@zackbart/connecta 0.24.1 → 0.24.3

package/dist/meta-tools.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { boundedDiscoveryText, CatalogService, DEFAULT_SEARCH_LIMIT, DiscoveryPolicyError, groupedSearchResult, MAX_DESCRIBE_ADDRESSES, MAX_DISCOVERY_RESULT_BYTES, MAX_SEARCH_LIMIT, } from "./catalog-service.js";
 import { resolveDiscoveryConcurrency } from "./concurrency.js";
-import { msg } from "./errors.js";
+import { boundedEchoText, msg } from "./errors.js";
 import { serializeResultText } from "./executor-result.js";
 import { InvocationService, } from "./invocation.js";
 import { isValidMaxResultBytes, MIN_MAX_RESULT_BYTES, resolveMaxResultBytes, } from "./registry.js";
@@ -37,7 +37,12 @@ async function discoveryResult(operation, hint) {
     try {
         const value = await operation();
         const text = boundedDiscoveryText(value, hint);
-        return jsonResult(value, text);
+        const result = jsonResult(value, text);
+        const bytes = enc.encode(JSON.stringify(result)).length;
+        if (bytes > MAX_DISCOVERY_RESULT_BYTES) {
+            throw new DiscoveryPolicyError("result_too_large", `Discovery result is ${bytes} UTF-8 bytes, over the ${MAX_DISCOVERY_RESULT_BYTES}-byte ceiling. ${hint}`);
+        }
+        return result;
     }
     catch (err) {
         if (err instanceof DiscoveryPolicyError) {
@@ -94,29 +99,37 @@ export function alignEndToCharBoundary(bytes, offset, end, total) {
     }
     return e;
 }
-// --- result-size guard + get_result (feature 1) ---------------------------
-/**
- * The one serialization every result guard measures, stashes, and pages: JSON
- * text for whatever JSON can represent, and `String(value)` for the returns
- * JSON renders as `undefined` — a handler that returns nothing, a function, or
- * a Symbol. `JSON.stringify` is *typed* as returning `string` while actually
- * returning `undefined` for those, which is how a handler returning `undefined`
- * reached clients as a `{"type":"text"}` block carrying no `text` at all: the
- * size guard measured `enc.encode(undefined)` — the empty string, per the
- * WebIDL default — and emitted the non-string unchanged (issue #42). `null`
- * needs no special case; JSON renders it as `"null"`.
- *
- * Shared by `guardText`, `guardValue`, and execute_code's `guardResultValue` so
- * the three give one answer to the same question. A value JSON cannot serialize
- * at all (a BigInt) still throws, as before, and is reported as a failure.
- */
-/**
- * Stash `text` under `result:<uuid>` (ttl 900s) and describe it as the
- * truncation notice every over-cap path hands back.
- */
-async function stashResult(text, results, totalBytes) {
+/** Stash a completed result, or return a notice without a paging route. */
+async function stashResult(bytes, results) {
+    const totalBytes = bytes.length;
     const id = crypto.randomUUID();
-    await results.set(`result:${id}`, text, { ttlSeconds: RESULT_TTL_SECONDS });
+    try {
+        // Base64 permits byte-range decoding after a KV read, without scanning or
+        // re-encoding all preceding text. Each chunk is a multiple of three bytes.
+        const chunks = [];
+        for (let offset = 0; offset < bytes.length; offset += 12_288) {
+            chunks.push(btoa(String.fromCharCode(...bytes.subarray(offset, offset + 12_288))));
+        }
+        const stored = `connecta-result-v1:${totalBytes}:${chunks.join("")}`;
+        if (!await results.set(`result:${id}`, stored, RESULT_TTL_SECONDS)) {
+            throw new Error("Result stash capacity exhausted");
+        }
+    }
+    catch {
+        // Paging is advisory after a completed call, including an approved write.
+        // Neither backend prose nor a retry hint belongs in this successful result.
+        try {
+            results.warn();
+        }
+        catch {
+            // Logging cannot change the call either.
