@zackbart/connecta 0.24.2 → 0.24.3

package/dist/invocation.js

@@ -1,5 +1,5 @@
 import { isCallAdmissionError } from "./call-admission.js";
-import { classifyCallError, ConnectorCallError, echoedCallArgs, framingError, } from "./errors.js";
+import { boundedEchoText, classifyCallError, ConnectorCallError, echoedCallArgs, framingError, } from "./errors.js";
 import { unwrapMcpResult } from "./mcp-result.js";
 import { splitAddress } from "./registry.js";
 import { isExplicitlyReadOnly } from "./tool-safety.js";
@@ -43,10 +43,10 @@ function assertRawMcpSuccess(kind, result) {
     const mcpResult = result;
     if (!mcpResult.isError)
         return;
-    throw new Error(mcpResult.content
+    throw new Error(boundedEchoText(mcpResult.content
         ?.filter((block) => block.type === "text")
         .map((block) => block.text ?? "")
-        .join("") || "Downstream tool call failed");
+        .join("") || "Downstream tool call failed"));
 }
 export class InvocationFailure extends Error {
     details;
@@ -196,6 +196,8 @@ export class InvocationService {
                     tool: target.toolName,
                     source: context.source,
                     code: details.code,
+                    // Sanitized transport diagnostics (origin and errno only, #539).
+                    ...(details.details ? { details: details.details } : {}),
                     attempts,
                     durationMs: Date.now() - started,
                     message: String(details.message ?? "").slice(0, 300),
@@ -215,111 +217,150 @@ export class InvocationService {
                 error: details,
             };
         };
-        const resolution = await this.catalog.resolveTool(address, defined({ signal: context.requestSignal }));
-        catalogMs += resolution.catalogMs;
-        if (!resolution.ok) {
-            if (resolution.connector && resolution.toolName) {
-                activityTarget = {
-                    connector: resolution.connector,
-                    toolName: resolution.toolName,
-                };
-            }
-            if (resolution.cause && context.requestSignal?.aborted) {
-                return failed(callerCancelledDetails());
-            }
-            return failed(resolution.error);
-        }
-        resolved = resolution.resolved;
-        activityTarget = resolved;
-        if (!isExplicitlyReadOnly(resolved.definition) && !context.allowDestructive) {
-            const canonicalAddress = `${resolved.connector.id}.${resolved.toolName}`;
-            return failed(framingError("destructive_tool_requires_approval", `Tool "${canonicalAddress}" is not explicitly read-only. Invoke it through call_destructive_tool so the MCP host can request explicit approval.`));
-        }
-        // Remote MCP tools advertise their input schema in the catalog. Validate
-        // against that same request-local definition before admission or provider
-        // dispatch, so a predictable mismatch stays structured instead of being
-        // flattened into provider-specific error prose. Unsupported schemas retain
-        // validateToolInput's fail-open behavior and reach the downstream normally.
-        if (resolved.connector.kind === "mcp" &&
-            resolved.definition.inputSchema) {
-            const invalid = validateToolInput(resolved.definition.inputSchema, args ?? {}, {
-                address: `${resolved.connector.id}.${resolved.toolName}`,
-                logger: this.registry.contextFor(resolved.connector.id, this.catalog.baseUrl, this.catalog.requestScope).logger,
-            });
-            if (invalid)
-                return failed(classifyCallError(invalid));
-        }
-        try {
-            context.beforeDispatch?.();
-        }
-        catch (error) {
-            return failed(error instanceof InvocationFailure
-                ? error.details
-                : classifyCallError(error));
+        if (context.requestSignal?.aborted) {
+            // Preserve the cancelled admission-attempt count without starting discovery.
+            attempts = 1;
+            return failed(callerCancelledDetails());
         }
         let result;
         let observedResult;
-        attempts = 1;
-        let permit;
-        let attemptError;
-        let attemptFailed = false;
+        // One deadline owns discovery, queue admission, and provider dispatch.
+        // Only the caller of this function records the final outcome, so a late
+        // cancellation cannot append a second activity event after the deadline.
