@zackbart/connecta 0.34.1 → 0.36.0

package/dist/routes/access-tokens.js

@@ -64,7 +64,7 @@ export async function routeAccessTokens(context, manager) {
     if (mutating && !isSameOrigin(request, baseUrl)) {
         return privateJson({ error: "same-origin request required" }, { status: 403 });
     }
-    const admin = await authorizeUiIdentity(request, baseUrl, opts.config.auth, "access token management", context.runtimeContext);
+    const admin = await authorizeUiIdentity(request, baseUrl, opts.config.auth, "access token management", context.runtimeContext, opts.config.logger);
     if (!admin.ok)
         return admin.response;
     // Interactive maintainers alone manage agent tokens (#837); anyone else

package/dist/routes/actor-labels.js

@@ -75,7 +75,7 @@ function labelLookups(actors, auth) {
 export function resolveActorLabels(actors, auth) {
     return Effect.suspend(() => {
         const labels = new Map();
-        const resolve = ({ key, id, provider }) => Effect.tryPromise(() => Promise.resolve(provider.activityActorLabel(id))).pipe(Effect.map(cleanActorLabel), Effect.orElseSucceed(() => undefined), Effect.map((label) => {
+        const resolve = ({ key, id, provider }) => Effect.tryPromise((signal) => Promise.resolve(provider.activityActorLabel(id, signal))).pipe(Effect.map(cleanActorLabel), Effect.orElseSucceed(() => undefined), Effect.map((label) => {
             if (label)
                 labels.set(key, label);
         }));

package/dist/routes/connect.js

@@ -84,7 +84,7 @@ async function connect(context) {
             headers: { Location: target.href, "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" },
         });
     };
-    const authz = await authorizeUiIdentity(request, baseUrl, opts.config.auth, "OAuth connection", runtimeContext);
+    const authz = await authorizeUiIdentity(request, baseUrl, opts.config.auth, "OAuth connection", runtimeContext, opts.config.logger);
     if (!authz.ok) {
         // Access sign-in is enforced at the edge. Clerk needs its own sign-in page.
         // The sign-in page returns to this link, which then sends a maintainer on

package/dist/routes/dispatch.js

@@ -0,0 +1,103 @@
+import { Context, Effect, Scheduler } from "effect";
+import * as HttpRouter from "effect/http/HttpRouter";
+import * as HttpServerError from "effect/http/HttpServerError";
+import * as HttpServerRequest from "effect/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/http/HttpServerResponse";
+import { notFoundResponse } from "../branding.js";
+import { isAgentPath } from "./agent-path.js";
+import { MCP_CORS_HEADERS } from "./mcp.js";
+import { routeConnect } from "./connect.js";
+import { routeOAuthCallback } from "./oauth.js";
+import { routeOAuthClientMetadata } from "./oauth-client-metadata.js";
+// Only execution provides this service. Registration never sees request state.
+class CurrentRoute extends Context.Service()("connecta/CurrentRoute") {
+}
+/** Private, request-free route tables, owned by one fetch handler. */
+export function createRouteDispatcher(mcp, metadata, health) {
+    let tables;
+    const missing = (context) => notFoundResponse(context.request, context.opts.config);
+    const fallback = (context) => Effect.gen(function* () {
+        if (context.request.method === "OPTIONS") {
+            return ((yield* mcp(context)) ??
+                (yield* metadata(context.request, context.baseUrl)) ??
+                new Response(null, { status: 204, headers: MCP_CORS_HEADERS }));
+        }
+        return (yield* mcp(context)) ?? missing(context);
+    });
+    const afterUi = (program) => (context) => Effect.gen(function* () {
+        const ui = context.opts.config.ui;
+        const response = ui ? yield* Effect.promise(() => ui.handle(context)) : null;
+        return response ?? (yield* program(context));
+    });
+    const optional = (program) => (context) => Effect.flatMap(program(context), (response) => (response ? Effect.succeed(response) : fallback(context)));
+    const agentProgram = (context) => Effect.map(mcp(context), (response) => response ?? missing(context));
+    const wrap = (program) => Effect.flatMap(CurrentRoute, (current) => {
+        current.entered = true;
+        return Effect.map(Effect.suspend(() => program(current.context)), HttpServerResponse.raw);
+    });
+    // make/addAll/asHttpEffect are entirely synchronous for these fixed tables.
