@zackbart/connecta 0.39.0 → 0.40.0

package/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 All notable changes to this package are documented here.
 
+## 0.40.0 — 2026-11-02
+
+This release makes warm Connecta calls on Workers cheaper in storage and closes a credential gap on OAuth remote MCP connectors. Deployments need no configuration change or migration, unless they use the Eve helper.
+
+**Eve helper:** `@zackbart/connecta-eve` now requires exactly Eve 1.0.0-rc.1. Eve 0.90 apps must upgrade Eve together with the helper and, when installed, upgrade `@vercel/connect` to `^2.7.0`. The core package and non-Eve deployments are not affected by this change.
+
+**Security:** an OAuth remote MCP connector no longer sends a passive handshake, catalog request or tool call without a credential if its tokens are removed mid-request. It returns OAuth recovery before sending instead. Before this, a server accepting anonymous requests could receive that request without the connector's credential.
+
+**Native pools:** native pools now always list `authorize_connector`, so an agent on a pool without `execute_code` can get the operator a handoff for a connector that needs authorization. On those pools the repaired connector's tools appear only after the host refreshes its tool list, usually by reconnecting; pools with `execute_code` can reach them from a program straight away. Anything that compares a native pool's tool list exactly will see one more tool. Meta endpoints keep the same six tools.
+
+**Storage work per call:** warm remote MCP catalog resolution now takes four D1 round trips instead of six on modern servers and five on legacy ones. Warm agent admission takes two reads instead of four. Warm OAuth calls read the grant 9 times instead of 11 on modern servers and 12 instead of 13 on legacy ones. A warm isolate reuses a stored catalog it has already validated, after the same freshness and partition checks. The catalog and admission round trips were measured with injected latency on local workerd, and the OAuth counts come from request-budget tests. None of this has been measured in production.
+
+### Changed
+
+- Read agent token admission state in one fresh D1 or SQLite statement, reducing warm admission and last-seen observation from four reads to two while preserving next-request rotation and revocation enforcement.
+- **Breaking:** `@zackbart/connecta-eve` now requires exactly Eve 1.0.0-rc.1; Eve 0.90 apps must upgrade Eve together with the helper and, when installed, upgrade `@vercel/connect` to `^2.7.0`. Align installed-consumer probes and upgrade guidance with the tested release candidate. Later candidates and stable 1.0 require a compatibility check.
+- Reduce grant reads on warm OAuth remote MCP calls while retaining fresh catalog acceptance, disconnect, token rotation and dispatch checks. Keep the separate invocation token read so same-epoch invalidation refuses writes with OAuth recovery before dispatch, and expiry changes are observed before early renewal.
+- Reuse validated stored catalogs within a warm isolate after checking stored chunks, partition identity, expiry and the fresh generation fence. Retained facts are immutable and bounded; credential redaction still runs per request.
+
+### Fixed
+
+- Reduce warm remote MCP catalog storage round trips by batching locating reads and private/public manifest probes while preserving fresh generation and OAuth credential acceptance checks.
+- Keep authorization recovery available on native pools without code by listing authorize_connector with the granted connector ids, even when a connector's catalog cannot load.
+
+### Security
+
+- Require a credential on passive OAuth remote MCP sends, including handshakes, catalog requests and tool dispatches, regardless of provider replacement. Return OAuth recovery before sending when the SDK cannot obtain one, and count a verified unsent write as failed without reconciliation. Explicit authorization flows retain their challenges; writes that may already have left remain unknown.
+
 ## 0.39.0 — 2026-10-30
 
 This release makes Connecta faster and leaner for agents and operators on Cloudflare Workers. A warm search over remote MCP connectors with cached catalogs no longer reconnects to them: an all-legacy warm search makes no downstream requests. Repeated storage reads are memoized per request, and catalog chunks are read in batches. OAuth tokens refresh before they expire instead of failing the first write after expiry. Legacy negotiation verdicts last six hours, with bounded recovery when a server changes protocol era. A connector that recently hung or failed slowly is reported in `catalogErrors` and skipped by unscoped search for about a minute, and unscoped discovery has a total budget. With one hung connector, three consecutive searches went from 30 s each to 5 s, 11 ms and 8 ms.

