@zackbart/connecta 0.38.0 → 0.40.0

package/dist/catalog-cache.js

@@ -1,19 +1,43 @@
 import { detach, runEdge } from "./runtime/run.js";
 import { Deferred, Effect } from "effect";
-import { authFlow, authCall, authInvoke, authValue, authMethod, authProgram, registerAuth, authStorage, authMap, authAwait, } from "./auth/native.js";
+import { authFlow, authCall, authInvoke, authValue, authMethod, authProgram, registerAuth, authStorage, authStorageMany, authMap, authAwait, } from "./auth/native.js";
 import { MAX_CACHE_TTL_MS, specTypeSchemas } from "@modelcontextprotocol/client";
 import { advanceCatalogRevision, catalogRevision } from "./catalog-revision.js";
 import { callerOf } from "./connector-caller.js";
 import { CONFIG_DEFAULTS } from "./config-defaults.js";
 import { Context } from "effect";
-import { RequestScope } from "./runtime/request-scope.js";
+import { ownerReads, RequestScope } from "./runtime/request-scope.js";
 import { serviceFor, setViewService, viewServices } from "./runtime/call.js";
 import { ConnectorCallError } from "./errors.js";
 import { fingerprintSerializedCatalog } from "./catalog-fingerprint.js";
 import { MAX_CATALOG_CHUNK_BYTES, MAX_CATALOG_TOOLS, MAX_SERIALIZED_CATALOG_BYTES } from "./catalog-limits.js";
 import { redactCatalog, sentSecretsForRequest } from "./sent-secrets.js";
 import { failureRecord, logFailure } from "./operator-record.js";
+import { secretDigest } from "./storage-digest.js";
 import { responseCacheKeys } from "./storage/keys.js";
+import { CatalogPolicy } from "./catalog-policy.js";
+/**
+ * An unchanged refresh leaves a baseline younger than this in place instead of
+ * rewriting it, so a baseline outlives every refresh by at least the baseline
+ * TTL minus this interval.
+ */
+const BASELINE_REWRITE_AGE_MS = 60 * 60 * 1000;
+const refreshHash = (v) => typeof v === "string" && /^sha256:[0-9]+:[0-9a-f]{64}$/.test(v);
+function refreshManifest(raw) {
+    if (!raw)
+        return;
+    try {
+        const value = JSON.parse(raw);
+        if (refreshHash(value.digest) &&
+            refreshHash(value.fingerprint) &&
+            /^[0-9a-f-]{36}$/.test(value.revision) &&
+            Number.isInteger(value.chunkCount) &&
+            value.chunkCount >= 1 &&
+            value.chunkCount <= Math.ceil(MAX_SERIALIZED_CATALOG_BYTES / MAX_CATALOG_CHUNK_BYTES))
+            return value;
+    }
+    catch { }
+}
 /** Publish one accepted catalog refresh, with its partitioned drift baseline. */
 export function observeCompletedCatalogRefresh(ctx, refresh) {
     return runEdge(authProgram(observeCompletedCatalogRefreshNative, [ctx, refresh]));
@@ -41,18 +65,10 @@ function refreshBaseline(storage, key, raw, io) {
     return runEdge(authProgram(refreshBaselineNative, [storage, key, raw, io]));
 }
 const refreshBaselineNative = /* @__PURE__ */ registerAuth(refreshBaseline, (storage, key, raw, io) => authFlow(function* () {
-    if (!raw)
+    const value = refreshManifest(raw);
+    if (!value)
         return;
     try {
-        const value = JSON.parse(raw);
-        const hash = (v) => typeof v === "string" && /^sha256:[0-9]+:[0-9a-f]{64}$/.test(v);
-        if (!hash(value.digest) ||
-            !hash(value.fingerprint) ||
-            !/^[0-9a-f-]{36}$/.test(value.revision) ||
-            !Number.isInteger(value.chunkCount) ||
-            value.chunkCount < 1 ||
-            value.chunkCount > Math.ceil(MAX_SERIALIZED_CATALOG_BYTES / MAX_CATALOG_CHUNK_BYTES))
-            return;
         const chunks = [];
         for (let index = 0; index < value.chunkCount; index++) {
             const chunk = (yield authCall(io, [
@@ -68,7 +84,7 @@ const refreshBaselineNative = /* @__PURE__ */ registerAuth(refreshBaseline, (sto
         const tools = JSON.parse(serialized);
         if (Array.isArray(tools) &&
             tools.length <= MAX_CATALOG_TOOLS &&
-            tools.every((tool) => tool && hash(tool.name) && hash(tool.fact)))
+            tools.every((tool) => tool && refreshHash(tool.name) && refreshHash(tool.fact)))
             return { digest: value.digest, tools };
     }
     catch { }
@@ -86,6 +102,18 @@ function acceptCatalogRefresh(storage, key, connectorId, digest, tools, privateC
     ]));
 }
 const acceptCatalogRefreshNative = /* @__PURE__ */ registerAuth(acceptCatalogRefresh, (storage, key, connectorId, digest, tools, privateCatalog, current, io) => authFlow(function* () {
+    // An identical catalog cannot drift, and its baseline, written within
+    // the last hour, needs no rewrite: such a refresh writes nothing. The
+    // stored chunks always outlive their manifest, since a manifest is only
+    // ever written with fresh chunks.
