@zackbart/connecta 0.34.0 → 0.35.0

package/dist/meta-tools.js

@@ -1,7 +1,11 @@
-import { authorizationHandoff, bindAuthorizationHandoffs } from "./authorization-handoff.js";
+import { upwardStep } from "./upward.js";
+import { authCall, authInvoke, authFlow, authMethod, authStorage, registerAuth } from "./auth/native.js";
+import { registryProgram } from "./runtime/registry.js";
+import { runEdge } from "./runtime/run.js";
+import { authorizationHandoff, authorizeConnector, bindAuthorizationHandoffs } from "./authorization-handoff.js";
 import { bindMcpClient } from "./mcp-client-context.js";
 import { CONFIG_DEFAULTS } from "./config-defaults.js";
-import { z } from "zod";
+import * as z from "zod";
 import { advertisedSchema } from "./advertised-schema.js";
 import { boundedDiscoveryText, CatalogService, DEFAULT_SEARCH_LIMIT, DiscoveryPolicyError, flatSearchResult, MAX_DESCRIBE_ADDRESSES, MAX_DISCOVERY_RESULT_BYTES, MAX_SEARCH_LIMIT, } from "./catalog-service.js";
 import { resolveDiscoveryConcurrency } from "./concurrency.js";
@@ -43,24 +47,26 @@ function discoveryErrorResult(error) {
     result.isError = true;
     return result;
 }
-async function discoveryResult(operation, hint) {
-    try {
-        const value = await operation();
-        const text = boundedDiscoveryText(value, hint);
-        const result = jsonResult(value, text);
-        const bytes = enc.encode(JSON.stringify(result)).length;
-        if (bytes > MAX_DISCOVERY_RESULT_BYTES) {
-            throw new DiscoveryPolicyError("result_too_large", `Discovery result is ${bytes} UTF-8 bytes, over the ${MAX_DISCOVERY_RESULT_BYTES}-byte ceiling. ${hint}`);
+const discoveryResult = function (operation, hint) {
+    return authFlow(function* () {
+        try {
+            const value = yield* upwardStep(authCall(operation, []));
+            const text = boundedDiscoveryText(value, hint);
+            const result = jsonResult(value, text);
+            const bytes = enc.encode(JSON.stringify(result)).length;
+            if (bytes > MAX_DISCOVERY_RESULT_BYTES) {
+                throw new DiscoveryPolicyError("result_too_large", `Discovery result is ${bytes} UTF-8 bytes, over the ${MAX_DISCOVERY_RESULT_BYTES}-byte ceiling. ${hint}`);
+            }
+            return result;
         }
-        return result;
-    }
-    catch (err) {
-        if (err instanceof DiscoveryPolicyError) {
-            return discoveryErrorResult(err);
+        catch (err) {
+            if (err instanceof DiscoveryPolicyError) {
+                return discoveryErrorResult(err);
+            }
+            throw err;
         }
-        throw err;
-    }
-}
+    });
+};
 /** True if `b` is a UTF-8 continuation byte (0b10xxxxxx). */
 function isContinuationByte(b) {
     return b !== undefined && (b & 0xc0) === 0x80;
@@ -84,7 +90,7 @@ function isValidResultOffset(value) {
  * (issue #38). An offset at or past `bytes.length` is left alone — there is no
  * character there to split.
  */
-export function alignStartToCharBoundary(bytes, offset) {
+function alignStartToCharBoundary(bytes, offset) {
     let o = offset;
     while (o > 0 && isContinuationByte(bytes[o]))
         o--;
@@ -92,7 +98,7 @@ export function alignStartToCharBoundary(bytes, offset) {
 }
 /** End boundary for UTF-8-safe, forward-progressing result pages. See
  * documentation/meta-tools.md#result-representation. */
-export function alignEndToCharBoundary(bytes, offset, end, total) {
+function alignEndToCharBoundary(bytes, offset, end, total) {
     if (end >= total)
         return total;
     // A window that reaches no further than `offset` yields no bytes and no
@@ -172,6 +178,14 @@ function isWellFormedText(text) {
  */
 const READ_REDUCE_FIRST = "To find something specific, repeat this read inside execute_code with connecta.call and filter or search the result there, returning only what matters";
 function pagingHint(results, totalBytes, preview) {
+    if (results.pagingTool === "read_result") {
+        const shown = preview.kind === "prefix"
+            ? `Bytes 0-${preview.bytes} of ${totalBytes} follow; page the rest`
+            : preview.kind === "text-of-envelope"
+                ? `Its text follows; page the full ${totalBytes}-byte content array as JSON`
+                : `Page all ${totalBytes} bytes`;
+        return `${results.write ? WRITE_ALREADY_RAN + " " : ""}${shown} with read_result using nextAction.`;
+    }
     if (!results.write) {
         if (results.binding.program)
             return "filter/map/slice data inside execute_code and return only what you need; page this completed return with connecta.result using nextAction.";
@@ -199,136 +213,155 @@ function pagingHint(results, totalBytes, preview) {
  * documentation/meta-tools.md#result-representation). It is one compact JSON
  * line with no raw newline, so the preview starts after the first `\n`.
  */
-async function stashResult(bytes, results, preview, rawText) {
-    const totalBytes = bytes.length;
-    // Direct pages promise offsets into the original UTF-8 text. JSON-escaping
-    // raw text would change that contract; never stash the encoder's replacement
-    // characters as if they were the completed call's output.
-    if (rawText !== undefined && !isWellFormedText(rawText))
-        return {
-            truncated: true,
-            totalBytes,
-            hint: `${results.write ? WRITE_ALREADY_RAN + " " : ""}Paging is unavailable: text contains unpaired surrogates and can't be paged as text; request the value as JSON (value mode or a JSON-returning call) to recover it.`,
-        };
-    const id = crypto.randomUUID();
-    try {
-        // Base64 permits byte-range decoding, and splitting the envelope across
-        // keys keeps a page's storage read proportional to the page instead of to
-        // the whole result (issue #540). Chunk 0 carries the header; the connecta.result
-        // reader below maps a byte offset back to chunk index and base64 quad.
-        const chunkBytes = resultChunkBytes(totalBytes);
-        const binding = base64Of(enc.encode(JSON.stringify(results.binding)));
-        const chunks = [`${RESULT_ENVELOPE_V4}${binding}:${totalBytes}:${chunkBytes}:${results.cap}:`];
-        for (let offset = 0; offset < bytes.length; offset += chunkBytes) {
-            const chunk = base64Of(bytes.subarray(offset, offset + chunkBytes));
-            if (offset === 0)
-                chunks[0] += chunk;
-            else
-                chunks.push(chunk);
-        }
-        if (!(await results.set(id, chunks, RESULT_TTL_SECONDS))) {
-            throw new Error("Result stash capacity exhausted");
-        }
-    }
-    catch {
-        // Paging is advisory after a completed call, including an approved write.
-        // Neither backend prose nor a retry hint belongs in this successful result.
+const stashResult = function (bytes, results, preview, rawText) {
+    return authFlow(function* () {
+        const totalBytes = bytes.length;
+        // Direct pages promise offsets into the original UTF-8 text. JSON-escaping
+        // raw text would change that contract; never stash the encoder's replacement
+        // characters as if they were the completed call's output.
