@zackbart/connecta 0.29.0 → 0.30.0

package/dist/providers/infisical/skill.generated.js

@@ -0,0 +1,8 @@
+// Generated by scripts/generate-providers.mjs; do not edit.
+export const skill = {
+    "content": "Start with `list_projects` for project IDs and environment slugs, then `list_folders` for absolute paths.\n\nKeep value reads narrow. `list_secrets` returns identifiers only by default, even if the server sends values or comments; use `get_secret` or opt into `includeValues` only when needed. These explicit reads return secrets, including values and comments. Comments are available only from these value-read tools. Do not echo values unless the user asks. Imports follow the same value policy.\n\nValues can reference secrets as `${env.KEY}`. Value reads expand references by default. Use `expandReferences: false` to read the literal reference before editing; updating a value changes only that secret, not the secrets it references. Updates send only named changes. Writes omit values and report `pendingApproval` when an environment's change policy requires approval.\n\nEvery value-free result returns only checked identifiers: UUID or legacy 24-hex IDs, secret keys, positive integer versions, known type/approval enums, environment and tag slugs, absolute paths, and ISO timestamps. Projects expose IDs and environment identifiers; folders expose IDs and paths. Project slugs are withheld because Infisical can derive them from free-text project names. Comments, descriptions, free-form names, reminder notes, and arbitrary nested objects are withheld. `metadataOmitted: true` reports dropped or unavailable metadata; success or pending-approval context remains available. Identifier fields outside the conservative grammar are dropped.\n\nKnown, accepted residual risk: environment slugs are returned as required routing identifiers. Infisical's UI derives them from environment names by default, so secrets entered in those names can appear in returned slugs. Operators must not put secrets in environment names or slugs. Secrets placed in identifiers or key names are out of scope.\n\nThe provider assumes an honest Infisical server and protects against careless human entry of secrets in free text. It does not match submitted values or defend against a malicious server encoding values into valid identifiers. Submitted secret data never joins credential redaction, so later calls in the same program keep their authorized arguments. Client credentials and tokens retain request-scoped credential protection.\n\nThis finite surface has no guarded raw-REST tool. These endpoints return complete collections without a page cursor; narrow the path and avoid recursive/value listings to stay below Connecta's 8 MiB response ceiling. Temporary result paging does not reduce the upstream response size.\n\nUniversal Auth tokens remain in memory only and refresh before expiry. Reads may retry once after a rejected token. Writes refresh a rejected token for a later explicit call and return the auth failure without resending; reconcile the target before another call. Recovery echoes marked `argsRedacted` omit secret values, secret comments, and folder descriptions, so any new call requires the original arguments. The operator's machine identity must belong to each project with the right role; a 403 needs an operator to fix membership or role. US cloud is the default; set `baseUrl: \"https://eu.infisical.com/api\"` for EU cloud or your self-hosted HTTPS API base including `/api`. Preserve the connector id and the `clientId`/`clientSecret` fields when migrating existing credentials.\n\nNo default call budget is assumed. Operators can supply `callAdmission` for their instance's limits. The credential test performs a Universal Auth login only, without reading projects or secrets.\n",
+    "instructionsHeading": "Organization instructions",
+    "fragments": {
+        "guide": "Start with `list_projects` for project IDs and environment slugs, then `list_folders` for absolute paths.\n\nKeep value reads narrow. `list_secrets` returns identifiers only by default, even if the server sends values or comments; use `get_secret` or opt into `includeValues` only when needed. These explicit reads return secrets, including values and comments. Comments are available only from these value-read tools. Do not echo values unless the user asks. Imports follow the same value policy.\n\nValues can reference secrets as `${env.KEY}`. Value reads expand references by default. Use `expandReferences: false` to read the literal reference before editing; updating a value changes only that secret, not the secrets it references. Updates send only named changes. Writes omit values and report `pendingApproval` when an environment's change policy requires approval.