@zackbart/connecta 0.24.4 → 0.26.0

package/dist/routes/mcp.js

@@ -1,10 +1,13 @@
 import { createMcpHandler, isLegacyRequest, McpServer, WebStandardStreamableHTTPServerTransport, } from "@modelcontextprotocol/server";
+import { Duration, Effect, Exit, Option, Result, Scope } from "effect";
 import { registerExecuteTool } from "../execute.js";
 import { ExecutorAdmissionError, } from "../executor-admission.js";
 import { registerMetaTools } from "../meta-tools.js";
+import { registerResumeTool } from "../resumable.js";
 import { intersectAccess } from "../connector-access.js";
 import { instructionsFor } from "../skills.js";
 import { msg } from "../errors.js";
+import { detach } from "../runtime/run.js";
 import { authorize, loggableValue, mayManageConnector, validateAuthPermissions, } from "./shared.js";
 export const MCP_CORS_HEADERS = {
     "Access-Control-Allow-Origin": "*",
@@ -73,11 +76,16 @@ function requestAdmissionFailure(error) {
     }), { status: 503, headers });
 }
 /**
- * A request owns its permit through the response body, not merely until the
- * handler returns. This is what makes slow clients and response-stream failure
- * part of the same bounded lifecycle as success, error, and cancellation.
+ * Hand a response the Scope that holds what its request acquired.
+ *
+ * A request owns its permit and its McpServer through the response body, not
+ * merely until the handler returns. `close` runs once, on whichever comes
+ * first: the body is read to its end or fails, its reader cancels it, or the
+ * request's signal aborts. This is what makes slow clients and response-stream
+ * failure part of the same bounded lifecycle as success, error, and
+ * cancellation.
  */
-function releaseAdmissionWithResponse(response, lease, signal) {
+function closeWithBody(response, signal, close) {
     let released = false;
     let onAbort = () => { };
     const release = () => {
@@ -85,7 +93,7 @@ function releaseAdmissionWithResponse(response, lease, signal) {
             return;
         released = true;
         signal.removeEventListener("abort", onAbort);
-        lease.release();
+        close();
     };
     if (!response.body) {
         release();
@@ -94,9 +102,9 @@ function releaseAdmissionWithResponse(response, lease, signal) {
     const reader = response.body.getReader();
     onAbort = () => {
         // `cancel()` belongs to an operator/auth/SDK-provided stream and may
-        // reject. Consume both outcomes: `.finally(release)` would release the
-        // permit but preserve the rejection as an unhandled promise.
-        void reader.cancel(signal.reason).then(release, release);
+        // reject or never settle. Release now; consume either outcome separately.
+        release();
+        void reader.cancel(signal.reason).catch(() => { });
     };
     signal.addEventListener("abort", onAbort, { once: true });
     if (signal.aborted)
@@ -119,12 +127,8 @@ function releaseAdmissionWithResponse(response, lease, signal) {
             }
         },
         async cancel(reason) {
-            try {
-                await reader.cancel(reason);
-            }
-            finally {
-                release();
-            }
+            release();
+            await reader.cancel(reason);
         },
     });
     return new Response(body, {
@@ -133,6 +137,52 @@ function releaseAdmissionWithResponse(response, lease, signal) {
         headers: response.headers,
     });
 }
+/**
+ * Run a request's handler in a Scope that outlives it.
+ *
+ * The handler acquires into the scope and its response carries the scope
+ * out, for `closeWithBody` to close when the body ends. A handler that fails,
+ * or is interrupted because the request's signal aborted, closes it at once:
+ * nothing it acquired waits on a body that will never be read.
+ */
+function scopedToBody(handler, signal) {
+    return Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+        const scope = yield* Scope.make();
+        const exit = yield* Effect.exit(restore(Scope.provide(scope)(handler)));
+        if (Exit.isFailure(exit)) {
+            yield* Scope.close(scope, exit);
+            return yield* exit;
+        }
+        // Every finalizer in the scope is synchronous, so the close has run by
+        // the time detach returns: the permit is back, and handed to the next
+        // queued request, inside the read or cancel that ended the body.