+    const stored = (yield authCall(io, [
+        authMethod(() => authStorage(storage, "get", [key])),
+    ]));
+    const baseline = refreshManifest(stored);
+    if (baseline?.digest === digest &&
+        baseline.writtenAt !== undefined &&
+        Date.now() - baseline.writtenAt < BASELINE_REWRITE_AGE_MS)
+        return;
     const next = (yield authCall(catalogFingerprints, [tools]));
     const serialized = JSON.stringify(next);
     const revision = crypto.randomUUID();
@@ -103,13 +131,17 @@ const acceptCatalogRefreshNative = /* @__PURE__ */ registerAuth(acceptCatalogRef
             ])),
         ]));
     }
-    const manifest = { digest, revision, chunkCount, fingerprint };
+    const manifest = { digest, revision, chunkCount, fingerprint, writtenAt: Date.now() };
     for (let attempt = 0; attempt < 16; attempt++) {
         if (!(yield authCall(current, [])))
             return;
-        const raw = (yield authCall(io, [
-            authMethod(() => authStorage(storage, "get", [key])),
-        ]));
+        // The first attempt publishes against the manifest read above; a lost
+        // compare-and-set reads it again.
+        const raw = attempt === 0
+            ? stored
+            : (yield authCall(io, [
+                authMethod(() => authStorage(storage, "get", [key])),
+            ]));
         const previous = (yield authCall(refreshBaseline, [storage, key, raw, io]));
         if (!(yield authCall(current, [])))
             return;
@@ -204,8 +236,8 @@ export function observeCatalogExpiry(ctx, method, ttlMs, expiresAt, staleFallbac
 // failure for five minutes. Resources never use stale inventories. A fallback
 // carries its original expired deadline and cannot authorize auth recovery.
 const STALE_FALLBACK_MS = 300_000;
-class CatalogPolicy extends Context.Service()("connecta/operation/CatalogPolicy") {
-}
+/** Catalog chunks one storage read fetches together. */
+const CHUNKS_PER_READ = 8;
 export function attachCatalogCache(ctx, value) {
     setViewService(ctx, CatalogPolicy, value);
 }
@@ -380,8 +412,42 @@ const invalidateCatalogCacheNative = /* @__PURE__ */ registerAuth(invalidateCata
         advanceCatalogRevision(storage);
     }
 }));
+// Only detached JSON facts cross requests: no context, storage, promises or
+// callbacks. FIFO bounds retained partitions, JSON/key text (UTF-16 worst
+// case) and structural slots. No WeakRef or timers required.
+const catalogStores = new WeakMap();
+const validatedCatalogs = new Map();
+let validatedBytes = 0;
+const VALIDATED_BYTES = 8 * 1024 * 1024;
+function rememberValidated(key, value, bytes) {
+    bytes = bytes * 2 + key.length * 2;
+    if (bytes > VALIDATED_BYTES || validatedCatalogs.has(key))
+        return;
+    const pending = [value];
+    while (pending.length) {
+        const item = pending.pop();
+        if (!item || typeof item !== "object" || Object.isFrozen(item))
+            continue;
+        Object.freeze(item);
+        for (const child of Object.values(item)) {
+            // Charge structural overhead too: tiny JSON objects/arrays can occupy
+            // much more heap than their serialized bytes alone suggest.