+        const dispatch = async (callSignal) => {
+            const resolution = await this.catalog.resolveTool(address, defined({ signal: callSignal }));
+            catalogMs += resolution.catalogMs;
+            if (callSignal?.aborted)
+                throw callSignal.reason;
+            if (!resolution.ok) {
+                if (resolution.connector && resolution.toolName) {
+                    activityTarget = {
+                        connector: resolution.connector,
+                        toolName: resolution.toolName,
+                    };
+                }
+                if (resolution.cause && context.requestSignal?.aborted) {
+                    return callerCancelledDetails();
+                }
+                return resolution.error;
+            }
+            const target = resolution.resolved;
+            resolved = target;
+            activityTarget = target;
+            if (!isExplicitlyReadOnly(target.definition) && !context.allowDestructive) {
+                const canonicalAddress = `${target.connector.id}.${target.toolName}`;
+                return framingError("destructive_tool_requires_approval", `Tool "${canonicalAddress}" is not explicitly read-only. Invoke it through call_destructive_tool so the MCP host can request explicit approval.`);
+            }
+            // Remote MCP tools advertise their input schema in the catalog. Validate
+            // against that same request-local definition before admission or provider
+            // dispatch, so a predictable mismatch stays structured instead of being
+            // flattened into provider-specific error prose. Unsupported schemas retain
+            // validateToolInput's fail-open behavior and reach the downstream normally.
+            if (target.connector.kind === "mcp" &&
+                target.definition.inputSchema) {
+                const invalid = validateToolInput(target.definition.inputSchema, args ?? {}, {
+                    address: `${target.connector.id}.${target.toolName}`,
+                    logger: this.registry.contextFor(target.connector.id, this.catalog.baseUrl, this.catalog.requestScope).logger,
+                });
+                if (invalid)
+                    return classifyCallError(invalid);
+            }
+            try {
+                context.beforeDispatch?.();
+            }
+            catch (error) {
+                return error instanceof InvocationFailure
+                    ? error.details
+                    : classifyCallError(error);
+            }
+            if (callSignal?.aborted)
+                throw callSignal.reason;
+            attempts = 1;
+            let permit;
+            let attemptError;
+            let attemptFailed = false;
+            try {
+                permit = await timed((elapsed) => { admissionMs += elapsed; }, () => this.registry.admitCall(target.connector.id, {
+                    toolName: target.toolName,
+                    args: args ?? {},
+                    ...defined({ signal: callSignal }),
+                }));
+                const raw = await timed((elapsed) => { connectorMs += elapsed; }, () => {
+                    const call = () => {
+                        const connectorContext = this.registry.contextFor(target.connector.id, this.catalog.baseUrl, this.catalog.requestScope, defined({ signal: callSignal, timeoutMs: context.timeoutMs }));
+                        if (target.connector.credential &&
+                            !connectorContext.credential) {
+                            throw new ConnectorCallError("auth_required", "Operator-managed credential storage is not configured. Call " +
+                                `authorize_connector({ connector: "${target.connector.id}" }).`);
+                        }
+                        // Cancellation can arrive during admission or context construction.
+                        if (callSignal?.aborted)
+                            throw callSignal.reason;
+                        return target.connector.callTool(target.toolName, args ?? {}, connectorContext);
+                    };
+                    // Race cancellation here too, so an uncooperative connector cannot
+                    // retain its admission permit after the enclosing deadline expires.
+                    return callSignal
+                        ? withDeadline(call, {
+                            signal: callSignal,
+                            timeoutError: new ConnectorCallError("timeout", "Tool call timed out"),
+                        })
+                        : call();
+                });
+                // isError is checked here for BOTH result shapes so every adapter
+                // reports the same downstream-failure wording, and the throw lands
+                // inside the attempt where it feeds health.