+        }
+        return {
+            truncated: true,
+            totalBytes,
+            hint: "Paging is unavailable. Use execute_code to reduce read-only results before returning them. Do not repeat a completed write to recover its result.",
+        };
+    }
     return {
         truncated: true,
         resultId: id,
@@ -141,7 +154,7 @@ async function guardEncoded(text, bytes, results, cap) {
             truncated: false,
         };
     }
-    const notice = await stashResult(text, results, bytes.length);
+    const notice = await stashResult(bytes, results);
     const head = dec.decode(bytes.slice(0, alignEndToCharBoundary(bytes, 0, cap, bytes.length)));
     return {
         result: {
@@ -166,8 +179,12 @@ async function guardValue(value, results, cap) {
     const bytes = enc.encode(text);
     if (bytes.length <= cap)
         return { result: value, truncated: false };
+    const notice = await stashResult(bytes, results);
     return {
-        result: await stashResult(text, results, bytes.length),
+        result: notice.resultId ? notice : {
+            ...notice,
+            preview: dec.decode(bytes.slice(0, alignEndToCharBoundary(bytes, 0, cap, bytes.length))),
+        },
         truncated: true,
     };
 }
@@ -210,7 +227,7 @@ async function guardContent(content, results, cap) {
     if (content.every((b) => b.type === "text")) {
         return guardEncoded(text, bytes, results, cap);
     }
-    const notice = await stashResult(text, results, bytes.length);
+    const notice = await stashResult(bytes, results);
     return {
         result: { content: [{ type: "text", text: JSON.stringify(notice) }] },
         truncated: true,
@@ -259,7 +276,6 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
     const invocation = new InvocationService(registry, catalog, opts.activity);
     /** MCP adapter: shared invocation semantics plus MCP-only result shaping. */
     async function runCall(call, source, options = {}) {
-        const results = registry.resultsStorage();
         const timeoutMs = normalizeTimeoutMs(call.timeoutMs) ?? defaultToolTimeoutMs;
         const outcome = await invocation.invoke(call.address, call.args ?? {}, {
             source,
@@ -272,6 +288,13 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                 : {}),
             unwrapResult: call.resultMode === "value",
             processResult: async (result, resolved) => {
+                const results = {
+                    set: (key, value, ttlSeconds) => registry.stashResult(key, value, ttlSeconds),
+                    warn: () => registry.contextFor(resolved.connector.id, baseUrl, requestScope).logger.warn("[connecta] result paging unavailable", {
+                        connector: resolved.connector.id,
+                        tool: resolved.toolName,
+                    }),
+                };
                 // Result-size cap for THIS call: the connector's own override wins,
                 // then the deployment-wide value, then the built-in default (already
                 // folded into `globalCap`). Resolved per call so one request can
@@ -292,7 +315,14 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                 }
                 if (resolved.connector.kind === "mcp") {
                     const mcpResult = result;
-                    const content = mcpResult?.content ?? [];
+                    let content = mcpResult?.content ?? [];
+                    if (!content.some((block) => block.type === "text") &&
+                        mcpResult?.structuredContent !== undefined) {
+                        content = [...content, {
+                                type: "text",
+                                text: JSON.stringify(mcpResult.structuredContent),
+                            }];
+                    }
                     const guarded = await guardContent(content, results, cap);
                     return processed(guarded.result, guarded.truncated);
                 }
@@ -305,12 +335,15 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
         if (!outcome.ok) {
             const structuredRecovery = outcome.error.nextAction !== undefined;
             const recoveryRequired = structuredRecovery ||
+                // Sanitized `unavailable` diagnostics ride the structured shape too;
+                // the plain-text path would drop them (#539).
