@zackbart/connecta 0.34.0 → 0.35.0

package/dist/invocation-auth.js

@@ -1,31 +1,39 @@
-import { vettedSchemaDigest } from "./catalog-drift.js";
+import { authCall, authFlow, registerAuth } from "./auth/native.js";
+import { upwardStep } from "./upward.js";
+import { runEdge } from "./runtime/run.js";
+import { Effect } from "effect";
+import { requestOwner } from "./runtime/request-scope.js";
+import { cloneTool, sourceClassification } from "./tool-safety.js";
 // Only built-in factories register local credential checks. This hook is not
 // part of Connector, and a replacement callTool cannot inherit its proof.
 const checks = new WeakMap();
 export function registerInvocationAuth(connector, check) {
     checks.set(connector, { callTool: connector.callTool, check });
 }
-/** Local credential resolution only, before entering any connector call. */
-export async function resolveInvocationAuth(connector, ctx) {
-    const entry = checks.get(connector);
-    if (entry?.callTool === connector.callTool)
-        await entry.check(ctx);
+/**
+ * Local credential resolution only, before entering any connector call.
+ * `callTool` is the function the invocation will invoke, read once.
+ */
+export function resolveInvocationAuthEffect(connector, callTool, ctx) {
+    return Effect.suspend(() => {
+        const entry = checks.get(connector);
+        return entry?.callTool === callTool ? authCall(entry.check, [ctx]) : Effect.void;
+    });
 }
-const requests = new WeakMap();
 function requestFor(scope) {
-    let facts = requests.get(scope);
-    if (!facts) {
-        facts = { entered: [], authFailures: new Map(), retryReads: new Map() };
-        requests.set(scope, facts);
-    }
-    return facts;
+    return requestOwner(scope).retained.invocations;
 }
 /** Bind the verdict, annotation facts and schemas used for this call. */
 export async function classificationDigest(definition) {
     try {
-        const schema = await vettedSchemaDigest(definition);
+        const schema = { inputSchema: definition.inputSchema, outputSchema: definition.outputSchema };
         const annotations = Object.entries(definition.annotations ?? {}).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-        const bytes = new TextEncoder().encode(JSON.stringify({ classification: definition.classification, annotations, schema }));
+        const bytes = new TextEncoder().encode(JSON.stringify({
+            classification: definition.classification,
+            source: sourceClassification(definition),
+            annotations,
+            schema,
+        }));
         return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
     }
     catch {
@@ -37,7 +45,7 @@ export async function classificationDigest(definition) {
 export function recordCallEntry(scope, call, definition) {
     // Snapshot synchronously. Recovery hashes this private copy only when it
     // needs a replay binding, without changing ordinary admission or completion.
-    requestFor(scope).entered.push({ ...call, definition: structuredClone(definition) });
+    requestFor(scope).entered.push({ ...call, definition: cloneTool(definition) });
 }
 export function bindReplayReads(scope, reads) {
     requestFor(scope).retryReads = new Map(reads.map((read) => [read.address, read.digest]));
@@ -50,13 +58,16 @@ export function recordAuthFailure(scope, connector, eligible) {
     const failures = requestFor(scope).authFailures;
     failures.set(connector, eligible && failures.get(connector) !== false);
 }
-export async function authRecoveryFacts(scope, connector) {
+export function authRecoveryFacts(scope, connector) {
+    return runEdge(authRecoveryFactsNative(scope, connector));
+}
+const authRecoveryFactsNative = /* @__PURE__ */ registerAuth(authRecoveryFacts, (scope, connector) => authFlow(function* () {
     const facts = requestFor(scope);
     const writeEntered = facts.entered.some((call) => call.classification === "write");
     const reads = new Map();
     let unsafeEntered = writeEntered;
     for (const call of facts.entered) {
-        const digest = await classificationDigest(call.definition);
+        const digest = yield* upwardStep(authCall(classificationDigest, [call.definition]));
         unsafeEntered ||= !call.fresh || !digest || (reads.has(call.address) && reads.get(call.address) !== digest);
