@zackbart/connecta 0.36.2 → 0.37.0

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to this package are documented here.
 
+## 0.37.0 — 2026-10-27
+
+Connecta 0.37.0 lets a `remoteMcp()` connection reach a trusted first-party downstream as the caller Connecta admitted, with no per-person OAuth. Request auth's new `principal` option gives the token resolver that caller's reference: people by default, and declared agents only with `accept: "human-or-agent"`. The new optional `fetch` carries all of the connector's MCP traffic, for example through a Workers service binding to a sibling Worker. The downstream must accept a forwarded identity only on its binding entrypoint or behind a verified signature. Operator status checks carry no caller, so a principal-forwarding connector reports `auth_required` on the operator pages even when calls succeed.
+
+Concurrent programs on Workers no longer fail with "Cannot call this AsyncLocalStorage bound function outside of the request in which it was created." Queued `execute_code` programs, MCP requests, connector calls and OAuth refresh waiters now resume in their own request. `workerExecutor()`'s default queue deadline rises from 5 to 60 seconds, so a queued run can wait through one default guest deadline. Queue plus run time can approach two minutes, so clients should allow deadlines to match. The pool is per isolate, as before.
+
+The operator UI no longer probes every connector twice on each page load. Maintainer admission now reads stored observations only. Each connector is then probed once, independently, and refreshes and recovery touch only the connectors involved. A slow refresh keeps the last snapshot visible as stale instead of blanking the page. The default `GET /ui/api/config` response is unchanged for other consumers.
+
+Remote MCP OAuth now decides status and consent from the stored grant. Top-level `headers` values are no longer redacted as sent secrets. Nothing here is breaking. Deployments that use neither principal forwarding nor custom `fetch` need no configuration change, but should review the longer queue deadline. The root bundle cap rose to 404,500 B gzip in #1110.
+
+### Added
+
+- Let `remoteMcp()` reach a trusted first-party downstream as the admitted caller. Request auth's new `principal: { accept, token }` gives the resolver the admitted person's `{ kind: "human", namespace, id }`, and declared agents only with `accept: "human-or-agent"`. Every other caller is refused with `auth_required` before resolving. Arguments, programs and headers cannot change the principal, and a different principal never reuses a client. An optional `fetch`, such as a Workers service binding, carries all of a connector's MCP traffic under the configured URL's HTTPS, redirect and origin rules; it cannot be combined with OAuth. Existing auth modes are unchanged.
+
+### Fixed
+
+- `remoteMcp()` top-level `headers` values are no longer treated as sent secrets. Every call in a code-mode program now reaches the downstream with arguments equal to a header value intact, instead of `[redacted]` after the first call, and results, catalogs and errors that echo a header value return it unchanged. `auth` headers and other credentials are still registered and redacted as before.
+- `remoteMcp()` OAuth now decides on the owner's stored grant rather than on a healthy handshake. A downstream that answers `initialize` and `tools/list` without credentials and challenges only `tools/call` (Google's hosted BigQuery MCP, for one) no longer reports "Already authorized": with no grant, Connect, Restart, a start after Disconnect, and `authorize_connector` start consent from the resource's RFC 9728 metadata and return its URL, and the operator status and UI report `auth_required` until a grant exists. An existing grant still reports `ok` without starting a new flow.
+- Resume a queued `execute_code` program, MCP request, connector call or OAuth refresh waiter in its own request, whichever request released the slot or finished the refresh. On Workers with compatibility date 2025-06-16 or later, workerd's September 2026 releases refused that cross-request resume: the releasing program failed with `Executor failed: Cannot call this AsyncLocalStorage bound function outside of the request in which it was created.`, and the queued one later hit `Executor admission timed out`. A slot granted just before the executor or call admission closes is given back and refused with `executor_closed` (or the call-admission `closed` refusal), so no program or call starts after shutdown. QuickJS host calls now also run in the async context of the request running the program, not the request that spawned its warm child. `workerExecutor()`'s default queue deadline rises from 5 to 60 seconds, so a queued run can wait out one default guest deadline; the pool remains two runs and eight queued per isolate, and `admission` still replaces the defaults. Queue refusals remain `executor_overloaded` with `retryable: true` and `retryAfterMs`.
+- Admit maintainer pages without live connector probes, load each connector once with its complete catalog and auth controls, scope refresh and recovery to affected connectors, and keep the last maintainer snapshot visible when admission becomes stale.
+  
+  Discard queued reads withheld by stale admission without showing sign-in, and fence connector reads again when credential or OAuth mutations settle so follow-ups observe post-write state.
+
 ## 0.36.2 — 2026-10-27
 
