@zackbart/connecta 0.34.0 → 0.35.0

package/dist/connectors/remote-mcp.js

@@ -1,55 +1,85 @@
+import { authView } from "../auth/native-call.js";
+import { authFlow, authCall, authInvoke, authValue, authMethod, authCatch } from "../auth/native.js";
+import { isOAuthCredentialRequest } from "../auth/oauth-token-response.js";
+import { deriveContext } from "../derived-context.js";
+import { operationContext, openRequest, viewServices, viewSignal } from "../runtime/call.js";
 import { assertRemoteOAuthClient, declareSelfHostedClient, downstreamClientMetadata, downstreamRedirectUri, remoteClientAuthMethod, selfHostedClientUrl, trackRemoteClientRequest, } from "../auth/downstream-client-metadata.js";
 import { AuthorizationServerMismatchError, Client, InsecureTokenEndpointError, InsufficientScopeError, IssuerMismatchError, MissingRequiredClientCapabilityError, OAuthClientFlowError, OAuthError, ProtocolError, RegistrationRejectedError, ResourceNotFoundError, SdkError, SdkErrorCode, SdkHttpError, SseError, UnsupportedProtocolVersionError, UrlElicitationRequiredError, isInputRequiredResult, fromJsonSchema, isJSONRPCErrorResponse, isJSONRPCNotification, specTypeSchemas, StreamableHTTPClientTransport, UnauthorizedError, } from "@modelcontextprotocol/client";
 import { Deferred, Duration, Effect, Exit, Scope } from "effect";
-import { assertOAuthScope, authorizingContext, KvOAuthProvider, OAuthRequestNotSentError, refreshCoordinatorsByPartition, } from "../auth/downstream-oauth.js";
+import { assertOAuthScope, authorizingContext, codeExchangeResponse, KvOAuthProvider, OAuthRequestNotSentError, refreshCoordinatorsByPartition, } from "../auth/downstream-oauth.js";
 import { trackOAuthStartReset } from "../auth/oauth-start-reset.js";
 import { byteReadResponse } from "../byte-read-response.js";
-import { redactCatalog, redactSentSecrets, sentSecretsFor, shortSecretWarning, trackCredentialReads, } from "../sent-secrets.js";
+import { redactCatalog, redactSentSecrets, requestSentSecrets, sentSecretsFor, shortSecretWarning, trackCredentialReads, } from "../sent-secrets.js";
 import { MAX_CATALOG_TOOLS, MAX_SERIALIZED_CATALOG_BYTES } from "../catalog-limits.js";
 import { catalogClientOptions, catalogItems, observeCompletedCatalogRefresh, closeCatalogCacheScope, observeCatalogChange, observeCatalogFetch, observeCatalogExpiry, } from "../catalog-cache.js";
-import { reviewedClassification } from "../catalog-drift.js";
 import { connectorScopeCleanupClaimed } from "../connector-scope.js";
-import { boundedEchoText, ConnectorCallError, msg, networkErrorCode, unavailableCallError, WithheldTextError, } from "../errors.js";
+import { boundedEchoText, ConnectorCallError, msg, networkErrorCode, resendAdvice, resendAdviceOf, unavailableCallError, WithheldTextError, withResendAdvice, } from "../errors.js";
 import { attachFailureFacts, carryFailureFacts, errorLabel, failureRecord, failureStatus, labelErrorClass, logFailure, OAUTH_ERROR_CODES, ownStatus, } from "../operator-record.js";
 import { CONNECTA_VERSION } from "../version.js";
 import { learnedUrlRefusal } from "../url-safety.js";
 import { oauthSealerFor } from "../oauth-sealing.js";
-import { retainingOAuthPartition } from "../oauth-partition.js";
+import { oauthPartitionFor, retainOAuthPartition } from "../oauth-partition.js";
+import { RequestScope } from "../runtime/request-scope.js";
+import { registerCallEntry } from "../runtime/call-entry.js";
+import { Context } from "effect";
 import { registerInvocationAuth } from "../invocation-auth.js";
 import { downstreamInputCapabilities, assertDownstreamOutputSafe, downstreamWriteContinuation, } from "../downstream-input-context.js";
 import { detach, runEdge } from "../runtime/run.js";
-import { assertKnownOptions, keys, optionsOf } from "../config-schema.js";
+import { assertKnownOptions, keys, optionsOf, strings } from "../config-schema.js";
 import { describedEndpoint, describedUrl } from "../described.js";
-import { retryAfterMs } from "./guarded-fetch.js";
+import { retryAfterMs } from "../http-policy.js";
 import { resourceUriMatchesTemplates } from "./resource-uri.js";
 import { callerOf } from "../connector-caller.js";
+import { callClassification } from "../call-classification.js";
+import { guardedTransport, sendGuarded, sendCredentialPost } from "../guarded-transport.js";
+import { sourceClassification } from "../tool-safety.js";
+import { dispatchProviderRequest, recordProviderResponse, enterProviderBoundary, knownProviderFailure, providerBoundary, providerRequest, renewedAfterUnauthorized, vendorRefusal, } from "../provider-call.js";
+import { providerCallFailure, unsentAfterUnauthorized } from "../write-outcome.js";
+import { recordRequestField } from "../provider-call-facts.js";
 import { readNegotiation, storeNegotiation } from "./negotiation-cache.js";
-import { CALL_ADMISSION, REMOTE_MCP_AUTH, USAGE_GUIDE } from "./option-shapes.js";
-/**
- * Apply a maintained provider's slot copy and header framing to credential
- * auth the deployment left bare.
- *
- * A provider knows what its own key is called and how the endpoint expects it
- * framed; a deployment that states either one keeps its answer. Every other
- * auth shape passes through untouched, so a provider can hand this its whole
- * `auth` option without branching first.
- */
-export function withCredentialDefaults(auth, defaults) {
-    if (auth.type !== "credential")
-        return auth;
-    return {
-        ...auth,
-        credential: auth.credential ?? defaults.credential,
-        ...(auth.scheme === undefined && defaults.scheme !== undefined ? { scheme: defaults.scheme } : {}),
-    };
-}
+import { READ_ONLY, CALL_ADMISSION, REMOTE_MCP_AUTH, USAGE_GUIDE } from "./option-shapes.js";
 /** The closed options remoteMcp() accepts; see `assertKnownOptions`. */
 const REMOTE_MCP_OPTIONS = optionsOf()({
-    ...keys("url", "title", "description", "authScope", "maxResultBytes", "versionNegotiation", "redirects", "requireHttps", "logger", "_transportFactory", "classify", "skills"),
+    ...keys("url", "title", "description", "authScope", "maxResultBytes", "versionNegotiation", "redirects", "requireHttps", "logger", "_transportFactory", "skills"),
+    readOnly: READ_ONLY,
     callAdmission: CALL_ADMISSION,
     usageGuide: USAGE_GUIDE,
     auth: REMOTE_MCP_AUTH,
+    headers: strings(),
 });
+/** Extra headers are immutable code configuration, not another auth channel. */
+function extraResourceHeaders(id, opts) {
+    if (opts.headers === undefined)
+        return undefined;
+    const refuse = () => new Error(`remoteMcp(${JSON.stringify(id)}).headers requires non-secret resource headers without reserved or auth-owned names; use auth for credentials.`);
+    if (opts.auth?.type === "headers")
+        throw refuse();
+    const authNames = new Set([
+        "authorization",
+        ...(opts.auth?.type === "credential" ? [opts.auth.header?.trim().toLowerCase() || "authorization"] : []),
+        ...(opts.auth?.type === "request" ? Object.keys(opts.auth.headers ?? {}).map((name) => name.toLowerCase()) : []),
+    ]);
+    const normalized = Object.create(null);
+    for (const [name, value] of Object.entries(opts.headers)) {
+        const lower = name.toLowerCase();
+        if (!HEADER_NAME_TOKEN.test(name) ||
+            typeof value !== "string" ||
+            /[\r\n]/.test(value) ||
+            Object.hasOwn(normalized, lower) ||
+            authNames.has(lower) ||
+            /^(?:accept|cookie|host|origin|connection|keep-alive|proxy-authenticate|proxy-authorization|te|trailer|transfer-encoding|upgrade|last-event-id|dpop|www-authenticate)$/.test(lower) ||
+            /^(?:content-|mcp-)/.test(lower) ||
+            /(?:api[-_]?key|token|secret|password|credential|authorization|signature|session)/.test(lower))
+            throw refuse();
+        try {
+            normalized[lower] = new Headers({ [lower]: value }).get(lower);
+        }
+        catch {
+            throw refuse();
+        }
+    }
+    return Object.freeze(Object.fromEntries(Object.entries(normalized).sort(([a], [b]) => a.localeCompare(b))));
+}
 /**
  * How long a downstream gets to answer the session-termination DELETE before
  * teardown stops waiting. This is a network round-trip budget, deliberately
@@ -454,10 +484,11 @@ function isCursorShapeError(err) {
  * passed the MCP and OAuth boundaries, and the origin and errno connecta
  * derived for it, which a message alone would drop.
  */
+/** An authorization start's failure for authorize_connector: no write's, so its advice stays. */
 function startMessage(err) {
     const details = err instanceof ConnectorCallError ? err.details : undefined;
     const facts = [details?.host, details?.code].filter(Boolean).join(", ");
-    return facts ? `${msg(err)} (${facts})` : msg(err);
+    return withResendAdvice(facts ? `${msg(err)} (${facts})` : msg(err), resendAdviceOf(err));
 }
 /**
  * End the downstream's session before the connection is torn down.
@@ -498,7 +529,7 @@ function terminateSession(transport, logger, connectorId) {
     return Effect.raceAllFirst([
         // The SDK issues no request at all when no `mcp-session-id` was captured,
         // so a stateless downstream never sees a spurious DELETE.
-        promised(() => Promise.resolve(terminate.call(transport))).pipe(Effect.catch((error) => 
+        promised(authMethod(() => authInvoke(Reflect, "apply", [terminate, transport, []]))).pipe(Effect.catch((error) => 
         // The SDK's error quotes the downstream's status text, and its `data`
         // the body, so the record keeps only the status it answered with.
         warn(() => logFailure(logger, "session termination refused or failed; the downstream session may remain until its provider timeout", failureRecord({ connector: connectorId }, error instanceof SdkHttpError ? attachFailureFacts(error, { httpStatus: error.status }) : error))))),
@@ -519,7 +550,7 @@ function closeLocally(client, transport) {
     if (!client && !transport)
         return Effect.void;
     return Effect.raceAllFirst([
-        promised(() => Promise.resolve(client ? client.close() : transport?.close())).pipe(Effect.ignore),
+        promised(authMethod(() => (client ? authInvoke(client, "close", []) : authValue(() => transport?.close())))).pipe(Effect.ignore),
         Effect.sleep(Duration.millis(LOCAL_CLOSE_BUDGET_MS)),
     ]);
 }
@@ -530,7 +561,7 @@ function closeLocally(client, transport) {
  * allocates no AbortController.
  */
 function promised(evaluate) {
-    return Effect.tryPromise({ try: evaluate, catch: (error) => error });
+    return authCall(evaluate, []);
 }
 /** A retained cause chain must not smuggle an SDK payload past the boundary. */
 function hasSdkPayload(error) {
@@ -544,14 +575,14 @@ function hasSdkPayload(error) {
 }
 /** Cancellation can bypass an inner SDK catch and return the signal's reason. */
 function payloadFree(run) {
-    return async (...args) => {
+    return authMethod((...args) => authFlow(function* () {
         try {
-            return await run(...args);
+            return (yield authCall(run, [...args]));
         }
         catch (error) {
             throw hasSdkPayload(error) ? carryFailureFacts(error, downstreamCallError(error)) : error;
         }
-    };
+    }));
 }
 /** Both the SDK's auth signal and its classified form invalidate a live client. */
 function requiresAuthorization(error) {
@@ -651,7 +682,7 @@ async function digestOf(value) {
  *
  * A scheme ending in `Basic` names HTTP Basic credentials wherever a provider
  * nests it, so the `user:secret` it frames is base64-encoded — that is what
- * makes plain `Basic` and Mixpanel's `Bearer Basic` one rule instead of two.
+ * makes plain `Basic` and nested `Bearer Basic` one rule instead of two.
  */
 function credentialHeaderValue(scheme, value) {
     if (scheme === null)
@@ -725,7 +756,7 @@ function redirectedInit(init, status) {
  * arbitrary static header names receive the same protection as Authorization.
  */
 export function redirectSafeFetch(connectorId, policy = "none", baseFetch = fetch) {
-    return async (input, initialInit = {}) => {
+    return authMethod((input, initialInit = {}) => authFlow(function* () {
         let current = new URL(input);
         let init = initialInit;
         const seen = new Set([current.href]);
@@ -733,22 +764,23 @@ export function redirectSafeFetch(connectorId, policy = "none", baseFetch = fetc
         while (true) {
             let response;
             try {
-                response = await baseFetch(current, {
-                    ...init,
-                    redirect: "manual",
-                });
+                response = (yield authCall(baseFetch, [
+                    current,
+                    {
+                        ...init,
+                        redirect: "manual",
+                    },
+                ]));
             }
             catch (cause) {
                 if (cause instanceof ConnectorCallError)
                     throw downstreamCallError(cause);
                 throw unavailableCallError(cause, current.href, undefined, hasSdkPayload(cause) ? undefined : (init.signal ?? undefined));
             }
-            // Every MCP and OAuth exchange reads its answer through here, and the
-            // SDK reads bodies with `.text()` and `.json()`: as bytes, never text.
             if (!REDIRECT_STATUSES.has(response.status))
                 return byteReadResponse(response);
             const location = response.headers.get("location");
-            await response.body?.cancel().catch(() => { });
+            (yield authCatch(authValue(() => response.body?.cancel()), () => { }));
             if (!location) {
                 throw new RemoteMcpRedirectError(connectorId, `HTTP ${response.status} carried no Location header`);
             }
@@ -782,7 +814,7 @@ export function redirectSafeFetch(connectorId, policy = "none", baseFetch = fetc
             init = redirectedInit(init, response.status);
             current = next;
         }
-    };
+    }));
 }
 class RemoteMcpDestinationError extends OAuthRequestNotSentError {
     constructor(connectorId, reason) {
@@ -835,13 +867,13 @@ for (const [ctor, label] of [
  * failures after an HTTP dispatch keep their permanent ambiguous verdict.
