@zackbart/connecta 0.8.0 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +128 -0
- package/README.md +31 -55
- package/SECURITY.md +5 -11
- package/dist/activity.d.ts +0 -8
- package/dist/activity.d.ts.map +1 -1
- package/dist/activity.js +0 -1
- package/dist/activity.js.map +1 -1
- package/dist/auth/bearer.d.ts +1 -7
- package/dist/auth/bearer.d.ts.map +1 -1
- package/dist/auth/bearer.js +2 -23
- package/dist/auth/bearer.js.map +1 -1
- package/dist/auth/clerk.d.ts +2 -11
- package/dist/auth/clerk.d.ts.map +1 -1
- package/dist/auth/clerk.js +31 -46
- package/dist/auth/clerk.js.map +1 -1
- package/dist/auth/downstream-oauth.d.ts +15 -6
- package/dist/auth/downstream-oauth.d.ts.map +1 -1
- package/dist/auth/downstream-oauth.js +60 -11
- package/dist/auth/downstream-oauth.js.map +1 -1
- package/dist/call-admission.d.ts.map +1 -1
- package/dist/call-admission.js +0 -1
- package/dist/call-admission.js.map +1 -1
- package/dist/catalog-service.d.ts +1 -2
- package/dist/catalog-service.d.ts.map +1 -1
- package/dist/catalog-service.js +12 -18
- package/dist/catalog-service.js.map +1 -1
- package/dist/catalog.d.ts +6 -0
- package/dist/catalog.d.ts.map +1 -1
- package/dist/catalog.js +51 -0
- package/dist/catalog.js.map +1 -1
- package/dist/connectors/remote-mcp.d.ts +1 -1
- package/dist/connectors/remote-mcp.d.ts.map +1 -1
- package/dist/connectors/remote-mcp.js +73 -71
- package/dist/connectors/remote-mcp.js.map +1 -1
- package/dist/errors.d.ts +19 -1
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js +1 -0
- package/dist/errors.js.map +1 -1
- package/dist/execute.d.ts +4 -9
- package/dist/execute.d.ts.map +1 -1
- package/dist/execute.js +41 -20
- package/dist/execute.js.map +1 -1
- package/dist/executor-result.js +1 -1
- package/dist/executor-result.js.map +1 -1
- package/dist/index.d.ts +3 -82
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +17 -90
- package/dist/index.js.map +1 -1
- package/dist/invocation.d.ts +5 -0
- package/dist/invocation.d.ts.map +1 -1
- package/dist/invocation.js +46 -10
- package/dist/invocation.js.map +1 -1
- package/dist/meta-tools.d.ts +4 -12
- package/dist/meta-tools.d.ts.map +1 -1
- package/dist/meta-tools.js +119 -169
- package/dist/meta-tools.js.map +1 -1
- package/dist/operator-ui/generated.d.ts +2 -2
- package/dist/operator-ui/generated.d.ts.map +1 -1
- package/dist/operator-ui/generated.js +2 -2
- package/dist/operator-ui/generated.js.map +1 -1
- package/dist/operator-ui/model.d.ts +1 -22
- package/dist/operator-ui/model.d.ts.map +1 -1
- package/dist/operator-ui/model.js.map +1 -1
- package/dist/registry.d.ts +11 -178
- package/dist/registry.d.ts.map +1 -1
- package/dist/registry.js +52 -330
- package/dist/registry.js.map +1 -1
- package/dist/retired-toolkits.d.ts +3 -0
- package/dist/retired-toolkits.d.ts.map +1 -0
- package/dist/retired-toolkits.js +9 -0
- package/dist/retired-toolkits.js.map +1 -0
- package/dist/routes/activity.d.ts.map +1 -1
- package/dist/routes/activity.js +2 -5
- package/dist/routes/activity.js.map +1 -1
- package/dist/routes/credentials.d.ts.map +1 -1
- package/dist/routes/credentials.js +1 -12
- package/dist/routes/credentials.js.map +1 -1
- package/dist/routes/mcp.d.ts.map +1 -1
- package/dist/routes/mcp.js +94 -188
- package/dist/routes/mcp.js.map +1 -1
- package/dist/routes/oauth.d.ts.map +1 -1
- package/dist/routes/oauth.js +3 -8
- package/dist/routes/oauth.js.map +1 -1
- package/dist/routes/shared.d.ts +9 -30
- package/dist/routes/shared.d.ts.map +1 -1
- package/dist/routes/shared.js +10 -69
- package/dist/routes/shared.js.map +1 -1
- package/dist/routes/ui.d.ts.map +1 -1
- package/dist/routes/ui.js +4 -10
- package/dist/routes/ui.js.map +1 -1
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +1 -31
- package/dist/server.js.map +1 -1
- package/dist/skills.d.ts +3 -6
- package/dist/skills.d.ts.map +1 -1
- package/dist/skills.js +9 -38
- package/dist/skills.js.map +1 -1
- package/dist/timeout.d.ts.map +1 -1
- package/dist/timeout.js +2 -4
- package/dist/timeout.js.map +1 -1
- package/dist/types.d.ts +8 -61
- package/dist/types.d.ts.map +1 -1
- package/dist/ui.d.ts +1 -2
- package/dist/ui.d.ts.map +1 -1
- package/dist/ui.js +5 -35
- package/dist/ui.js.map +1 -1
- package/dist/version.d.ts +1 -1
- package/dist/version.js +1 -1
- package/package.json +3 -2
- package/src/activity.ts +0 -9
- package/src/auth/bearer.ts +3 -32
- package/src/auth/clerk.ts +35 -48
- package/src/auth/downstream-oauth.ts +106 -24
- package/src/call-admission.ts +0 -1
- package/src/catalog-service.ts +23 -23
- package/src/catalog.ts +55 -0
- package/src/connectors/remote-mcp.ts +106 -86
- package/src/errors.ts +22 -0
- package/src/execute.ts +43 -24
- package/src/executor-result.ts +1 -1
- package/src/index.ts +24 -208
- package/src/invocation.ts +63 -10
- package/src/meta-tools.ts +139 -187
- package/src/operator-ui/browser.css +1 -54
- package/src/operator-ui/browser.ts +16 -150
- package/src/operator-ui/generated.ts +2 -2
- package/src/operator-ui/model.ts +1 -23
- package/src/registry.ts +59 -429