 Connecta 0.36.2 makes Google's hosted MCP servers, such as BigQuery, usable through generic `remoteMcp()` connections. The new `@zackbart/connecta/google` entry mints Google service-account tokens for request-local auth, so agent pools can share a service-account connection without a browser consent. The service account acts as itself, or as a Workspace user when a delegation subject is given. A rejected token is dropped and re-minted for the next request; dispatched writes are never replayed.

package/bin/version.mjs

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.36.2";
+export const CONNECTA_VERSION = "0.37.0";

package/dist/auth/downstream-oauth.js

@@ -1,11 +1,12 @@
 import { UnauthorizedError } from "@modelcontextprotocol/client";
-import { Deferred, Effect } from "effect";
+import { Effect, Exit } from "effect";
 import { byteReadResponse } from "../byte-read-response.js";
 import { deriveContext } from "../derived-context.js";
 import { ConnectorCallError, resendAdvice } from "../errors.js";
 import { oauthPartitionFor, retainOAuthPartition } from "../oauth-partition.js";
 import { keepErrorName } from "../redaction-identity.js";
 import { fromSignal, runEdge } from "../runtime/run.js";
+import { Settlement } from "../runtime/settlement.js";
 import { SentSecrets } from "../sent-secrets.js";
 import { OAUTH_FLOW_TTL_SECONDS, OAUTH_REFRESH_LEASE_SECONDS, oauthFlowKeys, oauthGrantKeys, oauthRefreshActiveKeys, oauthRefreshKeys, oauthRefreshSpentKeys, } from "../storage/keys.js";
 import { authenticateRemoteClient, downstreamClientMetadata, remoteClientAuthMethod, } from "./downstream-client-metadata.js";
@@ -189,15 +190,13 @@ function aborted(signal) {
  * The outcome of a flight another request owns, failures included. Rejects
  * only with this caller's own abort.
  *
- * This wait is a Promise edge of its own, and the caller's storage reads stay
- * outside it, on purpose. The owner settles the Deferred from its own request,
- * and Deferred resumes a waiting fiber synchronously inside that call — on
- * Workers, inside the owner's I/O context. Resolving this caller's promise
- * instead hands the rest of its work back to its own request, as workerd does
- * for any promise resolved from another one.
+ * The owner settles the flight from its own request. Settlement wakes this
+ * waiter through a Promise this request created, so the wait — and the
+ * caller's storage reads after it — resume here, never inside the owner's
+ * call (src/runtime/settlement.ts).
  */
 function waitForRefreshFlight(flight, signal, deadline) {
-    const settled = Deferred.await(flight.outcome);
+    const settled = flight.outcome.wait();
     // The abort goes first, so a caller that has already left never joins.
     return runEdge(Effect.raceAllFirst([
         ...(signal ? [fromSignal(signal)] : []),
@@ -341,7 +340,7 @@ export class OAuthRefreshCoordinator {
         if (!flight)
             return;
         this.flights.delete(epoch);
-        Deferred.doneUnsafe(flight.outcome, Effect.succeed({ status: "retired" }));
+        flight.outcome.settle(Exit.succeed({ status: "retired" }));
     }
     static {
         registerAuthMethod(OAuthRefreshCoordinator.prototype, "refresh", function (provider, input, init, baseFetch, signal, defer) {
@@ -428,7 +427,7 @@ export class OAuthRefreshCoordinator {
         }, OAuthRefreshCoordinator.prototype.refresh);
         registerAuthMethod(OAuthRefreshCoordinator.prototype, "redeem", function (provider, epoch, requested, input, init, baseFetch, waiting) {
             return authFlow(function* () {
-                const flight = { outcome: Deferred.makeUnsafe() };
+                const flight = { outcome: new Settlement() };
                 this.flights.set(epoch, flight);
                 // Pin the owner partition until the flight settles, whoever is waiting.
                 const release = this.retainPartition();
@@ -436,8 +435,8 @@ export class OAuthRefreshCoordinator {
                     if (this.flights.get(epoch) === flight)
                         this.flights.delete(epoch);
                     release();
-                    // Last, because joined fibers resume inside this call.
-                    Deferred.doneUnsafe(flight.outcome, Effect.succeed(outcome));
+                    // Last: joined waiters wake in their own requests, after this.
+                    flight.outcome.settle(Exit.succeed(outcome));
                 };
                 const fail = (error, verdict) => {
                     if (verdict)
@@ -783,6 +782,10 @@ export class KvOAuthProvider {
         if (client)
             this.addClientAuthentication = (headers, params) => authenticateRemoteClient(client, headers, params);
     }
+    /** Stored facts only: no migration, sealing writes, refresh or discovery. */
+    storedAuthorization(issuer) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "storedAuthorization", [issuer]));
+    }
     get redirectUrl() {
         return this.redirectUri;
     }
@@ -1432,6 +1435,22 @@ export class KvOAuthProvider {
                 };
             }.bind(this));
         }, KvOAuthProvider.prototype.openGrant);
+        registerAuthMethod(KvOAuthProvider.prototype, "storedAuthorization", function (issuer) {
+            return authFlow(function* () {
+                const raw = (yield authStorage(this.storage, "get", [GRANT]));
+                const grant = (yield authInvoke(this, "openGrant", [raw]));
+                if (isDisconnectedEpoch(grant.epoch))
+                    return false;
+                const body = grant.body;
+                const configured = issuer ?? this.clientOptions?.client?.issuer;
+                const discovered = body.discovery;
+                if (!configured &&
+                    (!discovered || discovered.authorizationServerMetadata?.issuer !== discovered.authorizationServerUrl))
+                    return false;
+                const expected = configured ?? discoveryIssuer(discovered);
+                return Boolean(expected && body.issuer === expected && body.tokens?.access_token);
+            }.bind(this)).pipe(Effect.catch(() => Effect.succeed(false)));
+        }, KvOAuthProvider.prototype.storedAuthorization);
         registerAuthMethod(KvOAuthProvider.prototype, "readGrant", function (signal) {
             signal = signal === undefined ? this.signal : signal;
             return authFlow(function* () {