         reads.set(call.address, digest);
     }
@@ -66,4 +77,4 @@ export async function authRecoveryFacts(scope, connector) {
         eligible: !unsafeEntered && facts.authFailures.get(connector) === true,
         reads: [...reads].map(([address, digest]) => ({ address, digest })),
     };
-}
+}));

package/dist/invocation.js

@@ -1,20 +1,25 @@
-import { withAuthorizationHandoff } from "./authorization-handoff.js";
+import { authCall, registerAuthMethod } from "./auth/native.js";
+import { withAuthorizationHandoffEffect } from "./authorization-handoff.js";
 import { hasControlCharacters } from "./tool-name.js";
-import { writeRefusal } from "./tool-safety.js";
-import { Cause, Effect, Exit } from "effect";
-import { isCallAdmissionError } from "./call-admission.js";
-import { attachCallAdmission } from "./call-admission-context.js";
-import { boundedEchoText, classificationCode, classifyCallError, ConnectorCallError, echoedCallArgs, framingError, } from "./errors.js";
+import { cloneTool, isWriteLike, writeRefusal } from "./tool-safety.js";
+import { Cause, Context, Effect, Exit } from "effect";
+import { CallAdmissionError, isCallAdmissionError } from "./call-admission.js";
+import { boundedEchoText, classificationCode, classifyCallError, classifyWithoutAdvice, ConnectorCallError, echoedCallArgs, framingError, keyResendAdviceOf, resendAdviceOf, withResendAdvice, } from "./errors.js";
 import { downstreamValue } from "./mcp-result.js";
 import { carryFailureFacts, classifiedFailure, failureRecord, logFailure, recordedToolName, } from "./operator-record.js";
 import { splitAddress } from "./registry.js";
-import { runEdge, withDeadlineEffect } from "./runtime/run.js";
+import { causeError, runEdge, withDeadlineEffect } from "./runtime/run.js";
 import { validateCatalogToolInput } from "./validate.js";
-import { sentSecretsFor, sentSecretsForRequest, trackCredentialReads } from "./sent-secrets.js";
-import { recoveryFor } from "./call-recovery.js";
-import { classifyWriteOutcome } from "./write-outcome.js";
-import { classificationDigest, recordAuthFailure, recordCallEntry, replayClassificationDigest, resolveInvocationAuth, } from "./invocation-auth.js";
+import { sentSecretsFor, sentSecretsForRequest } from "./sent-secrets.js";
+import { recoveryRecord, recordRecoveryFacts } from "./call-recovery.js";
+import { callFromContext, contextView, viewServices, Credentials } from "./runtime/call.js";
+import { chargeCallBudget } from "./runtime/call-admission.js";
+import { callEntry } from "./runtime/call-entry.js";
+import { forgetProviderFailure, isKnownProviderFailure, isSettledWrite, keyProtectsCall, knownCallFailure, onlyAuxiliaryRequests, knownProviderFailure, openLogicalCall, } from "./provider-call.js";
+import { classifyWriteOutcome, settleWrite, settleWriteResult } from "./write-outcome.js";
+import { classificationDigest, recordAuthFailure, recordCallEntry, replayClassificationDigest, resolveInvocationAuthEffect, } from "./invocation-auth.js";
 import { downstreamContinuation, recordDownstreamArgumentEcho, isDownstreamInputResult, assertDownstreamOutputSafe, } from "./downstream-input-context.js";
+import { keepErrorName } from "./redaction-identity.js";
 function defined(values) {
     return Object.fromEntries(Object.entries(values).filter(([, value]) => value !== undefined));
 }
@@ -74,8 +79,8 @@ function isCallerCancellation(error, signal) {
 }
 /**
  * A downstream MCP tool answered with `isError`. Classified exactly as the
- * plain `Error`: untyped, non-retryable, and marked so
- * a write's outcome can tell "the service said no" from "nobody answered".
+ * plain `Error`: untyped and non-retryable. It is a read's answer; for a
+ * write it is a 2xx reply after which the handler may have applied it.
  */
 class DownstreamToolError extends Error {
 }
@@ -97,13 +102,18 @@ function assertRawMcpSuccess(kind, result) {
         .join("") || "Downstream tool call failed"));
 }
 /**
- * Whether a failed attempt is the downstream tool's own answer: an MCP
- * `isError`. A connector's typed error is not, by itself, one — a response
- * too large to read or a refused redirect comes after the request was acted
- * on — so its code decides instead (`classifyWriteOutcome`).