+            bytes += 64;
+            if (bytes > VALIDATED_BYTES)
+                return;
+            pending.push(child);
+        }
+    }
+    while (validatedCatalogs.size >= 4 || validatedBytes + bytes > VALIDATED_BYTES) {
+        const oldest = validatedCatalogs.keys().next().value;
+        validatedBytes -= validatedCatalogs.get(oldest).bytes;
+        validatedCatalogs.delete(oldest);
+    }
+    validatedCatalogs.set(key, { value, bytes });
+    validatedBytes += bytes;
+}
 /** Keys ignore self-reported serverInfo and bind the configured connector instead. */
-export function catalogClientOptions(ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity) {
+export function catalogClientOptions(ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity, connectionless = false) {
     return runEdge(authProgram(catalogClientOptionsNative, [
         ctx,
         connectorId,
@@ -391,10 +457,20 @@ export function catalogClientOptions(ctx, connectorId, config, authPartition, co
         owner,
         sharing,
         resolveCredentialIdentity,
+        connectionless,
     ]));
 }
-const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOptions, (ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity) => authFlow(function* () {
+const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOptions, (ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity, connectionless = false) => authFlow(function* () {
     const request = Context.get(viewServices(ctx), RequestScope);
+    // Generation reads that only locate an entry are memoized for this
+    // request; every acceptance or publication check reads it fresh. A
+    // generation is never reused once replaced, so a stale one only
+    // addresses an entry that the fresh check then refuses.
+    const reads = ownerReads(request);
+    const generationRead = (memoized) => {
+        const key = responseCacheKeys.generation(connectorId);
+        return reads.read(storage, key, authStorage(storage, "get", [key]), !memoized);
+    };
     // SDK callbacks start at their own Promise edge. Reprovide only their
     // canonical request owner, never the initiating call's live services.
     const cacheMethod = (program) => authMethod((...args) => program(...args).pipe(Effect.provideService(RequestScope, request)));
@@ -411,6 +487,9 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
         authPartition,
     ]);
     const storage = policy?.storage ?? ctx.storage;
+    let storeIdentity = catalogStores.get(storage);
+    if (!storeIdentity)
+        catalogStores.set(storage, (storeIdentity = crypto.randomUUID()));
     const configHash = (yield authCall(fingerprintSerializedCatalog, [
         JSON.stringify([
             config,
@@ -443,18 +522,21 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
     };
     let lastStamp = 0;
     let staleTools;
-    const currentGeneration = cacheMethod(({ stopped, io, generation }) => authFlow(function* () {
+    const currentGeneration = cacheMethod(({ stopped, io, generation }, memoized = false) => authFlow(function* () {
         const key = responseCacheKeys.generation(connectorId);
         for (let attempt = 0; attempt < 16; attempt++) {
             if (stopped())
                 return undefined;
-            const current = (yield authCall(io, [
-                cacheMethod(() => authStorage(storage, "get", [key])),
-            ]));
+            // A retry after a lost claim always reads fresh.
+            const current = (yield authCall(io, [cacheMethod(() => generationRead(memoized && attempt === 0))]));
             if (stopped())
                 return undefined;
             if (current)
                 return current;
+            // A connectionless reader never claims or recreates a generation: a
+            // missing one is a miss at every check, never a reused namespace.
