@zackbart/connecta 0.37.0 → 0.38.0

package/dist/registry.js

@@ -1,12 +1,16 @@
+import { wrapViewCredentials } from "./runtime/call.js";
+import { sha256Hex } from "./bytes.js";
+import { catalogRevision } from "./catalog-revision.js";
 import { authCall, authInvoke } from "./auth/native.js";
 import { Clock, Duration, Effect, Random } from "effect";
 import { activityRequest } from "./activity-request.js";
 import { aggregateCallAdmissionSnapshots, ConnectorCallAdmissionController, } from "./call-admission.js";
-import { attachCatalogCache, catalogExpiry, catalogFetchedAt, customCatalogFallback, invalidateCatalogCache, observeUncachedCatalogRefresh, storeCustomCatalogFallback, } from "./catalog-cache.js";
+import { attachCatalogCache, catalogExpiry, catalogFetchedAt, customCatalogFallback, invalidateCatalogCache, observeUncachedCatalogRefresh, retainedCatalogIdentity, storeCustomCatalogFallback, } from "./catalog-cache.js";
 import { carryCatalogFreshness, markCatalogFreshness } from "./catalog-freshness.js";
 import { MAX_CATALOG_TOOLS, MAX_SERIALIZED_CATALOG_BYTES } from "./catalog-limits.js";
 import { CONFIG_DEFAULTS } from "./config-defaults.js";
 import { usesCallerIdentity } from "./connector-caller.js";
+import { forwardsPrincipal } from "./request-principal.js";
 import { canonicalJson } from "./canonical-json.js";
 import { storedCredentialShape } from "./credential-rules.js";
 import { ConnectorCallError } from "./errors.js";
@@ -21,7 +25,7 @@ import { causeError, runEdge } from "./runtime/run.js";
 import { Storage } from "./runtime/services.js";
 import { SharedRead } from "./runtime/shared-read.js";
 import { runOnPartition, storageCompareAndSet, storageDelete, storageGet, storageSet, storageList, } from "./runtime/storage.js";
-import { redactCatalog, sentSecretsFor, sentSecretsForRequest, trackCredentialReads } from "./sent-secrets.js";
+import { redactCatalog, sentSecretsFor, sentSecretsForRequest } from "./sent-secrets.js";
 import { GUIDE_SUMMARY_LENGTH, normalizeGuideSummary } from "./skills.js";
 import { jsonCodec, OAUTH_HANDOFF_TTL_SECONDS, oauthHandoffKeys, resultKeys, scopes, stashExpiryKeys, stashLedgerKeys, } from "./storage/keys.js";
 import { assertStaticToolNames, hasControlCharacters } from "./tool-name.js";
@@ -132,6 +136,8 @@ const STASH_LEDGER_BACKOFF_CAP_MS = 250;
 const STASH_WRITE_TIMEOUT_MS = 30_000;
 /** Total cleanup/release or settlement budget, including ledger retries. */
 const STASH_COMPLETION_TIMEOUT_MS = 15_000;
+/** Reservation, chunk writes and completion share one finite outer budget. */
+const STASH_TIMEOUT_MS = STASH_WRITE_TIMEOUT_MS + STASH_COMPLETION_TIMEOUT_MS;
 /** Stop waiting without starting background storage work after the deadline. */
 function completeStash(effect) {
     return effect.pipe(Effect.asVoid, Effect.timeoutOrElse({ duration: Duration.millis(STASH_COMPLETION_TIMEOUT_MS), orElse: () => Effect.void }), 
@@ -228,10 +234,6 @@ function swapStashLedger(plan) {
         }).pipe(Effect.catch(() => Effect.succeed({ status: "exhausted" })));
     });
 }
-async function sha256Hex(value) {
-    const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
-    return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-}
 /**
  * Holds the connector set, resolves addresses, and coalesces tool listings
  * within one request. Remote MCP clients own persisted response caching. Connector failures are isolated: a broken
@@ -449,6 +451,9 @@ export class Registry {
     }
     contextFor(id, baseUrl, requestScope = {}, callOptions = {}, scope) {
         const connector = this.connectors.get(id);
+        if (!scope?.caller && scope?.operatorCaller && connector && forwardsPrincipal(connector)) {
+            scope = { ...scope, caller: scope.operatorCaller };
+        }
         const credentialConfig = connector?.credential;
         let credentialAccess;
         let credentialProgram;
@@ -494,6 +499,7 @@ export class Registry {
         attachCatalogCache(context, {
             storage: this.opts.catalogStorage ?? this.opts.storage,
             partition: this.catalogPartition(scope),
+            credentialRevision: () => catalogRevision(this.opts.credentialVault),
             sharedPartition: JSON.stringify([baseUrl, this.opts.publicUrl ?? null, scope?.caller?.pool ?? null]),
             defaultTtlMs: (this.opts.toolCacheTtlSeconds ?? CONFIG_DEFAULTS.discovery.catalogTtlSeconds) * 1000,
             minTtlMs: (this.opts.catalogMinTtlSeconds ?? CONFIG_DEFAULTS.discovery.catalogMinTtlSeconds) * 1000,
@@ -510,7 +516,7 @@ export class Registry {
                 : {}),
         });
         sentSecretsFor(context);
-        trackCredentialReads(context);
+        wrapViewCredentials(context);
         attachOAuthPartition(context, this.oauthPartition);
         // Downstream OAuth state is sealed under the vault key, bound to this
         // connector and owner. The sealer rides beside the context, not on it.
@@ -539,12 +545,13 @@ export class Registry {
     }
     /** The admitted identity fields used by both catalog caching and reporting. */
     catalogPartition(scope) {
+        const caller = scope?.caller ?? scope?.operatorCaller;
         return JSON.stringify([
             scope?.principalKey ?? this.opts.credentialOwner ?? null,
             scope?.subjectKey ?? null,
-            scope?.caller?.identity ?? null,
-            scope?.caller?.authenticated ?? false,
-            scope?.caller?.pool ?? null,
