@zackbart/connecta 0.37.0 → 0.38.0

package/dist/config.js

@@ -79,11 +79,12 @@ const discovery = {
 const calls = {
     /**
      * Deadline (ms) for `call_tool`/`call_destructive_tool` calls that pass no
-     * `timeoutMs`. An explicit per-call value wins. Opt-in: unset by default, so
-     * existing long-running calls gain no surprise deadline.
+     * `timeoutMs`. An explicit per-call value wins. Unset by default, when those
+     * calls fall back to `execute.hostCallTimeoutMs`.
      *
-     * Each call makes one attempt. `execute_code` host calls are
-     * unaffected because they already carry their own bound.
+     * Each call makes one attempt. `connecta.call` inside `execute_code` uses
+     * it too, ahead of `execute.hostCallTimeoutMs`; `connecta.result`,
+     * `connecta.skill` and `connecta.read` do not.
      */
     defaultTimeoutMs: whole({ min: 1 }),
     /**
@@ -111,9 +112,12 @@ const execute = {
     /** Host calls one program may make. Default 20. */
     maxHostCalls: whole({ min: 1, default: D.execute.maxHostCalls }),
     /**
-     * Deadline for each host call a program makes, in milliseconds. Default
-     * 15_000. Raise it for providers whose legitimate calls run longer, such as
-     * analytics queries; `call_tool`'s own `timeoutMs` is unaffected.
+     * Deadline for a program's `connecta.result`, `connecta.skill` and
+     * `connecta.read`, in milliseconds. Default 15_000. Discovery uses
+     * `discovery.probeTimeoutMs`. `connecta.call` and the direct call tools use it only when
+     * `calls.defaultTimeoutMs` is unset, and an explicit per-call `timeoutMs`
+     * always wins. Raise it for providers whose legitimate calls run longer,
+     * such as analytics queries.
      */
     hostCallTimeoutMs: whole({ min: 1, default: D.execute.hostCallTimeoutMs }),
     /**
@@ -129,6 +133,14 @@ const execute = {
      * budget every call already spends. Default 10.
      */
     maxWrites: whole({ min: 1, default: D.execute.maxWrites }),
+    /**
+     * Serialized characters a program may return, shared with emitted text,
+     * before Connecta stashes the return and answers with a paging notice.
+     * Default 24_000 (~6k tokens). Raise it when agents need large results whole
+     * and the model's context can afford them: each paging round trip costs a
+     * model step. From 4_000 to 1_000_000.
+     */
+    maxResultChars: whole({ min: 4_000, max: 1_000_000, default: D.execute.maxResultChars }),
 };
 function admissionPool(defaults) {
     return {
@@ -492,48 +504,6 @@ const connectaConfig = {
     readOnly: required(opaque({ check: assertFlag }), (path) => READ_ONLY_REQUIRED(path)),
 };
 const CONFIG = object(connectaConfig);
-/** Pause-only options #672 removed with `resume_execution`. */
-const RETIRED_PAUSE_OPTIONS = ["ConnectaConfig.execute.resumableWrites", "ConnectaConfig.execute.pausedRunTtlSeconds"];
-/** Access options pools replaced (#837, decisions/0006). */
-const isRetiredPoolGrant = (path) => /^ConnectaConfig\.pools\.[^.]+\.grant$/.test(path);
-/** Management resolvers maintainers and pool membership replaced (#837, decisions/0006). */
-const RETIRED_IDENTITY = [
-    ["credentialAdministration", "maintainers administer shared credentials and OAuth grants. List them in maintainers."],
-    [
-        "personalConnection",
-        "pool members connect and disconnect their own personal connectors in their pools, and maintainers their own. Add people to a pool's members.",
-    ],
-    [
-        "accessTokenManagement",
-        "maintainers issue, rotate, and revoke agent tokens from an interactive session. List them in maintainers.",
-    ],
-    ["activityAccess", "maintainers read activity; activity.readGate can still narrow it. List them in maintainers."],
-];
-/** `trust`, on the deployment or a pool, was replaced by `readOnly` (#820). */
-const isRetiredTrust = (path) => path === "ConnectaConfig.trust" || (path.startsWith("ConnectaConfig.pools.") && path.endsWith(".trust"));