+ * Whether a failed attempt is the downstream tool's own answer. For a read:
+ * an MCP `isError`, or a boundary's known refusal/unsent failure. For a
+ * write, only refusal provenance that holds for the whole logical call
+ * (`knownCallFailure`); an `isError` arrives over a 2xx after the handler
+ * ran. A typed error alone is not proof: a body ceiling, refused redirect, or
+ * handler error may follow execution. Boundaries supply provenance, never
+ * wording.
  */
-function answeredFailure(error) {
-    return error instanceof DownstreamToolError;
+function answeredFailure(error, write, call) {
+    if (!write)
+        return error instanceof DownstreamToolError || isKnownProviderFailure(error);
+    return knownCallFailure(call, error);
 }
 export class InvocationFailure extends Error {
     details;
@@ -131,6 +141,7 @@ export class InvocationFailure extends Error {
         this.data = details;
     }
 }
+keepErrorName(InvocationFailure, "InvocationFailure");
 /**
  * Shared downstream invocation engine. Address/catalog resolution is delegated
  * to the request-local CatalogService; every remaining call semantic lives
@@ -149,6 +160,7 @@ export class InvocationService {
         this.registry = registry;
         this.catalog = catalog;
         this.activity = activity;
+        void InvocationService.nativePrograms;
     }
     invoke(address, args, context) {
         return runEdge(this.pipeline(address, args, context));
@@ -169,11 +181,20 @@ export class InvocationService {
             let attempts = 0;
             let resultBytes;
             let dispatchedToConnector = false;
-            // The context a dispatched call ran with, read for recovery facts the
-            // connector recorded before an interrupting deadline (call-recovery.ts).
-            let dispatchContext;
+            // The logical call bridge; recovery is a separate invocation-owned record.
+            let logicalCall;
+            // The served class owns gating and presentation. Physical source-write
+            // provenance additionally owns failure settlement, after dispatch only.
+            const sentSourceWrite = () => logicalCall?.sent.some((request) => request.sourceWrite === true) === true;
+            const recoveryState = recoveryRecord();
             let preInvocationAuthFailure = false;
             let answered = false;
+            // A dispatched failure's advice to send it again, composed by enrich
+            // only once the outcome allows it (resendAdvice), and its advice to
+            // reuse an idempotency key, only where that key protects the whole
+            // logical call (keyResendAdvice, keyProtectsCall).
+            let failureAdvice;
+            let failureKeyAdvice;
             const sentSecrets = sentSecretsForRequest(this.catalog.requestScope);
             context.sentSecrets?.include(sentSecrets);
             // A write gate's refusal that is no attempt; see WriteGateDecision.
@@ -207,7 +228,7 @@ export class InvocationService {
                     connectorId: identity.connectorId,
                     toolName,
                     address: `${identity.connectorId}.${toolName}`,
-                    source: context.source,
+                    source: context.activitySource ?? context.source,
                     outcome,
                     ...(activityTarget?.connector.authScope === "personal" ? { personal: true } : {}),
                     durationMs: Date.now() - started,
@@ -220,20 +241,33 @@ export class InvocationService {
                     }),
                 });
             };
-            const enrich = (error, target) => {
+            const enrich = (error, target, settled) => {
                 if (!target)
                     return error;
-                const recovery = recoveryFor(dispatchContext);
-                const recoveryRetry = recovery?.["idempotencyKey"]
+                const recovery = recoveryState.facts;
+                const enteredWrite = dispatchedToConnector &&
+                    ((resolved !== undefined && resolved.definition.classification !== "read") || sentSourceWrite());
+                // A known answer alone is not dispatch evidence. Require an owned,
+                // complete ledger with a positively recorded auxiliary resource read;
+                // an empty ledger, custom entry or interruption proves nothing.
+                const mayHaveWritten = enteredWrite && (error.writeOutcome === "unknown" || !(answered && onlyAuxiliaryRequests(logicalCall)));
+                // A recorded key is a diagnostic; advice to reuse it needs proof that
+                // it protects the whole logical call, not one request inside it. Q8's
+                // settled verdict is final: no enricher adds advice to it.
+                const recoveryRetry = !settled && keyProtectsCall(logicalCall, recovery?.["idempotencyKey"])
                     ? " A deliberate retry with uncertainCall.recovery.idempotencyKey and the exact original arguments cannot repeat the write while the vendor retains that key (Stripe keeps v1 keys at least 24 hours); after that, look the object up before retrying."