package/dist/auth/static-oauth.js

@@ -1,3 +1,4 @@
+import { withStoredAuth } from "./stored-observation.js";
 import { auth, OAuthError, UnauthorizedError } from "@modelcontextprotocol/client";
 import { Effect } from "effect";
 import { byteReadResponse } from "../byte-read-response.js";
@@ -946,7 +947,7 @@ export function staticOAuth(id, config) {
             });
         }), true);
     });
-    return {
+    return withStoredAuth({
         status: retainAuthPartition(status, 0),
         startAuth: retainAuthPartition(startAuth, 0),
         disconnectAuth: retainAuthPartition(disconnectAuth, 0),
@@ -976,7 +977,7 @@ export function staticOAuth(id, config) {
                 return authCall(authorizedFetch, [ctx, input, init]);
             })),
         }, grantFor(ctx)),
-    };
+    }, (ctx) => providerFor(ctx).storedAuthorization(settings.identity));
 }
 // Hook calls keep the existing owner partition pinned while their native
 // program settles. Each Promise shell enters its own registered program.

package/dist/auth/stored-observation.js

@@ -0,0 +1,8 @@
+const observations = new WeakMap();
+export function withStoredAuth(target, observe) {
+    observations.set(target, observe);
+    return target;
+}
+export function storedAuthObservation(target) {
+    return observations.get(target);
+}