+        if (rawText !== undefined && !isWellFormedText(rawText))
+            return {
+                truncated: true,
+                totalBytes,
+                hint: `${results.write ? WRITE_ALREADY_RAN + " " : ""}Paging is unavailable: text contains unpaired surrogates and can't be paged as text; request the value as JSON (value mode or a JSON-returning call) to recover it.`,
+            };
+        const id = crypto.randomUUID();
         try {
-            results.warn();
+            // Base64 permits byte-range decoding, and splitting the envelope across
+            // keys keeps a page's storage read proportional to the page instead of to
+            // the whole result (issue #540). Chunk 0 carries the header; the connecta.result
+            // reader below maps a byte offset back to chunk index and base64 quad.
+            const chunkBytes = resultChunkBytes(totalBytes);
+            const binding = base64Of(enc.encode(JSON.stringify(results.binding)));
+            const chunks = [`${RESULT_ENVELOPE_V4}${binding}:${totalBytes}:${chunkBytes}:${results.cap}:`];
+            for (let offset = 0; offset < bytes.length; offset += chunkBytes) {
+                const chunk = base64Of(bytes.subarray(offset, offset + chunkBytes));
+                if (offset === 0)
+                    chunks[0] += chunk;
+                else
+                    chunks.push(chunk);
+            }
+            if (!(yield* upwardStep(authInvoke(results, "set", [id, chunks, RESULT_TTL_SECONDS])))) {
+                throw new Error("Result stash capacity exhausted");
+            }
         }
         catch {
-            // Logging cannot change the call either.
+            // Paging is advisory after a completed call, including an approved write.
+            // Neither backend prose nor a retry hint belongs in this successful result.
+            try {
+                results.warn();
+            }
+            catch {
+                // Logging cannot change the call either.
+            }
+            return {
+                truncated: true,
+                totalBytes,
+                hint: results.write
+                    ? `Paging is unavailable. ${WRITE_ALREADY_RAN}`
+                    : results.pagingTool
+                        ? "Paging is unavailable."
+                        : "Paging is unavailable. Use execute_code to reduce read-only results before returning them.",
+            };
         }
         return {
             truncated: true,
+            resultId: id,
             totalBytes,
-            hint: results.write
-                ? `Paging is unavailable. ${WRITE_ALREADY_RAN}`
-                : "Paging is unavailable. Use execute_code to reduce read-only results before returning them.",
+            hint: pagingHint(results, totalBytes, preview),
+            nextOffset: preview.kind === "prefix" ? preview.bytes : 0,
+            nextAction: results.pagingTool === "read_result"
+                ? {
+                    tool: "read_result",
+                    arguments: { id, offset: preview.kind === "prefix" ? preview.bytes : 0 },
+                }
+                : {
+                    tool: "execute_code",
+                    // A byte may cost six JSON characters when escaped. Leave room for the
+                    // result id, page counters, and continuation metadata in the returned page.
+                    arguments: {
+                        code: `async () => await connecta.result(${JSON.stringify(id)}, { offset: ${preview.kind === "prefix" ? preview.bytes : 0}, maxBytes: ${Math.floor((MAX_EXECUTE_RESULT_CHARS - 1024) / 6)} })`,
+                    },
+                },
         };
-    }
-    return {
-        truncated: true,
-        resultId: id,
-        totalBytes,
-        hint: pagingHint(results, totalBytes, preview),
-        nextOffset: preview.kind === "prefix" ? preview.bytes : 0,
-        nextAction: {
-            tool: "execute_code",
-            // A byte may cost six JSON characters when escaped. Leave room for the
-            // result id, page counters, and continuation metadata in the returned page.
-            arguments: {
-                code: `async () => await connecta.result(${JSON.stringify(id)}, { offset: ${preview.kind === "prefix" ? preview.bytes : 0}, maxBytes: ${Math.floor((MAX_EXECUTE_RESULT_CHARS - 1024) / 6)} })`,
-            },
-        },
-    };
-}
+    });
+};
 /** Program calls use the direct-call envelope, ledger, expiry and authority. */
-export async function pageProgramResult(registry, baseUrl, resolved, value, format, secrets, requestScope, wireBytes = PROGRAM_RESULT_WIRE_BYTES) {
-    const data = secrets.redact(value);
-    const wire = JSON.stringify({ data, format });
-    if (enc.encode(wire).length <= wireBytes)
-        return { data, format };
-    const text = secrets.text(format === "text" ? String(data) : serializeResultText(data));
-    const bytes = enc.encode(text);
-    const write = resolved.definition.classification !== "read";
-    const notice = await stashResult(bytes, {
-        binding: {
-            identity: registry.resultIdentity(),
-            baseUrl,
-            connector: resolved.connector.id,
-            tool: resolved.definition.name,
-            classification: write ? "write" : "read",
-        },
-        write,
-        cap: resolveMaxResultBytes(resolved.connector.maxResultBytes, registry.maxResultBytes),
-        set: (id, chunks, ttl) => registry.stashResult(id, chunks, ttl),
-        warn: () => logFailure(registry.contextFor(resolved.connector.id, baseUrl, requestScope).logger, "result paging unavailable", failureRecord({ connector: resolved.connector.id, tool: resolved.definition })),
-    }, { kind: "none" }, format === "text" ? text : undefined);
-    return {
-        format: "paged",
-        valueFormat: format,
-        ...(notice.resultId ? { resultId: notice.resultId } : {}),
-        totalBytes: bytes.length,
-        truncated: true,
-        hint: notice.resultId
-            ? `${write ? WRITE_ALREADY_RAN + " " : ""}Page this result with connecta.result(handle); do not repeat the call for output.`
-            : notice.hint,
-    };
+export function pageProgramResult(registry, baseUrl, resolved, value, format, secrets, requestScope, wireBytes = PROGRAM_RESULT_WIRE_BYTES) {
+    return runEdge(pageProgramResultNative(registry, baseUrl, resolved, value, format, secrets, requestScope, wireBytes));
 }
+const pageProgramResultNative = /* @__PURE__ */ registerAuth(pageProgramResult, function (registry, baseUrl, resolved, value, format, secrets, requestScope, wireBytes = PROGRAM_RESULT_WIRE_BYTES) {
+    return authFlow(function* () {
+        const data = secrets.redact(value);
+        const wire = JSON.stringify({ data, format });
+        if (enc.encode(wire).length <= wireBytes)
+            return { data, format };
+        const text = secrets.text(format === "text" ? String(data) : serializeResultText(data));
+        const bytes = enc.encode(text);
+        const write = resolved.definition.classification !== "read";
+        const notice = yield* upwardStep(stashResult(bytes, {
+            binding: {
+                identity: registry.resultIdentity(),
+                baseUrl,
+                connector: resolved.connector.id,
+                tool: resolved.definition.name,
+                classification: write ? "write" : "read",
+            },
+            write,
+            cap: resolveMaxResultBytes(resolved.connector.maxResultBytes, registry.maxResultBytes),
+            set: authMethod((id, chunks, ttl) => registryProgram(registry, "stashResult", id, chunks, ttl)),
+            warn: () => logFailure(registry.contextFor(resolved.connector.id, baseUrl, requestScope).logger, "result paging unavailable", failureRecord({ connector: resolved.connector.id, tool: resolved.definition })),
+        }, { kind: "none" }, format === "text" ? text : undefined));
+        return {
+            format: "paged",
+            valueFormat: format,
+            ...(notice.resultId ? { resultId: notice.resultId } : {}),
+            totalBytes: bytes.length,
+            truncated: true,
+            hint: notice.resultId
+                ? `${write ? WRITE_ALREADY_RAN + " " : ""}Page this result with connecta.result(handle); do not repeat the call for output.`
+                : notice.hint,
+        };
+    });
+});
 /** Program returns share the direct stash, with all host-admitted call dependencies. */
-export async function guardProgramReturn(value, registry, baseUrl, dependencies, secrets, logger, maxChars, completedWrite) {
-    const serialized = serializeResultText(value);
-    if (serialized.length <= maxChars)
-        return value;
-    const text = secrets.text(serialized);
-    const bytes = enc.encode(text);
-    const write = dependencies.some((dependency) => dependency.classification === "write");
-    const cap = Math.min(registry.maxResultBytes, ...dependencies.map((dependency) => resolveMaxResultBytes(registry.getConnector(dependency.connector)?.maxResultBytes, registry.maxResultBytes)));
-    const results = {
-        secrets,
-        binding: {
-            identity: registry.resultIdentity(),
-            baseUrl,
-            classification: write ? "write" : "read",
-            program: dependencies,
-        },
-        write: completedWrite,
-        cap,
-        set: (id, chunks, ttl) => registry.stashResult(id, chunks, ttl),
-        warn: () => logFailure(logger, "result paging unavailable", failureRecord({})),
-    };
-    const notice = await stashResult(bytes, results, { kind: "none" }, text);
-    // Put the entire recovery route ahead of the preview in both response forms.