+        return closeWithBody(exit.value, signal, () => {
+            void detach(Scope.close(scope, Exit.void));
+        });
+    }));
+}
+/**
+ * The request's admission permit, owned by its Scope.
+ *
+ * Admission goes through the controller's Promise rather than its Effect
+ * program (`acquireScoped`), on purpose. The pool is shared by every request
+ * in the isolate, and a queued request is handed its permit from inside the
+ * request whose body just ended. A fiber resumed there would authorize and
+ * serve this request in that one's I/O context, which workerd refuses;
+ * awaiting `acquire()`'s promise resumes it in its own.
+ *
+ * The wait stays interruptible, and a permit granted just as it was
+ * interrupted still arrives, later, to be released on arrival.
+ */
+function admitted(controller, signal) {
+    return Effect.acquireRelease(Effect.suspend(() => {
+        const pending = controller.acquire({ signal });
+        return Effect.tryPromise({ try: () => pending, catch: (error) => error })
+            .pipe(Effect.onInterrupt(() => Effect.sync(() => {
+            pending.then((lease) => lease.release(), () => { });
+        })));
+    }), (lease) => Effect.sync(() => lease.release()), { interruptible: true });
+}
 /**
  * 404 for any `?toolkit=` value, kept after the feature's retirement (#178).
  *
@@ -167,10 +217,19 @@ function toolkitRetired(logger) {
         },
     });
 }
-async function serveMcp(request, opts, baseUrl, actor, registry, canManageAuth, runtimeContext) {
+function serveMcp(request, requestSignal, opts, baseUrl, actor, registry, canManageAuth, poolName, runtimeContext) {
+    // A paused run belongs to the endpoint it started on: resuming it through
+    // another pool's endpoint finds nothing, as another subject would.
+    const resumable = opts.resumable
+        ? { ...opts.resumable, pool: poolName ?? null, approval: opts.approval }
+        : undefined;
+    // Every McpServer the request builds is fresh and closes with its scope.
+    // The modern handler tears its own down after the exchange; the legacy
+    // transport never does, and neither may stay wired to an ended request.
+    const servers = [];
     const createServer = () => {
         const server = new McpServer(opts.serverInfo, {
-            instructions: instructionsFor(),
+            instructions: instructionsFor(resumable !== undefined),
             cacheHints: {
                 "tools/list": {
                     ttlMs: 3_600_000,
@@ -208,17 +267,18 @@ async function serveMcp(request, opts, baseUrl, actor, registry, canManageAuth,
             ...(opts.discoveryConcurrency !== undefined
                 ? { discoveryConcurrency: opts.discoveryConcurrency }
                 : {}),
-            requestSignal: request.signal,
+            requestSignal,
             ...(runtimeContext?.waitUntil
                 ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
                 : {}),
+            approval: opts.approval,
         });
-        registerExecuteTool(server, registry, {
+        const runner = registerExecuteTool(server, registry, {
             baseUrl,
             executor: opts.executor,
             logger: opts.logger,
             ...(activity ? { activity } : {}),
-            requestSignal: request.signal,
+            requestSignal,
             ...(runtimeContext?.waitUntil
                 ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
                 : {}),
@@ -240,26 +300,48 @@ async function serveMcp(request, opts, baseUrl, actor, registry, canManageAuth,
             ...(opts.hostCallTimeoutMs !== undefined
                 ? { hostCallTimeoutMs: opts.hostCallTimeoutMs }
                 : {}),
+            ...(opts.watchdogMs !== undefined
+                ? { watchdogMs: opts.watchdogMs }
+                : {}),
+            resumable,
+            approval: opts.approval,
+            maxWrites: opts.maxWrites,
         });
+        // Always registered, so the surface is the same eight tools on every
+        // deployment; without resumable writes it answers that there is nothing
+        // to resume.
