@zackbart/connecta 0.36.2 → 0.37.0

package/dist/connectors/remote-mcp.js

@@ -1,3 +1,4 @@
+import { withStoredAuth } from "../auth/stored-observation.js";
 import { authorizationParamsFor } from "../auth/oauth-authorization-params.js";
 import { authView } from "../auth/native-call.js";
 import { authFlow, authCall, authInvoke, authValue, authMethod, authCatch } from "../auth/native.js";
@@ -27,6 +28,7 @@ import { registerInvocationAuth } from "../invocation-auth.js";
 import { downstreamInputCapabilities, assertDownstreamOutputSafe, downstreamWriteContinuation, } from "../downstream-input-context.js";
 import { detach, runEdge } from "../runtime/run.js";
 import { assertKnownOptions, keys, optionsOf, strings } from "../config-schema.js";
+import { requestPrincipalFor } from "../request-principal.js";
 import { describedEndpoint, describedUrl } from "../described.js";
 import { retryAfterMs } from "../http-policy.js";
 import { resourceUriMatchesTemplates } from "./resource-uri.js";
@@ -41,7 +43,7 @@ import { readNegotiation, storeNegotiation } from "./negotiation-cache.js";
 import { READ_ONLY, CALL_ADMISSION, REMOTE_MCP_AUTH, USAGE_GUIDE } from "./option-shapes.js";
 /** The closed options remoteMcp() accepts; see `assertKnownOptions`. */
 const REMOTE_MCP_OPTIONS = optionsOf()({
-    ...keys("url", "title", "description", "authScope", "maxResultBytes", "versionNegotiation", "redirects", "requireHttps", "logger", "_transportFactory", "skills"),
+    ...keys("url", "title", "description", "authScope", "maxResultBytes", "versionNegotiation", "redirects", "requireHttps", "logger", "fetch", "_transportFactory", "skills"),
     readOnly: READ_ONLY,
     callAdmission: CALL_ADMISSION,
     usageGuide: USAGE_GUIDE,
@@ -1135,14 +1137,35 @@ export function remoteMcp(id, opts) {
     // its actual sent auth with every operation using that client, including
     // handshake/discovery requests and OAuth rotations. Remove settled users.
     const activeContexts = new WeakMap();
+    // Resource headers are non-secret context by contract. They never join the
+    // sent set, so arguments and results equal to them pass unchanged (#1108).
+    // An argument mirrored as `Mcp-Param-*` carrying a resource value is the
+    // same context under a name the tracker may read as credential-shaped.
+    const resourceValues = new Set(Object.values(extraHeaders ?? {}));
+    const withoutResourceHeaders = (input, init) => {
+        if (!extraHeaders)
+            return init;
+        const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+        for (const [name, value] of Object.entries(extraHeaders))
+            if (headers.get(name) === value)
+                headers.delete(name);
+        const mirrored = [];
+        for (const [name, value] of headers)
+            if (name.startsWith("mcp-param-") && resourceValues.has(value))
+                mirrored.push(name);
+        for (const name of mirrored)
+            headers.delete(name);
+        return { ...init, headers };
+    };
     const trackSentRequest = (ctx, input, init) => {
         const active = activeContexts.get(entryFor(ctx));
         const recipients = new Set([sentSecretsFor(ctx), ...[...(active ?? [])].map(sentSecretsFor)]);
+        const tracked = withoutResourceHeaders(input, init);
         for (const secrets of recipients) {
             if (opts.auth?.type === "oauth")
-                trackRemoteClientRequest(secrets, input, init);
+                trackRemoteClientRequest(secrets, input, tracked);
             else
-                secrets.request(input, init);
+                secrets.request(input, tracked);
         }
     };
     const connectingWaiters = new WeakMap();
@@ -1179,10 +1202,29 @@ export function remoteMcp(id, opts) {
             "this shape sends one secret in one header and reads the reserved " +
             "`value` field only.");
     }
+    // Both request shapes, read field by field; a mixture is refused below.
     const requestAuth = opts.auth?.type === "request" ? opts.auth : undefined;
-    if (requestAuth && (typeof requestAuth.token !== "function" || opts.authScope === "personal")) {
+    // Opt-in only: without it the resolver keeps receiving the context alone.