-    // A client retaining only the first 2,000 characters still sees the action.
-    if (notice.resultId) {
-        const base = { ...notice, totalChars: text.length, preview: "" };
-        const budget = Math.max(0, maxChars - JSON.stringify(base).length);
-        return { ...base, preview: escapedHeadOf(bytes, Math.min(512, budget)) };
-    }
-    const fallback = guardExecuteResultValue(secrets.redact(value), maxChars, notice.hint);
-    return { truncated: true, totalChars: fallback.totalChars, hint: fallback.hint, preview: fallback.preview };
+export function guardProgramReturn(value, registry, baseUrl, dependencies, secrets, logger, maxChars, completedWrite) {
+    return runEdge(guardProgramReturnNative(value, registry, baseUrl, dependencies, secrets, logger, maxChars, completedWrite));
 }
+const guardProgramReturnNative = /* @__PURE__ */ registerAuth(guardProgramReturn, function (value, registry, baseUrl, dependencies, secrets, logger, maxChars, completedWrite) {
+    return authFlow(function* () {
+        const serialized = serializeResultText(value);
+        if (serialized.length <= maxChars)
+            return value;
+        const text = secrets.text(serialized);
+        const bytes = enc.encode(text);
+        const write = dependencies.some((dependency) => dependency.classification === "write");
+        const cap = Math.min(registry.maxResultBytes, ...dependencies.map((dependency) => resolveMaxResultBytes(registry.getConnector(dependency.connector)?.maxResultBytes, registry.maxResultBytes)));
+        const results = {
+            secrets,
+            binding: {
+                identity: registry.resultIdentity(),
+                baseUrl,
+                classification: write ? "write" : "read",
+                program: dependencies,
+            },
+            write: completedWrite,
+            cap,
+            set: authMethod((id, chunks, ttl) => registryProgram(registry, "stashResult", id, chunks, ttl)),
+            warn: () => logFailure(logger, "result paging unavailable", failureRecord({})),
+        };
+        const notice = yield* upwardStep(stashResult(bytes, results, { kind: "none" }, text));
+        // Put the entire recovery route ahead of the preview in both response forms.
+        // A client retaining only the first 2,000 characters still sees the action.
+        if (notice.resultId) {
+            const base = { ...notice, totalChars: text.length, preview: "" };
+            const budget = Math.max(0, maxChars - JSON.stringify(base).length);
+            return { ...base, preview: escapedHeadOf(bytes, Math.min(512, budget)) };
+        }
+        const fallback = guardExecuteResultValue(secrets.redact(value), maxChars, notice.hint);
+        return { truncated: true, totalChars: fallback.totalChars, hint: fallback.hint, preview: fallback.preview };
+    });
+});
 /** The first `cap` bytes of `bytes`, ending on a character boundary. */
 function headOf(bytes, cap) {
     return bytes.subarray(0, alignEndToCharBoundary(bytes, 0, cap, bytes.length));
@@ -347,53 +380,59 @@ function noticeFirst(notice, preview) {
  * `text` already encoded, so a caller that had to measure it to make this
  * decision doesn't encode it twice.
  */
-async function guardEncoded(text, bytes, results, cap) {
-    if (bytes.length <= cap) {
-        return {
-            result: { content: [{ type: "text", text }] },
-            truncated: false,
-        };
-    }
-    if (!isWellFormedText(text)) {
-        const notice = await stashResult(bytes, results, { kind: "none" }, text);
-        return { result: noticeFirst(notice, ""), truncated: true };
-    }
-    const head = headOf(bytes, cap);
-    const notice = await stashResult(bytes, results, {
-        kind: "prefix",
-        bytes: head.length,
+const guardEncoded = function (text, bytes, results, cap) {
+    return authFlow(function* () {
+        if (bytes.length <= cap) {
+            return {
+                result: { content: [{ type: "text", text }] },
+                truncated: false,
+            };
+        }
+        if (!isWellFormedText(text)) {
+            const notice = yield* upwardStep(stashResult(bytes, results, { kind: "none" }, text));
+            return { result: noticeFirst(notice, ""), truncated: true };
+        }
+        const head = headOf(bytes, cap);
+        const notice = yield* upwardStep(stashResult(bytes, results, {
+            kind: "prefix",
+            bytes: head.length,
+        }));
+        return { result: noticeFirst(notice, dec.decode(head)), truncated: true };
     });
-    return { result: noticeFirst(notice, dec.decode(head)), truncated: true };
-}
+};
 /** {@link guardEncoded} over a string that has not been measured yet. */
-async function guardText(text, results, cap) {
-    // `JSON.stringify`'s type says `string` where its behavior says `string |
-    // undefined`, so TypeScript alone does not keep a non-string out of here.
-    // Normalizing at the door means the size check below always measures exactly
-    // the text that is emitted, and no future caller can launder a non-string
-    // through it the way issue #42 describes.
-    const serialized = typeof text === "string" ? text : serializeResultText(text);
-    const body = results.secrets?.text(serialized) ?? serialized;
-    return guardEncoded(body, enc.encode(body), results, cap);
-}
+const guardText = function (text, results, cap) {
+    return authFlow(function* () {
+        // `JSON.stringify`'s type says `string` where its behavior says `string |
+        // undefined`, so TypeScript alone does not keep a non-string out of here.
+        // Normalizing at the door means the size check below always measures exactly
+        // the text that is emitted, and no future caller can launder a non-string
+        // through it the way issue #42 describes.