  */
 function learnedUrlSafeFetch(connectorId, configured, baseFetch) {
-    return async (input, init) => {
+    return authMethod((input, init) => authFlow(function* () {
         const reason = learnedUrlRefusal(configured, new URL(input));
         if (reason !== undefined) {
             throw new RemoteMcpDestinationError(connectorId, reason);
         }
-        return byteReadResponse(await baseFetch(input, init));
-    };
+        return byteReadResponse((yield authCall(baseFetch, [input, init])));
+    }));
 }
 /** The JSON-RPC error answers each transport delivered, as `code\0message`. */
 const wireErrors = new WeakMap();
@@ -965,6 +997,7 @@ function withheldAs(message, verdict) {
             ...(verdict.details ? { details: verdict.details } : {}),
             ...(verdict.validation ? { validation: verdict.validation } : {}),
             ...(verdict.current ? { current: verdict.current } : {}),
+            ...(verdict.writeOutcome ? { writeOutcome: verdict.writeOutcome } : {}),
         });
     }
     return new WithheldTextError(message, verdict);
@@ -976,7 +1009,7 @@ function withheldAs(message, verdict) {
  * `grant_type`), or the JSON POST of dynamic client registration.
  */
 function tracedOAuthFetch(trail, endpoint, baseFetch) {
-    return async (input, init) => {
+    return authMethod((input, init) => authFlow(function* () {
         const url = new URL(input);
         if (url.href === endpoint.href) {
             trail.last = undefined;
@@ -985,7 +1018,8 @@ function tracedOAuthFetch(trail, endpoint, baseFetch) {
             const body = init?.body;
             const step = (init?.method ?? "GET").toUpperCase() === "GET"
                 ? "discovery"
-                : body instanceof URLSearchParams || (typeof body === "string" && new URLSearchParams(body).has("grant_type"))
+                : body instanceof URLSearchParams ||
+                    (typeof body === "string" && new URLSearchParams(body).has("grant_type"))
                     ? "token request"
                     : "client registration";
             trail.last = { step, host: url.origin };
@@ -993,7 +1027,7 @@ function tracedOAuthFetch(trail, endpoint, baseFetch) {
                 trail.registration = url.origin;
         }
         const leg = trail.last;
-        const response = await baseFetch(input, init);
+        const response = (yield authCall(baseFetch, [input, init]));
         if (leg) {
             leg.httpStatus = response.status;
             const wait = retryAfterMs(response.headers);
@@ -1001,7 +1035,7 @@ function tracedOAuthFetch(trail, endpoint, baseFetch) {
                 leg.retryAfterMs = wait;
         }
         return byteReadResponse(response);
-    };
+    }));
 }
 function registrationErrorCode(body) {
     try {
@@ -1012,6 +1046,37 @@ function registrationErrorCode(body) {
         return undefined;
     }
 }
+/**
+ * The key a `tools/call`'s params carry its dispatch under. Object spread
+ * copies a symbol-keyed property, and the pinned SDK only spreads a request's
+ * params (to add a progress token or its `_meta` envelope); `JSON.stringify`
+ * skips symbol keys, so nothing of it reaches the wire.
+ */
+const DISPATCH = Symbol("connecta.dispatch");
+function newDispatch(write, sourceWrite) {
+    return { write, sourceWrite, sent: false, unauthorized: false, redirected: false, resendRefused: false };
+}
+function withDispatch(params, dispatch) {
+    Object.defineProperty(params, DISPATCH, { value: dispatch, enumerable: true });
+    return params;
+}
+function dispatchOf(params) {
+    return params !== null && typeof params === "object"
+        ? params[DISPATCH]
+        : undefined;
+}
+/** A further request for a write that already left, stopped before it does. */
+function resendRefused(dispatch) {
+    dispatch.resendRefused = true;
+    return new ConnectorCallError("connector_call_failed", "This write was already sent once; it was not sent again.", {
+        retryable: false,
+        writeOutcome: "unknown",
+    });
+}
+/** Lost tracking cannot prove whether an earlier message already sent a write. */
+function missingDispatch() {
+    return new ConnectorCallError("connector_call_failed", "The downstream call lost its dispatch record and cannot be proven read-only. It was not sent; whether an earlier write took effect is unknown. Check the target before repeating it.", { retryable: false, writeOutcome: "unknown" });
+}
 /**
  * Proxy a downstream remote MCP server. SDK clients and transports are scoped
  * to one inbound request: reused by calls within a batch/execute_code run, but
@@ -1024,13 +1089,15 @@ function registrationErrorCode(body) {
  */
 export function remoteMcp(id, opts) {
     opts = assertKnownOptions(opts, `remoteMcp(${JSON.stringify(id)})`, REMOTE_MCP_OPTIONS);
+    if (opts.readOnly !== undefined)
+        READ_ONLY.parse(opts.readOnly, `Connector(${JSON.stringify(id)}).readOnly`);
     if (opts.callAdmission !== undefined)
         CALL_ADMISSION.parse(opts.callAdmission, `remoteMcp(${JSON.stringify(id)}).callAdmission`);
+    const extraHeaders = extraResourceHeaders(id, opts);
     const skillsEnabled = opts.skills;
     if (skillsEnabled !== undefined && typeof skillsEnabled !== "boolean") {
         throw new Error(`[connecta] connector "${id}" skills must be a boolean.`);
     }
-    const classification = opts.classify === undefined ? undefined : reviewedClassification(opts.classify, `connector "${id}"`);
     const clientMetadataUrl = opts.auth?.type === "oauth" ? opts.auth.clientMetadataUrl : undefined;
     const oauthScope = opts.auth?.type === "oauth" ? opts.auth.scope : undefined;
     assertOAuthScope(id, oauthScope);
@@ -1183,40 +1250,41 @@ export function remoteMcp(id, opts) {
      * Anything not already in connecta's words is withheld, including a store's
      * error while the flow saves what it discovered, which can quote it.
      */
-    const withoutAuthorizationServerText = async (ctx, err, trail, signals) => {
-        const safeOrigin = async (host) => {
+    const withoutAuthorizationServerText = authMethod((ctx, err, trail, signals) => authFlow(function* () {
+        const safeOrigin = authMethod((host) => authFlow(function* () {
             if (!host || sentSecretsFor(ctx).contains(host, true))
                 return undefined;
             if (host === destination.origin || (staticClient && host === new URL(staticClient.issuer).origin))
                 return host;
             try {
-                return host === (await newProvider(ctx).validatedIssuerOrigin()) ? host : undefined;
+                return host === (yield authInvoke(newProvider(ctx), "validatedIssuerOrigin", []))
+                    ? host
+                    : undefined;
             }
             catch {
                 return undefined;
             }
-        };
+        }));
         if (ownAbortReason(err, signals) && !hasSdkPayload(err))
             return err;
         if (err instanceof RegistrationRejectedError) {
             const code = registrationErrorCode(err.body);
-            const origin = await safeOrigin(trail.registration);
+            const origin = (yield authCall(safeOrigin, [trail.registration]));
             const facts = {
                 step: "OAuth client registration",
                 ...(origin ? { origin } : {}),
                 httpStatus: err.status,
                 ...(code ? { oauthError: code } : {}),
             };
-            return attachFailureFacts(carryFailureFacts(err, withheldAs(`Connector "${id}" could not register an OAuth client with ` +
+            return attachFailureFacts(carryFailureFacts(err, resendAdvice(withheldAs(`Connector "${id}" could not register an OAuth client with ` +
                 `${origin ?? "its authorization server"}: the ` +
                 `registration endpoint answered HTTP ${err.status}` +
                 `${code ? ` with OAuth error ${code}` : ""}. Its response is ` +
                 "withheld because it can quote the request or anything the server " +
-                "chose to add. Check the server's client registration policy, then " +
-                "retry authorization.", downstreamCallError(err, undefined, trail.last?.retryAfterMs))), facts);
+                "chose to add. Check the server's client registration policy.", downstreamCallError(err, undefined, trail.last?.retryAfterMs)), ", then retry authorization")), facts);
         }
         const leg = trail.last;
-        const origin = await safeOrigin(leg?.host);
+        const origin = (yield authCall(safeOrigin, [leg?.host]));
         const facts = leg
             ? {
                 step: `OAuth ${leg.step}`,
@@ -1232,11 +1300,10 @@ export function remoteMcp(id, opts) {
             (classified instanceof ConnectorCallError && classified.code === "provider_permission_denied")) {
             return attachFailureFacts(carryFailureFacts(err, classified), facts);
         }
-        return attachFailureFacts(carryFailureFacts(err, withheldAs(`Connector "${id}" OAuth ${leg ? `${leg.step}${origin ? ` with ${origin}` : ""}` : "flow"} ` +
+        return attachFailureFacts(carryFailureFacts(err, resendAdvice(withheldAs(`Connector "${id}" OAuth ${leg ? `${leg.step}${origin ? ` with ${origin}` : ""}` : "flow"} ` +
             `failed${errorKind(err)}. The error is withheld because its text can ` +
-            "quote what the server sent. Check the server's OAuth metadata, then " +
-            "retry authorization.", classified)), facts);
-    };
+            "quote what the server sent. Check the server's OAuth metadata.", classified), ", then retry authorization")), facts);
+    }));
     const endpointOrigin = new URL(opts.url).origin;
     /**
      * The MCP boundary, where an error leaves the SDK at the handshake, a
@@ -1258,7 +1325,7 @@ export function remoteMcp(id, opts) {
             origin: endpointOrigin,
             ...(httpStatus ? { httpStatus } : {}),
         };
-        const classified = downstreamCallError(redactSentSecrets(ctx, err), undefined, undefined, undefined, sentSecretsFor(ctx));
+        const classified = downstreamCallError(redactSentSecrets(ctx, err), undefined, undefined, undefined, requestSentSecrets(ctx));
         const verdict = isOauth && classified instanceof ConnectorCallError && classified.code === "auth_required"
             ? carryFailureFacts(err, authRequiredError())
             : classified;
@@ -1305,7 +1372,7 @@ export function remoteMcp(id, opts) {
      */
     const boundOAuthFlows = (ctx, transport, endpoint, 
     /** The request's and connection's signals: only their reasons pass as written. */
-    signals) => {
+    signals, renewalSignal) => {
         const internals = transport;
         const adapted = internals._authProvider;
         const onUnauthorized = adapted?.onUnauthorized;
@@ -1317,29 +1384,46 @@ export function remoteMcp(id, opts) {
                 "flows cannot be bounded. Pin @modelcontextprotocol/client to the " +
                 "version this release ships with.");
         }
-        const flow = async (start) => {
+        const flow = authMethod((start, signal) => authFlow(function* () {
             const trail = {};
             try {
-                return await start((fetchFn) => tracedOAuthFetch(trail, endpoint, async (input, init) => {
-                    trackSentRequest(ctx, input, init);
-                    return await fetchFn(input, init);
-                }));
+                return (yield authCall(start, [
+                    (fetchFn) => tracedOAuthFetch(trail, endpoint, authMethod((input, init) => authFlow(function* () {
+                        trackSentRequest(ctx, input, init);
+                        return (yield authCall(fetchFn, [
+                            input,
+                            signal
+                                ? {
+                                    ...init,
+                                    signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal,
+                                }
+                                : init,
+                        ]));
+                    }))),
+                ]));
             }
             catch (err) {
-                throw await withoutAuthorizationServerText(ctx, err, trail, signals);
-            }
-        };
-        adapted.onUnauthorized = (ctx) => flow((trace) => onUnauthorized.call(adapted, { ...ctx, fetchFn: trace(ctx.fetchFn ?? fetch) }));
-        internals._stepUpAuthorize = (challenge, retries) => flow((trace) => {
-            const traced = trace(internals._fetchWithInit ?? fetch);
-            // The step-up reads its fetch from `this`; everything else it reads
-            // and writes stays the transport's own.
-            const self = new Proxy(transport, {
-                get: (target, key) => (key === "_fetchWithInit" ? traced : Reflect.get(target, key, target)),
-                set: (target, key, value) => Reflect.set(target, key, value, target),
-            });
-            return stepUp.call(self, challenge, retries);
-        });
+                throw (yield authCall(withoutAuthorizationServerText, [ctx, err, trail, [...signals, signal]]));
+            }
+        }));
+        adapted.onUnauthorized = authMethod((ctx) => authCall(flow, [
+            authMethod((trace) => authInvoke(Reflect, "apply", [
+                onUnauthorized,
+                adapted,
+                [{ ...ctx, fetchFn: trace(ctx.fetchFn ?? fetch) }],
+            ])),
+            renewalSignal(ctx.response),
+        ]));
+        internals._stepUpAuthorize = authMethod((challenge, retries) => authCall(flow, [
+            authMethod((trace) => authFlow(function* () {
+                const traced = trace(internals._fetchWithInit ?? fetch);
+                const self = new Proxy(transport, {
+                    get: (target, key) => key === "_fetchWithInit" ? traced : Reflect.get(target, key, target),
+                    set: (target, key, value) => Reflect.set(target, key, value, target),
+                });
+                return (yield authInvoke(Reflect, "apply", [stepUp, self, [challenge, retries]]));
+            })),
+        ]));
     };
     class OperatorDisconnectedError extends ConnectorCallError {
         constructor() {
@@ -1364,11 +1448,11 @@ export function remoteMcp(id, opts) {
      * trusting any cached client, so an operator's replacement is picked up
      * without a redeploy. The value stays in the caller's local scope.