+    // `principal` replaces `token`; a malformed or mixed shape has no resolver.
+    const forwarding = requestAuth?.principal;
+    const requestToken = forwarding
+        ? requestAuth?.token === undefined && (forwarding.accept === "human" || forwarding.accept === "human-or-agent")
+            ? forwarding.token
+            : undefined
+        : requestAuth?.token;
+    if (requestAuth && (typeof requestToken !== "function" || opts.authScope === "personal")) {
         throw new Error(`remoteMcp(${JSON.stringify(id)}) requires a request token callback and shared authScope.`);
     }
+    const principalPolicy = forwarding?.accept;
+    const customFetch = opts.fetch;
+    // OAuth discovery, registration and token requests reach authorization
+    // servers the downstream names, through the owned credential sender. A
+    // custom fetch would split that traffic between two transports.
+    if (customFetch !== undefined && (typeof customFetch !== "function" || opts.auth?.type === "oauth")) {
+        throw new Error(`remoteMcp(${JSON.stringify(id)}).fetch must be a function, without OAuth auth.`);
+    }
+    // No delayed dispatch: a write counts as sent once it is handed to the function.
+    const customSender = customFetch && { send: customFetch };
     if (requestAuth?.headers) {
         try {
             if (Object.keys(requestAuth.headers).some((name) => name.toLowerCase() === "authorization"))
@@ -1450,11 +1492,12 @@ export function remoteMcp(id, opts) {
      * trusting any cached client, so an operator's replacement is picked up
      * without a redeploy. The value stays in the caller's local scope.
      */
-    const readCredential = authMethod((ctx) => authFlow(function* () {
+    const readCredential = authMethod((ctx, principal) => authFlow(function* () {
         if (requestAuth) {
             let value;
             try {
-                value = (yield authInvoke(requestAuth, "token", [ctx]));
+                // A fresh frozen input per resolution: one resolver cannot alter another's.
+                value = (yield authInvoke(forwarding ?? requestAuth, "token", principal ? [ctx, Object.freeze({ principal })] : [ctx]));
             }
             catch (error) {
                 if (error instanceof ConnectorCallError)
@@ -1753,7 +1796,9 @@ export function remoteMcp(id, opts) {
     /** The raw value behind `credentialFramed`, under the same terms. */
     credentialValue = null, 
     /** A code exchange never transfers ownership to the refresh coordinator. */
-    exchangeOnly = false) => {
+    exchangeOnly = false, 
+    /** The admitted principal `credentialValue` was resolved for, under the same terms. */
+    principal = undefined) => {
         const resourceInit = (input, init) => {
             if (!extraHeaders)
                 return init;
@@ -1805,7 +1850,12 @@ export function remoteMcp(id, opts) {
             if (toolCall && !flight && !untrackedRead(toolCall.params))
                 throw missingDispatch();
             const credentialPost = isOauth && (init?.method ?? "GET").toUpperCase() === "POST" && (!skillObject(rpc) || rpc.jsonrpc !== "2.0");
-            const sender = flight?.write ? guardedTransport(true) : undefined;
+            // A custom transport reaches only the configured origin; redirects are
+            // already same-origin, and OAuth cannot be combined with it.
+            if (customFetch && new URL(input instanceof Request ? input.url : String(input)).origin !== destination.origin)
+                throw new ConnectorCallError("connector_call_failed", `Connector "${id}" refused a request outside its origin; nothing was sent.`, { retryable: false });
+            // The deployment's fetch owns the wire: each write is handed over once.
+            const sender = flight?.write ? (customSender ?? guardedTransport(true)) : undefined;
             if (flight?.write) {
                 if (flight.sent) {
                     if (flight.request && flight.authorization)
@@ -1843,7 +1893,8 @@ export function remoteMcp(id, opts) {
                         ? sendGuarded(sender, new URL(input instanceof Request ? input.url : String(input)), { ...init, redirect: "manual" }, dispatch)
                         : (() => {
                             dispatch();
-                            return writeContinuation ? fetch(input, { ...init, redirect: "manual" }) : fetch(input, init);
+                            const send = customFetch ?? fetch;
+                            return writeContinuation ? send(input, { ...init, redirect: "manual" }) : send(input, init);
                         })();
                 return pending.then((response) => {
                     if (entry)
@@ -1859,10 +1910,10 @@ export function remoteMcp(id, opts) {
                     return response;
                 });
             }));
-            if (response.status === 401 && requestAuth?.token.invalidate && credentialValue !== null) {
+            if (response.status === 401 && requestToken?.invalidate && credentialValue !== null) {
                 // Invalidate the exact bytes this transport sent, never a newer token.
