@zackbart/connecta 0.26.3 → 0.27.0

package/dist/providers/notion.js

@@ -147,7 +147,10 @@ async function notionRequest(ctx, request) {
         if (!response.ok) {
             throw notionFailure(response.status, payload, response.headers);
         }
-        return payload ?? {};
+        if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+            throw new ConnectorCallError("connector_call_failed", "Notion returned an unreadable or non-object JSON response for a successful status. The request was sent, but its result could not be read; do not repeat a write to recover its result.", { retryable: false });
+        }
+        return payload;
     });
 }
 // Projections. Notion wraps every property in a discriminated object, every

package/dist/providers/vercel.js

@@ -83,7 +83,7 @@ function vercelFailure(status, headers, payload) {
         retryable: false,
     });
 }
-function parseBody(text, contentType) {
+function parseBody(text, contentType, strict = false) {
     if (!text)
         return undefined;
     try {
@@ -91,6 +91,8 @@ function parseBody(text, contentType) {
     }
     catch {
         if (contentType?.includes("stream+json") || contentType?.includes("ndjson")) {
+            if (strict)
+                return parseStreamRows(text);
             const rows = [];
             for (const line of text.split("\n")) {
                 if (!line.trim())
@@ -104,6 +106,9 @@ function parseBody(text, contentType) {
             }
             return rows;
         }
+        if (strict) {
+            throw new ConnectorCallError("connector_call_failed", "Vercel returned a malformed successful response.", { retryable: false });
+        }
         return text;
     }
 }
@@ -144,14 +149,13 @@ function vercelTransport(baseUrl) {
         },
     });
 }
-async function callVercel(send, request, ctx, parseSuccess) {
+async function callVercel(send, request, ctx, success = {}) {
     return await send(request, ctx, async (response) => {
         const text = await response.text();
-        const payload = parseBody(text, response.headers.get("content-type"));
         if (!response.ok) {
-            throw vercelFailure(response.status, response.headers, payload);
+            throw vercelFailure(response.status, response.headers, parseBody(text, response.headers.get("content-type")));
         }
-        return parseSuccess ? parseSuccess(text) : payload;
+        return success.parse ? success.parse(text) : parseBody(text, response.headers.get("content-type"), !success.raw);
     });
 }
 function teamQuery(args, defaultTeamId) {
@@ -553,7 +557,7 @@ function tools(send, defaultPageSize, defaultTeamId) {
                 required: ["result"],
             },
             handler: async (args, ctx) => ({
-                result: (await callVercel(send, { method: "GET", ...rawRequest(args, defaultTeamId) }, ctx)) ?? null,
+                result: (await callVercel(send, { method: "GET", ...rawRequest(args, defaultTeamId) }, ctx, { raw: true })) ?? null,
             }),
         },
         {
@@ -588,7 +592,7 @@ function tools(send, defaultPageSize, defaultTeamId) {
                     method: args["method"],
                     ...rawRequest(args, defaultTeamId),
                     ...(args["body"] !== undefined ? { body: args["body"] } : {}),
-                }, ctx)) ?? null,
+                }, ctx, { raw: true })) ?? null,
             }),
         },
         {
@@ -641,7 +645,7 @@ function tools(send, defaultPageSize, defaultTeamId) {
                         "Content-Type": args["contentType"],
                     },
                     rawBody: uploadBody(args),
-                }, ctx)) ?? null,
+                }, ctx, { raw: true })) ?? null,
             }),
         },
         {
@@ -839,7 +843,7 @@ function tools(send, defaultPageSize, defaultTeamId) {
                     method: "GET",
                     path: `/v1/projects/${encodeURIComponent(args["projectId"])}/deployments/${encodeURIComponent(args["deploymentId"])}/runtime-logs`,
                     query: team(args), headers: { Accept: "application/stream+json" },
-                }, { ...ctx, signal }, parseStreamRows), {
+                }, { ...ctx, signal }, { parse: parseStreamRows }), {
                     timeoutMs: RUNTIME_LOG_TIMEOUT_MS,
                     ...(ctx.signal ? { signal: ctx.signal } : {}),
                     timeoutError: new ConnectorCallError("unavailable", `Vercel's runtime-log stream stayed open past this connector's ${RUNTIME_LOG_TIMEOUT_MS / 1_000}-second bound. Retry for a fresh snapshot.`),