      */
-    const readCredential = async (ctx) => {
+    const readCredential = authMethod((ctx) => authFlow(function* () {
         if (requestAuth) {
             let value;
             try {
-                value = await requestAuth.token(ctx);
+                value = (yield authInvoke(requestAuth, "token", [ctx]));
             }
             catch (error) {
                 if (error instanceof ConnectorCallError)
@@ -1390,19 +1474,12 @@ export function remoteMcp(id, opts) {
             throw new CredentialRequiredError(`Connector "${id}" needs an operator-managed credential, but ` +
                 "credential storage is not configured. Configure vault in deployment code and redeploy. Call authorize_connector for recovery options.");
         }
-        // A stored-shape mismatch already arrives as a typed auth_required from
-        // the registry's accessor; nothing to reclassify here.
-        const value = (await ctx.credential.get())?.trim();
+        const value = (yield authInvoke(ctx.credential, "get", []))?.trim();
         if (!value) {
             throw new CredentialRequiredError(`Connector "${id}" has no stored credential — call ` +
                 `authorize_connector({ connector: "${id}" }) and follow the ` +
                 "operator handoff it returns.");
         }
-        // Refuse a value a header cannot carry BEFORE anything frames it. A
-        // wrapped newline in a pasted key is the ordinary way this happens, and
-        // the runtime that rejects the header quotes the whole value back in its
-        // TypeError — a message that travels to status, to the activity log, and
-        // to the agent. So the check lives here, and says only what is wrong.
         if (carriesIllegalHeaderChar(value)) {
             throw new CredentialRequiredError(`Connector "${id}"'s stored credential contains a character a header ` +
                 "cannot carry (a line break or other control character). Call " +
@@ -1410,7 +1487,7 @@ export function remoteMcp(id, opts) {
                 "it in this connection in the operator UI. The value is not shown or logged.");
         }
         return value;
-    };
+    }));
     /**
      * Replace, never edit.
      *
@@ -1468,48 +1545,59 @@ export function remoteMcp(id, opts) {
             });
         };
         const listTools = client.listTools.bind(client);
-        client.listTools = (params, options) => cache.withListing(listingContext(options), async () => {
-            const before = toolPages;
-            let result;
-            try {
-                result = await listTools(params, options);
-            }
-            catch (error) {
-                const bounded = atMcpBoundary(cache.currentContext(), error, "tools/list", client.transport, [
-                    cache.currentContext().signal,
-                ]);
-                const transient = (error instanceof SdkHttpError && [502, 503, 504].includes(error.status)) ||
-                    (bounded instanceof ConnectorCallError && bounded.code === "unavailable");
-                const fallback = transient && toolPages === before ? await cache.fallbackTools() : undefined;
-                if (!fallback)
-                    throw error;
-                return fallback;
-            }
-            if (toolPages !== before && params?.cursor === undefined) {
-                const refresh = await cache.completeCatalogRefresh(result);
-                if (refresh) {
-                    try {
-                        await observeCompletedCatalogRefresh(cache.currentContext(), refresh);
-                    }
-                    catch (error) {
-                        logFailure(cache.currentContext().logger, "catalog refresh observation failed", failureRecord({ connector: id }, error));
+        client.listTools = authMethod((params, options) => authInvoke(cache, "withListing", [
+            listingContext(options),
+            authMethod(() => authFlow(function* () {
+                const before = toolPages;
+                let result;
+                try {
+                    result = (yield authCall(listTools, [params, options]));
+                }
+                catch (error) {
+                    const bounded = atMcpBoundary(cache.currentContext(), error, "tools/list", client.transport, [
+                        cache.currentContext().signal,
+                    ]);
+                    const transient = (error instanceof SdkHttpError && [502, 503, 504].includes(error.status)) ||
+                        (bounded instanceof ConnectorCallError && bounded.code === "unavailable");
+                    const fallback = transient && toolPages === before
+                        ? (yield authInvoke(cache, "fallbackTools", []))
+                        : undefined;
+                    if (!fallback)
+                        throw error;
+                    return fallback;
+                }
+                if (toolPages !== before && params?.cursor === undefined) {
+                    const refresh = (yield authInvoke(cache, "completeCatalogRefresh", [result]));
+                    if (refresh) {
+                        try {
+                            (yield authCall(observeCompletedCatalogRefresh, [cache.currentContext(), refresh]));
+                        }
+                        catch (error) {
+                            logFailure(cache.currentContext().logger, "catalog refresh observation failed", failureRecord({ connector: id }, error));
+                        }
                     }
                 }
-            }
-            return result;
-        });
+                return result;
+            })),
+        ]));
         const listResources = client.listResources.bind(client);
-        client.listResources = (params, options) => cache.withListing(listingContext(options), () => listResources(params, options));
+        client.listResources = authMethod((params, options) => authInvoke(cache, "withListing", [
+            listingContext(options),
+            authMethod(() => authCall(listResources, [params, options])),
+        ]));
         const listResourceTemplates = client.listResourceTemplates.bind(client);
-        client.listResourceTemplates = (params, options) => cache.withListing(listingContext(options), () => listResourceTemplates(params, options));
+        client.listResourceTemplates = authMethod((params, options) => authInvoke(cache, "withListing", [
+            listingContext(options),
+            authMethod(() => authCall(listResourceTemplates, [params, options])),
+        ]));
         const request = client.request.bind(client);
         const walks = new WeakMap();
-        client.request = (async (...args) => {
+        client.request = authMethod((...args) => authFlow(function* () {
             const message = args[0];
             if (message.method !== "tools/list" &&
                 message.method !== "resources/list" &&
                 message.method !== "resources/templates/list")
-                return Reflect.apply(request, client, args);
+                return yield authCall(request, args, client);
             const method = message.method;
             const ctx = cache.currentContext();
             const options = (args.length === 3 ? args[2] : args[1]);
@@ -1525,11 +1613,15 @@ export function remoteMcp(id, opts) {
             }
             let page;
             try {
-                page = await request(message, method === "tools/list"
-                    ? CompatibleListToolsResultSchema
-                    : method === "resources/list"
-                        ? specTypeSchemas.ListResourcesResult
-                        : specTypeSchemas.ListResourceTemplatesResult, options);
+                page = (yield authCall(request, [
+                    message,
+                    method === "tools/list"
+                        ? CompatibleListToolsResultSchema
+                        : method === "resources/list"
+                            ? specTypeSchemas.ListResourcesResult
+                            : specTypeSchemas.ListResourceTemplatesResult,
+                    options,
+                ]));
             }
             catch (error) {
                 if (isCursorShapeError(error))
@@ -1575,19 +1667,18 @@ export function remoteMcp(id, opts) {
             if (!walk.first)
                 walk.first = result;
             else {
-                // SDK aggregation retains page-one metadata. A later page may only
-                // narrow its reuse grant, never broaden the complete catalog's scope.
                 walk.first.ttlMs = Math.min(walk.first.ttlMs, clean.ttlMs);
                 if (clean.cacheScope !== "public")
                     walk.first.cacheScope = "private";
             }
             observeCatalogExpiry(ctx, method, walk.first.ttlMs);
             return result;
-        });
+        }));
     };
     /** This request scope's entry, open or closed, created on first sight. */
     const entryFor = (ctx) => {
-        const key = ctx.requestScope ?? ctx;
+        const owner = Context.get(viewServices(ctx), RequestScope);
+        const key = owner;
         let state = states.get(key);
         if (!state) {
             state = {
@@ -1596,6 +1687,7 @@ export function remoteMcp(id, opts) {
                 client: null,
                 transport: null,
                 toolDefinitions: new Map(),
+                dispatches: new Map(),
                 connecting: null,
                 authRequired: false,
                 provider: null,
@@ -1604,6 +1696,13 @@ export function remoteMcp(id, opts) {
                 credentialDigest: null,
             };
             states.set(key, state);
+            const owned = state;
+            owner.own(() => {
+                const closing = Scope.closeUnsafe(owned.scope, Exit.void);
+                reset(owned);
+                if (closing)
+                    detach(closing);
+            });
         }
         return state;
     };
@@ -1614,7 +1713,7 @@ export function remoteMcp(id, opts) {
             throw scopeEndedError();
         return state;
     };
-    const newProvider = (ctx, state, signal = ctx.signal) => {
+    const newProvider = (ctx, state, signal = viewSignal(ctx, true)) => {
         if (state?.provider)
             return state.provider;
         const metadataUrl = staticClient ? undefined : (clientMetadataUrl ?? selfHostedClientUrl(ctx.publicUrl, id));
@@ -1647,76 +1746,250 @@ export function remoteMcp(id, opts) {
      * by the caller so the raw secret is not passed around twice. Never
      * retained past the transport it configures.
      */
-    credentialFramed = null, signal = ctx.signal, 
+    credentialFramed = null, signal = viewSignal(ctx, true), 
     /** The raw value behind `credentialFramed`, under the same terms. */
-    credentialValue = null) => {
+    credentialValue = null, 
+    /** A code exchange never transfers ownership to the refresh coordinator. */
+    exchangeOnly = false) => {
+        const resourceInit = (input, init) => {
+            if (!extraHeaders)
+                return init;
+            const target = new URL(input instanceof Request ? input.url : String(input));
+            const resource = new URL(opts.url);
+            if (target.origin !== resource.origin || target.pathname !== resource.pathname)
+                return init;
+            const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+            for (const [name, value] of Object.entries(extraHeaders))
+                headers.set(name, value);
+            return { ...init, headers };
+        };
+        const initiatingSignal = ctx.signal;
+        ctx = deriveContext(operationContext(ctx), signal ? { signal } : {});
         if (opts._transportFactory)
             return opts._transportFactory(ctx);
         const url = new URL(opts.url);
-        const trackedFetch = async (input, init) => {
-            trackSentRequest(ctx, input, init);
+        // Missing records never acquire a fresh write attempt. Only active calls
+        // for this exact tool, all classified read, can prove a recordless message
+        // safe. Catalog hints alone cannot prove the invocation's served verdict.
+        const untrackedRead = (params) => {
+            if (!skillObject(params) || typeof params.name !== "string")
+                return false;
+            let read = false;
+            for (const [dispatch, name] of entryFor(ctx).dispatches) {
+                if (name !== params.name)
+                    continue;
+                if (dispatch.write)
+                    return false;
+                read = true;
+            }
+            return read;
+        };
+        // This transport's calls on the wire, by JSON-RPC id, while each is sent.
+        const flights = new Map();
+        const trackedFetch = authMethod((input, init) => authFlow(function* () {
             let rpc;
             if (typeof init?.body === "string") {
                 try {
                     rpc = JSON.parse(init.body);
                 }
-                catch {
-                    /* OAuth exchanges can send form-encoded bodies. */
+                catch { }
+            }
+            const toolCall = init?.method === "POST" && skillObject(rpc) && rpc.method === "tools/call" ? rpc : undefined;
+            const writeContinuation = downstreamWriteContinuation(ctx.requestScope ?? ctx) && toolCall !== undefined;
+            const flight = toolCall && (typeof toolCall.id === "string" || typeof toolCall.id === "number")
+                ? flights.get(toolCall.id)
+                : undefined;
+            if (toolCall && !flight && !untrackedRead(toolCall.params))
+                throw missingDispatch();
+            const credentialPost = isOauth && (init?.method ?? "GET").toUpperCase() === "POST" && (!skillObject(rpc) || rpc.jsonrpc !== "2.0");
+            const sender = flight?.write ? guardedTransport(true) : undefined;
+            if (flight?.write) {
+                if (flight.sent) {
+                    if (flight.request && flight.authorization)
+                        renewedAfterUnauthorized(flight.request.entry, flight.authorization, new Headers(init?.headers).get("authorization") ?? flight.authorization);
+                    throw resendRefused(flight);
                 }
+                flight.authorization = new Headers(init?.headers).get("authorization");
+            }
+            const request = flight?.request;
+            if (request?.entry.dispatched)
+                request.entry = providerRequest(request.ctx, !flight?.write, request.entry.provider, {
+                    method: init?.method ?? "GET",
+                });
+            const entry = request?.entry;
+            const dispatch = () => {
+                if (flight?.write) {
+                    if (flight.sent)
+                        throw resendRefused(flight);
+                    flight.sent = true;
+                }
+                if (request && entry) {
+                    if (flight?.sourceWrite)
+                        recordRequestField(entry, "sourceWrite", true);
+                    dispatchProviderRequest(request.ctx, entry, init?.headers, init?.method ?? "GET");
+                }
+            };
+            trackSentRequest(ctx, input, init);
+            // Attach retained settlement facts at the physical Promise leaf.
+            // Cancellation may end the native waiter before it resumes; neither
+            // the status nor a 401 verdict may disappear with that live authority.