                     : "";
-                if (isTimeoutFailure(error) && dispatchedToConnector && resolved?.definition.classification === "write") {
+                if (isTimeoutFailure(error) && mayHaveWritten) {
+                    // An empty ledger's known mark cannot settle this timeout. Keep
+                    // program accounting conservative as well as its displayed code.
+                    answered = false;
                     const echoed = argumentEcho;
                     return {
                         ...error,
                         code: "write_outcome_unknown",
                         message: `${error.message} Its outcome is unknown. Check the target before repeating this call.`,
                         retryable: false,
+                        ...(sentSourceWrite() ? { writeOutcome: "unknown" } : {}),
                         connector: target.connector.id,
                         operation: `${target.connector.id}.${target.toolName}`,
                         uncertainCall: {
@@ -251,14 +285,35 @@ export class InvocationService {
                                     : " The arguments could not be echoed safely; use the exact arguments you sent."),
                     };
                 }
+                if (mayHaveWritten &&
+                    (error.code === "auth_required" || error.code === "downstream_oauth_required") &&
+                    !logicalCall?.sent.some((request) => request.dispatched)) {
+                    // An empty resource ledger cannot settle this auth failure. Keep
+                    // actual resource-refusal provenance, but withdraw an empty ledger's
+                    // known mark before composing advice and counting program writes.
+                    answered = false;
+                    forgetProviderFailure(error);
+                }
+                // A dispatched write without refusal provenance is unknown whatever
+                // its connector's code says, a custom connector's included: never
+                // retryable, and no advice below may tell the agent to retry it.
+                const unknownWrite = mayHaveWritten && classifyWriteOutcome({ ok: false, dispatched: true, answered, error }) === "unknown";
+                if (unknownWrite)
+                    error = { ...error, retryable: false, writeOutcome: "unknown" };
+                // The failure's advice to send it again was kept apart until now, and
+                // joins its message only where the outcome allows it: never on a write
+                // whose outcome is unknown, whatever redaction did to the message.
+                // Key-reuse advice also needs its key to protect the logical call.
+                else if (!settled) {
+                    if (failureKeyAdvice && keyProtectsCall(logicalCall, failureKeyAdvice.key))
+                        error = { ...error, message: withResendAdvice(error.message, failureKeyAdvice.advice) };
+                    if (failureAdvice !== undefined)
+                        error = { ...error, message: withResendAdvice(error.message, failureAdvice) };
+                }
                 // Any other dispatched write whose outcome is unknown (a lost response
                 // body, a 5xx, an unreadable reply) keeps the facts its connector
                 // recorded before dispatch, here and through program write accounting.
-                if (recovery &&
-                    !error.uncertainCall &&
-                    dispatchedToConnector &&
-                    resolved?.definition.classification === "write" &&
-                    classifyWriteOutcome({ ok: false, dispatched: true, answered, error }) === "unknown") {
+                if (recovery && !error.uncertainCall && unknownWrite) {
                     const echoed = argumentEcho;
                     error = {
                         ...error,
@@ -274,11 +329,16 @@ export class InvocationService {
                 if (error.code === "auth_required" && target.connector.startAuth) {
                     error = { ...error, code: "downstream_oauth_required" };
                 }
-                const enteredWrite = resolved?.definition.classification === "write" && dispatchedToConnector;
                 switch (error.code) {
                     case "input_required_unsupported":
                         if (context.processInputRequired)
                             return error;
+                        // Resending could apply the write twice: reconcile first.
+                        if (unknownWrite)
+                            return {
+                                ...error,
+                                retry: "Do not resend this write. Re-read its target to check whether it took effect before any fresh call.",
+                            };
                         return {
                             ...error,
                             nextAction: {
@@ -293,6 +353,8 @@ export class InvocationService {
                             },
                         };
                     case "destructive_tool_requires_approval": {
+                        if (settled)
+                            return error;
                         const echoed = argumentEcho;
                         return {
                             ...error,
@@ -318,17 +380,22 @@ export class InvocationService {
                             connector: target.connector.id,
                             operation: `${target.connector.id}.${target.toolName}`,
                             recovery: recoveryMode(this.registry, target.connector, this.catalog.baseUrl),
-                            ...(enteredWrite ? { reconciliationRequired: true, retryable: false } : {}),
+                            ...(unknownWrite ? { reconciliationRequired: true, retryable: false } : {}),
                             nextAction: {
                                 tool: "authorize_connector",
                                 arguments: { connector: target.connector.id },
                                 operatorHandoff: "Give the URL and instructions it returns to the operator.",
                             },
-                            retry: enteredWrite
+                            retry: unknownWrite
                                 ? "This write may have partially run. Reconcile its target before retrying after the operator completes recovery."
