@zackbart/connecta 0.29.0 → 0.31.0

package/dist/executor-result.js

@@ -18,12 +18,12 @@ const TRUNCATION_HINT = "filter/map/slice data inside execute_code and return on
  * of what the program returned, and truncation happens exactly once no matter
  * how many hops the value takes.
  */
-function truncationEnvelope(text, maxChars, totalChars = text.length) {
+function truncationEnvelope(text, maxChars, totalChars = text.length, hint = TRUNCATION_HINT) {
     const base = {
         truncated: true,
         preview: "",
         totalChars,
-        hint: TRUNCATION_HINT,
+        hint,
     };
     let budget = Math.max(0, maxChars - JSON.stringify(base).length);
     for (let attempt = 0; attempt < 8 && budget > 0; attempt += 1) {
@@ -37,11 +37,12 @@ function truncationEnvelope(text, maxChars, totalChars = text.length) {
     }
     return { ...base, preview: text.slice(0, budget) };
 }
-export function guardExecuteResultValue(value, maxChars = MAX_EXECUTE_RESULT_CHARS) {
+export function guardExecuteResultValue(value, maxChars = MAX_EXECUTE_RESULT_CHARS, hintPrefix) {
+    const hint = hintPrefix ? `${hintPrefix} ${TRUNCATION_HINT}` : TRUNCATION_HINT;
     const text = serializeResultText(value);
     if (text.length <= maxChars)
         return value;
-    // A child may already have guarded this value at a larger transport cap.
+    // A custom executor may already have guarded this value at a larger cap.
     // Shrink its preview once more without nesting notices or losing original size.
     if (value !== null && typeof value === "object") {
         const prior = value;
@@ -52,10 +53,10 @@ export function guardExecuteResultValue(value, maxChars = MAX_EXECUTE_RESULT_CHA
             Number.isSafeInteger(prior.totalChars) &&
             prior.totalChars >= prior.preview.length &&
             Object.keys(value).length === 4) {
-            return truncationEnvelope(prior.preview, maxChars, prior.totalChars);
+            return truncationEnvelope(prior.preview, maxChars, prior.totalChars, hint);
         }
     }
-    return truncationEnvelope(text, maxChars);
+    return truncationEnvelope(text, maxChars, text.length, hint);
 }
 export function truncateExecuteText(text, max) {
     if (text.length <= max)
@@ -63,8 +64,8 @@ export function truncateExecuteText(text, max) {
     return `${text.slice(0, max)}\n--- TRUNCATED (${text.length} chars total) — filter/map/slice data inside your code and return only what you need ---`;
 }
 /**
- * Apply the public execute_code result/log policy before a child result enters
- * IPC. The parent repeats the guard for third-party Executor implementations.
+ * Validate serialization before IPC without discarding the program return.
+ * The host applies the presentation cap after it can stash the full value.
  */
 export function prepareExecuteResultForTransport(outcome) {
     // QuickJS already bounds captured logs at source (entries + cumulative
@@ -82,8 +83,9 @@ export function prepareExecuteResultForTransport(outcome) {
         };
     }
     try {
+        serializeResultText(outcome.result);
         return {
-            result: guardExecuteResultValue(outcome.result),
+            result: outcome.result,
             ...(logs ? { logs } : {}),
         };
     }