+            const response = (yield authValue(() => {
+                const pending = credentialPost
+                    ? sendCredentialPost(input, init ?? {}, dispatch)
+                    : sender
+                        ? sendGuarded(sender, new URL(input instanceof Request ? input.url : String(input)), { ...init, redirect: "manual" }, dispatch)
+                        : (() => {
+                            dispatch();
+                            return writeContinuation ? fetch(input, { ...init, redirect: "manual" }) : fetch(input, init);
+                        })();
+                return pending.then((response) => {
+                    if (entry)
+                        recordProviderResponse(entry, response.status);
+                    if (flight?.write) {
+                        if (response.status === 401)
+                            flight.unauthorized = true;
+                        else if (REDIRECT_STATUSES.has(response.status))
+                            flight.redirected = true;
+                    }
+                    if (init?.signal?.aborted || request?.ctx.signal?.aborted)
+                        void response.body?.cancel().catch(() => { });
+                    return response;
+                });
+            }));
+            if (credentialPost && !isOAuthCredentialRequest(init) && REDIRECT_STATUSES.has(response.status)) {
+                (yield authCatch(authValue(() => response.body?.cancel()), () => { }));
+                throw new ConnectorCallError("connector_call_failed", "OAuth registration endpoint redirected; the request was not repeated.", { retryable: false });
             }
-            const writeContinuation = downstreamWriteContinuation(ctx.requestScope ?? ctx) &&
-                init?.method === "POST" &&
-                skillObject(rpc) &&
-                rpc.method === "tools/call";
-            const response = writeContinuation
-                ? await fetch(input, { ...init, redirect: "manual" })
-                : await fetch(input, init);
             if (writeContinuation && (response.status === 401 || (response.status >= 300 && response.status < 400))) {
-                await response.body?.cancel().catch(() => { });
-                // Stop before the SDK can refresh auth or follow a redirect and resend
-                // this write. The host's one-use continuation nonce remains spent.
+                (yield authCatch(authValue(() => response.body?.cancel()), () => { }));
                 if (response.status === 401)
                     throw authRequiredError();
-                throw new ConnectorCallError("connector_call_failed", "The downstream redirected a write continuation; it was not repeated.", { retryable: false });
+                throw new ConnectorCallError("connector_call_failed", "The downstream redirected a write continuation; it was not repeated.", { retryable: false, writeOutcome: "unknown" });
+            }
+            if (flight?.redirected) {
+                (yield authCatch(authValue(() => response.body?.cancel()), () => { }));
+                throw new ConnectorCallError("connector_call_failed", "The downstream answered this write with a redirect; it was not sent again.", { retryable: false, writeOutcome: "unknown" });
             }
             if (skillsEnabled && skillObject(rpc) && (rpc.method === "skills/list" || rpc.method === "resources/read")) {
-                return boundedSkillResponse(response, rpc.method === "skills/list" ? MAX_SERIALIZED_CATALOG_BYTES : MAX_SKILL_READ_RPC_BYTES, rpc.id, init?.signal);
+                return (yield authCall(boundedSkillResponse, [
+                    response,
+                    rpc.method === "skills/list" ? MAX_SERIALIZED_CATALOG_BYTES : MAX_SKILL_READ_RPC_BYTES,
+                    rpc.id,
+                    init?.signal,
+                ]));
             }
             return response;
-        };
+        }));
         // A runtime refusing the assembled header quotes it, and the transport
         // error below keeps none of what the runtime said. So whether the
         // rejection quoted the credential is decided here, first, and survives
         // as the class of the error rather than as its text.
         const guardedFetch = redirectSafeFetch(id, opts.redirects, credentialFramed === null
             ? trackedFetch
-            : async (input, init) => {
+            : authMethod((input, init) => authFlow(function* () {
                 try {
-                    return await trackedFetch(input, init);
+                    return (yield authCall(trackedFetch, [input, init]));
                 }
                 catch (err) {
                     throw withoutCredential(err, credentialValue, credentialFramed);
                 }
-            });
+            })));
         if (opts.auth?.type === "oauth") {
             const oauthProvider = provider ?? newProvider(ctx, undefined, signal);
+            // The session/provider belong to the request. A renewal belongs to the
+            // exact call whose HTTP response challenged it, until claim submission.
+            // Carry that ownership on the response the SDK passes to onUnauthorized;
+            // a shared mutable "current call" would borrow a concurrent call's lease.
+            const renewalSignals = new WeakMap();
+            const exchangeFetch = (send) => exchangeOnly
+                ? authMethod((input, init) => authView(ctx, authMethod((requestSignal) => authFlow(function* () {
+                    const response = (yield authCall(send, [
+                        input,
+                        {
+                            ...init,
+                            signal: init?.signal ? AbortSignal.any([requestSignal, init.signal]) : requestSignal,
+                        },
+                    ]));
+                    if (requestSignal.aborted) {
+                        void response.body?.cancel().catch(() => { });
+                        throw requestSignal.reason;
+                    }
+                    return codeExchangeResponse(response, requestSignal);
+                })), true))
+                : send;
+            const coordinatedFetch = refreshCoordinatorFor(ctx).coordinatedFetch(oauthProvider, exchangeFetch(learnedUrlSafeFetch(id, url, trackedFetch)), signal, ctx.defer, exchangeFetch(learnedUrlSafeFetch(id, url, authMethod((input, init) => authCall(guardedFetch, [input, resourceInit(input, init)])))), () => {
+                guardedTransport(true);
+            });
             const transport = new StreamableHTTPClientTransport(url, {
                 authProvider: oauthProvider,
                 onInsufficientScope: "throw",
-                fetch: refreshCoordinatorFor(ctx).coordinatedFetch(oauthProvider, learnedUrlSafeFetch(id, url, trackedFetch), signal, ctx.defer, learnedUrlSafeFetch(id, url, guardedFetch)),
+                fetch: authMethod((input, init) => authFlow(function* () {
+                    const response = (yield authCall(coordinatedFetch, [input, init]));
+                    if (response.status === 401) {
+                        let owner;
+                        if (typeof init?.body === "string") {
+                            try {
+                                const rpc = JSON.parse(init.body);
+                                if (skillObject(rpc)) {
+                                    if (rpc.method === "initialize" || rpc.method === "server/discover")
+                                        owner = initiatingSignal;
+                                    else if (typeof rpc.id === "string" || typeof rpc.id === "number")
+                                        owner = flights.get(rpc.id)?.request?.ctx.signal;
+                                }
+                            }
+                            catch { }
+                        }
+                        const ownedSignal = owner && init?.signal ? AbortSignal.any([owner, init.signal]) : (owner ?? init?.signal);
+                        if (ownedSignal)
+                            renewalSignals.set(response, ownedSignal);
+                    }
+                    return response;
+                })),
             });
-            boundOAuthFlows(ctx, transport, url, [signal, ctx.signal]);
-            return transport;
+            boundOAuthFlows(ctx, transport, url, [signal, ctx.signal], (response) => renewalSignals.get(response));
+            return sendingEachWriteOnce(transport, flights, untrackedRead);
         }
         const headers = opts.auth?.type === "headers"
             ? opts.auth.headers
             : (credentialAuth || requestAuth) && credentialFramed !== null
                 ? { ...requestAuth?.headers, [credentialHeader]: credentialFramed }
                 : undefined;
-        return new StreamableHTTPClientTransport(url, {
+        return sendingEachWriteOnce(new StreamableHTTPClientTransport(url, {
             ...(headers ? { requestInit: { headers } } : {}),
-            fetch: guardedFetch,
-        });
+            fetch: authMethod((input, init) => authCall(guardedFetch, [input, resourceInit(input, init)])),
+        }), flights, untrackedRead);
+    };
+    /**
+     * Admit a write's call to the wire once, whatever JSON-RPC id a later
+     * message for it carries, and show `trackedFetch` which call each message
+     * belongs to while it is sent. A missing record fails closed unless active
+     * calls prove the tool is read (INV-1, INV-9).
+     */
+    const sendingEachWriteOnce = (transport, flights, untrackedRead) => {
+        const send = transport.send.bind(transport);
+        transport.send = authMethod((message, options) => authFlow(function* () {
+            const request = !Array.isArray(message) && "method" in message && message.method === "tools/call" && "id" in message
+                ? message
+                : undefined;
+            if (!request)
+                return (yield authCall(send, [message, options]));
+            const dispatch = dispatchOf(request.params);
+            if (!dispatch) {
+                if (!untrackedRead(request.params))
+                    throw missingDispatch();
+                return (yield authCall(send, [message, options]));
+            }
+            if (dispatch.write && dispatch.sent)
+                throw resendRefused(dispatch);
+            flights.set(request.id, dispatch);
+            try {
+                return (yield authCall(send, [message, options]));
+            }
+            finally {
+                flights.delete(request.id);
+            }
+        }));
+        return transport;
     };
     const reset = (state) => {
         state.lease = null;
@@ -1758,101 +2031,85 @@ export function remoteMcp(id, opts) {
         if (release)
             detach(release);
     };
-    const ensureConnected = async (ctx, state) => {
-        // A 401 after connect is a verdict for the whole request scope, not merely
-        // for the one call that observed it. Do not let the still-cached client make
-        // a later status or call in the same scope report healthy.
-        if (state.authRequired) {
-            throw authRequiredError();
-        }
-        // Read the OAuth epoch before trusting either a cached client or starting a
-        // transport. A disconnected epoch is a durable operator instruction, not
-        // merely the absence of credentials: passive status/tool probes must not
-        // turn it back into a pending consent flow.
-        let oauthGeneration;
-        if (isOauth && (state.client || state.connecting)) {
-            const provider = newProvider(ctx, state);
-            oauthGeneration = await provider.liveEpoch();
-            if (provider.isOperatorDisconnectedEpoch(oauthGeneration)) {
-                closeHalf(state);
-                throw operatorDisconnectedError();
+    const waitForConnection = (attempt, signal) => runEdge(Deferred.await(attempt), signal ? { signal } : {});
+    const ensureConnected = authMethod((ctx, state) => authFlow(function* () {
+        let joined = state.connecting;
+        if (joined)
+            connectingWaiters.set(joined, (connectingWaiters.get(joined) ?? 0) + 1);
+        const leave = () => {
+            if (!joined)
+                return;
+            const remaining = (connectingWaiters.get(joined) ?? 1) - 1;
+            if (remaining > 0)
+                connectingWaiters.set(joined, remaining);
+            else {
+                connectingWaiters.delete(joined);
+                if (ctx.signal?.aborted && state.connecting === joined)
+                    closeHalf(state);
             }
-        }
-        // Cross-isolate force re-auth: another isolate replaced the grant's epoch,
-        // and the grant with it. This request's cached client still speaks the old
-        // token — drop it so the next connect runs against current state.
-        if (state.client && oauthGeneration !== undefined && state.connectedGeneration !== null) {
-            if (isClosed(state))
-                throw scopeEndedError();
-            if (oauthGeneration !== state.connectedGeneration) {
-                closeHalf(state);
+        };
+        try {
+            if (state.authRequired) {
+                throw authRequiredError();
             }
-        }
-        // The static-credential counterpart of the epoch read above, and
-        // deliberately beside it: the vault is read before any cached client is
-        // trusted, so an operator's rotation in the UI takes effect on the next
-        // call rather than the next deploy. Compared by digest — the
-        // plaintext lives in this function's scope and never reaches `state`.
-        let credentialValue = null;
-        let credentialFramed = null;
-        let credentialDigest = null;
-        if (credentialAuth || requestAuth) {
-            credentialValue = await readCredential(ctx);
-            credentialFramed = credentialHeaderValue(credentialScheme, credentialValue);
-            credentialDigest = await digestOf(credentialValue);
-            // Gated on a connect in flight as well as a cached client, exactly like
-            // the epoch read above: a rotation that lands while the first caller is
-            // still connecting must not let the second one ride the key the vault
-            // has already replaced.
-            if ((state.client || state.connecting) &&
-                state.credentialDigest !== null &&
-                state.credentialDigest !== credentialDigest) {
-                // A slow vault/token read or digest can resume after a newer caller
-                // connected with the replacement. Never let that stale read tear down
-                // the newer connection and install the rotated-away credential.
-                const observedConnection = state.client ?? state.connecting;
-                const currentCredential = await readCredential(ctx);
+            let oauthGeneration;
+            if (isOauth && (state.client || state.connecting)) {
+                const provider = newProvider(ctx, state, openRequest(ctx.requestScope ?? ctx).signal);
+                oauthGeneration = (yield authView(ctx, authMethod(() => authInvoke(provider, "liveEpoch", []))));
+                if (provider.isOperatorDisconnectedEpoch(oauthGeneration)) {
+                    closeHalf(state);
+                    throw operatorDisconnectedError();
+                }
+            }
+            if (state.client && oauthGeneration !== undefined && state.connectedGeneration !== null) {
                 if (isClosed(state))
                     throw scopeEndedError();
-                if (currentCredential !== credentialValue || (state.client ?? state.connecting) !== observedConnection) {
-                    throw new ConnectorCallError("connector_call_failed", "The downstream credential changed while connecting; retry the operation.", { retryable: true });
+                if (oauthGeneration !== state.connectedGeneration) {
+                    closeHalf(state);
                 }
-                closeHalf(state);
             }
-        }
-        if (isClosed(state))
-            throw scopeEndedError();
-        if (state.client)
-            return state.client;
-        const attempt = state.connecting ?? startConnect(ctx, state, credentialValue, credentialFramed, credentialDigest);
-        // A Promise edge of its own, as architecture.md's "Effect inside" requires
-        // of every shared wait: whatever this caller does next with the client is
-        // its own I/O, so it resumes in its own continuation rather than inside the
-        // call that completed the attempt.
-        connectingWaiters.set(attempt, (connectingWaiters.get(attempt) ?? 0) + 1);
-        let client;
-        try {
-            client = await runEdge(Deferred.await(attempt), { signal: ctx.signal });
-        }
-        finally {
-            const remaining = (connectingWaiters.get(attempt) ?? 1) - 1;
-            if (remaining > 0)
-                connectingWaiters.set(attempt, remaining);
-            else {
-                connectingWaiters.delete(attempt);
-                // A cancelled waiter leaves its siblings' handshake alone. Once every
-                // waiter has left, abandon the attempt and its OAuth refresh too.
