@zackbart/connecta 0.34.0 → 0.35.0

package/dist/catalog-cache.js

@@ -1,6 +1,12 @@
+import { detach, runEdge } from "./runtime/run.js";
+import { Deferred, Effect } from "effect";
+import { authFlow, authCall, authInvoke, authValue, authMethod, authProgram, registerAuth, authStorage, authMap, authAwait, } from "./auth/native.js";
 import { MAX_CACHE_TTL_MS, specTypeSchemas } from "@modelcontextprotocol/client";
 import { callerOf } from "./connector-caller.js";
 import { CONFIG_DEFAULTS } from "./config-defaults.js";
+import { Context } from "effect";
+import { RequestScope } from "./runtime/request-scope.js";
+import { serviceFor, setViewService, viewServices } from "./runtime/call.js";
 import { ConnectorCallError } from "./errors.js";
 import { fingerprintSerializedCatalog } from "./catalog-fingerprint.js";
 import { MAX_CATALOG_CHUNK_BYTES, MAX_CATALOG_TOOLS, MAX_SERIALIZED_CATALOG_BYTES } from "./catalog-limits.js";
@@ -8,21 +14,32 @@ import { redactCatalog, sentSecretsForRequest } from "./sent-secrets.js";
 import { failureRecord, logFailure } from "./operator-record.js";
 import { responseCacheKeys } from "./storage/keys.js";
 /** Publish one accepted catalog refresh, with its partitioned drift baseline. */
-export async function observeCompletedCatalogRefresh(ctx, refresh) {
-    await settings.get(ctx)?.onCompletedCatalogRefresh?.(refresh, ctx);
+export function observeCompletedCatalogRefresh(ctx, refresh) {
+    return runEdge(authProgram(observeCompletedCatalogRefreshNative, [ctx, refresh]));
 }
+const observeCompletedCatalogRefreshNative = /* @__PURE__ */ registerAuth(observeCompletedCatalogRefresh, (ctx, refresh) => authFlow(function* () {
+    (yield authValue(() => serviceFor(ctx, CatalogPolicy)?.onCompletedCatalogRefresh?.(refresh, ctx)));
+}));
 /** Hash-only facts preserve change counts without storing tool names or schemas. */
-async function catalogFingerprints(tools) {
+function catalogFingerprints(tools) {
+    return runEdge(authProgram(catalogFingerprintsNative, [tools]));
+}
+const catalogFingerprintsNative = /* @__PURE__ */ registerAuth(catalogFingerprints, (tools) => authFlow(function* () {
     const facts = [];
     for (let offset = 0; offset < tools.length; offset += 128) {
-        facts.push(...(await Promise.all(tools.slice(offset, offset + 128).map(async (tool) => ({
-            name: (await fingerprintSerializedCatalog(tool.name)).fingerprint,
-            fact: (await fingerprintSerializedCatalog(JSON.stringify(tool))).fingerprint,
-        })))));
+        facts.push(...(yield authMap(tools.slice(offset, offset + 128), (value) => authCall(authMethod((tool) => authFlow(function* () {
+            return {
+                name: (yield authCall(fingerprintSerializedCatalog, [tool.name])).fingerprint,
+                fact: (yield authCall(fingerprintSerializedCatalog, [JSON.stringify(tool)])).fingerprint,
+            };
+        })), [value]), false)));
     }
     return facts;
+}));
+function refreshBaseline(storage, key, raw, io) {
+    return runEdge(authProgram(refreshBaselineNative, [storage, key, raw, io]));
 }
-async function refreshBaseline(storage, key, raw, io) {
+const refreshBaselineNative = /* @__PURE__ */ registerAuth(refreshBaseline, (storage, key, raw, io) => authFlow(function* () {
     if (!raw)
         return;
     try {
@@ -37,13 +54,15 @@ async function refreshBaseline(storage, key, raw, io) {
             return;
         const chunks = [];
         for (let index = 0; index < value.chunkCount; index++) {
-            const chunk = await io(() => storage.get(responseCacheKeys.chunk(key, value.revision, index)));
+            const chunk = (yield authCall(io, [
+                authMethod(() => authStorage(storage, "get", [responseCacheKeys.chunk(key, value.revision, index)])),
+            ]));
             if (chunk === null || new TextEncoder().encode(chunk).byteLength > MAX_CATALOG_CHUNK_BYTES)
                 return;
             chunks.push(chunk);
         }
         const serialized = chunks.join("");
-        if ((await fingerprintSerializedCatalog(serialized)).fingerprint !== value.fingerprint)
+        if ((yield authCall(fingerprintSerializedCatalog, [serialized])).fingerprint !== value.fingerprint)
             return;
         const tools = JSON.parse(serialized);
         if (Array.isArray(tools) &&
@@ -51,34 +70,57 @@ async function refreshBaseline(storage, key, raw, io) {
             tools.every((tool) => tool && hash(tool.name) && hash(tool.fact)))
             return { digest: value.digest, tools };
     }
-    catch {
-        /* Retired or torn baselines establish a new count baseline. */
-    }
+    catch { }
+}));
+function acceptCatalogRefresh(storage, key, connectorId, digest, tools, privateCatalog, current, io) {
+    return runEdge(authProgram(acceptCatalogRefreshNative, [
+        storage,
+        key,
+        connectorId,
+        digest,
+        tools,
+        privateCatalog,
+        current,
+        io,
+    ]));
 }
-async function acceptCatalogRefresh(storage, key, connectorId, digest, tools, privateCatalog, current, io) {
-    const next = await catalogFingerprints(tools);
+const acceptCatalogRefreshNative = /* @__PURE__ */ registerAuth(acceptCatalogRefresh, (storage, key, connectorId, digest, tools, privateCatalog, current, io) => authFlow(function* () {
+    const next = (yield authCall(catalogFingerprints, [tools]));
     const serialized = JSON.stringify(next);
     const revision = crypto.randomUUID();
-    const fingerprint = (await fingerprintSerializedCatalog(serialized)).fingerprint;
-    // Fingerprints are ASCII. Chunk them under the same platform value ceiling
-    // as catalogs, then publish their manifest in one compare-and-set.
