@zackbart/connecta 0.29.0 → 0.31.0

package/dist/registry.js

@@ -19,7 +19,7 @@ import { attachCaller } from "./connector-caller.js";
 import { runEdge } from "./runtime/run.js";
 import { SharedRead } from "./runtime/shared-read.js";
 import { runOnPartition, storageCompareAndSet, storageDelete, storageGet, storageSet } from "./runtime/storage.js";
-import { jsonCodec, OAUTH_HANDOFF_TTL_SECONDS, oauthHandoffKeys, resultKeys, scopes, stashLedgerKeys, } from "./storage/keys.js";
+import { jsonCodec, OAUTH_HANDOFF_TTL_SECONDS, oauthHandoffKeys, resultKeys, scopes, stashLedgerKeys, stashExpiryKeys, } from "./storage/keys.js";
 import { classifyTool } from "./tool-safety.js";
 const ID_RE = /^[a-z0-9_-]+$/;
 const DEFAULT_MAX_RESULT_BYTES = CONFIG_DEFAULTS.calls.maxResultBytes;
@@ -87,6 +87,7 @@ function frozenFacts(tools) {
 }
 function namespaced(storage, prefix) {
     return {
+        capabilities: storage.capabilities,
         get: (k) => storage.get(prefix + k),
         set: (k, v, o) => storage.set(prefix + k, v, o),
         delete: (k) => storage.delete(prefix + k),
@@ -108,19 +109,21 @@ const STASH_LEDGER_ATTEMPTS = 32;
 /** First backoff window after a lost swap; it doubles up to the cap. */
 const STASH_LEDGER_BACKOFF_MS = 4;
 const STASH_LEDGER_BACKOFF_CAP_MS = 250;
-/**
- * Slack past a stash's deadline before its charge leaves the ledger, and the
- * longest one chunk write may take. A chunk's TTL is what remains of the
- * deadline on the clock read before its write, and the store starts that TTL
- * no later than the write returns, so the chunk expires within the write's
- * duration of the deadline. A write slower than this fails the stash.
- */
-const STASH_LEDGER_GRACE_MS = 30_000;
+/** Whole chunk-write phase, measured from booking, including the header. */
+const STASH_WRITE_TIMEOUT_MS = 30_000;
+/** Total cleanup/release or settlement budget, including ledger retries. */
+const STASH_COMPLETION_TIMEOUT_MS = 15_000;
+/** Stop waiting without starting background storage work after the deadline. */
+function completeStash(effect) {
+    return effect.pipe(Effect.asVoid, Effect.timeoutOrElse({ duration: Duration.millis(STASH_COMPLETION_TIMEOUT_MS), orElse: () => Effect.void }), 
+    // onError finalizers are otherwise uninterruptible, including their I/O.
+    Effect.interruptible);
+}
 /**
  * Live charges in a stored ledger. Anything malformed reads as empty: the
  * ledger bounds an advisory cache, and the next successful swap replaces it.
  */
-function liveStashCharges(raw, now) {
+function stashCharges(raw) {
     if (raw === null)
         return [];
     let parsed;
@@ -138,16 +141,36 @@ function liveStashCharges(raw, now) {
         typeof entry[0] === "string" &&
         Number.isSafeInteger(entry[1]) &&
         entry[1] >= 0 &&
-        typeof entry[2] === "number" &&
-        entry[2] > now);
+        Number.isSafeInteger(entry[2]));
 }
-/**
- * Rewrite the stash ledger by compare-and-set. `plan` sees the live charges
- * and the time it read them at, and answers its result with the entries to
- * store, or without them when there is nothing to write. Only `plan` refuses:
- * a lost swap backs off and plans again from a fresh read. Answers undefined
- * once the attempts run out.
- */
+/** Caller time can nominate a charge for pruning, but only storage proves expiry. */
+function liveStashCharges(raw, now) {
+    return Effect.gen(function* () {
+        const live = [];
+        const expired = new Map();
+        for (const entry of stashCharges(raw)) {
+            const deadline = entry[2];
+            if (deadline > now) {
+                live.push(entry);
+                continue;
+            }
+            let proven = expired.get(deadline);
+            if (proven === undefined) {
+                // A successful absolute-expiry write followed by an absent read proves
+                // storage has passed this deadline, even when the caller runs ahead.
+                // These probes expire at the deadline they check; no cleanup is needed.