+            caller?.identity ?? null,
+            caller?.authenticated ?? false,
+            caller?.pool ?? null,
         ]);
     }
     /** Bounded, in-memory tokens; no principal or catalog data is persisted. */
@@ -572,7 +579,7 @@ export class Registry {
      *
      * `chunks[n]` lands on `resultKeys.chunk(id, n)` inside `partition` — the
      * layout connecta.result reads back, so a page fetches only the chunks it covers
-     * instead of the whole stored result (issue #540). Chunking is a read-cost
+     * instead of the whole stored result. Chunking is a read-cost
      * decision, not a capacity one: however many keys an envelope occupies, it
      * is one stash entry charged its total ASCII length.
      *
@@ -580,6 +587,7 @@ export class Registry {
      * row in one ledger record in storage, booked by compare-and-set before any
      * chunk is written, so every isolate and process sharing the store sees the
      * same entries and bytes. A pending write keeps its finite charge reserved.
+     * The whole operation, including reservation, stops after 45 seconds.
      * Writes stop after 30 seconds; absolute chunk expiries cannot pass the
      * booked deadline even on late commit. Rejected responses leave writes
      * unconfirmed and retain their charge. Cleanup/release and settlement each
@@ -669,13 +677,17 @@ export class Registry {
                     yield* authCall(observe, [ctx, id, facts]).pipe(Effect.catch((error) => Effect.sync(() => logFailure(this.opts.logger, "catalog refresh observation failed", failureRecord({ connector: id }, error)))));
                 }
             }
-            this.catalogObservedAt.set(id, catalogFetchedAt(ctx) ?? Date.now());
             const provenance = catalogExpiry(ctx);
             const freshUntil = provenance && !provenance.staleFallback ? provenance.expiresAt : 0;
-            this.catalogAccess.set(id, {
-                state: freshUntil > Date.now() ? "fresh" : "stale",
-                observedAt: new Date().toISOString(),
-            });
+            // Principal-forwarded listings belong to one caller, never to the shared
+            // operator observation store. The actual catalog cache is identity-bound.
+            if (!forwardsPrincipal(connector)) {
+                this.catalogObservedAt.set(id, catalogFetchedAt(ctx) ?? Date.now());
+                this.catalogAccess.set(id, {
+                    state: freshUntil > Date.now() ? "fresh" : "stale",
+                    observedAt: new Date().toISOString(),
+                });
+            }
             return markCatalogFreshness(accepted, freshUntil);
         });
     }
@@ -863,7 +875,7 @@ export class Registry {
                 else
                     yield* completeStash(settle);
                 return written;
-            }).pipe(Effect.provideService(Storage, self.opts.storage)),
+            }).pipe(Effect.timeoutOrElse({ duration: Duration.millis(STASH_TIMEOUT_MS), orElse: () => Effect.succeed(false) }), Effect.provideService(Storage, self.opts.storage)),
             recheckResultAccess: () => Effect.succeed(true),
             storeOAuthHandoff: (self, connectorId, state, principalKey) => Effect.gen(function* () {
                 const key = oauthHandoffKeys.handoff(connectorId, yield* Effect.tryPromise({ try: () => sha256Hex(state), catch: (error) => error }));
@@ -907,16 +919,17 @@ export class Registry {
                 if (!self.connectors.has(id))
                     return Effect.fail(new Error(`Unknown connector "${id}"`));
                 const owner = self.contextFor(id, baseUrl, requestScope, callOptions, scope);
-                return duringViewEffect(owner, (signal) => {
+                return duringViewEffect(owner, (signal) => Effect.gen(function* () {
                     if (!requestScope)
-                        return self.loadTools(id, baseUrl, owner.requestScope, { ...callOptions, signal }, scope);
+                        return yield* self.loadTools(id, baseUrl, owner.requestScope, { ...callOptions, signal }, scope);
+                    const identity = self.connectors.get(id)?.staticTools ? "static" : retainedCatalogIdentity(owner);
                     let loads = self.requestCatalogLoads.get(requestScope);
                     if (!loads) {
                         loads = new Map();
                         self.requestCatalogLoads.set(requestScope, loads);
                     }
                     const requestLoads = loads;
-                    const key = JSON.stringify([id, scope?.principalKey, scope?.subjectKey, scope?.caller]);
+                    const key = JSON.stringify([id, scope?.principalKey, scope?.subjectKey, scope?.caller, identity]);
                     let load = requestLoads.get(key);
                     if (!load) {
                         const started = new SharedRead((signal) => self.loadTools(id, baseUrl, requestScope, { ...callOptions, signal }, scope), () => {
@@ -928,8 +941,8 @@ export class Registry {
                         requestLoads.set(key, started);
                         load = started;
                     }
-                    return load.join(signal);
-                });
+                    return yield* load.join(signal);
+                }));
             }),
             credentialDriftFor: (self, id) => Effect.gen(function* () {
                 const credential = self.connectors.get(id)?.credential;