-                if (ctx.signal?.aborted && state.connecting === attempt)
+            let credentialValue = null;
+            let credentialFramed = null;
+            let credentialDigest = null;
+            if (credentialAuth || requestAuth) {
+                credentialValue = (yield authCall(readCredential, [ctx]));
+                credentialFramed = credentialHeaderValue(credentialScheme, credentialValue);
+                credentialDigest = (yield authCall(digestOf, [credentialValue]));
+                if ((state.client || state.connecting) &&
+                    state.credentialDigest !== null &&
+                    state.credentialDigest !== credentialDigest) {
+                    const observedConnection = state.client ?? state.connecting;
+                    const currentCredential = (yield authCall(readCredential, [ctx]));
+                    if (isClosed(state))
+                        throw scopeEndedError();
+                    if (currentCredential !== credentialValue || (state.client ?? state.connecting) !== observedConnection) {
+                        throw resendAdvice(new ConnectorCallError("connector_call_failed", "The downstream credential changed while connecting.", {
+                            retryable: true,
+                        }), "; retry the operation");
+                    }
                     closeHalf(state);
+                }
             }
+            viewSignal(ctx).throwIfAborted();
+            if (isClosed(state))
+                throw scopeEndedError();
+            if (state.client)
+                return state.client;
+            const attempt = state.connecting ?? startConnect(ctx, state, credentialValue, credentialFramed, credentialDigest);
+            if (joined !== attempt) {
+                leave();
+                joined = attempt;
+                connectingWaiters.set(attempt, (connectingWaiters.get(attempt) ?? 0) + 1);
+            }
+            const client = (yield authCall(waitForConnection, [attempt, ctx.signal]));
+            if (isClosed(state))
+                throw scopeEndedError();
+            return client;
         }
-        // Teardown can land between the attempt completing and this caller
-        // resuming. The client it would hand back is being closed, and this scope
-        // is over.
-        if (isClosed(state))
-            throw scopeEndedError();
-        return client;
-    };
+        finally {
+            leave();
+        }
+    }));
     /**
      * Start this scope's connect attempt, publishing it before any of it runs.
      * The attempt completes its Deferred itself, and every caller — the one that
@@ -1866,7 +2123,10 @@ export function remoteMcp(id, opts) {
         // while this connect is in flight has to be visible to the next caller,
         // which would otherwise wait on a client bound to the older key.
         state.credentialDigest = credentialDigest;
-        detach(connect(ctx, state, attempt, credentialValue, credentialFramed).pipe(Effect.onExit((exit) => Effect.sync(() => {
+        detach(connect(ctx, state, attempt, credentialValue, credentialFramed).pipe(
+        // The connection belongs to this request, without the first waiter's
+        // call/credential/budget authority. Refresh coordinators stay separate.
+        Effect.provideService(RequestScope, Context.get(viewServices(ctx), RequestScope)), Effect.onExit((exit) => Effect.sync(() => {
             // Force reset may have abandoned this attempt and installed a new
             // one in the same request scope. An old completion must not erase
             // the new attempt and allow a third concurrent connect.
@@ -1885,8 +2145,8 @@ export function remoteMcp(id, opts) {
             // The transport and its OAuth provider are shared by every call in this
             // scope. A call's deadline signal is aborted even on success, so retaining
             // the first caller's signal here would abort its siblings and later calls.
-            // Keep OAuth work cancellable by the connection's own lifetime instead;
-            // requestOptions still passes each call's signal to the SDK separately.
+            // The provider uses the connection's lifetime. Each challenged response
+            // separately binds renewal preparation to the call that initiated it.
             const connectionAbort = new AbortController();
             // Own cancellation before beginFlow's storage reads.
             // The lease first owns just the signal, then the transport it creates.
@@ -1914,7 +2174,9 @@ export function remoteMcp(id, opts) {
                 // step-up — happens inside the SDK, bound to the epoch live now: a
                 // reset meanwhile fails the attempt rather than handing it the next
                 // epoch's grant.
-                const genAtStart = provider ? yield* promised(() => provider.beginFlow()) : "";
+                const genAtStart = provider
+                    ? yield* promised(authMethod(() => authInvoke(provider, "beginFlow", [])))
+                    : "";
                 if (!owned())
                     return yield* Effect.fail(scopeEndedError());
                 if (provider)
@@ -1935,39 +2197,57 @@ export function remoteMcp(id, opts) {
                         clientName: ctx.oauthClientName,
                     }
                     : undefined;
-                const negotiationDigest = yield* promised(() => digestOf(JSON.stringify([
-                    opts.url,
-                    opts.versionNegotiation ?? "auto",
-                    opts.auth?.type,
-                    opts.auth?.type === "headers" ? opts.auth.headers : requestAuth?.headers,
-                    credentialHeader,
-                    credentialScheme,
-                    opts.authScope ?? "shared",
-                    opts.redirects ?? "none",
-                    oauthConfig,
-                    oauthScope,
-                    state.credentialDigest,
-                    genAtStart,
-                    callerOf(ctx),
-                    skillsEnabled === true,
+                const negotiationDigest = yield* promised(authMethod(() => authCall(digestOf, [
+                    JSON.stringify([
+                        opts.url,
+                        opts.versionNegotiation ?? "auto",
+                        opts.auth?.type,
+                        opts.auth?.type === "headers" ? opts.auth.headers : requestAuth?.headers,
+                        ...(extraHeaders ? [extraHeaders] : []),
+                        credentialHeader,
+                        credentialScheme,
+                        opts.authScope ?? "shared",
+                        opts.redirects ?? "none",
+                        oauthConfig,
+                        oauthScope,
+                        state.credentialDigest,
+                        genAtStart,
+                        callerOf(ctx),
+                        skillsEnabled === true,
+                    ]),
                 ])));
                 const prior = opts.versionNegotiation === "legacy"
                     ? undefined
-                    : yield* promised(() => readNegotiation(ctx, negotiationDigest));
+                    : yield* promised(authMethod(() => authCall(readNegotiation, [ctx, negotiationDigest])));
                 if (!owned())
                     return yield* Effect.fail(scopeEndedError());
-                const cacheOptions = yield* promised(() => catalogClientOptions(ctx, id, JSON.stringify({
-                    url: new URL(opts.url).href,
-                    auth: opts.auth?.type ?? null,
-                    headers: opts.auth?.type === "headers" ? opts.auth.headers : requestAuth?.headers,
-                    credentialHeader,
-                    credentialScheme,
-                    authScope: opts.authScope ?? "shared",
-                    redirects: opts.redirects ?? "none",
-                    versionNegotiation: opts.versionNegotiation ?? "auto",
-                    oauthConfig,
-                    oauthScope,
-                }), JSON.stringify([genAtStart, state.credentialDigest]), connectionAbort.signal, cacheOwner, requestAuth || opts.authScope === "personal" ? "private" : "shared", provider ? async () => digestOf(JSON.stringify(await provider.tokens())) : undefined));
+                const cacheOptions = yield* promised(authMethod(() => authCall(catalogClientOptions, [
+                    ctx,
+                    id,
+                    JSON.stringify({
+                        url: new URL(opts.url).href,
+                        auth: opts.auth?.type ?? null,
+                        headers: opts.auth?.type === "headers" ? opts.auth.headers : requestAuth?.headers,
+                        ...(extraHeaders ? { extraHeaders } : {}),
+                        credentialHeader,
+                        credentialScheme,
+                        authScope: opts.authScope ?? "shared",
+                        redirects: opts.redirects ?? "none",
+                        versionNegotiation: opts.versionNegotiation ?? "auto",
+                        oauthConfig,
+                        oauthScope,
+                    }),
+                    JSON.stringify([genAtStart, state.credentialDigest]),
+                    connectionAbort.signal,
+                    cacheOwner,
+                    requestAuth || opts.authScope === "personal" ? "private" : "shared",
+                    provider
+                        ? authMethod(() => authFlow(function* () {
+                            const tokens = yield authInvoke(provider, "tokens", []);
+                            return yield authCall(digestOf, [JSON.stringify(tokens)]);
+                        }))
+                        : undefined,
+                ])));
                 if (!owned())
                     return yield* Effect.fail(scopeEndedError());
                 const makeClient = () => {
@@ -1997,14 +2277,14 @@ export function remoteMcp(id, opts) {
                 state.transport = t;
                 held.transport = t;
                 recordWireErrors(t, () => observeCatalogChange(ctx, id, connectionAbort.signal, cacheOwner));
-                yield* promised(async () => {
+                yield* promised(authMethod(() => authFlow(function* () {
                     try {
-                        await c.connect(t, { signal: handshakeAbort.signal, ...(prior ? { prior } : {}) });
+                        (yield authInvoke(c, "connect", [
+                            t,
+                            { signal: handshakeAbort.signal, ...(prior ? { prior } : {}) },
+                        ]));
                     }
                     catch (error) {
-                        // Some legacy servers crash on an unknown pre-initialize method.
-                        // Only an auto probe's typed HTTP 5xx permits a fresh legacy
-                        // handshake. An auth failure, timeout or initialize failure does not.
                         if (prior ||
                             opts.versionNegotiation === "legacy" ||
                             !(error instanceof SdkHttpError) ||
@@ -2014,15 +2294,16 @@ export function remoteMcp(id, opts) {
                             !owned() ||
                             handshakeAbort.signal.aborted)
                             throw error;
-                        // The SDK closed the failed probe transport. Its replacement owns
-                        // a new connection, with the same credential and OAuth generation.
                         c = makeClient();
                         t = buildTransport(ctx, provider, credentialFramed, connectionAbort.signal, credentialValue);
                         state.transport = held.transport = t;
                         recordWireErrors(t, () => observeCatalogChange(ctx, id, connectionAbort.signal, cacheOwner));
-                        await c.connect(t, { signal: handshakeAbort.signal, prior: { kind: "legacy" } });
+                        (yield authInvoke(c, "connect", [
+                            t,
+                            { signal: handshakeAbort.signal, prior: { kind: "legacy" } },
+                        ]));
                     }
-                }).pipe(Effect.mapError((err) => atMcpBoundary(ctx, 
+                }))).pipe(Effect.mapError((err) => atMcpBoundary(ctx, 
                 // First, while the runtime's text can still be read for it.
                 withoutCredential(err, credentialValue, credentialFramed), "MCP handshake", t, [ctx.signal, connectionAbort.signal, handshakeAbort.signal])));
                 held.client = c;
@@ -2036,7 +2317,7 @@ export function remoteMcp(id, opts) {
                 // credentials this client just bound to. Discard it rather than cache
                 // a stale-isolate connection.
                 if (provider) {
-                    const generation = yield* promised(() => provider.liveEpoch());
+                    const generation = yield* promised(authMethod(() => authInvoke(provider, "liveEpoch", []))).pipe(Effect.mapError((error) => (owned() ? error : scopeEndedError())));
                     // closeScope can land while the epoch read is pending, after
                     // connect succeeded but before this client is cached. Discard the
                     // client on that side of the await too.
@@ -2051,11 +2332,15 @@ export function remoteMcp(id, opts) {
                 state.authRequired = false;
                 const discover = c.getDiscoverResult();
                 if (!prior)
-                    yield* promised(() => storeNegotiation(ctx, negotiationDigest, discover ? { kind: "modern", discover } : { kind: "legacy" }));
+                    yield* promised(authMethod(() => authCall(storeNegotiation, [
+                        ctx,
+                        negotiationDigest,
+                        discover ? { kind: "modern", discover } : { kind: "legacy" },
+                    ])));
                 if (!owned())
                     return yield* Effect.fail(scopeEndedError());
                 return c;
-            }).pipe(Effect.catch((err) => {
+            }).pipe(Effect.catchDefect(Effect.fail), Effect.catch((err) => {
                 // Close the failed connection through its client, without waiting.
                 if (owned()) {
                     state.lease = null;
@@ -2087,27 +2372,23 @@ export function remoteMcp(id, opts) {
             }));
         });
     };
-    const disconnectAuthorization = async (ctx, state, operatorDisconnected = false, preserveClient = false) => {
+    const disconnectAuthorization = authMethod((ctx, state, operatorDisconnected = false, preserveClient = false) => authFlow(function* () {
         const provider = newProvider(ctx, state);
-        // Publish the replacement epoch before waiting on or closing any
-        // request-local transport. A hung connect therefore cannot delay the
-        // fence, and every late OAuth write stays in the older namespace.
         const reset = operatorDisconnected
-            ? provider.disconnectAuthorization(learnedUrlSafeFetch(id, new URL(opts.url), async (input, init) => {
-                trackSentRequest(ctx, input, init);
-                return await fetch(input, init);
-            }))
-            : provider.resetAuthorization(false, preserveClient);
+            ? authInvoke(provider, "disconnectAuthorization", [
+                learnedUrlSafeFetch(id, new URL(opts.url), authMethod((input, init) => authFlow(function* () {
+                    trackSentRequest(ctx, input, init);
+                    return (yield authCall(sendCredentialPost, [input, init ?? {}]));
+                }))),
+            ])
+            : authInvoke(provider, "resetAuthorization", [false, preserveClient]);
         try {
-            await reset;
+            yield reset;
         }
         finally {
-            // Abandon any connect in flight and close whichever half of the
-            // client/transport exists. Reset is unconditional because storage may already
-            // be fenced behind a newer epoch after a cleanup error.
             closeHalf(state);
         }
-    };
+    }));
     // Built once from construction-time values: names, framing, and public
     // URLs only. A static header's value and a stored credential never reach
     // it, and a URL keeps origin and path: a CIMD document's query may carry a
@@ -2131,6 +2412,8 @@ export function remoteMcp(id, opts) {
                         ...(describedClientMetadataUrl !== undefined ? { clientMetadataUrl: describedClientMetadataUrl } : {}),
                     }
                     : { mode: "none" };
+    if (extraHeaders)
+        authDescription.headerNames = [...new Set([...(authDescription.headerNames ?? []), ...Object.keys(extraHeaders)])];
     const endpoint = describedEndpoint(opts.url);
     const optionSources = Object.freeze({
         "source.kind": "default",
@@ -2150,9 +2433,9 @@ export function remoteMcp(id, opts) {
         if (ctx.signal?.aborted)
             throw ctx.signal.reason instanceof Error ? ctx.signal.reason : scopeEndedError();
     };
-    const withSkillsClient = async (ctx, method, run) => {
+    const withSkillsClient = authMethod((ctx, method, run) => authFlow(function* () {
         const state = stateFor(ctx);
-        const client = await ensureConnected(ctx, state);
+        const client = (yield authCall(ensureConnected, [ctx, state]));
         try {
             skillScopeOpen(ctx, state);
             const capabilities = client.getServerCapabilities();
@@ -2163,7 +2446,7 @@ export function remoteMcp(id, opts) {
                 (extension.directoryRead !== undefined && typeof extension.directoryRead !== "boolean")) {
                 throw new ConnectorCallError("connector_call_failed", "The downstream did not declare a valid Skills extension and resources capability.");
             }
-            const result = await run(client, state);
+            const result = (yield authCall(run, [client, state]));
             skillScopeOpen(ctx, state);
             return result;
         }
@@ -2173,11 +2456,9 @@ export function remoteMcp(id, opts) {
             const classified = atMcpBoundary(ctx, error, method, client.transport, [ctx.signal]);
             if (requiresAuthorization(classified) && state.client === client)
                 state.authRequired = true;
-            // The SDK and downstream can quote whole manifests or bodies in errors.
