBAAE,SAAS;gBACvC,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAC5C,OAAO,EACP,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAC3C,CAAC;oBACF,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yBAAyB,SAAS,CAAC,EAAE,wBAAwB,EAC7D,KAAK,CACN,CAAC;oBACF,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAED,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC;QAEF,OAAO,mBAAmB,CAAC,MAAM,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,GAIpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAIzC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAmB;IAKnB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEtC,OAAO,KAAK,UAAU,KAAK,CACzB,OAAgB,EAChB,cAAwC;QAExC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,KAAK,GAAG,cAAc;YAC1B,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC;QAEd,qEAAqE;QACrE,0EAA0E;QAC1E,oEAAoE;QACpE,yEAAyE;QACzE,mEAAmE;QACnE,oDAAoD;QACpD,IACE,SAAS;YACT,IAAI,KAAK,SAAS;YAClB,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,KAAK,QAAQ;YACxC,GAAG,CAAC,QAAQ,KAAK,OAAO,EACxB,CAAC;YACD,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,YAAY;YACZ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtD,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO,mBAAmB,CACxB,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACjB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE;aACzC,CAAC,EACF,GAAG,EACH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAiB;YAC5B,OAAO;YACP,GAAG;YACH,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,KAAK;YACL,cAAc;SACf,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,IAAuB,EAAE;YAC1C,qEAAqE;YACrE,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YAEpC,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAC;YAE5C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC5B,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;wBAC5B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBACjE,IAAI,QAAQ;4BAAE,OAAO,QAAQ,CAAC;oBAChC,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC5B,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;wBAC5B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBACjE,IAAI,QAAQ;4BAAE,OAAO,QAAQ,CAAC;oBAChC,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,GACjB,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACjD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE;oBACrC,CAAC,CAAC,SAAS,CAAC;gBAChB,OAAO,QAAQ,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM;oBAC5C,MAAM,EAAE,IAAI,CAAC,UAAU;oBACvB,SAAS,EAAE;wBACT,MAAM,EAAE,aAAa;wBACrB,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE;wBAC1C,IAAI,EAAE,IAAI,CAAC,QAAQ;4BACjB,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;4BAChD,CAAC,CAAC,IAAI;wBACR,eAAe,EAAE;4BACf,MAAM,EAAE,mCAAmC;4BAC3C,UAAU,EAAE,QAAQ,CAAC,qBAAqB,EAAE;yBAC7C;wBACD,cAAc,EAAE;4BACd,SAAS;4BACT,GAAG;4BACH,cAAc;4BACd,WAAW;4BACX,KAAK;4BACL,OAAO;yBACR;qBACF;oBACD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,aAAa;gBAAE,OAAO,aAAa,CAAC;YAExC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;YAElB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YAEpB,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,+BAA+B;YAC/B,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;gBAClD,IAAI,CAAC,SAAS,CAAC,aAAa;oBAAE,SAAS;gBACvC,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAC5C,OAAO,EACP,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAC3C,CAAC;oBACF,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yBAAyB,SAAS,CAAC,EAAE,wBAAwB,EAC7D,KAAK,CACN,CAAC;oBACF,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAED,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC;QAEF,OAAO,mBAAmB,CAAC,MAAM,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}

