@zackbart/connecta 0.8.0 → 0.9.0

package/src/routes/ui.ts

@@ -8,9 +8,7 @@ import {
 } from "../ui.js";
 import {
   authorize,
-  isToolkitRestricted,
   privateJson,
-  restrictedOperatorSurface,
   type RouteContext,
 } from "./shared.js";
 
@@ -54,8 +52,7 @@ function uiScriptNonce(): string {
 export async function routeUi(
   context: RouteContext,
 ): Promise<Response | null> {
-  const { request, url, path, baseUrl, opts, defer, sweepCredentials } =
-    context;
+  const { request, url, path, baseUrl, opts, defer } = context;
   if (request.method === "GET" && path === "/favicon.svg") {
     return new Response(opts.branding?.favicon?.svg ?? CONNECTA_FAVICON_SVG, {
       headers: {
@@ -119,14 +116,8 @@ export async function routeUi(
   }
   if (path !== "/ui/data") return null;
 
-  const authz = await authorize(request, baseUrl, opts.auth, opts.logger);
+  const authz = await authorize(request, baseUrl, opts.auth);
   if (!authz.ok) return authz.response;
-  if (isToolkitRestricted(authz.toolkitBinding)) {
-    return restrictedOperatorSurface();
-  }
-  // After the restriction check, not before: an identity that may not
-  // read this surface should not get to trigger background work from it.
-  sweepCredentials();
   const eligibleClerkOperator = authz.uiAdminEligible === true;
   const credentialManagement = credentialManagementCapability({
     eligibleClerkOperator,
@@ -144,7 +135,6 @@ export async function routeUi(
     eligibleClerkOperator ? opts.credentialVault : undefined,
     Boolean(opts.activity?.list),
     credentialManagement,
-    opts.toolkits,
     defer,
     eligibleClerkOperator,
     opts.discoveryConcurrency,

package/src/server.ts

@@ -29,7 +29,7 @@ export function createFetchHandler(
   request: Request,
   runtimeContext?: RuntimeExecutionContext,
 ) => Promise<Response> {
-  const { registry, auth, publicUrl } = opts;
+  const { auth, publicUrl, registry } = opts;
   const routeMcp = createMcpRoute(opts);
 
   return async function fetch(
@@ -43,35 +43,6 @@ export function createFetchHandler(
       ? runtimeContext.waitUntil.bind(runtimeContext)
       : undefined;
 
-    /**
-     * Piggyback a DUE credential liveness sweep on traffic that has already been
-     * authenticated (issue #24). Started beside the request and never awaited by
-     * it: it must not add latency or change a result, so it is handed to
-     * `ctx.waitUntil` where the runtime has one (Workers, and the Node adapter's
-     * shim) to settle after the response. The registry answers `undefined`
-     * unless a sweep is actually due, so the ordinary request pays nothing.
-     */
-    const sweepCredentials = (): void => {
-      // Belt and braces: a rejected sweep is already absorbed below, and this
-      // catches the synchronous half — arming the gate, or a connector list that
-      // throws while deciding whether anything is due. Nothing about a
-      // background health check may turn a served request into a 500.
-      try {
-        const sweep = registry.sweepCredentialHealthIfDue(baseUrl, defer);
-        if (!sweep) return;
-        const settled = sweep.then(
-          () => {},
-          (err) => {
-            opts.logger.warn("[connecta] credential health sweep failed", err);
-          },
-        );
-        if (defer) defer(settled);
-        else void settled;
-      } catch (err) {
-        opts.logger.warn("[connecta] credential health sweep failed", err);
-      }
-    };
-
     // Container and orchestrator probes reach /health over plain HTTP on
     // loopback, where no proxy has set X-Forwarded-Proto. Redirecting them to
     // the public origin would make an internal liveness check depend on
@@ -113,7 +84,6 @@ export function createFetchHandler(
       opts,
       defer,
       runtimeContext,
-      sweepCredentials,
     };
 
     const route = async (): Promise<Response> => {

package/src/skills.ts

@@ -1,12 +1,14 @@
 import type { Connector } from "./types.js";
 
 export const CONNECTA_INSTRUCTIONS =
-  'Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas="compact"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2–10 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results. For the detailed workflow, call skills({ name: "usage" }) once per task.';
+  'Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas="compact"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2–10 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results. Fetch skills({ name: "usage" }) when this routing workflow is unfamiliar.';
 