package/dist/registry.d.ts

@@ -171,6 +171,7 @@ export declare class Registry implements RegistryView {
     private resultStashBytes;
     private readonly configuredConnectors;
     private readonly personalRegistries;
+    private readonly oauthPartition;
     private callAdmissionClosed;
     /** Bounded FIFO of absent grants already warned about. */
     private readonly warnedAbsentGrants;

package/dist/registry.js

@@ -8,6 +8,7 @@ import { MAX_CATALOG_CHUNK_BYTES, MAX_CATALOG_TOOLS, MAX_SERIALIZED_CATALOG_BYTE
 import { ObservedOutputSchemas } from "./result-shapes.js";
 import { GUIDE_SUMMARY_LENGTH, normalizeGuideSummary, } from "./skills.js";
 import { attachOAuthSealer, vaultOAuthSealer } from "./oauth-sealing.js";
+import { attachOAuthPartition, oauthPartitionIdle } from "./oauth-partition.js";
 import { attachCaller } from "./connector-caller.js";
 import { closeScopeOnExit } from "./runtime/connector-scope.js";
 import { detach, runEdge, withDeadlineEffect } from "./runtime/run.js";
@@ -164,6 +165,7 @@ export class Registry {
     resultStashBytes = 0;
     configuredConnectors;
     personalRegistries = new Map();
+    oauthPartition = {};
     callAdmissionClosed = false;
     /** Bounded FIFO of absent grants already warned about. */
     warnedAbsentGrants = new Set();
@@ -226,9 +228,12 @@ export class Registry {
             // principal starts with no generations and no mutation queue, so a
             // refresh the evicted registry finishes later would persist a listing
             // that a credential change on the replacement had just deleted.
+            // OAuth status/start work bypasses both gates, and accepted rotations
+            // may still be saving after their caller leaves. Preserve its partition.
             const idle = [...this.personalRegistries].find(([, candidate]) => [...candidate.callAdmission.values()].every(admission => admission.isIdle()) &&
                 candidate.catalogRefreshes.size === 0 &&
-                candidate.catalogMutations.size === 0);
+                candidate.catalogMutations.size === 0 &&
+                oauthPartitionIdle(candidate.oauthPartition));
             if (!idle) {
                 throw new Error("Personal connector capacity is exhausted; retry after calls, rolling budgets, and catalog refreshes drain.");
             }
@@ -287,11 +292,24 @@ export class Registry {
     }
     async storeOAuthHandoff(connectorId, state, principalKey) {
         const key = this.oauthHandoffKey(connectorId, await sha256Hex(state));
-        const existing = await this.opts.storage.get(key);
-        if (existing && existing !== principalKey) {
-            throw new Error(`Connector "${connectorId}" reused one OAuth state across principals`);
+        for (let attempt = 0; attempt < 32; attempt++) {
+            const existing = await this.opts.storage.get(key);
+            if (existing && existing !== principalKey) {
+                throw new Error(`Connector "${connectorId}" reused one OAuth state across principals`);
+            }
+            const expiry = { ttlSeconds: OAUTH_HANDOFF_TTL_SECONDS };
+            if (this.opts.storage.compareAndSet) {
+                // Bind ownership atomically, including renewal of the same owner's
+                // handoff. Two owners reading a miss must not overwrite each other.
+                if (!await this.opts.storage.compareAndSet(key, existing, principalKey, expiry))
+                    continue;
+            }
+            else {
+                await this.opts.storage.set(key, principalKey, expiry);
+            }
+            return;
         }
-        await this.opts.storage.set(key, principalKey, { ttlSeconds: OAUTH_HANDOFF_TTL_SECONDS });
+        throw new Error(`OAuth handoff for "${connectorId}" is busy; retry authorization`);
     }
     async oauthCallbackView(connectorId, state) {
         const connector = this.connectors.get(connectorId);
@@ -389,7 +407,10 @@ export class Registry {
                 return values;
             };
             credentialAccess = {
-                get: async (field = "value") => (await readValues())?.[field] ?? null,
+                get: async (field = "value") => {
+                    const values = await readValues();
+                    return values && Object.hasOwn(values, field) ? values[field] : null;
+                },
                 getAll: readValues,
             };
         }
@@ -401,6 +422,7 @@ export class Registry {
             requestScope,
             ...callOptions,
         };
+        attachOAuthPartition(context, this.oauthPartition);
         // Downstream OAuth state is sealed under the vault key, bound to this
         // connector and owner. The sealer rides beside the context, not on it.
         return this.opts.credentialVault
@@ -818,8 +840,12 @@ export class Registry {
         const turn = Deferred.makeUnsafe();
         this.catalogMutations.set(id, turn);
         try {