- package/src/retired-toolkits.ts +14 -0
- package/src/routes/activity.ts +1 -6
- package/src/routes/credentials.ts +0 -12
- package/src/routes/mcp.ts +110 -230
- package/src/routes/oauth.ts +2 -8
- package/src/routes/shared.ts +10 -100
- package/src/routes/ui.ts +2 -12
- package/src/server.ts +1 -31
- package/src/skills.ts +9 -38
- package/src/timeout.ts +2 -4
- package/src/types.ts +11 -62
- package/src/ui.ts +9 -46
- package/src/version.ts +1 -1
- package/dist/credential-health.d.ts +0 -205
- package/dist/credential-health.d.ts.map +0 -1
- package/dist/credential-health.js +0 -610
- package/dist/credential-health.js.map +0 -1
- package/dist/toolkits.d.ts +0 -124
- package/dist/toolkits.d.ts.map +0 -1
- package/dist/toolkits.js +0 -322
- package/dist/toolkits.js.map +0 -1
- package/src/credential-health.ts +0 -835
- package/src/toolkits.ts +0 -461
package/dist/routes/shared.d.ts
CHANGED
|
@@ -1,16 +1,15 @@
|
|
|
1
|
-
import type {
|
|
1
|
+
import type { Implementation } from "@modelcontextprotocol/server";
|
|
2
2
|
import type { ActivityActor, ActivityReadGate, ActivityStore } from "../activity.js";
|
|
3
3
|
import type { CredentialVault } from "../credentials.js";
|
|
4
4
|
import type { DeferredWork } from "../connector-scope.js";
|
|
5
5
|
import type { AdmissionController } from "../executor-admission.js";
|
|
6
6
|
import type { Registry } from "../registry.js";
|
|
7
|
-
import {
|
|
8
|
-
import type { ConnectaBranding, Executor, InboundAuth, Logger, ToolkitBinding } from "../types.js";
|
|
7
|
+
import type { ConnectaBranding, Executor, InboundAuth, Logger } from "../types.js";
|
|
9
8
|
export interface ServerOptions {
|
|
10
9
|
registry: Registry;
|
|
11
10
|
auth: InboundAuth[];
|
|
12
11
|
publicUrl?: string;
|
|
13
|
-
serverInfo:
|
|
12
|
+
serverInfo: Implementation;
|
|
14
13
|
logger: Logger;
|
|
15
14
|
activity?: ActivityStore;
|
|
16
15
|
activityReadGate?: ActivityReadGate;
|
|
@@ -30,11 +29,6 @@ export interface ServerOptions {
|
|
|
30
29
|
credentialVault?: CredentialVault;
|
|
31
30
|
/** Optional browser UI and OAuth result-page labels. */
|
|
32
31
|
branding?: ConnectaBranding;
|
|
33
|
-
/**
|
|
34
|
-
* Validated named scopes, selected per connection with `?toolkit=<name>` on
|
|
35
|
-
* `/mcp`. Omit (or leave empty) and every connection sees the full registry.
|
|
36
|
-
*/
|
|
37
|
-
toolkits?: ReadonlyMap<string, Toolkit>;
|
|
38
32
|
}
|
|
39
33
|
export interface RuntimeExecutionContext {
|
|
40
34
|
waitUntil(promise: Promise<unknown>): void;
|
|
@@ -47,45 +41,30 @@ export interface RouteContext {
|
|
|
47
41
|
opts: ServerOptions;
|
|
48
42
|
defer: DeferredWork | undefined;
|
|
49
43
|
runtimeContext: RuntimeExecutionContext | undefined;
|
|
50
|
-
sweepCredentials(): void;
|
|
51
44
|
}
|
|
52
45
|
export declare function msg(err: unknown): string;
|
|
53
46
|
export declare function privateJson(body: unknown, init?: ResponseInit): Response;
|
|
54
47
|
/**
|
|
55
|
-
* Bounded, escaped form of a caller-influenced value (
|
|
56
|
-
*
|
|
48
|
+
* Bounded, escaped form of a caller-influenced value (an identity id or OAuth
|
|
49
|
+
* callback connector id) for the operator log. Goes
|
|
57
50
|
* through JSON.stringify so a caller-controlled newline or control character
|
|
58
51
|
* cannot forge a log line, plus a hand-rolled escape for U+2028/U+2029, which
|
|
59
52
|
* JSON.stringify leaves raw even though a log reader treats them as line
|
|
60
|
-
* terminators. Truncated to a small shared cap
|
|
61
|
-
*
|
|
53
|
+
* terminators. Truncated to a small shared cap so an oversized value cannot
|
|
54
|
+
* flood the log either.
|
|
62
55
|
*/
|
|
63
56
|
export declare function loggableValue(requested: string): string;
|
|
64
|
-
/** Length beyond which a rejected toolkit name is not echoed back. */
|
|
65
|
-
export declare const MAX_ECHOED_TOOLKIT_NAME = 64;
|
|
66
57
|
export declare function activityActorNamespace(provider: InboundAuth): string | undefined;
|
|
67
|
-
export declare function authorize(request: Request, baseUrl: string, auth: InboundAuth[]
|
|
58
|
+
export declare function authorize(request: Request, baseUrl: string, auth: InboundAuth[]): Promise<{
|
|
68
59
|
ok: true;
|
|
69
60
|
actor: ActivityActor;
|
|
70
61
|
/** True only when the admitting provider can also authorize UI mutation. */
|
|
71
62
|
uiAdminEligible?: boolean;
|
|
72
|
-
/** The admitting identity's toolkit binding (documentation/toolkits.md). */
|
|
73
|
-
toolkitBinding?: ToolkitBinding;
|
|
74
63
|
} | {
|
|
75
64
|
ok: false;
|
|
76
65
|
response: Response;
|
|
77
66
|
}>;
|
|
78
|
-
|
|
79
|
-
* True when this identity is confined to one or more toolkits — bound, without
|
|
80
|
-
* `unscoped`. Such a credential belongs to a team's agent, not to the operator
|
|
81
|
-
* running the deployment, so the deployment-wide operator surfaces (`/ui/data`,
|
|
82
|
-
* `/ui/activity`, the credential API) refuse it: their payloads describe every
|
|
83
|
-
* connector in the org, which is exactly what the binding exists to withhold.