+                assertRawMcpSuccess(target.connector.kind, raw);
+                observedResult = unwrapMcpResult(target.connector.kind, raw);
+                result = context.unwrapResult ? observedResult : raw;
+            }
+            catch (error) {
+                attemptFailed = true;
+                attemptError = error;
+            }
+            finally {
+                permit?.release();
+            }
+            if (attemptFailed) {
+                if (callSignal?.aborted)
+                    throw callSignal.reason;
+                const callerCancelled = isCallerCancellation(attemptError, context.requestSignal);
+                const details = callerCancelled
+                    ? callerCancelledDetails()
+                    : classifyCallError(attemptError);
+                return details;
+            }
+            return undefined;
+        };
         try {
-            permit = await timed((elapsed) => { admissionMs += elapsed; }, () => this.registry.admitCall(resolved.connector.id, {
-                toolName: resolved.toolName,
-                args: args ?? {},
-                ...defined({ signal: context.requestSignal }),
-            }));
-            const raw = await timed((elapsed) => { connectorMs += elapsed; }, () => {
-                const call = (callSignal) => {
-                    const connectorContext = this.registry.contextFor(resolved.connector.id, this.catalog.baseUrl, this.catalog.requestScope, defined({ signal: callSignal, timeoutMs: context.timeoutMs }));
-                    if (resolved.connector.credential &&
-                        !connectorContext.credential) {
-                        throw new ConnectorCallError("auth_required", "Operator-managed credential storage is not configured. Call " +
-                            `authorize_connector({ connector: "${resolved.connector.id}" }).`);
-                    }
-                    // Cancellation can arrive during admission or context construction.
-                    if (callSignal?.aborted)
-                        throw callSignal.reason;
-                    return resolved.connector.callTool(resolved.toolName, args ?? {}, connectorContext);
-                };
-                if (!context.timeoutMs && !context.requestSignal)
-                    return call();
-                return withDeadline(call, {
+            const error = context.timeoutMs || context.requestSignal
+                ? await withDeadline(dispatch, {
                     ...defined({
                         timeoutMs: context.timeoutMs,
                         signal: context.requestSignal,
                     }),
                     timeoutError: new ConnectorCallError("timeout", `Tool call timed out after ${context.timeoutMs}ms`),
-                });
-            });
-            // isError is checked here for BOTH result shapes so every adapter
-            // reports the same downstream-failure wording, and the throw lands
-            // inside the attempt where it feeds health.
-            assertRawMcpSuccess(resolved.connector.kind, raw);
-            observedResult = unwrapMcpResult(resolved.connector.kind, raw);
-            result = context.unwrapResult ? observedResult : raw;
+                })
+                : await dispatch();
+            if (error)
+                return failed(error);
         }
         catch (error) {
-            attemptFailed = true;
-            attemptError = error;
-        }
-        finally {
-            permit?.release();
-        }
-        if (attemptFailed) {
-            const callerCancelled = isCallerCancellation(attemptError, context.requestSignal);
-            const details = callerCancelled
+            return failed(context.requestSignal?.aborted
                 ? callerCancelledDetails()
-                : classifyCallError(attemptError);
-            return failed(details);
+                : classifyCallError(error));
         }
+        // A dispatch that returned no refusal resolved a concrete tool.
+        const completed = resolved;
+        if (!completed)
+            throw new Error("Invocation completed without a resolved tool");
         try {
             const value = await timed((elapsed) => { resultProcessingMs += elapsed; }, async () => {
                 const processed = context.processResult
-                    ? await context.processResult(result, resolved)
+                    ? await context.processResult(result, completed)
                     : result;
                 try {
-                    this.registry.observeOutputShape(resolved.connector.id, resolved.definition, observedResult);
+                    this.registry.observeOutputShape(completed.connector.id, completed.definition, observedResult);
                 }
                 catch {
                     // Shape learning is advisory. It cannot change a completed call.
