@zackbart/connecta 0.8.0 → 0.9.0

package/src/meta-tools.ts

@@ -1,4 +1,4 @@
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { McpServer } from "@modelcontextprotocol/server";
 import { z } from "zod";
 import type {
   ActivityCallSource,
@@ -7,6 +7,7 @@ import type {
 import {
   boundedDiscoveryText,
   CatalogService,
+  DEFAULT_SEARCH_LIMIT,
   DiscoveryPolicyError,
   groupedSearchResult,
   MAX_DESCRIBE_ADDRESSES,
@@ -48,7 +49,6 @@ import {
   normalizeTimeoutMs,
   withAbortableTimeout,
 } from "./timeout.js";
-import { credentialVerdictApplies } from "./credential-health.js";
 import type { ConnectorStatus, KVStorage } from "./types.js";
 
 export {
@@ -56,7 +56,6 @@ export {
   MAX_DISCOVERY_RESULT_BYTES,
   MAX_RETRY_BACKOFF_MS,
   MAX_SEARCH_LIMIT,
-  DiscoveryPolicyError,
   retryBackoffMs,
 };
 
@@ -77,7 +76,7 @@ const dec = new TextDecoder();
 
 export function jsonResult(obj: unknown): ToolResult {
   return {
-    content: [{ type: "text", text: JSON.stringify(obj, null, 2) }],
+    content: [{ type: "text", text: JSON.stringify(obj) }],
     ...(obj !== null && typeof obj === "object" && !Array.isArray(obj)
       ? { structuredContent: obj as Record<string, unknown> }
       : {}),
@@ -108,8 +107,12 @@ function discoveryErrorResult(error: DiscoveryPolicyError): ToolResult {
   return result;
 }
 
-function discoveryResult(value: unknown, hint: string): ToolResult {
+async function discoveryResult(
+  operation: () => unknown | Promise<unknown>,
+  hint: string,
+): Promise<ToolResult> {
   try {
+    const value = await operation();
     const text = boundedDiscoveryText(value, hint);
     return {
       content: [{ type: "text", text }],
@@ -255,7 +258,7 @@ function applyFieldsToContent(
     } catch {
       return b;
     }
-    return { ...b, text: JSON.stringify(applyFields(parsed, fields), null, 2) };
+    return { ...b, text: JSON.stringify(applyFields(parsed, fields)) };
   });
 }
 
@@ -277,7 +280,7 @@ function applyFieldsToContent(
  * at all (a BigInt) still throws, as before, and is reported as a failure.
  */
 function serializeResultText(value: unknown): string {
-  const serialized = JSON.stringify(value, null, 2);
+  const serialized = JSON.stringify(value);
   return serialized === undefined ? String(value) : serialized;
 }
 