package/dist/executors/quickjs-child.js

@@ -1,7 +1,7 @@
 import { prepareExecuteResultForTransport } from "../executor-result.js";
 import { InvocationFailure } from "../invocation.js";
 import { msg } from "../errors.js";
-import { MAX_QUICKJS_IPC_BYTES, MAX_QUICKJS_HOST_RPC_BYTES, serializedBytes, stringifyBounded, } from "./quickjs-protocol.js";
+import { MAX_QUICKJS_IPC_BYTES, MAX_QUICKJS_RESULT_BYTES, QUICKJS_RESULT_CHUNK_CHARS, MAX_QUICKJS_HOST_RPC_BYTES, serializedBytes, stringifyBounded, } from "./quickjs-protocol.js";
 import { executeQuickJs, prepareQuickJs } from "./quickjs-runtime.js";
 let activeJobId;
 let nextCallId = 1;
@@ -51,6 +51,13 @@ function fixedTransportFailure(message) {
         },
     };
 }
+function sendResult(jobId, payloadJson) {
+    for (let offset = 0; offset + QUICKJS_RESULT_CHUNK_CHARS < payloadJson.length; offset += QUICKJS_RESULT_CHUNK_CHARS) {
+        send({ type: "result-chunk", jobId, payloadJson: payloadJson.slice(offset, offset + QUICKJS_RESULT_CHUNK_CHARS) });
+    }
+    const tail = Math.floor((payloadJson.length - 1) / QUICKJS_RESULT_CHUNK_CHARS) * QUICKJS_RESULT_CHUNK_CHARS;
+    send({ type: "result", jobId, payloadJson: payloadJson.slice(tail) });
+}
 async function run(payload) {
     if (activeJobId !== undefined) {
         throw new Error("QuickJS child received overlapping executions.");
@@ -69,12 +76,12 @@ async function run(payload) {
         };
         let payloadJson;
         try {
-            payloadJson = stringifyBounded(prepared, "QuickJS execution result");
+            payloadJson = stringifyBounded(prepared, "QuickJS execution result", MAX_QUICKJS_RESULT_BYTES);
         }
         catch (err) {
-            payloadJson = JSON.stringify(fixedTransportFailure(`QuickJS execution result exceeded the ${MAX_QUICKJS_IPC_BYTES}-byte IPC limit: ${msg(err)}`));
+            payloadJson = JSON.stringify(fixedTransportFailure(`QuickJS execution result exceeded the ${MAX_QUICKJS_RESULT_BYTES}-byte aggregate transport limit: ${msg(err)}`));
         }
-        send({ type: "result", jobId: payload.id, payloadJson });
+        sendResult(payload.id, payloadJson);
     }
     finally {
         activeJobId = undefined;
@@ -118,7 +125,7 @@ process.on("message", (message) => {
     const payload = JSON.parse(message.payloadJson);
     void run(payload).catch((err) => {
         const payloadJson = JSON.stringify(fixedTransportFailure(`QuickJS child failed: ${msg(err)}`));
-        send({ type: "result", jobId: payload.id, payloadJson });
+        sendResult(payload.id, payloadJson);
         activeJobId = undefined;
     });
 });

package/dist/executors/quickjs-protocol.js

@@ -1,10 +1,9 @@
-// An execution result is serialized once into payloadJson and again as that
-// string is embedded in ChildToParentMessage. Captured logs therefore get a
-// separate 512 KiB budget measured after both JSON encodings. The final result
-// is shaped to 24k characters; even if every character takes its worst-case
-// seven transport bytes, that leaves ample structural overhead below this hard
-// process.send ceiling.
+// Result messages remain bounded even when a full return travels in chunks.
+// The host's presentation guard stashes the completed value after assembly.
 export const MAX_QUICKJS_IPC_BYTES = 1024 * 1024;
+/** Aggregate result transport bound, independent of per-message IPC and log caps. */
+export const MAX_QUICKJS_RESULT_BYTES = 64 * 1024 * 1024;
+export const QUICKJS_RESULT_CHUNK_CHARS = 65_536;
 export const MAX_QUICKJS_LOG_TRANSPORT_BYTES = 512 * 1024;
 /** Preserve #84's stopgap before a host value enters the child/WASM process. */
 export const MAX_QUICKJS_HOST_RPC_BYTES = 256 * 1024;

package/dist/executors/quickjs-runtime.js

@@ -253,7 +253,12 @@ function installBridge(ctx, providers, logs, onLog) {
                         // The error identity and typed facts stay in host state. A guest
                         // may edit public fields without changing the retained failure.
                         bridge.failures.push({ error: error.dup(), call });
-                        for (const [key, value] of Object.entries({ code: call.code, retryable: call.retryable, details: call })) {
+                        for (const [key, value] of Object.entries({
+                            code: call.code,
+                            retryable: call.retryable,
+                            details: call,
+                            data: call,
+                        })) {
                             const property = ctx.unwrapResult(ctx.evalCode(`(${JSON.stringify(value)})`));
                             ctx.setProp(error, key, property);
                             property.dispose();