package/dist/skills.d.ts

@@ -1,6 +1,6 @@
 import type { Connector } from "./types.js";
-export declare const CONNECTA_INSTRUCTIONS = "Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas=\"compact\"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2\u201310 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results. For the detailed workflow, call skills({ name: \"usage\" }) once per task.";
-export declare const USAGE_SKILL = "# Connecta usage\n\n## Choose the smallest execution tool\n\n- Unknown address: `search_tools({ query, includeSchemas: \"compact\" })`.\n- Schema still unclear: `describe_tools({ addresses: [...] })`.\n- One explicitly read-only call: `call_tool`.\n- Two to ten independent explicitly read-only calls: `batch_call`.\n- Dependent read-only calls, loops, joins, branching, or large-result reduction: `execute_code` when available.\n- Any unannotated, write-capable, or destructive call: `call_destructive_tool`, individually and only after reviewing its schema and consequences.\n- Truncated result: retry with `fields` when possible; otherwise page it with `get_result`.\n- `auth_required`: use `authorize_connector`, have the operator complete consent, then confirm with `list_connectors`.\n\nUse `list_connectors({ probe: false })` for a fast inventory. Use `probe: true` only when diagnosing live health or authorization. The fast inventory already reports a connector whose stored credential failed a proactive check as `auth_required` (with `credentialCheck` and the URL to open), so trust it and authorize up front rather than probing to confirm.\n\n## Code mode\n\nUse code mode when a later call depends on an earlier result, when joining across connectors, or when filtering or aggregating data in the sandbox will substantially shrink the response. Use `Promise.all` or `connecta.batch` for independent calls inside one execution.\n\nDo not use code mode for one straightforward call, for independent calls already handled by `batch_call`, or for any tool not explicitly annotated `readOnlyHint: true`. Code mode has a bounded host-call budget and per-call deadline. Return only the reduced value the agent needs; do not return a large upstream payload unchanged.\n\n## Examples\n\nThese addresses are illustrative; always use the exact address returned by `search_tools`.\n\nSingle call:\n```json\n{ \"address\": \"crm.get_account\", \"args\": { \"id\": \"acct_123\" }, \"resultMode\": \"value\" }\n```\n\nIndependent calls:\n```json\n{ \"calls\": [\n  { \"address\": \"crm.get_account\", \"args\": { \"id\": \"acct_123\" } },\n  { \"address\": \"billing.list_invoices\", \"args\": { \"status\": \"open\" } }\n] }\n```\n\nDependent code with reduction:\n```js\nasync () => {\n  const accounts = await crm.search_accounts({ query: \"renewal\" });\n  const details = await Promise.all(\n    accounts.results.slice(0, 5).map((account) =>\n      crm.get_account({ id: account.id })\n    )\n  );\n  return details.map(({ id, name, status }) => ({ id, name, status }));\n}\n```\n";
+export declare const CONNECTA_INSTRUCTIONS = "Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas=\"compact\"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2\u201310 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results. Fetch skills({ name: \"usage\" }) when this routing workflow is unfamiliar.";
+export declare const USAGE_SKILL = "# Connecta usage\n\n## Choose the smallest execution tool\n\nUse exact addresses returned by discovery; never invent one.\n\n- Unknown address: `search_tools({ query, includeSchemas: \"compact\" })`.\n- Schema still unclear: `describe_tools({ addresses: [...] })`.\n- One explicitly read-only call: `call_tool`.\n- Two to ten independent explicitly read-only calls: `batch_call`.\n- Dependent read-only calls, loops, joins, branching, or large-result reduction: `execute_code` when available.\n- Any unannotated, write-capable, or destructive call: `call_destructive_tool`, individually and only after reviewing its schema and consequences.\n- Truncated result: retry with `fields` when possible; otherwise page it with `get_result`.\n- `auth_required`: use `authorize_connector`, give its recovery handoff to the operator, then retry the original call.\n\nUse `list_connectors({ probe: false })` for a fast inventory based on recent call observations and local credential-shape drift. Use `probe: true` only when diagnosing live health or authorization.\n\n## Code mode\n\nUse code mode when calls depend on earlier results, when joining connectors, or when sandbox filtering or aggregation will substantially shrink the response. Use `Promise.all` or `connecta.batch` for independent calls inside one execution.\n\nConnector namespace calls and `connecta.call` use the same read-only gate and throw on downstream errors. Catch only failures the workflow can handle; let authorization failures return to the agent for recovery.\n\nDo not use code mode for one call, independent calls already handled by `batch_call`, or any tool lacking `readOnlyHint: true`. Host calls and time are bounded. Return only the reduced value the agent needs.\n";
 /**
  * Appended to USAGE_SKILL only when the deployment actually has at least one
  * connector guide. A deployment with none — every deployment that has not
@@ -21,10 +21,7 @@ export interface SkillListing {
 /**
  * Every fetchable skill: the built-in guides plus one entry per connector that
  * carries a usage guide. Derived from the connector list passed in — the single
- * place guide visibility is decided. The `skills` meta-tool passes its
- * connection's `registry.listConnectors()`, so a toolkit-scoped session lists
- * only in-scope guides, and `resolveSkill` below reports an out-of-scope
- * `connector:<id>` exactly as it reports an unknown connector.
+ * place guide visibility is decided.
  */
 export declare function listSkills(connectors: readonly Connector[]): SkillListing[];
 export type SkillLookup = {