package/dist/request-principal.js

@@ -1,4 +1,4 @@
-// The admitted principal a request-auth resolver may receive (#1103).
+// The admitted principal a request-auth resolver may receive.
 //
 // Only the caller core attached from the admitting authorization counts
 // (`callerOf`, see connector-caller.ts). No argument, program or header can
@@ -9,13 +9,26 @@
 import { isAgentName } from "./agent-identity.js";
 import { callerOf } from "./connector-caller.js";
 import { validIdentityReference } from "./identity.js";
+const forwardingConnectors = new WeakSet();
+/** Internal construction tag; never inferred from request data or descriptions. */
+export function tagPrincipalForwarding(connector) {
+    forwardingConnectors.add(connector);
+    return connector;
+}
+export function forwardsPrincipal(connector) {
+    for (let current = connector; current; current = Object.getPrototypeOf(current)) {
+        if (forwardingConnectors.has(current))
+            return true;
+    }
+    return false;
+}
 /**
  * The principal this operation's admitted caller is. Anything else is refused
  * through `refuse`, the connector's own `auth_required` error.
  */
 export function requestPrincipalFor(policy, ctx, refuse) {
     const caller = callerOf(ctx);
-    // An operator check, a context no request admitted, or an open deployment's anonymous caller.
+    // A context no request admitted, or an open deployment's anonymous caller.
     if (!caller?.authenticated)
         throw refuse("acts as the admitted caller, and this operation has none");
     const { identity } = caller;