package/dist/executors/quickjs.js

@@ -21,7 +21,7 @@ import { InvocationFailure } from "../invocation.js";
 import { brandExecutor } from "../executor-contract.js";
 import { MAX_EXECUTE_LOG_CHARS } from "../executor-result.js";
 import { detach, fromSignal, runEdge } from "../runtime/run.js";
-import { hostCallLabel, MAX_QUICKJS_IPC_BYTES, MAX_QUICKJS_HOST_RPC_BYTES, serializedBytes, stringifyBounded, } from "./quickjs-protocol.js";
+import { hostCallLabel, MAX_QUICKJS_IPC_BYTES, MAX_QUICKJS_RESULT_BYTES, QUICKJS_RESULT_CHUNK_CHARS, MAX_QUICKJS_HOST_RPC_BYTES, serializedBytes, stringifyBounded, } from "./quickjs-protocol.js";
 export { normalizeCode } from "./quickjs-runtime.js";
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_CPU_TIME_MS = 250;
@@ -244,6 +244,8 @@ class QuickJsChildPool {
                 id,
                 logs: [],
                 logChars: 0,
+                resultChunks: [],
+                resultBytes: 0,
                 providers: providerMap,
                 outcome: Deferred.makeUnsafe(),
             };
@@ -456,15 +458,29 @@ class QuickJsChildPool {
             await this.handleHostCall(slot, child.process, active, message);
             return;
         }
-        if (message.type !== "result" || message.jobId !== active.id)
+        if ((message.type !== "result" && message.type !== "result-chunk") || message.jobId !== active.id)
             return;
-        if (serializedBytes(message.payloadJson) > MAX_QUICKJS_IPC_BYTES) {
+        if (message.payloadJson.length > QUICKJS_RESULT_CHUNK_CHARS ||
+            (message.type === "result-chunk" && message.payloadJson.length !== QUICKJS_RESULT_CHUNK_CHARS) ||
+            message.payloadJson.length === 0) {
+            this.rejectActive(slot, new Error("QuickJS execution result exceeded the IPC limit."));
+            this.recycle(slot);
+            return;
+        }
+        const bytes = serializedBytes(message.payloadJson);
+        if (active.resultBytes + bytes > MAX_QUICKJS_RESULT_BYTES) {
             this.rejectActive(slot, new Error("QuickJS execution result exceeded the IPC limit."));
             this.recycle(slot);
             return;
         }
         try {
-            const payload = JSON.parse(message.payloadJson);
+            stringifyBounded(message, "QuickJS result IPC envelope");
+            active.resultBytes += bytes;
+            active.resultChunks.push(message.payloadJson);
+            if (message.type === "result-chunk")
+                return;
+            const payload = JSON.parse(active.resultChunks.join(""));
+            active.resultChunks.length = 0;
             // A result ends any crash streak: the next crash backs off from 100 ms.
             slot.crashes.length = 0;
             slot.backoff = undefined;

package/dist/guest-runtime.js

@@ -80,10 +80,57 @@ export function guestInitializer() {
   const promiseCatch = Function.prototype.call.bind(NativePromise.prototype.catch);
   const promiseFinally = Function.prototype.call.bind(NativePromise.prototype.finally);
   const push = Function.prototype.call.bind(Array.prototype.push);
+  const apply = Function.prototype.call.bind(Function.prototype.apply);
   const NativeError = Error;
+  const NativeWeakMap = WeakMap;
+  const isArray = Array.isArray;
+  const weakGet = Function.prototype.call.bind(WeakMap.prototype.get);
+  const weakSet = Function.prototype.call.bind(WeakMap.prototype.set);
   return freeze((provider) => {
   const pending = [];
   const emit = provider.emit;
+  const hostCall = provider.call;
+  const hostResult = provider.result;
+  const nativeRefs = new NativeWeakMap();
+  async function inline(value) {
+    if (!value || typeof value.transfer !== "string" || !value.handle) return value;
+    // A completed downstream call stays successful if transfer storage fails.
+    // Preserve its handle so the caller can page later, without repeating a write.
+    try {
+      let text = "", page;
+      do {
+        page = await hostResult(value.transfer);
+        text += page.text;
+      } while (page.hasMore);
+      return { data: value.handle.valueFormat === "json" ? JSON.parse(text) : text,
+        format: value.handle.valueFormat };
+    } catch { return value.handle; }
+  }
+  async function call() {
+    const reply = await apply(hostCall, undefined, arguments);
+    if (!reply || !reply.native) return inline(reply);
+    const native = await inline(reply.native.value);
+    if (native.format === "paged" && !reply.value) return native;
+    const value = reply.value ? await inline(reply.value) : {
+      data: reply.native.dataKey ? native.data[reply.native.dataKey] : native.data, format: "json"
+    };
+    if (value.format === "paged") return value;
+    if (native.format === "paged") {
+      value.contentResult = native;
+      return value;
+    }
+    if (native.format === "json" && native.data && isArray(native.data.content)) {
+      const content = native.data.content;
+      // Only host-issued refs cross back. Binary data never needs a second
+      // guest-to-host transfer, and guest edits cannot mint native pointers.
+      for (let i = 0; i < content.length; i++) {
+        weakSet(nativeRefs, content[i], { ref: reply.native.ref, index: i });
+      }
+      value.content = content;
+      weakSet(nativeRefs, value, { ref: reply.native.ref });
+    }
+    return value;
+  }
   function trackEmission(task) {
     const entry = { handled: false, settled: promiseThen(task,
       () => ({ ok: true }), error => ({ ok: false, error })) };
@@ -109,11 +156,14 @@ export function guestInitializer() {
     __proto__: null,
     search: provider.search,
     describe: provider.describe,
-    call: provider.call,
+    call,
     read: provider.read,
     result: provider.result,
     skill: provider.skill,
-    emit(block) { return trackEmission(emit(block)); }
+    emit(block) {
+      const ref = block && typeof block === "object" ? weakGet(nativeRefs, block) : undefined;
+      return trackEmission(emit(ref || block));
+    }
   });
   globalThis.connecta = namespace;
   defineProperties(globalThis, {