-/**
- * `identity` was removed whole (#837), so the walk reports only the section.
- * Name each key it still holds, read by descriptor without running a getter
- * or echoing a value, so a retired resolver's message names its replacement.
- */
-function expandRetiredIdentity(config, paths) {
-    if (!paths.includes("ConnectaConfig.identity"))
-        return paths;
-    let keys = [];
-    try {
-        const descriptor = Reflect.getOwnPropertyDescriptor(config, "identity");
-        const value = descriptor && "value" in descriptor ? descriptor.value : undefined;
-        if (typeof value === "object" && value !== null && !Array.isArray(value)) {
-            keys = Reflect.ownKeys(value).filter((key) => typeof key === "string");
-        }
-    }
-    catch {
-        keys = [];
-    }
-    if (keys.length === 0)
-        return paths;
-    return paths.flatMap((path) => path === "ConnectaConfig.identity" ? keys.map((key) => `ConnectaConfig.identity.${key}`) : [path]);
-}
 function rejectUnknownOptions(paths) {
     if (paths.length === 0)
         return;
@@ -547,27 +517,6 @@ function rejectUnknownOptions(paths) {
             : "") +
         (paths.includes("ConnectaConfig.execute.approval")
             ? "\nexecute.approval was removed. The MCP client owns approval; set readOnly: true on the deployment or a pool to refuse writes."
-            : "") +
-        (paths.some((path) => RETIRED_PAUSE_OPTIONS.includes(path))
-            ? "\nPrograms no longer pause at writes, so there is nothing to configure: writable endpoints let programs and call_destructive_tool write; readOnly endpoints refuse every write (issue #672). Delete the option."
-            : "") +
-        (paths.includes("ConnectaConfig.identity.connectorAccess")
-            ? "\nidentity.connectorAccess was removed (#837): pools are the access model. List who may use plain /mcp in maintainers, and give each pool its tools and members. A guarded { tool, requireReadOnly: true } grant becomes a pool with readOnly: true."
-            : "") +
-        RETIRED_IDENTITY.filter(([key]) => paths.includes(`ConnectaConfig.identity.${key}`))
-            .map(([key, replacement]) => `\nidentity.${key} was removed (#837): ${replacement}`)
-            .join("") +
-        (paths.some((path) => path === "ConnectaConfig.identity" || path.startsWith("ConnectaConfig.identity."))
-            ? "\nThe identity section was removed (#837): maintainers and pool members decide access and management. Delete it."
-            : "") +
-        (paths.includes("ConnectaConfig.grant")
-            ? "\nThe top-level grant was removed (#837); list the people who may use plain /mcp in maintainers."
-            : "") +
-        (paths.some(isRetiredPoolGrant)
-            ? "\nPool grant was removed (#837); list who may open the pool in its members."
-            : "") +
-        (paths.some(isRetiredTrust)
-            ? '\ntrust was removed (#820); set readOnly, which every deployment now chooses explicitly. trust: "read-only" becomes readOnly: true, which now also refuses call_destructive_tool. trust: "trusted" becomes readOnly: false. A pool inherits the deployment readOnly unless it sets its own.'
             : ""));
 }
 /** Checks that span fields; each value is already individually valid. */
@@ -598,7 +547,7 @@ export function resolveConfig(config) {
  */
 export function readConfig(config) {
     const read = readPlain(config, "ConnectaConfig", CONFIG);
-    rejectUnknownOptions(expandRetiredIdentity(config, read.unknown));
+    rejectUnknownOptions(read.unknown);
     const input = read.value;
     const parsed = CONFIG.parse(input, "ConnectaConfig");
     assertCoherent(parsed);
@@ -648,5 +597,6 @@ export function executeLimits(config) {
         hostCallTimeoutMs: config.execute.hostCallTimeoutMs,
         watchdogMs: config.execute.watchdogMs,
         maxWrites: config.execute.maxWrites,
+        maxResultChars: config.execute.maxResultChars,
     };
 }