+    // Bound only their registration/publication so concurrent first edges cannot
+    // yield halfway through and build duplicate tables. No callbacks or I/O here.
+    const initialize = Effect.suspend(() => {
+        if (tables)
+            return Effect.succeed(tables);
+        return Effect.gen(function* () {
+            const human = yield* HttpRouter.make;
+            const agent = yield* HttpRouter.make;
+            const humanRoutes = [
+                HttpRouter.route("*", "/oauth/client-metadata/*", wrap((context) => {
+                    const response = routeOAuthClientMetadata(context);
+                    return response ? Effect.succeed(response) : afterUi(fallback)(context);
+                })),
+                HttpRouter.route("*", "/connect/*", wrap(afterUi(optional(routeConnect)))),
+                HttpRouter.route("*", "/oauth/callback/*", wrap(afterUi(optional(routeOAuthCallback)))),
+                HttpRouter.route("*", "/.well-known/*", wrap(afterUi((context) => {
+                    if (!context.path.startsWith("/.well-known/"))
+                        return fallback(context);
+                    return Effect.gen(function* () {
+                        return ((yield* mcp(context)) ??
+                            (yield* metadata(context.request, context.baseUrl)) ??
+                            (context.request.method === "OPTIONS"
+                                ? new Response(null, { status: 204, headers: MCP_CORS_HEADERS })
+                                : missing(context)));
+                    });
+                }))),
+                HttpRouter.route("*", "/health", wrap(afterUi((context) => context.path === "/health" && context.request.method !== "OPTIONS"
+                    ? Effect.promise(health)
+                    : fallback(context)))),
+                HttpRouter.route("*", "/mcp/*", wrap(afterUi(fallback))),
+            ];
+            // addAll's Request markers describe execution dependencies, not services
+            // used during registration. CurrentRoute is supplied below on every call;
+            // the error marker is handled by the existing edge, never by registration.
+            yield* human.addAll(humanRoutes);
+            yield* agent.addAll([HttpRouter.route("*", "*", wrap(agentProgram))]);
+            tables = { human: human.asHttpEffect(), agent: agent.asHttpEffect() };
+            return tables;
+        });
+    }).pipe(Effect.provideService(HttpRouter.RouterConfig, {
+        ignoreDuplicateSlashes: false,
+        ignoreTrailingSlash: false,
+        caseSensitive: true,
+    }), Effect.provideService(Scheduler.PreventSchedulerYield, true), Effect.uninterruptible);
+    return (context) => Effect.gen(function* () {
+        const routers = yield* initialize;
+        const current = { context, entered: false };
+        const agent = isAgentPath(context.path);
+        // Dispatch only selects paths. Methods, body and headers belong to the
+        // original request in CurrentRoute; a GET projection also covers arbitrary
+        // extension methods outside FindMyWay's finite wildcard-method list.
+        // Escape '%' once so the matcher cannot decode raw prefixes or reject an
+        // invalid escape in an otherwise owned suffix; ';' is its query delimiter.