@@ -332,14 +373,14 @@ export class InvocationService {
             return {
                 ok: true,
                 value,
-                resolved,
+                resolved: completed,
                 durationMs: Date.now() - started,
                 attempts,
                 timing: diagnostics,
             };
         }
-        catch (error) {
-            return failed(framingError("result_processing_failed", error instanceof Error ? error.message : String(error)));
+        catch {
+            return failed(framingError("result_processing_failed", "The downstream call completed, but its result could not be processed. Do not repeat the call to recover its result."));
         }
     }
 }

package/dist/mcp-result.js

@@ -1,3 +1,4 @@
+import { boundedEchoText } from "./errors.js";
 /**
  * Unwrap an MCP CallToolResult into an ordinary JavaScript value:
  * `toolResult` wins when present, then `structuredContent`; all-text content is
@@ -17,9 +18,9 @@ export function unwrapMcpResult(kind, result) {
             .filter((c) => c.type === "text")
             .map((c) => c.text ?? "")
             .join("\n");
-        throw new Error(text || "Tool call failed");
+        throw new Error(boundedEchoText(text || "Tool call failed"));
     }
-    if (r.structuredContent != null)
+    if (r.structuredContent !== undefined)
         return r.structuredContent;
     if (content.length > 0 && content.every((c) => c.type === "text")) {
         const text = content.map((c) => c.text ?? "").join("\n");

package/dist/meta-tools.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { boundedDiscoveryText, CatalogService, DEFAULT_SEARCH_LIMIT, DiscoveryPolicyError, groupedSearchResult, MAX_DESCRIBE_ADDRESSES, MAX_DISCOVERY_RESULT_BYTES, MAX_SEARCH_LIMIT, } from "./catalog-service.js";
 import { resolveDiscoveryConcurrency } from "./concurrency.js";
-import { msg } from "./errors.js";
+import { boundedEchoText, msg } from "./errors.js";
 import { serializeResultText } from "./executor-result.js";
 import { InvocationService, } from "./invocation.js";
 import { isValidMaxResultBytes, MIN_MAX_RESULT_BYTES, resolveMaxResultBytes, } from "./registry.js";
@@ -37,7 +37,12 @@ async function discoveryResult(operation, hint) {
     try {
         const value = await operation();
         const text = boundedDiscoveryText(value, hint);
-        return jsonResult(value, text);
+        const result = jsonResult(value, text);
+        const bytes = enc.encode(JSON.stringify(result)).length;
+        if (bytes > MAX_DISCOVERY_RESULT_BYTES) {
+            throw new DiscoveryPolicyError("result_too_large", `Discovery result is ${bytes} UTF-8 bytes, over the ${MAX_DISCOVERY_RESULT_BYTES}-byte ceiling. ${hint}`);
+        }
+        return result;
     }
     catch (err) {
         if (err instanceof DiscoveryPolicyError) {
@@ -94,29 +99,37 @@ export function alignEndToCharBoundary(bytes, offset, end, total) {
     }
     return e;
 }
-// --- result-size guard + get_result (feature 1) ---------------------------
-/**
- * The one serialization every result guard measures, stashes, and pages: JSON
- * text for whatever JSON can represent, and `String(value)` for the returns
- * JSON renders as `undefined` — a handler that returns nothing, a function, or
- * a Symbol. `JSON.stringify` is *typed* as returning `string` while actually
- * returning `undefined` for those, which is how a handler returning `undefined`
- * reached clients as a `{"type":"text"}` block carrying no `text` at all: the
- * size guard measured `enc.encode(undefined)` — the empty string, per the
- * WebIDL default — and emitted the non-string unchanged (issue #42). `null`
- * needs no special case; JSON renders it as `"null"`.
- *
- * Shared by `guardText`, `guardValue`, and execute_code's `guardResultValue` so
- * the three give one answer to the same question. A value JSON cannot serialize
- * at all (a BigInt) still throws, as before, and is reported as a failure.
- */
-/**
- * Stash `text` under `result:<uuid>` (ttl 900s) and describe it as the
- * truncation notice every over-cap path hands back.
- */
-async function stashResult(text, results, totalBytes) {
+/** Stash a completed result, or return a notice without a paging route. */
+async function stashResult(bytes, results) {
+    const totalBytes = bytes.length;
     const id = crypto.randomUUID();
-    await results.set(`result:${id}`, text, { ttlSeconds: RESULT_TTL_SECONDS });
+    try {
+        // Base64 permits byte-range decoding after a KV read, without scanning or
+        // re-encoding all preceding text. Each chunk is a multiple of three bytes.