+                const key = stashExpiryKeys.deadline(deadline);
+                yield* storageSet(key, "live", { expiresAtMs: deadline });
+                proven = (yield* storageGet(key)) === null;
+                expired.set(deadline, proven);
+            }
+            if (!proven)
+                live.push(entry);
+        }
+        return live;
+    });
+}
+/** Rewrite the ledger with bounded retries; every stored charge already expires. */
 function swapStashLedger(plan) {
     return Effect.gen(function* () {
         const ledger = stashLedgerKeys.ledger;
@@ -156,16 +179,34 @@ function swapStashLedger(plan) {
                 const window = Math.min(STASH_LEDGER_BACKOFF_CAP_MS, STASH_LEDGER_BACKOFF_MS * 2 ** (attempt - 1));
                 yield* Effect.sleep(Duration.millis(Math.floor((yield* Random.next) * window) + 1));
             }
+            const outcome = yield* Effect.gen(function* () {
+                const raw = yield* storageGet(ledger);
+                const now = yield* Clock.currentTimeMillis;
+                const planned = plan(yield* liveStashCharges(raw, now), now);
+                if (planned.entries !== undefined) {
+                    const entries = planned.entries;
+                    // The ledger row itself expires with its last charge. A delayed CAS
+                    // cannot create an immortal row or restart any reservation's lifetime.
+                    const next = entries.length ? jsonCodec.encode({ v: 1, entries }) : null;
+                    const expiresAtMs = entries.reduce((latest, entry) => Math.max(latest, entry[2]), entries[0]?.[2] ?? now);
+                    if (!(yield* storageCompareAndSet(ledger, raw, next, { expiresAtMs })))
+                        return undefined;
+                }
+                return { status: "applied", result: planned.result };
+            }).pipe(Effect.catch(() => Effect.succeed(undefined)));
+            if (outcome !== undefined)
+                return outcome;
+        }
+        // The final CAS can commit and then throw too. Confirm a read-only plan
+        // once more, especially an already-booked reservation, without another CAS.
+        return yield* Effect.gen(function* () {
             const raw = yield* storageGet(ledger);
             const now = yield* Clock.currentTimeMillis;
-            const planned = plan(liveStashCharges(raw, now), now);
-            if (planned.entries === undefined)
-                return planned.result;
-            if (yield* storageCompareAndSet(ledger, raw, jsonCodec.encode({ v: 1, entries: planned.entries }))) {
-                return planned.result;
-            }
-        }
-        return undefined;
+            const planned = plan(yield* liveStashCharges(raw, now), now);
+            return planned.entries === undefined
+                ? { status: "applied", result: planned.result }
+                : { status: "exhausted" };
+        }).pipe(Effect.catch(() => Effect.succeed({ status: "exhausted" })));
     });
 }
 async function sha256Hex(value) {
@@ -551,9 +592,11 @@ export class Registry {
      * The bounds are the deployment's, not this isolate's. Every charge is a
      * row in one ledger record in storage, booked by compare-and-set before any
      * chunk is written, so every isolate and process sharing the store sees the
-     * same entries and bytes. A charge leaves the ledger just after its
-     * result's deadline, which every chunk's TTL ends by; the storage TTL
-     * reclaims the rows themselves.
+     * same entries and bytes. A pending write keeps its finite charge reserved.
+     * Writes stop after 30 seconds; absolute chunk expiries cannot pass the
+     * booked deadline even on late commit. Rejected responses leave writes
+     * unconfirmed and retain their charge. Cleanup/release and settlement each
+     * stop waiting after 15 seconds. Storage TTL reclaims the rows.
      */
     stashResult(id, chunks, ttlSeconds, partition = scopes.results) {
         return runOnPartition(Effect.gen({ self: this }, function* () {
@@ -564,48 +607,78 @@ export class Registry {
             if (bytes > maxBytes || maxEntries === 0)
                 return false;
             const keys = chunks.map((_, index) => partition + resultKeys.chunk(id, index));
-            const charge = keys[0];
-            // One deadline for the charge and every chunk under it. Writes take
-            // time, so a chunk's TTL is whatever remains of the deadline when it is
-            // written, never a fresh `ttlSeconds`, and no single write may take
-            // longer than the grace: no chunk outlives the charge that bounds it.
-            const deadline = yield* swapStashLedger((live, now) => {
+            // IDs belong to reservations, not reusable result IDs or subjects.
+            const charge = crypto.randomUUID();
+            const ttlMs = ttlSeconds * 1000;
+            if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0)
+                return false;
+            const booking = yield* swapStashLedger((live, now) => {
+                // A committed CAS with a lost response is already our booking, even
+                // at full capacity. Reuse its deadline instead of adding a second slot.
