@zackbart/connecta 0.37.1 → 0.39.0

package/dist/branding.d.ts

@@ -1,7 +1,7 @@
 import type { ConnectaBranding, ConnectaTheme, UiAuthConfig } from "./types.js";
 /** Connecta's default monochrome "C" mark. */
 export declare const CONNECTA_FAVICON_SVG = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 32 32\">\n  <style>\n    .fg { fill: #000 }\n    @media (prefers-color-scheme: dark) { .fg { fill: #fff } }\n  </style>\n  <path class=\"fg\" d=\"M27 9.4A13 13 0 1 0 27 22.6l-4.4-2.5a8 8 0 1 1 0-8.2z\"/>\n</svg>";
-export interface ResolvedTheme {
+interface ResolvedTheme {
     accent?: string;
     radius?: string;
     fontFamily?: string;
@@ -28,26 +28,12 @@ interface ResolvedBranding {
     theme: ResolvedTheme;
 }
 export declare function resolveBranding(branding?: ConnectaBranding): ResolvedBranding;
-/**
- * Read a theme the way branding URLs are read: gate every field, drop what
- * fails, never throw. This runs during `createConnecta`, so a malformed value
- * has to fall back to the stylesheet default instead of refusing to serve the
- * page. `droppedThemeTokens` names the drops for the startup warning.
- */
-export declare function resolveTheme(theme?: ConnectaTheme): ResolvedTheme;
 /**
  * Names of the theme tokens the operator set that failed their gate. Same
  * contract as `droppedBrandingUrls`: rendering falls back silently, so this is
  * the only place an operator learns their value never reached the page.
  */
 export declare function droppedThemeTokens(theme?: ConnectaTheme): string[];
-/**
- * The resolved theme as a `:root` block, or "" when a deployment configured
- * nothing. It is emitted after the stylesheet so it overrides the defaults.
- * There is no escaping here: every value has already passed a gate above, and
- * anything that would need escaping is dropped rather than rewritten.
- */
-export declare function themeCss(theme: ResolvedTheme): string;
 /** Text or attribute value, escaped for any position in an HTML document. */
 export declare function escapeHtml(value: string): string;
 export interface PageLayout {

package/dist/branding.js

@@ -71,7 +71,7 @@ const COLOR_SCHEMES = ["system", "light", "dark"];
  * has to fall back to the stylesheet default instead of refusing to serve the
  * page. `droppedThemeTokens` names the drops for the startup warning.
  */
-export function resolveTheme(theme) {
+function resolveTheme(theme) {
     const accent = trimmedString(theme?.accent);
     const fontFamily = trimmedString(theme?.fontFamily);
     const monoFamily = trimmedString(theme?.monoFamily);
@@ -175,7 +175,7 @@ function accentTokens(accent) {
  * There is no escaping here: every value has already passed a gate above, and
  * anything that would need escaping is dropped rather than rewritten.
  */
-export function themeCss(theme) {
+function themeCss(theme) {
     const derived = theme.accent ? accentTokens(theme.accent) : undefined;
     const declarations = [
         theme.accent ? `--accent:${theme.accent}` : "",

package/dist/bytes.js

@@ -0,0 +1,42 @@
+/** Lowercase hexadecimal, preserving each byte's leading zero. */
+export function bytesToHex(bytes) {
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+export async function sha256Hex(value) {
+    return bytesToHex(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))));
+}
+/** UTF-8 byte count without allocating encoded bytes; stops once the limit is exceeded. */
+export function utf8Length(value, limit = Infinity) {
+    let bytes = 0;
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 0x80)
+            bytes++;
+        else if (code < 0x800)
+            bytes += 2;
+        else if (code >= 0xd800 &&
+            code <= 0xdbff &&
+            value.charCodeAt(i + 1) >= 0xdc00 &&
+            value.charCodeAt(i + 1) <= 0xdfff) {
+            bytes += 4;
+            i++;
+        }
+        else
+            bytes += 3;
+        if (bytes > limit)
+            return bytes;
+    }
+    return bytes;
+}
+export function decodeBase64(value) {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1)
+        bytes[index] = binary.charCodeAt(index);
+    return bytes;
+}
+/** Optional padding preserves callers that pad before handing input to atob. */
+export function decodeBase64url(value, pad = false) {
+    const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+    return decodeBase64(pad ? base64 + "=".repeat((4 - (base64.length % 4)) % 4) : base64);
+}