package/dist/connector-caller.js

@@ -17,7 +17,7 @@
 // registry view that request receives, and `api()` hands handlers that same
 // context object; no argument or program can name it, and a header only
 // through an inbound-auth provider configured to read one (a bearer's asserted
-// principal). A context no request admitted, such as an operator probe, has no caller, and a delegated provider fails closed on it,
+// principal). A context no request admitted has no caller, and a delegated provider fails closed on it,
 // as it does on the anonymous caller an open deployment admits.
 import { Caller, serviceFor, setViewService } from "./runtime/call.js";
 const callerIdentities = new WeakSet();

package/dist/connectors/api-connector.js

@@ -1,3 +1,4 @@
+import { wrapViewCredentials } from "../runtime/call.js";
 import { storedAuthObservation, withStoredAuth } from "../auth/stored-observation.js";
 import { Effect, Exit } from "effect";
 import { registerConnectorVocabulary } from "../operation-vocabulary.js";
@@ -13,7 +14,7 @@ import { describedEndpoint, describedOrigin, describedTools } from "../described
 import { READ_ONLY, CALL_ADMISSION, CREDENTIAL, USAGE_GUIDE } from "./option-shapes.js";
 import { assertStaticToolNames } from "../tool-name.js";
 import { registerInvocationAuth } from "../invocation-auth.js";
-import { redactCatalog, redactSentSecrets, sentSecretsFetch, trackCredentialReads } from "../sent-secrets.js";
+import { redactCatalog, redactSentSecrets, sentSecretsFetch } from "../sent-secrets.js";
 import { callClassification } from "../call-classification.js";
 import { classifyTool } from "../tool-safety.js";
 import { closeProviderCall, enterProviderBoundary, inLogicalCall, knownProviderFailure, nestedProviderRequests, providerBoundary, providerCallContext, providerFetch, providerRequests, tracksRequests, } from "../provider-call.js";
@@ -24,7 +25,7 @@ export function defined(value) {
 }
 /**
  * Three things a hand-written surface is refused for at construction rather
- * than in production (#340): no description (discovery has nothing to route on
+ * than in production: no description (discovery has nothing to route on
  * and a guess costs a call), no explicit `readOnlyHint` (connecta never infers
  * the safety class, so an unclassified tool is a deployment bug), and an
  * `inputSchema` the validator cannot compile (declaring one is optional;
@@ -173,7 +174,7 @@ export function apiConnector(id, opts, oauth) {
         callTool: (name, args, ctx, options) => runEdge(core(name, args, ctx, options)),
     };
     const core = (name, args, ctx) => Effect.gen(function* () {
-        trackCredentialReads(ctx);
+        wrapViewCredentials(ctx);
         enterProviderBoundary(ctx, connector);
         const tool = byName.get(name);
         // Refusals before the handler runs are known failures: nothing was sent.

package/dist/connectors/guarded-fetch.d.ts

@@ -1,5 +1,4 @@
 export { retryAfterMs } from "../http-policy.js";
-import { type ProviderRequest } from "../provider-call.js";
 import type { ConnectorContext } from "../types.js";
 /** The methods a hand-written provider surface actually uses. */
 type GuardedMethod = "GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE";
@@ -182,11 +181,6 @@ type GuardedFetcher = (url: string, init: RequestInit, ctx: ConnectorContext) =>
 export declare function oauthBearer(provider: string): Pick<GuardedFetchOptions, "authenticate" | "fetch">;
 /** Send one guarded request and map its response with provider knowledge. */
 export type GuardedTransport = <T>(request: GuardedRequest, ctx: ConnectorContext, map: GuardedResponseMapper<T>) => Promise<T>;
-/**
- * Test-only legacy response lookup for renewal-provenance fixtures outside
- * the kit. Production renewal uses the kit ledger. Undefined for other objects.
- */
-export declare function answeredRequest(response: object): ProviderRequest | undefined;
 /**
  * Build the transport a connector sends every request through. `maxResponseBytes`
  * is required rather than defaulted: what counts as an absurd response is a fact

package/dist/connectors/guarded-fetch.js

@@ -3,7 +3,7 @@ export { retryAfterMs } from "../http-policy.js";
 import { callerSignal, duringViewCall, settleOnClose, viewSignal } from "../runtime/call.js";
 /**
  * The safety machinery every hand-written HTTP surface needs, extracted once
- * (#341): path confinement, encoded query and framed bodies, per-request
+ *: path confinement, encoded query and framed bodies, per-request
  * credential headers applied last, a refused redirect, a bounded read, and
  * network-failure normalization. It owns no vendor-specific meaning and never
  * invents an auth scheme, because the same 403 means an ungranted
@@ -280,15 +280,6 @@ async function jsonResult(read) {
         return { parseError: cause };
     }
 }
-// Each response a mapper reads, and the ledger entry of the request it answered.
-const answeredRequests = new WeakMap();
-/**
- * Test-only legacy response lookup for renewal-provenance fixtures outside
- * the kit. Production renewal uses the kit ledger. Undefined for other objects.
- */
-export function answeredRequest(response) {
-    return answeredRequests.get(response);
-}
 /**
  * Build the transport a connector sends every request through. `maxResponseBytes`
  * is required rather than defaulted: what counts as an absurd response is a fact
@@ -463,7 +454,6 @@ export function guardedFetch(options) {
                 throw oversized(provider, limit, `a declared ${declared} bytes`);
             }
             const answer = boundedResponse(provider, response, limit, signal);
-            answeredRequests.set(answer, dispatch);
             const abort = () => {
                 void response?.body?.cancel().catch(() => { });
             };