                 // Preserve the original 401 even if an operator hook fails. No replay.
-                (yield authCatch(authInvoke(requestAuth.token, "invalidate", [credentialValue, ctx]), () => { }));
+                (yield authCatch(authInvoke(requestToken, "invalidate", principal ? [credentialValue, ctx, Object.freeze({ principal })] : [credentialValue, ctx]), () => { }));
             }
             if (credentialPost && !isOAuthCredentialRequest(init) && REDIRECT_STATUSES.has(response.status)) {
                 (yield authCatch(authValue(() => response.body?.cancel()), () => { }));
@@ -2079,15 +2130,24 @@ export function remoteMcp(id, opts) {
             let credentialValue = null;
             let credentialFramed = null;
             let credentialDigest = null;
+            // Only the admitted caller on this operation's context, never an argument.
+            // Refused before the resolver runs, so no token is minted for anyone else.
+            const principal = principalPolicy
+                ? requestPrincipalFor(principalPolicy, ctx, (reason) => new CredentialRequiredError(`Connector "${id}" ${reason}.`))
+                : undefined;
             if (credentialAuth || requestAuth) {
-                credentialValue = (yield authCall(readCredential, [ctx]));
+                credentialValue = (yield authCall(readCredential, [ctx, principal]));
                 credentialFramed = credentialHeaderValue(credentialScheme, credentialValue);
-                credentialDigest = (yield authCall(digestOf, [credentialValue]));
+                // The principal joins the client's identity: another principal never
+                // reuses this client, even if its resolver returns the same token.
+                credentialDigest = (yield authCall(digestOf, [
+                    principal ? JSON.stringify([principal, credentialValue]) : credentialValue,
+                ]));
                 if ((state.client || state.connecting) &&
                     state.credentialDigest !== null &&
                     state.credentialDigest !== credentialDigest) {
                     const observedConnection = state.client ?? state.connecting;
-                    const currentCredential = (yield authCall(readCredential, [ctx]));
+                    const currentCredential = (yield authCall(readCredential, [ctx, principal]));
                     if (isClosed(state))
                         throw scopeEndedError();
                     if (currentCredential !== credentialValue || (state.client ?? state.connecting) !== observedConnection) {
@@ -2103,7 +2163,7 @@ export function remoteMcp(id, opts) {
                 throw scopeEndedError();
             if (state.client)
                 return state.client;
-            const attempt = state.connecting ?? startConnect(ctx, state, credentialValue, credentialFramed, credentialDigest);
+            const attempt = state.connecting ?? startConnect(ctx, state, credentialValue, credentialFramed, credentialDigest, principal);
             if (joined !== attempt) {
                 leave();
                 joined = attempt;
@@ -2124,14 +2184,14 @@ export function remoteMcp(id, opts) {
      * started it included — waits on that; nothing awaits the run directly,
      * which is why handing it to `detach` orphans nothing.
      */
-    const startConnect = (ctx, state, credentialValue, credentialFramed, credentialDigest) => {
+    const startConnect = (ctx, state, credentialValue, credentialFramed, credentialDigest, principal) => {
         const attempt = Deferred.makeUnsafe();
         state.connecting = attempt;
         // Published with the attempt, not with its result: a rotation that lands
         // while this connect is in flight has to be visible to the next caller,
         // which would otherwise wait on a client bound to the older key.
         state.credentialDigest = credentialDigest;
-        detach(connect(ctx, state, attempt, credentialValue, credentialFramed).pipe(
+        detach(connect(ctx, state, attempt, credentialValue, credentialFramed, principal).pipe(
         // The connection belongs to this request, without the first waiter's
         // call/credential/budget authority. Refresh coordinators stay separate.