+        registerResumeTool(server, registry, {
+            runner,
+            settings: resumable,
+            ...(activity ? { activity } : {}),
+            requestSignal,
+        });
+        servers.push(server);
         return server;
     };
-    // The v2 entry's built-in legacy fallback streams 2025 results as SSE.
-    // Connecta's established wire contract is JSON, so retain the documented
-    // user-land legacy branch with the same transport setting while the modern
-    // branch uses the fetch-native handler.
-    if (!(await isLegacyRequest(request))) {
-        return createMcpHandler(createServer, {
-            legacy: "reject",
-            onerror: (error) => opts.logger.error("[connecta] MCP handler error", error),
-        }).fetch(request);
-    }
-    // Fresh server + transport per legacy request, stateless and JSON-shaped.
-    const server = createServer();
-    const transport = new WebStandardStreamableHTTPServerTransport({
-        enableJsonResponse: true,
-    });
-    await server.connect(transport);
-    return transport.handleRequest(request);
+    const exchange = async () => {
+        // The v2 entry's built-in legacy fallback streams 2025 results as SSE.
+        // Connecta's established wire contract is JSON, so retain the documented
+        // user-land legacy branch with the same transport setting while the modern
+        // branch uses the fetch-native handler.
+        if (!(await isLegacyRequest(request))) {
+            return createMcpHandler(createServer, {
+                legacy: "reject",
+                onerror: (error) => opts.logger.error("[connecta] MCP handler error", error),
+            }).fetch(request);
+        }
+        // Fresh server + transport per legacy request, stateless and JSON-shaped.
+        const server = createServer();
+        const transport = new WebStandardStreamableHTTPServerTransport({
+            enableJsonResponse: true,
+        });
+        await server.connect(transport);
+        return transport.handleRequest(request);
+    };
+    return Effect.addFinalizer(() => Effect.sync(() => {
+        for (const server of servers)
+            void server.close().catch(() => { });
+    })).pipe(Effect.andThen(Effect.promise(exchange)));
 }
 export function createMcpRoute(opts) {
     const configuredOrigins = opts.allowedOrigins;
@@ -322,10 +404,10 @@ export function createMcpRoute(opts) {
         lastAdmissionWarningAt = now;
         suppressedAdmissionWarnings = 0;
     };
-    async function routeMcp(context) {
+    function routeMcp(context) {
         const { path, request, baseUrl, runtimeContext, } = context;
         if (path !== "/mcp" && !path.startsWith("/mcp/"))
-            return null;
+            return Effect.succeed(null);
         const poolName = path === "/mcp" ? undefined : path.slice("/mcp/".length);
         const origin = request.headers.get("Origin");
         const allowed = origin === null || allowsOrigin(origin);
@@ -334,90 +416,124 @@ export function createMcpRoute(opts) {
         // local header check also guards OPTIONS before any provider metadata.
         const refusal = rejectOrigin(request);
         if (refusal)
-            return refusal;
-        if (request.method === "OPTIONS")
-            return cors(new Response(null, { status: 204 }));
-        let admission;
-        try {
-            admission = await opts.requestAdmission.acquire({
-                signal: request.signal,
-            });
-            if (admission.waitMs > 0) {
-                opts.logger.debug("[connecta] MCP request admitted after queue wait", {
-                    waitMs: admission.waitMs,
-                    active: opts.requestAdmission.activeCount,
-                    queued: opts.requestAdmission.queuedCount,
-                });
-            }
+            return Effect.succeed(refusal);
+        if (request.method === "OPTIONS") {
+            return Effect.succeed(cors(new Response(null, { status: 204 })));
         }
-        catch (error) {
-            if (error instanceof ExecutorAdmissionError &&
-                error.code === "executor_cancelled") {
-                throw request.signal.reason ?? error;
-            }
-            if (error instanceof ExecutorAdmissionError) {
+        // This controller belongs to this request. Its signal reaches auth and
+        // every registered tool; a controller sweep never touches it.