\n\nEvery value-free result returns only checked identifiers: UUID or legacy 24-hex IDs, secret keys, positive integer versions, known type/approval enums, environment and tag slugs, absolute paths, and ISO timestamps. Projects expose IDs and environment identifiers; folders expose IDs and paths. Project slugs are withheld because Infisical can derive them from free-text project names. Comments, descriptions, free-form names, reminder notes, and arbitrary nested objects are withheld. `metadataOmitted: true` reports dropped or unavailable metadata; success or pending-approval context remains available. Identifier fields outside the conservative grammar are dropped.\n\nKnown, accepted residual risk: environment slugs are returned as required routing identifiers. Infisical's UI derives them from environment names by default, so secrets entered in those names can appear in returned slugs. Operators must not put secrets in environment names or slugs. Secrets placed in identifiers or key names are out of scope.\n\nThe provider assumes an honest Infisical server and protects against careless human entry of secrets in free text. It does not match submitted values or defend against a malicious server encoding values into valid identifiers. Submitted secret data never joins credential redaction, so later calls in the same program keep their authorized arguments. Client credentials and tokens retain request-scoped credential protection.\n\nThis finite surface has no guarded raw-REST tool. These endpoints return complete collections without a page cursor; narrow the path and avoid recursive/value listings to stay below Connecta's 8 MiB response ceiling. Temporary result paging does not reduce the upstream response size.\n\nUniversal Auth tokens remain in memory only and refresh before expiry. Reads may retry once after a rejected token. Writes refresh a rejected token for a later explicit call and return the auth failure without resending; reconcile the target before another call. Recovery echoes marked `argsRedacted` omit secret values, secret comments, and folder descriptions, so any new call requires the original arguments. The operator's machine identity must belong to each project with the right role; a 403 needs an operator to fix membership or role. US cloud is the default; set `baseUrl: \"https://eu.infisical.com/api\"` for EU cloud or your self-hosted HTTPS API base including `/api`. Preserve the connector id and the `clientId`/`clientSecret` fields when migrating existing credentials.\n\nNo default call budget is assumed. Operators can supply `callAdmission` for their instance's limits. The credential test performs a Universal Auth login only, without reading projects or secrets.\n"
+    }
+};

package/dist/registry.d.ts

@@ -112,7 +112,7 @@ export interface RegistryView {
     resultsStorage(): KVStorage;
     resultIdentity(): ResultIdentity;
     /** Recheck live auth/grants and pool admission before exposing stored data. */
-    recheckResultAccess(address: string, classification: "read" | "write", signal?: AbortSignal): Promise<boolean>;
+    recheckResultAccess(address: string | undefined, classification: "read" | "write", signal?: AbortSignal, access?: "catalog"): Promise<boolean>;
     /** Reserve deployment-wide capacity before writing a paging envelope's chunks. */
     stashResult(id: string, chunks: readonly string[], ttlSeconds: number): Promise<boolean>;
     /** Local declared-vs-stored credential mismatch, with no downstream I/O. */
@@ -142,7 +142,7 @@ export interface RegistryScope {
     principalKey?: string;
     endpoint?: string;
     origin?: string | null;
-    currentResultAccess?: (address: string, classification: "read" | "write", signal?: AbortSignal) => Promise<boolean>;
+    currentResultAccess?: (address: string | undefined, classification: "read" | "write", signal?: AbortSignal, access?: "catalog") => Promise<boolean>;
     /** The admitted caller, readable only by built-in connectors; see connector-caller.ts. */
     caller?: ConnectorCaller;
 }
@@ -241,9 +241,11 @@ export declare class Registry implements RegistryView {
      * The bounds are the deployment's, not this isolate's. Every charge is a
      * row in one ledger record in storage, booked by compare-and-set before any
      * chunk is written, so every isolate and process sharing the store sees the
-     * same entries and bytes. A charge leaves the ledger just after its
-     * result's deadline, which every chunk's TTL ends by; the storage TTL
-     * reclaims the rows themselves.
+     * same entries and bytes. A pending write keeps its finite charge reserved.