package/dist/guest-types.d.ts

@@ -15,7 +15,8 @@ export interface GuestApi {
         timeoutMs?: number;
     }): Promise<GuestResult>;
     read(uri: string): Promise<GuestResourceResult>;
-    result(id: string, options?: {
+    result(id: string | GuestResultHandle, options?: {
+        page?: number;
         offset?: number;
         maxBytes?: number;
     }): Promise<GuestResultPage>;
@@ -24,7 +25,7 @@ export interface GuestApi {
         text: string;
         format: "text";
     }>;
-    emit(block: GuestBlock): PromiseLike<void>;
+    emit(block: GuestNativeBlock | GuestResult): PromiseLike<void>;
 }
 export interface GuestResourceResult {
     contents: Array<{
@@ -36,12 +37,52 @@ export interface GuestResourceResult {
         blob: string;
     })>;
 }
-export type GuestResult = {
+export interface GuestResultHandle {
+    format: "paged";
+    valueFormat: "json" | "text";
+    resultId?: string;
+    totalBytes: number;
+    truncated: true;
+    hint: string;
+}
+/** Inline MCP rich results expose original blocks; emit(result) forwards all of them. */
+export type GuestResult = ({
     data: unknown;
     format: "json";
 } | {
     data: string;
     format: "text";
+} | GuestResultHandle) & {
+    content?: GuestNativeBlock[];
+    /** Paging handle when native content exceeds the inline cap or transfer fails. */
+    contentResult?: GuestResultHandle;
+};
+/** Native call blocks can be forwarded unchanged, including annotations and metadata. */
+export type GuestNativeBlock = (GuestBlock | {
+    type: "resource";
+    resource: {
+        uri: string;
+        mimeType?: string;
+    } & ({
+        text: string;
+    } | {
+        blob: string;
+    });
+} | {
+    type: "resource_link";
+    uri: string;
+    name: string;
+    title?: string;
+    description?: string;
+    mimeType?: string;
+    size?: number;
+}) & {
+    annotations?: {
+        audience?: Array<"user" | "assistant">;
+        priority?: number;
+        lastModified?: string;
+    };
+    _meta?: Record<string, unknown>;
 };
 export interface GuestResultPage {
     resultId: string;
@@ -79,7 +120,9 @@ export interface CatalogDescribeArgs {
     fullDescriptions?: boolean;
 }
 type GuideRequiredReason = "connector_required" | "approval_required" | "schema_truncated";
-interface CatalogFailureDetail {
+interface CatalogFailureDetail extends Partial<import("./errors.js").AuthorizationHandoff> {
+    nextAction?: CallErrorDetails["nextAction"];
+    retry?: string;
     code: string;
     message: string;
     retryable: boolean;
@@ -92,7 +135,6 @@ interface CatalogDescriptionFailureDetail extends CatalogFailureDetail {
 }
 interface CatalogSearchFailure extends CatalogFailureDetail {
     connector: string;
-    recovery?: CallErrorDetails["recovery"];
     nextAction?: Extract<NonNullable<CallErrorDetails["nextAction"]>, {
         tool: "authorize_connector";
     }>;