|
|
84
|
-
*/
|
|
85
|
-
export declare function isToolkitRestricted(binding: ToolkitBinding | undefined): boolean;
|
|
86
|
-
/** The refusal the deployment-wide operator surfaces give a bound identity. */
|
|
87
|
-
export declare function restrictedOperatorSurface(): Response;
|
|
88
|
-
export declare function authorizeUiAdmin(request: Request, baseUrl: string, auth: InboundAuth[], logger: Logger, purpose?: string): Promise<{
|
|
67
|
+
export declare function authorizeUiAdmin(request: Request, baseUrl: string, auth: InboundAuth[], purpose?: string): Promise<{
|
|
89
68
|
ok: true;
|
|
90
69
|
userId: string;
|
|
91
70
|
} | {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,
|
|
1
|
+
{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,MAAM,EACP,MAAM,aAAa,CAAC;AAGrB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,UAAU,EAAE,cAAc,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,kEAAkE;IAClE,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,2EAA2E;IAC3E,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,wDAAwD;IACxD,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,uBAAuB,GAAG,SAAS,CAAC;CACrD;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAExC;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,OAAO,EACb,IAAI,GAAE,YAAiB,GACtB,QAAQ,CAMV;AAID;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAOvD;AAID,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,WAAW,GACpB,MAAM,GAAG,SAAS,CAKpB;AAED,wBAAsB,SAAS,CAC7B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,EAAE,GAClB,OAAO,CACN;IACE,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,aAAa,CAAC;IACrB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CACpC,CAsCA;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,EAAE,EACnB,OAAO,SAA0B,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CA2C3E;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQvE;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,GAAG,EACf,IAAI,EAAE,MAAM,GACX,QAAQ,CAqBV"}
|
package/dist/routes/shared.js
CHANGED
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
import { resolveIdentityBinding } from "../toolkits.js";
|
|
2
1
|
import { operatorPageForPath } from "../ui.js";
|
|
3
2
|
export function msg(err) {
|
|
4
3
|
return err instanceof Error ? err.message : String(err);
|
|
@@ -12,21 +11,19 @@ export function privateJson(body, init = {}) {
|
|
|
12
11
|
}
|
|
13
12
|
const MAX_LOGGED_VALUE_LENGTH = 64;
|
|
14
13
|
/**
|
|
15
|
-
* Bounded, escaped form of a caller-influenced value (
|
|
16
|
-
*
|
|
14
|
+
* Bounded, escaped form of a caller-influenced value (an identity id or OAuth
|
|
15
|
+
* callback connector id) for the operator log. Goes
|
|
17
16
|
* through JSON.stringify so a caller-controlled newline or control character
|
|
18
17
|
* cannot forge a log line, plus a hand-rolled escape for U+2028/U+2029, which
|
|
19
18
|
* JSON.stringify leaves raw even though a log reader treats them as line
|
|
20
|
-
* terminators. Truncated to a small shared cap
|
|
21
|
-
*
|
|
19
|
+
* terminators. Truncated to a small shared cap so an oversized value cannot
|
|
20
|
+
* flood the log either.
|
|
22
21
|
*/
|
|
23
22
|
export function loggableValue(requested) {
|
|
24
23
|
const bounded = requested.slice(0, MAX_LOGGED_VALUE_LENGTH);
|
|
25
24
|
const escaped = JSON.stringify(bounded).replace(/[\u2028\u2029]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16)}`);
|
|
26
25
|
return escaped + (bounded.length < requested.length ? " (truncated)" : "");
|
|
27
26
|
}
|
|
28
|
-
/** Length beyond which a rejected toolkit name is not echoed back. */
|
|
29
|
-
export const MAX_ECHOED_TOOLKIT_NAME = MAX_LOGGED_VALUE_LENGTH;
|
|
30
27
|
const ACTIVITY_ACTOR_NAMESPACE_RE = /^[\x21-\x7e]{1,256}$/;
|
|
31
28
|
export function activityActorNamespace(provider) {
|
|
32
29
|
return typeof provider.activityActorNamespace === "string" &&
|
|
@@ -34,16 +31,7 @@ export function activityActorNamespace(provider) {
|
|
|
34
31
|
? provider.activityActorNamespace
|
|
35
32
|
: undefined;
|
|
36
33
|
}
|
|
37
|
-
|
|
38
|
-
* Refusal for an identity whose toolkit binding cannot be trusted — a malformed
|
|
39
|
-
* declaration, or a malformed per-identity binding out of `authorize`. The
|
|
40
|
-
* caller is authenticated, so this is a 403, and it is deliberately opaque: the
|
|
41
|
-
* cause is an operator bug, and the operator reads it in the log, not the client.
|
|
42
|
-
*/
|
|
43
|
-
function unusableBinding() {
|
|
44
|
-
return privateJson({ error: "forbidden" }, { status: 403 });
|
|
45
|
-
}
|
|
46
|
-
export async function authorize(request, baseUrl, auth, logger) {
|
|
34
|
+
export async function authorize(request, baseUrl, auth) {
|
|
47
35
|
if (auth.length === 0) {
|
|
48
36
|
return { ok: true, actor: { kind: "anonymous" } };
|
|
49
37
|
}
|
|
@@ -52,19 +40,6 @@ export async function authorize(request, baseUrl, auth, logger) {
|
|
|
52
40
|
const result = await provider.authorize(request, baseUrl);
|
|
53
41
|
if (result.ok) {
|
|
54
42
|
const subjectId = result.subjectId ?? result.userId;
|
|
55
|
-
// Re-validate both halves and cap the per-identity one by the provider's
|
|
56
|
-
// declaration (see resolveIdentityBinding). A binding that does not
|
|
57
|
-
// type-check at runtime refuses the request rather than evaporating:
|
|
58
|
-
// dropping it would hand the caller the full registry, which is the one
|
|
59
|
-
// outcome a binding exists to prevent.