-            if (previous)
-                await runEdge(Deferred.await(previous));
+            if (previous) {
+                // A cross-request Deferred alone looks hung to workerd. Keep a timer
+                // owned by this request until the preceding mutation hands over its
+                // turn; the race interrupts the timer as soon as the wait settles.
+                await runEdge(Effect.raceFirst(Deferred.await(previous), Effect.forever(Effect.sleep(Duration.seconds(1)))));
+            }
             await runOnPartition(operation, this.opts);
         }
         finally {
@@ -841,14 +867,8 @@ export class Registry {
         // observation, but must not overwrite a newer same-generation refresh.
         // Blocking callers do not set this flag and retain their prior publication
         // behavior when an inbound abort races a completed listing.
-        if (skipPublicationWhenAborted && ctx.signal?.aborted)
-            return tools;
-        // The caller that began this refresh may still use its result, but a
-        // credential/OAuth change that landed while listTools was in flight, or a
-        // flight abandoned while it listed, means the listing must not enter
-        // either shared cache layer.
-        if (!this.mayPublish(id, generation, flight))
-            return tools;
+        // Every returned listing must pass the ceilings, even when invalidation
+        // or abandonment means it can no longer enter either shared cache layer.
         if (tools.length > MAX_CATALOG_TOOLS) {
             const message = `Connector "${id}" returned ${tools.length} tools, over the ` +
                 `${MAX_CATALOG_TOOLS}-tool catalog ceiling; refusing the complete catalog.`;
@@ -857,10 +877,6 @@ export class Registry {
         }
         const previous = this.cache.get(id);
         const snapshot = await snapshotCatalog(tools);
-        if (!this.mayPublish(id, generation, flight) ||
-            (skipPublicationWhenAborted && ctx.signal?.aborted)) {
-            return tools;
-        }
         if (snapshot.serializedBytes.byteLength > MAX_SERIALIZED_CATALOG_BYTES) {
             const message = `Connector "${id}" returned a ${snapshot.serializedBytes.byteLength}-byte ` +
                 `serialized catalog, over the ${MAX_SERIALIZED_CATALOG_BYTES}-byte ceiling; ` +
@@ -868,6 +884,13 @@ export class Registry {
             this.opts.logger.warn(`[connecta] ${message}`);
             throw new Error(message);
         }
+        // The caller that began this refresh may still use its bounded result,
+        // but credential changes, abandoned flights, and deferred cancellation
+        // prevent publication. Recheck after snapshotting, which is asynchronous.
+        if (!this.mayPublish(id, generation, flight) ||
+            (skipPublicationWhenAborted && ctx.signal?.aborted)) {
+            return tools;
+        }
         const now = Date.now();
         const catalogChanged = !previous || previous.fingerprint !== snapshot.fingerprint;
         const shouldPersist = catalogChanged ||
@@ -1296,23 +1319,33 @@ class ScopedRegistryView {
     allowed;
     scope;
     maxResultBytes;
-    personal;
+    /** An evicted view's admission controller must remain closed. */
+    admissionPersonal;
+    get personal() {
+        return this.scope.principalKey
+            ? this.root.personalRegistry(this.scope.principalKey)
+            : undefined;
+    }
     constructor(root, allowed, scope) {
         this.root = root;
         this.allowed = allowed;
         this.scope = scope;
         this.maxResultBytes = root.maxResultBytes;
-        this.personal = scope.principalKey
+        // Check capacity at construction, then resolve the current registry on
+        // use. A retained view must not revive one evicted while it was idle.
+        this.admissionPersonal = scope.principalKey
             ? root.personalRegistry(scope.principalKey)
             : undefined;
     }
-    registryFor(id) {
+    registryFor(id, admission = false) {
         if (!this.allowed.has(id))
             return undefined;
         const connector = this.root.getConnector(id);
         if (!connector)
             return undefined;
-        return connector.authScope === "personal" ? this.personal : this.root;
+        if (connector.authScope !== "personal")
+            return this.root;
+        return admission ? this.admissionPersonal : this.personal;
     }
     listConnectors() {
         return this.root.listConnectors().filter((connector) => this.registryFor(connector.id) !== undefined);
@@ -1358,7 +1391,7 @@ class ScopedRegistryView {
         return attachCaller(registry.contextFor(...args), this.scope.caller);
     }
     admitCall(...args) {
-        const registry = this.registryFor(args[0]);
+        const registry = this.registryFor(args[0], true);
         if (!registry) {
             return Promise.reject(new Error(`Unknown connector "${args[0]}"`));
         }