+            if (connectionless)
+                return undefined;
             const next = generation.value ?? crypto.randomUUID();
             const claimed = (yield authCall(io, [
                 cacheMethod(() => authStorage(storage, "compareAndSet", [
@@ -471,12 +553,13 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
         }
         throw new Error("Catalog cache generation is busy.");
     }));
-    const namespace = cacheMethod((operation) => authFlow(function* () {
+    const namespace = cacheMethod((operation, memoized = false) => authFlow(function* () {
         const { stopped, generation, io } = operation;
-        if (resolveCredentialIdentity &&
+        if (!memoized &&
+            resolveCredentialIdentity &&
             (yield authCall(io, [resolveCredentialIdentity])) !== operation.credentialIdentity)
             return undefined;
-        const current = (yield authCall(currentGeneration, [operation]));
+        const current = (yield authCall(currentGeneration, [operation, memoized]));
         if (!current || stopped())
             return undefined;
         generation.value ??= current;
@@ -499,7 +582,10 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
             pair.length !== 2 ||
             (pair[1] !== partition && (pair[1] !== "" || sharing !== "shared")))
             return undefined;
-        const prefix = (yield authCall(namespace, [operation]));
+        // Locate with the listing's pinned identity and generation. Neither
+        // authorizes acceptance: get's post-chunk fence and set's publication
+        // re-read both, so rotation or disconnect during I/O refuses the entry.
+        const prefix = (yield authCall(namespace, [operation, true]));
         if (!prefix || stopped())
             return undefined;
         const digest = (yield authCall(fingerprintSerializedCatalog, [
@@ -593,24 +679,47 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
             const root = (yield authCall(address, [key, operation]));
             if (!root || stopped())
                 return undefined;
-            const m = manifest((yield authCall(io, [
-                cacheMethod(() => authStorage(storage, "get", [root])),
-            ])));
+            // The SDK probes private, then public. Derive both addresses from
+            // the already-bound locating generation and identity, and fetch
+            // them in one statement. The post-chunk namespace check stays fresh.
+            const listing = operation.listing;
+            if (listing && !listing.manifests?.has(root)) {
+                const slots = sharing === "shared" ? [partition, sharedPartition] : [partition];
+                const roots = [];
+                for (const slot of slots) {
+                    const { fingerprint } = (yield authCall(fingerprintSerializedCatalog, [
+                        JSON.stringify([key.method, slot, operation.credentialIdentity ?? null]),
+                    ]));
+                    roots.push(responseCacheKeys.entry(responseCacheKeys.namespace(connectorId, configHash, operation.generation.value), fingerprint));
+                }
+                const values = (yield authCall(io, [cacheMethod(() => authStorageMany(storage, roots))]));
+                listing.manifests ??= new Map();
+                roots.forEach((root, i) => listing.manifests.set(root, values[i] ?? null));
+            }
+            const m = manifest(listing?.manifests?.has(root)
+                ? listing.manifests.get(root)
+                : (yield authCall(io, [
+                    cacheMethod(() => authStorage(storage, "get", [root])),
+                ])));
             if (stopped() ||
                 !m ||
                 (m.expiresAt <= Date.now() &&
                     (key.method !== "tools/list" || m.expiresAt + STALE_FALLBACK_MS <= Date.now())))
                 return undefined;
+            // Up to CHUNKS_PER_READ chunks per round trip, so one answer stays a
+            // few megabytes; the generation fence below still decides whether
+            // what was read may be served.
             const chunks = [];
-            for (let i = 0; i < m.chunkCount; i++) {
+            for (let first = 0; first < m.chunkCount; first += CHUNKS_PER_READ) {
                 if (stopped())
                     return undefined;
-                const chunk = (yield authCall(io, [
-                    cacheMethod(() => authStorage(storage, "get", [responseCacheKeys.chunk(root, m.revision, i)])),
-                ]));
-                if (stopped() || chunk === null || new TextEncoder().encode(chunk).byteLength > MAX_CATALOG_CHUNK_BYTES)
-                    return undefined;
-                chunks.push(chunk);
+                const keys = Array.from({ length: Math.min(CHUNKS_PER_READ, m.chunkCount - first) }, (_, i) => responseCacheKeys.chunk(root, m.revision, first + i));
+                const read = (yield authCall(io, [cacheMethod(() => authStorageMany(storage, keys))]));
+                for (const chunk of read) {
+                    if (stopped() || chunk === null || new TextEncoder().encode(chunk).byteLength > MAX_CATALOG_CHUNK_BYTES)
+                        return undefined;
+                    chunks.push(chunk);
+                }
             }
             const value = chunks.join("");
             const fingerprint = (yield authCall(fingerprintSerializedCatalog, [value]));
@@ -620,18 +729,29 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
                 !(yield authCall(namespace, [operation])) ||
                 stopped())
                 return undefined;
-            const result = JSON.parse(value);
             const method = key.method;
-            const items = catalogItems(method, result);
-            if (!Array.isArray(items) ||
-                items.length > MAX_CATALOG_TOOLS ||
-                "nextCursor" in result ||
-                (result.resultType !== undefined && result.resultType !== "complete"))
-                return undefined;
-            const validated = (yield authInvoke(catalogSchema(method)["~standard"], "validate", [result]));
-            if (stopped() || validated.issues)
-                return undefined;
-            const clean = intake(ctx, method, validated.value);
+            // root binds connector/config/generation/scope/credential; partition
+            // also binds the current owner/deployment even for public entries.