-                                : `Retry ${target.connector.id}.${target.toolName} after the operator completes recovery.`,
+                                : enteredWrite && logicalCall?.sent.some((request) => request.dispatched)
+                                    ? `Fix the credentials, then retry ${target.connector.id}.${target.toolName}.`
+                                    : `Retry ${target.connector.id}.${target.toolName} after the operator completes recovery.`,
                         };
                     case "provider_permission_denied":
+                        // A write whose outcome is unknown is never told to retry.
+                        if (error.writeOutcome === "unknown")
+                            return error;
                         return {
                             ...error,
                             connector: target.connector.id,
@@ -336,7 +403,7 @@ export class InvocationService {
                             retry: "Ask the provider's resource owner or administrator to grant the required permission or scope, then retry. Repeating the call or reconnecting alone will not grant access.",
                         };
                     case "invalid_args":
-                        if (!error.validation)
+                        if (!error.validation || error.writeOutcome === "unknown")
                             return error;
                         return {
                             ...error,
@@ -354,13 +421,27 @@ export class InvocationService {
             };
             let stage = "catalog";
             const failed = (error) => {
+                // Q8 (settleWrite): this invocation's deadline or its caller cut off
+                // a write. No connector failure arrives, so the logical call's
+                // recorded requests alone decide whether a 401 left it unknown.
+                if (dispatchedToConnector &&
+                    (resolved?.definition.classification !== "read" || sentSourceWrite()) &&
+                    (error.code === "cancelled" || isTimeoutFailure(error))) {
+                    const departed = settleWrite(logicalCall?.sent ?? [], undefined, true);
+                    if (departed !== undefined) {
+                        failureAdvice = failureKeyAdvice = undefined;
+                        error = carryFailureFacts(departed, classifyWithoutAdvice(sentSecrets.redact(departed)));
+                    }
+                }
                 const diagnostics = timing();
                 const target = resolved ?? activityTarget;
                 if (target && (error.code === "auth_required" || error.code === "downstream_oauth_required")) {
-                    recordAuthFailure(this.catalog.requestScope, target.connector.id, (resolved?.definition.classification === "read" && resolved.classificationFresh === true) ||
+                    recordAuthFailure(this.catalog.requestScope, target.connector.id, (resolved !== undefined && !isWriteLike(resolved.definition) && resolved.classificationFresh === true) ||
                         preInvocationAuthFailure ||
                         (!resolved && context.source === "call_tool"));
                 }
+                // Read before any step below rebuilds the details: Q8's verdict is final.
+                const settled = isSettledWrite(error);
                 // Attach host deadline facts before write recovery changes the code.
                 if (isTimeoutFailure(error)) {
                     const elapsedMs = Date.now() - started;
@@ -372,7 +453,7 @@ export class InvocationService {
                     };
                 }
                 // Downstream diagnostics were redacted under payload rules where they entered.
-                const details = sentSecrets.redact(enrich(error, target), "envelope");
+                const details = carryFailureFacts(error, sentSecrets.redact(enrich(error, target, settled), "envelope"));
                 const outcome = () => ({
                     ok: false,
                     durationMs: Date.now() - started,
@@ -395,7 +476,7 @@ export class InvocationService {
                         connector: target.connector.id,
                         // Named only when the catalog listed it (src/operator-record.ts).