+     * Writes stop after 30 seconds; absolute chunk expiries cannot pass the
+     * booked deadline even on late commit. Rejected responses leave writes
+     * unconfirmed and retain their charge. Cleanup/release and settlement each
+     * stop waiting after 15 seconds. Storage TTL reclaims the rows.
      */
     stashResult(id: string, chunks: readonly string[], ttlSeconds: number, partition?: string): Promise<boolean>;
     /**
@@ -251,7 +253,7 @@ export declare class Registry implements RegistryView {
      * connector's namespace. Backs connecta.result.
      */
     resultIdentity(): ResultIdentity;
-    recheckResultAccess(_address: string, _classification: "read" | "write", _signal?: AbortSignal): Promise<boolean>;
+    recheckResultAccess(_address: string | undefined, _classification: "read" | "write", _signal?: AbortSignal, _access?: "catalog"): Promise<boolean>;
     resultsStorage(): KVStorage;
     credentialUiAvailable(): boolean;
     bindOAuthHandoff(id: string, authorizationUrl: string, principalKey?: string): Promise<void>;

package/dist/registry.js

@@ -19,7 +19,7 @@ import { attachCaller } from "./connector-caller.js";
 import { runEdge } from "./runtime/run.js";
 import { SharedRead } from "./runtime/shared-read.js";
 import { runOnPartition, storageCompareAndSet, storageDelete, storageGet, storageSet } from "./runtime/storage.js";
-import { jsonCodec, OAUTH_HANDOFF_TTL_SECONDS, oauthHandoffKeys, resultKeys, scopes, stashLedgerKeys, } from "./storage/keys.js";
+import { jsonCodec, OAUTH_HANDOFF_TTL_SECONDS, oauthHandoffKeys, resultKeys, scopes, stashLedgerKeys, stashExpiryKeys, } from "./storage/keys.js";
 import { classifyTool } from "./tool-safety.js";
 const ID_RE = /^[a-z0-9_-]+$/;
 const DEFAULT_MAX_RESULT_BYTES = CONFIG_DEFAULTS.calls.maxResultBytes;
@@ -87,6 +87,7 @@ function frozenFacts(tools) {
 }
 function namespaced(storage, prefix) {
     return {
+        capabilities: storage.capabilities,
         get: (k) => storage.get(prefix + k),
         set: (k, v, o) => storage.set(prefix + k, v, o),
         delete: (k) => storage.delete(prefix + k),
@@ -108,19 +109,21 @@ const STASH_LEDGER_ATTEMPTS = 32;
 /** First backoff window after a lost swap; it doubles up to the cap. */
 const STASH_LEDGER_BACKOFF_MS = 4;
 const STASH_LEDGER_BACKOFF_CAP_MS = 250;
-/**
- * Slack past a stash's deadline before its charge leaves the ledger, and the
- * longest one chunk write may take. A chunk's TTL is what remains of the
- * deadline on the clock read before its write, and the store starts that TTL
- * no later than the write returns, so the chunk expires within the write's
- * duration of the deadline. A write slower than this fails the stash.
- */
-const STASH_LEDGER_GRACE_MS = 30_000;
+/** Whole chunk-write phase, measured from booking, including the header. */
+const STASH_WRITE_TIMEOUT_MS = 30_000;
+/** Total cleanup/release or settlement budget, including ledger retries. */
+const STASH_COMPLETION_TIMEOUT_MS = 15_000;
+/** Stop waiting without starting background storage work after the deadline. */
+function completeStash(effect) {
+    return effect.pipe(Effect.asVoid, Effect.timeoutOrElse({ duration: Duration.millis(STASH_COMPLETION_TIMEOUT_MS), orElse: () => Effect.void }), 
+    // onError finalizers are otherwise uninterruptible, including their I/O.
+    Effect.interruptible);
+}
 /**
  * Live charges in a stored ledger. Anything malformed reads as empty: the
  * ledger bounds an advisory cache, and the next successful swap replaces it.