+        const localAbort = new AbortController();
+        const onCallerAbort = () => localAbort.abort(request.signal.reason);
+        request.signal.addEventListener("abort", onCallerAbort, { once: true });
+        if (request.signal.aborted)
+            onCallerAbort();
+        let deadlineTimer;
+        return scopedToBody(Effect.gen(function* () {
+            yield* Effect.addFinalizer(() => Effect.sync(() => {
+                if (!localAbort.signal.aborted) {
+                    localAbort.abort(request.signal.reason ?? new Error("MCP request ended."));
+                }
+                request.signal.removeEventListener("abort", onCallerAbort);
+                if (deadlineTimer !== undefined)
+                    clearTimeout(deadlineTimer);
+            }));
+            const admission = yield* Effect.result(admitted(opts.requestAdmission, request.signal));
+            if (Result.isFailure(admission)) {
+                const error = admission.failure;
+                if (!(error instanceof ExecutorAdmissionError)) {
+                    return yield* Effect.fail(error);
+                }
+                if (error.code === "executor_cancelled") {
+                    return yield* Effect.fail(request.signal.reason ?? error);
+                }
                 if (error.code === "executor_overloaded") {
                     warnAdmissionRejected(error);
                 }
                 return cors(requestAdmissionFailure(error));
             }
-            throw error;
-        }
-        try {
-            const authz = await authorize(request, baseUrl, opts.auth, runtimeContext, opts.identity);
-            if (!authz.ok) {
-                return releaseAdmissionWithResponse(cors(authz.response), admission, request.signal);
+            const remainingMs = admission.success.remainingMs();
+            if (remainingMs !== undefined && remainingMs <= 0) {
+                admission.success.release();
+                return cors(new Response("MCP request lifetime exceeded.", { status: 504 }));
             }
-            // A pool endpoint narrows the identity's own view and nothing else. An
-            // undeclared name, a grant that refuses, and a grant that throws are
-            // one identical 404 so a credential never enumerates the other pools;
-            // the operator log is where the reason lives.
-            let access = authz;
-            if (poolName !== undefined) {
-                const pool = opts.pools?.get(poolName);
-                let granted = false;
-                let reason = "undeclared";
-                if (pool) {
-                    try {
-                        granted = (await pool.grant(authz.identity)) === true;
-                        reason = granted ? "granted" : "refused";
-                    }
-                    catch {
-                        reason = "grant threw";
-                    }
-                }
-                if (!pool || !granted) {
-                    opts.logger.warn(`[connecta] refused /mcp/${poolName} with 404: pool ${reason}` +
-                        (authz.actor.id ? ` for ${loggableValue(authz.actor.id)}` : ""));
-                    return releaseAdmissionWithResponse(cors(new Response("Not Found", { status: 404 })), admission, request.signal);
-                }
-                access = intersectAccess(authz, pool.access);
+            if (remainingMs !== undefined) {
+                deadlineTimer = setTimeout(() => {
+                    localAbort.abort(new Error("MCP request lifetime exceeded."));
+                }, remainingMs);
             }
-            let scopedRegistry;
-            try {
-                validateAuthPermissions(authz, opts.registry);
-                scopedRegistry = opts.registry.scoped({
-                    connectorIds: access.connectorIds,
-                    ...(access.toolAccess ? { toolAccess: access.toolAccess } : {}),
-                    ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
-                    ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
+            const localRequest = new Request(request, { signal: localAbort.signal });
+            if (admission.success.waitMs > 0) {
+                opts.logger.debug("[connecta] MCP request admitted after queue wait", {
+                    waitMs: admission.success.waitMs,
+                    active: opts.requestAdmission.activeCount,
+                    queued: opts.requestAdmission.queuedCount,
                 });
             }
-            catch (error) {
-                return releaseAdmissionWithResponse(cors(new Response(JSON.stringify({ error: msg(error) }), {
-                    status: 403,
-                    headers: { "Content-Type": "application/json" },
-                })), admission, request.signal);
-            }
-            if (new URL(request.url).searchParams.has("toolkit")) {
-                return releaseAdmissionWithResponse(cors(toolkitRetired(opts.logger)), admission, request.signal);
-            }
-            return releaseAdmissionWithResponse(cors(await serveMcp(request, opts, baseUrl, authz.actor, scopedRegistry, id => { const connector = scopedRegistry.getConnector(id); return Boolean(connector && mayManageConnector(authz, connector)); }, runtimeContext)), admission, request.signal);
-        }
-        catch (error) {
-            admission.release();
-            throw error;
-        }
+            // Promise code the fiber stops waiting on when the caller leaves. An
+            // Effect `authorize` would put Effect in the /activity bundle, which
+            // shares it, to save only the lookups an abandoned authorization
+            // finishes on its own.