+        const request = HttpServerRequest.fromWeb(new Request(context.url)).modify({
+            url: context.path.replaceAll("%", "%25").replaceAll(";", "%3B"),
+        });
+        return yield* Effect.scoped(agent ? routers.agent : routers.human).pipe(Effect.provideService(CurrentRoute, current), Effect.provideService(HttpServerRequest.HttpServerRequest, request), Effect.map(HttpServerResponse.toWeb), Effect.catch((error) => !current.entered &&
+            HttpServerError.isHttpServerError(error) &&
+            error.reason instanceof HttpServerError.RouteNotFound
+            ? agent
+                ? agentProgram(context)
+                : afterUi(fallback)(context)
+            : Effect.fail(error)));
+    });
+}

package/dist/routes/mcp.js

@@ -1,5 +1,10 @@
+import { upwardStep } from "../upward.js";
+import { authCall, authInvoke, authFlow, authMethod } from "../auth/native.js";
+import { registryProgram } from "../runtime/registry.js";
+import { requestOwner, RequestScope } from "../runtime/request-scope.js";
+import { observeAgentAdmission } from "../agent-observation.js";
 import { bindActivityRequest } from "../activity-request.js";
-import { closeConnectorScope } from "../connector-scope.js";
+import { closeScope } from "../runtime/connector-scope.js";
 import { executeLimits } from "../config.js";
 import { oauthConnectUrl, oauthConnectLink, oauthConnectLinkProgress, closeOAuthConnectLinks, claimAuthRetry, oauthConnectUnavailable, } from "../oauth-handoff.js";
 import { AuthElicitation } from "../auth-elicitation.js";
@@ -9,6 +14,7 @@ import { registerExecuteTool } from "../execute.js";
 import { ExecutorAdmissionError } from "../executor-admission.js";
 import { registerMetaTools } from "../meta-tools.js";
 import { endpointInstructions } from "../skills.js";
+import { NATIVE_TOOLS_LIST_TTL_MS, NativeSurface, nativeRequestHint } from "../native-tools.js";
 import { registerSkills } from "./skills.js";
 import { failureRecord, logFailure } from "../operator-record.js";
 import { redactAgentOutput, sentSecretsForRequest } from "../sent-secrets.js";
@@ -16,12 +22,9 @@ import { detach } from "../runtime/run.js";
 import { agentEndpointPool, isAgentPath } from "./agent-path.js";
 import { admitsMaintainer, agentPool, authorize, authorizeAgent, mayManageConnector, memberPool, } from "./shared.js";
 /**
- * The SDK's own bound on the body it reads. Since server 2.1.0 the SDK
- * answers anything over 4 MiB with its own 413, which would quietly shadow
- * the bound the host already enforces: `listen()`'s `maxBodyBytes` on Node,
- * the platform's request limit on Workers. The host owns that decision, as it
- * did before the SDK had an opinion, so the SDK is told to have none. Its
- * option must be finite.
+ * Core checks admission.requests.maxBodyBytes after authentication and endpoint
+ * admission, before any SDK/body-hint reader. The SDK's separate 4 MiB default
+ * must not shadow a configured larger bound. Its option must be finite.
  */
 const SDK_BODY_BOUND = { maxRequestBodySize: Number.MAX_SAFE_INTEGER };
 // Identity, not a status/header a custom auth response could imitate.
@@ -33,12 +36,12 @@ const deadlineResponses = new WeakSet();
  */
 export const MAX_LISTEN_CLASSIFICATION_BYTES = 64 * 1024;
 /**
- * Whether an admitted, authenticated request is a modern `subscriptions/listen`.
- * Reads at most `MAX_LISTEN_CLASSIFICATION_BYTES` of a clone, then stops and
- * cancels the body: `"too_large"` past the cap, `"aborted"` when the request
- * ended or its lifetime ran out while reading.
+ * Check an authenticated, endpoint-admitted body while streaming. The clone
+ * preserves the SDK's body and protocol validation. Only a listen candidate
+ * needs decoding/classification; other bodies retain no second text copy.
+ * Cancel both tee branches past the bound or when the request ends.
  */
-async function classifyListen(request, signal) {
+async function inspectRequestBody(request, signal, maxBytes, listen) {
     const reader = request.clone().body?.getReader();
     if (!reader)
         return "other";
@@ -50,7 +53,7 @@ async function classifyListen(request, signal) {
     if (signal.aborted)
         onAbort();
     try {
-        const decoder = new TextDecoder();
+        const decoder = listen ? new TextDecoder() : undefined;
         let text = "";
         let bytes = 0;
         for (;;) {
@@ -58,15 +61,18 @@ async function classifyListen(request, signal) {
             if (done)
                 break;
             bytes += value.byteLength;
-            if (bytes > MAX_LISTEN_CLASSIFICATION_BYTES) {
+            if (bytes > maxBytes) {
                 void reader.cancel().catch(() => { });
                 void request.body?.cancel().catch(() => { });
                 return "too_large";
             }
-            text += decoder.decode(value, { stream: true });
+            if (decoder)
+                text += decoder.decode(value, { stream: true });
         }
         if (signal.aborted)
             return "aborted";
+        if (!decoder)
+            return "other";
         const protocolVersion = request.headers.get("MCP-Protocol-Version");
         const method = request.headers.get("Mcp-Method");
         const route = classifyInboundRequest({
@@ -319,7 +325,9 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
     // The modern handler tears its own down after the exchange; the legacy
     // transport never does, and neither may stay wired to an ended request.