  */
-function liveStashCharges(raw, now) {
+function stashCharges(raw) {
     if (raw === null)
         return [];
     let parsed;
@@ -138,16 +141,36 @@ function liveStashCharges(raw, now) {
         typeof entry[0] === "string" &&
         Number.isSafeInteger(entry[1]) &&
         entry[1] >= 0 &&
-        typeof entry[2] === "number" &&
-        entry[2] > now);
+        Number.isSafeInteger(entry[2]));
 }
-/**
- * Rewrite the stash ledger by compare-and-set. `plan` sees the live charges
- * and the time it read them at, and answers its result with the entries to
- * store, or without them when there is nothing to write. Only `plan` refuses:
- * a lost swap backs off and plans again from a fresh read. Answers undefined
- * once the attempts run out.
- */
+/** Caller time can nominate a charge for pruning, but only storage proves expiry. */
+function liveStashCharges(raw, now) {
+    return Effect.gen(function* () {
+        const live = [];
+        const expired = new Map();
+        for (const entry of stashCharges(raw)) {
+            const deadline = entry[2];
+            if (deadline > now) {
+                live.push(entry);
+                continue;
+            }
+            let proven = expired.get(deadline);
+            if (proven === undefined) {
+                // A successful absolute-expiry write followed by an absent read proves
+                // storage has passed this deadline, even when the caller runs ahead.
+                // These probes expire at the deadline they check; no cleanup is needed.
+                const key = stashExpiryKeys.deadline(deadline);
+                yield* storageSet(key, "live", { expiresAtMs: deadline });
+                proven = (yield* storageGet(key)) === null;
+                expired.set(deadline, proven);
+            }
+            if (!proven)
+                live.push(entry);
+        }
+        return live;
+    });
+}
+/** Rewrite the ledger with bounded retries; every stored charge already expires. */
 function swapStashLedger(plan) {
     return Effect.gen(function* () {
         const ledger = stashLedgerKeys.ledger;
@@ -156,16 +179,34 @@ function swapStashLedger(plan) {
                 const window = Math.min(STASH_LEDGER_BACKOFF_CAP_MS, STASH_LEDGER_BACKOFF_MS * 2 ** (attempt - 1));
                 yield* Effect.sleep(Duration.millis(Math.floor((yield* Random.next) * window) + 1));
             }
+            const outcome = yield* Effect.gen(function* () {
+                const raw = yield* storageGet(ledger);
+                const now = yield* Clock.currentTimeMillis;
+                const planned = plan(yield* liveStashCharges(raw, now), now);
+                if (planned.entries !== undefined) {
+                    const entries = planned.entries;
+                    // The ledger row itself expires with its last charge. A delayed CAS
+                    // cannot create an immortal row or restart any reservation's lifetime.
+                    const next = entries.length ? jsonCodec.encode({ v: 1, entries }) : null;
+                    const expiresAtMs = entries.reduce((latest, entry) => Math.max(latest, entry[2]), entries[0]?.[2] ?? now);
+                    if (!(yield* storageCompareAndSet(ledger, raw, next, { expiresAtMs })))
+                        return undefined;
+                }
+                return { status: "applied", result: planned.result };
+            }).pipe(Effect.catch(() => Effect.succeed(undefined)));
+            if (outcome !== undefined)
+                return outcome;
+        }
+        // The final CAS can commit and then throw too. Confirm a read-only plan
+        // once more, especially an already-booked reservation, without another CAS.