|
|
60
|
-
const binding = resolveIdentityBinding(provider.toolkitBinding, result.toolkitBinding);
|
|
61
|
-
if (!binding.ok) {
|
|
62
|
-
logger.warn(`[connecta] refused a request admitted by inbound auth provider ` +
|
|
63
|
-
`"${provider.kind}" with 403: ${binding.reason}. Until it is fixed ` +
|
|
64
|
-
"this provider cannot admit anyone, because connecta cannot tell " +
|
|
65
|
-
"which toolkits the identity may use.");
|
|
66
|
-
return { ok: false, response: unusableBinding() };
|
|
67
|
-
}
|
|
68
43
|
const actorNamespace = activityActorNamespace(provider);
|
|
69
44
|
return {
|
|
70
45
|
ok: true,
|
|
@@ -78,7 +53,6 @@ export async function authorize(request, baseUrl, auth, logger) {
|
|
|
78
53
|
...(result.userId && provider.uiAuth?.kind === "clerk"
|
|
79
54
|
? { uiAdminEligible: true }
|
|
80
55
|
: {}),
|
|
81
|
-
...(binding.binding ? { toolkitBinding: binding.binding } : {}),
|
|
82
56
|
};
|
|
83
57
|
}
|
|
84
58
|
lastResponse = result.response;
|
|
@@ -95,35 +69,15 @@ export async function authorize(request, baseUrl, auth, logger) {
|
|
|
95
69
|
}),
|
|
96
70
|
};
|
|
97
71
|
}
|
|
98
|
-
|
|
99
|
-
* True when this identity is confined to one or more toolkits — bound, without
|
|
100
|
-
* `unscoped`. Such a credential belongs to a team's agent, not to the operator
|
|
101
|
-
* running the deployment, so the deployment-wide operator surfaces (`/ui/data`,
|
|
102
|
-
* `/ui/activity`, the credential API) refuse it: their payloads describe every
|
|
103
|
-
* connector in the org, which is exactly what the binding exists to withhold.
|
|
104
|
-
*/
|
|
105
|
-
export function isToolkitRestricted(binding) {
|
|
106
|
-
return Boolean(binding && !binding.unscoped);
|
|
107
|
-
}
|
|
108
|
-
/** The refusal the deployment-wide operator surfaces give a bound identity. */
|
|
109
|
-
export function restrictedOperatorSurface() {
|
|
110
|
-
return privateJson({
|
|
111
|
-
error: "this credential is bound to a toolkit and may not read " +
|
|
112
|
-
"deployment-wide operator data",
|
|
113
|
-
}, { status: 403 });
|
|
114
|
-
}
|
|
115
|
-
export async function authorizeUiAdmin(request, baseUrl, auth, logger, purpose = "credential management") {
|
|
72
|
+
export async function authorizeUiAdmin(request, baseUrl, auth, purpose = "credential management") {
|
|
116
73
|
// Operator mutation is intentionally narrower than /mcp and /ui/data: only
|
|
117
74
|
// an interactive Clerk provider may admit it. A static bearer token is useful
|
|
118
75
|
// for headless tool calls but must not become a deployment-admin key.
|
|
119
76
|
//
|
|
120
|
-
//
|
|
121
|
-
//
|
|
122
|
-
//
|
|
123
|
-
//
|
|
124
|
-
// would refuse the operator outright, and a refusal here — a failed gate, a
|
|
125
|
-
// missing user, a toolkit-bound identity — is exactly the case where a later
|
|
126
|
-
// provider is the one meant to admit. The last refusal is returned if none do.
|
|
77
|
+
// Every Clerk provider gets a turn, the way the /mcp gate does. Stopping at
|
|
78
|
+
// the first would make admission depend on config order: a failed gate or
|
|
79
|
+
// missing user may simply mean a later provider is the one meant to admit.
|
|
80
|
+
// The last refusal is returned if none do.
|
|
127
81
|
const providers = auth.filter((candidate) => candidate.uiAuth?.kind === "clerk");
|
|
128
82
|
if (providers.length === 0) {
|
|
129
83
|
return {
|
|
@@ -142,19 +96,6 @@ export async function authorizeUiAdmin(request, baseUrl, auth, logger, purpose =
|
|
|
142
96
|
lastResponse = privateJson({ error: "authenticated user required" }, { status: 403 });
|
|
143
97
|
continue;
|
|
144
98
|
}
|
|
145
|
-
const binding = resolveIdentityBinding(provider.toolkitBinding, result.toolkitBinding);
|
|
146
|
-
if (!binding.ok) {
|
|
147
|
-
logger.warn(`[connecta] refused an operator-mutation request admitted by inbound auth ` +
|
|
148
|
-
`provider "${provider.kind}" with 403: ${binding.reason}.`);
|
|
149
|
-
lastResponse = unusableBinding();
|
|
150
|
-
continue;
|
|
151
|
-
}
|
|
152
|
-
// A toolkit-bound identity is a team's credential, not a vault admin key:
|
|
153
|
-
// credentials are deployment-wide, so writing one reaches every toolkit.
|
|
154
|
-
if (isToolkitRestricted(binding.binding)) {
|
|
155
|
-
lastResponse = restrictedOperatorSurface();
|
|
156
|
-
continue;
|
|
157
|
-
}
|
|
158
99
|
return { ok: true, userId: result.userId };
|
|
159
100
|
}
|
|
160
101
|
return {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AA4C/C,MAAM,UAAU,GAAG,CAAC,GAAY;IAC9B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAa,EACb,OAAqB,EAAE;IAEvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAC7C,iBAAiB,EACjB,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAC9C,CAAC;IACF,OAAO,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAE3D,MAAM,UAAU,sBAAsB,CACpC,QAAqB;IAErB,OAAO,OAAO,QAAQ,CAAC,sBAAsB,KAAK,QAAQ;QACxD,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACjE,CAAC,CAAC,QAAQ,CAAC,sBAAsB;QACjC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAgB,EAChB,OAAe,EACf,IAAmB;IAUnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,GAAoB,IAAI,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC;YACpD,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YACxD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,SAAS,IAAI,cAAc;wBAC7B,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE;wBAC/B,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;oBACpD,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;oBAC3B,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EACN,YAAY;YACZ,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;gBACtD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,QAAQ;iBAC7B;aACF,CAAC;KACL,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,OAAe,EACf,IAAmB,EACnB,OAAO,GAAG,uBAAuB;IAEjC,2EAA2E;IAC3E,8EAA8E;IAC9E,sEAAsE;IACtE,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAC3B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAClD,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,WAAW,CACnB,EAAE,KAAK,EAAE,GAAG,OAAO,gCAAgC,EAAE,EACrD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,GAAoB,IAAI,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,YAAY,GAAG,WAAW,CACxB,EAAE,KAAK,EAAE,6BAA6B,EAAE,EACxC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACF,SAAS;QACX,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EACN,YAAY;YACZ,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,OAAe;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAkB,EAClB,UAAe,EACf,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAChD,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}
|
package/dist/routes/ui.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../src/routes/ui.ts"],"names":[],"mappings":"AAQA,OAAO,
|
|
1
|
+
{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../src/routes/ui.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AAuCrB,wBAAsB,OAAO,CAC3B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyF1B"}
|
package/dist/routes/ui.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { CONNECTA_FAVICON_ICO } from "../favicon.js";
|
|
2
2
|
import { buildUiData, CONNECTA_FAVICON_SVG, credentialManagementCapability, operatorPageForPath, renderUiHtml, } from "../ui.js";
|
|
3
|
-
import { authorize,
|
|
3
|
+
import { authorize, privateJson, } from "./shared.js";
|
|
4
4
|
/**
|
|
5
5
|
* Headers that make an operator-supplied favicon body inert on this origin.