         Effect.provideService(RequestScope, Context.get(viewServices(ctx), RequestScope)), Effect.onExit((exit) => Effect.sync(() => {
@@ -2145,7 +2205,7 @@ export function remoteMcp(id, opts) {
         }))));
         return attempt;
     };
-    const connect = (ctx, state, attempt, credentialValue, credentialFramed) => {
+    const connect = (ctx, state, attempt, credentialValue, credentialFramed, principal) => {
         // Force reset, rotation, and teardown all abandon an attempt the same way:
         // they unpublish it and close the lease it holds, if it holds one yet.
         const owned = () => state.connecting === attempt && !isClosed(state);
@@ -2277,7 +2337,7 @@ export function remoteMcp(id, opts) {
                     return client;
                 };
                 let c = makeClient();
-                let t = buildTransport(ctx, provider, credentialFramed, connectionAbort.signal, credentialValue);
+                let t = buildTransport(ctx, provider, credentialFramed, connectionAbort.signal, credentialValue, false, principal);
                 if (!owned()) {
                     held.transport = t;
                     return yield* Effect.fail(scopeEndedError());
@@ -2303,7 +2363,7 @@ export function remoteMcp(id, opts) {
                             handshakeAbort.signal.aborted)
                             throw error;
                         c = makeClient();
-                        t = buildTransport(ctx, provider, credentialFramed, connectionAbort.signal, credentialValue);
+                        t = buildTransport(ctx, provider, credentialFramed, connectionAbort.signal, credentialValue, false, principal);
                         state.transport = held.transport = t;
                         recordWireErrors(t, () => observeCatalogChange(ctx, id, connectionAbort.signal, cacheOwner));
                         (yield authInvoke(c, "connect", [
@@ -2397,6 +2457,56 @@ export function remoteMcp(id, opts) {
             closeHalf(state);
         }
     }));
+    /**
+     * Whether the owner's grant holds tokens, read the way the invocation gate
+     * reads it. A downstream may answer its handshake and listing without
+     * credentials, so a healthy connection proves nothing about the grant.
+     * Read after connecting: connect has bound the epoch, migrated an older
+     * layout, and refused a disconnected one within the scope's lifetime.
+     */
+    const granted = authMethod((ctx) => authFlow(function* () {
+        return Boolean(yield authInvoke(newProvider(ctx), "tokens", []));
+    }));
+    /**
+     * Start consent for a downstream that answered without challenging. The
+     * transport's bound 401 seam runs the SDK flow exactly as a challenge
+     * without `resource_metadata` would: RFC 9728 discovery at the resource's
+     * well-known URLs, the same issuer and resource checks, consent state, and
+     * CIMD/DCR/static client order. Nothing is sent to the MCP endpoint.
+     */
+    const startUnchallenged = authMethod((ctx) => authFlow(function* () {
+        const required = {
+            state: "auth_required",
+            message: "Authorization required \u2014 open the URL to connect.",
+        };
+        // A test transport carries no OAuth flow to start.
+        if (opts._transportFactory)
+            return required;
+        // Bound to the live epoch, which the connect just found connected: a
+        // reset or disconnect meanwhile fails this flow's writes.
+        const provider = newProvider(ctx);
+        (yield authInvoke(provider, "beginFlow", []));
+        // Never started, this transport holds no session or stream to close.
+        const transport = buildTransport(ctx, provider);
+        const internals = transport;
+        try {
+            (yield authInvoke(internals._authProvider, "onUnauthorized", [
+                {
+                    response: new Response(null, { status: 401 }),
+                    serverUrl: new URL(opts.url),
+                    fetchFn: internals._fetchWithInit,
+                },
+            ]));
+            // Authorized without consent: nothing is pending to hand back.