+            // Hash the chunks again above, never trust the manifest alone.
+            const reuseKey = JSON.stringify([storeIdentity, root, partition, m.fingerprint]);
+            let accepted = validatedCatalogs.get(reuseKey)?.value;
+            if (!accepted) {
+                const result = JSON.parse(value);
+                const items = catalogItems(method, result);
+                if (!Array.isArray(items) ||
+                    items.length > MAX_CATALOG_TOOLS ||
+                    "nextCursor" in result ||
+                    (result.resultType !== undefined && result.resultType !== "complete"))
+                    return undefined;
+                const validated = (yield authInvoke(catalogSchema(method)["~standard"], "validate", [result]));
+                if (stopped() || validated.issues)
+                    return undefined;
+                accepted = validated.value;
+            }
+            // Redaction depends on this request's sent credentials. It must
+            // still run, and returns detached objects from the frozen facts.
+            const clean = intake(ctx, method, accepted);
+            rememberValidated(reuseKey, accepted, fingerprint.byteLength);
             if (m.expiresAt <= Date.now()) {
                 if (method === "tools/list" && (!staleTools || staleTools.manifest.fetchedAt < m.fetchedAt))
                     staleTools = { result: clean, manifest: m };
@@ -647,6 +767,7 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
             const root = (yield authCall(address, [key, operation]));
             if (!root || stopped())
                 return 0;
+            operation.listing?.manifests?.delete(root);
             const result = JSON.parse(entry.value);
             const method = key.method;
             if (catalogTtlMs(ctx, result.ttlMs) === 0) {
@@ -733,10 +854,12 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
         delete: cacheMethod((key) => authFlow(function* () {
             const operation = capture();
             const root = (yield authCall(address, [key, operation]));
-            if (root && !operation.stopped())
+            if (root && !operation.stopped()) {
+                operation.listing?.manifests?.delete(root);
                 (yield authInvoke(operation, "io", [
                     cacheMethod(() => authStorage(storage, "delete", [root])),
                 ]));
+            }
         })),
         evict: cacheMethod((method) => authFlow(function* () {
             if (isCatalogMethod(method))
@@ -752,10 +875,11 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
     };
     try {
         const { stopped, io } = capture({ ctx, generation: connectionGeneration, ended: false });
-        if (!stopped()) {
-            const current = (yield authCall(io, [
-                cacheMethod(() => authStorage(storage, "get", [responseCacheKeys.generation(connectorId)])),
-            ]));
+        // A connectionless reader only lists, and each listing reads its own
+        // generation; there are no connection-owned writes to fence.
+        if (!connectionless && !stopped()) {
+            // Memoized: a connection's writes publish only after a fresh check.
+            const current = (yield authCall(io, [cacheMethod(() => generationRead(true))]));
             if (!stopped())
                 connectionGeneration.value = current ?? crypto.randomUUID();
         }
@@ -792,9 +916,13 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
                     listing.credentialIdentity = yield authInvoke(operation, "io", [resolveCredentialIdentity]);
                 if (!operation.stopped()) {
                     try {
-                        const generation = (yield authInvoke(operation, "io", [
-                            cacheMethod(() => authStorage(storage, "get", [responseCacheKeys.generation(connectorId)])),
-                        ])) ?? crypto.randomUUID();
+                        // Memoized: it locates the listing's entries, which the
+                        // fresh fence in get accepts or refuses.