package/dist/request-state.js

@@ -1,3 +1,4 @@
+import { sha256Hex } from "./bytes.js";
 import { ProtocolError, INVALID_PARAMS } from "@modelcontextprotocol/server";
 export const REQUEST_STATE_TTL_MS = 10 * 60_000;
 export const MAX_INPUT_ROUNDS = 3;
@@ -16,6 +17,5 @@ export function canonicalState(value) {
         : item);
 }
 export async function requestDigest(tool, args) {
-    const bytes = new TextEncoder().encode(canonicalState({ tool, args }));
-    return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+    return sha256Hex(canonicalState({ tool, args }));
 }

package/dist/routes/access-tokens.js

@@ -67,7 +67,7 @@ export async function routeAccessTokens(context, manager) {
     const admin = await authorizeUiIdentity(request, baseUrl, opts.config.auth, "access token management", context.runtimeContext, opts.config.logger);
     if (!admin.ok)
         return admin.response;
-    // Interactive maintainers alone manage agent tokens (#837); anyone else
+    // Interactive maintainers alone manage agent tokens; anyone else
     // gets the same private 404 every operator route gives them.
     if (!managesAgentTokens(opts, admin) || !admin.identity.principal) {
         return privateJson({ error: "not found" }, { status: 404 });

package/dist/routes/activity-disclosure.js

@@ -6,7 +6,7 @@ function activityToolVisible(access, event) {
 }
 /**
  * One disclosure rule for the timeline and the UI's last-call overlay. Only
- * maintainers read activity (#837), and only after the optional
+ * maintainers read activity, and only after the optional
  * read gate. They may see other principals' shared-connector history,
  * including request IDs, client name/version, and actor kind/id/namespace, on
  * plain /mcp and in every declared pool, within the tools that pool declares.

package/dist/routes/connect.js

@@ -88,7 +88,7 @@ async function connect(context) {
     if (!authz.ok) {
         // Access sign-in is enforced at the edge. Clerk needs its own sign-in page.
         // The sign-in page returns to this link, which then sends a maintainer on
-        // to the operator UI. Pool members cannot use that UI yet (#837), so
+        // to the operator UI. Pool members cannot use that UI yet, so
         // signing in there would strand them.
         if (authz.response.status === 401 &&
             authorizationCredential(request).kind === "absent" &&
@@ -107,7 +107,7 @@ async function connect(context) {
     if (authz.principalKey !== handoff.principal || !mayManageConnector(opts, authz, connector)) {
         return refuse("Sign in as the user who requested this connection and has permission to manage it.");
     }
-    // The operator UI serves maintainers only until member views ship (#837).
+    // The operator UI serves maintainers only until member views ship.
     // A member's OAuth link starts here directly, as it does without a UI.
     const viaUi = Boolean(opts.config.ui) && admitsMaintainer(opts, authz);
     if (!connector.startAuth) {

package/dist/routes/credentials.js

@@ -158,7 +158,7 @@ function credentialRequest(context, connectorId, action) {
         if (request.method === "DELETE") {
             // Clearing nothing is refused, as testing nothing is, so the route
             // agrees with the operator contract, which offers `clear` only once a
-            // value is stored in the caller's partition (#837). A value that cannot
+            // value is stored in the caller's partition. A value that cannot
             // be read may still be cleared: removing it is how one recovers.
             const stored = yield* Effect.tryPromise({
                 try: () => vault.metadata(connectorId, owner),