+        return yield* Effect.gen(function* () {
             const raw = yield* storageGet(ledger);
             const now = yield* Clock.currentTimeMillis;
-            const planned = plan(liveStashCharges(raw, now), now);
-            if (planned.entries === undefined)
-                return planned.result;
-            if (yield* storageCompareAndSet(ledger, raw, jsonCodec.encode({ v: 1, entries: planned.entries }))) {
-                return planned.result;
-            }
-        }
-        return undefined;
+            const planned = plan(yield* liveStashCharges(raw, now), now);
+            return planned.entries === undefined
+                ? { status: "applied", result: planned.result }
+                : { status: "exhausted" };
+        }).pipe(Effect.catch(() => Effect.succeed({ status: "exhausted" })));
     });
 }
 async function sha256Hex(value) {
@@ -551,9 +592,11 @@ export class Registry {
      * The bounds are the deployment's, not this isolate's. Every charge is a
      * row in one ledger record in storage, booked by compare-and-set before any
      * chunk is written, so every isolate and process sharing the store sees the
-     * same entries and bytes. A charge leaves the ledger just after its
-     * result's deadline, which every chunk's TTL ends by; the storage TTL
-     * reclaims the rows themselves.
+     * same entries and bytes. A pending write keeps its finite charge reserved.
+     * Writes stop after 30 seconds; absolute chunk expiries cannot pass the
+     * booked deadline even on late commit. Rejected responses leave writes
+     * unconfirmed and retain their charge. Cleanup/release and settlement each
+     * stop waiting after 15 seconds. Storage TTL reclaims the rows.
      */
     stashResult(id, chunks, ttlSeconds, partition = scopes.results) {
         return runOnPartition(Effect.gen({ self: this }, function* () {
@@ -564,48 +607,78 @@ export class Registry {
             if (bytes > maxBytes || maxEntries === 0)
                 return false;
             const keys = chunks.map((_, index) => partition + resultKeys.chunk(id, index));
-            const charge = keys[0];
-            // One deadline for the charge and every chunk under it. Writes take
-            // time, so a chunk's TTL is whatever remains of the deadline when it is
-            // written, never a fresh `ttlSeconds`, and no single write may take
-            // longer than the grace: no chunk outlives the charge that bounds it.
-            const deadline = yield* swapStashLedger((live, now) => {
+            // IDs belong to reservations, not reusable result IDs or subjects.
+            const charge = crypto.randomUUID();
+            const ttlMs = ttlSeconds * 1000;
+            if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0)
+                return false;
+            const booking = yield* swapStashLedger((live, now) => {
+                // A committed CAS with a lost response is already our booking, even
+                // at full capacity. Reuse its deadline instead of adding a second slot.
+                const own = live.find((entry) => entry[0] === charge);
+                if (own)
+                    return { result: own[2] };
                 const used = live.reduce((sum, entry) => sum + entry[1], 0);
                 if (live.length >= maxEntries || used + bytes > maxBytes)
                     return { result: undefined };
-                const end = now + ttlSeconds * 1000;
-                return { entries: [...live, [charge, bytes, end + STASH_LEDGER_GRACE_MS]], result: end };
+                const deadline = now + STASH_WRITE_TIMEOUT_MS + ttlMs;
+                if (!Number.isSafeInteger(deadline))
+                    return { result: undefined };
+                return { entries: [...live, [charge, bytes, deadline]], result: deadline };
             });
-            if (deadline === undefined)
+            if (booking.status === "exhausted" || booking.result === undefined)
                 return false;
-            // A failed write may still have persisted. Delete every key it could
-            // have written and release the charge only when all of them are gone;
-            // otherwise the charge stays booked until it expires, by which time the
-            // storage TTL has removed whatever did land.
-            const release = Effect.gen(function* () {
-                for (const key of keys)
-                    yield* storageDelete(key);
-                yield* swapStashLedger((live) => live.some((entry) => entry[0] === charge)
-                    ? { entries: live.filter((entry) => entry[0] !== charge), result: undefined }
-                    : { result: undefined });
-            }).pipe(Effect.ignore);
-            // Trailing chunks first: the header chunk is what makes an id readable, so
-            // a write that fails midway leaves no envelope pointing at absent chunks.