+        const serialized = typeof text === "string" ? text : serializeResultText(text);
+        const body = results.secrets?.text(serialized) ?? serialized;
+        return yield* upwardStep(guardEncoded(body, enc.encode(body), results, cap));
+    });
+};
 /** Store an oversized JSON value and replace it with a page handle. */
-async function guardValue(value, results, cap) {
-    const serialized = serializeResultText(value);
-    const text = results.secrets?.text(serialized) ?? serialized;
-    const bytes = enc.encode(text);
-    if (bytes.length <= cap)
-        return { result: results.secrets?.redact(value) ?? value, truncated: false };
-    const notice = await stashResult(bytes, results, { kind: "none" });
-    return {
-        result: notice.resultId
-            ? notice
-            : {
-                ...notice,
-                preview: escapedHeadOf(bytes, cap),
-            },
-        truncated: true,
-    };
-}
+const guardValue = function (value, results, cap) {
+    return authFlow(function* () {
+        const serialized = serializeResultText(value);
+        const text = results.secrets?.text(serialized) ?? serialized;
+        const bytes = enc.encode(text);
+        if (bytes.length <= cap)
+            return { result: results.secrets?.redact(value) ?? value, truncated: false };
+        const notice = yield* upwardStep(stashResult(bytes, results, { kind: "none" }));
+        return {
+            result: notice.resultId
+                ? notice
+                : {
+                    ...notice,
+                    preview: escapedHeadOf(bytes, cap),
+                },
+            truncated: true,
+        };
+    });
+};
 /**
  * The longest head of `bytes` whose JSON string form fits `cap` bytes. Value
  * mode carries an unpageable preview inside its JSON envelope, where escaping
@@ -432,48 +471,50 @@ function escapedHeadOf(bytes, cap) {
  * the head of a half-written base64 image is of no use to anyone. Either way
  * the full envelope is stashed and pages through `connecta.result`.
  */
-async function guardContent(content, results, cap) {
-    content = results.secrets?.redact({ content }).content ?? content;
-    const only = content.length === 1 ? content[0] : undefined;
-    if (only?.type === "text" && typeof only.text === "string") {
-        const bytes = enc.encode(only.text);
-        // Under the cap the block passes through untouched, annotations included.
-        if (bytes.length <= cap)
+const guardContent = function (content, results, cap) {
+    return authFlow(function* () {
+        content = results.secrets?.redact({ content }).content ?? content;
+        const only = content.length === 1 ? content[0] : undefined;
+        if (only?.type === "text" && typeof only.text === "string") {
+            const bytes = enc.encode(only.text);
+            // Under the cap the block passes through untouched, annotations included.
+            if (bytes.length <= cap)
+                return { result: { content }, truncated: false };
+            return yield* upwardStep(guardEncoded(only.text, bytes, results, cap));
+        }
+        let text;
+        try {
+            const serialized = JSON.stringify(content);
+            text = results.secrets?.text(serialized) ?? serialized;
+        }
+        catch {
+            // A block carrying a BigInt or a cycle cannot be serialized, so it cannot
+            // be measured, stashed, or paged either — there is nothing this guard could
+            // do with it. Pass it through as the old text-only measure did, rather than
+            // turning a call that used to succeed into result_processing_failed.
             return { result: { content }, truncated: false };
-        return guardEncoded(only.text, bytes, results, cap);
-    }
-    let text;
-    try {
-        const serialized = JSON.stringify(content);
-        text = results.secrets?.text(serialized) ?? serialized;
-    }
-    catch {
-        // A block carrying a BigInt or a cycle cannot be serialized, so it cannot
-        // be measured, stashed, or paged either — there is nothing this guard could
-        // do with it. Pass it through as the old text-only measure did, rather than
-        // turning a call that used to succeed into result_processing_failed.
-        return { result: { content }, truncated: false };
-    }
-    const bytes = enc.encode(text);
-    // Under the cap the downstream blocks pass through untouched, non-text ones
-    // included, in their original order.
-    if (bytes.length <= cap) {
-        return { result: { content }, truncated: false };
-    }
-    if (content.every((b) => b.type === "text")) {
-        const joined = enc.encode(content.map((b) => b.text).join("\n"));
-        const notice = await stashResult(bytes, results, { kind: "text-of-envelope" });
+        }
+        const bytes = enc.encode(text);
+        // Under the cap the downstream blocks pass through untouched, non-text ones
+        // included, in their original order.
+        if (bytes.length <= cap) {
+            return { result: { content }, truncated: false };
+        }
+        if (content.every((b) => b.type === "text")) {
+            const joined = enc.encode(content.map((b) => b.text).join("\n"));
+            const notice = yield* upwardStep(stashResult(bytes, results, { kind: "text-of-envelope" }));
+            return {
+                result: noticeFirst(notice, dec.decode(headOf(joined, cap))),
+                truncated: true,
+            };
+        }
+        const notice = yield* upwardStep(stashResult(bytes, results, { kind: "none" }));
         return {
-            result: noticeFirst(notice, dec.decode(headOf(joined, cap))),
+            result: { content: [{ type: "text", text: JSON.stringify(notice) }] },
             truncated: true,
         };
-    }
-    const notice = await stashResult(bytes, results, { kind: "none" });
-    return {
-        result: { content: [{ type: "text", text: JSON.stringify(notice) }] },
-        truncated: true,
-    };
-}
+    });
+};
 /**
  * Every meta-tool handler over a registry, one per registered tool. Exported for
  * direct testing; registerMetaTools() wires the six explicit tools onto an
@@ -503,7 +544,13 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
     // request without leaking request-bound I/O into the next one.
     const requestScope = opts.requestScope ?? {};
     if (opts.canManageAuth || opts.oauthConnectUrl || opts.credentialHandoffUrl || opts.oauthConnectUnavailable) {
-        bindAuthorizationHandoffs(requestScope, (connector) => authorizationHandoff(registry, baseUrl, requestScope, opts, { connector }));
+        bindAuthorizationHandoffs(requestScope, authMethod((connector) => authCall(authorizationHandoff, [
+            registry,
+            baseUrl,
+            requestScope,
+            opts,
+            { connector },
+        ])));
     }
     const sentSecrets = sentSecretsForRequest(requestScope);
     const skills = new SkillsRegistry(registry, baseUrl, {
@@ -525,144 +572,162 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
     });
     const invocation = new InvocationService(registry, catalog, opts.activity);
     /** MCP adapter: shared invocation semantics plus MCP-only result shaping. */
-    async function runCall(call, source) {
-        const timeoutMs = normalizeTimeoutMs(call.timeoutMs) ?? defaultToolTimeoutMs;
-        const outcome = await invocation.invoke(call.address, call.args ?? {}, {
-            source,
-            sentSecrets,
-            readOnly: opts.readOnly,
-            ...(timeoutMs !== undefined ? { timeoutMs } : {}),
-            ...(opts.requestSignal !== undefined ? { requestSignal: opts.requestSignal } : {}),
-            unwrapResult: call.resultMode === "value",
-            ...(opts.downstreamInput
-                ? {
-                    processInputRequired: async (result, resolved, secrets) => {
-                        await captureDownstreamInput(requestScope, resolved.connector.id, `${resolved.connector.id}.${resolved.toolName}`, result, secrets);
-                        return { toolResult: { content: [] } };
-                    },
-                }
-                : {}),
-            processResult: async (result, resolved, secrets, format) => {
-                // Result-size cap for THIS call: the connector's own override wins,
-                // then the deployment-wide value, then the built-in default (already
-                // folded into `globalCap`). Resolved per call so one request can
-                // mix a tight-capped connector with siblings on the global cap. An
-                // override the registry already warned about at startup is dropped
-                // here, so the connector simply inherits `globalCap`.