 export const USAGE_SKILL = `# Connecta usage
 
 ## Choose the smallest execution tool
 
+Use exact addresses returned by discovery; never invent one.
+
 - Unknown address: \`search_tools({ query, includeSchemas: "compact" })\`.
 - Schema still unclear: \`describe_tools({ addresses: [...] })\`.
 - One explicitly read-only call: \`call_tool\`.
@@ -14,45 +16,17 @@ export const USAGE_SKILL = `# Connecta usage
 - Dependent read-only calls, loops, joins, branching, or large-result reduction: \`execute_code\` when available.
 - Any unannotated, write-capable, or destructive call: \`call_destructive_tool\`, individually and only after reviewing its schema and consequences.
 - Truncated result: retry with \`fields\` when possible; otherwise page it with \`get_result\`.
-- \`auth_required\`: use \`authorize_connector\`, have the operator complete consent, then confirm with \`list_connectors\`.
+- \`auth_required\`: use \`authorize_connector\`, give its recovery handoff to the operator, then retry the original call.
 
-Use \`list_connectors({ probe: false })\` for a fast inventory. Use \`probe: true\` only when diagnosing live health or authorization. The fast inventory already reports a connector whose stored credential failed a proactive check as \`auth_required\` (with \`credentialCheck\` and the URL to open), so trust it and authorize up front rather than probing to confirm.
+Use \`list_connectors({ probe: false })\` for a fast inventory based on recent call observations and local credential-shape drift. Use \`probe: true\` only when diagnosing live health or authorization.
 
 ## Code mode
 
-Use code mode when a later call depends on an earlier result, when joining across connectors, or when filtering or aggregating data in the sandbox will substantially shrink the response. Use \`Promise.all\` or \`connecta.batch\` for independent calls inside one execution.
-
-Do not use code mode for one straightforward call, for independent calls already handled by \`batch_call\`, or for any tool not explicitly annotated \`readOnlyHint: true\`. Code mode has a bounded host-call budget and per-call deadline. Return only the reduced value the agent needs; do not return a large upstream payload unchanged.
-
-## Examples
-
-These addresses are illustrative; always use the exact address returned by \`search_tools\`.
+Use code mode when calls depend on earlier results, when joining connectors, or when sandbox filtering or aggregation will substantially shrink the response. Use \`Promise.all\` or \`connecta.batch\` for independent calls inside one execution.
 
-Single call:
-\`\`\`json
-{ "address": "crm.get_account", "args": { "id": "acct_123" }, "resultMode": "value" }
-\`\`\`
+Connector namespace calls and \`connecta.call\` use the same read-only gate and throw on downstream errors. Catch only failures the workflow can handle; let authorization failures return to the agent for recovery.
 
-Independent calls:
-\`\`\`json
-{ "calls": [
-  { "address": "crm.get_account", "args": { "id": "acct_123" } },
-  { "address": "billing.list_invoices", "args": { "status": "open" } }
-] }
-\`\`\`
-
-Dependent code with reduction:
-\`\`\`js
-async () => {
-  const accounts = await crm.search_accounts({ query: "renewal" });
-  const details = await Promise.all(
-    accounts.results.slice(0, 5).map((account) =>
-      crm.get_account({ id: account.id })
-    )
-  );
-  return details.map(({ id, name, status }) => ({ id, name, status }));
-}
-\`\`\`
+Do not use code mode for one call, independent calls already handled by \`batch_call\`, or any tool lacking \`readOnlyHint: true\`. Host calls and time are bounded. Return only the reduced value the agent needs.
 `;
 