package/dist/resumable.js

@@ -226,7 +226,9 @@ export class RunState {
     /** A claimed replay of a paused run. */
     static replaying(options) {
         const { header } = options.claim;
-        return new RunState(options.journal, options.program, { clockMs: header.clock, seed: header.seed }, "resume_execution", options.settings, options.claim, new ReplayState(options.entries, header.pending?.key));
+        const run = new RunState(options.journal, options.program, { clockMs: header.clock, seed: header.seed }, "resume_execution", options.settings, options.claim, new ReplayState(options.entries, header.pending?.key));
+        run.writesSpent = header.writes.length;
+        return run;
     }
     // --- numbering and the gate sequencer ---------------------------------
     /**
@@ -325,12 +327,9 @@ export class RunState {
     lookup(key) {
         if (!this.replay)
             return { kind: "live" };
-        const found = this.replay.lookup(key);
-        // Replayed writes spend the write budget again, as replayed calls spend
-        // the host-call budget: per-play totals equal per-run totals.
-        if (found.kind === "hit" && found.entry.write)
-            this.writesSpent++;
-        return found;
+        // Already-sent writes spend the run budget whether this play repeats them
+        // or diverges before doing so. Only new dispatches spend it again.
+        return this.replay.lookup(key);
     }
     /** Journal a completed live call that was not a write. */
     record(seq, op, key, outcome) {
@@ -546,11 +545,41 @@ export class RunState {
                 : undefined;
             if (this.claim && slot !== undefined) {
                 const claim = this.claim;
+                const entryBytes = utf8Bytes(RunJournal.entryText(entry));
+                let tooLarge = false;
+                // Reserve capacity through the same serialized CAS as the write-ahead
+                // marks. Concurrent answers cannot both spend the last free bytes.
+                const capacity = yield* this.mutateHeader((header) => {
+                    const pendingBytes = this.unpersisted.reduce((sum, pending) => sum + utf8Bytes(RunJournal.entryText(pending)), 0);
+                    tooLarge = header.bytes + pendingBytes + entryBytes > MAX_JOURNAL_BYTES;
+                    if (tooLarge) {
+                        this.stopWith({
+                            kind: "failed",
+                            failure: unknownFailure ?? failure("journal_too_large", `This run recorded more than ${MAX_JOURNAL_BYTES} bytes of source and host calls, too much to keep in its journal. Writes it already sent are counted in writes and are not undone; check them before running the task again.`),
+                        });
+                    }
+                    return {
+                        ...header,
+                        bytes: tooLarge ? header.bytes : header.bytes + entryBytes,
+                        writes: tooLarge
+                            ? header.writes.map((write) => write.entry === slot ? { ...write, state } : write)
+                            : header.writes,
+                    };
+                });
+                if (capacity !== "ok") {
+                    this.noteLocally(slot, state);
+                    const lost = capacity === "lost"
+                        ? failure("execution_claim_lost", `The write to ${target.address} was sent (${describeState(state)}), but another resume_execution took the run over before its result could be journaled.`)
+                        : interrupted(`The write to ${target.address} was sent (${describeState(state)}), but paused-run storage failed before its result could be journaled.`);
+                    this.stopWith({ kind: "failed", failure: lost });
+                    return guestFailure(lost.code, lost.message);
+                }
+                if (tooLarge)
+                    return this.halted();
                 const written = yield* Effect.tryPromise(() => this.journal.writeEntry(slot, entry, claim.header.expiresAt)).pipe(Effect.as(true), Effect.catch(() => Effect.succeed(false)));
                 const recorded = written ? state : "unknown";
                 const settled = yield* this.mutateHeader((header) => ({
                     ...header,
-                    bytes: header.bytes + utf8Bytes(RunJournal.entryText(entry)),
                     writes: header.writes.map((write) => write.entry === slot ? { ...write, state: recorded } : write),
                 }));
                 if (settled !== "ok") {
@@ -670,8 +699,11 @@ export class RunState {
         const stop = this.stop;
         if (!stop)
             return Effect.die(new Error("finishStopped without a stop"));
-        if (stop.kind === "failed")
-            return this.finishFailed(stop.failure);
+        if (stop.kind === "failed") {
+            return this.finishFailed(stop.failure.code === "journal_too_large" && this.writeCounts().unknown > 0
+                ? unknownOutcome()
+                : stop.failure);
+        }
         if (this.writeCounts().unknown > 0)
             return this.finishFailed(unknownOutcome());
         return this.persistPause(stop.pending);