-                const cap = resolveMaxResultBytes(resolved.connector.maxResultBytes, globalCap);
-                const results = {
-                    secrets,
-                    binding: {
-                        identity: registry.resultIdentity(),
-                        baseUrl,
-                        connector: resolved.connector.id,
-                        tool: resolved.definition.name,
-                        classification: resolved.definition.classification === "read" ? "read" : "write",
-                    },
-                    write: resolved.definition.classification !== "read",
-                    cap,
-                    set: (id, value, ttlSeconds) => registry.stashResult(id, value, ttlSeconds),
-                    // The catalog entry, never `toolName`: a record names a tool
-                    // only through the grammar check (src/operator-record.ts).
-                    warn: () => logFailure(registry.contextFor(resolved.connector.id, baseUrl, requestScope).logger, "result paging unavailable", failureRecord({ connector: resolved.connector.id, tool: resolved.definition })),
-                };
-                const processed = (toolResult, truncated, value) => ({
-                    toolResult,
-                    ...value,
-                    ...(truncated ? { friction: "result_too_large" } : {}),
-                });
-                if (call.resultMode === "value") {
-                    let value = result;
-                    const guarded = await guardValue(value, results, cap);
-                    value = guarded.result;
-                    return processed(jsonResult({ ok: true, data: value, format }), guarded.truncated, { value });
-                }
-                if (resolved.connector.kind === "mcp") {
-                    const mcpResult = result;
-                    let content = mcpResult?.content ?? [];
-                    if (!content.some((block) => block.type === "text") && mcpResult?.structuredContent !== undefined) {
-                        content = [
-                            ...content,
-                            {
-                                type: "text",
-                                text: JSON.stringify(mcpResult.structuredContent),
+    function runCall(call, source) {
+        return runEdge(runCallNative(call, source));
+    }
+    const runCallNative = /* @__PURE__ */ registerAuth(runCall, function (call, source) {
+        return authFlow(function* () {
+            const timeoutMs = normalizeTimeoutMs(call.timeoutMs) ?? defaultToolTimeoutMs;
+            const outcome = yield* upwardStep(authInvoke(invocation, "invoke", [
+                call.address,
+                call.args ?? {},
+                {
+                    source,
+                    activitySource: opts.activitySource,
+                    sentSecrets,
+                    readOnly: opts.readOnly,
+                    ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+                    ...(opts.requestSignal !== undefined ? { requestSignal: opts.requestSignal } : {}),
+                    unwrapResult: call.resultMode === "value",
+                    ...(opts.downstreamInput
+                        ? {
+                            processInputRequired: authMethod((result, resolved, secrets) => authFlow(function* () {
+                                yield* upwardStep(authCall(captureDownstreamInput, [
+                                    requestScope,
+                                    resolved.connector.id,
+                                    `${resolved.connector.id}.${resolved.toolName}`,
+                                    result,
+                                    secrets,
+                                    resolved.definition.classification !== "read",
+                                ]));
+                                return { toolResult: { content: [] } };
+                            })),
+                        }
+                        : {}),
+                    processResult: authMethod((result, resolved, secrets, format) => authFlow(function* () {
+                        // Result-size cap for THIS call: the connector's own override wins,
+                        // then the deployment-wide value, then the built-in default (already
+                        // folded into `globalCap`). Resolved per call so one request can
+                        // mix a tight-capped connector with siblings on the global cap. An
+                        // override the registry already warned about at startup is dropped
+                        // here, so the connector simply inherits `globalCap`.
+                        const cap = resolveMaxResultBytes(resolved.connector.maxResultBytes, globalCap);
+                        const results = {
+                            secrets,
+                            binding: {
+                                identity: registry.resultIdentity(),
+                                baseUrl,
+                                connector: resolved.connector.id,
+                                tool: resolved.definition.name,
+                                classification: resolved.definition.classification === "read" ? "read" : "write",
                             },
-                        ];
+                            write: resolved.definition.classification !== "read",
+                            cap,
+                            ...(opts.pagingTool ? { pagingTool: opts.pagingTool } : {}),
+                            set: authMethod((id, value, ttlSeconds) => registryProgram(registry, "stashResult", id, value, ttlSeconds)),
+                            // The catalog entry, never `toolName`: a record names a tool
+                            // only through the grammar check (src/operator-record.ts).
+                            warn: () => logFailure(registry.contextFor(resolved.connector.id, baseUrl, requestScope).logger, "result paging unavailable", failureRecord({ connector: resolved.connector.id, tool: resolved.definition })),
+                        };
+                        const processed = (toolResult, truncated, value) => ({
+                            toolResult,
+                            ...value,
+                            ...(truncated ? { friction: "result_too_large" } : {}),
+                        });
+                        if (call.resultMode === "value") {
+                            let value = result;
+                            const guarded = yield* upwardStep(guardValue(value, results, cap));
+                            value = guarded.result;
+                            return processed(jsonResult({ ok: true, data: value, format }), guarded.truncated, { value });
+                        }
+                        if (resolved.connector.kind === "mcp") {
+                            const mcpResult = result;
+                            let content = mcpResult?.content ?? [];
+                            if (!content.some((block) => block.type === "text") && mcpResult?.structuredContent !== undefined) {
+                                content = [
+                                    ...content,
+                                    {
+                                        type: "text",
+                                        text: JSON.stringify(mcpResult.structuredContent),
+                                    },
+                                ];
+                            }
+                            const guarded = yield* upwardStep(guardContent(content, results, cap));
+                            // Native blocks and bounded previews are the result. A format-only
+                            // structuredContent hides them in clients that prefer that field.
+                            guarded.result._meta = { "dev.connecta/format": format };
+                            return processed(guarded.result, guarded.truncated);
+                        }
+                        const value = result;
+                        const guarded = yield* upwardStep(guardText(serializeResultText(value), results, cap));
+                        guarded.result._meta = { "dev.connecta/format": format };
+                        return processed(guarded.result, guarded.truncated, { value });
+                    })),
+                    activityFriction: (processed) => processed.friction,
+                },
+            ]));
+            if (!outcome.ok) {
+                const structuredRecovery = outcome.error.nextAction !== undefined;
+                const recoveryRequired = structuredRecovery ||
+                    // Sanitized `unavailable` diagnostics ride the structured shape too;
+                    // the plain-text path would drop them (#539).
+                    outcome.error.details !== undefined ||
+                    // So does a conflict's `current`: where things stand is the retry.
+                    outcome.error.current !== undefined ||
+                    ["auth_required", "invalid_args", "input_required_unsupported"].includes(outcome.error.code);
+                // Every mode carries the complete repair envelope in both MCP forms.
+                const makeFailedResult = () => jsonResult({
+                    ok: false,
+                    error: outcome.error,
+                    durationMs: outcome.durationMs,
+                    attempts: outcome.attempts,
+                    ...(call.diagnostics ? { timing: outcome.timing } : {}),
+                });
+                let failedResult = makeFailedResult();
+                // Errors repeat in text and structuredContent. Account for
+                // both copies and JSON escaping when the bounded provider reason is large.
+                if (!recoveryRequired) {
+                    const cap = resolveMaxResultBytes(outcome.resolved?.connector.maxResultBytes, globalCap);
+                    let budget = 512;
+                    while (enc.encode(JSON.stringify(failedResult)).length > cap && budget > 0) {
+                        budget = Math.floor(budget / 2);
+                        outcome.error.message = boundedEchoText(outcome.error.message, budget);
+                        failedResult = makeFailedResult();
                     }
-                    const guarded = await guardContent(content, results, cap);
-                    // Native blocks and bounded previews are the result. A format-only
-                    // structuredContent hides them in clients that prefer that field.