+        const chunks = [];
+        for (let offset = 0; offset < bytes.length; offset += 12_288) {
+            chunks.push(btoa(String.fromCharCode(...bytes.subarray(offset, offset + 12_288))));
+        }
+        const stored = `connecta-result-v1:${totalBytes}:${chunks.join("")}`;
+        if (!await results.set(`result:${id}`, stored, RESULT_TTL_SECONDS)) {
+            throw new Error("Result stash capacity exhausted");
+        }
+    }
+    catch {
+        // Paging is advisory after a completed call, including an approved write.
+        // Neither backend prose nor a retry hint belongs in this successful result.
+        try {
+            results.warn();
+        }
+        catch {
+            // Logging cannot change the call either.
+        }
+        return {
+            truncated: true,
+            totalBytes,
+            hint: "Paging is unavailable. Use execute_code to reduce read-only results before returning them. Do not repeat a completed write to recover its result.",
+        };
+    }
     return {
         truncated: true,
         resultId: id,
@@ -141,7 +154,7 @@ async function guardEncoded(text, bytes, results, cap) {
             truncated: false,
         };
     }
-    const notice = await stashResult(text, results, bytes.length);
+    const notice = await stashResult(bytes, results);
     const head = dec.decode(bytes.slice(0, alignEndToCharBoundary(bytes, 0, cap, bytes.length)));
     return {
         result: {
@@ -166,8 +179,12 @@ async function guardValue(value, results, cap) {
     const bytes = enc.encode(text);
     if (bytes.length <= cap)
         return { result: value, truncated: false };
+    const notice = await stashResult(bytes, results);
     return {
-        result: await stashResult(text, results, bytes.length),
+        result: notice.resultId ? notice : {
+            ...notice,
+            preview: dec.decode(bytes.slice(0, alignEndToCharBoundary(bytes, 0, cap, bytes.length))),
+        },
         truncated: true,
     };
 }
@@ -210,7 +227,7 @@ async function guardContent(content, results, cap) {
     if (content.every((b) => b.type === "text")) {
         return guardEncoded(text, bytes, results, cap);
     }
-    const notice = await stashResult(text, results, bytes.length);
+    const notice = await stashResult(bytes, results);
     return {
         result: { content: [{ type: "text", text: JSON.stringify(notice) }] },
         truncated: true,
@@ -259,7 +276,6 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
     const invocation = new InvocationService(registry, catalog, opts.activity);
     /** MCP adapter: shared invocation semantics plus MCP-only result shaping. */
     async function runCall(call, source, options = {}) {
-        const results = registry.resultsStorage();
         const timeoutMs = normalizeTimeoutMs(call.timeoutMs) ?? defaultToolTimeoutMs;
         const outcome = await invocation.invoke(call.address, call.args ?? {}, {
             source,
@@ -272,6 +288,13 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                 : {}),
             unwrapResult: call.resultMode === "value",
             processResult: async (result, resolved) => {
+                const results = {
+                    set: (key, value, ttlSeconds) => registry.stashResult(key, value, ttlSeconds),
+                    warn: () => registry.contextFor(resolved.connector.id, baseUrl, requestScope).logger.warn("[connecta] result paging unavailable", {
+                        connector: resolved.connector.id,
+                        tool: resolved.toolName,
+                    }),
+                };
                 // Result-size cap for THIS call: the connector's own override wins,
                 // then the deployment-wide value, then the built-in default (already
                 // folded into `globalCap`). Resolved per call so one request can
@@ -292,7 +315,14 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                 }
                 if (resolved.connector.kind === "mcp") {
                     const mcpResult = result;
-                    const content = mcpResult?.content ?? [];
+                    let content = mcpResult?.content ?? [];
+                    if (!content.some((block) => block.type === "text") &&
+                        mcpResult?.structuredContent !== undefined) {
+                        content = [...content, {
+                                type: "text",
+                                text: JSON.stringify(mcpResult.structuredContent),
+                            }];
+                    }
                     const guarded = await guardContent(content, results, cap);
                     return processed(guarded.result, guarded.truncated);
                 }
@@ -305,12 +335,15 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
         if (!outcome.ok) {
             const structuredRecovery = outcome.error.nextAction !== undefined;
             const recoveryRequired = structuredRecovery ||
+                // Sanitized `unavailable` diagnostics ride the structured shape too;
+                // the plain-text path would drop them (#539).