package/dist/connectors/remote-mcp.js

@@ -1,3 +1,5 @@
+import { wrapViewCredentials } from "../runtime/call.js";
+import { sha256Hex, utf8Length } from "../bytes.js";
 import { withStoredAuth } from "../auth/stored-observation.js";
 import { authorizationParamsFor } from "../auth/oauth-authorization-params.js";
 import { authView } from "../auth/native-call.js";
@@ -6,12 +8,12 @@ import { isOAuthCredentialRequest } from "../auth/oauth-token-response.js";
 import { deriveContext } from "../derived-context.js";
 import { operationContext, openRequest, viewServices, viewSignal } from "../runtime/call.js";
 import { assertRemoteOAuthClient, declareSelfHostedClient, downstreamClientMetadata, downstreamRedirectUri, remoteClientAuthMethod, selfHostedClientUrl, trackRemoteClientRequest, } from "../auth/downstream-client-metadata.js";
-import { AuthorizationServerMismatchError, Client, InsecureTokenEndpointError, InsufficientScopeError, IssuerMismatchError, MissingRequiredClientCapabilityError, OAuthClientFlowError, OAuthError, ProtocolError, RegistrationRejectedError, ResourceNotFoundError, SdkError, SdkErrorCode, SdkHttpError, SseError, UnsupportedProtocolVersionError, UrlElicitationRequiredError, isInputRequiredResult, fromJsonSchema, isJSONRPCErrorResponse, isJSONRPCNotification, specTypeSchemas, StreamableHTTPClientTransport, UnauthorizedError, } from "@modelcontextprotocol/client";
+import { AuthorizationServerMismatchError, Client, InsecureTokenEndpointError, InsufficientScopeError, IssuerMismatchError, MissingRequiredClientCapabilityError, OAuthClientFlowError, OAuthError, ProtocolError, RegistrationRejectedError, ResourceNotFoundError, SdkError, SdkErrorCode, SdkHttpError, SseError, UnsupportedProtocolVersionError, UrlElicitationRequiredError, isInputRequiredResult, fromJsonSchema, isJSONRPCErrorResponse, isJSONRPCNotification, extractWWWAuthenticateParams, specTypeSchemas, StreamableHTTPClientTransport, UnauthorizedError, } from "@modelcontextprotocol/client";
 import { Deferred, Duration, Effect, Exit, Scope } from "effect";
 import { assertOAuthScope, authorizingContext, codeExchangeResponse, KvOAuthProvider, OAuthRequestNotSentError, refreshCoordinatorsByPartition, } from "../auth/downstream-oauth.js";
 import { trackOAuthStartReset } from "../auth/oauth-start-reset.js";
 import { byteReadResponse } from "../byte-read-response.js";
-import { redactCatalog, redactSentSecrets, requestSentSecrets, sentSecretsFor, shortSecretWarning, trackCredentialReads, } from "../sent-secrets.js";
+import { redactCatalog, redactSentSecrets, requestSentSecrets, sentSecretsFor, shortSecretWarning, } from "../sent-secrets.js";
 import { MAX_CATALOG_TOOLS, MAX_SERIALIZED_CATALOG_BYTES } from "../catalog-limits.js";
 import { catalogClientOptions, catalogItems, observeCompletedCatalogRefresh, closeCatalogCacheScope, observeCatalogChange, observeCatalogFetch, observeCatalogExpiry, } from "../catalog-cache.js";
 import { connectorScopeCleanupClaimed } from "../connector-scope.js";
@@ -28,7 +30,7 @@ import { registerInvocationAuth } from "../invocation-auth.js";
 import { downstreamInputCapabilities, assertDownstreamOutputSafe, downstreamWriteContinuation, } from "../downstream-input-context.js";
 import { detach, runEdge } from "../runtime/run.js";
 import { assertKnownOptions, keys, optionsOf, strings } from "../config-schema.js";
-import { requestPrincipalFor } from "../request-principal.js";
+import { requestPrincipalFor, tagPrincipalForwarding } from "../request-principal.js";
 import { describedEndpoint, describedUrl } from "../described.js";
 import { retryAfterMs } from "../http-policy.js";
 import { resourceUriMatchesTemplates } from "./resource-uri.js";
@@ -115,32 +117,11 @@ const MAX_SKILL_BYTES = 16 * 1024 * 1024;
 // Leave room for the envelope while accepting every file up to the spec limit.
 const MAX_SKILL_READ_RPC_BYTES = 6 * MAX_SKILL_BYTES + 1024 * 1024;
 /** Count UTF-8 without allocating another full copy of a bounded response. */
-function skillTextBytes(value) {
-    let bytes = 0;
-    for (let i = 0; i < value.length; i++) {
-        const code = value.charCodeAt(i);
-        if (code < 0x80)
-            bytes++;
-        else if (code < 0x800)
-            bytes += 2;
-        else if (code >= 0xd800 &&
-            code <= 0xdbff &&
-            i + 1 < value.length &&
-            value.charCodeAt(i + 1) >= 0xdc00 &&
-            value.charCodeAt(i + 1) <= 0xdfff) {
-            bytes += 4;
-            i++;
-        }
-        else
-            bytes += 3;
-    }
-    return bytes;
-}
 function skillObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function skillJsonBytes(value) {
-    return skillTextBytes(JSON.stringify(value));
+    return utf8Length(JSON.stringify(value));
 }
 function validSkill(value) {
     if (!skillObject(value) ||
@@ -229,9 +210,7 @@ function skillReadSchema(uri) {
                     return { issues: [{ message: "Unexpected skill resource contents." }] };
                 }
                 const mimeType = typeof content.mimeType === "string" ? { mimeType: content.mimeType } : {};
-                if (typeof content.text === "string" &&
-                    !("blob" in content) &&
-                    skillTextBytes(content.text) <= MAX_SKILL_BYTES) {
+                if (typeof content.text === "string" && !("blob" in content) && utf8Length(content.text) <= MAX_SKILL_BYTES) {
                     return { value: [{ uri, ...mimeType, text: content.text }] };