-                    guarded.result._meta = { "dev.connecta/format": format };
-                    return processed(guarded.result, guarded.truncated);
-                }
-                const value = result;
-                const guarded = await guardText(serializeResultText(value), results, cap);
-                guarded.result._meta = { "dev.connecta/format": format };
-                return processed(guarded.result, guarded.truncated, { value });
-            },
-            activityFriction: (processed) => processed.friction,
-        });
-        if (!outcome.ok) {
-            const structuredRecovery = outcome.error.nextAction !== undefined;
-            const recoveryRequired = structuredRecovery ||
-                // Sanitized `unavailable` diagnostics ride the structured shape too;
-                // the plain-text path would drop them (#539).
-                outcome.error.details !== undefined ||
-                // So does a conflict's `current`: where things stand is the retry.
-                outcome.error.current !== undefined ||
-                ["auth_required", "invalid_args", "input_required_unsupported"].includes(outcome.error.code);
-            // Every mode carries the complete repair envelope in both MCP forms.
-            const makeFailedResult = () => jsonResult({
-                ok: false,
-                error: outcome.error,
-                durationMs: outcome.durationMs,
-                attempts: outcome.attempts,
-                ...(call.diagnostics ? { timing: outcome.timing } : {}),
-            });
-            let failedResult = makeFailedResult();
-            // Errors repeat in text and structuredContent. Account for
-            // both copies and JSON escaping when the bounded provider reason is large.
-            if (!recoveryRequired) {
-                const cap = resolveMaxResultBytes(outcome.resolved?.connector.maxResultBytes, globalCap);
-                let budget = 512;
-                while (enc.encode(JSON.stringify(failedResult)).length > cap && budget > 0) {
-                    budget = Math.floor(budget / 2);
-                    outcome.error.message = boundedEchoText(outcome.error.message, budget);
-                    failedResult = makeFailedResult();
                 }
+                failedResult.isError = true;
+                return {
+                    toolResult: failedResult,
+                    durationMs: outcome.durationMs,
+                    attempts: outcome.attempts,
+                    timing: outcome.timing,
+                    error: outcome.error,
+                };
             }
-            failedResult.isError = true;
+            const valueModeResult = call.resultMode === "value"
+                ? jsonResult({
+                    ok: true,
+                    data: outcome.value.value,
+                    format: outcome.format,
+                    durationMs: outcome.durationMs,
+                    attempts: outcome.attempts,
+                    ...(call.diagnostics ? { timing: outcome.timing } : {}),
+                })
+                : outcome.value.toolResult;
             return {
-                toolResult: failedResult,
+                toolResult: valueModeResult,
                 durationMs: outcome.durationMs,
                 attempts: outcome.attempts,
                 timing: outcome.timing,
-                error: outcome.error,
+                ...(Object.prototype.hasOwnProperty.call(outcome.value, "value") ? { value: outcome.value.value } : {}),
             };
-        }
-        const valueModeResult = call.resultMode === "value"
-            ? jsonResult({
-                ok: true,
-                data: outcome.value.value,
-                format: outcome.format,
-                durationMs: outcome.durationMs,
-                attempts: outcome.attempts,
-                ...(call.diagnostics ? { timing: outcome.timing } : {}),
-            })
-            : outcome.value.toolResult;
-        return {
-            toolResult: valueModeResult,
-            durationMs: outcome.durationMs,
-            attempts: outcome.attempts,
-            timing: outcome.timing,
-            ...(Object.prototype.hasOwnProperty.call(outcome.value, "value") ? { value: outcome.value.value } : {}),
-        };
-    }
+        });
+    });
     return {
-        async skills(args = {}) {
+        skills: authMethod((args = {}) => authFlow(function* () {
             try {
                 if (!args.name) {
-                    const listing = await skills.summaries();
+                    const listing = yield* upwardStep(authInvoke(skills, "summaries", []));
                     return {
                         structuredContent: { skills: listing },
                         content: [
@@ -674,31 +739,37 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
                         ],
                     };
                 }
-                const text = await skills.text(args.name);
+                const text = yield* upwardStep(authInvoke(skills, "text", [args.name]));
                 return { content: [{ type: "text", text }], structuredContent: { name: args.name, format: "text", text } };
             }
             catch (error) {
                 return errorResult(error instanceof ConnectorCallError ? error.message : "Skills are unavailable.");
             }
-        },
-        async searchTools(args) {
+        })),
+        searchTools: authMethod((args) => authFlow(function* () {
             if (args.connector !== undefined && enc.encode(args.connector).length > 512) {
                 return discoveryErrorResult(new DiscoveryPolicyError("invalid_args", "connector must be at most 512 UTF-8 bytes."));
             }
-            return discoveryResult(async () => flatSearchResult(await catalog.search({
-                ...args,
-                includeSchemaKeys: args.includeSchemas !== undefined,
-            })), "Request a smaller limit, omit fullDescriptions, or use compact schemas.");
-        },
-        async callTool(args) {
-            return (await runCall(args, "call_tool")).toolResult;
-        },
-        async callDestructiveTool(args) {
+            return yield* upwardStep(discoveryResult(authMethod(() => authFlow(function* () {
+                return yield* upwardStep(authCall(flatSearchResult, [
+                    yield* upwardStep(authInvoke(catalog, "search", [
+                        {
+                            ...args,
+                            includeSchemaKeys: args.includeSchemas !== undefined,
+                        },
+                    ])),
+                ]));
+            })), "Request a smaller limit, omit fullDescriptions, or use compact schemas."));
+        })),
+        callTool: authMethod((args) => authFlow(function* () {
+            return (yield* upwardStep(authCall(runCall, [args, "call_tool"]))).toolResult;
+        })),
+        callDestructiveTool: authMethod((args) => authFlow(function* () {
             // `reason` is read by the host's approval view and stops there — runCall
             // forwards only the call arguments, so it never reaches the connector.
-            return (await runCall(args, "call_destructive_tool")).toolResult;
-        },
-        async readResult(args, options = {}) {
+            return (yield* upwardStep(authCall(runCall, [args, "call_destructive_tool"]))).toolResult;
+        })),
+        readResult: authMethod((args, options = {}) => authFlow(function* () {
             // Defense for in-process callers too: guest paging validates these domains
             // before calling here, while internal consumers may call readResult directly.
             if (args.maxBytes !== undefined && !isValidMaxResultBytes(args.maxBytes)) {
@@ -709,7 +780,8 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
                 return errorResult(`Invalid offset ${args.offset}: must be a whole number of bytes ` +
                     `>= ${MIN_RESULT_OFFSET}. Omit it to start at the beginning.`);
             }
-            if (args.page !== undefined && (!Number.isSafeInteger(args.page) || args.page < 0 || args.offset !== undefined)) {
+            if (args.page !== undefined &&
+                (!Number.isSafeInteger(args.page) || args.page < 0 || args.offset !== undefined)) {
                 return errorResult("Use a whole page >= 0, without offset.");
             }
             const results = registry.resultsStorage();
@@ -726,11 +798,12 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
             // `false` is a storage failure — retryable, and distinct from an id that
             // is simply gone. Every key a page touches answers the same way, so a
             // backend that dies halfway through a multi-chunk page says so.