package/dist/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,eAAO,MAAM,qBAAqB,+qBACmoB,CAAC;AAEtqB,eAAO,MAAM,WAAW,4hFAkDvB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,odAIpC,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAI5E;AA2BD,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAGvE;AAyDD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,YAAY,EAAE,CAc3E;AAED,MAAM,MAAM,WAAW,GACrB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,WAAW,CAsCb"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,eAAO,MAAM,qBAAqB,grBACooB,CAAC;AAEvqB,eAAO,MAAM,WAAW,ktDAwBvB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,odAIpC,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAI5E;AA2BD,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAGvE;AAyDD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,YAAY,EAAE,CAc3E;AAED,MAAM,MAAM,WAAW,GACrB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,WAAW,CAsCb"}

package/dist/skills.js

@@ -1,8 +1,10 @@
-export const CONNECTA_INSTRUCTIONS = 'Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas="compact"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2–10 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results. For the detailed workflow, call skills({ name: "usage" }) once per task.';
+export const CONNECTA_INSTRUCTIONS = 'Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas="compact"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2–10 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results. Fetch skills({ name: "usage" }) when this routing workflow is unfamiliar.';
 export const USAGE_SKILL = `# Connecta usage
 
 ## Choose the smallest execution tool
 
+Use exact addresses returned by discovery; never invent one.
+
 - Unknown address: \`search_tools({ query, includeSchemas: "compact" })\`.
 - Schema still unclear: \`describe_tools({ addresses: [...] })\`.
 - One explicitly read-only call: \`call_tool\`.
@@ -10,45 +12,17 @@ export const USAGE_SKILL = `# Connecta usage
 - Dependent read-only calls, loops, joins, branching, or large-result reduction: \`execute_code\` when available.
 - Any unannotated, write-capable, or destructive call: \`call_destructive_tool\`, individually and only after reviewing its schema and consequences.
 - Truncated result: retry with \`fields\` when possible; otherwise page it with \`get_result\`.
-- \`auth_required\`: use \`authorize_connector\`, have the operator complete consent, then confirm with \`list_connectors\`.
+- \`auth_required\`: use \`authorize_connector\`, give its recovery handoff to the operator, then retry the original call.
 
-Use \`list_connectors({ probe: false })\` for a fast inventory. Use \`probe: true\` only when diagnosing live health or authorization. The fast inventory already reports a connector whose stored credential failed a proactive check as \`auth_required\` (with \`credentialCheck\` and the URL to open), so trust it and authorize up front rather than probing to confirm.
+Use \`list_connectors({ probe: false })\` for a fast inventory based on recent call observations and local credential-shape drift. Use \`probe: true\` only when diagnosing live health or authorization.
 
 ## Code mode
 
-Use code mode when a later call depends on an earlier result, when joining across connectors, or when filtering or aggregating data in the sandbox will substantially shrink the response. Use \`Promise.all\` or \`connecta.batch\` for independent calls inside one execution.
-
-Do not use code mode for one straightforward call, for independent calls already handled by \`batch_call\`, or for any tool not explicitly annotated \`readOnlyHint: true\`. Code mode has a bounded host-call budget and per-call deadline. Return only the reduced value the agent needs; do not return a large upstream payload unchanged.
-
-## Examples
+Use code mode when calls depend on earlier results, when joining connectors, or when sandbox filtering or aggregation will substantially shrink the response. Use \`Promise.all\` or \`connecta.batch\` for independent calls inside one execution.
 