                 }
                 if (typeof content.blob === "string" &&
@@ -668,18 +647,6 @@ function base64Utf8(value) {
     }
     return btoa(binary);
 }
-/**
- * Hex SHA-256 of a credential, used only to notice that a cached client
- * connected with a value the vault no longer holds. WebCrypto rather than a
- * `node:` hash: the whole core has to keep running unchanged on Workers.
- */
-async function digestOf(value) {
-    const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
-    let hex = "";
-    for (const byte of bytes)
-        hex += byte.toString(16).padStart(2, "0");
-    return hex;
-}
 /**
  * Assemble the one header a credential-auth connector sends.
  *
@@ -1132,13 +1099,16 @@ export function remoteMcp(id, opts) {
     // A closed scope keeps its (emptied) entry, so a late or future lookup finds
     // it closed rather than recreating an ownerless connection under it.
     const states = new WeakMap();
+    // Post-connect auth checks keep the exact provider that bound this client,
+    // even if another attempt has since replaced the request scope's state.
+    const connectedProviders = new WeakMap();
     const cacheOwner = {};
     // A cached transport may dispatch concurrent calls and listings. Register
     // its actual sent auth with every operation using that client, including
     // handshake/discovery requests and OAuth rotations. Remove settled users.
     const activeContexts = new WeakMap();
     // Resource headers are non-secret context by contract. They never join the
-    // sent set, so arguments and results equal to them pass unchanged (#1108).
+    // sent set, so arguments and results equal to them pass unchanged.
     // An argument mirrored as `Mcp-Param-*` carrying a resource value is the
     // same context under a name the tracker may read as credential-shaped.
     const resourceValues = new Set(Object.values(extraHeaders ?? {}));
@@ -1451,11 +1421,22 @@ export function remoteMcp(id, opts) {
             }
         }));
         adapted.onUnauthorized = authMethod((ctx) => authCall(flow, [
-            authMethod((trace) => authInvoke(Reflect, "apply", [
-                onUnauthorized,
-                adapted,
-                [{ ...ctx, fetchFn: trace(ctx.fetchFn ?? fetch) }],
-            ])),
+            authMethod((trace) => authFlow(function* () {
+                // This seam receives every 401, during status, starts, and live
+                // calls. Use the SDK's parser so the check covers exactly the
+                // challenged URL it would honor. The provider separately drops
+                // foreign cached resource metadata on every SDK discovery read,
+                // including callbacks and flows without a challenge.
+                const { resourceMetadataUrl } = extractWWWAuthenticateParams(ctx.response);
+                if (resourceMetadataUrl && resourceMetadataUrl.origin !== destination.origin) {
+                    throw new RemoteMcpDestinationError(id, "resource metadata outside the configured resource origin is not allowed");
+                }
+                yield authInvoke(Reflect, "apply", [
+                    onUnauthorized,
+                    adapted,
+                    [{ ...ctx, fetchFn: trace(ctx.fetchFn ?? fetch) }],
+                ]);
+            })),
             renewalSignal(ctx.response),
         ]));
         internals._stepUpAuthorize = authMethod((challenge, retries) => authCall(flow, [
@@ -1487,6 +1468,16 @@ export function remoteMcp(id, opts) {
             super("auth_required", message);
         }
     }
+    /**
+     * A request resolver threw something untyped. Calls still fail with
+     * `auth_required`, but status reports an error: the resolver's own outage
+     * is not an authorization the operator can grant.
+     */
+    class UnresolvedTokenError extends ConnectorCallError {
+        constructor() {
+            super("auth_required", "The request token could not be resolved.");
+        }
+    }
     /**
      * Read this request's credential. Called before every connect and before
      * trusting any cached client, so an operator's replacement is picked up
@@ -1502,7 +1493,7 @@ export function remoteMcp(id, opts) {
             catch (error) {
                 if (error instanceof ConnectorCallError)
                     throw error;
-                throw new ConnectorCallError("auth_required", "The request token could not be resolved.");
+                throw new UnresolvedTokenError();
             }
             ctx.signal?.throwIfAborted();
             if (typeof value !== "string" ||
@@ -1781,7 +1772,13 @@ export function remoteMcp(id, opts) {
                     },
                 }
                 : {}),
-        }), (reset) => trackOAuthStartReset(ctx.requestScope ?? ctx, reset), metadataUrl, oauthScope, undefined, { name: ctx.oauthClientName, client: staticClient, secrets: sentSecretsFor(ctx), authorizationParams });
+        }), (reset) => trackOAuthStartReset(ctx.requestScope ?? ctx, reset), metadataUrl, oauthScope, undefined, {
+            name: ctx.oauthClientName,
+            client: staticClient,
+            secrets: sentSecretsFor(ctx),
+            authorizationParams,
+            resourceOrigin: destination.origin,
+        });
         if (state)
             state.provider = provider;
         return provider;
@@ -1811,6 +1808,7 @@ export function remoteMcp(id, opts) {