|
|
6
6
|
* The SVG route is the sharp one: `image/svg+xml` is an *active* content type,
|
|
@@ -37,7 +37,7 @@ function uiScriptNonce() {
|
|
|
37
37
|
return btoa(binary);
|
|
38
38
|
}
|
|
39
39
|
export async function routeUi(context) {
|
|
40
|
-
const { request, url, path, baseUrl, opts, defer
|
|
40
|
+
const { request, url, path, baseUrl, opts, defer } = context;
|
|
41
41
|
if (request.method === "GET" && path === "/favicon.svg") {
|
|
42
42
|
return new Response(opts.branding?.favicon?.svg ?? CONNECTA_FAVICON_SVG, {
|
|
43
43
|
headers: {
|
|
@@ -96,15 +96,9 @@ export async function routeUi(context) {
|
|
|
96
96
|
}
|
|
97
97
|
if (path !== "/ui/data")
|
|
98
98
|
return null;
|
|
99
|
-
const authz = await authorize(request, baseUrl, opts.auth
|
|
99
|
+
const authz = await authorize(request, baseUrl, opts.auth);
|
|
100
100
|
if (!authz.ok)
|
|
101
101
|
return authz.response;
|
|
102
|
-
if (isToolkitRestricted(authz.toolkitBinding)) {
|
|
103
|
-
return restrictedOperatorSurface();
|
|
104
|
-
}
|
|
105
|
-
// After the restriction check, not before: an identity that may not
|
|
106
|
-
// read this surface should not get to trigger background work from it.
|
|
107
|
-
sweepCredentials();
|
|
108
102
|
const eligibleClerkOperator = authz.uiAdminEligible === true;
|
|
109
103
|
const credentialManagement = credentialManagementCapability({
|
|
110
104
|
eligibleClerkOperator,
|
|
@@ -116,7 +110,7 @@ export async function routeUi(context) {
|
|
|
116
110
|
const data = await buildUiData(opts.registry, baseUrl, opts.serverInfo,
|
|
117
111
|
// The static headless bearer may read connector health, but only a
|
|
118
112
|
// Clerk-authenticated operator receives credential metadata.
|
|
119
|
-
eligibleClerkOperator ? opts.credentialVault : undefined, Boolean(opts.activity?.list), credentialManagement,
|
|
113
|
+
eligibleClerkOperator ? opts.credentialVault : undefined, Boolean(opts.activity?.list), credentialManagement, defer, eligibleClerkOperator, opts.discoveryConcurrency);
|
|
120
114
|
return privateJson(data);
|
|
121
115
|
}
|
|
122
116
|
//# sourceMappingURL=ui.js.map
|
package/dist/routes/ui.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/routes/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,8BAA8B,EAC9B,mBAAmB,EACnB,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,SAAS,EACT,
|
|
1
|
+
{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/routes/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,8BAA8B,EAC9B,mBAAmB,EACnB,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,SAAS,EACT,WAAW,GAEZ,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,kBAAkB,GAAG;IACzB,yBAAyB,EACvB,wDAAwD;IAC1D,wBAAwB,EAAE,SAAS;CACpC,CAAC;AAEF,uFAAuF;AACvF,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,oBAAoB,EAAE;YACvE,OAAO,EAAE;gBACP,cAAc,EAAE,eAAe;gBAC/B,eAAe,EAAE,uBAAuB;gBACxC,GAAG,kBAAkB;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,oBAAoB,EAAE;YACvE,OAAO,EAAE;gBACP,cAAc,EAAE,cAAc;gBAC9B,eAAe,EAAE,uBAAuB;gBACxC,GAAG,kBAAkB;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE;SACzC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CACjB,OAAO,CAAC,MAAM,KAAK,MAAM;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EACpE;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,yBAAyB,EACvB,qBAAqB,KAAK,6CAA6C;oBACvE,4DAA4D;gBAC9D,wBAAwB,EAAE,SAAS;aACpC;SACF,CACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IACrC,MAAM,qBAAqB,GAAG,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;IAC7D,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;QAC1D,qBAAqB;QACrB,kBAAkB,EAAE,IAAI,CAAC,QAAQ;aAC9B,cAAc,EAAE;aAChB,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrD,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,QAAQ,EACb,OAAO,EACP,IAAI,CAAC,UAAU;IACf,mEAAmE;IACnE,6DAA6D;IAC7D,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EACxD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC5B,oBAAoB,EACpB,KAAK,EACL,qBAAqB,EACrB,IAAI,CAAC,oBAAoB,CAC1B,CAAC;IACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}
|
package/dist/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,GAClB,CACD,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,uBAAuB,KACrC,OAAO,CAAC,QAAQ,CAAC,
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,GAClB,CACD,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,uBAAuB,KACrC,OAAO,CAAC,QAAQ,CAAC,CA+JrB"}
|
package/dist/server.js
CHANGED
|
@@ -13,7 +13,7 @@ import { routeUi } from "./routes/ui.js";
|
|
|
13
13
|
* wrapper is applied to every response.