+                outcome.error.details !== undefined ||
                 [
                     "auth_required",
                     "invalid_args",
                     "input_required_unsupported",
                 ].includes(outcome.error.code);
-            const failedResult = recoveryRequired ||
+            const makeFailedResult = () => recoveryRequired ||
                 call.resultMode === "value"
                 ? jsonResult({
                     ok: false,
@@ -320,6 +353,18 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                     ...(call.diagnostics ? { timing: outcome.timing } : {}),
                 })
                 : errorResult(outcome.error.message);
+            let failedResult = makeFailedResult();
+            // Value mode repeats the error in text and structuredContent. Account for
+            // both copies and JSON escaping when the bounded provider reason is large.
+            if (!recoveryRequired) {
+                const cap = resolveMaxResultBytes(outcome.resolved?.connector.maxResultBytes, globalCap);
+                let budget = 512;
+                while (enc.encode(JSON.stringify(failedResult)).length > cap && budget > 0) {
+                    budget = Math.floor(budget / 2);
+                    outcome.error.message = boundedEchoText(outcome.error.message, budget);
+                    failedResult = makeFailedResult();
+                }
+            }
             if (recoveryRequired) {
                 failedResult.isError = true;
             }
@@ -372,6 +417,9 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
             return { content: [{ type: "text", text: skill.content }] };
         },
         async searchTools(args) {
+            if (args.connector !== undefined && enc.encode(args.connector).length > 512) {
+                return discoveryErrorResult(new DiscoveryPolicyError("invalid_args", "connector must be at most 512 UTF-8 bytes."));
+            }
             return discoveryResult(async () => groupedSearchResult(await catalog.search({
                 ...args,
                 includeSchemaKeys: args.includeSchemas !== undefined,
@@ -401,29 +449,60 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                     `>= ${MIN_RESULT_OFFSET}. Omit it to start at the beginning.`);
             }
             const results = registry.resultsStorage();
-            const stored = await results.get(`result:${args.id}`);
+            let stored;
+            try {
+                stored = await results.get(`result:${args.id}`);
+            }
+            catch {
+                return {
+                    ...jsonResult({
+                        error: {
+                            code: "unavailable",
+                            message: "Result paging storage is unavailable.",
+                            retryable: true,
+                        },
+                    }),
+                    isError: true,
+                };
+            }
             if (stored === null || stored === undefined) {
-                return errorResult(`Unknown or expired result id "${args.id}"`);
+                return errorResult(`Unknown or expired result id "${boundedEchoText(args.id)}"`);
+            }
+            const requestedOffset = args.offset ?? 0;
+            const maxBytes = args.maxBytes ?? globalCap;
+            // Decode only this page plus UTF-8 boundary lookaround. Legacy raw-text
+            // entries remain readable for their short TTL after an upgrade.
+            const header = /^connecta-result-v1:(\d+):/.exec(stored.slice(0, 64));
+            let bytes;
+            let total;
+            let start = 0;
+            if (header) {
+                total = Number(header[1]);
+                start = Math.floor(Math.max(0, Math.min(requestedOffset, total) - 3) / 3) * 3;
+                const end = Math.min(total, requestedOffset + maxBytes + 4);
+                const binary = atob(stored.slice(header[0].length + start / 3 * 4, header[0].length + Math.ceil(end / 3) * 4));
+                bytes = Uint8Array.from(binary, char => char.charCodeAt(0));
+            }
+            else {
+                bytes = enc.encode(stored);
+                total = bytes.length;
             }
-            const bytes = enc.encode(stored);
-            const total = bytes.length;
             // Validated above, so no coercion is needed here — only alignment. A
             // client that computes its own offsets can land inside a multi-byte
             // character, which would decode as U+FFFD; the offset actually served is
             // the boundary at or before it, and it is what the response reports back
             // as `offset` (issue #38).