+                outcome.error.details !== undefined ||
                 [
                     "auth_required",
                     "invalid_args",
                     "input_required_unsupported",
                 ].includes(outcome.error.code);
-            const failedResult = recoveryRequired ||
+            const makeFailedResult = () => recoveryRequired ||
                 call.resultMode === "value"
                 ? jsonResult({
                     ok: false,
@@ -320,6 +353,18 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                     ...(call.diagnostics ? { timing: outcome.timing } : {}),
                 })
                 : errorResult(outcome.error.message);
+            let failedResult = makeFailedResult();
+            // Value mode repeats the error in text and structuredContent. Account for
+            // both copies and JSON escaping when the bounded provider reason is large.
+            if (!recoveryRequired) {
+                const cap = resolveMaxResultBytes(outcome.resolved?.connector.maxResultBytes, globalCap);
+                let budget = 512;
+                while (enc.encode(JSON.stringify(failedResult)).length > cap && budget > 0) {
+                    budget = Math.floor(budget / 2);
+                    outcome.error.message = boundedEchoText(outcome.error.message, budget);
+                    failedResult = makeFailedResult();
+                }
+            }
             if (recoveryRequired) {
                 failedResult.isError = true;
             }
@@ -372,6 +417,9 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
             return { content: [{ type: "text", text: skill.content }] };
         },
         async searchTools(args) {
+            if (args.connector !== undefined && enc.encode(args.connector).length > 512) {
+                return discoveryErrorResult(new DiscoveryPolicyError("invalid_args", "connector must be at most 512 UTF-8 bytes."));
+            }
             return discoveryResult(async () => groupedSearchResult(await catalog.search({
                 ...args,
                 includeSchemaKeys: args.includeSchemas !== undefined,
@@ -401,29 +449,60 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                     `>= ${MIN_RESULT_OFFSET}. Omit it to start at the beginning.`);
             }
             const results = registry.resultsStorage();
-            const stored = await results.get(`result:${args.id}`);
+            let stored;
+            try {
+                stored = await results.get(`result:${args.id}`);
+            }
+            catch {
+                return {
+                    ...jsonResult({
+                        error: {
+                            code: "unavailable",
+                            message: "Result paging storage is unavailable.",
+                            retryable: true,
+                        },
+                    }),
+                    isError: true,
+                };
+            }
             if (stored === null || stored === undefined) {
-                return errorResult(`Unknown or expired result id "${args.id}"`);
+                return errorResult(`Unknown or expired result id "${boundedEchoText(args.id)}"`);
+            }
+            const requestedOffset = args.offset ?? 0;
+            const maxBytes = args.maxBytes ?? globalCap;
+            // Decode only this page plus UTF-8 boundary lookaround. Legacy raw-text
+            // entries remain readable for their short TTL after an upgrade.
+            const header = /^connecta-result-v1:(\d+):/.exec(stored.slice(0, 64));
+            let bytes;
+            let total;
+            let start = 0;
+            if (header) {
+                total = Number(header[1]);
+                start = Math.floor(Math.max(0, Math.min(requestedOffset, total) - 3) / 3) * 3;
+                const end = Math.min(total, requestedOffset + maxBytes + 4);
+                const binary = atob(stored.slice(header[0].length + start / 3 * 4, header[0].length + Math.ceil(end / 3) * 4));
+                bytes = Uint8Array.from(binary, char => char.charCodeAt(0));
+            }
+            else {
+                bytes = enc.encode(stored);
+                total = bytes.length;
             }
-            const bytes = enc.encode(stored);
-            const total = bytes.length;
             // Validated above, so no coercion is needed here — only alignment. A
             // client that computes its own offsets can land inside a multi-byte
             // character, which would decode as U+FFFD; the offset actually served is
             // the boundary at or before it, and it is what the response reports back
             // as `offset` (issue #38).
-            const offset = alignStartToCharBoundary(bytes, args.offset ?? 0);
+            const offset = start + alignStartToCharBoundary(bytes, requestedOffset - start);
             // Page size only: a stashed result carries no connector identity, so
             // get_result keeps the deployment-wide default when none is requested.
             // Both sides are validated by now — the argument above, `globalCap` at
             // intake — so `offset + maxBytes` always reaches past `offset`.