|
|
14
14
|
*/
|
|
15
15
|
export function createFetchHandler(opts) {
|
|
16
|
-
const {
|
|
16
|
+
const { auth, publicUrl, registry } = opts;
|
|
17
17
|
const routeMcp = createMcpRoute(opts);
|
|
18
18
|
return async function fetch(request, runtimeContext) {
|
|
19
19
|
const url = new URL(request.url);
|
|
@@ -22,35 +22,6 @@ export function createFetchHandler(opts) {
|
|
|
22
22
|
const defer = runtimeContext
|
|
23
23
|
? runtimeContext.waitUntil.bind(runtimeContext)
|
|
24
24
|
: undefined;
|
|
25
|
-
/**
|
|
26
|
-
* Piggyback a DUE credential liveness sweep on traffic that has already been
|
|
27
|
-
* authenticated (issue #24). Started beside the request and never awaited by
|
|
28
|
-
* it: it must not add latency or change a result, so it is handed to
|
|
29
|
-
* `ctx.waitUntil` where the runtime has one (Workers, and the Node adapter's
|
|
30
|
-
* shim) to settle after the response. The registry answers `undefined`
|
|
31
|
-
* unless a sweep is actually due, so the ordinary request pays nothing.
|
|
32
|
-
*/
|
|
33
|
-
const sweepCredentials = () => {
|
|
34
|
-
// Belt and braces: a rejected sweep is already absorbed below, and this
|
|
35
|
-
// catches the synchronous half — arming the gate, or a connector list that
|
|
36
|
-
// throws while deciding whether anything is due. Nothing about a
|
|
37
|
-
// background health check may turn a served request into a 500.
|
|
38
|
-
try {
|
|
39
|
-
const sweep = registry.sweepCredentialHealthIfDue(baseUrl, defer);
|
|
40
|
-
if (!sweep)
|
|
41
|
-
return;
|
|
42
|
-
const settled = sweep.then(() => { }, (err) => {
|
|
43
|
-
opts.logger.warn("[connecta] credential health sweep failed", err);
|
|
44
|
-
});
|
|
45
|
-
if (defer)
|
|
46
|
-
defer(settled);
|
|
47
|
-
else
|
|
48
|
-
void settled;
|
|
49
|
-
}
|
|
50
|
-
catch (err) {
|
|
51
|
-
opts.logger.warn("[connecta] credential health sweep failed", err);
|
|
52
|
-
}
|
|
53
|
-
};
|
|
54
25
|
// Container and orchestrator probes reach /health over plain HTTP on
|
|
55
26
|
// loopback, where no proxy has set X-Forwarded-Proto. Redirecting them to
|
|
56
27
|
// the public origin would make an internal liveness check depend on
|
|
@@ -85,7 +56,6 @@ export function createFetchHandler(opts) {
|
|
|
85
56
|
opts,
|
|
86
57
|
defer,
|
|
87
58
|
runtimeContext,
|
|
88
|
-
sweepCredentials,
|
|
89
59
|
};
|
|
90
60
|
const route = async () => {
|
|
91
61
|
// Private mutations own OPTIONS so they never inherit wildcard CORS.
|
package/dist/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,GAIpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAIzC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAmB;IAKnB,MAAM,EAAE,
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,GAIpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAIzC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAmB;IAKnB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEtC,OAAO,KAAK,UAAU,KAAK,CACzB,OAAgB,EAChB,cAAwC;QAExC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,KAAK,GAAG,cAAc;YAC1B,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC;QAEd,qEAAqE;QACrE,0EAA0E;QAC1E,oEAAoE;QACpE,yEAAyE;QACzE,mEAAmE;QACnE,oDAAoD;QACpD,IACE,SAAS;YACT,IAAI,KAAK,SAAS;YAClB,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,KAAK,QAAQ;YACxC,GAAG,CAAC,QAAQ,KAAK,OAAO,EACxB,CAAC;YACD,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,YAAY;YACZ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtD,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO,mBAAmB,CACxB,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACjB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE;aACzC,CAAC,EACF,GAAG,EACH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAiB;YAC5B,OAAO;YACP,GAAG;YACH,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,KAAK;YACL,cAAc;SACf,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,IAAuB,EAAE;YAC1C,qEAAqE;YACrE,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YAEpC,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAC;YAE5C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC5B,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;wBAC5B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBACjE,IAAI,QAAQ;4BAAE,OAAO,QAAQ,CAAC;oBAChC,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC5B,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;wBAC5B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBACjE,IAAI,QAAQ;4BAAE,OAAO,QAAQ,CAAC;oBAChC,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,GACjB,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACjD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE;oBACrC,CAAC,CAAC,SAAS,CAAC;gBAChB,OAAO,QAAQ,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM;oBAC5C,MAAM,EAAE,IAAI,CAAC,UAAU;oBACvB,SAAS,EAAE;wBACT,MAAM,EAAE,aAAa;wBACrB,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE;wBAC1C,IAAI,EAAE,IAAI,CAAC,QAAQ;4BACjB,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;4BAChD,CAAC,CAAC,IAAI;wBACR,eAAe,EAAE;4BACf,MAAM,EAAE,mCAAmC;4BAC3C,UAAU,EAAE,QAAQ,CAAC,qBAAqB,EAAE;yBAC7C;wBACD,cAAc,EAAE;4BACd,SAAS;4BACT,GAAG;4BACH,cAAc;4BACd,WAAW;4BACX,KAAK;4BACL,OAAO;yBACR;qBACF;oBACD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,aAAa;gBAAE,OAAO,aAAa,CAAC;YAExC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;YAElB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YAEpB,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,+BAA+B;YAC/B,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;gBAClD,IAAI,CAAC,SAAS,CAAC,aAAa;oBAAE,SAAS;gBACvC,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAC5C,OAAO,EACP,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAC3C,CAAC;oBACF,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yBAAyB,SAAS,CAAC,EAAE,wBAAwB,EAC7D,KAAK,CACN,CAAC;oBACF,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAED,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC;QAEF,OAAO,mBAAmB,CAAC,MAAM,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}
|
package/dist/skills.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import type { Connector } from "./types.js";
|
|
2
|
-
export declare const CONNECTA_INSTRUCTIONS = "Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas=\"compact\"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2\u201310 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results.