+            const deadline = booking.result;
+            const writeDeadline = deadline - ttlMs;
+            const chunkExpiry = deadline - STASH_WRITE_TIMEOUT_MS;
+            const owns = (entry) => entry[0] === charge;
+            const settle = swapStashLedger((live) => live.some((entry) => owns(entry) && entry[2] > chunkExpiry)
+                ? {
+                    entries: live.map((entry) => (owns(entry) ? [charge, bytes, Math.min(entry[2], chunkExpiry)] : entry)),
+                    result: undefined,
+                }
+                : { result: undefined });
+            let pendingWrite = false;
+            // A rejected or timed-out driver call may still commit after deletion.
+            // Only a confirmed write response clears pendingWrite.
+            const release = completeStash(Effect.gen(function* () {
+                const deleted = yield* Effect.gen(function* () {
+                    for (const key of keys)
+                        yield* storageDelete(key);
+                    return true;
+                }).pipe(Effect.catch(() => Effect.succeed(false)));
+                if (pendingWrite)
+                    return;
+                if (deleted) {
+                    const released = yield* swapStashLedger((live) => live.some(owns)
+                        ? { entries: live.filter((entry) => !owns(entry)), result: undefined }
+                        : { result: undefined });
+                    if (released.status === "applied")
+                        return;
+                }
+                yield* settle;
+            }));
+            // Trailing chunks first, then the header. The caller receives no result
+            // ID after failure or timeout, including a late header commit.
+            const remaining = Math.max(0, writeDeadline - (yield* Clock.currentTimeMillis));
             const written = yield* Effect.gen(function* () {
                 for (let index = keys.length - 1; index >= 0; index--) {
                     const before = yield* Clock.currentTimeMillis;
-                    const remaining = Math.floor((deadline - before) / 1000);
-                    // Zero would mean no expiry: a stash that outlasts its deadline fails.
-                    if (remaining < 1)
+                    if (before >= writeDeadline || before >= chunkExpiry)
                         return false;
-                    yield* storageSet(keys[index], chunks[index], { ttlSeconds: remaining });
-                    if ((yield* Clock.currentTimeMillis) - before > STASH_LEDGER_GRACE_MS)
+                    pendingWrite = true;
+                    yield* storageSet(keys[index], chunks[index], { expiresAtMs: chunkExpiry }).pipe(Effect.tap(() => Effect.sync(() => {
+                        pendingWrite = false;
+                    })));
+                    if ((yield* Clock.currentTimeMillis) >= writeDeadline)
                         return false;
                 }
                 return true;
-            }).pipe(Effect.onError(() => release));
+            }).pipe(Effect.timeoutOrElse({ duration: Duration.millis(remaining), orElse: () => Effect.succeed(false) }), Effect.onError(() => release.pipe(Effect.ignore)));
             if (!written)
                 yield* release;
+            else
+                yield* completeStash(settle);
             return written;
         }), this.opts);
     }
@@ -616,7 +689,7 @@ export class Registry {
     resultIdentity() {
         return { subject: null, principal: null, endpoint: "/mcp", origin: null };
     }
-    recheckResultAccess(_address, _classification, _signal) {
+    recheckResultAccess(_address, _classification, _signal, _access) {
         return Promise.resolve(true);
     }
     resultsStorage() {
@@ -996,8 +1069,8 @@ class ScopedRegistryView {
             origin: this.scope.origin ?? null,
         };
     }
-    recheckResultAccess(address, classification, signal) {
-        return this.scope.currentResultAccess?.(address, classification, signal) ?? Promise.resolve(true);
+    recheckResultAccess(address, classification, signal, access) {
+        return this.scope.currentResultAccess?.(address, classification, signal, access) ?? Promise.resolve(true);
     }
     resultsStorage() {
         return this.scope.subjectKey ? this.root.scopedStorage(this.scope.subjectKey) : this.root.resultsStorage();

package/dist/resource-read.js

@@ -39,6 +39,7 @@ export function readResource(registry, raw, options) {
     return withDeadlineEffect((signal) => Effect.scoped(Effect.gen(function* () {
         const target = yield* Effect.try({ try: () => resourceTarget(registry, raw), catch: (error) => error });
         connector = target.connector;
+        options.onResolved?.(target.connector);
         // Await this Promise in the reader's request context, as invocation.ts does.
         yield* Effect.acquireRelease(Effect.suspend(() => {
             const pending = registry.admitCall(target.connector.id, {
@@ -50,7 +51,8 @@ export function readResource(registry, raw, options) {
                 pending.then((permit) => permit.release(), () => { });
             })));
         }), (permit) => Effect.sync(() => permit.release()), { interruptible: true });
-        return yield* timed((elapsed) => options.onConnectorTime?.(elapsed), Effect.tryPromise({
+        // Downstream contents enter the guest here, so they take the full payload rules.