package/dist/call-admission-context.js

@@ -1,8 +1,5 @@
-import { Budget, callScopeKnown, chargeView, recordedService, setViewService } from "./runtime/call.js";
-import { chargeCallBudget } from "./runtime/call-admission.js";
-export function attachCallAdmission(ctx, permit) {
-    setViewService(ctx, Budget, { charge: chargeCallBudget(permit, ctx.signal) });
-}
+// The Promise view of the call's admission service; authority stays internal.
+import { Budget, callScopeKnown, chargeView, recordedService } from "./runtime/call.js";
 export function chargeConnectorCall(ctx) {
     return recordedService(ctx, Budget) || callScopeKnown(ctx) ? chargeView(ctx) : Promise.resolve();
 }

package/dist/call-recovery.js

@@ -43,6 +43,3 @@ export function recordRecovery(ctx, facts) {
         recordFor(ctx);
     serviceFor(ctx, Recovery)?.recordNow?.(facts);
 }
-export function recoveryFor(ctx) {
-    return ctx ? serviceFor(ctx, RecordedRecovery)?.facts : undefined;
-}

package/dist/catalog-cache.js

@@ -1,19 +1,43 @@
 import { detach, runEdge } from "./runtime/run.js";
 import { Deferred, Effect } from "effect";
-import { authFlow, authCall, authInvoke, authValue, authMethod, authProgram, registerAuth, authStorage, authMap, authAwait, } from "./auth/native.js";
+import { authFlow, authCall, authInvoke, authValue, authMethod, authProgram, registerAuth, authStorage, authStorageMany, authMap, authAwait, } from "./auth/native.js";
 import { MAX_CACHE_TTL_MS, specTypeSchemas } from "@modelcontextprotocol/client";
 import { advanceCatalogRevision, catalogRevision } from "./catalog-revision.js";
 import { callerOf } from "./connector-caller.js";
 import { CONFIG_DEFAULTS } from "./config-defaults.js";
 import { Context } from "effect";
-import { RequestScope } from "./runtime/request-scope.js";
+import { ownerReads, RequestScope } from "./runtime/request-scope.js";
 import { serviceFor, setViewService, viewServices } from "./runtime/call.js";
 import { ConnectorCallError } from "./errors.js";
 import { fingerprintSerializedCatalog } from "./catalog-fingerprint.js";
 import { MAX_CATALOG_CHUNK_BYTES, MAX_CATALOG_TOOLS, MAX_SERIALIZED_CATALOG_BYTES } from "./catalog-limits.js";
 import { redactCatalog, sentSecretsForRequest } from "./sent-secrets.js";
 import { failureRecord, logFailure } from "./operator-record.js";
+import { secretDigest } from "./storage-digest.js";
 import { responseCacheKeys } from "./storage/keys.js";
+import { CatalogPolicy } from "./catalog-policy.js";
+/**
+ * An unchanged refresh leaves a baseline younger than this in place instead of
+ * rewriting it, so a baseline outlives every refresh by at least the baseline
+ * TTL minus this interval.
+ */
+const BASELINE_REWRITE_AGE_MS = 60 * 60 * 1000;
+const refreshHash = (v) => typeof v === "string" && /^sha256:[0-9]+:[0-9a-f]{64}$/.test(v);
+function refreshManifest(raw) {
+    if (!raw)
+        return;
+    try {
+        const value = JSON.parse(raw);
+        if (refreshHash(value.digest) &&
+            refreshHash(value.fingerprint) &&
+            /^[0-9a-f-]{36}$/.test(value.revision) &&
+            Number.isInteger(value.chunkCount) &&
+            value.chunkCount >= 1 &&
+            value.chunkCount <= Math.ceil(MAX_SERIALIZED_CATALOG_BYTES / MAX_CATALOG_CHUNK_BYTES))
+            return value;
+    }
+    catch { }
+}
 /** Publish one accepted catalog refresh, with its partitioned drift baseline. */
 export function observeCompletedCatalogRefresh(ctx, refresh) {
     return runEdge(authProgram(observeCompletedCatalogRefreshNative, [ctx, refresh]));
@@ -41,18 +65,10 @@ function refreshBaseline(storage, key, raw, io) {
     return runEdge(authProgram(refreshBaselineNative, [storage, key, raw, io]));
 }
 const refreshBaselineNative = /* @__PURE__ */ registerAuth(refreshBaseline, (storage, key, raw, io) => authFlow(function* () {
-    if (!raw)
+    const value = refreshManifest(raw);
+    if (!value)
         return;
     try {
-        const value = JSON.parse(raw);
-        const hash = (v) => typeof v === "string" && /^sha256:[0-9]+:[0-9a-f]{64}$/.test(v);
-        if (!hash(value.digest) ||
-            !hash(value.fingerprint) ||
-            !/^[0-9a-f-]{36}$/.test(value.revision) ||
-            !Number.isInteger(value.chunkCount) ||
-            value.chunkCount < 1 ||
-            value.chunkCount > Math.ceil(MAX_SERIALIZED_CATALOG_BYTES / MAX_CATALOG_CHUNK_BYTES))
-            return;
         const chunks = [];
         for (let index = 0; index < value.chunkCount; index++) {
             const chunk = (yield authCall(io, [
@@ -68,7 +84,7 @@ const refreshBaselineNative = /* @__PURE__ */ registerAuth(refreshBaseline, (sto
         const tools = JSON.parse(serialized);
         if (Array.isArray(tools) &&
             tools.length <= MAX_CATALOG_TOOLS &&