                 headers.set(name, value);
             return { ...init, headers };
         };
+        const responseOwner = Context.get(viewServices(ctx), RequestScope);
         const initiatingSignal = ctx.signal;
         ctx = deriveContext(operationContext(ctx), signal ? { signal } : {});
         if (opts._transportFactory)
@@ -1897,6 +1895,12 @@ export function remoteMcp(id, opts) {
                             return writeContinuation ? send(input, { ...init, redirect: "manual" }) : send(input, init);
                         })();
                 return pending.then((response) => {
+                    // RPC fetch adapters can return a disposable Response. Own it at
+                    // the physical Promise leaf, including a late answer after close,
+                    // and keep its body live until the existing request boundary.
+                    const dispose = response[Symbol.dispose];
+                    if (dispose)
+                        responseOwner.own(() => dispose.call(response));
                     if (entry)
                         recordProviderResponse(entry, response.status);
                     if (flight?.write) {
@@ -2140,7 +2144,7 @@ export function remoteMcp(id, opts) {
                 credentialFramed = credentialHeaderValue(credentialScheme, credentialValue);
                 // The principal joins the client's identity: another principal never
                 // reuses this client, even if its resolver returns the same token.
-                credentialDigest = (yield authCall(digestOf, [
+                credentialDigest = (yield authCall(sha256Hex, [
                     principal ? JSON.stringify([principal, credentialValue]) : credentialValue,
                 ]));
                 if ((state.client || state.connecting) &&
@@ -2265,7 +2269,7 @@ export function remoteMcp(id, opts) {
                         clientName: ctx.oauthClientName,
                     }
                     : undefined;
-                const negotiationDigest = yield* promised(authMethod(() => authCall(digestOf, [
+                const negotiationDigest = yield* promised(authMethod(() => authCall(sha256Hex, [
                     JSON.stringify([
                         opts.url,
                         opts.versionNegotiation ?? "auto",
@@ -2312,7 +2316,7 @@ export function remoteMcp(id, opts) {
                     provider
                         ? authMethod(() => authFlow(function* () {
                             const tokens = yield authInvoke(provider, "tokens", []);
-                            return yield authCall(digestOf, [JSON.stringify(tokens)]);
+                            return yield authCall(sha256Hex, [JSON.stringify(tokens)]);
                         }))
                         : undefined,
                 ])));
@@ -2396,6 +2400,8 @@ export function remoteMcp(id, opts) {
                     }
                 }
                 state.client = c;
+                if (provider)
+                    connectedProviders.set(c, provider);
                 state.connectedGeneration = genAtStart;
                 state.authRequired = false;
                 const discover = c.getDiscoverResult();
@@ -2464,8 +2470,8 @@ export function remoteMcp(id, opts) {
      * Read after connecting: connect has bound the epoch, migrated an older
      * layout, and refused a disconnected one within the scope's lifetime.
      */
-    const granted = authMethod((ctx) => authFlow(function* () {
-        return Boolean(yield authInvoke(newProvider(ctx), "tokens", []));
+    const granted = authMethod((provider) => authFlow(function* () {
+        return Boolean(yield authInvoke(provider, "tokens", []));
     }));
     /**
      * Start consent for a downstream that answered without challenging. The
@@ -2474,7 +2480,7 @@ export function remoteMcp(id, opts) {
      * well-known URLs, the same issuer and resource checks, consent state, and
      * CIMD/DCR/static client order. Nothing is sent to the MCP endpoint.
      */
-    const startUnchallenged = authMethod((ctx) => authFlow(function* () {
+    const startUnchallenged = authMethod((ctx, connectedProvider) => authFlow(function* () {
         const required = {
             state: "auth_required",
             message: "Authorization required \u2014 open the URL to connect.",
@@ -2482,10 +2488,12 @@ export function remoteMcp(id, opts) {
         // A test transport carries no OAuth flow to start.
         if (opts._transportFactory)
             return required;
-        // Bound to the live epoch, which the connect just found connected: a
-        // reset or disconnect meanwhile fails this flow's writes.
+        // A cached connection may belong to a passive status or call. Give this
+        // explicit start its own authorization-capable provider without widening
+        // the transport's authority or adopting a Restart's replacement epoch.
+        const epoch = (yield authInvoke(connectedProvider, "flowEpoch", []));
         const provider = newProvider(ctx);
-        (yield authInvoke(provider, "beginFlow", []));
+        (yield authInvoke(provider, "beginFlow", [epoch]));
         // Never started, this transport holds no session or stream to close.
         const transport = buildTransport(ctx, provider);
         const internals = transport;
@@ -2967,6 +2975,8 @@ export function remoteMcp(id, opts) {
             return yield authView(ctx, authMethod(() => authValue(() => closing)), true);