+                const own = live.find((entry) => entry[0] === charge);
+                if (own)
+                    return { result: own[2] };
                 const used = live.reduce((sum, entry) => sum + entry[1], 0);
                 if (live.length >= maxEntries || used + bytes > maxBytes)
                     return { result: undefined };
-                const end = now + ttlSeconds * 1000;
-                return { entries: [...live, [charge, bytes, end + STASH_LEDGER_GRACE_MS]], result: end };
+                const deadline = now + STASH_WRITE_TIMEOUT_MS + ttlMs;
+                if (!Number.isSafeInteger(deadline))
+                    return { result: undefined };
+                return { entries: [...live, [charge, bytes, deadline]], result: deadline };
             });
-            if (deadline === undefined)
+            if (booking.status === "exhausted" || booking.result === undefined)
                 return false;
-            // A failed write may still have persisted. Delete every key it could
-            // have written and release the charge only when all of them are gone;
-            // otherwise the charge stays booked until it expires, by which time the
-            // storage TTL has removed whatever did land.
-            const release = Effect.gen(function* () {
-                for (const key of keys)
-                    yield* storageDelete(key);
-                yield* swapStashLedger((live) => live.some((entry) => entry[0] === charge)
-                    ? { entries: live.filter((entry) => entry[0] !== charge), result: undefined }
-                    : { result: undefined });
-            }).pipe(Effect.ignore);
-            // Trailing chunks first: the header chunk is what makes an id readable, so
-            // a write that fails midway leaves no envelope pointing at absent chunks.
+            const deadline = booking.result;
+            const writeDeadline = deadline - ttlMs;
+            const chunkExpiry = deadline - STASH_WRITE_TIMEOUT_MS;
+            const owns = (entry) => entry[0] === charge;
+            const settle = swapStashLedger((live) => live.some((entry) => owns(entry) && entry[2] > chunkExpiry)
+                ? {
+                    entries: live.map((entry) => (owns(entry) ? [charge, bytes, Math.min(entry[2], chunkExpiry)] : entry)),
+                    result: undefined,
+                }
+                : { result: undefined });
+            let pendingWrite = false;
+            // A rejected or timed-out driver call may still commit after deletion.
+            // Only a confirmed write response clears pendingWrite.
+            const release = completeStash(Effect.gen(function* () {
+                const deleted = yield* Effect.gen(function* () {
+                    for (const key of keys)
+                        yield* storageDelete(key);
+                    return true;
+                }).pipe(Effect.catch(() => Effect.succeed(false)));
+                if (pendingWrite)
+                    return;
+                if (deleted) {
+                    const released = yield* swapStashLedger((live) => live.some(owns)
+                        ? { entries: live.filter((entry) => !owns(entry)), result: undefined }
+                        : { result: undefined });
+                    if (released.status === "applied")
+                        return;
+                }
+                yield* settle;
+            }));
+            // Trailing chunks first, then the header. The caller receives no result
+            // ID after failure or timeout, including a late header commit.
+            const remaining = Math.max(0, writeDeadline - (yield* Clock.currentTimeMillis));
             const written = yield* Effect.gen(function* () {
                 for (let index = keys.length - 1; index >= 0; index--) {
                     const before = yield* Clock.currentTimeMillis;
-                    const remaining = Math.floor((deadline - before) / 1000);
-                    // Zero would mean no expiry: a stash that outlasts its deadline fails.