|
|
3
|
-
export declare const USAGE_SKILL = "# Connecta usage\n\n## Choose the smallest execution tool\n\n- Unknown address: `search_tools({ query, includeSchemas: \"compact\" })`.\n- Schema still unclear: `describe_tools({ addresses: [...] })`.\n- One explicitly read-only call: `call_tool`.\n- Two to ten independent explicitly read-only calls: `batch_call`.\n- Dependent read-only calls, loops, joins, branching, or large-result reduction: `execute_code` when available.\n- Any unannotated, write-capable, or destructive call: `call_destructive_tool`, individually and only after reviewing its schema and consequences.\n- Truncated result: retry with `fields` when possible; otherwise page it with `get_result`.\n- `auth_required`: use `authorize_connector`,
|
|
2
|
+
export declare const CONNECTA_INSTRUCTIONS = "Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas=\"compact\"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2\u201310 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results. Fetch skills({ name: \"usage\" }) when this routing workflow is unfamiliar.";
|
|
3
|
+
export declare const USAGE_SKILL = "# Connecta usage\n\n## Choose the smallest execution tool\n\nUse exact addresses returned by discovery; never invent one.\n\n- Unknown address: `search_tools({ query, includeSchemas: \"compact\" })`.\n- Schema still unclear: `describe_tools({ addresses: [...] })`.\n- One explicitly read-only call: `call_tool`.\n- Two to ten independent explicitly read-only calls: `batch_call`.\n- Dependent read-only calls, loops, joins, branching, or large-result reduction: `execute_code` when available.\n- Any unannotated, write-capable, or destructive call: `call_destructive_tool`, individually and only after reviewing its schema and consequences.\n- Truncated result: retry with `fields` when possible; otherwise page it with `get_result`.\n- `auth_required`: use `authorize_connector`, give its recovery handoff to the operator, then retry the original call.\n\nUse `list_connectors({ probe: false })` for a fast inventory based on recent call observations and local credential-shape drift. Use `probe: true` only when diagnosing live health or authorization.\n\n## Code mode\n\nUse code mode when calls depend on earlier results, when joining connectors, or when sandbox filtering or aggregation will substantially shrink the response. Use `Promise.all` or `connecta.batch` for independent calls inside one execution.\n\nConnector namespace calls and `connecta.call` use the same read-only gate and throw on downstream errors. Catch only failures the workflow can handle; let authorization failures return to the agent for recovery.\n\nDo not use code mode for one call, independent calls already handled by `batch_call`, or any tool lacking `readOnlyHint: true`. Host calls and time are bounded. Return only the reduced value the agent needs.\n";
|
|
4
4
|
/**
|
|
5
5
|
* Appended to USAGE_SKILL only when the deployment actually has at least one
|
|
6
6
|
* connector guide. A deployment with none — every deployment that has not
|
|
@@ -21,10 +21,7 @@ export interface SkillListing {
|
|
|
21
21
|
/**
|
|
22
22
|
* Every fetchable skill: the built-in guides plus one entry per connector that
|
|
23
23
|
* carries a usage guide. Derived from the connector list passed in — the single
|
|
24
|
-
* place guide visibility is decided.
|
|
25
|
-
* connection's `registry.listConnectors()`, so a toolkit-scoped session lists
|
|
26
|
-
* only in-scope guides, and `resolveSkill` below reports an out-of-scope
|
|
27
|
-
* `connector:<id>` exactly as it reports an unknown connector.
|
|
24
|
+
* place guide visibility is decided.
|
|
28
25
|
*/
|
|
29
26
|
export declare function listSkills(connectors: readonly Connector[]): SkillListing[];
|
|
30
27
|
export type SkillLookup = {
|
package/dist/skills.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,eAAO,MAAM,qBAAqB
|
|
1
|
+
{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,eAAO,MAAM,qBAAqB,grBACooB,CAAC;AAEvqB,eAAO,MAAM,WAAW,ktDAwBvB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,odAIpC,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAI5E;AA2BD,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAGvE;AAyDD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,YAAY,EAAE,CAc3E;AAED,MAAM,MAAM,WAAW,GACrB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,WAAW,CAsCb"}
|
package/dist/skills.js
CHANGED
|
@@ -1,8 +1,10 @@
|
|
|
1
|
-
export const CONNECTA_INSTRUCTIONS = 'Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas="compact"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2–10 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results.
|
|
1
|
+
export const CONNECTA_INSTRUCTIONS = 'Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas="compact"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2–10 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results. Fetch skills({ name: "usage" }) when this routing workflow is unfamiliar.';
|
|
2
2
|
export const USAGE_SKILL = `# Connecta usage
|
|
3
3
|
|
|
4
4
|
## Choose the smallest execution tool
|
|
5
5
|
|
|
6
|
+
Use exact addresses returned by discovery; never invent one.
|
|
7
|
+
|
|
6
8
|
- Unknown address: \`search_tools({ query, includeSchemas: "compact" })\`.
|
|
7
9
|
- Schema still unclear: \`describe_tools({ addresses: [...] })\`.
|
|
8
10
|
- One explicitly read-only call: \`call_tool\`.
|
|
@@ -10,45 +12,17 @@ export const USAGE_SKILL = `# Connecta usage
|
|
|
10
12
|
- Dependent read-only calls, loops, joins, branching, or large-result reduction: \`execute_code\` when available.
|
|
11
13
|
- Any unannotated, write-capable, or destructive call: \`call_destructive_tool\`, individually and only after reviewing its schema and consequences.
|
|
12
14
|
- Truncated result: retry with \`fields\` when possible; otherwise page it with \`get_result\`.
|
|
13
|
-
- \`auth_required\`: use \`authorize_connector\`,
|
|
15
|
+
- \`auth_required\`: use \`authorize_connector\`, give its recovery handoff to the operator, then retry the original call.
|
|
14
16
|
|
|
15
|
-
Use \`list_connectors({ probe: false })\` for a fast inventory. Use \`probe: true\` only when diagnosing live health or authorization.
|
|
17
|
+
Use \`list_connectors({ probe: false })\` for a fast inventory based on recent call observations and local credential-shape drift. Use \`probe: true\` only when diagnosing live health or authorization.
|
|
16
18
|
|
|
17
19
|
## Code mode
|
|
18
20
|
|
|
19
|
-
Use code mode when
|
|
20
|
-
|
|
21
|
-
Do not use code mode for one straightforward call, for independent calls already handled by \`batch_call\`, or for any tool not explicitly annotated \`readOnlyHint: true\`. Code mode has a bounded host-call budget and per-call deadline. Return only the reduced value the agent needs; do not return a large upstream payload unchanged.