+    const fingerprint = (yield authCall(fingerprintSerializedCatalog, [serialized])).fingerprint;
     const chunkCount = Math.ceil(serialized.length / MAX_CATALOG_CHUNK_BYTES);
     for (let index = 0; index < chunkCount; index++) {
-        if (!(await current()))
+        if (!(yield authCall(current, [])))
             return;
         const chunk = serialized.slice(index * MAX_CATALOG_CHUNK_BYTES, (index + 1) * MAX_CATALOG_CHUNK_BYTES);
-        await io(() => storage.set(responseCacheKeys.chunk(key, revision, index), chunk, { ttlSeconds: GENERATION_TTL_SECONDS + 300 }));
+        (yield authCall(io, [
+            authMethod(() => authStorage(storage, "set", [
+                responseCacheKeys.chunk(key, revision, index),
+                chunk,
+                { ttlSeconds: GENERATION_TTL_SECONDS + 300 },
+            ])),
+        ]));
     }
     const manifest = { digest, revision, chunkCount, fingerprint };
     for (let attempt = 0; attempt < 16; attempt++) {
-        if (!(await current()))
+        if (!(yield authCall(current, [])))
             return;
-        const raw = await io(() => storage.get(key));
-        const previous = await refreshBaseline(storage, key, raw, io);
-        if (!(await current()))
+        const raw = (yield authCall(io, [
+            authMethod(() => authStorage(storage, "get", [key])),
+        ]));
+        const previous = (yield authCall(refreshBaseline, [storage, key, raw, io]));
+        if (!(yield authCall(current, [])))
             return;
-        const published = await io(() => storage.compareAndSet(key, raw, JSON.stringify(manifest), { ttlSeconds: GENERATION_TTL_SECONDS }));
-        if (!(await current()))
+        const published = (yield authCall(io, [
+            authMethod(() => authStorage(storage, "compareAndSet", [
+                key,
+                raw,
+                JSON.stringify(manifest),
+                { ttlSeconds: GENERATION_TTL_SECONDS },
+            ])),
+        ]));
+        if (!(yield authCall(current, [])))
             return;
         if (published)
             return {
@@ -90,20 +132,33 @@ async function acceptCatalogRefresh(storage, key, connectorId, digest, tools, pr
             };
     }
     throw new Error("Catalog refresh baseline is busy.");
-}
+}));
 /** Custom dynamic connectors have no SDK cache; publish their complete intake here. */
-export async function observeUncachedCatalogRefresh(ctx, connectorId, tools) {
-    const policy = settings.get(ctx);
+export function observeUncachedCatalogRefresh(ctx, connectorId, tools) {
+    return runEdge(authProgram(observeUncachedCatalogRefreshNative, [ctx, connectorId, tools]));
+}
+const observeUncachedCatalogRefreshNative = /* @__PURE__ */ registerAuth(observeUncachedCatalogRefresh, (ctx, connectorId, tools) => authFlow(function* () {
+    const policy = serviceFor(ctx, CatalogPolicy);
     if (!policy?.onCompletedCatalogRefresh)
         return;
-    const config = (await fingerprintSerializedCatalog("custom-connector")).fingerprint;
-    const partition = (await fingerprintSerializedCatalog(JSON.stringify([policy.partition, ctx.baseUrl, ctx.publicUrl])))
-        .fingerprint;
-    const digest = (await fingerprintSerializedCatalog(JSON.stringify(tools))).fingerprint;
-    const refresh = await acceptCatalogRefresh(policy.storage, responseCacheKeys.refreshDigest(connectorId, config, partition), connectorId, digest, tools, true, async () => !ctx.signal?.aborted, (read) => read());
+    const config = (yield authCall(fingerprintSerializedCatalog, ["custom-connector"])).fingerprint;
+    const partition = (yield authCall(fingerprintSerializedCatalog, [
+        JSON.stringify([policy.partition, ctx.baseUrl, ctx.publicUrl]),
+    ])).fingerprint;
+    const digest = (yield authCall(fingerprintSerializedCatalog, [JSON.stringify(tools)])).fingerprint;
+    const refresh = (yield authCall(acceptCatalogRefresh, [
+        policy.storage,
+        responseCacheKeys.refreshDigest(connectorId, config, partition),
+        connectorId,
+        digest,
+        tools,
+        true,
+        authMethod(() => Effect.sync(() => !ctx.signal?.aborted)),
+        authMethod((read) => authCall(read, [])),
+    ]));
     if (refresh)