package/dist/routes/dispatch.js

@@ -4,6 +4,8 @@ import * as HttpServerError from "effect/http/HttpServerError";
 import * as HttpServerRequest from "effect/http/HttpServerRequest";
 import * as HttpServerResponse from "effect/http/HttpServerResponse";
 import { notFoundResponse } from "../branding.js";
+import { authorizationCredential } from "../inbound-credential.js";
+import { failureRecord, logFailure } from "../operator-record.js";
 import { isAgentPath } from "./agent-path.js";
 import { MCP_CORS_HEADERS } from "./mcp.js";
 import { routeConnect } from "./connect.js";
@@ -27,6 +29,14 @@ export function createRouteDispatcher(mcp, metadata, health) {
     const afterUi = (program) => (context) => Effect.gen(function* () {
         const ui = context.opts.config.ui;
         const response = ui ? yield* Effect.promise(() => ui.handle(context)) : null;
+        if (response?.status === 401) {
+            const authorizationHeader = authorizationCredential(context.request).kind;
+            logFailure(context.opts.config.logger, "operator_refused", failureRecord({
+                reason: authorizationHeader === "invalid" ? "authorization_header_invalid" : "authentication_failed",
+                accessContext: Boolean(context.runtimeContext?.access),
+                authorizationHeader,
+            }, response));
+        }
         return response ?? (yield* program(context));
     });
     const optional = (program) => (context) => Effect.flatMap(program(context), (response) => (response ? Effect.succeed(response) : fallback(context)));

package/dist/routes/mcp.js

@@ -32,7 +32,7 @@ const deadlineResponses = new WeakSet();
 /**
  * The most a `subscriptions/listen` classification reads. A listen is a small
  * JSON-RPC request; this read happens before request admission, so it is
- * bounded by this fixed cap rather than by the host's body limit (#857).
+ * bounded by this fixed cap rather than by the host's body limit.
  */
 export const MAX_LISTEN_CLASSIFICATION_BYTES = 64 * 1024;
 /**
@@ -286,7 +286,7 @@ function admitted(controller, signal) {
     }), (lease) => Effect.sync(() => lease.release()), { interruptible: true });
 }
 /**
- * 404 for any `?toolkit=` value, kept after the feature's retirement (#178).
+ * 404 for any `?toolkit=` value, kept after the feature's retirement.
  *
  * Toolkits are gone, but the URLs that named them are not: clients were handed
  * MCP endpoint URLs with `?toolkit=` baked in, and nothing about upgrading the
@@ -409,6 +409,7 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             credentialHandoffUrl: opts.config.ui?.credentialHandoffUrl(baseUrl),
             ...(activity ? { activity } : {}),
             defaultToolTimeoutMs: opts.config.calls.defaultTimeoutMs ?? opts.config.execute.hostCallTimeoutMs,
+            maxProgramResultChars: opts.config.execute.maxResultChars,
             probeTimeoutMs: opts.config.discovery.probeTimeoutMs,
             discoveryConcurrency: opts.config.discovery.concurrency,
             requestSignal,
@@ -504,20 +505,7 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
         if (!response.body)
             return response;
         const body = yield* upwardStep(authInvoke(response, "text", []));
-        let text;
-        if (response.headers.get("Content-Type")?.includes("application/json")) {
-            // Structured redaction also joins text blocks before a secret split
-            // across them can cross the serialization boundary.
-            try {
-                text = JSON.stringify(redactAgentOutput(sentSecrets, JSON.parse(body)));
-            }
-            catch {
-                /* Non-JSON diagnostics still pass through the text boundary. */
-            }
-        }
-        // Parsed JSON already passes every string through the boundary. A second
-        // serialized pass would mistake a blob's encoding for credential bytes.
-        text ??= redactAgentOutput(sentSecrets, body);
+        const text = sentSecrets.serializedAgentOutput(body, response.headers.get("Content-Type")?.includes("application/json") ?? false);