@@ -391,7 +394,7 @@ async function guardContent(
 ): Promise<ToolResult> {
   let text: string;
   try {
-    text = JSON.stringify(content, null, 2);
+    text = JSON.stringify(content);
   } catch {
     // A block carrying a BigInt or a cycle cannot be serialized, so it cannot
     // be measured, stashed, or paged either — there is nothing this guard could
@@ -453,15 +456,7 @@ export interface GetResultArgs {
   /** Page size in bytes; a whole number >= 1. Defaults to the deployment cap. */
   maxBytes?: number;
 }
-export interface BatchCall {
-  address: string;
-  args?: Record<string, unknown>;
-  fields?: string[];
-  resultMode?: ResultMode;
-  timeoutMs?: number;
-  maxRetries?: number;
-  diagnostics?: boolean;
-}
+export type BatchCall = CallArgs;
 export interface BatchArgs {
   calls: BatchCall[];
   resultMode?: ResultMode;
@@ -614,17 +609,26 @@ export function createMetaTools(
       },
     );
     if (!outcome.ok) {
+      const failedResult =
+        outcome.error.code === "auth_required" ||
+        outcome.error.code === "input_required_unsupported" ||
+        call.resultMode === "value"
+          ? jsonResult({
+              ok: false,
+              error: outcome.error,
+              durationMs: outcome.durationMs,
+              attempts: outcome.attempts,
+              ...(call.diagnostics ? { timing: outcome.timing } : {}),
+            })
+          : errorResult(outcome.error.message);
+      if (
+        outcome.error.code === "auth_required" ||
+        outcome.error.code === "input_required_unsupported"
+      ) {
+        failedResult.isError = true;
+      }
       return {
-        toolResult:
-          call.resultMode === "value"
-            ? jsonResult({
-                ok: false,
-                error: outcome.error,
-                durationMs: outcome.durationMs,
-                attempts: outcome.attempts,
-                ...(call.diagnostics ? { timing: outcome.timing } : {}),
-              })
-            : errorResult(outcome.error.message),
+        toolResult: failedResult,
         durationMs: outcome.durationMs,
         attempts: outcome.attempts,
         timing: outcome.timing,
@@ -683,11 +687,13 @@ export function createMetaTools(
       const inspect = async (c: (typeof connectors)[number]) => {
         const statusStarted = Date.now();
         const observed = registry.healthFor(c.id);
-        const verdict = await registry.credentialHealthFor(c.id);
+        const drift = await registry.credentialDriftFor(c.id);
         let status:
           | ConnectorStatus
           | { state: "ok" | "error" | "unknown"; message?: string };
-        if (probe) {
+        if (drift) {
+          status = { state: "auth_required", message: drift };
+        } else if (probe) {
           try {
             status = await withProbeDeadline(
               `list_connectors probe of "${c.id}"`,
@@ -700,32 +706,7 @@ export function createMetaTools(
             // hanging the whole list_connectors call.
             status = { state: "error", message: msg(err) };
           }
-        } else if (
-          verdict &&
-          // Deployment-wide, deliberately, like `hasObservedSuccess` beside
-          // it: a sibling toolkit's successful call proves the shared
-          // credential works, and a verdict retired for one view but not
-          // another would make the same connector read differently per scope
-          // for a reason that has nothing to do with scope.
-          credentialVerdictApplies(verdict, registry.observedSuccessAt(c.id))
-        ) {
-          // The proactive layer (issue #24): a liveness check already found
-          // the stored credential dead, so say so on the cheap path instead of
-          // waiting for an agent's real call to discover it. Only while it is
-          // the freshest evidence — a successful call since then retires it.
-          status = {
-            state: verdict.state,
-            ...(verdict.message ? { message: verdict.message } : {}),
-            ...(verdict.authorizationUrl
-              ? { authorizationUrl: verdict.authorizationUrl }
-              : {}),
-          };
         } else {
-          // "error" comes from THIS view's own observations — a sibling
-          // toolkit's failure is not this session's experience — while
-          // ok/unknown may lean on the deployment-wide success signal, since
-          // "the connector answers at all" is a fact about the connector.