package/dist/call-admission.js

@@ -1,8 +1,9 @@
-import { Deferred, Duration, Effect } from "effect";
+import { Duration, Effect, Exit } from "effect";
 import { CALL_ADMISSION } from "./provider.js";
 import { ConnectorCallError } from "./errors.js";
 import { provideCallAdmissionProgram, provideCallBudgetCharge, startCallAdmission } from "./runtime/call-admission.js";
 import { fromSignal, runEdge } from "./runtime/run.js";
+import { Settlement } from "./runtime/settlement.js";
 import { keepErrorName } from "./redaction-identity.js";
 const DEFAULT_MAX_QUEUE_SIZE = 32;
 const DEFAULT_QUEUE_TIMEOUT_MS = 5_000;
@@ -133,7 +134,7 @@ export class ConnectorCallAdmissionController {
         this.closed = true;
         for (const state of this.partitions.values()) {
             for (const waiter of state.waiters.splice(0)) {
-                Deferred.doneUnsafe(waiter.outcome, Effect.fail(new CallAdmissionError("closed", "unavailable", `Connector "${this.connectorId}" call admission is closed.`)));
+                waiter.outcome.settle(Exit.fail(new CallAdmissionError("closed", "unavailable", `Connector "${this.connectorId}" call admission is closed.`)));
             }
         }
     }
@@ -198,11 +199,11 @@ export class ConnectorCallAdmissionController {
             const retryAfterMs = this.budgetRetryAfterMs(state, now);
             if (retryAfterMs !== undefined) {
                 this.rateLimitedTotal++;
-                Deferred.doneUnsafe(waiter.outcome, Effect.fail(this.budgetLimited(retryAfterMs)));
+                waiter.outcome.settle(Exit.fail(this.budgetLimited(retryAfterMs)));
                 continue;
             }
             const waitMs = Math.max(0, now - waiter.queuedAt);
-            Deferred.doneUnsafe(waiter.outcome, Effect.succeed(this.admit(state, now, waitMs)));
+            waiter.outcome.settle(Exit.succeed(this.admit(state, now, waitMs)));
         }
     }
     pruneBudget(state, now) {
@@ -259,9 +260,11 @@ export class ConnectorCallAdmissionController {
             this.maybeDeletePartition(key, state, waiter.now());
             return Effect.void;
         }
-        if (!Deferred.isDoneUnsafe(waiter.outcome))
-            return Effect.void;
-        return Deferred.await(waiter.outcome).pipe(Effect.tap((permit) => Effect.sync(() => permit.release())), Effect.ignore);
+        return Effect.sync(() => {
+            const outcome = waiter.outcome.outcome;
+            if (outcome && Exit.isSuccess(outcome))
+                outcome.value.release();
+        });
     }
     concurrencyLimited(reason) {
         return new CallAdmissionError("concurrency", "rate_limited", `Connector "${this.connectorId}" call concurrency ${reason}.`, { retryAfterMs: this.retryAfterMs });
@@ -283,7 +286,7 @@ export class ConnectorCallAdmissionController {
     // for a fiber. Semaphore does not fit that wait — permits here are
     // per-partition, the queue is bounded and counted, and each waiter carries
     // its own timeout and budget recheck — so the queue stays explicit, as in
-    // AdmissionController, with a Deferred per waiter.
+    // AdmissionController, with a Settlement per waiter.
     static {
         provideCallAdmissionProgram((controller, input, now) => {
             // Copy the signal out before building the wait: the effect returned
@@ -348,16 +351,16 @@ export class ConnectorCallAdmissionController {
             const waiter = {
                 queuedAt,
                 now,
-                outcome: Deferred.makeUnsafe(),
+                outcome: new Settlement(),
             };
             state.waiters.push(waiter);
             controller.queuedTotal++;
             // A timeout or abort settles the waiter only if it takes it out of the
-            // queue first. Otherwise the pump or close() got there in the same tick,
-            // and the outcome they recorded is the answer.
+            // queue first. Otherwise the pump or close() got there first, and the
+            // outcome they recorded is the answer, rechecked once heard.
             const giveUp = (count, error) => Effect.suspend(() => {
                 if (!controller.removeWaiter(state, waiter)) {
-                    return Deferred.await(waiter.outcome);
+                    return waiter.outcome.wait();
                 }
                 count();
                 const refusal = error();
@@ -368,13 +371,23 @@ export class ConnectorCallAdmissionController {
             // checks the signal as it starts, which closes the check-to-listener
             // race an AbortSignal would not replay.
             const contenders = [
-                Deferred.await(waiter.outcome),
+                waiter.outcome.wait(),
                 Effect.sleep(Duration.millis(controller.queueTimeoutMs)).pipe(Effect.andThen(giveUp(() => controller.rejectedTotal++, () => controller.concurrencyLimited(`queue wait exceeded ${controller.queueTimeoutMs}ms`)))),
             ];
             if (signal) {
                 contenders.push(fromSignal(signal).pipe(Effect.catch(() => giveUp(() => controller.cancelledTotal++, () => controller.cancelled(signal)))));
             }
-            return Effect.raceAllFirst(contenders).pipe(Effect.onInterrupt(() => controller.cleanupWaiter(key, state, waiter)));
+            // A grant is recorded in the releasing request and heard here a turn
+            // later. A shutdown in that gap wins, so no call dispatches after
+            // close(): give the permit back. A grant that beat the caller's abort
+            // stays the caller's to release, as it always has.
+            const received = (permit) => Effect.suspend(() => {
+                if (!controller.closed)
+                    return Effect.succeed(permit);
+                permit.release();
+                return Effect.fail(new CallAdmissionError("closed", "unavailable", `Connector "${controller.connectorId}" call admission is closed.`));
+            });
+            return Effect.raceAllFirst(contenders).pipe(Effect.flatMap(received), Effect.onInterrupt(() => controller.cleanupWaiter(key, state, waiter)));
         });
     }
 }