         const headers = new Headers(response.headers);
         headers.delete("Content-Length");
         return new Response(text, { status: response.status, statusText: response.statusText, headers });
@@ -651,7 +639,7 @@ export function createMcpRoute(opts) {
             }));
             // A request naming `subscriptions/listen` defers its permit: nothing of
             // its body is read until auth and endpoint admission pass, and then at
-            // most MAX_LISTEN_CLASSIFICATION_BYTES (#857). Only a body-confirmed
+            // most MAX_LISTEN_CLASSIFICATION_BYTES. Only a body-confirmed
             // modern listen goes without a permit; trusting the header alone would
             // let a legacy tools/call bypass the pool, so anything else takes one
             // after classification. Every other request takes its permit here,
@@ -662,15 +650,21 @@ export function createMcpRoute(opts) {
             const refuseAdmission = (error) => {
                 if (!(error instanceof ExecutorAdmissionError))
                     return Effect.fail(error);
-                if (error.code === "executor_cancelled")
+                if (error.code === "executor_cancelled") {
+                    // The lifetime timer can withdraw a fallback waiter before the
+                    // enclosing timeout settles. Keep its public deadline response.
+                    if (localAbort.signal.aborted && !request.signal.aborted) {
+                        return Effect.succeed(cors(mcpRefusal(sentSecrets, 504, -33003, "MCP request lifetime exceeded.")));
+                    }
                     return Effect.fail(request.signal.reason ?? error);
+                }
                 if (error.code === "executor_overloaded")
                     warnAdmissionRejected(error);
                 return Effect.succeed(cors(requestAdmissionFailure(sentSecrets, error)));
             };
             const admission = listenHeader
                 ? Result.succeed(undefined)
-                : yield* Effect.result(admitted(opts.requestAdmission, request.signal));
+                : yield* Effect.result(admitted(opts.requestAdmission, localAbort.signal));
             if (Result.isFailure(admission))
                 return yield* refuseAdmission(admission.failure);
             const remainingMs = admission.success
@@ -687,7 +681,15 @@ export function createMcpRoute(opts) {
                     localAbort.abort(new Error("MCP request lifetime exceeded."));
                 }, remainingMs);
             }
-            const localRequest = new Request(request, { signal: localAbort.signal });
+            // Pass the body explicitly: inheriting it makes Node add an identity
+            // TransformStream whose pull-ahead can exceed the inspection bound.
+            const localRequest = new Request(request, {
+                signal: localAbort.signal,
+                // This is an inbound SDK view, not an outgoing keepalive or no-cors
+                // fetch; Node rejects an explicit stream with either.
+                ...(request.body ? { body: request.body, duplex: "half", keepalive: false } : {}),
+                ...(request.body && request.mode === "no-cors" ? { mode: "cors" } : {}),
+            });
             if (admission.success && admission.success.waitMs > 0) {
                 opts.config.logger.debug("[connecta] MCP request admitted after queue wait", {
                     waitMs: admission.success.waitMs,
@@ -803,7 +805,7 @@ export function createMcpRoute(opts) {
                         return cors(mcpRefusal(sentSecrets, 413, -33006, "MCP request body too large."));
                     }
                     if (listenHeader && verdict === "other") {
-                        const late = yield* Effect.result(admitted(opts.requestAdmission, request.signal));
+                        const late = yield* Effect.result(admitted(opts.requestAdmission, localAbort.signal));
                         if (Result.isFailure(late))
                             return yield* refuseAdmission(late.failure);
                     }