-          // Unscoped, the two are the same log, so this is unchanged there.
           const derived =
             observed?.consecutiveFailures && observed.consecutiveFailures > 0
               ? ("error" as const)
@@ -733,43 +714,13 @@ export function createMetaTools(
                 ? ("ok" as const)
                 : ("unknown" as const);
           status = {
-            // A successful liveness check upgrades "unknown" — nothing has
-            // been called yet, but the credential was verified, which is how
-            // re-authorization shows up here as ok rather than as an absence
-            // of evidence. It never DOWNgrades an observed failure: a real
-            // call that failed is stronger evidence than a background check.
-            state:
-              derived === "unknown" && verdict?.state === "ok"
-                ? ("ok" as const)
-                : derived,
+            state: derived,
             ...(observed?.lastError ? { message: observed.lastError } : {}),
           };
         }
-        // Stamped where the observation actually happened — after the status
-        // probe, not before it. A 30-second probe stamped at its start would
-        // report a verdict older than it is, and would lose the race against a
-        // real call that succeeded WHILE it ran (that success must retire the
-        // verdict, and only an honest timestamp says so).
+        // Stamped after any live probe so the response reports when its
+        // observation completed, not when a potentially slow request began.
         const checkedAt = new Date().toISOString();
-        // A live status probe IS a liveness observation of the stored
-        // credential, so it updates the same verdict a background check
-        // writes: the cached read afterwards agrees with what the operator
-        // just saw, and they are not swept again moments later. Recorded from
-        // the STATUS phase only, and only when the connector actually answered
-        // — a catalog refresh below is not a credential check (the sweep never
-        // fetches one), it is already counted in the health log, and letting
-        // its failure land here would spend the freshness budget on it. The
-        // registry ignores this for connectors storing no credential of ours.
-        if (probe && (status.state === "ok" || status.state === "auth_required")) {
-          await registry.recordCredentialHealth(c.id, {
-            state: status.state,
-            checkedAt,
-            ...(status.message ? { message: status.message } : {}),
-            ...("authorizationUrl" in status && status.authorizationUrl
-              ? { authorizationUrl: status.authorizationUrl }
-              : {}),
-          });
-        }
         let tools = registry.peekTools(c.id);
         // An auth_required status may have just started OAuth. A second
         // listTools probe would overwrite its state/verifier while returning
@@ -803,15 +754,6 @@ export function createMetaTools(
                       state: "auth_required" as const,
                       message: details.message,
                     };
-              await registry.recordCredentialHealth(c.id, {
-                state: "auth_required",
-                checkedAt,
-                ...(status.message && { message: status.message }),
-                ...("authorizationUrl" in status &&
-                status.authorizationUrl
-                  ? { authorizationUrl: status.authorizationUrl }
-                  : {}),
-              });
             } else {
               status = { state: "error" as const, message: msg(err) };
             }
@@ -820,9 +762,6 @@ export function createMetaTools(
         }
         const latencyMs = Date.now() - statusStarted;
         const latestObserved = registry.healthFor(c.id);
-        const credentialCheck = probe
-          ? await registry.credentialHealthFor(c.id)
-          : verdict;
         return {
           id: c.id,
           ...(c.title ? { title: c.title } : {}),
@@ -833,7 +772,6 @@ export function createMetaTools(
           latencyMs,
           probe,
           ...(latestObserved ?? observed),
-          ...(credentialCheck ? { credentialCheck } : {}),
           ...("authorizationUrl" in status &&
             status.authorizationUrl && {
               authorizationUrl: status.authorizationUrl,
@@ -866,31 +804,18 @@ export function createMetaTools(
     },
 