-            const offset = alignStartToCharBoundary(bytes, args.offset ?? 0);
+            const offset = start + alignStartToCharBoundary(bytes, requestedOffset - start);
             // Page size only: a stashed result carries no connector identity, so
             // get_result keeps the deployment-wide default when none is requested.
             // Both sides are validated by now — the argument above, `globalCap` at
             // intake — so `offset + maxBytes` always reaches past `offset`.
-            const maxBytes = args.maxBytes ?? globalCap;
             // Align the slice end to a codepoint boundary so a multi-byte char is
             // never split across pages (which would emit U+FFFD on both sides).
             // `nextOffset` is this aligned end, so it is a valid boundary for the
             // next call and paging reassembles the original byte-for-byte.
-            const end = alignEndToCharBoundary(bytes, offset, offset + maxBytes, total);
-            const slice = dec.decode(bytes.slice(offset, end));
+            const end = start + alignEndToCharBoundary(bytes, offset - start, offset - start + maxBytes, total - start);
+            const slice = dec.decode(bytes.subarray(offset - start, end - start));
             const nextOffset = end < total ? end : undefined;
             return jsonResult({
                 offset,
@@ -435,7 +514,7 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
         async authorizeConnector(args) {
             const connector = registry.getConnector(args.connector);
             if (!connector) {
-                return errorResult(`Unknown connector "${args.connector}"`);
+                return errorResult(`Unknown connector "${boundedEchoText(args.connector)}"`);
             }
             if (!connector.startAuth) {
                 if (!connector.credential) {

package/dist/registry.d.ts

@@ -61,6 +61,10 @@ export interface RegistryOptions {
      * to the default 50_000.
      */
     maxResultBytes?: number | undefined;
+    results?: {
+        maxStashBytes?: number;
+        maxStashEntries?: number;
+    } | undefined;
     /**
      * Where payload-free catalog-drift observations go. Present only when the
      * deployment configured an activity store; drift is reported through
@@ -103,6 +107,8 @@ export interface RegistryView {
         signal?: AbortSignal;
     }): Promise<CallAdmissionPermit>;
     resultsStorage(): KVStorage;
+    /** Reserve runtime-wide capacity before writing a paging envelope. */
+    stashResult(key: string, value: string, ttlSeconds: number): Promise<boolean>;
     /** Local declared-vs-stored credential mismatch, with no downstream I/O. */
     credentialDriftFor(id: string): Promise<string | undefined>;
     /** Value-free shape learned from successful calls, never a provider declaration. */
@@ -156,9 +162,13 @@ export declare class Registry implements RegistryView {
     private readonly persistToolCatalog;
     /** Result-size guard cap threaded to the meta-tools. */
     readonly maxResultBytes: number;
+    /** Only keys, byte counts, and expiry survive requests; never write promises. */
+    private readonly resultStash;
+    private resultStashBytes;
     private readonly configuredConnectors;
     private readonly personalRegistries;
-    /** `connector.tool` grants that matched nothing, warned once per isolate. */
+    private callAdmissionClosed;
+    /** Bounded FIFO of absent grants already warned about. */
     private readonly warnedAbsentGrants;
     constructor(connectors: Connector[], opts: RegistryOptions);
     personalRegistry(principalKey: string): Registry;
@@ -202,7 +212,7 @@ export declare class Registry implements RegistryView {
         args: unknown;
         signal?: AbortSignal;
     }): Promise<CallAdmissionPermit>;
-    /** Payload-free aggregate state for the open health endpoint. */
+    /** Connector totals across root and personal controllers; health removes ids. */
     callAdmissionSnapshot(): Record<string, ConnectorCallAdmissionSnapshot>;
     /**
      * Payload-free drift counts for the open health endpoint, so `connecta
@@ -230,6 +240,8 @@ export declare class Registry implements RegistryView {
     private observeCatalogDrift;
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission(): void;
+    /** Reserve capacity and write one ASCII paging envelope in this runtime. */
+    stashResult(key: string, value: string, ttlSeconds: number, prefix?: string): Promise<boolean>;
     /**
      * Storage namespaced to the meta-tool result store (`results:` prefix), kept
      * separate from any connector's `conn:<id>:` namespace. Backs get_result.