package/dist/index.d.ts

@@ -35,7 +35,7 @@ export { validateToolInput } from "./validate.js";
 export type { ValidateToolInputOptions } from "./validate.js";
 export { memoryStorage } from "./storage/memory.js";
 export { CONNECTA_VERSION } from "./version.js";
-export type { GuestApi, GuestResourceResult, GuestResult, GuestResultPage, GuestBlock } from "./guest-types.js";
+export type { GuestApi, GuestResourceResult, GuestResult, GuestResultPage, GuestBlock, GuestNativeBlock, } from "./guest-types.js";
 export type { Registry } from "./registry.js";
 export type { RemoteMcpOptions, RemoteMcpAuth, RemoteMcpRedirectPolicy } from "./connectors/remote-mcp.js";
 export type { ApiHandlerContext, ApiOAuthAccess, ApiOAuthClientAuthentication, ApiOAuthConfig, ApiOptions, ApiTool, } from "./connectors/api.js";

package/dist/invocation.js

@@ -1,3 +1,4 @@
+import { withAuthorizationHandoff } from "./authorization-handoff.js";
 import { hasControlCharacters } from "./tool-name.js";
 import { surfaceAllowsTool } from "./tool-safety.js";
 import { Cause, Effect, Exit } from "effect";
@@ -9,8 +10,10 @@ import { splitAddress } from "./registry.js";
 import { runEdge, withDeadlineEffect } from "./runtime/run.js";
 import { validateCatalogToolInput } from "./validate.js";
 import { sentSecretsFor, sentSecretsForRequest, trackCredentialReads } from "./sent-secrets.js";
+import { recoveryFor } from "./call-recovery.js";
+import { classifyWriteOutcome } from "./write-outcome.js";
 import { classificationDigest, recordAuthFailure, recordCallEntry, replayClassificationDigest, resolveInvocationAuth, } from "./invocation-auth.js";
-import { downstreamContinuation, isDownstreamInputResult, assertDownstreamOutputSafe, } from "./downstream-input-context.js";
+import { downstreamContinuation, recordDownstreamArgumentEcho, isDownstreamInputResult, assertDownstreamOutputSafe, } from "./downstream-input-context.js";
 function defined(values) {
     return Object.fromEntries(Object.entries(values).filter(([, value]) => value !== undefined));
 }
@@ -111,6 +114,7 @@ export class InvocationFailure extends Error {
     recovery;
     nextAction;
     retry;
+    data;
     constructor(details) {
         super(details.message);
         this.details = details;
@@ -123,6 +127,7 @@ export class InvocationFailure extends Error {
         this.recovery = details.recovery;
         this.nextAction = details.nextAction;
         this.retry = details.retry;
+        this.data = details;
     }
 }
 /**
@@ -155,7 +160,7 @@ export class InvocationService {
     pipeline(address, args, context) {
         return Effect.gen({ self: this }, function* () {
             const started = Date.now();
-            const argumentEcho = echoedCallArgs(args ?? {});
+            let argumentEcho = {};
             let catalogMs = 0;
             let admissionMs = 0;
             let connectorMs = 0;
@@ -163,6 +168,9 @@ export class InvocationService {
             let attempts = 0;
             let resultBytes;
             let dispatchedToConnector = false;
+            // The context a dispatched call ran with, read for recovery facts the
+            // connector recorded before an interrupting deadline (call-recovery.ts).
+            let dispatchContext;
             let preInvocationAuthFailure = false;
             let answered = false;
             const sentSecrets = sentSecretsForRequest(this.catalog.requestScope);
@@ -214,6 +222,10 @@ export class InvocationService {
             const enrich = (error, target) => {
                 if (!target)
                     return error;
+                const recovery = recoveryFor(dispatchContext);
+                const recoveryRetry = recovery?.["idempotencyKey"]
+                    ? " A deliberate retry with uncertainCall.recovery.idempotencyKey and the exact original arguments cannot repeat the write while the vendor retains that key (Stripe keeps v1 keys at least 24 hours); after that, look the object up before retrying."
+                    : "";
                 if (isTimeoutFailure(error) && dispatchedToConnector && resolved?.definition.classification === "write") {
                     const echoed = argumentEcho;
                     return {
@@ -227,9 +239,35 @@ export class InvocationService {
                             address: `${target.connector.id}.${target.toolName}`,
                             ...echoed,
                             ...("args" in echoed ? {} : { argsOmitted: true }),
+                            ...(recovery ? { recovery } : {}),
                         },
                         retry: "Do not retry automatically. Check whether the write took effect first." +
-                            ("args" in echoed ? "" : " The arguments exceed the echo budget; use the exact arguments you sent."),
+                            recoveryRetry +
+                            (echoed.argsRedacted