     const servers = [];
-    const createServer = () => {
+    // A native pool lists its downstream tools directly (pools.<name>.surface).
+    const native = pool !== undefined ? opts.pools.get(pool)?.native : undefined;
+    const createServer = authMethod((hint) => authFlow(function* () {
         const authElicitation = new AuthElicitation({
             vault: opts.config.vault,
             publicUrl: opts.config.publicUrl,
@@ -327,10 +335,18 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             principal: principalKey,
             registry,
             canManage: canManageAuth,
-            connectLink: (id, force, after) => oauthConnectLink(opts, opts.config.publicUrl ?? baseUrl, id, principalKey, force, Boolean(opts.config.vault?.seal && opts.config.vault.open), after),
-            linkProgress: (id, nonce) => oauthConnectLinkProgress(opts, baseUrl, id, nonce),
-            closeLinks: (id, nonces) => closeOAuthConnectLinks(opts, baseUrl, id, nonces),
-            claimRetry: (id, nonce) => claimAuthRetry(opts, baseUrl, id, nonce),
+            connectLink: authMethod((id, force, after) => authCall(oauthConnectLink, [
+                opts,
+                opts.config.publicUrl ?? baseUrl,
+                id,
+                principalKey,
+                force,
+                Boolean(opts.config.vault?.seal && opts.config.vault.open),
+                after,
+            ])),
+            linkProgress: authMethod((id, nonce) => authCall(oauthConnectLinkProgress, [opts, baseUrl, id, nonce])),
+            closeLinks: authMethod((id, nonces) => authCall(closeOAuthConnectLinks, [opts, baseUrl, id, nonces])),
+            claimRetry: authMethod((id, nonce) => authCall(claimAuthRetry, [opts, baseUrl, id, nonce])),
             unavailable: oauthConnectUnavailable(opts),
             credentialUi: Boolean(opts.config.ui && opts.config.vault),
             requestSignal,
@@ -344,17 +360,18 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             // Instructions differ per endpoint only by the admitted pool's
             // description. Every cache hint below is private, so a client keeps
             // what it learned per endpoint URL and never shares it across them.
-            instructions: endpointInstructions(pool !== undefined ? opts.pools.get(pool)?.description : undefined),
+            instructions: endpointInstructions(pool !== undefined ? opts.pools.get(pool)?.description : undefined, native),
             inputRequired: { legacyShim: false },
             requestState: { verify: (state, context) => authElicitation.verify(state, context) },
             cacheHints: {
                 "server/discover": { ttlMs: 3_600_000, cacheScope: "private" },
                 "tools/list": {
-                    ttlMs: 3_600_000,
+                    ttlMs: native ? NATIVE_TOOLS_LIST_TTL_MS : 3_600_000,
                     cacheScope: "private",
                 },
             },
         });
+        servers.push(server);
         const activity = opts.config.activity?.store
             ? {
                 sink: opts.config.activity?.store,
@@ -378,14 +395,16 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             probeTimeoutMs: opts.config.discovery.probeTimeoutMs,
             ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
         });
-        registerMetaTools(server, registry, {
+        const diagnostics = native ? { ...native, catalogErrors: [] } : undefined;
+        const nativeRoute = registerMetaTools(server, registry, {
+            native: diagnostics,
             authElicitation,
             client,
             baseUrl,
             requestScope,
             readOnly,
             canManageAuth,
-            oauthConnectUrl: (id, force) => oauthConnectUrl(opts, baseUrl, id, principalKey, force),
+            oauthConnectUrl: authMethod((id, force) => authCall(oauthConnectUrl, [opts, baseUrl, id, principalKey, force])),
             oauthConnectUnavailable: oauthConnectUnavailable(opts),
             credentialHandoffUrl: opts.config.ui?.credentialHandoffUrl(baseUrl),
             ...(activity ? { activity } : {}),
@@ -395,39 +414,62 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             requestSignal,
             ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
         });
-        registerExecuteTool(server, registry, {
-            authElicitation,
-            client,
-            baseUrl,
-            requestScope,
-            executor: opts.executor,
-            defaultToolTimeoutMs: opts.config.calls.defaultTimeoutMs ?? opts.config.execute.hostCallTimeoutMs,
-            logger: opts.config.logger,
-            ...(activity ? { activity } : {}),
-            requestSignal,
-            ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
-            ...executeLimits(opts.config),
-            readOnly,
-        });
-        servers.push(server);
+        if (!native || native.executeCode) {
+            registerExecuteTool(server, registry, {
+                authElicitation,
+                client,
+                baseUrl,
+                requestScope,
+                executor: opts.executor,
+                defaultToolTimeoutMs: opts.config.calls.defaultTimeoutMs ?? opts.config.execute.hostCallTimeoutMs,
+                logger: opts.config.logger,
+                ...(activity ? { activity } : {}),
+                requestSignal,
+                ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
+                ...executeLimits(opts.config),
+                readOnly,
+                native: native !== undefined,
+            });
+        }
+        if (native && nativeRoute && hint) {
+            yield* upwardStep(authInvoke(new NativeSurface(registry, {
+                baseUrl,
+                executeCode: native.executeCode,
+                route: nativeRoute,
+                bind: (context) => authElicitation.bind(context),
+                catalogErrors: diagnostics.catalogErrors,
+                logger: opts.config.logger,
+                requestScope,
+                requestSignal,
+                probeTimeoutMs: opts.config.discovery.probeTimeoutMs,
+                discoveryConcurrency: opts.config.discovery.concurrency,
+                readOnly,
+                ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
+            }), "register", [server, hint]));
+        }
         return server;
-    };
-    const exchange = async () => {
+    }));
+    const exchange = authFlow(function* () {
         // The v2 entry's built-in legacy fallback streams 2025 results as SSE.
         // Connecta's established wire contract is JSON, so retain the documented
         // user-land legacy branch with the same transport setting while the modern
         // branch uses the fetch-native handler.
-        if (!(await isLegacyRequest(request, undefined, SDK_BODY_BOUND))) {
-            const response = await createMcpHandler(createServer, {
+        if (!(yield* upwardStep(authCall(isLegacyRequest, [request, undefined, SDK_BODY_BOUND])))) {
+            const response = yield* upwardStep(authInvoke(createMcpHandler(authMethod(() => authFlow(function* () {
+                const hint = native
+                    ? yield* upwardStep(authCall(nativeRequestHint, [request, true]))
+                    : undefined;
+                return yield* upwardStep(authCall(createServer, [hint]));
+            })), {
                 ...SDK_BODY_BOUND,
                 legacy: "reject",
                 // Keep the SDK's validation and prevent it from opening an SSE stream.
                 // Its capacity error below becomes our permanent unsupported method.
                 maxSubscriptions: 0,
                 onerror: (error) => logFailure(opts.config.logger, "MCP handler error", failureRecord({}, error), "error"),
-            }).fetch(request);
+            }), "fetch", [request]));
             if (request.headers.get("Mcp-Method") === "subscriptions/listen" && response.status === 200) {
-                const body = await response.clone().json();
+                const body = yield* upwardStep(authInvoke(response.clone(), "json", []));
                 if (isJSONRPCErrorResponse(body) &&
                     body.error.code === -32603 &&
                     body.error.message === "Subscription limit reached") {
@@ -441,24 +483,27 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             return response;
         }
         // Fresh server + transport per legacy request, stateless and JSON-shaped.