package/bin/connecta.mjs

@@ -258,18 +258,14 @@ async function doctor() {
         `Native catalogs unavailable: ${surface.catalogErrors.join(", ")}. Inspect connector status and authentication.`,
       );
     const expected = native
-      ? ["skills", executeCode ? "execute_code" : "read_result"].sort()
+      ? ["authorize_connector", "skills", executeCode ? "execute_code" : "read_result"].sort()
       : [...META_TOOL_NAMES].sort();
     if (
       native
         ? expected.some((name) => !actual.includes(name)) ||
-          [
-            "search_tools",
-            "call_tool",
-            "call_destructive_tool",
-            "authorize_connector",
-            executeCode ? "read_result" : "execute_code",
-          ].some((name) => actual.includes(name))
+          ["search_tools", "call_tool", "call_destructive_tool", executeCode ? "read_result" : "execute_code"].some(
+            (name) => actual.includes(name),
+          )
         : JSON.stringify(actual) !== JSON.stringify(expected)
     ) {
       throw new Error(

package/bin/version.mjs

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.39.0";
+export const CONNECTA_VERSION = "0.40.0";

package/dist/access-tokens.js

@@ -8,7 +8,7 @@ import { accessTokenKeys } from "./storage/keys.js";
 import { AGENT_NAMESPACE, agentSubjectId, isAgentName, trustAgentProvider } from "./agent-identity.js";
 import { keepErrorName } from "./redaction-identity.js";
 import { agentConfig } from "./agent-config.js";
-import { authCall, authCatch, authFlow, authInvoke, authMethod, authOwnMethod, authStorage, registerAuthMethod, } from "./auth/native.js";
+import { authAccessToken, authCall, authCatch, authFlow, authInvoke, authMethod, authOwnMethod, authStorage, registerAuthMethod, } from "./auth/native.js";
 import { runEdge } from "./runtime/run.js";
 const TOKEN_PREFIX = "cta_";
 const TOKEN_BYTES = 32;
@@ -802,7 +802,9 @@ export class AccessTokenManager {
                             signal.throwIfAborted();
                             const hash = (yield authCall(hashToken, [token]));
                             signal.throwIfAborted();
-                            const lookupRaw = (yield authStorage(this.storage, "get", [lookupKey(hash)]));
+                            const snapshot = (yield authAccessToken(this.storage, hash));
+                            const read = (key) => snapshot ? (snapshot.get(key) ?? null) : authStorage(this.storage, "get", [key]);
+                            const lookupRaw = (yield authCall(read, [lookupKey(hash)]));
                             signal.throwIfAborted();
                             if (!lookupRaw)
                                 return unauthorized();
@@ -810,7 +812,7 @@ export class AccessTokenManager {
                             if (!lookup)
                                 return unauthorized();
                             const recordRaw = ID_RE.test(lookup.id)
-                                ? (yield authStorage(this.storage, "get", [recordKey(lookup.id)]))
+                                ? (yield authCall(read, [recordKey(lookup.id)]))
                                 : null;
                             const record = recordRaw ? parseRecord(recordRaw) : null;
                             if (record && record.id !== lookup.id)
@@ -827,7 +829,7 @@ export class AccessTokenManager {
                             // code, refuse exactly as an unknown token does.
                             if (record.principal || record.agent === undefined || !this.agents.has(record.agent))
                                 return unauthorized();
-                            const slotRaw = (yield authStorage(this.storage, "get", [slotKey(record.agent)]));
+                            const slotRaw = (yield authCall(read, [slotKey(record.agent)]));
                             const slot = slotRaw === null ? null : parseSlot(slotRaw, record.agent);
                             signal.throwIfAborted();
                             if (slot?.state !== "issued" || slot.tokenId !== record.id)