     async searchTools(args: SearchArgs): Promise<ToolResult> {
-      try {
-        return discoveryResult(
+      return discoveryResult(
+        async () =>
           groupedSearchResult(await catalog.search(args)),
-          "Request a smaller limit, omit fullDescriptions, or use compact schemas.",
-        );
-      } catch (err) {
-        if (err instanceof DiscoveryPolicyError) {
-          return discoveryErrorResult(err);
-        }
-        throw err;
-      }
+        "Request a smaller limit, omit fullDescriptions, or use compact schemas.",
+      );
     },
 
     async describeTools(args: DescribeArgs): Promise<ToolResult> {
-      try {
-        return discoveryResult(
-          { tools: await catalog.describe(args) },
-          'Split the address list or use format: "compact".',
-        );
-      } catch (err) {
-        if (err instanceof DiscoveryPolicyError) {
-          return discoveryErrorResult(err);
-        }
-        throw err;
-      }
+      return discoveryResult(
+        async () => ({ tools: await catalog.describe(args) }),
+        'Split the address list or use format: "compact".',
+      );
     },
 
     async callTool(args: CallArgs): Promise<ToolResult> {
@@ -1076,6 +1001,21 @@ export function createMetaTools(
               ...(details.retryAfterMs !== undefined
                 ? { retryAfterMs: details.retryAfterMs }
                 : {}),
+              ...(details.connector !== undefined
+                ? { connector: batchSummaryString(details.connector) }
+                : {}),
+              ...(details.operation !== undefined
+                ? { operation: batchSummaryString(details.operation) }
+                : {}),
+              ...(details.recovery !== undefined
+                ? { recovery: details.recovery }
+                : {}),
+              ...(details.nextAction !== undefined
+                ? { nextAction: details.nextAction }
+                : {}),
+              ...(details.retry !== undefined
+                ? { retry: batchSummaryString(details.retry) }
+                : {}),
             },
           };
         }),
@@ -1090,9 +1030,55 @@ export function createMetaTools(
         return errorResult(`Unknown connector "${args.connector}"`);
       }
       if (!connector.startAuth) {
-        return errorResult(
-          `Connector "${args.connector}" does not use downstream OAuth — its auth is static (headers/none), so there is nothing to authorize.`,
+        if (!connector.credential) {
+          return jsonResult({
+            connector: connector.id,
+            recovery: "unavailable",
+            message:
+              `Connector "${connector.id}" declares neither downstream OAuth ` +
+              "nor an operator-managed credential slot. Update the connector " +
+              "or deployment configuration before retrying.",
+          });
+        }
+        const ctx = registry.contextFor(
+          connector.id,
+          baseUrl,
+          requestScope,
         );
+        if (!ctx.credential) {
+          return jsonResult({
+            connector: connector.id,
+            recovery: "unavailable",
+            message:
+              "Credential storage is not configured. Configure " +
+              "credentials.encryptionKey, redeploy, then call " +
+              "authorize_connector again.",
+          });
+        }
+        const fields = connector.credential.fields?.map((field) => ({
+          name: field.name,
+          guidance: field.description ?? field.label,
+        })) ?? [
+          {
+            name: "value",
+            guidance:
+              connector.credential.description ??
+              connector.credential.label,
+          },
+        ];
+        return jsonResult({
+          connector: connector.id,
+          recovery: "operator_config",
+          credential: {
+            label: connector.credential.label,
+            fields,
+          },
+          operatorUrl: new URL("/credentials", baseUrl).toString(),
+          instructions:
+            "Have the operator open operatorUrl, set and test the credential, " +
+            "then retry the original call. No redeploy is needed. Credential " +
+            "mutation requires a Clerk-authenticated operator.",
+        });
       }
       const ctx = registry.contextFor(connector.id, baseUrl, requestScope);
       try {
@@ -1100,17 +1086,6 @@ export function createMetaTools(
           ctx,
           args.force !== undefined ? { force: args.force } : {},
         );
-        // startAuth just spoke to the downstream about this exact credential, so
-        // its answer replaces any older liveness verdict — including the stale
-        // `auth_required` that sent the agent here, once it reports ok.
-        await registry.recordCredentialHealth(connector.id, {
-          state: status.state,
-          checkedAt: new Date().toISOString(),
-          ...(status.message ? { message: status.message } : {}),
-          ...(status.authorizationUrl
-            ? { authorizationUrl: status.authorizationUrl }
-            : {}),
-        });
         if (status.state === "auth_required" && !status.authorizationUrl) {
           // auth_required with nothing to open is a dead end for the operator.
           return errorResult(
@@ -1119,6 +1094,7 @@ export function createMetaTools(
         }
         return jsonResult({
           connector: connector.id,
+          recovery: "oauth",
           status: status.state,
           ...(status.authorizationUrl
             ? {
@@ -1142,7 +1118,7 @@ export function createMetaTools(
 