+            return { state: "ok", message: "Already authorized \u2014 connection is healthy." };
+        }
+        catch (err) {
+            if (!(err instanceof UnauthorizedError))
+                throw err;
+        }
+        const authorizationUrl = (yield authInvoke(provider, "consentUrl", [viewSignal(ctx, true)]));
+        return { ...required, ...(authorizationUrl !== undefined ? { authorizationUrl } : {}) };
+    }));
     // Built once from construction-time values: names, framing, and public
     // URLs only. A static header's value and a stored credential never reach
     // it, and a URL keeps origin and path: a CIMD document's query may carry a
@@ -2870,6 +2980,12 @@ export function remoteMcp(id, opts) {
             }));
             try {
                 (yield authCall(ensureConnected, [ctx, state]));
+                // The grant decides, as it does for a call: a downstream that
+                // answers without credentials is not connected for this owner.
+                if (isOauth && !(yield authCall(granted, [ctx])))
+                    return (yield authCall(report, [
+                        { state: "auth_required", message: "Authorization required \u2014 open the URL to connect." },
+                    ]));
                 return (yield authCall(report, [{ state: "ok" }]));
             }
             catch (err) {
@@ -2974,7 +3090,11 @@ export function remoteMcp(id, opts) {
             if (ctx.signal?.aborted)
                 throw ctx.signal.reason;
             try {
+                // The handshake runs first, so a 401 challenge's
+                // `resource_metadata` starts consent as it always has.
                 (yield authCall(ensureConnected, [ctx, state]));
+                if (!(yield authCall(granted, [ctx])))
+                    return (yield authCall(startUnchallenged, [ctx]));
                 return {
                     state: "ok",
                     message: "Already authorized \u2014 connection is healthy.",
@@ -3017,8 +3137,6 @@ export function remoteMcp(id, opts) {
             for (const value of Object.values(opts.auth.headers))
                 secrets.header(value);
         }
-        for (const value of Object.values(extraHeaders ?? {}))
-            secrets.header(value);
         const state = entryFor(ctx);
         let active = activeContexts.get(state);
         if (!active) {
@@ -3152,5 +3270,7 @@ export function remoteMcp(id, opts) {
             if (!(yield authInvoke(provider, "tokens", [])))
                 throw authRequiredError();
         })), 0), 0));
+    if (isOauth)
+        withStoredAuth(connector, (ctx) => newProvider(ctx).storedAuthorization());
     return connector;
 }

package/dist/execute.js

@@ -1012,11 +1012,11 @@ function runSignal(caller) {
 /**
  * An admitting executor's lease, released when the run's scope closes.
  *
- * `acquire()` is the executor's Promise, awaited as one on purpose. A queued
- * request is handed its lease from inside whichever request released one, so
- * a fiber resumed straight from the executor's admission queue would build
- * this request's providers and run its program in the releasing request —
- * which workerd refuses for any I/O. Awaiting the promise resumes it here.
+ * A queued request is handed its lease from inside whichever request released
+ * one. The built-in queues wake it through a Promise its own request created
+ * (src/runtime/settlement.ts), and `acquire()` is awaited as a Promise for any
+ * executor, so this request's providers and program run here, never in the
+ * releasing request, which workerd refuses.
  */
 function leased(executor, signal) {
     return Effect.acquireRelease(awaitExecutor(() => executor.acquire({ signal, wait: true }), signal, {

package/dist/executor-admission.js

@@ -1,6 +1,7 @@
-import { Deferred, Duration, Effect } from "effect";
+import { Duration, Effect, Exit } from "effect";
 import { admit, provideAdmissionProgram } from "./runtime/admission.js";
 import { fromSignal, runEdge } from "./runtime/run.js";
+import { Settlement } from "./runtime/settlement.js";
 import { keepErrorName } from "./redaction-identity.js";
 /**
  * A stable, machine-readable admission failure. Overload is retryable; caller
@@ -119,7 +120,7 @@ export class AdmissionController {
         this.closed = true;
         for (const waiter of this.waiters.splice(0)) {
             this.closedTotal++;
-            Deferred.doneUnsafe(waiter.outcome, Effect.fail(new ExecutorAdmissionError("executor_closed", "Executor is shutting down.")));
+            waiter.outcome.settle(Exit.fail(new ExecutorAdmissionError("executor_closed", "Executor is shutting down.")));
         }