package/dist/routes/oauth-management.js

@@ -23,7 +23,7 @@ function oauthManagementRequest(context, connectorId) {
         const registry = yield* managementRegistry(context, authz);
         const connector = registry.getConnector(connectorId);
         const disconnectAuth = connector?.disconnectAuth?.bind(connector);
-        // Each verb needs only its own hooks (#837): connecting needs the whole
+        // Each verb needs only its own hooks: connecting needs the whole
         // flow, through the callback's state check; disconnecting needs only
         // disconnectAuth, so a grant provisioned out of band can still be dropped.
         const connects = Boolean(connector?.startAuth && connector.finishAuth && connector.verifyState);

package/dist/routes/operator.js

@@ -1,3 +1,4 @@
+import { bytesToHex } from "../bytes.js";
 // The Effect plumbing the operator and activity data routes share.
 //
 // Each JSON route under /ui/* is one Effect program, run at its Promise edge
@@ -21,7 +22,8 @@
 //
 // Imported by the /ui and /activity graphs only; never from the root entry.
 import { Effect } from "effect";
-import { runEdge } from "../runtime/run.js";
+import { operatorViewerKeys } from "../storage/keys.js";
+import { runEdge, withDeadlineEffect } from "../runtime/run.js";
 import { isMaintainer } from "../membership.js";
 import { admitsMaintainer, authorize, authorizeUiIdentity, memberConnectors, privateJson, } from "./shared.js";
 /** A response the route has already decided on. */
@@ -47,36 +49,80 @@ export function authorized({ request, baseUrl, opts, runtimeContext }, partition
 export function authorizedPerson({ request, baseUrl, opts, runtimeContext }, purpose) {
     return Effect.suspend(() => admitted(authorizeUiIdentity(request, baseUrl, opts.config.auth, purpose, runtimeContext, opts.config.logger)));
 }
+// Cache resolved keys only; request promises and identities never outlive a read.
+const viewerSigningKeys = new WeakMap();
+/** Stable across isolates, opaque even for guessable Access email identities. */
+export function operatorViewerKey(context, authz) {
+    const attempt = (read) => Effect.tryPromise({ try: read, catch: (error) => error });
+    return withDeadlineEffect(() => Effect.gen(function* () {
+        const storage = context.opts.config.storage;
+        let key = viewerSigningKeys.get(storage);
+        if (!key) {
+            let raw = yield* attempt(() => storage.get(operatorViewerKeys.signingKey));
+            if (raw === null) {
+                const candidate = crypto.randomUUID();
+                raw = (yield* attempt(() => storage.compareAndSet(operatorViewerKeys.signingKey, null, candidate)))
+                    ? candidate
+                    : yield* attempt(() => storage.get(operatorViewerKeys.signingKey));
+            }
+            if (!raw || !/^[0-9a-f-]{36}$/.test(raw))
+                return yield* Effect.fail(new Error("Operator viewer key unavailable"));
+            const bytes = new TextEncoder().encode(raw);
+            key = yield* attempt(() => crypto.subtle.importKey("raw", bytes, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]));
+            viewerSigningKeys.set(storage, key);
+        }
+        const { principal, subject, actor, interactive, agent } = authz.identity;
+        const identity = new TextEncoder().encode(JSON.stringify([
+            principal?.namespace,
+            principal?.id,
+            subject?.namespace,
+            subject?.id,
+            actor.kind,
+            actor.namespace,
+            actor.id,
+            interactive,
+            agent,
+        ]));
+        const signingKey = key;
+        const digest = yield* attempt(() => crypto.subtle.sign("HMAC", signingKey, identity));
+        return bytesToHex(new Uint8Array(digest));
+    }), {
+        timeoutMs: 500,
+        signal: context.request.signal,
+        timeoutError: new Error("Operator viewer key timed out"),
+    }).pipe(Effect.catch(() => refuse("operator identity could not be read", 503)));
+}
 /** The partition an identity carries into a registry view of the given connectors. */
-export function scopeFor(authz, connectorIds = "all") {
+export function scopeFor(authz, authenticated, connectorIds = "all") {
     return {
         connectorIds,
         ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
         ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
+        operatorCaller: { identity: authz.identity, authenticated },
     };
 }
 /**
- * The whole registry, for a maintainer only (#837). Everyone else gets the
+ * The whole registry, for a maintainer only. Everyone else gets the
  * private 404 plain `/mcp` gives them.
  */
 export function visibleRegistry({ opts }, authz) {
     // Operator catalogs describe the default endpoint's view, never a pool view.
     if (!admitsMaintainer(opts, authz))
         return refuse("not found", 404);
-    return Effect.succeed(opts.registry.scoped(scopeFor(authz)));
+    return Effect.succeed(opts.registry.scoped(scopeFor(authz, opts.config.auth.length > 0)));
 }
 /**
- * The connectors a connector-auth route may resolve (#837): every connector
+ * The connectors a connector-auth route may resolve: every connector
  * for a maintainer, the connectors of their pools for a pool member, and the
  * private 404 for anyone else. mayManageConnector still decides each action.
  */
 export function managementRegistry({ opts }, authz) {
     if (isMaintainer(opts.maintainers, authz.identity))
-        return Effect.succeed(opts.registry.scoped(scopeFor(authz)));
+        return Effect.succeed(opts.registry.scoped(scopeFor(authz, opts.config.auth.length > 0)));
     const ids = memberConnectors(opts, authz.identity);
     if (ids !== "all" && ids.size === 0)
         return refuse("not found", 404);
-    return Effect.succeed(opts.registry.scoped(scopeFor(authz, ids === "all" ? "all" : [...ids])));
+    return Effect.succeed(opts.registry.scoped(scopeFor(authz, opts.config.auth.length > 0, ids === "all" ? "all" : [...ids])));
 }
 /**
  * Run one route program to its Response.