-        await observeCompletedCatalogRefresh(ctx, refresh);
-}
+        (yield authCall(observeCompletedCatalogRefresh, [ctx, refresh]));
+}));
 export function catalogItems(method, result) {
     if (method === "tools/list")
         return result.tools;
@@ -118,42 +173,46 @@ function catalogSchema(method) {
             ? specTypeSchemas.ListResourcesResult
             : specTypeSchemas.ListResourceTemplatesResult;
 }
-const expiry = new WeakMap();
-const fetches = new WeakMap();
+class CatalogExpiryService extends Context.Service()("connecta/operation/CatalogExpiryService") {
+}
+class CatalogFetches extends Context.Service()("connecta/operation/CatalogFetches") {
+}
 export function observeCatalogFetch(ctx, at, method = "tools/list") {
-    const methods = fetches.get(ctx) ?? new Map();
+    const methods = serviceFor(ctx, CatalogFetches) ?? new Map();
     methods.set(method, at);
-    fetches.set(ctx, methods);
+    setViewService(ctx, CatalogFetches, methods);
 }
 export function catalogFetchedAt(ctx, method = "tools/list") {
-    return fetches.get(ctx)?.get(method);
+    return serviceFor(ctx, CatalogFetches)?.get(method);
 }
 export function catalogExpiry(ctx, method = "tools/list") {
-    return expiry.get(ctx)?.get(method);
+    return serviceFor(ctx, CatalogExpiryService)?.get(method);
 }
 export function observeCatalogExpiry(ctx, method, ttlMs, expiresAt, staleFallback = false) {
     const fetchedAt = catalogFetchedAt(ctx, method) ?? Date.now();
-    const methods = expiry.get(ctx) ?? new Map();
+    const methods = serviceFor(ctx, CatalogExpiryService) ?? new Map();
     methods.set(method, {
         fetchedAt,
         ttlMs,
         expiresAt: Math.min(expiresAt ?? Infinity, fetchedAt + ttlMs),
         staleFallback,
     });
-    expiry.set(ctx, methods);
+    setViewService(ctx, CatalogExpiryService, methods);
 }
 // Tool facts remain available for ordinary calls after a transient listing
 // failure for five minutes. Resources never use stale inventories. A fallback
 // carries its original expired deadline and cannot authorize auth recovery.
 const STALE_FALLBACK_MS = 300_000;
-const settings = new WeakMap();
+class CatalogPolicy extends Context.Service()("connecta/operation/CatalogPolicy") {
+}
 export function attachCatalogCache(ctx, value) {
-    settings.set(ctx, value);
+    setViewService(ctx, CatalogPolicy, value);
 }
 const defaultOwner = {};
 const scopes = new WeakMap();
 function cacheScope(ctx, connectorId, owner = defaultOwner) {
-    const key = ctx.requestScope ?? ctx;
+    const request = Context.get(viewServices(ctx), RequestScope);
+    const key = request;
     let connectors = scopes.get(key);
     if (!connectors) {
         connectors = new Map();
@@ -168,6 +227,11 @@ function cacheScope(ctx, connectorId, owner = defaultOwner) {
     if (!scope) {
         scope = { closed: false, abort: new AbortController() };
         owners.set(owner, scope);
+        const owned = scope;
+        request.own(() => {
+            owned.closed = true;
+            owned.abort.abort();
+        });
     }
     return scope;
 }
@@ -176,20 +240,26 @@ export function observeCatalogChange(ctx, connectorId, connectionSignal, owner)
     const scope = cacheScope(ctx, connectorId, owner);
     if (scope.closed || connectionSignal?.aborted)
         return;
-    const writing = invalidateCatalogCache(settings.get(ctx)?.storage ?? ctx.storage, connectorId).catch((error) => {
-        logFailure(ctx.logger, "catalog invalidation failed", failureRecord({ connector: connectorId }, error));
-    });
-    scope.invalidating = scope.invalidating ? Promise.all([scope.invalidating, writing]).then(() => { }) : writing;
+    const previous = scope.invalidating;
+    const settled = Deferred.makeUnsafe();
+    scope.invalidating = settled;
+    const writing = authCall(invalidateCatalogCache, [
+        serviceFor(ctx, CatalogPolicy)?.storage ?? ctx.storage,
+        connectorId,
+    ]).pipe(Effect.catch((error) => Effect.sync(() => logFailure(ctx.logger, "catalog invalidation failed", failureRecord({ connector: connectorId }, error)))));
+    // Start the fence in this SDK callback's request, and retain only its native
+    // settlement for teardown. Concurrent notifications still begin immediately.