package/dist/routes/credentials.js

@@ -1,4 +1,5 @@
 import { Effect } from "effect";
+import { claimConnectorScopeCleanup, closeConnectorScope } from "../connector-scope.js";
 import { credentialTestRule, describeCredentialTestMismatch, storedCredentialShape, } from "../credential-rules.js";
 import { authorizedPerson, refuse, serveOperator, visibleRegistry, } from "./operator.js";
 import { mayManageConnector, isSameOrigin, msg, privateJson, } from "./shared.js";
@@ -164,14 +165,21 @@ function credentialRequest(context, connectorId, action) {
                     }
                     const storedValues = values;
                     const ctx = registry.contextFor(connectorId, baseUrl);
-                    const result = mode === "multiple"
-                        ? await connector.testCredentials(storedValues, ctx)
-                        : await connector.testCredential(
-                        // The single-value shape check above guarantees this key.
-                        storedValues.value, ctx);
-                    const ok = result?.ok === true;
-                    logged(ok, result?.message);
-                    return privateJson({ ok });
+                    const releaseCleanup = claimConnectorScopeCleanup(ctx, connectorId);
+                    try {
+                        const result = mode === "multiple"
+                            ? await connector.testCredentials(storedValues, ctx)
+                            : await connector.testCredential(
+                            // The single-value shape check above guarantees this key.
+                            storedValues.value, ctx);
+                        const ok = result?.ok === true;
+                        logged(ok, result?.message);
+                        return privateJson({ ok });
+                    }
+                    finally {
+                        releaseCleanup();
+                        await closeConnectorScope(connector, ctx, context.defer);
+                    }
                 },
                 catch: (error) => error,
             }).pipe(Effect.catch((error) => {