-            const maxBytes = args.maxBytes ?? globalCap;
             // Align the slice end to a codepoint boundary so a multi-byte char is
             // never split across pages (which would emit U+FFFD on both sides).
             // `nextOffset` is this aligned end, so it is a valid boundary for the
             // next call and paging reassembles the original byte-for-byte.
-            const end = alignEndToCharBoundary(bytes, offset, offset + maxBytes, total);
-            const slice = dec.decode(bytes.slice(offset, end));
+            const end = start + alignEndToCharBoundary(bytes, offset - start, offset - start + maxBytes, total - start);
+            const slice = dec.decode(bytes.subarray(offset - start, end - start));
             const nextOffset = end < total ? end : undefined;
             return jsonResult({
                 offset,
@@ -435,7 +514,7 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
         async authorizeConnector(args) {
             const connector = registry.getConnector(args.connector);
             if (!connector) {
-                return errorResult(`Unknown connector "${args.connector}"`);
+                return errorResult(`Unknown connector "${boundedEchoText(args.connector)}"`);
             }
             if (!connector.startAuth) {
                 if (!connector.credential) {

package/dist/registry.d.ts

@@ -61,6 +61,10 @@ export interface RegistryOptions {
      * to the default 50_000.
      */
     maxResultBytes?: number | undefined;
+    results?: {
+        maxStashBytes?: number;
+        maxStashEntries?: number;
+    } | undefined;
     /**
      * Where payload-free catalog-drift observations go. Present only when the
      * deployment configured an activity store; drift is reported through
@@ -103,6 +107,8 @@ export interface RegistryView {
         signal?: AbortSignal;
     }): Promise<CallAdmissionPermit>;
     resultsStorage(): KVStorage;
+    /** Reserve runtime-wide capacity before writing a paging envelope. */
+    stashResult(key: string, value: string, ttlSeconds: number): Promise<boolean>;
     /** Local declared-vs-stored credential mismatch, with no downstream I/O. */
     credentialDriftFor(id: string): Promise<string | undefined>;
     /** Value-free shape learned from successful calls, never a provider declaration. */
@@ -114,8 +120,15 @@ export interface RegistryView {
     /** Bind returned OAuth state to this view's personal storage partition. */
     bindOAuthHandoff(id: string, authorizationUrl: string): Promise<void>;
 }
+/**
+ * Connector id → the only tool names this view may see on it. A connector
+ * absent from the map is visible whole. Derived from `connectorAccess`
+ * addresses at the auth gate; never from caller input.
+ */
+export type ToolAccess = ReadonlyMap<string, ReadonlySet<string>>;
 export interface RegistryScope {
     connectorIds: "all" | readonly string[];
+    toolAccess?: ToolAccess;
     subjectKey?: string;
     principalKey?: string;
 }
@@ -149,13 +162,26 @@ export declare class Registry implements RegistryView {
     private readonly persistToolCatalog;
     /** Result-size guard cap threaded to the meta-tools. */
     readonly maxResultBytes: number;
+    /** Only keys, byte counts, and expiry survive requests; never write promises. */
+    private readonly resultStash;
+    private resultStashBytes;
     private readonly configuredConnectors;
     private readonly personalRegistries;
+    private callAdmissionClosed;
+    /** Bounded FIFO of absent grants already warned about. */
+    private readonly warnedAbsentGrants;
     constructor(connectors: Connector[], opts: RegistryOptions);
     personalRegistry(principalKey: string): Registry;
     /** Build the only connector view an authenticated request receives. */
     scoped(scope: RegistryScope): RegistryView;
     scopedStorage(subjectKey: string): KVStorage;
+    /**
+     * A granted `connector.tool` address the live catalog does not contain is
+     * unreachable, which is the fail-closed outcome; this only makes the
+     * misconfiguration visible. Remote catalogs load lazily, so construction
+     * cannot check it, and a catalog that drifts later cannot widen a grant.