+    detach(Effect.all([previous ? Deferred.await(previous) : Effect.void, writing], { concurrency: "unbounded" }).pipe(Effect.asVoid, Effect.provideService(RequestScope, Context.get(viewServices(ctx), RequestScope)), Effect.onExit((exit) => Deferred.done(settled, exit))));
 }
 export function closeCatalogCacheScope(ctx, connectorId, owner) {
     const scope = cacheScope(ctx, connectorId, owner);
     scope.closed = true;
     scope.abort.abort();
-    return scope.invalidating;
+    return scope.invalidating ? runEdge(Deferred.await(scope.invalidating)) : undefined;
 }
 /** Zero is an explicit refusal to reuse. Positive hints use the configured bounds. */
 function catalogTtlMs(ctx, hint) {
-    const policy = settings.get(ctx);
+    const policy = serviceFor(ctx, CatalogPolicy);
     const ttl = hint === undefined ? Math.floor(policy?.defaultTtlMs ?? CONFIG_DEFAULTS.discovery.catalogTtlSeconds * 1000) : hint;
     if (typeof ttl !== "number" || !Number.isSafeInteger(ttl) || ttl <= 0)
         return 0;
@@ -279,14 +349,37 @@ function catalogCeiling() {
     });
 }
 const GENERATION_TTL_SECONDS = (MAX_CACHE_TTL_MS * 2) / 1000;
-export async function invalidateCatalogCache(storage, connectorId) {
-    await storage.set(responseCacheKeys.generation(connectorId), crypto.randomUUID(), {
-        ttlSeconds: GENERATION_TTL_SECONDS,
-    });
+export function invalidateCatalogCache(storage, connectorId) {
+    return runEdge(authProgram(invalidateCatalogCacheNative, [storage, connectorId]));
 }
+const invalidateCatalogCacheNative = /* @__PURE__ */ registerAuth(invalidateCatalogCache, (storage, connectorId) => authFlow(function* () {
+    (yield authStorage(storage, "set", [
+        responseCacheKeys.generation(connectorId),
+        crypto.randomUUID(),
+        {
+            ttlSeconds: GENERATION_TTL_SECONDS,
+        },
+    ]));
+}));
 /** Keys ignore self-reported serverInfo and bind the configured connector instead. */
-export async function catalogClientOptions(ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity) {
-    const policy = settings.get(ctx);
+export function catalogClientOptions(ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity) {
+    return runEdge(authProgram(catalogClientOptionsNative, [
+        ctx,
+        connectorId,
+        config,
+        authPartition,
+        connectionSignal,
+        owner,
+        sharing,
+        resolveCredentialIdentity,
+    ]));
+}
+const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOptions, (ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity) => authFlow(function* () {
+    const request = Context.get(viewServices(ctx), RequestScope);
+    // SDK callbacks start at their own Promise edge. Reprovide only their
+    // canonical request owner, never the initiating call's live services.
+    const cacheMethod = (program) => authMethod((...args) => program(...args).pipe(Effect.provideService(RequestScope, request)));
+    const policy = serviceFor(ctx, CatalogPolicy);
     const partition = JSON.stringify([
         policy?.partition ?? JSON.stringify(callerOf(ctx) ?? null),
         ctx.baseUrl,
@@ -299,18 +392,18 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
         authPartition,
     ]);
     const storage = policy?.storage ?? ctx.storage;
-    const configHash = (await fingerprintSerializedCatalog(JSON.stringify([
-        config,
-        policy?.defaultTtlMs ?? 300_000,
-        policy?.minTtlMs ?? 0,
-        policy?.maxTtlMs ?? MAX_CACHE_TTL_MS,
-    ]))).fingerprint;
+    const configHash = (yield authCall(fingerprintSerializedCatalog, [
+        JSON.stringify([
+            config,
+            policy?.defaultTtlMs ?? 300000,
+            policy?.minTtlMs ?? 0,
+            policy?.maxTtlMs ?? MAX_CACHE_TTL_MS,
+        ]),
+    ])).fingerprint;
     const scope = cacheScope(ctx, connectorId, owner);
     let unavailable = false;
     const connectionGeneration = {};
     let active;
-    // ResponseCacheStore has no per-call options. A method snapshots its binding
-    // before any await; an abandoned storage promise never adopts a later listing.
     const capture = (listing = active) => {
         const signals = [scope.abort.signal, connectionSignal, listing?.ctx.signal].filter((signal) => signal !== undefined);
         const ended = () => scope.closed || listing?.ended === true || signals.some((signal) => signal.aborted);
@@ -322,73 +415,57 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
             credentialIdentity: listing?.credentialIdentity,
             listing,
             stopped: () => unavailable || ended(),
-            io: (read) => new Promise((resolve, reject) => {
-                const cleanup = () => {
-                    for (const signal of signals)
-                        signal.removeEventListener("abort", abort);
-                };
-                const abort = () => {
-                    cleanup();
-                    reject(reason());
-                };
-                if (ended()) {
-                    abort();
-                    return;
-                }
-                for (const signal of signals)
-                    signal.addEventListener("abort", abort, { once: true });
-                // Storage cannot cancel dispatched I/O. Stop waiting, but attach both
-                // outcomes so its eventual completion cannot continue cache publication.