 const LIST_DESC =
   "List connectors with status, cached tool count, and recent real-call health. Use probe=false for a fast inventory; use probe=true (default) only to diagnose live health or authorization.";
-const SEARCH_DESC = `Start here when a tool address is unknown. Exact/name matches rank above description matches; an empty query browses all. Pages contain at most ${MAX_SEARCH_LIMIT} tools. includeSchemas="compact" usually removes the describe_tools round trip.`;
+const SEARCH_DESC = `Start here when a tool address is unknown. Exact/name matches rank above description matches; an empty query browses all. The default page has ${DEFAULT_SEARCH_LIMIT} tools; explicit limit can request up to ${MAX_SEARCH_LIMIT}. includeSchemas="compact" usually removes the describe_tools round trip.`;
 const DESCRIBE_DESC = `Inspect up to ${MAX_DESCRIBE_ADDRESSES} known tool addresses when search_tools did not include a sufficient schema. Returns descriptions, input/output schemas, and behavior annotations; format "compact" is the default.`;
 const CALL_DESC =
   'Use for one tool explicitly annotated readOnlyHint: true. For 2–10 independent read-only calls use batch_call; for dependent steps or data reduction use execute_code when available. Unannotated, write-capable, and destructive tools are refused and require call_destructive_tool. fields selects JSON dot-paths, resultMode "value" unwraps results, timeoutMs sets a deadline, safe maxRetries are annotation-gated, diagnostics adds timing, and large results page through get_result.';
@@ -1153,7 +1129,7 @@ const GET_RESULT_DESC =
 const BATCH_DESC =
   "Use for 2–10 independent tools explicitly annotated readOnlyHint: true. Calls run in parallel with shared request-scoped clients; use execute_code when available instead for dependencies or in-sandbox reduction. Unannotated, write-capable, and destructive tools are refused. Batch timeout, safe retry, result mode, and diagnostics defaults may be overridden per call. An oversized final envelope returns ordered outcome summaries plus a get_result page handle.";
 const AUTHORIZE_DESC =
-  "Use after a connector reports auth_required. Starts downstream OAuth and returns an authorizationUrl for the operator to open. force=true wipes stored credentials first and restarts consent.";
+  "Use after auth_required. Returns an OAuth or operator-credential handoff, or reports required deployment configuration. force=true restarts OAuth only; this tool never accepts credentials.";
 const SKILLS_DESC =
   'List or fetch concise guidance for choosing among Connecta meta-tools. Call skills({ name: "usage" }) once when the routing workflow is unfamiliar; do not refetch it in the same task.';
 
@@ -1163,10 +1139,7 @@ const SKILLS_DESC =
  * so a deployment with no guides gets every base description unchanged rather
  * than paying for text about a feature it does not use.
  *
- * Registration is per connection and reads the connection's own registry view,
- * so under a toolkit these sentences reflect the SCOPED connector set: a scoped
- * session whose connectors carry no guides sees the base descriptions, and
- * never learns from a tool description that guides exist out of scope.
+ * Registration is per connection and reads the configured connector set.
  */
 const GUIDE_NOTES = {
   skills:
@@ -1208,6 +1181,16 @@ const READ_ONLY_LOCAL = {
   openWorldHint: false,
 } as const;
 