-                    if (remaining < 1)
+                    if (before >= writeDeadline || before >= chunkExpiry)
                         return false;
-                    yield* storageSet(keys[index], chunks[index], { ttlSeconds: remaining });
-                    if ((yield* Clock.currentTimeMillis) - before > STASH_LEDGER_GRACE_MS)
+                    pendingWrite = true;
+                    yield* storageSet(keys[index], chunks[index], { expiresAtMs: chunkExpiry }).pipe(Effect.tap(() => Effect.sync(() => {
+                        pendingWrite = false;
+                    })));
+                    if ((yield* Clock.currentTimeMillis) >= writeDeadline)
                         return false;
                 }
                 return true;
-            }).pipe(Effect.onError(() => release));
+            }).pipe(Effect.timeoutOrElse({ duration: Duration.millis(remaining), orElse: () => Effect.succeed(false) }), Effect.onError(() => release.pipe(Effect.ignore)));
             if (!written)
                 yield* release;
+            else
+                yield* completeStash(settle);
             return written;
         }), this.opts);
     }
@@ -616,7 +689,7 @@ export class Registry {
     resultIdentity() {
         return { subject: null, principal: null, endpoint: "/mcp", origin: null };
     }
-    recheckResultAccess(_address, _classification, _signal) {
+    recheckResultAccess(_address, _classification, _signal, _access) {
         return Promise.resolve(true);
     }
     resultsStorage() {
@@ -996,8 +1069,8 @@ class ScopedRegistryView {
             origin: this.scope.origin ?? null,
         };
     }
-    recheckResultAccess(address, classification, signal) {
-        return this.scope.currentResultAccess?.(address, classification, signal) ?? Promise.resolve(true);
+    recheckResultAccess(address, classification, signal, access) {
+        return this.scope.currentResultAccess?.(address, classification, signal, access) ?? Promise.resolve(true);
     }
     resultsStorage() {
         return this.scope.subjectKey ? this.root.scopedStorage(this.scope.subjectKey) : this.root.resultsStorage();

package/dist/resource-read.js

@@ -39,6 +39,7 @@ export function readResource(registry, raw, options) {
     return withDeadlineEffect((signal) => Effect.scoped(Effect.gen(function* () {
         const target = yield* Effect.try({ try: () => resourceTarget(registry, raw), catch: (error) => error });
         connector = target.connector;
+        options.onResolved?.(target.connector);
         // Await this Promise in the reader's request context, as invocation.ts does.
         yield* Effect.acquireRelease(Effect.suspend(() => {
             const pending = registry.admitCall(target.connector.id, {
@@ -50,7 +51,8 @@ export function readResource(registry, raw, options) {
                 pending.then((permit) => permit.release(), () => { });
             })));
         }), (permit) => Effect.sync(() => permit.release()), { interruptible: true });
-        return yield* timed((elapsed) => options.onConnectorTime?.(elapsed), Effect.tryPromise({
+        // Downstream contents enter the guest here, so they take the full payload rules.
+        const contents = yield* timed((elapsed) => options.onConnectorTime?.(elapsed), Effect.tryPromise({
             try: () => {
                 if (signal.aborted)
                     throw signal.reason;
@@ -66,6 +68,7 @@ export function readResource(registry, raw, options) {
             },
             catch: (error) => error,
         }));
+        return options.sentSecrets.redact(contents);
     })), {
         timeoutMs: options.timeoutMs,
         ...(options.signal ? { signal: options.signal } : {}),

package/dist/routes/mcp.js

@@ -675,7 +675,7 @@ export function createMcpRoute(opts) {
                         ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
                         endpoint: new URL(request.url).pathname,
                         origin: request.headers.get("Origin"),
-                        currentResultAccess: async (address, classification, signal) => {
+                        currentResultAccess: async (address, classification, signal, access) => {
                             signal?.throwIfAborted();
                             const current = await authorize(localRequest, baseUrl, opts.config.auth, runtimeContext, opts.config.identity);
                             if (!current.ok) {
@@ -699,6 +699,13 @@ export function createMcpRoute(opts) {
                                 ...(current.subjectKey ? { subjectKey: current.subjectKey } : {}),
                                 ...(current.principalKey ? { principalKey: current.principalKey } : {}),
                             });
+                            if (classification === "write" && currentTrust !== "trusted")
+                                return false;
+                            if (address === undefined)
+                                return true;
+                            // Skill and resource content requires a whole grant; catalog metadata requires visibility.
+                            if (!address.includes("."))