package/dist/auth/native.js

@@ -117,6 +117,16 @@ export function authStorage(storage, key, args, beforeSubmit) {
         return Effect.flatMap(Effect.serviceOption(AuthenticationWork), (work) => work._tag === "Some" ? authDetached(submitted) : submitted);
     });
 }
+/** Optional fresh token snapshot, with the same request ownership as an auth storage read. */
+export function authAccessToken(storage, hash) {
+    return Effect.suspend(() => {
+        const read = getNativeStorage(storage)?.accessToken;
+        if (!read)
+            return Effect.succeed(undefined);
+        const operation = authValue(() => read(hash));
+        return Effect.flatMap(Effect.serviceOption(AuthenticationWork), (work) => work._tag === "Some" ? authDetached(operation) : operation);
+    });
+}
 /** Several keys in one round trip when the store can, else one `get` at a time. */
 export function authStorageMany(storage, keys) {
     return Effect.suspend(() => {

package/dist/catalog-cache.js

@@ -412,6 +412,40 @@ const invalidateCatalogCacheNative = /* @__PURE__ */ registerAuth(invalidateCata
         advanceCatalogRevision(storage);
     }
 }));
+// Only detached JSON facts cross requests: no context, storage, promises or
+// callbacks. FIFO bounds retained partitions, JSON/key text (UTF-16 worst
+// case) and structural slots. No WeakRef or timers required.
+const catalogStores = new WeakMap();
+const validatedCatalogs = new Map();
+let validatedBytes = 0;
+const VALIDATED_BYTES = 8 * 1024 * 1024;
+function rememberValidated(key, value, bytes) {
+    bytes = bytes * 2 + key.length * 2;
+    if (bytes > VALIDATED_BYTES || validatedCatalogs.has(key))
+        return;
+    const pending = [value];
+    while (pending.length) {
+        const item = pending.pop();
+        if (!item || typeof item !== "object" || Object.isFrozen(item))
+            continue;
+        Object.freeze(item);
+        for (const child of Object.values(item)) {
+            // Charge structural overhead too: tiny JSON objects/arrays can occupy
+            // much more heap than their serialized bytes alone suggest.
+            bytes += 64;
+            if (bytes > VALIDATED_BYTES)
+                return;
+            pending.push(child);
+        }
+    }
+    while (validatedCatalogs.size >= 4 || validatedBytes + bytes > VALIDATED_BYTES) {
+        const oldest = validatedCatalogs.keys().next().value;
+        validatedBytes -= validatedCatalogs.get(oldest).bytes;
+        validatedCatalogs.delete(oldest);
+    }
+    validatedCatalogs.set(key, { value, bytes });
+    validatedBytes += bytes;
+}
 /** Keys ignore self-reported serverInfo and bind the configured connector instead. */
 export function catalogClientOptions(ctx, connectorId, config, authPartition, connectionSignal, owner, sharing = "private", resolveCredentialIdentity, connectionless = false) {
     return runEdge(authProgram(catalogClientOptionsNative, [
@@ -453,6 +487,9 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
         authPartition,
     ]);
     const storage = policy?.storage ?? ctx.storage;
+    let storeIdentity = catalogStores.get(storage);
+    if (!storeIdentity)
+        catalogStores.set(storage, (storeIdentity = crypto.randomUUID()));
     const configHash = (yield authCall(fingerprintSerializedCatalog, [
         JSON.stringify([
             config,
@@ -518,7 +555,8 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
     }));
     const namespace = cacheMethod((operation, memoized = false) => authFlow(function* () {
         const { stopped, generation, io } = operation;
-        if (resolveCredentialIdentity &&
+        if (!memoized &&
+            resolveCredentialIdentity &&
             (yield authCall(io, [resolveCredentialIdentity])) !== operation.credentialIdentity)
             return undefined;
         const current = (yield authCall(currentGeneration, [operation, memoized]));
@@ -544,7 +582,9 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
             pair.length !== 2 ||
             (pair[1] !== partition && (pair[1] !== "" || sharing !== "shared")))
             return undefined;
-        // Locating only: get's fence and set's publication re-check fresh.
+        // Locate with the listing's pinned identity and generation. Neither
+        // authorizes acceptance: get's post-chunk fence and set's publication
+        // re-read both, so rotation or disconnect during I/O refuses the entry.
         const prefix = (yield authCall(namespace, [operation, true]));
         if (!prefix || stopped())
             return undefined;
@@ -639,9 +679,28 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
             const root = (yield authCall(address, [key, operation]));
             if (!root || stopped())
                 return undefined;
-            const m = manifest((yield authCall(io, [
-                cacheMethod(() => authStorage(storage, "get", [root])),
-            ])));
+            // The SDK probes private, then public. Derive both addresses from