-            tools.every((tool) => tool && hash(tool.name) && hash(tool.fact)))
+            tools.every((tool) => tool && refreshHash(tool.name) && refreshHash(tool.fact)))
             return { digest: value.digest, tools };
     }
     catch { }
@@ -86,6 +102,18 @@ function acceptCatalogRefresh(storage, key, connectorId, digest, tools, privateC
     ]));
 }
 const acceptCatalogRefreshNative = /* @__PURE__ */ registerAuth(acceptCatalogRefresh, (storage, key, connectorId, digest, tools, privateCatalog, current, io) => authFlow(function* () {
+    // An identical catalog cannot drift, and its baseline, written within
+    // the last hour, needs no rewrite: such a refresh writes nothing. The
+    // stored chunks always outlive their manifest, since a manifest is only
+    // ever written with fresh chunks.
+    const stored = (yield authCall(io, [
+        authMethod(() => authStorage(storage, "get", [key])),
+    ]));
+    const baseline = refreshManifest(stored);
+    if (baseline?.digest === digest &&
+        baseline.writtenAt !== undefined &&
+        Date.now() - baseline.writtenAt < BASELINE_REWRITE_AGE_MS)
+        return;
     const next = (yield authCall(catalogFingerprints, [tools]));
     const serialized = JSON.stringify(next);
     const revision = crypto.randomUUID();
@@ -103,13 +131,17 @@ const acceptCatalogRefreshNative = /* @__PURE__ */ registerAuth(acceptCatalogRef
             ])),
         ]));
     }
-    const manifest = { digest, revision, chunkCount, fingerprint };
+    const manifest = { digest, revision, chunkCount, fingerprint, writtenAt: Date.now() };
     for (let attempt = 0; attempt < 16; attempt++) {
         if (!(yield authCall(current, [])))
             return;
-        const raw = (yield authCall(io, [
-            authMethod(() => authStorage(storage, "get", [key])),
-        ]));
+        // The first attempt publishes against the manifest read above; a lost
+        // compare-and-set reads it again.
+        const raw = attempt === 0
+            ? stored
+            : (yield authCall(io, [
+                authMethod(() => authStorage(storage, "get", [key])),
+            ]));
         const previous = (yield authCall(refreshBaseline, [storage, key, raw, io]));
         if (!(yield authCall(current, [])))
             return;
@@ -204,8 +236,8 @@ export function observeCatalogExpiry(ctx, method, ttlMs, expiresAt, staleFallbac
 // failure for five minutes. Resources never use stale inventories. A fallback
 // carries its original expired deadline and cannot authorize auth recovery.
 const STALE_FALLBACK_MS = 300_000;
-class CatalogPolicy extends Context.Service()("connecta/operation/CatalogPolicy") {
-}
+/** Catalog chunks one storage read fetches together. */
+const CHUNKS_PER_READ = 8;
 export function attachCatalogCache(ctx, value) {
     setViewService(ctx, CatalogPolicy, value);
 }
@@ -381,7 +413,7 @@ const invalidateCatalogCacheNative = /* @__PURE__ */ registerAuth(invalidateCata
     }
 }));
 /** Keys ignore self-reported serverInfo and bind the configured connector instead. */
-export function catalogClientOptions(ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity) {
+export function catalogClientOptions(ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity, connectionless = false) {
     return runEdge(authProgram(catalogClientOptionsNative, [
         ctx,
         connectorId,
@@ -391,10 +423,20 @@ export function catalogClientOptions(ctx, connectorId, config, authPartition, co
         owner,
         sharing,
         resolveCredentialIdentity,
+        connectionless,
     ]));
 }
-const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOptions, (ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity) => authFlow(function* () {
+const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOptions, (ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity, connectionless = false) => authFlow(function* () {
     const request = Context.get(viewServices(ctx), RequestScope);
+    // Generation reads that only locate an entry are memoized for this
+    // request; every acceptance or publication check reads it fresh. A
+    // generation is never reused once replaced, so a stale one only
+    // addresses an entry that the fresh check then refuses.
+    const reads = ownerReads(request);
+    const generationRead = (memoized) => {
+        const key = responseCacheKeys.generation(connectorId);
+        return reads.read(storage, key, authStorage(storage, "get", [key]), !memoized);
+    };
     // SDK callbacks start at their own Promise edge. Reprovide only their
     // canonical request owner, never the initiating call's live services.
     const cacheMethod = (program) => authMethod((...args) => program(...args).pipe(Effect.provideService(RequestScope, request)));