                         tool: resolved?.definition,
-                        source: context.source,
+                        source: context.activitySource ?? context.source,
                         attempts,
                         durationMs: Date.now() - started,
                         // Every refusal reaching `failed` is one connecta built: a
@@ -449,6 +530,7 @@ export class InvocationService {
                 argumentEcho = echoedCallArgs(args ?? {}, target.definition.inputSchema);
                 sentSecrets.arguments(args ?? {}, target.definition.inputSchema);
                 const write = target.definition.classification !== "read";
+                const writeLike = isWriteLike(target.definition);
                 const canonicalAddress = `${target.connector.id}.${target.toolName}`;
                 const input = context.source !== "execute_code"
                     ? downstreamContinuation(this.catalog.requestScope, target.connector.id, canonicalAddress)
@@ -457,16 +539,18 @@ export class InvocationService {
                     recordDownstreamArgumentEcho(this.catalog.requestScope, argumentEcho);
                 const expectedDigest = replayClassificationDigest(this.catalog.requestScope, canonicalAddress);
                 if (expectedDigest !== undefined &&
-                    (target.classificationFresh !== true ||
+                    (writeLike ||
+                        target.classificationFresh !== true ||
                         (yield* Effect.promise(() => classificationDigest(target.definition))) !== expectedDigest)) {
                     return {
                         ...framingError("auth_replay_refused", "An entered read no longer has the same fresh classification. Reconcile its target before starting a new request."),
                         reconciliationRequired: true,
                     };
                 }
-                const refusal = writeRefusal(target.definition.classification, context.source, context.readOnly);
+                const connectorReadOnly = target.connector.readOnly === true;
+                const refusal = writeRefusal(target.definition.classification, context.source, context.readOnly || connectorReadOnly);
                 if (refusal === "read_only_endpoint") {
-                    return framingError("read_only_endpoint", `Tool "${canonicalAddress}" is a write, and this endpoint is read-only. Nothing here can send it.`);
+                    return framingError("read_only_endpoint", `Tool "${canonicalAddress}" is a write, and ${connectorReadOnly ? `connector "${target.connector.id}"` : "this endpoint"} is read-only. Nothing here can send it.`);
                 }
                 if (refusal === "destructive_tool_requires_approval") {
                     return framingError("destructive_tool_requires_approval", `Tool "${canonicalAddress}" is a write. Invoke it through call_destructive_tool so the MCP host can request approval.`);
@@ -485,7 +569,8 @@ export class InvocationService {
                     if (invalid)
                         return classifyCallError(invalid);
                 }
-                if (write && context.beforeWrite) {
+                // Source writes keep program write accounting; only effective writes spend W10 budget.
+                if (writeLike && context.beforeWrite) {
                     const decision = yield* context.beforeWrite(target, args ?? {});
                     if (decision.kind === "refuse") {
                         unrecorded = decision.unrecorded === true;
@@ -495,44 +580,71 @@ export class InvocationService {
                 if (callSignal?.aborted)
                     return yield* Effect.fail(callSignal.reason);
                 attempts = 1;
-                const call = async (permit) => {
-                    const connectorContext = this.registry.contextFor(target.connector.id, this.catalog.baseUrl, this.catalog.requestScope, defined({ signal: callSignal, timeoutMs: context.timeoutMs, defer: this.catalog.defer }));
-                    attachCallAdmission(connectorContext, permit);
-                    trackCredentialReads(connectorContext);
+                const call = (permit) => Effect.gen({ self: this }, function* () {
+                    const operationContext = this.registry.contextFor(target.connector.id, this.catalog.baseUrl, this.catalog.requestScope, defined({ signal: callSignal, timeoutMs: context.timeoutMs, defer: this.catalog.defer }));
+                    const lease = callFromContext(operationContext, write ? "write" : "read", {
+                        admitted: true,
+                        // An invocation deadline aborts when its call finishes. A
+                        // request-owned auxiliary must retain only request cancellation.
+                        requestSourceSignal: context.requestSignal,
+                        served: write ? "write" : "read",
+                        charge: (signal) => runEdge(chargeCallBudget(permit, signal)),
+                        chargeEffect: (signal) => chargeCallBudget(permit, signal),
+                        chargeClosed: () => new CallAdmissionError("closed", "connector_call_failed", "This call has ended; its admission permit can no longer be charged."),
+                        record: (facts) => recordRecoveryFacts(recoveryState, facts),
+                    });
+                    yield* Effect.addFinalizer(() => Effect.sync(lease.close));
+                    const connectorContext = contextView(lease, operationContext);
                     sentSecrets.include(sentSecretsFor(connectorContext));
-                    dispatchContext = connectorContext;
-                    try {
+                    // The one object and function this call invokes, read once: its
+                    // logical call, auth check, and dispatch all name them, so a
+                    // connector that reassigns its own callTool mid-call changes none.