+            // the already-bound locating generation and identity, and fetch
+            // them in one statement. The post-chunk namespace check stays fresh.
+            const listing = operation.listing;
+            if (listing && !listing.manifests?.has(root)) {
+                const slots = sharing === "shared" ? [partition, sharedPartition] : [partition];
+                const roots = [];
+                for (const slot of slots) {
+                    const { fingerprint } = (yield authCall(fingerprintSerializedCatalog, [
+                        JSON.stringify([key.method, slot, operation.credentialIdentity ?? null]),
+                    ]));
+                    roots.push(responseCacheKeys.entry(responseCacheKeys.namespace(connectorId, configHash, operation.generation.value), fingerprint));
+                }
+                const values = (yield authCall(io, [cacheMethod(() => authStorageMany(storage, roots))]));
+                listing.manifests ??= new Map();
+                roots.forEach((root, i) => listing.manifests.set(root, values[i] ?? null));
+            }
+            const m = manifest(listing?.manifests?.has(root)
+                ? listing.manifests.get(root)
+                : (yield authCall(io, [
+                    cacheMethod(() => authStorage(storage, "get", [root])),
+                ])));
             if (stopped() ||
                 !m ||
                 (m.expiresAt <= Date.now() &&
@@ -670,18 +729,29 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
                 !(yield authCall(namespace, [operation])) ||
                 stopped())
                 return undefined;
-            const result = JSON.parse(value);
             const method = key.method;
-            const items = catalogItems(method, result);
-            if (!Array.isArray(items) ||
-                items.length > MAX_CATALOG_TOOLS ||
-                "nextCursor" in result ||
-                (result.resultType !== undefined && result.resultType !== "complete"))
-                return undefined;
-            const validated = (yield authInvoke(catalogSchema(method)["~standard"], "validate", [result]));
-            if (stopped() || validated.issues)
-                return undefined;
-            const clean = intake(ctx, method, validated.value);
+            // root binds connector/config/generation/scope/credential; partition
+            // also binds the current owner/deployment even for public entries.
+            // Hash the chunks again above, never trust the manifest alone.
+            const reuseKey = JSON.stringify([storeIdentity, root, partition, m.fingerprint]);
+            let accepted = validatedCatalogs.get(reuseKey)?.value;
+            if (!accepted) {
+                const result = JSON.parse(value);
+                const items = catalogItems(method, result);
+                if (!Array.isArray(items) ||
+                    items.length > MAX_CATALOG_TOOLS ||
+                    "nextCursor" in result ||
+                    (result.resultType !== undefined && result.resultType !== "complete"))
+                    return undefined;
+                const validated = (yield authInvoke(catalogSchema(method)["~standard"], "validate", [result]));
+                if (stopped() || validated.issues)
+                    return undefined;
+                accepted = validated.value;
+            }
+            // Redaction depends on this request's sent credentials. It must
+            // still run, and returns detached objects from the frozen facts.
+            const clean = intake(ctx, method, accepted);
+            rememberValidated(reuseKey, accepted, fingerprint.byteLength);
             if (m.expiresAt <= Date.now()) {
                 if (method === "tools/list" && (!staleTools || staleTools.manifest.fetchedAt < m.fetchedAt))
                     staleTools = { result: clean, manifest: m };
@@ -697,6 +767,7 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
             const root = (yield authCall(address, [key, operation]));
             if (!root || stopped())
                 return 0;
+            operation.listing?.manifests?.delete(root);
             const result = JSON.parse(entry.value);
             const method = key.method;
             if (catalogTtlMs(ctx, result.ttlMs) === 0) {
@@ -783,10 +854,12 @@ const catalogClientOptionsNative = /* @__PURE__ */ registerAuth(catalogClientOpt
         delete: cacheMethod((key) => authFlow(function* () {
             const operation = capture();
             const root = (yield authCall(address, [key, operation]));
-            if (root && !operation.stopped())
+            if (root && !operation.stopped()) {
+                operation.listing?.manifests?.delete(root);
                 (yield authInvoke(operation, "io", [
                     cacheMethod(() => authStorage(storage, "delete", [root])),
                 ]));
+            }
         })),
         evict: cacheMethod((method) => authFlow(function* () {
             if (isCatalogMethod(method))