-        const server = createServer();
+        const hint = native
+            ? yield* upwardStep(authCall(nativeRequestHint, [request, false]))
+            : undefined;
+        const server = yield* upwardStep(authCall(createServer, [hint]));
         const transport = new WebStandardStreamableHTTPServerTransport({
             ...SDK_BODY_BOUND,
             enableJsonResponse: true,
         });
-        await server.connect(transport);
-        return transport.handleRequest(request);
-    };
+        yield* upwardStep(authInvoke(server, "connect", [transport]));
+        return yield* upwardStep(authInvoke(transport, "handleRequest", [request]));
+    });
     return Effect.addFinalizer(() => Effect.sync(() => {
         for (const server of servers)
             void server.close().catch(() => { });
-    })).pipe(Effect.andThen(Effect.promise(async () => {
-        const response = await exchange();
+    })).pipe(Effect.andThen(authFlow(function* () {
+        const response = yield* upwardStep(exchange);
         // Both SDK transports serialize here. This also covers SDK-generated
         // JSON-RPC errors and allowed HTTP 4xx text, outside tool result shaping.
         if (!response.body)
             return response;
-        const body = await response.text();
+        const body = yield* upwardStep(authInvoke(response, "text", []));
         let text;
         if (response.headers.get("Content-Type")?.includes("application/json")) {
             // Structured redaction also joins text blocks before a secret split
@@ -596,6 +641,7 @@ export function createMcpRoute(opts) {
         let deadlineTimer;
         return scopedToBody(Effect.gen(function* () {
             yield* Effect.addFinalizer(() => Effect.sync(() => {
+                requestOwner(requestScope).close();
                 if (!localAbort.signal.aborted) {
                     localAbort.abort(request.signal.reason ?? new Error("MCP request ended."));
                 }
@@ -654,9 +700,23 @@ export function createMcpRoute(opts) {
             // shares it, to save only the lookups an abandoned authorization
             // finishes on its own.
             // Agent endpoints consult only the `cta_` adapter; human endpoints refuse `cta_`.
-            const admit = () => agentEndpoint
-                ? authorizeAgent(localRequest, baseUrl, opts.config.auth)
-                : authorize(localRequest, baseUrl, opts.config.auth, runtimeContext);
+            const admit = authMethod(() => agentEndpoint
+                ? authCall(authorizeAgent, [
+                    localRequest,
+                    baseUrl,
+                    opts.config.auth,
+                    opts.config.logger,
+                    runtimeContext?.waitUntil.bind(runtimeContext),
+                ])
+                : authCall(authorize, [
+                    localRequest,
+                    baseUrl,
+                    opts.config.auth,
+                    runtimeContext,
+                    true,
+                    false,
+                    opts.config.logger,
+                ]));
             // Plain /mcp admits maintainers and serves the whole catalog; a pool
             // admits its members, people at /mcp/<pool> and agents at
             // /agent/<pool>, and serves exactly its tools (INV-4).
@@ -680,7 +740,7 @@ export function createMcpRoute(opts) {
                     : undefined;
             };
             const handled = Effect.gen(function* () {
-                const authz = yield* Effect.promise(admit);
+                const authz = yield* authCall(admit, []);
                 if (!authz.ok) {
                     const response = authz.response;
                     // Preserve the auth adapter's challenge and status. The MCP host must
@@ -726,8 +786,15 @@ export function createMcpRoute(opts) {
                     return notFound();
                 }
                 const { access, readOnly, poolOwner } = scope;
-                if (listenHeader) {
-                    const verdict = yield* Effect.promise(() => classifyListen(localRequest, localAbort.signal));
+                // Admission, not completed-call activity. This fact carries no live
+                // identity or credential and never changes the admission verdict.