 /**
@@ -173,10 +147,7 @@ export interface SkillListing {
 /**
  * Every fetchable skill: the built-in guides plus one entry per connector that
  * carries a usage guide. Derived from the connector list passed in — the single
- * place guide visibility is decided. The `skills` meta-tool passes its
- * connection's `registry.listConnectors()`, so a toolkit-scoped session lists
- * only in-scope guides, and `resolveSkill` below reports an out-of-scope
- * `connector:<id>` exactly as it reports an unknown connector.
+ * place guide visibility is decided.
  */
 export function listSkills(connectors: readonly Connector[]): SkillListing[] {
   const listing: SkillListing[] = AVAILABLE_SKILLS.map((skill) => ({

package/src/timeout.ts

@@ -1,7 +1,5 @@
-// The deadline vocabulary shared by every non-call downstream probe: the
-// discovery meta-tools' catalog fan-out (src/meta-tools.ts) and the credential
-// liveness checks (src/credential-health.ts). One definition so a "probe" means
-// the same thing, and is bounded the same way, wherever one is issued.
+// The deadline vocabulary shared by downstream discovery probes and tool calls.
+// One definition keeps those waits bounded consistently.
 
 /**
  * Generous default bound for a single downstream probe/catalog call. High enough

package/src/types.ts

@@ -174,7 +174,7 @@ export interface ConnectorContext {
   timeoutMs?: number;
 }
 
-export type ConnectorStatusState = "ok" | "auth_required" | "error";
+type ConnectorStatusState = "ok" | "auth_required" | "error";
 
 export interface ConnectorStatus {
   state: ConnectorStatusState;
@@ -226,19 +226,6 @@ export interface Connector {
     values: ConnectorCredentialValues,
     ctx: ConnectorContext,
   ): Promise<CredentialTestResult>;
-  /**
-   * Optional: whether this connector currently holds a stored downstream
-   * credential — an OAuth grant it persisted, typically. Read only by the
-   * credential liveness checks: a connector with nothing stored has no
-   * credential whose liveness could be in question, and probing it anyway would
-   * start an authorization flow nobody asked for.
-   *
-   * Implement it on connectors that manage their own credential storage (the
-   * shipped `remoteMcp` does, for `auth: { type: "oauth" }`). Connectors whose
-   * credential lives in connecta's vault (`credential` above) need not: the
-   * vault answers for them. Must not perform downstream I/O.
-   */
-  hasStoredCredential?(ctx: ConnectorContext): Promise<boolean>;
   /**
    * Statically-known tool defs, exposed by in-code connectors (`api()`) for
    * startup convention checks. Remote connectors omit this — their tools are
@@ -289,8 +276,16 @@ export interface Connector {
    * pending URL could complete consent with their own account.
    */
   verifyState?(state: string | null, ctx: ConnectorContext): Promise<boolean>;
-  /** Optional: complete a downstream OAuth flow (called by /oauth/callback/<id>). */
-  finishAuth?(code: string, ctx: ConnectorContext): Promise<void>;
+  /**
+   * Optional: complete a downstream OAuth flow (called by
+   * /oauth/callback/<id>). `callbackParams` preserves the authorization
+   * server's RFC 9207 `iss` response parameter for SDK validation.
+   */
+  finishAuth?(
+    code: string,
+    ctx: ConnectorContext,
+    callbackParams?: URLSearchParams,
+  ): Promise<void>;
   /**
    * Optional: serve a connector-owned HTTP route — for example a signed
    * download link minted by one of the connector's tools. Called only after
@@ -384,50 +379,12 @@ export interface ExecutorLease {
   release(): void;
 }
 
-/**
- * Which toolkits one inbound identity may open — the membership half of the
- * deployment=org / toolkit=team framing (documentation/toolkits.md). A mapping, never a
- * policy engine: one identity → the toolkit names it may select, plus whether
- * it may connect with no `?toolkit=` at all.
- *
- * An identity with NO binding is unbound and keeps the pre-binding behavior:
- * any declared toolkit, or the full registry. A binding is enforced at connect
- * time, before any scoped registry is constructed.
- */
-export interface ToolkitBinding {
-  /** Toolkit names this identity may select with `?toolkit=<name>`. */
-  readonly toolkits: readonly string[];
-  /**
-   * Whether this identity may also connect with no `?toolkit=` and see the full
-   * registry (and read the deployment-wide operator surfaces). Defaults to
-   * false: binding a credential to a toolkit means binding it.
-   */
-  readonly unscoped?: boolean;
-}
-
 /** Result of an inbound-auth check. */
 export type AuthResult =
   | {
       ok: true;
       userId?: string;
       subjectId?: string;
-      /**
-       * Toolkit binding resolved for THIS identity — the seam for an adapter
-       * that maps its own users (or an IdP claim) to views. Omit to inherit the
-       * provider's `toolkitBinding`.
-       *
-       * When the provider also declares one, the declaration is a **CEILING**,
-       * not a default: connecta intersects the two, and grants `unscoped` only
-       * if both do. A per-identity binding can therefore narrow the credential's
-       * view but never widen it — otherwise an adapter reading a user-writable
-       * claim would let the user name their own toolkits. When the provider
-       * declares nothing, this binding is used as given.
-       *
-       * Validated on arrival (a malformed one refuses the request with 403
-       * rather than being ignored), but never checked against the configured
-       * toolkits, which is only possible for the static declaration at startup.
-       */
-      toolkitBinding?: ToolkitBinding;
     }
   | { ok: false; response: Response };
 