+                    const connector = target.connector;
+                    const callTool = connector.callTool;
+                    logicalCall = openLogicalCall(connectorContext, connector, callTool);
+                    yield* Effect.gen(function* () {
                         if (target.connector.credential) {
                             if (!connectorContext.credential) {
                                 throw new ConnectorCallError("auth_required", "Operator-managed credential storage is not configured. Call " +
                                     `authorize_connector({ connector: "${target.connector.id}" }).`);
                             }
-                            if (!(await connectorContext.credential.getAll())) {
+                            if (!(yield* Context.get(lease.services, Credentials).values)) {
                                 throw new ConnectorCallError("auth_required", `Connector "${target.connector.id}" has no stored credential. Call authorize_connector.`);
                             }
                         }
-                        await resolveInvocationAuth(target.connector, connectorContext);
-                    }
-                    catch (error) {
-                        const code = classifyCallError(error).code;
+                        yield* resolveInvocationAuthEffect(connector, callTool, connectorContext);
+                    }).pipe(Effect.onError((cause) => Effect.sync(() => {
+                        const code = classifyCallError(causeError(cause, connectorContext.signal)).code;
                         preInvocationAuthFailure = code === "auth_required" || code === "downstream_oauth_required";
-                        throw error;
-                    }
+                    })));
                     // Cancellation can arrive during admission or context construction.
                     if (admissionSignal?.aborted)
                         throw admissionSignal.reason;
                     dispatchedToConnector = true;
                     recordCallEntry(this.catalog.requestScope, {
                         address: canonicalAddress,
-                        classification: write ? "write" : "read",
+                        classification: writeLike ? "write" : "read",
                         fresh: target.classificationFresh === true,
                     }, target.definition);
-                    return await target.connector.callTool(target.toolName, args ?? {}, connectorContext, 
-                    // The connector may retain or mutate its definition. Keep the
-                    // invocation's classification and schema private, even during
-                    // this call, and give every dispatch its own deep copy.
-                    { definition: structuredClone(target.definition), ...defined({ input }) });
-                };
+                    // Reflect.apply, never the function's own `call` or `apply`
+                    // property, which anyone holding the function could replace.
+                    const options = { definition: cloneTool(target.definition), ...defined({ input }) };
+                    const entry = callEntry(connector, callTool);
+                    if (entry)
+                        return yield* entry(target.toolName, args ?? {}, options).pipe(Effect.provideContext(viewServices(connectorContext)));
+                    return yield* Effect.tryPromise({
+                        try: () => Reflect.apply(callTool, connector, [
+                            target.toolName,
+                            args ?? {},
+                            connectorContext,
+                            // The connector may retain or mutate its definition. Keep the
+                            // invocation's classification and schema private, even during
+                            // this call, and give every dispatch its own deep copy.
+                            options,
+                        ]),
+                        catch: (error) => error,
+                    });
+                });
                 // The permit belongs to this scope, so success, failure, and the
                 // deadline's interruption all release it. Interruption stops the
                 // wait instead of waiting for the connector, so an uncooperative one
@@ -545,17 +657,16 @@ export class InvocationService {
                     stage = "downstream";
                     const reply = yield* timed((elapsed) => {
                         connectorMs += elapsed;
-                    }, Effect.tryPromise({
-                        try: () => Promise.resolve(call(permit)),
-                        catch: (error) => error,
-                    }));
+                    }, call(permit));
                     if (target.connector.kind === "mcp" && isDownstreamInputResult(reply)) {
+                        // The downstream suspended for input. A handler asks for
+                        // input from inside its run, so a write may already have
+                        // applied: only a read's suspension is a known answer.
                         if (!context.processInputRequired)
-                            throw new ConnectorCallError("input_required_unsupported", "The downstream returned input_required. Use the equivalent direct MCP call to provide input.");
-                        const value = yield* Effect.tryPromise({
-                            try: () => Promise.resolve(context.processInputRequired(reply, target, sentSecrets)),
-                            catch: (error) => error,
-                        });
+                            throw write
+                                ? new ConnectorCallError("input_required_unsupported", "The downstream returned input_required after this write was sent, and this call cannot provide input. Whether the write took effect is unknown.", { writeOutcome: "unknown" })
+                                : knownProviderFailure(new ConnectorCallError("input_required_unsupported", "The downstream returned input_required. Use the equivalent direct MCP call to provide input."));
+                        const value = yield* authCall(context.processInputRequired, [reply, target, sentSecrets]);
                         return { inputRequired: true, value };
                     }
                     assertDownstreamOutputSafe(this.catalog.requestScope, reply);
@@ -571,11 +682,23 @@ export class InvocationService {
                         return yield* Effect.fail(callSignal.reason);
                     if (!dispatchedToConnector && admissionSignal?.aborted)
                         return callerCancelledDetails();
-                    const attemptError = Cause.squash(attempt.cause);
-                    answered = answeredFailure(attemptError);
-                    return isCallerCancellation(attemptError, context.requestSignal)
-                        ? callerCancelledDetails()
-                        : carryFailureFacts(attemptError, classifyCallError(sentSecrets.redact(attemptError)));
+                    const thrown = Cause.squash(attempt.cause);
+                    if (isCallerCancellation(thrown, context.requestSignal))
+                        return callerCancelledDetails();
+                    const failureWrite = write || sentSourceWrite();
+                    answered = answeredFailure(thrown, failureWrite, logicalCall);
+                    // Q8 is decided here for every served write, whatever its
+                    // connector made of the 401: over the logical call's whole ledger.