-                try {
-                    read().then((value) => {
-                        cleanup();
-                        resolve(value);
-                    }, (error) => {
-                        cleanup();
-                        reject(error);
-                    });
-                }
-                catch (error) {
-                    cleanup();
-                    reject(error);
-                }
-            }),
+            io: cacheMethod((read) => authFlow(function* () {
+                if (ended())
+                    throw reason();
+                return yield authAwait(authCall(read, []), AbortSignal.any(signals));
+            })),
         };
     };
     let lastStamp = 0;
     let staleTools;
-    const currentGeneration = async ({ stopped, io, generation }) => {
+    const currentGeneration = cacheMethod(({ stopped, io, generation }) => authFlow(function* () {
         const key = responseCacheKeys.generation(connectorId);
         for (let attempt = 0; attempt < 16; attempt++) {
             if (stopped())
                 return undefined;
-            const current = await io(() => storage.get(key));
+            const current = (yield authCall(io, [
+                cacheMethod(() => authStorage(storage, "get", [key])),
+            ]));
             if (stopped())
                 return undefined;
             if (current)
                 return current;
             const next = generation.value ?? crypto.randomUUID();
-            const claimed = await io(() => storage.compareAndSet(key, null, next, { ttlSeconds: GENERATION_TTL_SECONDS }));
+            const claimed = (yield authCall(io, [
+                cacheMethod(() => authStorage(storage, "compareAndSet", [
+                    key,
+                    null,
+                    next,
+                    { ttlSeconds: GENERATION_TTL_SECONDS },
+                ])),
+            ]));
             if (stopped())
                 return undefined;
             if (claimed)
                 return next;
         }
         throw new Error("Catalog cache generation is busy.");
-    };
-    const namespace = async (operation) => {
+    }));
+    const namespace = cacheMethod((operation) => authFlow(function* () {
         const { stopped, generation, io } = operation;
-        if (resolveCredentialIdentity && (await io(resolveCredentialIdentity)) !== operation.credentialIdentity)
+        if (resolveCredentialIdentity &&
+            (yield authCall(io, [resolveCredentialIdentity])) !== operation.credentialIdentity)
             return undefined;
-        const current = await currentGeneration(operation);
+        const current = (yield authCall(currentGeneration, [operation]));
         if (!current || stopped())
             return undefined;
         generation.value ??= current;
         return generation.value === current
             ? responseCacheKeys.namespace(connectorId, configHash, generation.value)
             : undefined;
-    };
-    const address = async (key, operation) => {
+    }));
+    const address = cacheMethod((key, operation) => authFlow(function* () {
         const { stopped } = operation;
         if (stopped() || !isCatalogMethod(key.method) || key.params)
             return undefined;
@@ -403,17 +480,18 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
             pair.length !== 2 ||
             (pair[1] !== partition && (pair[1] !== "" || sharing !== "shared")))
             return undefined;
-        const prefix = await namespace(operation);
+        const prefix = (yield authCall(namespace, [operation]));
         if (!prefix || stopped())
             return undefined;
-        // Hash the admitted principal/pool/auth partition; no identities or server text in keys.
-        const digest = (await fingerprintSerializedCatalog(JSON.stringify([
-            key.method,
-            pair[1] === "" ? sharedPartition : partition,
-            operation.credentialIdentity ?? null,
-        ]))).fingerprint;
+        const digest = (yield authCall(fingerprintSerializedCatalog, [
+            JSON.stringify([
+                key.method,
+                pair[1] === "" ? sharedPartition : partition,
+                operation.credentialIdentity ?? null,
+            ]),
+        ])).fingerprint;
         return stopped() ? undefined : responseCacheKeys.entry(prefix, digest);
-    };
+    }));
     const manifest = (raw) => {
         if (!raw)
             return undefined;
@@ -456,53 +534,71 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
             cacheScope: body.cacheScope === "public" ? "public" : "private",
         };
     };
-    const completeCatalogRefresh = async (result) => {
+    const completeCatalogRefresh = cacheMethod((result) => authFlow(function* () {
         const listing = active;
         const operation = capture();
         const { stopped, io } = operation;
         if (!listing || stopped())
             return;
         const clean = intake(listing.ctx, "tools/list", result);
-        const digest = (await fingerprintSerializedCatalog(JSON.stringify(clean))).fingerprint;
-        const partitionDigest = (await fingerprintSerializedCatalog(JSON.stringify([
-            clean.cacheScope === "public" ? sharedPartition : partition,
-            operation.credentialIdentity ?? null,
-        ]))).fingerprint;
+        const digest = (yield authCall(fingerprintSerializedCatalog, [JSON.stringify(clean)])).fingerprint;
+        const partitionDigest = (yield authCall(fingerprintSerializedCatalog, [
+            JSON.stringify([
+                clean.cacheScope === "public" ? sharedPartition : partition,
+                operation.credentialIdentity ?? null,
+            ]),
+        ])).fingerprint;
         try {
-            return await acceptCatalogRefresh(storage, responseCacheKeys.refreshDigest(connectorId, configHash, partitionDigest), connectorId, digest, clean.tools, clean.cacheScope !== "public", async () => !stopped() && !!(await namespace(operation)) && !stopped(), io);
+            return (yield authCall(acceptCatalogRefresh, [
+                storage,
+                responseCacheKeys.refreshDigest(connectorId, configHash, partitionDigest),
+                connectorId,
+                digest,
+                clean.tools,
+                clean.cacheScope !== "public",
+                cacheMethod(() => authFlow(function* () {
+                    return !stopped() && !!(yield authCall(namespace, [operation])) && !stopped();
+                })),
+                io,
+            ]));
         }
         catch (error) {
             if (!stopped())
                 logFailure(listing.ctx.logger, "catalog refresh observation failed", failureRecord({ connector: connectorId }, error));
         }
-    };
+    }));
     const store = {
-        async get(key) {
+        get: cacheMethod((key) => authFlow(function* () {
             const operation = capture();
             const { ctx, stopped, io } = operation;
-            const root = await address(key, operation);
+            const root = (yield authCall(address, [key, operation]));
             if (!root || stopped())
                 return undefined;
-            const m = manifest(await io(() => storage.get(root)));
+            const m = manifest((yield authCall(io, [
+                cacheMethod(() => authStorage(storage, "get", [root])),
+            ])));
             if (stopped() ||
                 !m ||
-                (m.expiresAt <= Date.now() && (key.method !== "tools/list" || m.expiresAt + STALE_FALLBACK_MS <= Date.now())))
+                (m.expiresAt <= Date.now() &&
+                    (key.method !== "tools/list" || m.expiresAt + STALE_FALLBACK_MS <= Date.now())))
                 return undefined;
             const chunks = [];
             for (let i = 0; i < m.chunkCount; i++) {
                 if (stopped())
                     return undefined;
-                const chunk = await io(() => storage.get(responseCacheKeys.chunk(root, m.revision, i)));
+                const chunk = (yield authCall(io, [
+                    cacheMethod(() => authStorage(storage, "get", [responseCacheKeys.chunk(root, m.revision, i)])),