package/dist/connectors/remote-mcp/connection.js

@@ -3,8 +3,8 @@
 // served without connecting (INV-10).
 import { routePhrases } from "../../agent-routes.js";
 import { authView } from "../../auth/native-call.js";
-import { authFlow, authCall, authInvoke, authMethod } from "../../auth/native.js";
-import { openRequest, viewServices, viewSignal } from "../../runtime/call.js";
+import { authFlow, authCall, authInvoke, authMethod, authStorageMany } from "../../auth/native.js";
+import { openRequest, viewServices, viewSignal, viewReads, serviceFor } from "../../runtime/call.js";
 import { secretDigest } from "../../storage-digest.js";
 import { downstreamClientMetadata, downstreamRedirectUri, remoteClientAuthMethod, selfHostedClientUrl, } from "../../auth/downstream-client-metadata.js";
 import { Client, SdkErrorCode, SdkHttpError, UnauthorizedError } from "@modelcontextprotocol/client";
@@ -23,6 +23,8 @@ import { downstreamInputCapabilities } from "../../downstream-input-context.js";
 import { detach, runEdge } from "../../runtime/run.js";
 import { requestPrincipalFor } from "../../request-principal.js";
 import { callerOf } from "../../connector-caller.js";
+import { CatalogPolicy } from "../../catalog-policy.js";
+import { negotiationKeys, responseCacheKeys } from "../../storage/keys.js";
 import { forgetNegotiation, readNegotiation, storeNegotiation } from "../negotiation-cache.js";
 import { carriesIllegalHeaderChar, credentialHeaderValue } from "./config.js";
 import { AUTH_OR_THROTTLE, promised, recordWireErrors, requiresAuthorization } from "./errors.js";
@@ -293,6 +295,15 @@ export function remoteMcpConnection(rt) {
             }
             if (opts.versionNegotiation !== "legacy") {
                 const digest = (yield authCall(negotiationKey, [ctx, credentialDigest, epoch]));
+                // Both reads only locate cached data. Acceptance and dispatch keep
+                // their fresh generation and credential checks.
+                yield viewReads(ctx).prefetch([
+                    { storage: ctx.storage, key: negotiationKeys.verdict(digest) },
+                    {
+                        storage: serviceFor(ctx, CatalogPolicy)?.storage ?? ctx.storage,
+                        key: responseCacheKeys.generation(id),
+                    },
+                ], (storage, keys) => authStorageMany(storage, keys));
                 const prior = (yield authCall(readNegotiation, [ctx, digest]));
                 preread.negotiation = { digest, prior };
                 if (prior?.kind === "modern")

package/dist/connectors/remote-mcp/oauth.js

@@ -399,6 +399,10 @@ export function remoteMcpOAuth(rt) {
         connector.startAuth = authMethod((ctx, startOpts) => authFlow(function* () {
             ctx = authorizingContext(ctx);
             const state = rt.stateFor(ctx);
+            // A passive tokenless handshake was refused locally. An explicit
+            // start gets its own challenge-capable connection attempt.
+            if (state.authRequired && !state.client)
+                rt.closeHalf(state);
             state.provider = null;
             const p = rt.newProvider(ctx, state);
             if (ctx.signal?.aborted)