+     */
+    noteAbsentGrant(connectorId: string, toolName: string): void;
     private oauthHandoffKey;
     storeOAuthHandoff(connectorId: string, state: string, principalKey: string): Promise<void>;
     oauthCallbackView(connectorId: string, state: string | null): Promise<{
@@ -186,7 +212,7 @@ export declare class Registry implements RegistryView {
         args: unknown;
         signal?: AbortSignal;
     }): Promise<CallAdmissionPermit>;
-    /** Payload-free aggregate state for the open health endpoint. */
+    /** Connector totals across root and personal controllers; health removes ids. */
     callAdmissionSnapshot(): Record<string, ConnectorCallAdmissionSnapshot>;
     /**
      * Payload-free drift counts for the open health endpoint, so `connecta
@@ -214,6 +240,8 @@ export declare class Registry implements RegistryView {
     private observeCatalogDrift;
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission(): void;
+    /** Reserve capacity and write one ASCII paging envelope in this runtime. */
+    stashResult(key: string, value: string, ttlSeconds: number, prefix?: string): Promise<boolean>;
     /**
      * Storage namespaced to the meta-tool result store (`results:` prefix), kept
      * separate from any connector's `conn:<id>:` namespace. Backs get_result.

package/dist/registry.js

@@ -1,7 +1,7 @@
 import { closeConnectorScope, } from "./connector-scope.js";
 import { storedCredentialShape, } from "./credential-rules.js";
 import { ConnectorCallError, msg } from "./errors.js";
-import { ConnectorCallAdmissionController, } from "./call-admission.js";
+import { ConnectorCallAdmissionController, aggregateCallAdmissionSnapshots, } from "./call-admission.js";
 import { boundedCatalogDrift } from "./catalog-drift.js";
 import { fingerprintSerializedCatalog, snapshotCatalog, } from "./catalog-fingerprint.js";
 import { MAX_CATALOG_CHUNK_BYTES, MAX_CATALOG_TOOLS, MAX_SERIALIZED_CATALOG_BYTES, } from "./catalog-limits.js";
@@ -80,6 +80,7 @@ function namespaced(storage, prefix) {
     };
 }
 const MAX_PERSONAL_REGISTRIES = 1_024;
+const MAX_ABSENT_GRANT_WARNINGS = 1_024;
 const OAUTH_HANDOFF_TTL_SECONDS = 15 * 60;
 async function sha256Hex(value) {
     const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
@@ -117,8 +118,14 @@ export class Registry {
     persistToolCatalog;
     /** Result-size guard cap threaded to the meta-tools. */
     maxResultBytes;
+    /** Only keys, byte counts, and expiry survive requests; never write promises. */
+    resultStash = new Map();
+    resultStashBytes = 0;
     configuredConnectors;
     personalRegistries = new Map();
+    callAdmissionClosed = false;
+    /** Bounded FIFO of absent grants already warned about. */
+    warnedAbsentGrants = new Set();
     constructor(connectors, opts) {
         this.opts = opts;
         this.configuredConnectors = [...connectors];
@@ -172,18 +179,24 @@ export class Registry {
             this.personalRegistries.set(principalKey, existing);
             return existing;
         }
+        if (this.personalRegistries.size >= MAX_PERSONAL_REGISTRIES) {
+            // Eviction must not reset a live rolling budget or orphan queued calls.