+            const handled = Effect.gen(function* () {
+                const authz = yield* Effect.promise(() => authorize(localRequest, baseUrl, opts.auth, runtimeContext, opts.identity));
+                if (!authz.ok)
+                    return cors(authz.response);
+                // A pool endpoint narrows the identity's own view and nothing else. An
+                // undeclared name, a grant that refuses, and a grant that throws are
+                // one identical 404 so a credential never enumerates the other pools;
+                // the operator log is where the reason lives.
+                let access = authz;
+                if (poolName !== undefined) {
+                    const pool = opts.pools?.get(poolName);
+                    const reason = !pool ? "undeclared" : yield* Effect.promise(async () => {
+                        try {
+                            return (await pool.grant(authz.identity)) === true ? "granted" : "refused";
+                        }
+                        catch {
+                            return "grant threw";
+                        }
+                    });
+                    if (!pool || reason !== "granted") {
+                        opts.logger.warn(`[connecta] refused /mcp/${poolName} with 404: pool ${reason}` +
+                            (authz.actor.id ? ` for ${loggableValue(authz.actor.id)}` : ""));
+                        return cors(new Response("Not Found", { status: 404 }));
+                    }
+                    access = intersectAccess(authz, pool.access);
+                }
+                let scopedRegistry;
+                try {
+                    validateAuthPermissions(authz, opts.registry);
+                    scopedRegistry = opts.registry.scoped({
+                        connectorIds: access.connectorIds,
+                        ...(access.toolAccess ? { toolAccess: access.toolAccess } : {}),
+                        ...(access.guardedToolAccess ? { guardedToolAccess: access.guardedToolAccess } : {}),
+                        ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
+                        ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
+                        caller: {
+                            identity: authz.identity,
+                            ...(poolName !== undefined ? { pool: poolName } : {}),
+                        },
+                    });
+                }
+                catch (error) {
+                    return cors(new Response(JSON.stringify({ error: msg(error) }), {
+                        status: 403,
+                        headers: { "Content-Type": "application/json" },
+                    }));
+                }
+                if (new URL(request.url).searchParams.has("toolkit")) {
+                    return cors(toolkitRetired(opts.logger));
+                }
+                return cors(yield* serveMcp(localRequest, localAbort.signal, opts, baseUrl, authz.actor, scopedRegistry, id => { const connector = scopedRegistry.getConnector(id); return Boolean(connector && mayManageConnector(authz, connector)); }, poolName, runtimeContext));
+            });
+            if (remainingMs === undefined)
+                return yield* handled;
+            const bounded = yield* handled.pipe(Effect.timeoutOption(Duration.millis(remainingMs)));
+            if (Option.isNone(bounded))
+                localAbort.abort(new Error("MCP request lifetime exceeded."));
+            return Option.isSome(bounded)
+                ? bounded.value
+                : cors(new Response("MCP request lifetime exceeded.", { status: 504 }));
+        }), localAbort.signal);
     }
     return { handle: routeMcp, rejectOrigin };
 }

package/dist/routes/oauth-management.js

@@ -1,70 +1,76 @@
-import { closeConnectorScope } from "../connector-scope.js";
+import { Effect, Result } from "effect";
+import { closeScope } from "../runtime/connector-scope.js";