-            const read = async (key) => {
+            const read = authMethod((key) => authFlow(function* () {
+                options.onStage?.("result storage");
                 options.signal?.throwIfAborted();
                 let value;
                 try {
-                    value = (await results.get(key)) ?? null;
+                    value = (yield* upwardStep(authStorage(results, "get", [key]))) ?? null;
                 }
                 catch {
                     value = false;
@@ -739,8 +812,8 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
                 // subsequent chunk read or decode may start when that happens (INV-7).
                 options.signal?.throwIfAborted();
                 return value;
-            };
-            const stored = await read(resultKeys.chunk(args.id, 0));
+            }));
+            const stored = yield* upwardStep(authCall(read, [resultKeys.chunk(args.id, 0)]));
             if (stored === false)
                 return unavailableResult();
             if (stored === null) {
@@ -776,19 +849,19 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
                             !["read", "write"].includes(dependency.classification))) ||
                 !["read", "write"].includes(binding.classification))
                 return denied();
-            const allowed = async () => {
+            const allowed = authMethod(() => authFlow(function* () {
+                options.onStage?.("access validation");
                 options.signal?.throwIfAborted();
                 try {
-                    if (binding.program &&
-                        !(await registry.recheckResultAccess(undefined, binding.classification, options.signal)))
+                    const dependencies = binding.program ?? [binding];
+                    if (!(yield* upwardStep(registryProgram(registry, "recheckResultAccess", dependencies, binding.classification, options.signal))))
                         return false;
+                    options.signal?.throwIfAborted();
                     if (binding.classification === "write" && opts.readOnly === true)
                         return false;
-                    const dependencies = binding.program ?? [binding];
+                    const catalogs = new Map();
                     for (const dependency of dependencies) {
-                        const address = dependency.tool === undefined ? dependency.connector : `${dependency.connector}.${dependency.tool}`;
-                        if (!(await registry.recheckResultAccess(address, dependency.classification, options.signal, dependency.access)))
-                            return false;
+                        options.signal?.throwIfAborted();
                         if (dependency.tool === undefined) {
                             if (dependency.access === "catalog"
                                 ? !registry.getConnector(dependency.connector)
@@ -796,14 +869,20 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
                                 return false;
                             continue;
                         }
-                        if (!registry.getConnector(dependency.connector))
+                        const connector = registry.getConnector(dependency.connector);
+                        if (!connector)
                             return false;
-                        const tools = await registry.getTools(dependency.connector, baseUrl, requestScope, options.signal ? { signal: options.signal } : {});
+                        let tools = catalogs.get(dependency.connector);
+                        if (!tools) {
+                            tools = yield* upwardStep(registryProgram(registry, "getTools", dependency.connector, baseUrl, requestScope, options.signal ? { signal: options.signal } : {}));
+                            catalogs.set(dependency.connector, tools);
+                        }
+                        options.signal?.throwIfAborted();
                         const tool = tools.find((tool) => tool.name === dependency.tool);
                         if (!tool ||
                             !(dependency.access === "catalog" ||
                                 (dependency.classification === "read" && tool.classification === "read") ||
-                                opts.readOnly !== true))
+                                (opts.readOnly !== true && connector.readOnly !== true)))
                             return false;
                     }
                     return true;
@@ -812,9 +891,10 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
                     options.signal?.throwIfAborted();
                     return false;
                 }
-            };
-            if (!(await allowed()))
+            }));
+            if (!(yield* upwardStep(authCall(allowed, []))))
                 return denied();
+            options.onStage?.("result storage");
             opts.onResultRead?.(binding.program ?? [binding]);
             let requestedOffset = args.offset ?? 0;
             const cap = Number(header[4]);
@@ -844,7 +924,9 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
                 bytes = new Uint8Array(Math.max(0, end - start));
                 const lastChunk = Math.floor(Math.max(end - 1, start) / chunkBytes);
                 for (let index = Math.floor(start / chunkBytes); index <= lastChunk; index++) {
-                    const encoded = index === 0 ? stored.slice(header[0].length) : await read(resultKeys.chunk(args.id, index));
+                    const encoded = index === 0
+                        ? stored.slice(header[0].length)
+                        : yield* upwardStep(authCall(read, [resultKeys.chunk(args.id, index)]));
                     if (encoded === false)
                         return unavailableResult();
                     if (encoded === null) {
@@ -893,28 +975,28 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
                 hasMore,
                 ...(hasMore ? { nextOffset: end } : {}),
             };
-            if (!(await allowed()))
+            if (!(yield* upwardStep(authCall(allowed, []))))
                 return denied();
             const page = noticeFirst(pageHeader, slice);
             page.structuredContent = { ...pageHeader, text: slice, format: "text" };
             return page;
-        },
-        async authorizeConnector(args) {
+        })),
+        authorizeConnector: authMethod((args) => authFlow(function* () {
             try {
-                return jsonResult(await authorizationHandoff(registry, baseUrl, requestScope, opts, args));
+                return jsonResult(yield* upwardStep(authCall(authorizeConnector, [registry, baseUrl, requestScope, opts, args])));
             }
             catch (err) {
                 return errorResult(msg(err));
             }
-        },
+        })),
     };
 }
-const SEARCH_DESC = (readOnly) => `${readOnly ? "Use top-level search for catalog inspection; this read-only endpoint omits write tools." : "Use top-level search for catalog inspection or approval-required work before call_destructive_tool."} Unknown-address read-only work belongs in one execute_code program that searches, calls, and returns the answer. Use 2–4 action/object terms and includeSchemas="compact"; the default limit is ${DEFAULT_SEARCH_LIMIT}. Set connector when known. safety="readOnly" finds tools that run unasked; "approvalRequired" finds the fail-closed complement. These filters grant no authority. Empty query browses. Returns { catalogErrors, tools, total, offset, limit, hasMore }; read catalogErrors and absence before selecting a tool. Compact schemas have schemaFormat="text".`;
+const SEARCH_DESC = (readOnly) => `${readOnly ? "Use top-level search for catalog inspection; this read-only endpoint omits write tools." : "Use top-level search for catalog inspection or write work before call_destructive_tool."} Unknown-address read-only work belongs in one execute_code program that searches, calls, and returns the answer. Use 2–4 action/object terms and includeSchemas="compact"; the default limit is ${DEFAULT_SEARCH_LIMIT}. Set connector when known. safety="readOnly" selects reads; "approvalRequired" selects the fail-closed write complement. The host owns confirmation; these filters grant no authority. Empty query browses. Returns { catalogErrors, tools, total, offset, limit, hasMore }; read catalogErrors and absence before selecting a tool. Compact schemas have schemaFormat="text".`;
 const CALL_DESC = (readOnly) => `Call one known-address tool explicitly annotated readOnlyHint: true. Use execute_code for unknown-address, multiple, dependent, or reduced read-only work. ${readOnly ? "This endpoint is read-only and refuses every write." : "Unannotated or write-capable tools fail closed to call_destructive_tool."} A truncated result carries a connecta.result action.`;
 const CALL_DESTRUCTIVE_DESC = "Call any tool not explicitly annotated readOnlyHint: true. Include a short reason for the human reviewer after checking the schema and consequences. The reason grants no authority and is not sent downstream.";
 /** A read-only endpoint keeps the six-tool surface, so this tool says why it never writes here. */
 const CALL_DESTRUCTIVE_READ_ONLY_DESC = "This endpoint is read-only: search and describe omit write tools, and every write call here is refused. Reads still run; prefer call_tool or execute_code for them.";
-const AUTHORIZE_DESC = "Use after auth_required. Returns an OAuth or operator-credential handoff, or reports required deployment configuration. force=true requests an OAuth restart when the verified user opens the /connect URL; this tool never accepts credentials.";
+const AUTHORIZE_DESC = "Use after auth_required. Returns an OAuth or operator-credential handoff, or required deployment configuration. A configured credential reports presence only: if a call just failed with an authentication or operator-configuration error, give the retained handoff to the operator; otherwise proceed with the call. force=true requests an OAuth restart when the verified user opens the /connect URL; this tool never accepts credentials.";
 const SKILLS_DESC = "List or fetch on-demand guidance. Fetch usage only when the always-loaded instructions are insufficient or a program needs repair.";
 /**
  * Sentences appended to a meta-tool description only when this connection
@@ -981,6 +1063,13 @@ const CALL_DESTRUCTIVE_INPUT = advertisedSchema(z.strictObject({
     // trade. It is normalized to absent in the handler instead.