package/dist/routes/shared.d.ts

@@ -78,7 +78,7 @@ export declare function authorize(request: Request, baseUrl: string, auth: reado
     response: Response;
 }>;
 /**
- * Admission at an agent endpoint, `/agent/<pool>` (#837). Only the built-in
+ * Admission at an agent endpoint, `/agent/<pool>`. Only the built-in
  * agent credential adapters are consulted: Clerk and Access never run, cookies and Clerk
  * handshake parameters are stripped, and the runtime context, which carries
  * Access's `ctx.access` even on a bypassed path, is never passed. Anything but
@@ -88,31 +88,31 @@ export declare function authorizeAgent(request: Request, baseUrl: string, auth:
 /** Human routes reject machine credentials before any verification or storage I/O. */
 export declare function authorizeUiIdentity(request: Request, baseUrl: string, auth: readonly InboundAuth[], purpose: string, runtimeContext?: RuntimeExecutionContext, logger?: Logger): Promise<Awaited<ReturnType<typeof authorize>>>;
 export declare function isSameOrigin(request: Request, baseUrl: string): boolean;
-export declare function withSecurityHeaders(response: Response, requestUrl: URL, _path: string): Response;
+export declare function withSecurityHeaders(response: Response, requestUrl: URL): Response;
 type AuthorizedIdentity = Extract<Awaited<ReturnType<typeof authorize>>, {
     ok: true;
 }>;
 /**
- * Plain `/mcp` and every operator route admit a maintainer (#837). An open
+ * Plain `/mcp` and every operator route admit a maintainer. An open
  * deployment has no inbound auth and so no maintainers: its one anonymous
  * caller keeps the whole default endpoint, as the startup warning says.
  */
 export declare function admitsMaintainer(opts: ServerOptions, authz: AuthorizedIdentity): boolean;
 /**
  * The declared pool `/mcp/<name>` serves to this person, or undefined for the
- * same 404. An agent is never admitted here, even when listed (#837).
+ * same 404. An agent is never admitted here, even when listed.
  */
 export declare function memberPool(opts: ServerOptions, name: string, identity: Readonly<AuthenticatedIdentity>): ResolvedPool | undefined;
 /** The declared pool `/agent/<name>` serves to this agent, or undefined for the same 404. */
 export declare function agentPool(opts: ServerOptions, name: string, identity: Readonly<AuthenticatedIdentity>): ResolvedPool | undefined;
 /**
- * The connectors of every pool this identity is a member of (#837): what a
+ * The connectors of every pool this identity is a member of: what a
  * pool member may ever manage, and only their personal ones among these.
  */
 export declare function memberConnectors(opts: ServerOptions, identity: Readonly<AuthenticatedIdentity>): "all" | ReadonlySet<string>;
 /**
  * Whether this identity may start, finish, or remove a connector's auth
- * (#837). Only an interactive person ever may; an agent or any other machine
+ * Only an interactive person ever may; an agent or any other machine
  * credential manages nothing. Shared auth is deployment-wide, so it takes a
  * maintainer. A personal connector takes a stable principal that is a
  * maintainer, whose plain `/mcp` includes it, or a member of a pool that
@@ -124,10 +124,10 @@ export declare function mayManageConnector(opts: ServerOptions, authz: Authorize
     id: string;
     authScope?: "shared" | "personal";
 }): boolean;
-/** Agent token list, issue, rotate, and revoke: an interactive maintainer only (#837). */
+/** Agent token list, issue, rotate, and revoke: an interactive maintainer only. */
 export declare function managesAgentTokens(opts: ServerOptions, authz: AuthorizedIdentity): boolean;
 /**
- * Activity reads: a maintainer principal, interactive or not (#837). Members
+ * Activity reads: a maintainer principal, interactive or not. Members
  * and agents read none, and an open deployment has no maintainer.
  */
 export declare function readsActivity(opts: ServerOptions, authz: AuthorizedIdentity): boolean;