+                if (agentEndpoint && authz.identity.agent && opts.config.agents.includes(authz.identity.agent)) {
+                    yield* observeAgentAdmission(opts.config.storage, authz.identity.agent, new Date().toISOString(), opts.config.discovery.probeTimeoutMs);
+                }
+                {
+                    const maxBodyBytes = opts.config.admission.requests.maxBodyBytes;
+                    const bound = listenHeader ? Math.min(maxBodyBytes, MAX_LISTEN_CLASSIFICATION_BYTES) : maxBodyBytes;
+                    const verdict = yield* Effect.promise(() => inspectRequestBody(localRequest, localAbort.signal, bound, listenHeader));
                     // The deadline timer aborts a stalled read; its body is already cancelled.
                     if (verdict === "aborted") {
                         return cors(mcpRefusal(sentSecrets, 504, -33003, "MCP request lifetime exceeded."));
@@ -735,7 +802,7 @@ export function createMcpRoute(opts) {
                     if (verdict === "too_large") {
                         return cors(mcpRefusal(sentSecrets, 413, -33006, "MCP request body too large."));
                     }
-                    if (verdict === "other") {
+                    if (listenHeader && verdict === "other") {
                         const late = yield* Effect.result(admitted(opts.requestAdmission, request.signal));
                         if (Result.isFailure(late))
                             return yield* refuseAdmission(late.failure);
@@ -762,13 +829,15 @@ export function createMcpRoute(opts) {
                         ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
                         endpoint: new URL(request.url).pathname,
                         origin: request.headers.get("Origin"),
-                        currentResultAccess: async (address, classification, signal, access) => {
+                        currentResultAccess: authMethod((dependencies, classification, signal) => authFlow(function* () {
                             signal?.throwIfAborted();
-                            const current = await admit();
+                            const current = yield* upwardStep(authCall(admit, []));
                             if (!current.ok) {
-                                await current.response.body?.cancel().catch(() => { });
+                                yield* upwardStep(authCall(() => current.response.body?.cancel().catch(() => { }), []));
+                                signal?.throwIfAborted();
                                 return false;
                             }
+                            signal?.throwIfAborted();
                             if (current.subjectKey !== authz.subjectKey || current.principalKey !== authz.principalKey)
                                 return false;
                             // Paging re-admits the caller at this endpoint, as a new request would.
@@ -784,27 +853,49 @@ export function createMcpRoute(opts) {
                             });
                             if (classification === "write" && currentReadOnly)
                                 return false;
-                            if (address === undefined)
-                                return true;
-                            // Skill and resource content requires a whole grant; catalog metadata requires visibility.
-                            if (!address.includes("."))
-                                return Boolean(access === "catalog" ? view.getConnector(address) : view.getResourceConnector(address));
-                            const resolved = view.resolveAddress(address);
-                            if (!resolved)
-                                return false;
+                            // Both admission and catalogs belong to this pass only. A second
+                            // pass after reading the page must observe revocation afresh.
                             const requestScope = {};
+                            const catalogs = new Map();
                             try {
-                                const tool = (await view.getTools(resolved.connector.id, baseUrl, requestScope, signal ? { signal } : {})).find((tool) => tool.name === resolved.toolName);
-                                signal?.throwIfAborted();
-                                return Boolean(tool &&
-                                    (access === "catalog" ||
-                                        (classification === "read" && tool.classification === "read") ||
-                                        !currentReadOnly));
+                                for (const dependency of dependencies) {
+                                    signal?.throwIfAborted();
+                                    if (dependency.classification === "write" && currentReadOnly)
+                                        return false;
+                                    // Skill and resource content requires a whole grant; catalog metadata requires visibility.
+                                    if (dependency.tool === undefined) {
+                                        if (!(dependency.access === "catalog"
+                                            ? view.getConnector(dependency.connector)
+                                            : view.getResourceConnector(dependency.connector)))
+                                            return false;
+                                        continue;
+                                    }
+                                    const resolved = view.resolveAddress(`${dependency.connector}.${dependency.tool}`);
+                                    if (!resolved)
+                                        return false;
+                                    let catalog = catalogs.get(resolved.connector.id);
+                                    if (!catalog) {
+                                        // Track even a failed load so its scope is always closed.