+                                ? " Sensitive fields are omitted; use the original arguments if reconciliation requires another call."
+                                : "args" in echoed
+                                    ? ""
+                                    : " The arguments could not be echoed safely; use the exact arguments you sent."),
+                    };
+                }
+                // Any other dispatched write whose outcome is unknown (a lost response
+                // body, a 5xx, an unreadable reply) keeps the facts its connector
+                // recorded before dispatch, here and through program write accounting.
+                if (recovery &&
+                    !error.uncertainCall &&
+                    dispatchedToConnector &&
+                    resolved?.definition.classification === "write" &&
+                    classifyWriteOutcome({ ok: false, dispatched: true, answered, error }) === "unknown") {
+                    const echoed = argumentEcho;
+                    error = {
+                        ...error,
+                        uncertainCall: {
+                            address: `${target.connector.id}.${target.toolName}`,
+                            ...echoed,
+                            ...("args" in echoed ? {} : { argsOmitted: true }),
+                            recovery,
+                        },
+                        retry: error.retry ?? `Do not retry automatically. Check whether the write took effect first.${recoveryRetry}`,
                     };
                 }
                 if (error.code === "auth_required" && target.connector.startAuth) {
@@ -244,12 +282,17 @@ export class InvocationService {
                             ...error,
                             nextAction: {
                                 tool: resolved?.definition.classification === "read" ? "call_tool" : "call_destructive_tool",
-                                arguments: { address: `${target.connector.id}.${target.toolName}`, ...echoedCallArgs(args) },
-                                purpose: "Use this direct call so the host can fulfill the downstream input request.",
+                                arguments: { address: `${target.connector.id}.${target.toolName}`, ...argumentEcho },
+                                purpose: "Use this direct call so the host can fulfill the downstream input request." +
+                                    (argumentEcho.argsRedacted
+                                        ? " Re-send the original arguments; sensitive fields are omitted."
+                                        : "args" in argumentEcho
+                                            ? ""
+                                            : " Re-send the original arguments; they could not be echoed safely."),
                             },
                         };
                     case "destructive_tool_requires_approval": {
-                        const echoed = echoedCallArgs(args);
+                        const echoed = argumentEcho;
                         return {
                             ...error,
                             nextAction: {
@@ -259,9 +302,11 @@ export class InvocationService {
                                     ...echoed,
                                 },
                                 purpose: "Ask the MCP host to approve this consequential call. " +
-                                    ("args" in echoed
-                                        ? "Re-send these arguments and add a short reason for the human reviewer."
-                                        : "Re-send the arguments you just sent — they are too large to echo back — and add a short reason for the human reviewer."),
+                                    (echoed.argsRedacted
+                                        ? "Re-send the original arguments; sensitive fields are omitted from this hint. Add a short reason for the human reviewer."
+                                        : "args" in echoed
+                                            ? "Re-send these arguments and add a short reason for the human reviewer."
+                                            : "Re-send the arguments you just sent; they could not be echoed safely. Add a short reason for the human reviewer."),
                             },
                         };
                     }
@@ -325,7 +370,8 @@ export class InvocationService {
                         details: { ...error.details, operation, stage, elapsedMs, ...defined({ deadlineMs: context.timeoutMs }) },
                     };
                 }
-                const details = sentSecrets.redact(enrich(error, target));
+                // Downstream diagnostics were redacted under payload rules where they entered.
+                const details = sentSecrets.redact(enrich(error, target), "envelope");
                 const outcome = () => ({