         })),
         status: authMethod((ctx) => authFlow(function* () {
+            if (principalPolicy && !callerOf(ctx)?.authenticated)
+                return ownStatus({ state: "per_caller", message: "Authenticates as each caller; verified on use." });
             const state = stateFor(ctx);
             const report = authMethod((status) => authFlow(function* () {
                 const path = isOauth
@@ -2979,10 +2989,10 @@ export function remoteMcp(id, opts) {
                 });
             }));
             try {
-                (yield authCall(ensureConnected, [ctx, state]));
+                const client = (yield authCall(ensureConnected, [ctx, state]));
                 // The grant decides, as it does for a call: a downstream that
                 // answers without credentials is not connected for this owner.
-                if (isOauth && !(yield authCall(granted, [ctx])))
+                if (isOauth && !(yield authCall(granted, [connectedProviders.get(client)])))
                     return (yield authCall(report, [
                         { state: "auth_required", message: "Authorization required \u2014 open the URL to connect." },
                     ]));
@@ -2995,7 +3005,10 @@ export function remoteMcp(id, opts) {
                 if (err instanceof OperatorDisconnectedError) {
                     return (yield authCall(report, [{ state: "auth_required", message: err.message }]));
                 }
-                if (state.authRequired) {
+                if (state.authRequired ||
+                    (err instanceof ConnectorCallError &&
+                        err.code === "auth_required" &&
+                        !(err instanceof UnresolvedTokenError))) {
                     return (yield authCall(report, [
                         {
                             state: "auth_required",
@@ -3008,7 +3021,9 @@ export function remoteMcp(id, opts) {
                 return failureStatus(id, err);
             }
         })),
-        finishAuth: authMethod((code, ctx, callbackParams) => authView(ctx, authMethod((signal) => authFlow(function* () {
+    };
+    if (isOauth) {
+        connector.finishAuth = authMethod((code, ctx, callbackParams) => authView(ctx, authMethod((signal) => authFlow(function* () {
             const state = stateFor(ctx);
             const provider = newProvider(ctx, state);
             const consent = callbackParams?.get("state") ?? null;
@@ -3041,9 +3056,7 @@ export function remoteMcp(id, opts) {
             finally {
                 detach(closeConnection(null, t, ctx.logger));
             }
-        })), true)),
-    };
-    if (opts.auth?.type === "oauth") {
+        })), true));
         connector.verifyState = authMethod((oauthState, ctx) => authFlow(function* () {
             const state = stateFor(ctx);
             return (yield authInvoke(newProvider(ctx, state), "verifyState", [oauthState]));
@@ -3090,18 +3103,27 @@ export function remoteMcp(id, opts) {
             if (ctx.signal?.aborted)
                 throw ctx.signal.reason;
             try {
+                // A passive call's refusal stays latched for status and calls. A
+                // successful connection with no tokens still permits explicit
+                // consent, bound to that connection rather than the live grant.
+                if (state.authRequired && state.client) {
+                    const provider = connectedProviders.get(state.client);
+                    if (!(yield authCall(granted, [provider])))
+                        return (yield authCall(startUnchallenged, [ctx, provider]));
+                }
                 // The handshake runs first, so a 401 challenge's
                 // `resource_metadata` starts consent as it always has.
-                (yield authCall(ensureConnected, [ctx, state]));
-                if (!(yield authCall(granted, [ctx])))
-                    return (yield authCall(startUnchallenged, [ctx]));
+                const client = (yield authCall(ensureConnected, [ctx, state]));
+                const provider = connectedProviders.get(client);
+                if (!(yield authCall(granted, [provider])))
+                    return (yield authCall(startUnchallenged, [ctx, provider]));
                 return {
                     state: "ok",
                     message: "Already authorized \u2014 connection is healthy.",
                 };
             }
             catch (err) {
-                if (state.authRequired) {
+                if (state.authRequired && requiresAuthorization(err)) {
                     let authorizationUrl;
                     try {
                         authorizationUrl = (yield state.attemptProvider
@@ -3131,7 +3153,7 @@ export function remoteMcp(id, opts) {
         }
     }));
     const withActiveSecrets = authMethod((ctx, run, redactResult = true, preserveInput = false) => authFlow(function* () {
-        trackCredentialReads(ctx);
+        wrapViewCredentials(ctx);
         const secrets = sentSecretsFor(ctx);
         if (opts.auth?.type === "headers") {
             for (const value of Object.values(opts.auth.headers))
@@ -3272,5 +3294,7 @@ export function remoteMcp(id, opts) {
         })), 0), 0));
     if (isOauth)
         withStoredAuth(connector, (ctx) => newProvider(ctx).storedAuthorization());
+    if (principalPolicy)
+        tagPrincipalForwarding(connector);
     return connector;
 }