|
|
22
|
-
|
|
23
|
-
## Examples
|
|
21
|
+
Use code mode when calls depend on earlier results, when joining connectors, or when sandbox filtering or aggregation will substantially shrink the response. Use \`Promise.all\` or \`connecta.batch\` for independent calls inside one execution.
|
|
24
22
|
|
|
25
|
-
|
|
23
|
+
Connector namespace calls and \`connecta.call\` use the same read-only gate and throw on downstream errors. Catch only failures the workflow can handle; let authorization failures return to the agent for recovery.
|
|
26
24
|
|
|
27
|
-
|
|
28
|
-
\`\`\`json
|
|
29
|
-
{ "address": "crm.get_account", "args": { "id": "acct_123" }, "resultMode": "value" }
|
|
30
|
-
\`\`\`
|
|
31
|
-
|
|
32
|
-
Independent calls:
|
|
33
|
-
\`\`\`json
|
|
34
|
-
{ "calls": [
|
|
35
|
-
{ "address": "crm.get_account", "args": { "id": "acct_123" } },
|
|
36
|
-
{ "address": "billing.list_invoices", "args": { "status": "open" } }
|
|
37
|
-
] }
|
|
38
|
-
\`\`\`
|
|
39
|
-
|
|
40
|
-
Dependent code with reduction:
|
|
41
|
-
\`\`\`js
|
|
42
|
-
async () => {
|
|
43
|
-
const accounts = await crm.search_accounts({ query: "renewal" });
|
|
44
|
-
const details = await Promise.all(
|
|
45
|
-
accounts.results.slice(0, 5).map((account) =>
|
|
46
|
-
crm.get_account({ id: account.id })
|
|
47
|
-
)
|
|
48
|
-
);
|
|
49
|
-
return details.map(({ id, name, status }) => ({ id, name, status }));
|
|
50
|
-
}
|
|
51
|
-
\`\`\`
|
|
25
|
+
Do not use code mode for one call, independent calls already handled by \`batch_call\`, or any tool lacking \`readOnlyHint: true\`. Host calls and time are bounded. Return only the reduced value the agent needs.
|
|
52
26
|
`;
|
|
53
27
|
/**
|
|
54
28
|
* Appended to USAGE_SKILL only when the deployment actually has at least one
|
|
@@ -152,10 +126,7 @@ function summarizeGuide(connector, guide) {
|
|
|
152
126
|
/**
|
|
153
127
|
* Every fetchable skill: the built-in guides plus one entry per connector that
|
|
154
128
|
* carries a usage guide. Derived from the connector list passed in — the single
|
|
155
|
-
* place guide visibility is decided.
|
|
156
|
-
* connection's `registry.listConnectors()`, so a toolkit-scoped session lists
|
|
157
|
-
* only in-scope guides, and `resolveSkill` below reports an out-of-scope
|
|
158
|
-
* `connector:<id>` exactly as it reports an unknown connector.
|
|
129
|
+
* place guide visibility is decided.
|
|
159
130
|
*/
|
|
160
131
|
export function listSkills(connectors) {
|
|
161
132
|
const listing = AVAILABLE_SKILLS.map((skill) => ({
|
package/dist/skills.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAChC,
|
|
1
|
+
{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAChC,oqBAAoqB,CAAC;AAEvqB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwB1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;CAIvC,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,UAAgC;IACjE,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,SAAS,CACvD,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,UAAgC;IAClD,OAAO,kBAAkB,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,WAAW,GAAG,wBAAwB;QACxC,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EACT,0FAA0F;QAC5F,OAAO,EAAE,UAAU;KACpB;CACO,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAE5C,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,GAAG,sBAAsB,GAAG,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAAoB;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC;IACnC,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,8EAA8E;AAC9E,MAAM,OAAO,GAAG,gCAAgC,CAAC;AAEjD,uCAAuC;AACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAEnC;;;;GAIG;AACH,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAExE,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,KAAe;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAoB,EAAE,KAAa;IACzD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,OAAO,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,OAAO;YAAE,SAAS;QACtB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5D,MAAM,IAAI,GAAG,GAAG;YACd,wEAAwE;YACxE,qDAAqD;aACpD,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;aAC3B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,OAAO,IAAI,CAAC,MAAM,IAAI,cAAc;YAClC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,WAAW,IAAI,oBAAoB,SAAS,CAAC,EAAE,IAAI,CAAC;AACvE,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,UAAgC;IACzD,MAAM,OAAO,GAAmB,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,UAAgC;IAEhC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,UAAU,CAAC,UAAU,CAAC;SACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,SAAS,EAAE,GAAG;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,cAAc,EAAE,2CAA2C,SAAS,EAAE,GAAG;aACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,kBAAkB,IAAI,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,wBAAwB,SAAS,EAAE,GAAG;gBAC7H,CAAC,CAAC,cAAc,IAAI,2CAA2C,SAAS,EAAE,GAAG;SAChF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,kBAAkB,IAAI,wBAAwB,SAAS,EAAE,GAAG;KACtE,CAAC;AACJ,CAAC"}
|
package/dist/timeout.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAC3B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAC9C,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CA2BZ"}
|
package/dist/timeout.js
CHANGED
|
@@ -1,7 +1,5 @@
|
|
|
1
|
-
// The deadline vocabulary shared by
|
|
2
|
-
//
|
|
3
|
-
// liveness checks (src/credential-health.ts). One definition so a "probe" means
|
|
4
|
-
// the same thing, and is bounded the same way, wherever one is issued.
|
|
1
|
+
// The deadline vocabulary shared by downstream discovery probes and tool calls.
|
|
2
|
+
// One definition keeps those waits bounded consistently.
|
|
5
3
|
/**
|
|
6
4
|
* Generous default bound for a single downstream probe/catalog call. High enough
|
|
7
5
|
* to trip only on a pathological hang, not a realistically slow probe.
|
package/dist/timeout.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"timeout.js","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAAA,
|
|
1
|
+
{"version":3,"file":"timeout.js","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,yDAAyD;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAChC,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAmB,EACnB,EAAU,EACV,KAAa;IAEb,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA8C,EAC9C,EAAU,EACV,KAAa;IAEb,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC/B,MAAM,CAAC,YAAY,CAAC,CAAC;QACvB,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
|