-These addresses are illustrative; always use the exact address returned by \`search_tools\`.
+Connector namespace calls and \`connecta.call\` use the same read-only gate and throw on downstream errors. Catch only failures the workflow can handle; let authorization failures return to the agent for recovery.
 
-Single call:
-\`\`\`json
-{ "address": "crm.get_account", "args": { "id": "acct_123" }, "resultMode": "value" }
-\`\`\`
-
-Independent calls:
-\`\`\`json
-{ "calls": [
-  { "address": "crm.get_account", "args": { "id": "acct_123" } },
-  { "address": "billing.list_invoices", "args": { "status": "open" } }
-] }
-\`\`\`
-
-Dependent code with reduction:
-\`\`\`js
-async () => {
-  const accounts = await crm.search_accounts({ query: "renewal" });
-  const details = await Promise.all(
-    accounts.results.slice(0, 5).map((account) =>
-      crm.get_account({ id: account.id })
-    )
-  );
-  return details.map(({ id, name, status }) => ({ id, name, status }));
-}
-\`\`\`
+Do not use code mode for one call, independent calls already handled by \`batch_call\`, or any tool lacking \`readOnlyHint: true\`. Host calls and time are bounded. Return only the reduced value the agent needs.
 `;
 /**
  * Appended to USAGE_SKILL only when the deployment actually has at least one
@@ -152,10 +126,7 @@ function summarizeGuide(connector, guide) {
 /**
  * Every fetchable skill: the built-in guides plus one entry per connector that
  * carries a usage guide. Derived from the connector list passed in — the single
- * place guide visibility is decided. The `skills` meta-tool passes its
- * connection's `registry.listConnectors()`, so a toolkit-scoped session lists
- * only in-scope guides, and `resolveSkill` below reports an out-of-scope
- * `connector:<id>` exactly as it reports an unknown connector.
+ * place guide visibility is decided.
  */
 export function listSkills(connectors) {
     const listing = AVAILABLE_SKILLS.map((skill) => ({