+            const idle = [...this.personalRegistries].find(([, candidate]) => [...candidate.callAdmission.values()].every(admission => admission.isIdle()));
+            if (!idle) {
+                throw new Error("Personal connector capacity is exhausted; retry after calls and rolling budgets drain.");
+            }
+            idle[1].closeCallAdmission();
+            this.personalRegistries.delete(idle[0]);
+        }
         const registry = new Registry(this.configuredConnectors.filter((connector) => connector.authScope === "personal"), {
             ...this.opts,
             storage: namespaced(this.opts.storage, `principal:${principalKey}:`),
             credentialOwner: principalKey,
             constructionChecks: false,
         });
+        if (this.callAdmissionClosed)
+            registry.closeCallAdmission();
         this.personalRegistries.set(principalKey, registry);
-        const oldest = this.personalRegistries.keys().next().value;
-        if (this.personalRegistries.size > MAX_PERSONAL_REGISTRIES &&
-            typeof oldest === "string") {
-            this.personalRegistries.delete(oldest);
-        }
         return registry;
     }
     /** Build the only connector view an authenticated request receives. */
@@ -201,6 +214,27 @@ export class Registry {
     scopedStorage(subjectKey) {
         return namespaced(this.opts.storage, `subject:${subjectKey}:`);
     }
+    /**
+     * A granted `connector.tool` address the live catalog does not contain is
+     * unreachable, which is the fail-closed outcome; this only makes the
+     * misconfiguration visible. Remote catalogs load lazily, so construction
+     * cannot check it, and a catalog that drifts later cannot widen a grant.
+     */
+    noteAbsentGrant(connectorId, toolName) {
+        const key = `${connectorId}.${toolName}`;
+        if (this.warnedAbsentGrants.has(key))
+            return;
+        this.warnedAbsentGrants.add(key);
+        if (this.warnedAbsentGrants.size > MAX_ABSENT_GRANT_WARNINGS) {
+            const oldest = this.warnedAbsentGrants.values().next().value;
+            if (oldest !== undefined)
+                this.warnedAbsentGrants.delete(oldest);
+        }
+        // Grant names are operator data but may carry any non-control character;
+        // quote them so a line terminator a log reader honours cannot forge a line.
+        const quoted = JSON.stringify(key).replace(/[\u2028\u2029]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16)}`);
+        this.opts.logger.warn(`connectorAccess grants ${quoted} but connector "${connectorId}" lists no such tool; the grant is unreachable`);
+    }
     oauthHandoffKey(connectorId, stateHash) {
         return `oauth-handoff:v1:${connectorId}:${stateHash}`;
     }
@@ -327,11 +361,19 @@ export class Registry {
             return admission.acquire(input);
         return Promise.resolve({ waitMs: 0, release() { } });
     }
-    /** Payload-free aggregate state for the open health endpoint. */
+    /** Connector totals across root and personal controllers; health removes ids. */
     callAdmissionSnapshot() {
-        return Object.fromEntries([...this.callAdmission].map(([id, admission]) => [
-            id,
-            admission.snapshot(),
+        const snapshots = new Map();
+        for (const [id, admission] of this.callAdmission) {
+            snapshots.set(id, [admission.snapshot()]);
+        }
+        for (const registry of this.personalRegistries.values()) {
+            for (const [id, admission] of registry.callAdmission) {
+                snapshots.get(id)?.push(admission.snapshot());
+            }
+        }
+        return Object.fromEntries([...snapshots].map(([id, values]) => [
+            id, aggregateCallAdmissionSnapshots(values),
         ]));
     }
     /**
@@ -398,8 +440,54 @@ export class Registry {
     }
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission() {
+        this.callAdmissionClosed = true;
         for (const admission of this.callAdmission.values())
             admission.close();
+        for (const registry of this.personalRegistries.values())
+            registry.closeCallAdmission();
+    }
+    /** Reserve capacity and write one ASCII paging envelope in this runtime. */
+    async stashResult(key, value, ttlSeconds, prefix = "results:") {
+        const maxBytes = this.opts.results?.maxStashBytes ?? 8 * 1024 * 1024;
+        const maxEntries = this.opts.results?.maxStashEntries ?? 64;
+        // The paging envelope is ASCII, so its string length is its stored byte count.
+        const bytes = value.length;
+        if (bytes > maxBytes || maxEntries === 0)
+            return false;
+        const now = Date.now();
+        for (const [oldKey, entry] of this.resultStash) {
+            if (entry.busy || entry.expiresAt > now)
+                continue;
+            entry.busy = true;
+            try {
+                // TTL alone cannot reclaim a lazy backend. Keep the charge until deletion
+                // succeeds, including writes which persisted before throwing.