@@ -527,14 +484,6 @@ export interface InboundAuth {
    * provider instead of asking the operator to paste a static bearer secret.
    */
   uiAuth?: UiAuthConfig;
-  /**
-   * Optional toolkit binding for every identity this provider admits
-   * (documentation/toolkits.md). Declared statically so `createConnecta` can validate the
-   * names against `ConnectaConfig.toolkits` and throw on a typo — a binding
-   * nobody wrote is not one an operator can reason about. An `authorize` result
-   * may narrow it per identity with its own `toolkitBinding`.
-   */
-  toolkitBinding?: ToolkitBinding;
   /** Serve/short-circuit .well-known + OPTIONS. Return null when not handled. */
   handleMetadata?(
     request: Request,

package/src/ui.ts

@@ -16,7 +16,6 @@ import {
   type CredentialManagementCapability,
   type UiConnector,
   type UiData,
-  type UiToolkit,
   type UiTool,
 } from "./operator-ui/model.js";
 import {
@@ -24,8 +23,11 @@ import {
   OPERATOR_UI_SCRIPT,
 } from "./operator-ui/generated.js";
 import type { Registry } from "./registry.js";
-import type { Toolkit } from "./toolkits.js";
-import type { ConnectaBranding, UiAuthConfig } from "./types.js";
+import type {
+  ConnectaBranding,
+  ConnectorStatus,
+  UiAuthConfig,
+} from "./types.js";
 import { CONNECTA_VERSION } from "./version.js";
 
 export {
@@ -310,7 +312,6 @@ export async function buildUiData(
   credentialManagement: CredentialManagementCapability = credentialVault
     ? "available"
     : "requires_clerk",
-  toolkits?: ReadonlyMap<string, Toolkit>,
   defer?: DeferredWork,
   oauthManagement = false,
   discoveryConcurrency?: number,
@@ -322,8 +323,10 @@ export async function buildUiData(
     connectorSet,
     concurrency,
     async (c): Promise<UiConnector> => {
-      const status = await registry.statusFor(c.id, baseUrl, requestScope);
-      const credentialCheck = await registry.credentialHealthFor(c.id);
+      const drift = await registry.credentialDriftFor(c.id);
+      const status: ConnectorStatus = drift
+        ? { state: "auth_required", message: drift }
+        : await registry.statusFor(c.id, baseUrl, requestScope);
       let tools: UiTool[] = [];
       // `status()` on an unauthenticated remote connector starts OAuth and
       // stores its state + PKCE verifier. Probing listTools immediately
@@ -447,17 +450,6 @@ export async function buildUiData(
         toolCount: tools.length,
         tools,
         ...(c.disconnectAuth && c.startAuth ? { oauth: true } : {}),
-        ...(credentialCheck
-          ? {
-              credentialCheck: {
-                state: credentialCheck.state,
-                checkedAt: credentialCheck.checkedAt,
-                ...(credentialCheck.message
-                  ? { message: credentialCheck.message }
-                  : {}),
-              },
-            }
-          : {}),
         ...(credential ? { credential } : {}),
       };
     },
@@ -476,29 +468,10 @@ export async function buildUiData(
     if (result.status === "rejected") throw result.reason;
     return result.value;
   });
-  const toolkitData: UiToolkit[] = [...(toolkits?.values() ?? [])].map(
-    (toolkit) => ({
-      name: toolkit.name,
-      connectors: [...toolkit.connectors],
-      includeTools: [...toolkit.includeTools],
-      excludeTools: [...toolkit.excludeTools],
-      toolCount: connectors.reduce(
-        (count, connector) =>
-          count +
-          (toolkit.hasConnector(connector.id)
-            ? connector.tools.filter((tool) =>
-                toolkit.hasTool(connector.id, tool.name),
-              ).length
-            : 0),
-        0,
-      ),
-    }),
-  );
   return {
     serverInfo,
     connectaVersion: CONNECTA_VERSION,
     connectors,
-    toolkits: toolkitData,
     activityEnabled,
     credentialManagement,
     oauthManagement,
@@ -668,16 +641,6 @@ ${clerkScript}
         <div id="list" class="connector-tools" aria-busy="false"></div>
       </div>
     </section>
-    <section class="section pgrid" aria-labelledby="toolkitLedgerHeading">
-      <h2 class="pcap" id="toolkitLedgerHeading">Toolkits</h2>
-      <div class="pbody">
-        <p class="toolkit-copy meta">
-          Read-only views from deployment config. Change the config and redeploy
-          to update them.
-        </p>
-        <div id="toolkitList" class="toolkit-ledger"></div>
-      </div>
-    </section>
   </section>
 