 import { isSafeHttpUrl } from "../ui.js";
-import { authorizeUiIdentity, mayManageConnector, validateAuthPermissions, isSameOrigin, msg, privateJson, } from "./shared.js";
-async function handleOAuthManagementRequest(context, connectorId) {
-    const { request, baseUrl, opts, defer } = context;
-    if (!isSameOrigin(request, baseUrl)) {
-        return privateJson({ error: "same-origin request required" }, { status: 403 });
-    }
-    const authz = await authorizeUiIdentity(request, baseUrl, opts.auth, "OAuth management", context.runtimeContext, opts.identity);
-    if (!authz.ok)
-        return authz.response;
-    let registry;
-    try {
-        validateAuthPermissions(authz, opts.registry);
-        registry = opts.registry.scoped({
-            connectorIds: authz.connectorIds,
-            ...(authz.toolAccess ? { toolAccess: authz.toolAccess } : {}),
-            ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
-            ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
-        });
-    }
-    catch (error) {
-        return privateJson({ error: msg(error) }, { status: 403 });
-    }
-    const connector = registry.getConnector(connectorId);
-    if (!connector?.disconnectAuth || !connector.startAuth) {
-        return privateJson({ error: "unknown OAuth connector" }, { status: 404 });
-    }
-    if (!mayManageConnector(authz, connector))
-        return privateJson({ error: "credential management is not permitted" }, { status: 403 });
-    if (connector.authScope === "personal" && !authz.principalKey) {
-        return privateJson({ error: "forbidden" }, { status: 403 });
-    }
-    if (request.method !== "DELETE" && request.method !== "POST") {
-        return privateJson({ error: "method not allowed" }, { status: 405 });
-    }
-    const requestScope = {};
-    const ctx = registry.contextFor(connectorId, baseUrl, requestScope);
-    try {
-        let result;
-        let operationError;
-        try {
-            if (request.method === "DELETE") {
-                await connector.disconnectAuth(ctx);
-            }
-            else {
-                result = await connector.startAuth(ctx, { force: true });
-                if (result.authorizationUrl) {
-                    await registry.bindOAuthHandoff(connectorId, result.authorizationUrl);
-                }
-            }
+import { authorizedPerson, refuse, serveOperator, visibleRegistry, } from "./operator.js";
+import { mayManageConnector, isSameOrigin, msg, privateJson, } from "./shared.js";
+function oauthManagementRequest(context, connectorId) {
+    const { request, baseUrl, defer, opts } = context;
+    return Effect.gen(function* () {
+        if (!isSameOrigin(request, baseUrl)) {
+            return yield* refuse("same-origin request required", 403);
         }
-        catch (error) {
-            operationError = error;
+        const authz = yield* authorizedPerson(context, "OAuth management");
+        const registry = yield* visibleRegistry(context, authz);
+        const connector = registry.getConnector(connectorId);
+        const disconnectAuth = connector?.disconnectAuth?.bind(connector);
+        const startAuth = connector?.startAuth?.bind(connector);
+        if (!connector || !disconnectAuth || !startAuth) {
+            return yield* refuse("unknown OAuth connector", 404);
         }
+        if (!mayManageConnector(authz, connector)) {
+            return yield* refuse("credential management is not permitted", 403);
+        }
+        if (connector.authScope === "personal" && !authz.principalKey) {
+            return yield* refuse("forbidden", 403);
+        }
+        const disconnecting = request.method === "DELETE";
+        if (!disconnecting && request.method !== "POST") {
+            return yield* refuse("method not allowed", 405);
+        }
+        const ctx = registry.contextFor(connectorId, baseUrl, {});
+        // The connector scope this request opened ends with it, however it ends.