+                await this.opts.storage.delete(oldKey);
+                this.resultStash.delete(oldKey);
+                this.resultStashBytes -= entry.bytes;
+            }
+            finally {
+                entry.busy = false;
+            }
+        }
+        if (this.resultStash.size >= maxEntries || this.resultStashBytes + bytes > maxBytes)
+            return false;
+        const fullKey = prefix + key;
+        const entry = { bytes, expiresAt: Infinity, busy: true };
+        this.resultStash.set(fullKey, entry);
+        this.resultStashBytes += bytes;
+        try {
+            await this.opts.storage.set(fullKey, value, { ttlSeconds });
+            entry.expiresAt = Date.now() + ttlSeconds * 1000;
+            return true;
+        }
+        catch (error) {
+            entry.expiresAt = 0;
+            throw error;
+        }
+        finally {
+            entry.busy = false;
+        }
     }
     /**
      * Storage namespaced to the meta-tool result store (`results:` prefix), kept
@@ -1078,12 +1166,27 @@ class ScopedRegistryView {
         const connector = this.getConnector(parsed.connectorId);
         return connector ? { connector, toolName: parsed.toolName } : null;
     }
-    getTools(...args) {
+    async getTools(...args) {
         const registry = this.registryFor(args[0]);
         if (!registry) {
-            return Promise.reject(new Error(`Unknown connector "${args[0]}"`));
+            throw new Error(`Unknown connector "${args[0]}"`);
+        }
+        const tools = await registry.getTools(...args);
+        const granted = this.scope.toolAccess?.get(args[0]);
+        if (!granted)
+            return tools;
+        // Every consumer — search, describe, call_tool, and a program's
+        // connecta.call — resolves through this list, so an ungranted tool is
+        // indistinguishable from one the connector never had.
+        const visible = tools.filter((tool) => granted.has(tool.name));
+        if (visible.length < granted.size) {
+            const present = new Set(visible.map((tool) => tool.name));
+            for (const name of granted) {
+                if (!present.has(name))
+                    this.root.noteAbsentGrant(args[0], name);
+            }
         }
-        return registry.getTools(...args);
+        return visible;
     }
     contextFor(...args) {
         const registry = this.registryFor(args[0]);
@@ -1092,10 +1195,14 @@ class ScopedRegistryView {
         return registry.contextFor(...args);
     }
     admitCall(...args) {
-        if (!this.registryFor(args[0])) {
+        const registry = this.registryFor(args[0]);
+        if (!registry) {
             return Promise.reject(new Error(`Unknown connector "${args[0]}"`));
         }
-        return this.root.admitCall(...args);
+        return registry.admitCall(...args);
+    }
+    stashResult(key, value, ttlSeconds) {
+        return this.root.stashResult(key, value, ttlSeconds, this.scope.subjectKey ? `subject:${this.scope.subjectKey}:` : "results:");
     }
     resultsStorage() {
         return this.scope.subjectKey

package/dist/routes/credentials.js

@@ -81,6 +81,7 @@ async function handleCredentialRequest(context, connectorId, action) {
         validateAuthPermissions(authz, opts.registry);
         registry = opts.registry.scoped({
             connectorIds: authz.connectorIds,
+            ...(authz.toolAccess ? { toolAccess: authz.toolAccess } : {}),
             ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
             ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
         });

package/dist/routes/mcp.d.ts

@@ -4,4 +4,7 @@ export declare const MCP_CORS_HEADERS: {
     "Access-Control-Allow-Methods": string;
     "Access-Control-Allow-Headers": string;
 };
-export declare function createMcpRoute(opts: ServerOptions): (context: RouteContext) => Promise<Response | null>;
+export declare function createMcpRoute(opts: ServerOptions): {
+    handle(context: RouteContext): Promise<Response | null>;
+    rejectOrigin(request: Request): Response | null;
+};