   <section id="credentialsView"${page === "credentials" ? "" : ' class="hidden"'}>

package/src/version.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.8.0";
+export const CONNECTA_VERSION = "0.9.0";

package/dist/credential-health.d.ts

@@ -1,205 +0,0 @@
-import type { CredentialVault } from "./credentials.js";
-import { type DeferredWork } from "./connector-scope.js";
-import type { Connector, ConnectorContext, ConnectorStatusState, KVStorage, Logger } from "./types.js";
-/** Verdict of one liveness check. Same vocabulary as `ConnectorStatus.state`. */
-export type CredentialCheckState = ConnectorStatusState;
-/** The stored verdict of the most recent liveness check of one connector. */
-export interface CredentialHealthRecord {
-    state: CredentialCheckState;
-    /** ISO timestamp of the check that produced this record. */
-    checkedAt: string;
-    /** Why, for a non-ok state — the connector's own reason, verbatim. */
-    message?: string;
-    /** Consent URL to open, when the connector reported one. */
-    authorizationUrl?: string;
-}
-/**
- * Why a connector was not checked.
- *
- * - `not_found` — no connector with that id is registered. Only reachable
- *   through an explicit `ids` request, and reported rather than dropped so a
- *   typo in a scheduled check is visible instead of silent.
- * - `not_checkable` — it stores no credential connecta manages, or exposes no
- *   usable way to ask: neither `status()` nor a credential test hook the
- *   declared credential shape can use (`credentialTestRule`), against a value
- *   actually stored under it.
- * - `no_credential` — checkable, but nothing is stored yet: there is no
- *   credential whose liveness could be in question, and probing would start an
- *   OAuth flow nobody asked for.
- * - `fresh` — checked less than `intervalSeconds` ago (by any isolate — the
- *   record is persisted), so this is the rate limit doing its job.
- * - `in_flight` — another check of this connector is already running.
- */
-export type CredentialCheckSkip = "not_found" | "not_checkable" | "no_credential" | "fresh" | "in_flight";
-/** One connector's outcome in a sweep. */
-export interface CredentialCheckResult {
-    connectorId: string;
-    /**
-     * The record now in force. Present for a completed check, and for a `fresh`
-     * skip (where the still-valid record is what the skip deferred to).
-     */
-    record?: CredentialHealthRecord;
-    /** Set when no check ran; `record` is then whatever was already stored. */
-    skipped?: CredentialCheckSkip;
-    /**
-     * The check ran, but its verdict was thrown away: the credential it judged
-     * was replaced or removed while it was in flight (see `clear`). `record` is
-     * what the check saw, not what is stored — nothing is.
-     */
-    discarded?: true;
-    /** How long the check took, when one ran. */
-    latencyMs?: number;
-}
-/** Deployment-wide tuning for credential liveness checks. */
-export interface CredentialHealthConfig {
-    /**
-     * Minimum seconds between checks of the same connector, across isolates (the
-     * verdict is persisted, so a Worker cron isolate and a request isolate share
-     * one clock). Default 900 (15 minutes). This is the bound on downstream cost:
-     * repeated status reads never each trigger a check.
-     */
-    intervalSeconds?: number;
-    /** Max checks in flight at once during one sweep. Default 4. */
-    concurrency?: number;
-    /** Per-check deadline. Default 30 000, the probe default. */
-    timeoutMs?: number;
-    /**
-     * Let inbound authenticated `/mcp` and `/ui/data` traffic trigger a *due*
-     * sweep in the background (`ctx.waitUntil` where the runtime has it). Default
-     * true — it is the trigger that makes stale-credential detection work with no
-     * scheduler wired at all, and it cannot slow a request down or change a
-     * result. Set false to check only from `Connecta.checkCredentials()`.
-     */
-    onRequest?: boolean;
-}
-/** What the checker needs from the registry, without depending on it. */
-export interface CredentialHealthDeps {
-    listConnectors(): Connector[];
-    getConnector(id: string): Connector | undefined;
-    contextFor(id: string, baseUrl: string, requestScope?: object): ConnectorContext;
-    storage: KVStorage;
-    logger: Logger;
-    credentialVault?: CredentialVault;
-}
-export interface CredentialCheckOptions {
-    /** Check even connectors whose verdict is still fresh. */
-    force?: boolean;
-    /** Restrict the sweep to these connector ids. Default: every connector. */
-    ids?: string[];
-    /**
-     * @deprecated Ignored. Credential checks always create and close their own
-     * probe scope; no core path supplies an existing request scope.
-     */
-    requestScope?: object;
-}
-/**
- * Runs and caches credential liveness checks. One instance per `Registry`.
- *
- * Cost is bounded four ways, because a status surface an agent polls must never
- * become a way to hammer a downstream auth endpoint:
- *
- * 1. **Eligibility** — only connectors holding a credential of ours are probed
- *    at all (`isCheckableConnector`), and only when something is actually stored.
- * 2. **Freshness (cross-isolate)** — a persisted verdict younger than
- *    `intervalSeconds` short-circuits the check, so every isolate and every