     }
     overloaded(message) {
@@ -164,7 +165,7 @@ export class AdmissionController {
             this.queueWaitTotalMs += waitMs;
             this.queueWaitMaxMs = Math.max(this.queueWaitMaxMs, waitMs);
             this.active++;
-            Deferred.doneUnsafe(waiter.outcome, Effect.succeed(this.makeLease(waitMs)));
+            waiter.outcome.settle(Exit.succeed(this.makeLease(waitMs)));
         }
     }
     pruneExpiredWaiters() {
@@ -175,7 +176,7 @@ export class AdmissionController {
                 continue;
             this.waiters.splice(index, 1);
             this.rejectedTotal++;
-            Deferred.doneUnsafe(waiter.outcome, Effect.fail(this.overloaded(`Executor admission timed out after ${this.queueTimeoutMs}ms.`)));
+            waiter.outcome.settle(Exit.fail(this.overloaded(`Executor admission timed out after ${this.queueTimeoutMs}ms.`)));
         }
     }
     reapExpired() {
@@ -219,9 +220,11 @@ export class AdmissionController {
             this.cancelledTotal++;
             return Effect.void;
         }
-        if (!Deferred.isDoneUnsafe(waiter.outcome))
-            return Effect.void;
-        return Deferred.await(waiter.outcome).pipe(Effect.tap((lease) => Effect.sync(() => lease.release())), Effect.ignore);
+        return Effect.sync(() => {
+            const outcome = waiter.outcome.outcome;
+            if (outcome && Exit.isSuccess(outcome))
+                outcome.value.release();
+        });
     }
     // The admission program, handed to src/runtime/admission.ts. It lives in a
     // static block because the class declaration ships, private member names
@@ -254,22 +257,22 @@ export class AdmissionController {
             }
             const waiter = {
                 queuedAt: Date.now(),
-                outcome: Deferred.makeUnsafe(),
+                outcome: new Settlement(),
             };
             controller.waiters.push(waiter);
             controller.queuedTotal++;
             // A timeout or abort settles the waiter only if it takes it out of the
-            // queue first. Otherwise release() or close() got there in the same
-            // tick, and the outcome they recorded is the answer.
+            // queue first. Otherwise release() or close() got there first, and the
+            // outcome they recorded is the answer, rechecked once heard.
             const giveUp = (count, error) => Effect.suspend(() => {
                 if (!controller.remove(waiter))
-                    return Deferred.await(waiter.outcome);
+                    return waiter.outcome.wait();
                 count();
                 return Effect.fail(error());
             });
             // One flat race; each contender is a forked fiber.
             const contenders = [
-                Deferred.await(waiter.outcome),
+                waiter.outcome.wait(),
                 Effect.sleep(Duration.millis(controller.queueTimeoutMs)).pipe(Effect.andThen(giveUp(() => controller.rejectedTotal++, () => controller.overloaded(`Executor admission timed out after ${controller.queueTimeoutMs}ms.`)))),
             ];
             if (controller.maxDurationMs !== undefined) {
@@ -278,7 +281,18 @@ export class AdmissionController {
             if (signal) {
                 contenders.push(fromSignal(signal).pipe(Effect.catch(() => giveUp(() => controller.cancelledTotal++, () => new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled while queued.")))));
             }
-            return Effect.raceAllFirst(contenders).pipe(Effect.onInterrupt(() => controller.cleanup(waiter)));
+            // A grant is recorded in the releasing request and heard here a turn
+            // later. A shutdown in that gap wins, so nothing granted before
+            // close() starts after it: give the slot back. A grant that beat the
+            // caller's abort stays the caller's to release, as it always has.
+            const received = (lease) => Effect.suspend(() => {
+                if (!controller.closed)
+                    return Effect.succeed(lease);
+                lease.release();
+                controller.closedTotal++;
+                return Effect.fail(new ExecutorAdmissionError("executor_closed", "Executor is shutting down."));
+            });
+            return Effect.raceAllFirst(contenders).pipe(Effect.flatMap(received), Effect.onInterrupt(() => controller.cleanup(waiter)));
         }));
     }
 }

package/dist/executors/quickjs.js

@@ -10,6 +10,7 @@
 // Respawn after a crash waits out a Schedule. The IPC protocol stays plain:
 // the child's messages arrive as Node events, and host calls are the
 // Promise-shaped provider functions execute.ts hands over.