package/dist/routes/oauth.js

@@ -1,4 +1,5 @@
 import { Effect } from "effect";
+import { closeConnectorScope } from "../connector-scope.js";
 import { oauthValueStorageKey } from "../auth/downstream-oauth.js";
 import { escapeHtml, renderPage, resolveBranding, STATUS_ICONS } from "../branding.js";
 import { oauthCallbackOutcome, providerErrorReason, } from "../oauth-callback-outcome.js";
@@ -127,79 +128,84 @@ async function finishOAuthCallback(context) {
         await equalizeRefusalCost(connectorContext);
         return refused();
     }
-    const expectedPrincipalKey = callbackTarget?.principalKey;
-    // A browser returning from consent normally has no MCP Authorization
-    // header. An interactive bearer provider therefore answers 401 here; state
-    // and the saved state-to-principal handoff still prove ownership below.
-    // Rejecting 401 would break that callback. A 403 is an explicit denial.
-    const browserIdentity = await authorizeUiIdentity(context.request, baseUrl, opts.auth, "OAuth callback", context.runtimeContext, opts.identity);
-    if (browserIdentity.ok) {
-        try {
-            validateAuthPermissions(browserIdentity, opts.registry);
+    try {
+        const expectedPrincipalKey = callbackTarget?.principalKey;
+        // A browser returning from consent normally has no MCP Authorization
+        // header. An interactive bearer provider therefore answers 401 here; state
+        // and the saved state-to-principal handoff still prove ownership below.
+        // Rejecting 401 would break that callback. A 403 is an explicit denial.
+        const browserIdentity = await authorizeUiIdentity(context.request, baseUrl, opts.auth, "OAuth callback", context.runtimeContext, opts.identity);
+        if (browserIdentity.ok) {
+            try {
+                validateAuthPermissions(browserIdentity, opts.registry);
+            }
+            catch {
+                return refused();
+            }
+            if (!mayManageConnector(browserIdentity, connector) || (expectedPrincipalKey && browserIdentity.principalKey !== expectedPrincipalKey))
+                return refused();
         }
-        catch {
+        else if (browserIdentity.response.status === 403 && opts.auth.some(provider => provider.interactiveOperator)) {
             return refused();
         }
-        if (!mayManageConnector(browserIdentity, connector) || (expectedPrincipalKey && browserIdentity.principalKey !== expectedPrincipalKey))
+        // CSRF / login-fixation guard: this route is intentionally public, so verify
+        // the `state` matches the flow connecta started BEFORE exchanging the code.
+        if (!connector.verifyState) {
+            await equalizeRefusalCost(connectorContext);
+            opts.logger.warn(`[connecta] refused an OAuth callback for connector ` +
+                `${loggableValue(id)} with 400: it implements finishAuth but no ` +
+                "verifyState, so connecta cannot establish that it started this flow. " +
+                "No authorization code was exchanged. Implement verifyState before " +
+                "trying again.");
             return refused();
-    }
-    else if (browserIdentity.response.status === 403 && opts.auth.some(provider => provider.interactiveOperator)) {
-        return refused();
-    }
-    // CSRF / login-fixation guard: this route is intentionally public, so verify
-    // the `state` matches the flow connecta started BEFORE exchanging the code.
-    if (!connector.verifyState) {
-        await equalizeRefusalCost(connectorContext);
-        opts.logger.warn(`[connecta] refused an OAuth callback for connector ` +
-            `${loggableValue(id)} with 400: it implements finishAuth but no ` +
-            "verifyState, so connecta cannot establish that it started this flow. " +
-            "No authorization code was exchanged. Implement verifyState before " +
-            "trying again.");
-        return refused();
-    }
-    let stateMatches;
-    try {
-        stateMatches = await connector.verifyState(state, connectorContext);
-    }
-    catch (err) {
-        opts.logger.warn(`[connecta] refused an OAuth callback for connector ` +
-            `${loggableValue(id)} with 400: verifyState threw ` +
-            `${loggableValue(msg(err))}. No authorization code was exchanged. ` +
-            "Re-run authorization from connecta and check the verifier if it " +
-            "fails again.");
-        return refused();
-    }
-    if (!stateMatches) {
-        opts.logger.warn(`[connecta] refused an OAuth callback for connector ` +
-            `${loggableValue(id)} with 400: ` +
-            (state === null
-                ? "the state parameter was missing"
-                : "the state did not match the pending authorization flow") +