-            // Keep their typed verdict and operator facts, never the quoted payload.
             throw carryFailureFacts(classified, withheldAs(`Connector "${id}" downstream ${method} failed.`, classified));
         }
-    };
+    }));
     const connector = {
         id,
         ...(opts.title !== undefined ? { title: opts.title } : {}),
@@ -2194,6 +2475,7 @@ export function remoteMcp(id, opts) {
             },
         }),
         ...(opts.description !== undefined ? { description: opts.description } : {}),
+        ...(opts.readOnly !== undefined ? { readOnly: opts.readOnly } : {}),
         ...(opts.authScope !== undefined ? { authScope: opts.authScope } : {}),
         ...(opts.maxResultBytes !== undefined ? { maxResultBytes: opts.maxResultBytes } : {}),
         ...(opts.callAdmission !== undefined ? { callAdmission: opts.callAdmission } : {}),
@@ -2201,47 +2483,55 @@ export function remoteMcp(id, opts) {
         ...(skillsEnabled
             ? {
                 downstreamSkills: {
-                    list: (ctx) => withSkillsClient(ctx, "skills/list", async (client, state) => {
-                        const listed = [];
-                        const uris = new Set();
-                        const cursors = new Set();
-                        let cursor;
-                        let bytes = 0;
-                        for (let page = 0; page < MAX_SKILLS; page++) {
-                            skillScopeOpen(ctx, state);
-                            const result = await client.request({ method: "skills/list", ...(cursor === undefined ? {} : { params: { cursor } }) }, SkillPageSchema, requestOptions(ctx));
-                            bytes += result.bytes;
-                            if (bytes > MAX_SERIALIZED_CATALOG_BYTES || listed.length + result.skills.length > MAX_SKILLS) {
-                                throw new ConnectorCallError("connector_call_failed", "Downstream Skills listing exceeds the aggregate limit.");
-                            }
-                            for (const skill of result.skills) {
-                                if (uris.has(skill.uri))
-                                    throw new ConnectorCallError("connector_call_failed", "Downstream Skills listing contains duplicate skill URIs.");
-                                uris.add(skill.uri);
-                                listed.push(skill);
-                            }
-                            if (result.nextCursor === undefined)
-                                return listed;
-                            if (!result.skills.length || cursors.has(result.nextCursor)) {
-                                throw new ConnectorCallError("connector_call_failed", "Downstream Skills pagination loops or makes no progress.");
+                    list: authMethod((ctx) => authCall(withSkillsClient, [
+                        ctx,
+                        "skills/list",
+                        authMethod((client, state) => authFlow(function* () {
+                            const listed = [];
+                            const uris = new Set();
+                            const cursors = new Set();
+                            let cursor;
+                            let bytes = 0;
+                            for (let page = 0; page < MAX_SKILLS; page++) {
+                                skillScopeOpen(ctx, state);
+                                const result = (yield authInvoke(client, "request", [
+                                    { method: "skills/list", ...(cursor === undefined ? {} : { params: { cursor } }) },
+                                    SkillPageSchema,
+                                    requestOptions(ctx),
+                                ]));
+                                bytes += result.bytes;
+                                if (bytes > MAX_SERIALIZED_CATALOG_BYTES || listed.length + result.skills.length > MAX_SKILLS) {
+                                    throw new ConnectorCallError("connector_call_failed", "Downstream Skills listing exceeds the aggregate limit.");
+                                }
+                                for (const skill of result.skills) {
+                                    if (uris.has(skill.uri))
+                                        throw new ConnectorCallError("connector_call_failed", "Downstream Skills listing contains duplicate skill URIs.");
+                                    uris.add(skill.uri);
+                                    listed.push(skill);
+                                }
+                                if (result.nextCursor === undefined)
+                                    return listed;
+                                if (!result.skills.length || cursors.has(result.nextCursor)) {
+                                    throw new ConnectorCallError("connector_call_failed", "Downstream Skills pagination loops or makes no progress.");
+                                }
+                                cursors.add(result.nextCursor);
+                                cursor = result.nextCursor;
                             }
-                            cursors.add(result.nextCursor);
-                            cursor = result.nextCursor;
-                        }
-                        throw new ConnectorCallError("connector_call_failed", "Downstream Skills listing exceeds the page limit.");
-                    }),
-                    read: (uri, ctx) => withSkillsClient(ctx, "resources/read", async (client) => {
-                        // The registry admits only advertised manifest URIs. An explicit
-                        // request bypasses the SDK readResource response cache entirely and
-                        // validates the raw result before its resource union drops fields.
-                        return client.request({ method: "resources/read", params: { uri } }, skillReadSchema(uri), requestOptions(ctx));
-                    }),
+                            throw new ConnectorCallError("connector_call_failed", "Downstream Skills listing exceeds the page limit.");
+                        })),
+                    ])),
+                    read: authMethod((uri, ctx) => authCall(withSkillsClient, [
+                        ctx,
+                        "resources/read",
+                        authMethod((client) => authInvoke(client, "request", [
+                            { method: "resources/read", params: { uri } },
+                            skillReadSchema(uri),
+                            requestOptions(ctx),
+                        ])),
+                    ])),
                 },
             }
             : {}),
-        // Data the registry classifies every read with; listTools below returns
-        // the downstream's listing unclassified.
-        ...(classification !== undefined ? { classification } : {}),
         // Declaring the slot is what makes the rest of the operator surface work:
         // the connection's credential form renders it, the shape check compares
         // against it, and authorize_connector returns the operator handoff rather than
@@ -2255,17 +2545,9 @@ export function remoteMcp(id, opts) {
                  * here is connecta's to verify — the credential's scope, project,
                  * and mode are the provider's answer, not ours.
                  */
-                testCredential: async (value, ctx) => {
+                testCredential: authMethod((value, ctx) => authFlow(function* () {
                     try {
-                        // The connect below reads the vault itself — the header is
-                        // assembled deep inside `ensureConnected`, and handing a
-                        // candidate down that path would mean threading a second secret
-                        // through the whole connection state. `/ui/credentials/<id>/test`
-                        // reads the stored value and passes it here, so today the two are
-                        // the same string. Check rather than assume: a route that later
-                        // tested an unsaved candidate would otherwise silently report on
-                        // the old value, which is the one answer worse than refusing.
-                        const stored = (await ctx.credential?.get())?.trim();
+                        const stored = (yield authCall(ctx.credential?.get, [], ctx.credential))?.trim();
                         if (stored !== value.trim()) {
                             return {
                                 ok: false,
@@ -2273,7 +2555,7 @@ export function remoteMcp(id, opts) {
                                     "saved. Save the value first, then test it.",
                             };
                         }
-                        const tools = await connector.listTools(ctx);
+                        const tools = (yield authInvoke(connector, "listTools", [ctx]));
                         return {
                             ok: true,
                             message: `Connected — the downstream served ${tools.length} tool${tools.length === 1 ? "" : "s"}.`,
@@ -2283,24 +2565,22 @@ export function remoteMcp(id, opts) {
                         return { ok: false, message: msg(err) };
                     }
                     finally {
-                        // Standalone tests own their scope; an operator route owns
-                        // bounded teardown for the context it supplied to this hook.
                         if (!connectorScopeCleanupClaimed(ctx, id))
-                            await connector.closeScope?.(ctx);
+                            (yield authCall(connector.closeScope, [ctx], connector));
                     }
-                },
+                })),
             }
             : {}),
         // The SDK walks the whole chain and writes one complete result. Intake
         // runs on its public request seam before any page can enter that cache.
-        async listTools(ctx) {
+        listTools: authMethod((ctx) => authFlow(function* () {
             const state = stateFor(ctx);
-            const client = await ensureConnected(ctx, state);
+            const client = (yield authCall(ensureConnected, [ctx, state]));
             let clean;
             const options = requestOptions(ctx) ?? {};
             listingContexts.set(options, ctx);
             try {
-                const result = await client.listTools(undefined, options);
+                const result = (yield authInvoke(client, "listTools", [undefined, options]));
                 clean = redactCatalog(ctx, result.tools);
             }
             catch (err) {
@@ -2324,15 +2604,10 @@ export function remoteMcp(id, opts) {
                 ...(t.title !== undefined ? { title: t.title } : {}),
                 ...(t.icons !== undefined
                     ? {
-                        // Inline images can consume the catalog ceiling and storage chunks.
-                        // The SDK needs no icons for validation or parameter mirroring.
                         icons: t.icons.filter((icon) => !/^data:/i.test(icon.src)),
                     }
                     : {}),
                 ...(t.execution !== undefined ? { execution: t.execution } : {}),
-                // SEP-2243 declarations live in inputSchema. SDK validation and header
-                // mirroring need no _meta keys, so arbitrary downstream metadata stays
-                // out of the persisted catalog.
                 ...(t.description !== undefined ? { description: t.description } : {}),
                 ...(t.inputSchema !== undefined
                     ? {
@@ -2350,88 +2625,157 @@ export function remoteMcp(id, opts) {
                     }
                     : {}),
             }));
-        },
-        async callTool(name, args, ctx, options) {
-            if (classification?.unlisted === "hide" && !Object.hasOwn(classification.tools, name)) {
-                throw new ConnectorCallError("invalid_args", "This tool is not in the connector allowlist.");
-            }
-            const state = stateFor(ctx);
-            const client = await ensureConnected(ctx, state);
+        })),
+        callTool: authMethod((name, args, ctx, options) => authFlow(function* () {
+            enterProviderBoundary(ctx, connector);
+            let active;
             try {
-                const definition = options?.definition;
-                const toolDefinition = definition
-                    ? {
-                        ...definition,
-                        // Older stored catalogs and custom connectors may omit inputSchema.
-                        inputSchema: (definition.inputSchema ?? { type: "object" }),
+                return (yield authView(ctx, authMethod(() => authFlow(function* () {
+                    const state = stateFor(ctx);
+                    const client = (yield authCatch(authCall(ensureConnected, [ctx, state]), (error) => {
+                        throw knownProviderFailure(error);
+                    }));
+                    const definition = options?.definition;
+                    const facts = definition ?? state.toolDefinitions.get(name) ?? { name };
+                    const sourceFacts = definition ?? {
+                        name,
+                        ...(facts.annotations
+                            ? { annotations: facts.annotations }
+                            : {}),
+                    };
+                    const source = sourceClassification(sourceFacts);
+                    const serverWrite = source === "write";
+                    const write = serverWrite || (callClassification(ctx) ?? definition?.classification ?? source) === "write";
+                    const dispatch = newDispatch(write, serverWrite);
+                    dispatch.request = {
+                        entry: providerRequest(ctx, !write, `Connector "${id}"'s MCP server`, { method: "POST" }),
+                        ctx,
+                    };
+                    active = { state, client, dispatch, write };
+                    state.dispatches.set(dispatch, name);
+                    const toolDefinition = definition
+                        ? {
+                            ...definition,
+                            inputSchema: (definition.inputSchema ?? { type: "object" }),
+                        }
+                        : state.toolDefinitions.get(name);
+                    if (toolDefinition?.execution?.taskSupport === "required") {
+                        throw new ConnectorCallError("connector_call_failed", `Tool "${name}" requires task-based execution, which Connecta does not support.`);
                     }
-                    : state.toolDefinitions.get(name);
-                if (toolDefinition?.execution?.taskSupport === "required") {
-                    throw new ConnectorCallError("connector_call_failed", `Tool "${name}" requires task-based execution, which Connecta does not support.`);
-                }
-                let output;
-                const outputError = (code, message) => atMcpBoundary(ctx, new ProtocolError(code, message), "tools/call", client.transport, [ctx.signal]);
-                if (toolDefinition?.outputSchema) {
-                    try {
-                        output = fromJsonSchema(toolDefinition.outputSchema);
+                    let output;
+                    const outputError = (code, message) => atMcpBoundary(ctx, new ProtocolError(code, message), "tools/call", client.transport, [ctx.signal]);
+                    if (toolDefinition?.outputSchema) {
+                        try {
+                            output = fromJsonSchema(toolDefinition.outputSchema);
+                        }
+                        catch {
+                            throw outputError(-32602, `Tool '${name}' has an invalid outputSchema: schema could not be compiled`);
+                        }
                     }
-                    catch {
-                        throw outputError(-32602, `Tool '${name}' has an invalid outputSchema: schema could not be compiled`);
+                    const result = (yield authCatch(authInvoke(client, "callTool", [
+                        withDispatch({
+                            name,
+                            arguments: (args ?? {}),
+                            ...options?.input,
+                        }, dispatch),
+                        {
+                            ...requestOptions(ctx),
+                            allowInputRequired: true,
+                            ...(toolDefinition
+                                ? { toolDefinition: { ...toolDefinition, outputSchema: undefined } }
+                                : write
+                                    ? { toolDefinition: { name, inputSchema: { type: "object" } } }
+                                    : {}),
+                        },
+                    ]), (err) => {
+                        assertDownstreamOutputSafe(ctx.requestScope ?? ctx, err);
+                        throw atMcpBoundary(ctx, err, "tools/call", client.transport, [ctx.signal]);
+                    }));
+                    if (isInputRequiredResult(result)) {
+                        return result;
+                    }
+                    assertDownstreamOutputSafe(ctx.requestScope ?? ctx, result);
+                    if (output && !result.isError) {
+                        if (result.structuredContent === undefined)
+                            throw outputError(-32600, `Tool ${name} has an output schema but did not return structured content`);
+                        const validation = (yield authInvoke(output["~standard"], "validate", [
+                            result.structuredContent,
+                        ]));
+                        if (validation.issues)
+                            throw outputError(-32602, "Structured content does not match the tool's output schema: validation failed");
                     }
-                }
-                const result = await client
-                    .callTool({
-                    name,
-                    arguments: (args ?? {}),
-                    ...options?.input,
-                }, {
-                    ...requestOptions(ctx),
-                    allowInputRequired: true,
-                    // SDK 2.3.1's callTool checks outputSchema even for a suspension.