+                ]));
                 if (stopped() || chunk === null || new TextEncoder().encode(chunk).byteLength > MAX_CATALOG_CHUNK_BYTES)
                     return undefined;
                 chunks.push(chunk);
             }
             const value = chunks.join("");
-            const fingerprint = await fingerprintSerializedCatalog(value);
+            const fingerprint = (yield authCall(fingerprintSerializedCatalog, [value]));
             if (stopped() ||
                 fingerprint.byteLength > MAX_SERIALIZED_CATALOG_BYTES ||
                 fingerprint.fingerprint !== m.fingerprint ||
-                !(await namespace(operation)) ||
+                !(yield authCall(namespace, [operation])) ||
                 stopped())
                 return undefined;
             const result = JSON.parse(value);
@@ -513,7 +609,7 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
                 "nextCursor" in result ||
                 (result.resultType !== undefined && result.resultType !== "complete"))
                 return undefined;
-            const validated = await catalogSchema(method)["~standard"].validate(result);
+            const validated = (yield authInvoke(catalogSchema(method)["~standard"], "validate", [result]));
             if (stopped() || validated.issues)
                 return undefined;
             const clean = intake(ctx, method, validated.value);
@@ -525,30 +621,33 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
             observeCatalogFetch(ctx, m.fetchedAt, method);
             observeCatalogExpiry(ctx, method, clean.ttlMs, m.expiresAt);
             return { value: JSON.stringify(clean), stamp: m.stamp, expiresAt: m.expiresAt, scope: m.scope };
-        },
-        async set(key, entry) {
+        })),
+        set: cacheMethod((key, entry) => authFlow(function* () {
             const operation = capture();
             const { ctx, stopped, io } = operation;
-            const root = await address(key, operation);
+            const root = (yield authCall(address, [key, operation]));
             if (!root || stopped())
                 return 0;
             const result = JSON.parse(entry.value);
             const method = key.method;
             if (catalogTtlMs(ctx, result.ttlMs) === 0) {
-                if (!stopped() && (await namespace(operation)) && !stopped())
-                    await io(() => storage.delete(root));
+                if (!stopped() && (yield authCall(namespace, [operation])) && !stopped())
+                    (yield authCall(io, [
+                        cacheMethod(() => authStorage(storage, "delete", [root])),
+                    ]));
                 return 0;
             }
             if (!Array.isArray(catalogItems(method, result)) ||
                 "nextCursor" in result ||
                 (result.resultType !== undefined && result.resultType !== "complete"))
                 return 0;
-            // Defence in depth: the SDK catches store failures, so intake also runs on
-            // the request path, where a secret-bearing name refuses the entire list.
             const value = JSON.stringify(intake(ctx, method, result));
-            const fingerprint = await fingerprintSerializedCatalog(value);
+            const fingerprint = (yield authCall(fingerprintSerializedCatalog, [value]));
             const expiresAt = Math.min(entry.expiresAt ?? Date.now(), (catalogFetchedAt(ctx, method) ?? Date.now()) + catalogTtlMs(ctx, result.ttlMs));
-            if (stopped() || expiresAt <= Date.now() || !(await namespace(operation)) || stopped())
+            if (stopped() ||
+                expiresAt <= Date.now() ||
+                !(yield authCall(namespace, [operation])) ||
+                stopped())
                 return 0;
             const revision = crypto.randomUUID();
             const bytes = new TextEncoder().encode(value);
@@ -560,18 +659,29 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
                 if (stopped() || expiresAt <= Date.now())
                     return 0;
                 let end = Math.min(offset + MAX_CATALOG_CHUNK_BYTES, bytes.length);
-                while (end < bytes.length && (bytes[end] & 0xc0) === 0x80)
+                while (end < bytes.length && (bytes[end] & 192) === 128)
                     end--;
                 const chunk = responseCacheKeys.chunk(root, revision, chunkCount++);
-                await io(() => storage.set(chunk, decoder.decode(bytes.subarray(offset, end)), { ttlSeconds: ttlSeconds() }));
+                (yield authCall(io, [
+                    cacheMethod(() => authStorage(storage, "set", [
+                        chunk,
+                        decoder.decode(bytes.subarray(offset, end)),
+                        { ttlSeconds: ttlSeconds() },
+                    ])),
+                ]));
                 if (stopped())
                     return 0;
                 offset = end;
             }
             for (let attempt = 0; attempt < 16; attempt++) {
-                if (stopped() || expiresAt <= Date.now() || !(await namespace(operation)) || stopped())
+                if (stopped() ||
+                    expiresAt <= Date.now() ||
+                    !(yield authCall(namespace, [operation])) ||
+                    stopped())
                     return 0;
-                const previous = await io(() => storage.get(root));
+                const previous = (yield authCall(io, [
+                    cacheMethod(() => authStorage(storage, "get", [root])),
+                ]));
                 if (stopped() || expiresAt <= Date.now())
                     return 0;
                 const stamp = Math.max(Date.now(), (manifest(previous)?.stamp ?? 0) + 1, lastStamp + 1);
@@ -584,7 +694,14 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
                     chunkCount,
                     fingerprint: fingerprint.fingerprint,
                 };
-                const published = await io(() => storage.compareAndSet(root, previous, JSON.stringify(m), { ttlSeconds: ttlSeconds() }));
+                const published = (yield authCall(io, [
+                    cacheMethod(() => authStorage(storage, "compareAndSet", [
+                        root,
+                        previous,
+                        JSON.stringify(m),
+                        { ttlSeconds: ttlSeconds() },
+                    ])),
+                ]));
                 if (stopped())
                     return 0;
                 if (published) {
@@ -593,31 +710,33 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
                 }
             }
             throw new Error("Catalog cache publication is busy.");
-        },
-        async delete(key) {
+        })),
+        delete: cacheMethod((key) => authFlow(function* () {
             const operation = capture();
-            const root = await address(key, operation);
+            const root = (yield authCall(address, [key, operation]));
             if (root && !operation.stopped())
-                await operation.io(() => storage.delete(root));
-        },
-        async evict(method) {
+                (yield authInvoke(operation, "io", [
+                    cacheMethod(() => authStorage(storage, "delete", [root])),
+                ]));
+        })),
+        evict: cacheMethod((method) => authFlow(function* () {
             if (isCatalogMethod(method))
-                await store.clear();
-        },
-        async clear() {
+                (yield authInvoke(store, "clear", []));
+        })),
+        clear: cacheMethod(() => authFlow(function* () {
             const operation = capture();
             if (!operation.stopped())
-                await operation.io(() => invalidateCatalogCache(storage, connectorId));
-        },
+                (yield authInvoke(operation, "io", [
+                    cacheMethod(() => authCall(invalidateCatalogCache, [storage, connectorId])),
+                ]));
+        })),
     };
-    // Refresh/bypass listings may never call get(). Pin before any wire I/O so
-    // their first late publication cannot adopt a post-notification generation.