- *    trigger share one budget.
- * 3. **Sweep gate (per isolate)** — `sweepIfDue` runs at most one traffic-
- *    triggered sweep per interval per isolate, and never two at once, so a burst
- *    of requests costs one sweep, not one per request.
- * 4. **Deadline + fan-out bound** — each check is bounded by `timeoutMs` and at
- *    most `concurrency` run together (the same shape as the
- *    `discovery.probeTimeoutMs` bound on the discovery fan-out, issue #19).
- */
-export declare class CredentialHealthChecker {
-    private readonly deps;
-    private readonly store;
-    private readonly intervalMs;
-    private readonly concurrency;
-    private readonly timeoutMs;
-    private readonly onRequest;
-    /** Per-connector checks in flight in THIS isolate. */
-    private readonly inFlight;
-    /** Earliest a traffic-triggered sweep may run again in this isolate. */
-    private nextSweepAt;
-    private sweeping;
-    constructor(deps: CredentialHealthDeps, config?: CredentialHealthConfig);
-    /**
-     * The stored verdict, if any. No downstream I/O — and no storage read at all
-     * for a connector that stores no credential of ours, since only a checkable
-     * connector can ever have had a verdict written. That keeps
-     * `list_connectors({ probe: false })` exactly as cheap as it was for the
-     * deployments this feature does not apply to.
-     */
-    healthFor(connectorId: string): Promise<CredentialHealthRecord | undefined>;
-    /**
-     * Record a liveness verdict observed elsewhere — today, the live status a
-     * `list_connectors({ probe: true })` just performed. Filtered by the same
-     * eligibility rule as a check, so this stays a record of *credential* health
-     * rather than a general status cache, and so it also counts against the
-     * freshness budget: an operator who just probed live does not get swept again
-     * moments later.
-     */
-    record(connectorId: string, record: CredentialHealthRecord): Promise<void>;
-    /** Forget a connector's verdict — its credential just changed under us. */
-    clear(connectorId: string): Promise<void>;
-    /** Whether any connector in this deployment could be checked at all. */
-    hasCheckableConnectors(): boolean;
-    /**
-     * Check every (or the named) connector's stored credential and return one
-     * outcome per connector considered. Never rejects: a connector that throws,
-     * hangs past `timeoutMs`, or cannot be persisted becomes an `error` verdict.
-     */
-    check(baseUrl: string, opts?: CredentialCheckOptions, defer?: DeferredWork): Promise<CredentialCheckResult[]>;
-    /**
-     * The traffic-triggered sweep: a promise to hand to `ctx.waitUntil`, or
-     * `undefined` when nothing is due (the common case, and free — no I/O). The
-     * gate is armed BEFORE the sweep starts, so a burst of concurrent requests
-     * produces one sweep.
-     */
-    sweepIfDue(baseUrl: string, defer?: DeferredWork): Promise<CredentialCheckResult[]> | undefined;
-    private checkOne;
-    private recordOrNothing;
-    private runCheck;
-    /**
-     * `isCheckableConnector` re-asked against what is actually stored: the hook
-     * the declared shape selects, bound to a value that fits it (see
-     * {@link testHookFor}), or a `status()` to fall back on. Neither ⇒ there is no
-     * honest question to put to this connector.
-     */
-    private canAsk;
-    /**
-     * Ask the connector whether the credential it holds still works — with no
-     * downstream mutation and no tool call. A credential test is preferred for a
-     * vault credential because it validates the stored value itself; `status()` is
-     * the downstream-OAuth answer (it refreshes the grant, which is the liveness
-     * question for a token).
-     */
-    private probe;
-    private settle;
-}
-/**
- * Whether a liveness verdict may DECIDE a connector's cached status.
- *
- * Only `auth_required` ever does, and only while nothing better has happened
- * since. Two separate judgements:
- *
- * 1. **`error` is not credential evidence.** A check that timed out, threw, or
- *    got a 502 from the provider's status endpoint failed to *complete* — it
- *    learned nothing about the credential. Letting it set the status would flip
- *    a connector whose calls are fine to `error` for a whole interval on a DNS
- *    blip. Error verdicts stay visible in `credentialCheck` (an operator wants
- *    to know checks are failing) but the status keeps coming from observed real
- *    calls, which is evidence.
- * 2. **A successful real call retires the verdict, except static shape drift.**
- *    Traffic beats a background probe, so a `lastSuccessAt` at or after
- *    `checkedAt` normally means the credential demonstrably works. Stored-shape
- *    drift is different: a credential-independent tool can succeed without
- *    making a missing declared field appear, so only replacement/removal clears
- *    that verdict.
- *
- * `auth_required` deliberately outranks an observed real-call *failure*: both
- * say something is wrong, and only one of them carries the URL that fixes it.
- * The failure stays visible as `lastError`.
- */
-export declare function credentialVerdictApplies(record: CredentialHealthRecord | undefined, lastSuccessAt: string | undefined): boolean;
-//# sourceMappingURL=credential-health.d.ts.map