@@ -443,18 +485,21 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
     };
     let lastStamp = 0;
     let staleTools;
-    const currentGeneration = cacheMethod(({ stopped, io, generation }) => authFlow(function* () {
+    const currentGeneration = cacheMethod(({ stopped, io, generation }, memoized = false) => authFlow(function* () {
         const key = responseCacheKeys.generation(connectorId);
         for (let attempt = 0; attempt < 16; attempt++) {
             if (stopped())
                 return undefined;
-            const current = (yield authCall(io, [
-                cacheMethod(() => authStorage(storage, "get", [key])),
-            ]));
+            // A retry after a lost claim always reads fresh.
+            const current = (yield authCall(io, [cacheMethod(() => generationRead(memoized && attempt === 0))]));
             if (stopped())
                 return undefined;
             if (current)
                 return current;
+            // A connectionless reader never claims or recreates a generation: a
+            // missing one is a miss at every check, never a reused namespace.
+            if (connectionless)
+                return undefined;
             const next = generation.value ?? crypto.randomUUID();
             const claimed = (yield authCall(io, [
                 cacheMethod(() => authStorage(storage, "compareAndSet", [
@@ -471,12 +516,12 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
         }
         throw new Error("Catalog cache generation is busy.");
     }));
-    const namespace = cacheMethod((operation) => authFlow(function* () {
+    const namespace = cacheMethod((operation, memoized = false) => authFlow(function* () {
         const { stopped, generation, io } = operation;
         if (resolveCredentialIdentity &&
             (yield authCall(io, [resolveCredentialIdentity])) !== operation.credentialIdentity)
             return undefined;
-        const current = (yield authCall(currentGeneration, [operation]));
+        const current = (yield authCall(currentGeneration, [operation, memoized]));
         if (!current || stopped())
             return undefined;
         generation.value ??= current;
@@ -499,7 +544,8 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
             pair.length !== 2 ||
             (pair[1] !== partition && (pair[1] !== "" || sharing !== "shared")))
             return undefined;
-        const prefix = (yield authCall(namespace, [operation]));
+        // Locating only: get's fence and set's publication re-check fresh.
+        const prefix = (yield authCall(namespace, [operation, true]));
         if (!prefix || stopped())
             return undefined;
         const digest = (yield authCall(fingerprintSerializedCatalog, [
@@ -601,16 +647,20 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
                 (m.expiresAt <= Date.now() &&
                     (key.method !== "tools/list" || m.expiresAt + STALE_FALLBACK_MS <= Date.now())))
                 return undefined;
+            // Up to CHUNKS_PER_READ chunks per round trip, so one answer stays a
+            // few megabytes; the generation fence below still decides whether
+            // what was read may be served.
             const chunks = [];
-            for (let i = 0; i < m.chunkCount; i++) {
+            for (let first = 0; first < m.chunkCount; first += CHUNKS_PER_READ) {
                 if (stopped())
                     return undefined;
-                const chunk = (yield authCall(io, [
-                    cacheMethod(() => authStorage(storage, "get", [responseCacheKeys.chunk(root, m.revision, i)])),
-                ]));
-                if (stopped() || chunk === null || new TextEncoder().encode(chunk).byteLength > MAX_CATALOG_CHUNK_BYTES)
-                    return undefined;
-                chunks.push(chunk);
+                const keys = Array.from({ length: Math.min(CHUNKS_PER_READ, m.chunkCount - first) }, (_, i) => responseCacheKeys.chunk(root, m.revision, first + i));
+                const read = (yield authCall(io, [cacheMethod(() => authStorageMany(storage, keys))]));
+                for (const chunk of read) {
+                    if (stopped() || chunk === null || new TextEncoder().encode(chunk).byteLength > MAX_CATALOG_CHUNK_BYTES)
+                        return undefined;
+                    chunks.push(chunk);
+                }
             }
             const value = chunks.join("");
             const fingerprint = (yield authCall(fingerprintSerializedCatalog, [value]));
@@ -752,10 +802,11 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
     };
     try {
         const { stopped, io } = capture({ ctx, generation: connectionGeneration, ended: false });
-        if (!stopped()) {