                     ok: false,
                     durationMs: Date.now() - started,
@@ -365,6 +411,7 @@ export class InvocationService {
                 return failed(callerCancelledDetails());
             }
             let result;
+            let rawResult;
             let inputRequiredValue;
             let observedResult;
             let valueFormat = "json";
@@ -398,11 +445,15 @@ export class InvocationService {
                 const target = resolution.resolved;
                 resolved = target;
                 activityTarget = target;
+                argumentEcho = echoedCallArgs(args ?? {}, target.definition.inputSchema);
+                sentSecrets.arguments(args ?? {}, target.definition.inputSchema);
                 const write = target.definition.classification !== "read";
                 const canonicalAddress = `${target.connector.id}.${target.toolName}`;
                 const input = context.source !== "execute_code"
                     ? downstreamContinuation(this.catalog.requestScope, target.connector.id, canonicalAddress)
                     : undefined;
+                if (input)
+                    recordDownstreamArgumentEcho(this.catalog.requestScope, argumentEcho);
                 const expectedDigest = replayClassificationDigest(this.catalog.requestScope, canonicalAddress);
                 if (expectedDigest !== undefined &&
                     (target.classificationFresh !== true ||
@@ -444,6 +495,7 @@ export class InvocationService {
                     const connectorContext = this.registry.contextFor(target.connector.id, this.catalog.baseUrl, this.catalog.requestScope, defined({ signal: callSignal, timeoutMs: context.timeoutMs, defer: this.catalog.defer }));
                     trackCredentialReads(connectorContext);
                     sentSecrets.include(sentSecretsFor(connectorContext));
+                    dispatchContext = connectorContext;
                     try {
                         if (target.connector.credential) {
                             if (!connectorContext.credential) {
@@ -536,7 +588,8 @@ export class InvocationService {
                     /* Unserializable values have no measurable byte count. */
                 }
                 valueFormat = attempt.value.observed.format;
-                result = context.unwrapResult ? observedResult : attempt.value.raw;
+                rawResult = attempt.value.raw;
+                result = context.unwrapResult ? observedResult : rawResult;
                 return undefined;
             });
             // One deadline owns discovery, queue admission, and provider dispatch.
@@ -571,7 +624,7 @@ export class InvocationService {
                 ? Effect.succeed(inputRequiredValue.value)
                 : processResult
                     ? Effect.tryPromise({
-                        try: () => Promise.resolve(processResult(sentSecrets.redact(result), completed, sentSecrets, valueFormat)),
+                        try: () => Promise.resolve(processResult(sentSecrets.redact(result), completed, sentSecrets, valueFormat, rawResult)),
                         catch: (error) => error,
                     })
                     : Effect.succeed(result);
@@ -592,7 +645,7 @@ export class InvocationService {
             if (Exit.isFailure(processed))
                 return unprocessable();
             try {
-                const value = sentSecrets.redact(processed.value);
+                const value = sentSecrets.redact(processed.value, "envelope");
                 const diagnostics = timing();
                 const friction = context.activityFriction?.(value);
                 record("success", friction ? { friction } : {});
@@ -610,6 +663,11 @@ export class InvocationService {
             catch {
                 return unprocessable();
             }
-        });
+        }).pipe(Effect.flatMap((outcome) => outcome.ok
+            ? Effect.succeed(outcome)
+            : Effect.promise(async () => ({
+                ...outcome,
+                error: await withAuthorizationHandoff(this.catalog.requestScope, outcome.error),
+            }))));
     }
 }

package/dist/meta-output.js

@@ -51,21 +51,6 @@ export const SEARCH_OUTPUT = {
         },
     },
 };
-export const CALL_OUTPUT = advertisedSchema(z
-    .object({
-    ok: z.boolean().optional(),
-    data: z.unknown().optional(),
-    format: format.optional(),
-    error: error.optional(),
-    durationMs: z.number().nonnegative().optional(),
-    attempts: z.number().int().nonnegative().optional(),
-    truncated: z.boolean().optional(),
-    resultId: z.string().optional(),
-    totalBytes: z.number().int().nonnegative().optional(),
-    hint: z.string().optional(),
-    nextAction: z.record(z.string(), z.unknown()).optional(),
-})
-    .passthrough());
 export const AUTHORIZE_OUTPUT = advertisedSchema(z
     .object({
     connector: z.string().optional(),