-                    // Retain its header mirroring, then validate only final results.
-                    ...(toolDefinition ? { toolDefinition: { ...toolDefinition, outputSchema: undefined } } : {}),
-                })
-                    .catch((err) => {
-                    assertDownstreamOutputSafe(ctx.requestScope ?? ctx, err);
-                    throw atMcpBoundary(ctx, err, "tools/call", client.transport, [ctx.signal]);
-                });
-                if (isInputRequiredResult(result)) {
                     return result;
-                }
-                assertDownstreamOutputSafe(ctx.requestScope ?? ctx, result);
-                if (output && !result.isError) {
-                    if (result.structuredContent === undefined)
-                        throw outputError(-32600, `Tool ${name} has an output schema but did not return structured content`);
-                    const validation = await output["~standard"].validate(result.structuredContent);
-                    if (validation.issues)
-                        throw outputError(-32602, "Structured content does not match the tool's output schema: validation failed");
-                }
-                return result;
+                }))));
             }
             catch (err) {
-                // A grant revoked after connect surfaces here, not in ensureConnected.
-                if (ownAbortReason(err, [ctx.signal]) && !hasSdkPayload(err))
+                if (!active)
+                    throw knownProviderFailure(err);
+                const { state, client, dispatch, write } = active;
+                const direct = write && callClassification(ctx) === undefined;
+                const ownAbort = ownAbortReason(err, [ctx.signal]) && !hasSdkPayload(err);
+                // The SDK can reject its wait synchronously from the abort event,
+                // before the physical response's Promise observer records its facts.
+                // Yield only settlement; no closed caller regains live authority.
+                if (ownAbort)
+                    yield Effect.yieldNow;
+                if (ownAbort && !direct)
                     throw err;
-                if (requiresAuthorization(err)) {
-                    if (state.client === client)
-                        state.authRequired = true;
-                    if (err instanceof UnauthorizedError)
-                        throw carryFailureFacts(err, authRequiredError());
-                }
-                throw downstreamCallError(err, undefined, undefined, undefined, sentSecretsFor(ctx));
+                if (requiresAuthorization(err) && state.client === client)
+                    state.authRequired = true;
+                const failure = ownAbort
+                    ? err
+                    : err instanceof UnauthorizedError
+                        ? carryFailureFacts(err, authRequiredError())
+                        : downstreamCallError(err, undefined, undefined, undefined, requestSentSecrets(ctx));
+                if (!write)
+                    throw failure;
+                const renewal = dispatch.request?.entry.renewed
+                    ? undefined
+                    : dispatch.resendRefused
+                        ? authRequiredError()
+                        : failure;
+                const unsent = (entry) => {
+                    const verdict = unsentAfterUnauthorized(`Connector "${id}"'s MCP server`, renewal, isOauth ? "downstream_oauth_required" : "auth_required");
+                    return entry ? vendorRefusal(verdict, entry) : verdict;
+                };
+                const verdict = dispatch.unauthorized
+                    ? unsent(dispatch.request?.entry)
+                    : dispatch.redirected || dispatch.resendRefused
+                        ? new ConnectorCallError("connector_call_failed", `Connector "${id}"'s MCP server ` +
+                            (dispatch.redirected
+                                ? "answered this write with a redirect, and the write was not sent again, "
+                                : "was sent this write, and a second send of it was stopped, ") +
+                            "so whether it took effect is unknown: check the target before repeating it.", { retryable: false, writeOutcome: "unknown" })
+                        : failure;
+                const vendor = { title: `connector "${id}"` };
+                const status = failureRecord({}, err).httpStatus;
+                const settled = providerCallFailure(ctx, vendor, verdict, {
+                    dispatched: dispatch.sent,
+                    ...(status === undefined ? {} : { status }),
+                    fallback: "write",
+                    request: dispatch.request?.entry,
+                });
+                throw settled === failure ? failure : carryFailureFacts(failure, settled);
             }
-        },
-        async readResource(uri, ctx) {
+            finally {
+                if (active)
+                    active.state.dispatches.delete(active.dispatch);
+            }
+        })),
+        readResource: authMethod((uri, ctx) => authFlow(function* () {
             const state = stateFor(ctx);
-            const client = await ensureConnected(ctx, state);
+            const client = (yield authCall(ensureConnected, [ctx, state]));
             try {
                 const options = requestOptions(ctx) ?? {};
                 listingContexts.set(options, ctx);
                 try {
                     if (!client.getServerCapabilities()?.resources)
                         throw unadvertisedResource();
-                    const resources = await client.listResources(undefined, options);
-                    const templates = await client.listResourceTemplates(undefined, options);
+                    const resources = (yield authInvoke(client, "listResources", [undefined, options]));
+                    const templates = (yield authInvoke(client, "listResourceTemplates", [
+                        undefined,
+                        options,
+                    ]));
                     const exact = resources.resources.some((resource) => resource.uri === uri);
                     if (!exact) {
                         const match = resourceUriMatchesTemplates(uri, templates.resourceTemplates, (code) => resourceTemplateRefusals.add(code));
@@ -2450,18 +2794,19 @@ export function remoteMcp(id, opts) {
                 finally {
                     listingContexts.delete(options);
                 }
-                const result = await client
-                    .readResource({ uri }, {
-                    ...requestOptions(ctx),
-                    cacheMode: "bypass",
-                    allowInputRequired: true,
-                })
-                    .catch((err) => {
+                const result = (yield authCatch(authInvoke(client, "readResource", [
+                    { uri },
+                    {
+                        ...requestOptions(ctx),
+                        cacheMode: "bypass",
+                        allowInputRequired: true,
+                    },
+                ]), (err) => {
                     if (err instanceof ResourceNotFoundError) {
                         throw new ConnectorCallError("not_found", "The downstream resource does not exist.");
                     }
                     throw atMcpBoundary(ctx, err, "resources/read", client.transport, [ctx.signal]);
-                });
+                }));
                 if (isInputRequiredResult(result)) {
                     throw new ConnectorCallError("input_required_unsupported", "Resource reads inside programs cannot request mid-call input.");
                 }
@@ -2476,170 +2821,161 @@ export function remoteMcp(id, opts) {
                     if (err instanceof UnauthorizedError)
                         throw carryFailureFacts(err, authRequiredError());
                 }
-                throw downstreamCallError(err, undefined, undefined, undefined, sentSecretsFor(ctx));
+                throw downstreamCallError(err, undefined, undefined, undefined, requestSentSecrets(ctx));
             }
-        },
-        async closeScope(ctx) {
-            // A scope closed before its first use gets an entry too, closed at once,
-            // so it cannot spring into existence later.
+        })),
+        closeScope: authMethod((ctx) => authFlow(function* () {
+            // Revocation and all finalizers start before any caller guard. Cleanup
+            // retains its own bounded settlement even after the request has closed.
             const state = entryFor(ctx);
-            // Closed before any await, and before the finalizers run: every check
-            // from here on sees the scope ended. A duplicate teardown finds it
-            // closed and has nothing to run.
             const release = Scope.closeUnsafe(state.scope, Exit.void);
             const cacheClosing = closeCatalogCacheScope(ctx, id, cacheOwner);
-            // Storage cannot cancel an already-started write. Bound the join in
-            // parallel with transport cleanup so it adds no unbounded teardown tail.
-            const cacheClosed = cacheClosing &&
-                runEdge(Effect.raceAllFirst([
-                    Effect.promise(() => cacheClosing),
-                    Effect.sleep(Duration.millis(LOCAL_CLOSE_BUDGET_MS)),
-                ]));
             reset(state);
-            // Runs the live connection's lease finalizer, if there is one.
-            if (release)
-                await runEdge(release);
-            await cacheClosed;
-        },
-        async status(ctx) {
+            const closing = runEdge(Effect.all([
+                release ?? Effect.void,
+                cacheClosing
+                    ? Effect.raceAllFirst([
+                        Effect.promise(() => cacheClosing),
+                        Effect.sleep(Duration.millis(LOCAL_CLOSE_BUDGET_MS)),
+                    ])
+                    : Effect.void,
+            ], { concurrency: "unbounded" }).pipe(Effect.asVoid));
+            void closing.catch(() => { });
+            if (viewSignal(ctx, true).aborted)
+                return yield authValue(() => closing);
+            return yield authView(ctx, authMethod(() => authValue(() => closing)), true);
+        })),
+        status: authMethod((ctx) => authFlow(function* () {
             const state = stateFor(ctx);
-            const report = async (status) => {
-                const path = isOauth ? await newProvider(ctx, state).registrationPath() : undefined;
+            const report = authMethod((status) => authFlow(function* () {
+                const path = isOauth
+                    ? (yield authInvoke(newProvider(ctx, state), "registrationPath", []))
+                    : undefined;
                 return ownStatus({
                     ...status,
                     ...(path ? { registrationPath: path } : {}),
                     ...(resourceTemplateRefusals.size ? { resourceTemplateRefusals: [...resourceTemplateRefusals] } : {}),
                 });
-            };
+            }));
             try {
-                await ensureConnected(ctx, state);
-                return report({ state: "ok" });
+                (yield authCall(ensureConnected, [ctx, state]));
+                return (yield authCall(report, [{ state: "ok" }]));
             }
             catch (err) {
-                // An empty slot, or one with no vault behind it, is reported the way a
-                // missing grant is: present, unauthenticated, and repairable — never a
-                // boot failure and never a silently absent connector.
                 if (err instanceof CredentialRequiredError) {
-                    return report({ state: "auth_required", message: err.message });
+                    return (yield authCall(report, [{ state: "auth_required", message: err.message }]));
                 }
                 if (err instanceof OperatorDisconnectedError) {
-                    return report({ state: "auth_required", message: err.message });
+                    return (yield authCall(report, [{ state: "auth_required", message: err.message }]));
                 }
                 if (state.authRequired) {
-                    // Only an OAuth connector has a pending consent URL to offer. A
-                    // credential connector's downstream 401 is repaired in the operator
-                    // UI connection, so do not reach into OAuth storage to look for one.
-                    return report({
-                        state: "auth_required",
-                        message: credentialAuth
-                            ? "Authorization required — the downstream rejected this connector's stored credential."
-                            : "Authorization required — open the URL to connect.",
-                    });
+                    return (yield authCall(report, [
+                        {
+                            state: "auth_required",
+                            message: credentialAuth
+                                ? "Authorization required \u2014 the downstream rejected this connector's stored credential."
+                                : "Authorization required \u2014 open the URL to connect.",
+                        },
+                    ]));
                 }
-                // An operator surface: the record, never the error's own text.
                 return failureStatus(id, err);
             }
-        },
-        async finishAuth(code, ctx, callbackParams) {
+        })),
+        finishAuth: authMethod((code, ctx, callbackParams) => authView(ctx, authMethod((signal) => authFlow(function* () {
             const state = stateFor(ctx);
             const provider = newProvider(ctx, state);
-            // verifyState ran on this request-scoped provider first and found the
-            // consent; a programmatic exchange names it by its callback's state.
             const consent = callbackParams?.get("state") ?? null;
-            if (!consent || !(await provider.verifyCallbackState(consent))) {
+            if (!consent || !(yield authInvoke(provider, "verifyCallbackState", [consent]))) {
                 throw new ConnectorCallError("connector_call_failed", `Connector "${id}" authorization callback matches no pending consent; nothing was exchanged.`);
             }
-            // The exchange reads and writes only the epoch its consent was written
-            // in; it decides nothing about the grant there.
             provider.validateCallbackIssuer(callbackParams?.get("iss") ?? null);
-            await provider.bindFlow();
-            // Always a transport of the exchange's own, over the provider that
-            // verified the state: that provider holds the consent's claim, and the
-            // fence before the token request is its to cross. A connection this
-            // scope opened earlier speaks for its connect attempt, not this callback.