-            ". No authorization code was exchanged. Re-run authorization from " +
-            "connecta and try again.");
-        return refused();
-    }
-    if (connector.authScope === "personal") {
+        }
+        let stateMatches;
         try {
-            await opts.registry.clearOAuthHandoff(id, state);
+            stateMatches = await connector.verifyState(state, connectorContext);
         }
         catch (err) {
             opts.logger.warn(`[connecta] refused an OAuth callback for connector ` +
-                `${loggableValue(id)} with 500: its principal handoff could not be ` +
-                `consumed (${loggableValue(msg(err))}). No authorization code was exchanged.`);
-            return html("handoff_failed", opts, connector);
+                `${loggableValue(id)} with 400: verifyState threw ` +
+                `${loggableValue(msg(err))}. No authorization code was exchanged. ` +
+                "Re-run authorization from connecta and check the verifier if it " +
+                "fails again.");
+            return refused();
+        }
+        if (!stateMatches) {
+            opts.logger.warn(`[connecta] refused an OAuth callback for connector ` +
+                `${loggableValue(id)} with 400: ` +
+                (state === null
+                    ? "the state parameter was missing"
+                    : "the state did not match the pending authorization flow") +
+                ". No authorization code was exchanged. Re-run authorization from " +
+                "connecta and try again.");
+            return refused();
+        }
+        if (connector.authScope === "personal") {
+            try {
+                await opts.registry.clearOAuthHandoff(id, state);
+            }
+            catch (err) {
+                opts.logger.warn(`[connecta] refused an OAuth callback for connector ` +
+                    `${loggableValue(id)} with 500: its principal handoff could not be ` +
+                    `consumed (${loggableValue(msg(err))}). No authorization code was exchanged.`);
+                return html("handoff_failed", opts, connector);
+            }
+        }
+        try {
+            await connector.finishAuth(code, connectorContext, url.searchParams);
+            await callbackRegistry.invalidateStored(id);
+            return html("connected", opts, connector);
+        }
+        catch (err) {
+            // The page names the reason and nothing else; what the exchange threw can
+            // quote a token endpoint's body, so it goes only to the operator log.
+            opts.logger.warn(`[connecta] OAuth callback for connector ${loggableValue(id)} failed ` +
+                `with 500: the authorization code exchange threw ${loggableValue(msg(err))}.`);
+            return html("exchange_failed", opts, connector);
         }
     }
-    try {
-        await connector.finishAuth(code, connectorContext, url.searchParams);
-        await callbackRegistry.invalidateStored(id);
-        return html("connected", opts, connector);
-    }
-    catch (err) {
-        // The page names the reason and nothing else; what the exchange threw can
-        // quote a token endpoint's body, so it goes only to the operator log.
-        opts.logger.warn(`[connecta] OAuth callback for connector ${loggableValue(id)} failed ` +
-            `with 500: the authorization code exchange threw ${loggableValue(msg(err))}.`);
-        return html("exchange_failed", opts, connector);
+    finally {
+        await closeConnectorScope(connector, connectorContext, context.defer);
     }
 }

package/dist/runtime/run.js

@@ -34,7 +34,9 @@ function setMicrotask(task) {
 export const microtaskScheduler = new Scheduler.MixedScheduler("async", setMicrotask);
 const runExit = Effect.runPromiseExitWith(Context.make(Scheduler.Scheduler, microtaskScheduler));
 function abortReason(signal) {
-    return signal?.reason ?? new DOMException("aborted", "AbortError");
+    return signal && signal.reason !== undefined
+        ? signal.reason
+        : new DOMException("aborted", "AbortError");
 }
 /**
  * Turn a failed Exit back into the value a Promise caller would have seen.
@@ -136,6 +138,10 @@ export function fromSignal(signal) {
  */
 export function withDeadlineEffect(operation, options) {
     return Effect.suspend(() => {
+        // Do not dispatch work that already lost its caller. The operation is the
+        // first race contender and can finish before the abort contender starts.
+        if (options.signal?.aborted)
+            return Effect.fail(abortReason(options.signal));
         const controller = new AbortController();
         const forwardAbort = () => controller.abort(options.signal?.reason);
         options.signal?.addEventListener("abort", forwardAbort, { once: true });