+        const contents = yield* timed((elapsed) => options.onConnectorTime?.(elapsed), Effect.tryPromise({
             try: () => {
                 if (signal.aborted)
                     throw signal.reason;
@@ -66,6 +68,7 @@ export function readResource(registry, raw, options) {
             },
             catch: (error) => error,
         }));
+        return options.sentSecrets.redact(contents);
     })), {
         timeoutMs: options.timeoutMs,
         ...(options.signal ? { signal: options.signal } : {}),

package/dist/routes/mcp.js

@@ -675,7 +675,7 @@ export function createMcpRoute(opts) {
                         ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
                         endpoint: new URL(request.url).pathname,
                         origin: request.headers.get("Origin"),
-                        currentResultAccess: async (address, classification, signal) => {
+                        currentResultAccess: async (address, classification, signal, access) => {
                             signal?.throwIfAborted();
                             const current = await authorize(localRequest, baseUrl, opts.config.auth, runtimeContext, opts.config.identity);
                             if (!current.ok) {
@@ -699,6 +699,13 @@ export function createMcpRoute(opts) {
                                 ...(current.subjectKey ? { subjectKey: current.subjectKey } : {}),
                                 ...(current.principalKey ? { principalKey: current.principalKey } : {}),
                             });
+                            if (classification === "write" && currentTrust !== "trusted")
+                                return false;
+                            if (address === undefined)
+                                return true;
+                            // Skill and resource content requires a whole grant; catalog metadata requires visibility.
+                            if (!address.includes("."))
+                                return Boolean(access === "catalog" ? view.getConnector(address) : view.getResourceConnector(address));
                             const resolved = view.resolveAddress(address);
                             if (!resolved)
                                 return false;
@@ -707,7 +714,9 @@ export function createMcpRoute(opts) {
                                 const tool = (await view.getTools(resolved.connector.id, baseUrl, requestScope, signal ? { signal } : {})).find((tool) => tool.name === resolved.toolName);
                                 signal?.throwIfAborted();
                                 return Boolean(tool &&
-                                    ((classification === "read" && tool.classification === "read") || currentTrust === "trusted"));
+                                    (access === "catalog" ||
+                                        (classification === "read" && tool.classification === "read") ||
+                                        currentTrust === "trusted"));
                             }
                             finally {
                                 await closeConnectorScope(resolved.connector, view.contextFor(resolved.connector.id, baseUrl, requestScope), runtimeContext?.waitUntil?.bind(runtimeContext));

package/dist/sent-secrets.d.ts

@@ -1,30 +1,69 @@
-import type { ConnectorContext, Logger } from "./types.js";
+import type { ConnectorContext, JsonSchema, Logger } from "./types.js";
 /** One payload-free warning per configured connector, regardless of requests. */
 export declare function shortSecretWarning(): (value: string | undefined, logger: Logger) => void;
 export declare class SentSecrets {
-    private readonly values;
-    private matcher;
-    private unicode;
+    /** Normalized form to its strongest kind. */
+    private readonly forms;
     private readonly recipients;
-    private form;
-    /** The request receives existing and future credentials from every context. */
+    private privateChars;
+    /** The shortest form left unregistered; any string this long might contain it. */
+    private unmatched;
+    private unicode;
+    private views;
+    private store;
+    private unregistered;
+    private register;
+    /** The request receives existing and future secrets from every context. */
     include(source: SentSecrets): void;
     add(value: string): void;
     /** Explicit secrets use the same floor as every other credential. */
     secret(value: string): void;
+    /** Submitted writeOnly strings and numbers join this request's set, including property
+     * names inside a private object. Empty strings, booleans, and null carry no text. */
+    arguments(args: unknown, schema: JsonSchema | undefined): void;
     /** Structural fields must be refused, never repaired into different URLs. */
     contains(value: string, ignoreCase?: boolean): boolean;
     containsUrl(value: string): boolean;
     header(value: string): void;
     request(input: RequestInfo | URL, init?: RequestInit): void;
+    /** Serialized wire text about to be returned, stored, or paged, under payload rules. */
     text(value: string): string;
-    /** Skill supporting files may contain arbitrary bytes, including credential echoes. */
+    /** Copy only what changes, including non-enumerable Error fields; never retain a raw cause.