+const CALL_INPUT_SCHEMA = {
+  address: z.string(),
+  args: z.record(z.string(), z.unknown()).optional(),
+  fields: z.array(z.string()).optional(),
+  resultMode: z.enum(["mcp", "value"]).optional(),
+  timeoutMs: z.number().int().positive().optional(),
+  maxRetries: z.number().int().min(0).max(2).optional(),
+  diagnostics: z.boolean().optional(),
+};
+
 /** Register the nine meta-tools onto an McpServer instance. */
 export function registerMetaTools(
   server: McpServer,
@@ -1243,13 +1226,8 @@ export function registerMetaTools(
     "skills",
     {
       description: describedFor(registry, SKILLS_DESC, "skills"),
-      inputSchema: { name: z.string().optional() },
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: false,
-      },
+      inputSchema: z.object({ name: z.string().optional() }),
+      annotations: READ_ONLY_LOCAL,
     },
     async (args) => mt.skills(args as SkillArgs),
   );
@@ -1258,7 +1236,7 @@ export function registerMetaTools(
     "list_connectors",
     {
       description: LIST_DESC,
-      inputSchema: { probe: z.boolean().optional() },
+      inputSchema: z.object({ probe: z.boolean().optional() }),
       annotations: READ_ONLY_REMOTE,
     },
     async (args) => mt.listConnectors(args as ListArgs),
@@ -1268,14 +1246,14 @@ export function registerMetaTools(
     "search_tools",
     {
       description: describedFor(registry, SEARCH_DESC, "search"),
-      inputSchema: {
+      inputSchema: z.object({
         query: z.string().optional(),
         connector: z.string().optional(),
         limit: z.number().int().positive().max(MAX_SEARCH_LIMIT).optional(),
         offset: z.number().int().nonnegative().optional(),
         fullDescriptions: z.boolean().optional(),
         includeSchemas: z.enum(["compact", "json"]).optional(),
-      },
+      }),
       annotations: READ_ONLY_REMOTE,
     },
     async (args) => mt.searchTools(args as SearchArgs),
@@ -1285,11 +1263,11 @@ export function registerMetaTools(
     "describe_tools",
     {
       description: describedFor(registry, DESCRIBE_DESC, "describe"),
-      inputSchema: {
+      inputSchema: z.object({
         addresses: z.array(z.string()).max(MAX_DESCRIBE_ADDRESSES),
         format: z.enum(["compact", "json"]).optional(),
         fullDescriptions: z.boolean().optional(),
-      },
+      }),
       annotations: READ_ONLY_REMOTE,
     },
     async (args) => mt.describeTools(args as DescribeArgs),
@@ -1299,15 +1277,7 @@ export function registerMetaTools(
     "call_tool",
     {
       description: CALL_DESC,
-      inputSchema: {
-        address: z.string(),
-        args: z.record(z.string(), z.unknown()).optional(),
-        fields: z.array(z.string()).optional(),
-        resultMode: z.enum(["mcp", "value"]).optional(),
-        timeoutMs: z.number().int().positive().optional(),
-        maxRetries: z.number().int().min(0).max(2).optional(),
-        diagnostics: z.boolean().optional(),
-      },
+      inputSchema: z.object(CALL_INPUT_SCHEMA),
       // call_tool admits only tools that are themselves explicitly read-only;
       // anything else is refused and routed to call_destructive_tool.
       annotations: READ_ONLY_REMOTE,
@@ -1319,15 +1289,7 @@ export function registerMetaTools(
     "call_destructive_tool",
     {
       description: CALL_DESTRUCTIVE_DESC,
-      inputSchema: {
-        address: z.string(),
-        args: z.record(z.string(), z.unknown()).optional(),
-        fields: z.array(z.string()).optional(),
-        resultMode: z.enum(["mcp", "value"]).optional(),
-        timeoutMs: z.number().int().positive().optional(),
-        maxRetries: z.number().int().min(0).max(2).optional(),
-        diagnostics: z.boolean().optional(),
-      },
+      inputSchema: z.object(CALL_INPUT_SCHEMA),
       annotations: {
         destructiveHint: true,
         readOnlyHint: false,
@@ -1341,10 +1303,10 @@ export function registerMetaTools(
     "authorize_connector",
     {
       description: AUTHORIZE_DESC,
-      inputSchema: {
+      inputSchema: z.object({
         connector: z.string(),
         force: z.boolean().optional(),
-      },
+      }),
       // Starts (or with force, resets) a downstream OAuth flow — it changes
       // stored connector auth state, so it is deliberately not read-only.
       annotations: {
@@ -1360,7 +1322,7 @@ export function registerMetaTools(
     "get_result",
     {
       description: GET_RESULT_DESC,
-      inputSchema: {
+      inputSchema: z.object({
         id: z.string(),
         // Both bounds are the shared rules (isValidResultOffset,
         // isValidMaxResultBytes) expressed for the wire: spelling them against
@@ -1368,7 +1330,7 @@ export function registerMetaTools(
         // in-handler checks if either floor ever moves.
         offset: z.number().int().min(MIN_RESULT_OFFSET).optional(),
         maxBytes: z.number().int().min(MIN_MAX_RESULT_BYTES).optional(),
-      },
+      }),
       annotations: READ_ONLY_LOCAL,
     },
     async (args) => mt.getResult(args as GetResultArgs),
@@ -1378,26 +1340,16 @@ export function registerMetaTools(
     "batch_call",
     {
       description: BATCH_DESC,
-      inputSchema: {
+      inputSchema: z.object({
         calls: z
-          .array(
-            z.object({
-              address: z.string(),
-              args: z.record(z.string(), z.unknown()).optional(),
-              fields: z.array(z.string()).optional(),
-              resultMode: z.enum(["mcp", "value"]).optional(),
-              timeoutMs: z.number().int().positive().optional(),
-              maxRetries: z.number().int().min(0).max(2).optional(),
-              diagnostics: z.boolean().optional(),
-            }),
-          )
+          .array(z.object(CALL_INPUT_SCHEMA))
           .min(1)
           .max(10),
         resultMode: z.enum(["mcp", "value"]).optional(),
         timeoutMs: z.number().int().positive().optional(),
         maxRetries: z.number().int().min(0).max(2).optional(),
         diagnostics: z.boolean().optional(),
-      },
+      }),
       // Same gate as call_tool: every call in the batch must be explicitly
       // read-only or the batch is refused.
       annotations: READ_ONLY_REMOTE,