package/dist/connectors/remote-mcp/transport.js

@@ -19,7 +19,7 @@ import { RequestScope } from "../../runtime/request-scope.js";
 import { Context } from "effect";
 import { downstreamWriteContinuation } from "../../downstream-input-context.js";
 import { guardedTransport, sendGuarded, sendCredentialPost } from "../../guarded-transport.js";
-import { dispatchProviderRequest, recordProviderResponse, providerRequest, renewedAfterUnauthorized, } from "../../provider-call.js";
+import { dispatchProviderRequest, recordProviderResponse, knownProviderFailure, providerRequest, renewedAfterUnauthorized, } from "../../provider-call.js";
 import { recordRequestField } from "../../provider-call-facts.js";
 import { AUTH_OR_THROTTLE, errorBodyText, jsonRpcErrorBody, keepsModernVerdict, promised } from "./errors.js";
 import { MAX_SKILL_READ_RPC_BYTES, boundedSkillResponse, skillObject } from "./resources.js";
@@ -273,6 +273,17 @@ export function remoteMcpTransport(rt) {
             if (toolCall && !flight && !untrackedRead(toolCall.params))
                 throw missingDispatch();
             const credentialPost = isOauth && (init?.method ?? "GET").toUpperCase() === "POST" && (!skillObject(rpc) || rpc.jsonrpc !== "2.0");
+            // OAuth discovery, registration and exchange share this fetch, but do
+            // not use the resource credential. Guard the assembled MCP request,
+            // after the SDK token read and before dispatch bookkeeping or fetch.
+            // OAuth is required on passive paths regardless of which provider
+            // read the grant. Only an explicit authorization start may probe the
+            // resource anonymously for an SDK challenge, never a tools/call.
+            if (isOauth && !credentialPost && new URL(input).href === url.href) {
+                const authorization = new Headers(init?.headers).get("authorization");
+                if ((provider?.allowAuthorization !== true || toolCall) && !authorization)
+                    throw knownProviderFailure(rt.authRequiredError(ctx), flight?.sent ? undefined : (flight?.request?.entry ?? providerRequest(ctx, true, id)));
+            }
             // A custom transport reaches only the configured origin; redirects are
             // already same-origin, and OAuth cannot be combined with it.
             if (customFetch && new URL(input instanceof Request ? input.url : String(input)).origin !== destination.origin)
@@ -410,7 +421,7 @@ export function remoteMcpTransport(rt) {
                 }
             })));
         if (opts.auth?.type === "oauth") {
-            const oauthProvider = provider ?? rt.newProvider(ctx, undefined, signal);
+            const oauthProvider = (provider ??= rt.newProvider(ctx, undefined, signal));
             // The session/provider belong to the request. A renewal belongs to the
             // exact call whose HTTP response challenged it, until claim submission.
             // Carry that ownership on the response the SDK passes to onUnauthorized;

package/dist/connectors/remote-mcp.js

@@ -481,9 +481,12 @@ export function remoteMcp(id, opts) {
             const provider = newProvider(ctx, stateFor(ctx));
             if ((yield authInvoke(provider, "operatorDisconnected", [])))
                 throw operatorDisconnectedError();
+            // Keep this separate from the disconnect read: invalidation and
+            // refresh can remove or replace tokens without changing the epoch.
+            // The SDK may otherwise send anonymously when its tokens() is empty.
             if (!(yield authInvoke(provider, "tokens", [])))
                 throw authRequiredError(ctx);
-            // That read decides whether the token is about to expire.
+            // That read also decides whether the token is about to expire.
             const due = provider.renewalDue();
             if (due !== undefined)
                 (yield authCall(renewBeforeCall, [ctx, due]));