+                        const stored = (yield authInvoke(operation, "io", [
+                            cacheMethod(() => generationRead(true)),
+                        ]));
+                        const generation = stored ?? crypto.randomUUID();
+                        listing.generationStored = stored !== null;
                         listing.generation.value = generation;
                         connectionGeneration.value = generation;
                     }
@@ -820,6 +948,34 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
                 void previous.then(release);
         }
     }));
+    // A complete, unexpired tools/list entry, read before any connection
+    // exists. This is the SDK's own two-probe read: the private slot
+    // `[serverIdentity, cachePartition]`, then a shared connector's public
+    // slot `[serverIdentity, ""]`, served only when written as public.
+    // `address` binds the configured connector rather than the self-reported
+    // identity, so the pre-connect `""` identity selects the same entries.
+    // Expired, partial, refused (`ttlMs: 0`) and invalidated entries miss,
+    // and the read writes nothing.
+    const cachedTools = cacheMethod((listingCtx) => authCall(withListing, [
+        listingCtx,
+        cacheMethod(() => authFlow(function* () {
+            // No stored generation means no entry, and claiming one is a write.
+            if (!active?.generationStored)
+                return undefined;
+            const read = (slot) => authInvoke(store, "get", [
+                { method: "tools/list", params: "", partition: JSON.stringify(["", slot]) },
+            ]);
+            let entry = (yield read(partition));
+            if (entry === undefined && sharing === "shared") {
+                const shared = (yield read(""));
+                entry = shared?.scope === "public" ? shared : undefined;
+            }
+            if (entry?.expiresAt === undefined || !(entry.expiresAt > Date.now()))
+                return undefined;
+            const result = JSON.parse(entry.value);
+            return Array.isArray(result.tools) ? result : undefined;
+        })),
+    ]));
     const fallbackTools = cacheMethod(() => authFlow(function* () {
         const operation = capture();
         if (!staleTools ||
@@ -837,6 +993,7 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
         intake,
         completeCatalogRefresh,
         fallbackTools,
+        cachedTools,
         responseCacheStore: store,
         cachePartition: partition,
         defaultCacheTtlMs: policy?.defaultTtlMs ?? CONFIG_DEFAULTS.discovery.catalogTtlSeconds * 1000,
@@ -855,7 +1012,10 @@ function customCatalogCache(ctx, connectorId) {
 }
 const customCatalogCacheNative = /* @__PURE__ */ registerAuth(customCatalogCache, (ctx, connectorId) => authFlow(function* () {
     const credential = (yield authValue(() => ctx.credential?.getAll()));
-    const auth = (yield authCall(fingerprintSerializedCatalog, [JSON.stringify(credential ?? null)])).fingerprint;
+    // Credential values enter the stored partition only through a keyed digest.
+    const auth = credential == null
+        ? (yield authCall(fingerprintSerializedCatalog, ["null"])).fingerprint
+        : (yield authCall(secretDigest, [ctx, JSON.stringify(credential)]));
     const cache = (yield authCall(catalogClientOptions, [ctx, connectorId, "custom-connector", auth]));
     const key = {
         method: "tools/list",

package/dist/catalog-policy.js

@@ -0,0 +1,18 @@
+// The catalog cache's per-view policy: its store, owner partition and TTL
+// bounds, attached to each connector context by the registry. Kept apart from
+// the cache itself so bounded facts stored beside it (connector health, the
+// operator page's status observations) reach the partition without the MCP
+// client the cache adapter imports.
+import { Context } from "effect";
+import { callerOf } from "./connector-caller.js";
+import { serviceFor } from "./runtime/call.js";
+export class CatalogPolicy extends Context.Service()("connecta/operation/CatalogPolicy") {
+}
+/** The store and owner partition this connector's catalog cache uses, for bounded facts kept beside it. */
+export function catalogOwnerPartition(ctx) {
+    const policy = serviceFor(ctx, CatalogPolicy);
+    return {
+        storage: policy?.storage ?? ctx.storage,
+        partition: JSON.stringify([policy?.partition ?? JSON.stringify(callerOf(ctx) ?? null), ctx.baseUrl, ctx.publicUrl]),
+    };
+}