+import { AsyncResource } from "node:async_hooks";
 import { Buffer } from "node:buffer";
 import { fork } from "node:child_process";
 import { existsSync } from "node:fs";
@@ -273,6 +274,7 @@ class QuickJsChildPool {
                 providers: providerMap,
                 outcome: Deferred.makeUnsafe(),
                 hosts: Scope.makeUnsafe(),
+                owner: new AsyncResource("connecta.quickjs.run"),
             };
             slot.active = active;
             try {
@@ -485,7 +487,8 @@ class QuickJsChildPool {
         if (message.type === "host-call") {
             if (message.jobId !== active.id)
                 return;
-            void detach(forkOwned(this.handleHostCall(slot, child.process, active, message), active.hosts));
+            // Dispatch in the program's own request, never the spawner's.
+            active.owner.runInAsyncScope(() => void detach(forkOwned(this.handleHostCall(slot, child.process, active, message), active.hosts)));
             return;
         }
         if ((message.type !== "result" && message.type !== "result-chunk") || message.jobId !== active.id)

package/dist/index.d.ts

@@ -38,7 +38,8 @@ export { memoryStorage } from "./storage/memory.js";
 export { CONNECTA_VERSION } from "./version.js";
 export type { GuestApi, GuestResourceResult, GuestResult, GuestResultPage, GuestBlock, GuestNativeBlock, } from "./guest-types.js";
 export type { Registry } from "./registry.js";
-export type { RemoteMcpOptions, RemoteMcpAuth, RemoteMcpRedirectPolicy } from "./connectors/remote-mcp.js";
+export type { RemoteMcpOptions, RemoteMcpAuth, RemoteMcpRequestAuth, RemoteMcpRedirectPolicy, } from "./connectors/remote-mcp.js";
+export type { AgentRequestPrincipal, HumanRequestPrincipal, PrincipalForwarding, PrincipalRequestToken, RequestPrincipal, RequestPrincipalPolicy, RequestToken, RequestTokenInput, } from "./request-token.js";
 export type { ApiHandlerContext, ApiOAuthAccess, ApiOAuthClientAuthentication, ApiOAuthConfig, ApiOptions, ApiTool, } from "./connectors/api.js";
 export type { ConnectaBranding, ConnectaTheme, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorAuthDescription, ConnectorDescription, ConnectorToolDescription, ConnectorUsageGuide, ConnectorSkill, ConnectorSkillResourceContents, DescribedEndpoint, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, InboundAuthRuntimeContext, UiAuthConfig, AuthResult, AuthenticatedIdentity, IdentityReference, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
 export type { ActivityActor, ActivityCatalogChange, ActivityCallSource, ActivityOutcome, ActivityPage, ActivityReadActor, ActivityReadEvent, ActivityReader, ActivityReadGate, ActivityReadPage, ActivitySink, ActivityStore, AgentFriction, ToolCallActivityEvent, } from "./activity.js";

package/dist/invocation.js

@@ -33,13 +33,12 @@ export function timed(bucket, effect) {
 /**
  * The connector's call permit, owned by the enclosing Scope.
  *
- * Admission goes through `registry.admitCall`, a Promise, on purpose. The
- * permit queue is shared by every request in the isolate, and a queued
- * waiter is resumed from inside the request that released the slot. Were
- * this fiber to wait on the controller's Effect program itself
- * (`acquireCallScoped`), it would be resumed there and run this call's
- * downstream I/O in the releasing request, which workerd refuses. Awaiting
- * admitCall's promise resumes it in its own request instead.
+ * The permit queue is shared by every request in the isolate, and a queued
+ * waiter is handed its permit from inside the request that released the
+ * slot. The queue wakes it through a Promise its own request created
+ * (src/runtime/settlement.ts), and this fiber awaits `registry.admitCall`'s
+ * Promise, so this call's downstream I/O runs in its own request, never the
+ * releasing one, which workerd refuses.
  *
  * The wait stays interruptible, so a deadline ends it. A permit granted just
  * as the wait was interrupted still arrives, later, and is released on