package/dist/invocation.js

@@ -16,7 +16,7 @@ import { recoveryRecord, recordRecoveryFacts } from "./call-recovery.js";
 import { callFromContext, contextView, viewServices, Credentials } from "./runtime/call.js";
 import { chargeCallBudget } from "./runtime/call-admission.js";
 import { callEntry } from "./runtime/call-entry.js";
-import { forgetProviderFailure, isKnownProviderFailure, isSettledWrite, keyProtectsCall, knownCallFailure, onlyAuxiliaryRequests, knownProviderFailure, openLogicalCall, } from "./provider-call.js";
+import { forgetProviderFailure, isKnownProviderFailure, isSettledWrite, keyProtectsCall, knownCallFailure, refusalRequest, onlyAuxiliaryRequests, knownProviderFailure, openLogicalCall, } from "./provider-call.js";
 import { classifyWriteOutcome, settleWrite, settleWriteResult } from "./write-outcome.js";
 import { classificationDigest, recordAuthFailure, recordCallEntry, replayClassificationDigest, resolveInvocationAuthEffect, } from "./invocation-auth.js";
 import { downstreamContinuation, recordDownstreamArgumentEcho, isDownstreamInputResult, assertDownstreamOutputSafe, } from "./downstream-input-context.js";
@@ -288,10 +288,13 @@ export class InvocationService {
                 }
                 if (mayHaveWritten &&
                     (error.code === "auth_required" || error.code === "downstream_oauth_required") &&
-                    !logicalCall?.sent.some((request) => request.dispatched)) {
+                    !logicalCall?.sent.some((request) => request.dispatched) &&
+                    !(answered && refusalRequest(error)?.dispatched === false)) {
                     // An empty resource ledger cannot settle this auth failure. Keep
                     // actual resource-refusal provenance, but withdraw an empty ledger's
                     // known mark before composing advice and counting program writes.
+                    // A boundary-owned physical pre-dispatch refusal is positive proof;
+                    // its private provenance cannot be supplied by error fields.
                     answered = false;
                     forgetProviderFailure(error);
                 }

package/dist/meta-tools.js

@@ -1130,6 +1130,37 @@ export function registerMetaTools(server, registry, ctx) {
         bindRequest(request);
         return yield* upwardStep(authInvoke(mt, "skills", [args]));
     })));
+    server.registerTool("authorize_connector", {
+        description: ctx.native
+            ? AUTHORIZE_DESC +
+                " Use when a connector’s tools are missing. Granted: " +
+                registry
+                    .listConnectors()
+                    .map((connector) => connector.id)
+                    .join(", ") +
+                "."
+            : AUTHORIZE_DESC,
+        inputSchema: AUTHORIZE_INPUT,
+        outputSchema: AUTHORIZE_OUTPUT,
+        // Starts (or with force, resets) a downstream OAuth flow — it changes
+        // stored connector auth state, so it is deliberately not read-only.
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            openWorldHint: true,
+        },
+    }, authMethod((args, request) => authFlow(function* () {
+        bindRequest(request);
+        const run = authMethod(() => authInvoke(mt, "authorizeConnector", [args]));
+        return yield* upwardStep(ctx.authElicitation
+            ? authInvoke(ctx.authElicitation, "run", [
+                "authorize_connector",
+                args,
+                request,
+                run,
+            ])
+            : authCall(run, []));
+    })));
     if (ctx.native) {
         if (!ctx.native.executeCode) {
             server.registerTool("read_result", { description: READ_RESULT_DESC, inputSchema: READ_RESULT_INPUT, annotations: READ_ONLY_LOCAL }, authMethod((args, request) => authFlow(function* () {
@@ -1201,28 +1232,5 @@ export function registerMetaTools(server, registry, ctx) {
             ])
             : authInvoke(mt, "callDestructiveTool", [call]));
     })));
-    server.registerTool("authorize_connector", {
-        description: AUTHORIZE_DESC,
-        inputSchema: AUTHORIZE_INPUT,
-        outputSchema: AUTHORIZE_OUTPUT,
-        // Starts (or with force, resets) a downstream OAuth flow — it changes
-        // stored connector auth state, so it is deliberately not read-only.
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            openWorldHint: true,
-        },
-    }, authMethod((args, request) => authFlow(function* () {
-        bindRequest(request);
-        const run = authMethod(() => authInvoke(mt, "authorizeConnector", [args]));
-        return yield* upwardStep(ctx.authElicitation
-            ? authInvoke(ctx.authElicitation, "run", [
-                "authorize_connector",
-                args,
-                request,
-                run,
-            ])
-            : authCall(run, []));
-    })));
     return undefined;
 }