-    // Reading an absent generation pins a nonce without mutating storage before
-    // negotiation/auth succeeds. The first cache operation may claim that nonce.
     try {
         const { stopped, io } = capture({ ctx, generation: connectionGeneration, ended: false });
         if (!stopped()) {
-            const current = await io(() => storage.get(responseCacheKeys.generation(connectorId)));
+            const current = (yield authCall(io, [
+                cacheMethod(() => authStorage(storage, "get", [responseCacheKeys.generation(connectorId)])),
+            ]));
             if (!stopped())
                 connectionGeneration.value = current ?? crypto.randomUUID();
         }
@@ -626,54 +745,67 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
         unavailable = true;
         logFailure(ctx.logger, "catalog read failed", failureRecord({ connector: connectorId }, error));
     }
+    // The queue retains only a Promise turn. Awaiting it in this caller's
+    // request preserves workerd I/O ownership; the listing program stays native.
     let tail = Promise.resolve();
-    const withListing = (listingCtx, read) => {
-        const pending = tail.then(async () => {
+    const withListing = cacheMethod((listingCtx, read) => authFlow(function* () {
+        const previous = tail;
+        let release;
+        tail = new Promise((resolve) => {
+            release = resolve;
+        });
+        let entered = false;
+        try {
+            yield authValue(() => previous);
+            entered = true;
             if (scope.closed || connectionSignal?.aborted)
                 throw new ConnectorCallError("connector_call_failed", "Catalog cache scope ended.");
             if (listingCtx.signal?.aborted)
                 throw listingCtx.signal.reason;
-            if (policy && !settings.has(listingCtx))
-                settings.set(listingCtx, policy);
+            if (policy && serviceFor(listingCtx, CatalogPolicy) === undefined)
+                setViewService(listingCtx, CatalogPolicy, policy);
             const listing = { ctx: listingCtx, generation: {}, ended: false };
             active = listing;
             staleTools = undefined;
             const operation = capture();
             try {
                 if (resolveCredentialIdentity)
-                    listing.credentialIdentity = await operation.io(resolveCredentialIdentity);
-                // Each new listing pins before even a refresh's first wire page. A
-                // notification fences this listing, while a later listing can refresh.
+                    listing.credentialIdentity = yield authInvoke(operation, "io", [resolveCredentialIdentity]);
                 if (!operation.stopped()) {
                     try {
-                        listing.generation.value =
-                            (await operation.io(() => storage.get(responseCacheKeys.generation(connectorId)))) ?? crypto.randomUUID();
-                        connectionGeneration.value = listing.generation.value;
+                        const generation = (yield authInvoke(operation, "io", [
+                            cacheMethod(() => authStorage(storage, "get", [responseCacheKeys.generation(connectorId)])),
+                        ])) ?? crypto.randomUUID();
+                        listing.generation.value = generation;
+                        connectionGeneration.value = generation;
                     }
                     catch (error) {
                         if (operation.stopped())
                             throw error;
                         unavailable = true;
-                        logFailure(ctx.logger, "catalog read failed", failureRecord({ connector: connectorId }, error));
+                        logFailure(listingCtx.logger, "catalog read failed", failureRecord({ connector: connectorId }, error));
                     }
                 }
-                return await read();
+                return yield authCall(read, []);
             }
             finally {
                 listing.ended = true;
                 active = undefined;
             }
-        });
-        // Keep the binding through the entire SDK method, including its opposite
-        // partition delete even when set() failed. Only then may a sibling bind.
-        tail = pending.then(() => { }, () => { });
-        return pending;
-    };
-    const fallbackTools = async () => {
+        }
+        finally {
+            // A cancelled queued waiter cannot unlock the listing ahead of it.