+        yield* Effect.addFinalizer(() => closeScope(connector, ctx, defer));
+        const operation = yield* Effect.result(Effect.tryPromise({
+            try: async () => {
+                if (disconnecting) {
+                    await disconnectAuth(ctx);
+                    return undefined;
+                }
+                const started = await startAuth(ctx, { force: true });
+                if (started.authorizationUrl) {
+                    await registry.bindOAuthHandoff(connectorId, started.authorizationUrl);
+                }
+                return started;
+            },
+            catch: (error) => error,
+        }));
         // The old grant and its cached catalog are invalid after either operation,
         // including a partially failed physical cleanup whose epoch fence succeeded.
-        try {
-            await registry.invalidateStored(connectorId);
-        }
-        catch (error) {
-            operationError ??= error;
+        const invalidated = yield* Effect.result(Effect.tryPromise({
+            try: () => registry.invalidateStored(connectorId),
+            catch: (error) => error,
+        }));
+        // Every failure below answers in the route's own fixed words. A hook's
+        // rejection and a status message can quote a token endpoint's error body
+        // or a provider's refusal, either of which can quote the secret it was
+        // sent, so that text goes to the deployment's log and nowhere else.
+        const failed = (detail, fixed, status) => {
+            opts.logger.warn(`[connecta] connector "${connectorId}" OAuth ${disconnecting ? "disconnect" : "restart"} failed: ${detail}`);
+            return refuse(fixed, status);
+        };
+        const couldNot = disconnecting
+            ? "OAuth disconnect failed"
+            : "OAuth authorization could not start";
+        // A Result, not a caught value, decides whether it failed: a hook that
+        // rejects with no reason at all still failed.
+        if (Result.isFailure(operation)) {
+            return yield* failed(msg(operation.failure), couldNot, 400);
         }
-        if (operationError) {
-            return privateJson({ error: msg(operationError) }, { status: 400 });
+        if (Result.isFailure(invalidated)) {
+            return yield* failed(`stored-state invalidation: ${msg(invalidated.failure)}`, couldNot, 400);
         }
-        if (request.method === "DELETE") {
+        const result = operation.success;
+        if (!result) {
             return new Response(null, {
                 status: 204,
                 headers: {
@@ -77,23 +83,18 @@ async function handleOAuthManagementRequest(context, connectorId) {
             ? result.authorizationUrl
             : undefined;
         if (result.state === "error") {
-            return privateJson({ error: result.message || "OAuth authorization could not start" }, { status: 502 });
+            return yield* failed(result.message || "the connector reported an error state", couldNot, 502);
         }
         if (result.state === "auth_required" && !authorizationUrl) {
-            return privateJson({
-                error: result.message ||
-                    "OAuth authorization requires consent but no safe URL is available",
-            }, { status: 502 });
+            return yield* failed(result.message || "consent is required but no safe authorization URL was returned", "OAuth authorization requires consent but no safe URL is available", 502);
         }
+        // No message: a status message is the same text the Connections page
+        // stopped shipping, and the state and the link are the whole answer.
         return privateJson({
             state: result.state,
-            ...(result.message ? { message: result.message } : {}),
             ...(authorizationUrl ? { authorizationUrl } : {}),
         });
-    }
-    finally {
-        await closeConnectorScope(connector, ctx, defer);
-    }
+    }).pipe(Effect.scoped);
 }
 export async function routeOAuthManagement(context) {
     const match = /^\/ui\/oauth\/([a-z0-9_-]+)$/.exec(context.path);
@@ -105,5 +106,6 @@ export async function routeOAuthManagement(context) {
     if (context.request.method === "OPTIONS") {
         return privateJson({ error: "method not allowed" }, { status: 405 });
     }
-    return handleOAuthManagementRequest(context, connectorId);
+    // No signal: a disconnect that has started runs through to its invalidation.
+    return serveOperator(oauthManagementRequest(context, connectorId));
 }