+                    const attemptError = failureWrite ? settleWrite(logicalCall?.sent ?? [], thrown, answered) : thrown;
+                    if (attemptError !== thrown)
+                        answered = false;
+                    failureAdvice = resendAdviceOf(attemptError);
+                    failureKeyAdvice = keyResendAdviceOf(attemptError);
+                    const details = carryFailureFacts(attemptError, classifyWithoutAdvice(sentSecrets.redact(attemptError)));
+                    // An inner call's verdict that does not hold for this one is withdrawn.
+                    if (failureWrite && !answered)
+                        forgetProviderFailure(details);
+                    return details;
                 }
                 if ("inputRequired" in attempt.value) {
                     inputRequiredValue = { value: attempt.value.value };
@@ -612,9 +735,11 @@ export class InvocationService {
                 : dispatch());
             if (Exit.isFailure(dispatched)) {
                 const failure = Cause.squash(dispatched.cause);
+                failureAdvice = resendAdviceOf(failure);
+                failureKeyAdvice = keyResendAdviceOf(failure);
                 const details = context.requestSignal?.aborted
                     ? callerCancelledDetails()
-                    : carryFailureFacts(failure, classifyCallError(sentSecrets.redact(failure)));
+                    : carryFailureFacts(failure, classifyWithoutAdvice(sentSecrets.redact(failure)));
                 return failed(details);
             }
             if (dispatched.value)
@@ -624,14 +749,21 @@ export class InvocationService {
             if (!completed) {
                 return yield* Effect.die(new Error("Invocation completed without a resolved tool"));
             }
+            // Q8 settles a result too: a write an undeclared 401 left unknown is no
+            // success, whatever its handler made of the 401, and its result is not
+            // processed.
+            if (dispatchedToConnector && (completed.definition.classification !== "read" || sentSourceWrite())) {
+                const unknown = settleWriteResult(logicalCall?.sent ?? []);
+                if (unknown) {
+                    failureAdvice = failureKeyAdvice = undefined;
+                    return failed(carryFailureFacts(unknown, classifyWithoutAdvice(sentSecrets.redact(unknown))));
+                }
+            }
             const processResult = context.processResult;
             const processing = inputRequiredValue
                 ? Effect.succeed(inputRequiredValue.value)
                 : processResult
-                    ? Effect.tryPromise({
-                        try: () => Promise.resolve(processResult(sentSecrets.redact(result), completed, sentSecrets, valueFormat, rawResult)),
-                        catch: (error) => error,
-                    })
+                    ? authCall(processResult, [sentSecrets.redact(result), completed, sentSecrets, valueFormat, rawResult])
                     : Effect.succeed(result);
             const processed = yield* Effect.exit(timed((elapsed) => {
                 resultProcessingMs += elapsed;
@@ -670,9 +802,11 @@ export class InvocationService {
             }
         }).pipe(Effect.flatMap((outcome) => outcome.ok
             ? Effect.succeed(outcome)
-            : Effect.promise(async () => ({
-                ...outcome,
-                error: await withAuthorizationHandoff(this.catalog.requestScope, outcome.error),
-            }))));
+            : withAuthorizationHandoffEffect(this.catalog.requestScope, outcome.error).pipe(Effect.map((error) => ({ ...outcome, error })))));
     }
+    static nativePrograms = /* @__PURE__ */ (() => {
+        registerAuthMethod(InvocationService.prototype, "invoke", function (address, args, context) {
+            return this.pipeline(address, args, context);
+        }, InvocationService.prototype.invoke);
+    })();
 }