package/dist/credential-health.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-health.d.ts","sourceRoot":"","sources":["../src/credential-health.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAEL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,oBAAoB,EAEpB,SAAS,EACT,MAAM,EACP,MAAM,YAAY,CAAC;AAEpB,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAExD,6EAA6E;AAC7E,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,eAAe,GACf,eAAe,GACf,OAAO,GACP,WAAW,CAAC;AAEhB,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AA0MD,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,cAAc,IAAI,SAAS,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IAChD,UAAU,CACR,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,GACpB,gBAAgB,CAAC;IACpB,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAiGD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,uBAAuB;IAahC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,sDAAsD;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuC;IAChE,wEAAwE;IACxE,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAA+C;gBAG5C,IAAI,EAAE,oBAAoB,EAC3C,MAAM,GAAE,sBAA2B;IAsBrC;;;;;;OAMG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAQ3E;;;;;;;OAOG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC;IAMhB,2EAA2E;IAC3E,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,wEAAwE;IACxE,sBAAsB,IAAI,OAAO;IAIjC;;;;OAIG;IACG,KAAK,CACT,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,sBAA2B,EACjC,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAcnC;;;;;OAKG;IACH,UAAU,CACR,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,qBAAqB,EAAE,CAAC,GAAG,SAAS;YAajC,QAAQ;YAiCR,eAAe;YAOf,QAAQ;IAiHtB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAOd;;;;;;OAMG;YACW,KAAK;YA+BL,MAAM;CAcrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAC1C,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAMT"}