+            if (entered)
+                release();
+            else
+                void previous.then(release);
+        }
+    }));
+    const fallbackTools = cacheMethod(() => authFlow(function* () {
         const operation = capture();
         if (!staleTools ||
             operation.stopped() ||
-            !(await namespace(operation)) ||
+            !(yield authCall(namespace, [operation])) ||
             operation.stopped() ||
             staleTools.manifest.expiresAt + STALE_FALLBACK_MS <= Date.now())
             return;
@@ -681,7 +813,7 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
         observeCatalogFetch(operation.ctx, manifest.fetchedAt);
         observeCatalogExpiry(operation.ctx, "tools/list", typeof result.ttlMs === "number" ? result.ttlMs : 0, manifest.expiresAt, true);
         return result;
-    };
+    }));
     return {
         intake,
         completeCatalogRefresh,
@@ -692,48 +824,72 @@ export async function catalogClientOptions(ctx, connectorId, config, authPartiti
         withListing,
         currentContext: () => active?.ctx ?? ctx,
     };
-}
+}));
 function isCatalogMethod(method) {
     return method === "tools/list" || method === "resources/list" || method === "resources/templates/list";
 }
-async function customCatalogCache(ctx, connectorId) {
-    const credential = await ctx.credential?.getAll();
-    const auth = (await fingerprintSerializedCatalog(JSON.stringify(credential ?? null))).fingerprint;
-    const cache = await catalogClientOptions(ctx, connectorId, "custom-connector", auth);
-    const key = { method: "tools/list", partition: JSON.stringify(["custom-connector", cache.cachePartition]) };
-    return { cache, key };
+function customCatalogCache(ctx, connectorId) {
+    return runEdge(authProgram(customCatalogCacheNative, [
+        ctx,
+        connectorId,
+    ]));
 }
+const customCatalogCacheNative = /* @__PURE__ */ registerAuth(customCatalogCache, (ctx, connectorId) => authFlow(function* () {
+    const credential = (yield authValue(() => ctx.credential?.getAll()));
+    const auth = (yield authCall(fingerprintSerializedCatalog, [JSON.stringify(credential ?? null)])).fingerprint;
+    const cache = (yield authCall(catalogClientOptions, [ctx, connectorId, "custom-connector", auth]));
+    const key = {
+        method: "tools/list",
+        partition: JSON.stringify(["custom-connector", cache.cachePartition]),
+    };
+    return { cache, key };
+}));
 /** Custom listings always fetch. Only an authenticated owner may retain a
  * complete private fallback; unscoped/operator reads start no cache I/O. */
-export async function storeCustomCatalogFallback(ctx, connectorId, tools) {
+export function storeCustomCatalogFallback(ctx, connectorId, tools) {
+    return runEdge(authProgram(storeCustomCatalogFallbackNative, [ctx, connectorId, tools]));
+}
+const storeCustomCatalogFallbackNative = /* @__PURE__ */ registerAuth(storeCustomCatalogFallback, (ctx, connectorId, tools) => authFlow(function* () {
     const ttlMs = catalogTtlMs(ctx, undefined);
     observeCatalogFetch(ctx, Date.now());
     observeCatalogExpiry(ctx, "tools/list", ttlMs);
     if (!ttlMs || !callerOf(ctx)?.authenticated)
         return;
-    const { cache, key } = await customCatalogCache(ctx, connectorId);
-    await cache.withListing(ctx, async () => {
-        const result = catalogIntake(ctx, {
-            tools: tools.map((tool) => ({
-                ...tool,
-                inputSchema: tool.inputSchema ?? { type: "object" },
-            })),
-            ttlMs,
-            cacheScope: "private",
-        });
-        await cache.responseCacheStore.set(key, {
-            value: JSON.stringify(result),
-            expiresAt: catalogExpiry(ctx).expiresAt,
-            scope: "private",
-        });
-    });
+    const { cache, key } = (yield authCall(customCatalogCache, [ctx, connectorId]));
+    (yield authInvoke(cache, "withListing", [
+        ctx,
+        authMethod(() => authFlow(function* () {
+            const result = catalogIntake(ctx, {
+                tools: tools.map((tool) => ({
+                    ...tool,
+                    inputSchema: tool.inputSchema ?? { type: "object" },
+                })),
+                ttlMs,
+                cacheScope: "private",
+            });
+            (yield authInvoke(cache.responseCacheStore, "set", [
+                key,
+                {
+                    value: JSON.stringify(result),
+                    expiresAt: catalogExpiry(ctx).expiresAt,
+                    scope: "private",
+                },
+            ]));
+        })),
+    ]));
+}));
+export function customCatalogFallback(ctx, connectorId) {
+    return runEdge(authProgram(customCatalogFallbackNative, [ctx, connectorId]));
 }
-export async function customCatalogFallback(ctx, connectorId) {
+const customCatalogFallbackNative = /* @__PURE__ */ registerAuth(customCatalogFallback, (ctx, connectorId) => authFlow(function* () {
     if (!callerOf(ctx)?.authenticated)
         return;
-    const { cache, key } = await customCatalogCache(ctx, connectorId);
-    return cache.withListing(ctx, async () => {
-        await cache.responseCacheStore.get(key);
-        return (await cache.fallbackTools())?.tools;
-    });
-}
+    const { cache, key } = (yield authCall(customCatalogCache, [ctx, connectorId]));
+    return (yield authInvoke(cache, "withListing", [
+        ctx,
+        authMethod(() => authFlow(function* () {
+            (yield authInvoke(cache.responseCacheStore, "get", [key]));
+            return (yield authInvoke(cache, "fallbackTools", []))?.tools;
+        })),
+    ]));
+}));