package/src/operator-ui/browser.css

@@ -236,57 +236,6 @@
   .connector-description { margin-top: .25rem; max-width: 40rem; }
   .connector-message,
   .connector-auth { margin-top: .75rem; }
-  .connector-toolkits {
-    align-items: baseline;
-    display: flex;
-    flex-wrap: wrap;
-    gap: .25rem .5rem;
-    margin-top: .5rem;
-  }
-  .scope-label {
-    border: 1px solid var(--rule);
-    display: inline-block;
-    font-family: var(--mono);
-    font-size: .72rem;
-    padding: .05rem .35rem;
-  }
-
-  .toolkit-copy { margin-bottom: 1rem; max-width: 42rem; }
-  .toolkit-ledger { border-bottom: 1px solid var(--rule); }
-  .toolkit-card {
-    border-top: 1px solid var(--rule);
-    padding: .9rem 0 1rem;
-  }
-  .toolkit-head {
-    display: grid;
-    gap: var(--gap);
-    grid-template-columns: minmax(0, 2fr) minmax(10rem, 1fr);
-  }
-  .toolkit-name {
-    align-items: baseline;
-    display: flex;
-    flex-wrap: wrap;
-    gap: .5rem;
-  }
-  .toolkit-name h3 { overflow-wrap: anywhere; }
-  .toolkit-state { text-align: right; }
-  .toolkit-connectors {
-    display: flex;
-    flex-wrap: wrap;
-    gap: .5rem;
-    margin-top: .75rem;
-  }
-  .toolkit-connector {
-    border-left: 1px solid var(--ink);
-    display: inline-flex;
-    flex-wrap: wrap;
-    gap: .4rem;
-    padding-left: .5rem;
-  }
-  .toolkit-rules { margin-top: .75rem; }
-  .toolkit-rules > * + * { margin-top: .25rem; }
-  .toolkit-endpoint { margin-top: .75rem; }
-
   .credential-ledger { border-bottom: 1px solid var(--rule); }
   .credential-card { border-top: 1px solid var(--rule); padding-bottom: .75rem; padding-top: .75rem; }
   .credential-head {
@@ -403,11 +352,9 @@
     .section,
     .section + .section { margin-top: 2.5rem; }
     .connector-head,
-    .toolkit-head,
     .tool,
     .activity-item { grid-template-columns: 1fr; }
-    .connector-state,
-    .toolkit-state { text-align: left; }
+    .connector-state { text-align: left; }
     .credential-field { align-items: start; grid-template-columns: 1fr; gap: .25rem; }
     input { min-height: 2.75rem; }
   }