+                                return Boolean(access === "catalog" ? view.getConnector(address) : view.getResourceConnector(address));
                             const resolved = view.resolveAddress(address);
                             if (!resolved)
                                 return false;
@@ -707,7 +714,9 @@ export function createMcpRoute(opts) {
                                 const tool = (await view.getTools(resolved.connector.id, baseUrl, requestScope, signal ? { signal } : {})).find((tool) => tool.name === resolved.toolName);
                                 signal?.throwIfAborted();
                                 return Boolean(tool &&
-                                    ((classification === "read" && tool.classification === "read") || currentTrust === "trusted"));
+                                    (access === "catalog" ||
+                                        (classification === "read" && tool.classification === "read") ||
+                                        currentTrust === "trusted"));
                             }
                             finally {
                                 await closeConnectorScope(resolved.connector, view.contextFor(resolved.connector.id, baseUrl, requestScope), runtimeContext?.waitUntil?.bind(runtimeContext));

package/dist/sent-secrets.d.ts

@@ -1,30 +1,69 @@
-import type { ConnectorContext, Logger } from "./types.js";
+import type { ConnectorContext, JsonSchema, Logger } from "./types.js";
 /** One payload-free warning per configured connector, regardless of requests. */
 export declare function shortSecretWarning(): (value: string | undefined, logger: Logger) => void;
 export declare class SentSecrets {
-    private readonly values;
-    private matcher;
-    private unicode;
+    /** Normalized form to its strongest kind. */
+    private readonly forms;
     private readonly recipients;
-    private form;
-    /** The request receives existing and future credentials from every context. */
+    private privateChars;
+    /** The shortest form left unregistered; any string this long might contain it. */
+    private unmatched;
+    private unicode;
+    private views;
+    private store;
+    private unregistered;
+    private register;
+    /** The request receives existing and future secrets from every context. */
     include(source: SentSecrets): void;
     add(value: string): void;
     /** Explicit secrets use the same floor as every other credential. */
     secret(value: string): void;
+    /** Submitted writeOnly strings and numbers join this request's set, including property
+     * names inside a private object. Empty strings, booleans, and null carry no text. */
+    arguments(args: unknown, schema: JsonSchema | undefined): void;
     /** Structural fields must be refused, never repaired into different URLs. */
     contains(value: string, ignoreCase?: boolean): boolean;
     containsUrl(value: string): boolean;
     header(value: string): void;
     request(input: RequestInfo | URL, init?: RequestInit): void;
+    /** Serialized wire text about to be returned, stored, or paged, under payload rules. */
     text(value: string): string;
-    /** Skill supporting files may contain arbitrary bytes, including credential echoes. */
+    /** Copy only what changes, including non-enumerable Error fields; never retain a raw cause.
+     * Payload rules apply where downstream or guest data enters; envelopes repeat literal
+     * replacement. */
+    redact<T>(value: T, mode?: "payload" | "prose" | "envelope"): T;
+    /** Credentials alone: later calls keep the private arguments they submit, and cached
+     * catalogs never depend on one request's arguments. */
+    redactCredentials<T>(value: T): T;
+    private idle;
+    private scan;
+    private matcher;
+    private credentials;
+    /** Strings at least this long might hold a form that was never matched. */
+    private floor;
+    /** Every raw and JSON-unescaped match, mapped to source spans before any replacement. Text
+     * decodes one more layer while the last one could still hold an escape, up to
+     * MAX_DECODE_LEVELS counting the JSON strings it came from. Work beyond the call's budget
+     * or that depth returns undefined, which withholds the string. */
+    private find;
+    /** A structured leaf, property name, or prose. A short private form withholds prose
+     * wherever it occurs, and a leaf only when the whole leaf is that form. */
+    private string;
+    /** A number, boolean, or null matching by its canonical text becomes a placeholder string. */
+    private scalar;
+    /** JSON objects, arrays, and string literals are parsed and walked, nested JSON strings
+     * included; their serialized bytes must then hold no literal the walk cannot see, such as
+     * one spanning tokens. Other text is prose or a structured leaf. */
+    private wire;
+    /** Iterative and copy-on-write: only containers on a changed path are copied. A container's
+     * entries are counted against the node budget before it is walked; a cycle or a container
+     * past MAX_WALK_DEPTH is withheld, and one past the node budget is checked as serialized text. */
+    private walk;
+    /** A container larger than the node budget is scanned as serialized text, Error fields
+     * included: kept unchanged when nothing registered appears, otherwise withheld whole. */
+    private serialized;
+    /** Skill supporting files may contain arbitrary bytes, including echoes. */
     private blob;
-    /** Decode bounded windows with source spans, including twice-escaped JSON.
-     * Scratch space follows credential length, never the whole skill file. */
-    private escapedText;
-    /** Copy, including non-enumerable Error fields; never retain a raw cause. */
-    redact<T>(value: T): T;
     /** Match across blocks before isError/JSON unwrapping concatenates them. */
     private joinedContent;
 }
@@ -33,7 +72,9 @@ export declare function sentSecretsFor(ctx: ConnectorContext): SentSecrets;
 export declare function sentSecretsForRequest(scope: object, secrets?: SentSecrets): SentSecrets;
 /** The agent-facing choke point. Apply to values before bridge serialization
  * and to serialized wire text, so JSON escapes and structured strings share
- * the same rule. Intake redaction protects caches independently of this edge. */
+ * the same rule. Payloads were redacted where they entered; this boundary
+ * repeats credential and literal private-value replacement around Connecta's
+ * own envelopes, whose identifiers and counts are never private data. */
 export declare function redactAgentOutput<T>(secrets: SentSecrets, value: T): T;
 /** Wrap the complete operation table, including rejections. Adding an operation
  * cannot add an unredacted exit. A direct invocation owns a fresh scope unless