package/dist/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAChC,mqBAAmqB,CAAC;AAEtqB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;CAIvC,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,UAAgC;IACjE,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,SAAS,CACvD,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,UAAgC;IAClD,OAAO,kBAAkB,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,WAAW,GAAG,wBAAwB;QACxC,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EACT,0FAA0F;QAC5F,OAAO,EAAE,UAAU;KACpB;CACO,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAE5C,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,GAAG,sBAAsB,GAAG,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAAoB;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC;IACnC,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,8EAA8E;AAC9E,MAAM,OAAO,GAAG,gCAAgC,CAAC;AAEjD,uCAAuC;AACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAEnC;;;;GAIG;AACH,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAExE,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,KAAe;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAoB,EAAE,KAAa;IACzD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,OAAO,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,OAAO;YAAE,SAAS;QACtB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5D,MAAM,IAAI,GAAG,GAAG;YACd,wEAAwE;YACxE,qDAAqD;aACpD,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;aAC3B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,OAAO,IAAI,CAAC,MAAM,IAAI,cAAc;YAClC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,WAAW,IAAI,oBAAoB,SAAS,CAAC,EAAE,IAAI,CAAC;AACvE,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,UAAgC;IACzD,MAAM,OAAO,GAAmB,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,UAAgC;IAEhC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,UAAU,CAAC,UAAU,CAAC;SACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,SAAS,EAAE,GAAG;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,cAAc,EAAE,2CAA2C,SAAS,EAAE,GAAG;aACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,kBAAkB,IAAI,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,wBAAwB,SAAS,EAAE,GAAG;gBAC7H,CAAC,CAAC,cAAc,IAAI,2CAA2C,SAAS,EAAE,GAAG;SAChF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,kBAAkB,IAAI,wBAAwB,SAAS,EAAE,GAAG;KACtE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAChC,oqBAAoqB,CAAC;AAEvqB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwB1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;CAIvC,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,UAAgC;IACjE,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,SAAS,CACvD,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,UAAgC;IAClD,OAAO,kBAAkB,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,WAAW,GAAG,wBAAwB;QACxC,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EACT,0FAA0F;QAC5F,OAAO,EAAE,UAAU;KACpB;CACO,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAE5C,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,GAAG,sBAAsB,GAAG,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAAoB;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC;IACnC,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,8EAA8E;AAC9E,MAAM,OAAO,GAAG,gCAAgC,CAAC;AAEjD,uCAAuC;AACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAEnC;;;;GAIG;AACH,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAExE,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,KAAe;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAoB,EAAE,KAAa;IACzD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,OAAO,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,OAAO;YAAE,SAAS;QACtB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5D,MAAM,IAAI,GAAG,GAAG;YACd,wEAAwE;YACxE,qDAAqD;aACpD,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;aAC3B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,OAAO,IAAI,CAAC,MAAM,IAAI,cAAc;YAClC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,WAAW,IAAI,oBAAoB,SAAS,CAAC,EAAE,IAAI,CAAC;AACvE,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,UAAgC;IACzD,MAAM,OAAO,GAAmB,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,UAAgC;IAEhC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,UAAU,CAAC,UAAU,CAAC;SACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,SAAS,EAAE,GAAG;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,cAAc,EAAE,2CAA2C,SAAS,EAAE,GAAG;aACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,kBAAkB,IAAI,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,wBAAwB,SAAS,EAAE,GAAG;gBAC7H,CAAC,CAAC,cAAc,IAAI,2CAA2C,SAAS,EAAE,GAAG;SAChF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,kBAAkB,IAAI,wBAAwB,SAAS,EAAE,GAAG;KACtE,CAAC;AACJ,CAAC"}

package/dist/timeout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAC3B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAC9C,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CA2BZ"}
+{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAC3B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAC9C,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CA2BZ"}

package/dist/timeout.js

@@ -1,7 +1,5 @@
-// The deadline vocabulary shared by every non-call downstream probe: the
-// discovery meta-tools' catalog fan-out (src/meta-tools.ts) and the credential
-// liveness checks (src/credential-health.ts). One definition so a "probe" means
-// the same thing, and is bounded the same way, wherever one is issued.
+// The deadline vocabulary shared by downstream discovery probes and tool calls.
+// One definition keeps those waits bounded consistently.
 /**
  * Generous default bound for a single downstream probe/catalog call. High enough
  * to trip only on a pathological hang, not a realistically slow probe.

package/dist/timeout.js.map

@@ -1 +1 @@
-{"version":3,"file":"timeout.js","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AAEvE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAChC,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAmB,EACnB,EAAU,EACV,KAAa;IAEb,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA8C,EAC9C,EAAU,EACV,KAAa;IAEb,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC/B,MAAM,CAAC,YAAY,CAAC,CAAC;QACvB,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"timeout.js","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,yDAAyD;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAChC,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAmB,EACnB,EAAU,EACV,KAAa;IAEb,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA8C,EAC9C,EAAU,EACV,KAAa;IAEb,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC/B,MAAM,CAAC,YAAY,CAAC,CAAC;QACvB,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/types.d.ts