package/dist/connectors/resource-uri.js

@@ -26,10 +26,6 @@ export function resourceUriMatchesTemplates(uri, templates, note = () => { }) {
     }
     return matched ? { matched } : { matched, ...(refusal ? { refusal } : {}) };
 }
-export function resourceUriMatchesTemplate(uri, template) {
-    const parsed = parse(template);
-    return typeof parsed === "object" && matches(uri, parsed);
-}
 function parse(template) {
     if (template.length > MAX_URI_LENGTH)
         return;

package/dist/credentials.js

@@ -1,3 +1,4 @@
+import { advanceCatalogRevision } from "./catalog-revision.js";
 import { deriveOAuthHandoffKey, deriveRequestStateKey } from "./oauth-sealing.js";
 import { credentialKeys } from "./storage/keys.js";
 const KEY_BYTES = 32;
@@ -201,10 +202,12 @@ export class CredentialVault {
             ciphertext: bytesToBase64(new Uint8Array(ciphertext)),
         };
         await this.storage.set(storageKey(connectorId, owner), JSON.stringify(envelope));
+        advanceCatalogRevision(this);
         return (await this.metadata(connectorId, owner));
     }
     async delete(connectorId, owner) {
         await this.storage.delete(storageKey(connectorId, owner));
+        advanceCatalogRevision(this);
     }
     /** Encrypt downstream OAuth state under the vault key; nothing is stored. */
     async seal(connectorId, purpose, plaintext, owner) {