+                                        catalog = { connector: resolved.connector, tools: [] };
+                                        catalogs.set(resolved.connector.id, catalog);
+                                        catalog.tools = yield* upwardStep(registryProgram(view, "getTools", resolved.connector.id, baseUrl, requestScope, signal ? { signal } : {}));
+                                    }
+                                    signal?.throwIfAborted();
+                                    const tool = catalog.tools.find((tool) => tool.name === resolved.toolName);
+                                    if (!(tool &&
+                                        (dependency.access === "catalog" ||
+                                            (dependency.classification === "read" && tool.classification === "read") ||
+                                            !currentReadOnly)))
+                                        return false;
+                                }
+                                return true;
                             }
                             finally {
-                                await closeConnectorScope(resolved.connector, view.contextFor(resolved.connector.id, baseUrl, requestScope), runtimeContext?.waitUntil?.bind(runtimeContext));
+                                for (const [id, { connector }] of catalogs) {
+                                    yield* upwardStep(closeScope(connector, view.contextFor(id, baseUrl, requestScope), runtimeContext?.waitUntil?.bind(runtimeContext)));
+                                }
                             }
-                        },
+                        })),
                         caller: callerFor(authz.identity, poolOwner),
                     });
                 }
@@ -833,7 +924,7 @@ export function createMcpRoute(opts) {
             return Option.isSome(bounded)
                 ? bounded.value
                 : cors(mcpRefusal(sentSecrets, 504, -33003, "MCP request lifetime exceeded."));
-        }), localAbort.signal);
+        }).pipe(Effect.provideService(RequestScope, requestOwner(requestScope))), localAbort.signal);
     }
     return { handle: routeMcp, rejectOrigin };
 }

package/dist/routes/oauth.js

@@ -167,8 +167,10 @@ async function finishOAuthCallback(context) {
     }
     try {
         const expectedPrincipalKey = callbackTarget?.principalKey;
-        const browserIdentity = await authorizeUiIdentity(context.request, baseUrl, opts.config.auth, "OAuth callback", context.runtimeContext);
+        const browserIdentity = await authorizeUiIdentity(context.request, baseUrl, opts.config.auth, "OAuth callback", context.runtimeContext, opts.config.logger);
         if (!browserIdentity.ok) {
+            if (browserIdentity.response.status === 503)
+                return browserIdentity.response;
             if (browserIdentity.response.status === 401 && authorizationCredential(context.request).kind !== "absent")
                 return browserIdentity.response;
             // A Clerk browser handshake refreshes its session and returns to this
@@ -215,6 +217,9 @@ async function finishOAuthCallback(context) {
         if (["state", "iss", "code", "error"].some((name) => url.searchParams.getAll(name).length > 1))
             return refused();
         try {
+            if (connector.verifyCallbackParameters &&
+                !(await connector.verifyCallbackParameters(url.searchParams, connectorContext)))
+                return refused();
             const issuer = url.searchParams.get("iss");
             if (connector.verifyCallbackIssuer) {
                 if (!(await connector.verifyCallbackIssuer(issuer, connectorContext)))

package/dist/routes/operator.js

@@ -41,11 +41,11 @@ function admitted(result) {
 }
 /** Any configured caller. The gate's refusal, challenge headers and all, is the answer. */
 export function authorized({ request, baseUrl, opts, runtimeContext }, partitionIdentity = true) {
-    return Effect.suspend(() => admitted(authorize(request, baseUrl, opts.config.auth, runtimeContext, partitionIdentity)));
+    return Effect.suspend(() => admitted(authorize(request, baseUrl, opts.config.auth, runtimeContext, partitionIdentity, false, opts.config.logger)));
 }
 /** A signed-in person, for a route that changes how a connector authenticates. */
 export function authorizedPerson({ request, baseUrl, opts, runtimeContext }, purpose) {
-    return Effect.suspend(() => admitted(authorizeUiIdentity(request, baseUrl, opts.config.auth, purpose, runtimeContext)));
+    return Effect.suspend(() => admitted(authorizeUiIdentity(request, baseUrl, opts.config.auth, purpose, runtimeContext, opts.config.logger)));
 }
 /** The partition an identity carries into a registry view of the given connectors. */
 export function scopeFor(authz, connectorIds = "all") {