@@ -153,7 +153,7 @@ export interface ConnectorContext {
     /** Requested connector-operation deadline in milliseconds. */
     timeoutMs?: number;
 }
-export type ConnectorStatusState = "ok" | "auth_required" | "error";
+type ConnectorStatusState = "ok" | "auth_required" | "error";
 export interface ConnectorStatus {
     state: ConnectorStatusState;
     /** When state === "auth_required", the URL the operator should open. */
@@ -197,19 +197,6 @@ export interface Connector {
     testCredential?(value: string, ctx: ConnectorContext): Promise<CredentialTestResult>;
     /** Optional multi-field credential check used by /credentials' Test action. */
     testCredentials?(values: ConnectorCredentialValues, ctx: ConnectorContext): Promise<CredentialTestResult>;
-    /**
-     * Optional: whether this connector currently holds a stored downstream
-     * credential — an OAuth grant it persisted, typically. Read only by the
-     * credential liveness checks: a connector with nothing stored has no
-     * credential whose liveness could be in question, and probing it anyway would
-     * start an authorization flow nobody asked for.
-     *
-     * Implement it on connectors that manage their own credential storage (the
-     * shipped `remoteMcp` does, for `auth: { type: "oauth" }`). Connectors whose
-     * credential lives in connecta's vault (`credential` above) need not: the
-     * vault answers for them. Must not perform downstream I/O.
-     */
-    hasStoredCredential?(ctx: ConnectorContext): Promise<boolean>;
     /**
      * Statically-known tool defs, exposed by in-code connectors (`api()`) for
      * startup convention checks. Remote connectors omit this — their tools are
@@ -342,48 +329,11 @@ export interface ExecutorLease {
     /** Idempotent. Call from finally even when provider construction fails. */
     release(): void;
 }
-/**
- * Which toolkits one inbound identity may open — the membership half of the
- * deployment=org / toolkit=team framing (documentation/toolkits.md). A mapping, never a
- * policy engine: one identity → the toolkit names it may select, plus whether
- * it may connect with no `?toolkit=` at all.
- *
- * An identity with NO binding is unbound and keeps the pre-binding behavior:
- * any declared toolkit, or the full registry. A binding is enforced at connect
- * time, before any scoped registry is constructed.
- */
-export interface ToolkitBinding {
-    /** Toolkit names this identity may select with `?toolkit=<name>`. */
-    readonly toolkits: readonly string[];
-    /**
-     * Whether this identity may also connect with no `?toolkit=` and see the full
-     * registry (and read the deployment-wide operator surfaces). Defaults to
-     * false: binding a credential to a toolkit means binding it.
-     */
-    readonly unscoped?: boolean;
-}
 /** Result of an inbound-auth check. */
 export type AuthResult = {
     ok: true;
     userId?: string;
     subjectId?: string;
-    /**
-     * Toolkit binding resolved for THIS identity — the seam for an adapter
-     * that maps its own users (or an IdP claim) to views. Omit to inherit the
-     * provider's `toolkitBinding`.
-     *
-     * When the provider also declares one, the declaration is a **CEILING**,
-     * not a default: connecta intersects the two, and grants `unscoped` only
-     * if both do. A per-identity binding can therefore narrow the credential's
-     * view but never widen it — otherwise an adapter reading a user-writable
-     * claim would let the user name their own toolkits. When the provider
-     * declares nothing, this binding is used as given.
-     *
-     * Validated on arrival (a malformed one refuses the request with 403
-     * rather than being ignored), but never checked against the configured
-     * toolkits, which is only possible for the static declaration at startup.
-     */
-    toolkitBinding?: ToolkitBinding;
 } | {
     ok: false;
     response: Response;
@@ -480,17 +430,10 @@ export interface InboundAuth {
      * provider instead of asking the operator to paste a static bearer secret.
      */
     uiAuth?: UiAuthConfig;
-    /**
-     * Optional toolkit binding for every identity this provider admits
-     * (documentation/toolkits.md). Declared statically so `createConnecta` can validate the
-     * names against `ConnectaConfig.toolkits` and throw on a typo — a binding
-     * nobody wrote is not one an operator can reason about. An `authorize` result
-     * may narrow it per identity with its own `toolkitBinding`.
-     */
-    toolkitBinding?: ToolkitBinding;
     /** Serve/short-circuit .well-known + OPTIONS. Return null when not handled. */
     handleMetadata?(request: Request, baseUrl: string): Response | null | Promise<Response | null>;
     /** Attempt to authorize a request. */
     authorize(request: Request, baseUrl: string): AuthResult | Promise<AuthResult>;
 }
+export {};
 //# sourceMappingURL=types.d.ts.map