-            const current = (yield authCall(io, [
-                cacheMethod(() => authStorage(storage, "get", [responseCacheKeys.generation(connectorId)])),
-            ]));
+        // A connectionless reader only lists, and each listing reads its own
+        // generation; there are no connection-owned writes to fence.
+        if (!connectionless && !stopped()) {
+            // Memoized: a connection's writes publish only after a fresh check.
+            const current = (yield authCall(io, [cacheMethod(() => generationRead(true))]));
             if (!stopped())
                 connectionGeneration.value = current ?? crypto.randomUUID();
         }
@@ -792,9 +843,13 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
                     listing.credentialIdentity = yield authInvoke(operation, "io", [resolveCredentialIdentity]);
                 if (!operation.stopped()) {
                     try {
-                        const generation = (yield authInvoke(operation, "io", [
-                            cacheMethod(() => authStorage(storage, "get", [responseCacheKeys.generation(connectorId)])),
-                        ])) ?? crypto.randomUUID();
+                        // Memoized: it locates the listing's entries, which the
+                        // fresh fence in get accepts or refuses.
+                        const stored = (yield authInvoke(operation, "io", [
+                            cacheMethod(() => generationRead(true)),
+                        ]));
+                        const generation = stored ?? crypto.randomUUID();
+                        listing.generationStored = stored !== null;
                         listing.generation.value = generation;
                         connectionGeneration.value = generation;
                     }
@@ -820,6 +875,34 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
                 void previous.then(release);
         }
     }));
+    // A complete, unexpired tools/list entry, read before any connection
+    // exists. This is the SDK's own two-probe read: the private slot
+    // `[serverIdentity, cachePartition]`, then a shared connector's public
+    // slot `[serverIdentity, ""]`, served only when written as public.
+    // `address` binds the configured connector rather than the self-reported
+    // identity, so the pre-connect `""` identity selects the same entries.
+    // Expired, partial, refused (`ttlMs: 0`) and invalidated entries miss,
+    // and the read writes nothing.
+    const cachedTools = cacheMethod((listingCtx) => authCall(withListing, [
+        listingCtx,
+        cacheMethod(() => authFlow(function* () {
+            // No stored generation means no entry, and claiming one is a write.
+            if (!active?.generationStored)
+                return undefined;
+            const read = (slot) => authInvoke(store, "get", [
+                { method: "tools/list", params: "", partition: JSON.stringify(["", slot]) },
+            ]);
+            let entry = (yield read(partition));
+            if (entry === undefined && sharing === "shared") {
+                const shared = (yield read(""));
+                entry = shared?.scope === "public" ? shared : undefined;
+            }
+            if (entry?.expiresAt === undefined || !(entry.expiresAt > Date.now()))
+                return undefined;
+            const result = JSON.parse(entry.value);
+            return Array.isArray(result.tools) ? result : undefined;
+        })),
+    ]));
     const fallbackTools = cacheMethod(() => authFlow(function* () {
         const operation = capture();
         if (!staleTools ||
@@ -837,6 +920,7 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
         intake,
         completeCatalogRefresh,
         fallbackTools,
+        cachedTools,
         responseCacheStore: store,
         cachePartition: partition,
         defaultCacheTtlMs: policy?.defaultTtlMs ?? CONFIG_DEFAULTS.discovery.catalogTtlSeconds * 1000,
@@ -855,7 +939,10 @@ function customCatalogCache(ctx, connectorId) {
 }
 const customCatalogCacheNative = /* @__PURE__ */ registerAuth(customCatalogCache, (ctx, connectorId) => authFlow(function* () {
     const credential = (yield authValue(() => ctx.credential?.getAll()));
-    const auth = (yield authCall(fingerprintSerializedCatalog, [JSON.stringify(credential ?? null)])).fingerprint;
+    // Credential values enter the stored partition only through a keyed digest.
+    const auth = credential == null
+        ? (yield authCall(fingerprintSerializedCatalog, ["null"])).fingerprint
+        : (yield authCall(secretDigest, [ctx, JSON.stringify(credential)]));
     const cache = (yield authCall(catalogClientOptions, [ctx, connectorId, "custom-connector", auth]));
     const key = {
         method: "tools/list",