package/dist/connectors/api-connector.js

@@ -1,3 +1,4 @@
+import { storedAuthObservation, withStoredAuth } from "../auth/stored-observation.js";
 import { Effect, Exit } from "effect";
 import { registerConnectorVocabulary } from "../operation-vocabulary.js";
 import { causeError, runEdge } from "../runtime/run.js";
@@ -304,5 +305,8 @@ export function apiConnector(id, opts, oauth) {
             }
         });
     registerConnectorVocabulary(connector, opts.tools);
+    const storedAuth = oauth && storedAuthObservation(oauth);
+    if (storedAuth)
+        withStoredAuth(connector, storedAuth);
     return connector;
 }

package/dist/connectors/option-shapes.js

@@ -14,7 +14,11 @@ export const CREDENTIAL = optionsOf()({
 export const USAGE_GUIDE = optionsOf()(keys("content", "summary", "required"));
 /** `remoteMcp()`'s `auth`, closed per `type`. */
 export const REMOTE_MCP_AUTH = variants("type", {
-    request: optionsOf()({ ...keys("type", "token"), headers: strings() }).shape,
+    request: optionsOf()({
+        ...keys("type", "token"),
+        headers: strings(),
+        principal: optionsOf()(keys("accept", "token")),
+    }).shape,
     headers: optionsOf()({ ...keys("type"), headers: strings() }).shape,
     credential: optionsOf()({
         ...keys("type", "header", "scheme"),

package/dist/connectors/remote-mcp.d.ts

@@ -1,7 +1,7 @@
 import { type RemoteOAuthClient } from "../auth/downstream-client-metadata.js";
 import type { FetchLike, Transport } from "@modelcontextprotocol/client";
 import { ConnectorCallError } from "../errors.js";
-import type { RequestToken } from "../request-token.js";
+import type { PrincipalForwarding, RequestToken } from "../request-token.js";
 import type { Connector, ConnectorCallAdmissionPolicy, ConnectorContext, ConnectorCredentialConfig, ConnectorUsageGuide, Logger } from "../types.js";
 /**
  * A static downstream credential supplied through the connection in the
@@ -35,13 +35,29 @@ interface RemoteMcpCredentialAuth {
      */
     scheme?: string | null;
 }
-export type RemoteMcpAuth = {
+/**
+ * Request-local Bearer auth. With `principal`, the resolver also receives the
+ * caller inbound auth admitted, for a trusted first-party downstream.
+ */
+export type RemoteMcpRequestAuth = {
     type: "request";
     /** Resolve a Bearer token inside this request. Never persisted or described. */
     token: RequestToken;
+    principal?: never;
     /** Static protocol/catalog headers, never Authorization. */
     headers?: Record<string, string>;
 } | {
+    type: "request";
+    token?: never;
+    /**
+     * Resolve the Bearer token for the admitted caller instead. Callers the
+     * policy does not accept are refused before the resolver runs.
+     */
+    principal: PrincipalForwarding;
+    /** Static protocol/catalog headers, never Authorization. */
+    headers?: Record<string, string>;
+};
+export type RemoteMcpAuth = RemoteMcpRequestAuth | {
     type: "headers";
     headers: Record<string, string>;
 } | RemoteMcpCredentialAuth | {
@@ -88,7 +104,8 @@ export interface RemoteMcpOptions {
      * Non-secret resource context headers. Never credentials: use auth for those.
      * Auth-owned, HTTP transport/session and OAuth client-auth headers are
      * reserved. Cannot be combined with inline headers auth. Sent only at the
-     * resource URL path; echoed values are redacted at eight characters or more.
+     * resource URL path. Values are never treated as sent secrets: arguments and
+     * echoes equal to them pass unchanged.
      */
     headers?: Record<string, string>;
     /**
@@ -122,6 +139,15 @@ export interface RemoteMcpOptions {
      * Default console.
      */
     logger?: Logger;
+    /**
+     * Send every MCP request through this fetch instead of the global one, such
+     * as a Workers service binding: `(input, init) => env.NOTES.fetch(input, init)`.
+     * `url` still names the logical origin, and the HTTPS, redirect and
+     * same-origin rules apply to it. Each request, writes included, is handed
+     * over once with `redirect: "manual"`; the function must not retry or follow
+     * redirects. Cannot be combined with `auth: { type: "oauth" }`.
+     */
+    fetch?: FetchLike;
     /**
      * @internal Testing seam. When set, this transport is used instead of the
      * HTTP transport, letting tests point the connector at an in-process MCP