     reason: z.string().max(500).optional(),
 }));
+const READ_RESULT_DESC = "Page by resultId and nextAction from the truncation notice. UTF-8 byte ranges: continue from nextOffset while hasMore. Never repeat a write for output.";
+const READ_RESULT_INPUT = advertisedSchema(z.strictObject({
+    id: z.string(),
+    offset: z.number().int().nonnegative().optional(),
+    page: z.number().int().nonnegative().optional(),
+    maxBytes: z.number().int().positive().optional(),
+}));
 const AUTHORIZE_INPUT = advertisedSchema(z.object({
     connector: z.string(),
     force: z.boolean().optional(),
@@ -995,6 +1084,8 @@ const AUTHORIZE_INPUT = advertisedSchema(z.object({
  */
 export function registerMetaTools(server, registry, ctx) {
     const mt = createMetaTools(registry, ctx.baseUrl, {
+        ...(ctx.native && !ctx.native.executeCode ? { pagingTool: "read_result" } : {}),
+        ...(ctx.native ? { activitySource: "native" } : {}),
         downstreamInput: Boolean(ctx.authElicitation),
         requestScope: ctx.requestScope,
         readOnly: ctx.readOnly,
@@ -1016,22 +1107,40 @@ export function registerMetaTools(server, registry, ctx) {
     };
     server.registerTool("skills", {
         description: describedFor(registry, SKILLS_DESC, "skills"),
+        ...(ctx.native ? { _meta: { "dev.connecta/surface": { surface: "native", ...ctx.native } } } : {}),
         inputSchema: SKILLS_INPUT,
         outputSchema: SKILLS_OUTPUT,
         annotations: READ_ONLY_LOCAL,
-    }, async (args, request) => {
+    }, authMethod((args, request) => authFlow(function* () {
         bindRequest(request);
-        return mt.skills(args);
-    });
+        return yield* upwardStep(authInvoke(mt, "skills", [args]));
+    })));
+    if (ctx.native) {
+        if (!ctx.native.executeCode) {
+            server.registerTool("read_result", { description: READ_RESULT_DESC, inputSchema: READ_RESULT_INPUT, annotations: READ_ONLY_LOCAL }, authMethod((args, request) => authFlow(function* () {
+                bindRequest(request);
+                return yield* upwardStep(authInvoke(mt, "readResult", [args, { signal: request.mcpReq.signal }]));
+            })));
+        }
+        // A native call is the call_tool or call_destructive_tool call it names,
+        // run exactly as those two tools run it below.
+        return authMethod((route, call, request) => {
+            bindRequest(request);
+            const run = authMethod(() => authInvoke(mt, route === "call_tool" ? "callTool" : "callDestructiveTool", [call]));
+            return ctx.authElicitation
+                ? authInvoke(ctx.authElicitation, "run", [route, call, request, run])
+                : authCall(run, []);
+        });
+    }
     server.registerTool("search_tools", {
         description: describedFor(registry, SEARCH_DESC(ctx.readOnly === true), "search"),
         inputSchema: SEARCH_INPUT,
         outputSchema: SEARCH_OUTPUT,
         annotations: READ_ONLY_REMOTE,
-    }, async (args, request) => {
+    }, authMethod((args, request) => authFlow(function* () {
         bindRequest(request);
-        return mt.searchTools(args);
-    });
+        return yield* upwardStep(authInvoke(mt, "searchTools", [args]));
+    })));
     server.registerTool("call_tool", {
         description: CALL_DESC(ctx.readOnly === true),
         inputSchema: CALL_INPUT,
@@ -1039,12 +1148,17 @@ export function registerMetaTools(server, registry, ctx) {
         // call_tool admits only tools that are themselves explicitly read-only;
         // anything else is refused and routed to call_destructive_tool.
         annotations: READ_ONLY_REMOTE,
-    }, async (args, request) => {
+    }, authMethod((args, request) => authFlow(function* () {
         bindRequest(request);
-        return ctx.authElicitation
-            ? ctx.authElicitation.run("call_tool", args, request, () => mt.callTool(args))
-            : mt.callTool(args);
-    });
+        return yield* upwardStep(ctx.authElicitation
+            ? authInvoke(ctx.authElicitation, "run", [
+                "call_tool",
+                args,
+                request,
+                authMethod(() => authInvoke(mt, "callTool", [args])),
+            ])
+            : authInvoke(mt, "callTool", [args]));
+    })));
     server.registerTool("call_destructive_tool", {
         description: ctx.readOnly === true
             ? CALL_DESTRUCTIVE_READ_ONLY_DESC
@@ -1055,7 +1169,7 @@ export function registerMetaTools(server, registry, ctx) {
             readOnlyHint: false,
             openWorldHint: true,
         },
-    }, async (args, request) => {
+    }, authMethod((args, request) => authFlow(function* () {
         bindRequest(request);
         // `reason` is the host's to display and connecta's to keep out of the
         // downstream call, so this destructuring is the whole of its handling:
@@ -1063,10 +1177,15 @@ export function registerMetaTools(server, registry, ctx) {
         // whitespace-only one "absent" rather than a validation failure — there
         // is no field left for it to be absent from.
         const { reason: _hostContext, ...call } = args;
-        return ctx.authElicitation
-            ? ctx.authElicitation.run("call_destructive_tool", call, request, () => mt.callDestructiveTool(call))
-            : mt.callDestructiveTool(call);
-    });
+        return yield* upwardStep(ctx.authElicitation
+            ? authInvoke(ctx.authElicitation, "run", [
+                "call_destructive_tool",
+                call,
+                request,
+                authMethod(() => authInvoke(mt, "callDestructiveTool", [call])),
+            ])
+            : authInvoke(mt, "callDestructiveTool", [call]));
+    })));
     server.registerTool("authorize_connector", {
         description: AUTHORIZE_DESC,
         inputSchema: AUTHORIZE_INPUT,
@@ -1078,10 +1197,17 @@ export function registerMetaTools(server, registry, ctx) {
             destructiveHint: false,
             openWorldHint: true,
         },
-    }, async (args, request) => {
+    }, authMethod((args, request) => authFlow(function* () {
         bindRequest(request);
-        return ctx.authElicitation
-            ? ctx.authElicitation.run("authorize_connector", args, request, () => mt.authorizeConnector(args))
-            : mt.authorizeConnector(args);
-    });
+        const run = authMethod(() => authInvoke(mt, "authorizeConnector", [args]));
+        return yield* upwardStep(ctx.authElicitation
+            ? authInvoke(ctx.authElicitation, "run", [
+                "authorize_connector",
+                args,
+                request,
+                run,
+            ])
+            : authCall(run, []));
+    })));
+    return undefined;
 }