package/dist/catalog-fingerprint.js

@@ -1,7 +1,8 @@
+import { bytesToHex } from "./bytes.js";
 const encoder = new TextEncoder();
 async function fingerprintBytes(bytes) {
     const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(bytes)));
-    const hex = [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+    const hex = bytesToHex(digest);
     return `sha256:${bytes.byteLength}:${hex}`;
 }
 /** Fingerprint an already serialized catalog without parsing/reserializing it. */
@@ -12,20 +13,3 @@ export async function fingerprintSerializedCatalog(serializedTools) {
         byteLength: bytes.byteLength,
     };
 }
-/**
- * Capture every persisted/discovered field in one deterministic snapshot.
- * Object key order is allowed to cause a conservative extra write; changing
- * any serialized field must change the digest.
- */
-export async function snapshotCatalog(tools) {
-    const serializedTools = JSON.stringify(tools);
-    if (serializedTools === undefined) {
-        throw new TypeError("Tool catalog is not JSON-serializable.");
-    }
-    const bytes = encoder.encode(serializedTools);
-    return {
-        tools,
-        fingerprint: await fingerprintBytes(bytes),
-        serializedBytes: bytes,
-    };
-}

package/dist/catalog-policy.js

@@ -0,0 +1,18 @@
+// The catalog cache's per-view policy: its store, owner partition and TTL
+// bounds, attached to each connector context by the registry. Kept apart from
+// the cache itself so bounded facts stored beside it (connector health, the
+// operator page's status observations) reach the partition without the MCP
+// client the cache adapter imports.
+import { Context } from "effect";
+import { callerOf } from "./connector-caller.js";
+import { serviceFor } from "./runtime/call.js";
+export class CatalogPolicy extends Context.Service()("connecta/operation/CatalogPolicy") {
+}
+/** The store and owner partition this connector's catalog cache uses, for bounded facts kept beside it. */
+export function catalogOwnerPartition(ctx) {
+    const policy = serviceFor(ctx, CatalogPolicy);
+    return {
+        storage: policy?.storage ?? ctx.storage,
+        partition: JSON.stringify([policy?.partition ?? JSON.stringify(callerOf(ctx) ?? null), ctx.baseUrl, ctx.publicUrl]),
+    };
+}