+     * Payload rules apply where downstream or guest data enters; envelopes repeat literal
+     * replacement. */
+    redact<T>(value: T, mode?: "payload" | "prose" | "envelope"): T;
+    /** Credentials alone: later calls keep the private arguments they submit, and cached
+     * catalogs never depend on one request's arguments. */
+    redactCredentials<T>(value: T): T;
+    private idle;
+    private scan;
+    private matcher;
+    private credentials;
+    /** Strings at least this long might hold a form that was never matched. */
+    private floor;
+    /** Every raw and JSON-unescaped match, mapped to source spans before any replacement. Text
+     * decodes one more layer while the last one could still hold an escape, up to
+     * MAX_DECODE_LEVELS counting the JSON strings it came from. Work beyond the call's budget
+     * or that depth returns undefined, which withholds the string. */
+    private find;
+    /** A structured leaf, property name, or prose. A short private form withholds prose
+     * wherever it occurs, and a leaf only when the whole leaf is that form. */
+    private string;
+    /** A number, boolean, or null matching by its canonical text becomes a placeholder string. */
+    private scalar;
+    /** JSON objects, arrays, and string literals are parsed and walked, nested JSON strings
+     * included; their serialized bytes must then hold no literal the walk cannot see, such as
+     * one spanning tokens. Other text is prose or a structured leaf. */
+    private wire;
+    /** Iterative and copy-on-write: only containers on a changed path are copied. A container's
+     * entries are counted against the node budget before it is walked; a cycle or a container
+     * past MAX_WALK_DEPTH is withheld, and one past the node budget is checked as serialized text. */
+    private walk;
+    /** A container larger than the node budget is scanned as serialized text, Error fields
+     * included: kept unchanged when nothing registered appears, otherwise withheld whole. */
+    private serialized;
+    /** Skill supporting files may contain arbitrary bytes, including echoes. */
     private blob;
-    /** Decode bounded windows with source spans, including twice-escaped JSON.
-     * Scratch space follows credential length, never the whole skill file. */
-    private escapedText;
-    /** Copy, including non-enumerable Error fields; never retain a raw cause. */
-    redact<T>(value: T): T;
     /** Match across blocks before isError/JSON unwrapping concatenates them. */
     private joinedContent;
 }
@@ -33,7 +72,9 @@ export declare function sentSecretsFor(ctx: ConnectorContext): SentSecrets;
 export declare function sentSecretsForRequest(scope: object, secrets?: SentSecrets): SentSecrets;
 /** The agent-facing choke point. Apply to values before bridge serialization
  * and to serialized wire text, so JSON escapes and structured strings share
- * the same rule. Intake redaction protects caches independently of this edge. */
+ * the same rule. Payloads were redacted where they entered; this boundary
+ * repeats credential and literal private-value replacement around Connecta's
+ * own envelopes, whose identifiers and counts are never private data. */
 export declare function redactAgentOutput<T>(secrets: SentSecrets, value: T): T;
 /** Wrap the complete operation table, including rejections. Adding an operation
  * cannot add an unredacted exit. A direct invocation owns a fresh scope unless