-            const t = buildTransport(ctx, provider);
+            (yield authInvoke(provider, "bindFlow", []));
+            signal.throwIfAborted();
+            const t = buildTransport(ctx, provider, null, signal, null, true);
             const trail = {};
             const internals = t;
             const traced = tracedOAuthFetch(trail, new URL(opts.url), internals._fetchWithInit ?? fetch);
             const exchange = new Proxy(t, {
-                get: (target, key) => (key === "_fetchWithInit" ? traced : Reflect.get(target, key, target)),
+                get: (target, key) => key === "_fetchWithInit" ? traced : Reflect.get(target, key, target),
                 set: (target, key, value) => Reflect.set(target, key, value, target),
             });
             try {
-                await exchange.finishAuth(callbackParams);
-                // Reset so the next use reconnects with the freshly stored tokens.
+                (yield authInvoke(exchange, "finishAuth", [callbackParams]));
                 closeHalf(state);
             }
             catch (err) {
-                throw await withoutAuthorizationServerText(ctx, err, trail, [ctx.signal]);
+                throw (yield authCall(withoutAuthorizationServerText, [
+                    ctx,
+                    err,
+                    trail,
+                    [signal, ctx.signal],
+                ]));
             }
             finally {
-                // This exchange-only transport has no lease in the request scope.
                 detach(closeConnection(null, t, ctx.logger));
             }
-        },
+        })), true)),
     };
     if (opts.auth?.type === "oauth") {
-        connector.verifyState = async (oauthState, ctx) => {
+        connector.verifyState = authMethod((oauthState, ctx) => authFlow(function* () {
             const state = stateFor(ctx);
-            return newProvider(ctx, state).verifyState(oauthState);
-        };
-        connector.verifyCallbackIssuer = async (issuer, ctx) => {
-            newProvider(ctx, stateFor(ctx)).validateCallbackIssuer(issuer);
-            return true;
-        };
-        connector.consumeAuthError = async (ctx) => {
-            await newProvider(ctx, stateFor(ctx)).consumeAuthError();
-        };
-        connector.disconnectAuth = async (ctx) => {
-            await disconnectAuthorization(ctx, stateFor(ctx), true);
-        };
-        connector.startAuth = async (ctx, startOpts) => {
+            return (yield authInvoke(newProvider(ctx, state), "verifyState", [oauthState]));
+        }));
+        connector.verifyCallbackIssuer = authMethod((issuer, ctx) => Effect.try({
+            try: () => {
+                newProvider(ctx, stateFor(ctx)).validateCallbackIssuer(issuer);
+                return true;
+            },
+            catch: (error) => error,
+        }));
+        connector.consumeAuthError = authMethod((ctx) => authFlow(function* () {
+            (yield authInvoke(newProvider(ctx, stateFor(ctx)), "consumeAuthError", []));
+        }));
+        connector.disconnectAuth = authMethod((ctx) => authFlow(function* () {
+            (yield authCall(disconnectAuthorization, [ctx, stateFor(ctx), true]));
+        }));
+        connector.startAuth = authMethod((ctx, startOpts) => authFlow(function* () {
             ctx = authorizingContext(ctx);
             const state = stateFor(ctx);
             state.provider = null;
             const p = newProvider(ctx, state);
             if (ctx.signal?.aborted)
                 throw ctx.signal.reason;
-            const disconnected = startOpts?.force ? false : await p.operatorDisconnected();
+            const disconnected = startOpts?.force
+                ? false
+                : (yield authInvoke(p, "operatorDisconnected", []));
             if (ctx.signal?.aborted)
                 throw ctx.signal.reason;
             if (startOpts?.force || disconnected) {
-                await disconnectAuthorization(ctx, state, false, startOpts?.force === true);
+                (yield authCall(disconnectAuthorization, [ctx, state, false, startOpts?.force === true]));
             }
             else {
-                // A consent URL already outstanding? Re-issue it rather than re-running
-                // the SDK flow, which would overwrite the PKCE verifier and invalidate
-                // the URL the operator may be mid-consent on. Only a recent one: an
-                // old or untimed URL falls through to a fresh flow in this same
-                // epoch, which keeps the stored client registration and discovery.
-                const pending = await p.reusablePendingAuthorizationUrl();
+                const pending = (yield authInvoke(p, "reusablePendingAuthorizationUrl", []));
                 if (pending) {
                     return {
                         state: "auth_required",
                         authorizationUrl: pending,
                         authorizationReused: true,
-                        message: "Authorization required — open the URL to connect.",
+                        message: "Authorization required \u2014 open the URL to connect.",
                     };
                 }
             }
             if (ctx.signal?.aborted)
                 throw ctx.signal.reason;
             try {
-                await ensureConnected(ctx, state);
+                (yield authCall(ensureConnected, [ctx, state]));
                 return {
                     state: "ok",
-                    message: "Already authorized — connection is healthy.",
+                    message: "Already authorized \u2014 connection is healthy.",
                 };
             }
             catch (err) {
                 if (state.authRequired) {
-                    // The consent this start's attempt stored, while its epoch is live:
-                    // one a later reset published belongs to another flow, and this
-                    // start fails rather than hand it out.
                     let authorizationUrl;
                     try {
-                        authorizationUrl = await state.attemptProvider?.consentUrl();
+                        authorizationUrl = (yield state.attemptProvider
+                            ? authInvoke(state.attemptProvider, "consentUrl", [viewSignal(ctx, true)])
+                            : Effect.succeed(undefined));
                     }
                     catch (readErr) {
                         return { state: "error", message: startMessage(readErr) };
@@ -2647,20 +2983,31 @@ export function remoteMcp(id, opts) {
                     return {
                         state: "auth_required",
                         ...(authorizationUrl !== undefined ? { authorizationUrl } : {}),
-                        message: "Authorization required — open the URL to connect.",
+                        message: "Authorization required \u2014 open the URL to connect.",
                     };
                 }
                 return { state: "error", message: startMessage(err) };
             }
-        };
+        }));
     }
-    const withActiveSecrets = async (ctx, run, redactResult = true, preserveInput = false) => {
+    const retainOperation = (operation, contextIndex) => authMethod((...args) => authFlow(function* () {
+        const release = retainOAuthPartition(oauthPartitionFor(args[contextIndex]));
+        try {
+            return yield authCall(operation, args);
+        }
+        finally {
+            release();
+        }
+    }));
+    const withActiveSecrets = authMethod((ctx, run, redactResult = true, preserveInput = false) => authFlow(function* () {
         trackCredentialReads(ctx);
         const secrets = sentSecretsFor(ctx);
         if (opts.auth?.type === "headers") {
             for (const value of Object.values(opts.auth.headers))
                 secrets.header(value);
         }
+        for (const value of Object.values(extraHeaders ?? {}))
+            secrets.header(value);
         const state = entryFor(ctx);
         let active = activeContexts.get(state);
         if (!active) {
@@ -2669,9 +3016,7 @@ export function remoteMcp(id, opts) {
         }
         active.add(ctx);
         try {
-            const result = await run();
-            // Opaque state must reach the sealing handler byte-exact. Invocation
-            // intercepts it before ordinary result processing or guest exposure.
+            const result = (yield authCall(run, []));
             if (!preserveInput || !isInputRequiredResult(result))
                 assertDownstreamOutputSafe(ctx.requestScope ?? ctx, result);
             return (preserveInput && isInputRequiredResult(result)) || !redactResult
@@ -2680,35 +3025,82 @@ export function remoteMcp(id, opts) {
         }
         catch (error) {
             assertDownstreamOutputSafe(ctx.requestScope ?? ctx, error);
-            throw redactSentSecrets(ctx, error);
+            throw requestSentSecrets(ctx).redact(error);
         }
         finally {
             active.delete(ctx);
         }
-    };
+    }));
     const callTool = connector.callTool;
-    connector.callTool = (name, args, ctx, options) => withActiveSecrets(ctx, () => callTool(name, args, ctx, options), true, true);
+    connector.callTool = authMethod((name, args, ctx, options) => authCall(withActiveSecrets, [
+        ctx,
+        authMethod(() => authCall(callTool, [name, args, ctx, options])),
+        true,
+        true,
+    ]));
     const listTools = connector.listTools;
-    connector.listTools = (ctx) => withActiveSecrets(ctx, () => listTools(ctx));
+    connector.listTools = authMethod((ctx) => authCall(withActiveSecrets, [
+        ctx,
+        authMethod(() => authCall(listTools, [ctx])),
+    ]));
     const readResource = connector.readResource;
-    connector.readResource = (uri, ctx) => withActiveSecrets(ctx, () => readResource(uri, ctx));
+    connector.readResource = authMethod((uri, ctx) => authCall(withActiveSecrets, [
+        ctx,
+        authMethod(() => authCall(readResource, [uri, ctx])),
+    ]));
     if (connector.downstreamSkills) {
         const { list, read } = connector.downstreamSkills;
-        connector.downstreamSkills.list = (ctx) => withActiveSecrets(ctx, () => list(ctx), false);
-        connector.downstreamSkills.read = (uri, ctx) => withActiveSecrets(ctx, () => read(uri, ctx), false);
+        connector.downstreamSkills.list = authMethod((ctx) => authCall(withActiveSecrets, [
+            ctx,
+            authMethod(() => authCall(list, [ctx])),
+            false,
+        ]));
+        connector.downstreamSkills.read = authMethod((uri, ctx) => authCall(withActiveSecrets, [
+            ctx,
+            authMethod(() => authCall(read, [uri, ctx])),
+            false,
+        ]));
     }
     if (isOauth && !staticClient && clientMetadataUrl === undefined)
         declareSelfHostedClient(connector, oauthScope);
     if (isOauth) {
         const start = connector.startAuth;
-        connector.startAuth = async (...args) => {
-            const status = await start(...args);
-            const path = await newProvider(args[0], stateFor(args[0])).registrationPath();
+        connector.startAuth = authMethod((...args) => authFlow(function* () {
+            const status = (yield authCall(start, [...args]));
+            const path = (yield authInvoke(newProvider(args[0], stateFor(args[0])), "registrationPath", []));
             return { ...status, ...(path ? { registrationPath: path } : {}) };
-        };
+        }));
+    }
+    // Every published Promise operation owns its whole wait, including local
+    // storage, digest, registration-path and result processing seams. callTool
+    // settles inside its write decider; closeScope starts cleanup before racing
+    // the join, and finishAuth already owns its request-scoped exchange boundary.
+    const settlingOperation = (operation, contextIndex, requestOwned = false) => authMethod((...args) => authFlow(function* () {
+        const ctx = args[contextIndex];
+        const state = states.get(Context.get(viewServices(ctx), RequestScope));
+        if (state && isClosed(state))
+            return (yield Effect.fail(scopeEndedError()));
+        return (yield authView(ctx, authMethod(() => authCall(operation, [...args])), requestOwned));
+    }));
+    connector.listTools = settlingOperation(connector.listTools, 0);
+    connector.readResource = settlingOperation(connector.readResource, 1);
+    if (connector.downstreamSkills) {
+        connector.downstreamSkills.list = settlingOperation(connector.downstreamSkills.list, 0);
+        connector.downstreamSkills.read = settlingOperation(connector.downstreamSkills.read, 1);
+    }
+    const status = connector.status;
+    connector.status = authMethod((ctx) => authCatch(authView(ctx, authMethod(() => authCall(status, [ctx]))), (error) => failureStatus(id, error)));
+    if (connector.testCredential)
+        connector.testCredential = settlingOperation(connector.testCredential, 1);
+    if (isOauth) {
+        connector.startAuth = settlingOperation(connector.startAuth, 0);
+        connector.disconnectAuth = settlingOperation(connector.disconnectAuth, 0);
+        connector.verifyState = settlingOperation(connector.verifyState, 1, true);
+        connector.verifyCallbackIssuer = settlingOperation(connector.verifyCallbackIssuer, 1, true);
+        connector.consumeAuthError = settlingOperation(connector.consumeAuthError, 0, true);
         // Pin before the first asynchronous storage/discovery read, not only once
         // a refresh flight exists. These operations do not take call admission.
-        const retain = retainingOAuthPartition;
+        const retain = retainOperation;
         connector.listTools = retain(connector.listTools, 0);
         connector.callTool = retain(connector.callTool, 2);
         connector.readResource = retain(connector.readResource, 1);
@@ -2735,15 +3127,19 @@ export function remoteMcp(id, opts) {
         connector.startAuth = payloadFree(connector.startAuth);
     if (connector.finishAuth)
         connector.finishAuth = payloadFree(connector.finishAuth);
+    // This boundary's identity in a logical call: this object with its
+    // published, fully wrapped function, fixed now, never what the property or
+    // a copy holds by then.
+    providerBoundary(connector);
+    const ownCall = connector.callTool;
+    registerCallEntry(connector, (name, args, ctx, options) => authCall(ownCall, [name, args, ctx, options]));
     if (isOauth)
-        registerInvocationAuth(connector, retainingOAuthPartition(async (ctx) => {
-            // Only inspect local grant state here. Discovery, refresh, and MCP
-            // transports remain inside callTool and cannot establish retry safety.
+        registerInvocationAuth(connector, retainOperation(settlingOperation(authMethod((ctx) => authFlow(function* () {
             const provider = newProvider(ctx, stateFor(ctx));
-            if (await provider.operatorDisconnected())
+            if ((yield authInvoke(provider, "operatorDisconnected", [])))
                 throw operatorDisconnectedError();
-            if (!(await provider.tokens()))
+            if (!(yield authInvoke(provider, "tokens", [])))
                 throw authRequiredError();
-        }, 0));
+        })), 0), 0));
     return connector;
 }