package/dist/native-tools.js

@@ -29,7 +29,7 @@ const SEPARATOR = "__";
 const PLAIN_TOOL = /^[A-Za-z0-9-](?:[A-Za-z0-9-]|_(?!_))*$/;
 const NATIVE_NAME = new RegExp(`^[A-Za-z][A-Za-z0-9_-]{0,${NATIVE_NAME_MAX - 1}}$`);
 /** Connecta's own tools on a native endpoint. Their names never contain `__`. */
-const NATIVE_OWN_TOOLS = ["execute_code", "skills", "read_result"];
+const NATIVE_OWN_TOOLS = ["execute_code", "skills", "read_result", "authorize_connector"];
 const enc = new TextEncoder();
 function shortHash(text) {
     return runEdge(shortHashNative(text));

package/dist/provider-call-facts.js

@@ -133,9 +133,13 @@ export function renewedAfterUnauthorized(request, sent, fresh) {
 export function refusalRequest(error) {
     return error !== null && typeof error === "object" ? refusals.get(error) : undefined;
 }
-export function knownProviderFailure(error) {
-    if (error !== null && typeof error === "object")
+/** A local refusal may additionally name the physical request it prevented. */
+export function knownProviderFailure(error, unsent) {
+    if (error !== null && typeof error === "object") {
         knownFailures.add(error);
+        if (unsent && !unsent.dispatched)
+            refusals.set(error, unsent);
+    }
     return error;
 }
 export function isKnownProviderFailure(error) {

package/dist/providers/planning-center/lib/constants.d.ts

@@ -55,4 +55,4 @@ export declare const PLANNING_CENTER_MAX_RESPONSE_BYTES: number;
  */
 export declare const PLANNING_CENTER_ADMISSION: ConnectorCallAdmissionPolicy;
 /** Planning Center refuses a request without a descriptive one (HTTP 403). */
-export declare const DEFAULT_USER_AGENT = "connecta/0.39.0 (+https://github.com/zackbart/connecta)";
+export declare const DEFAULT_USER_AGENT = "connecta/0.40.0 (+https://github.com/zackbart/connecta)";

package/dist/runtime/native-storage.js

@@ -25,6 +25,9 @@ export function registerNativeStorage(edge, native) {
     storageMethods.set(edge, own);
     const getMany = native.getMany;
     storage.set(edge, {
+        accessToken: native.accessToken
+            ? (hash) => typed(() => (getNativeStorage(edge) ? native.accessToken(hash) : Effect.succeed(undefined)))
+            : undefined,
         get: (key) => current(edge, "get", own.get, [key], () => native.get(key)),
         // A replaced `get` answers each key itself, in order, as before.
         ...(getMany

package/dist/runtime/request-reads.js

@@ -36,6 +36,7 @@
 // `FinalizationRegistry` (workerd before compatibility date 2025-05-05 without
 // `enable_weak_ref`) memoizes nothing: every read goes to storage.
 import { Effect } from "effect";
+const roots = new WeakMap();
 const observed = new WeakMap();
 /**
  * Open memos holding or reading entries of each store. Weak, so a request
@@ -72,6 +73,8 @@ export function observedWrite(store, key, write) {
  * one is.
  */
 export function observeStorageWrites(storage, layer) {
+    if ("root" in layer)
+        roots.set(layer.root, storage);
     observed.set(storage, {
         own: {
             get: storage.get,
@@ -159,6 +162,28 @@ export class RequestReads {
             return Effect.tap(load, (value) => Effect.sync(() => found.record(value)));
         });
     }
+    /** Prefetch only keys whose callers already permit request-local staleness. */
+    prefetch(requests, load) {
+        return Effect.suspend(() => {
+            const pending = requests.map(({ storage, key }) => ({
+                address: physical(storage, key),
+                found: this.lookup(storage, key, false),
+            }));
+            const root = pending[0]?.address?.store;
+            const storage = root && roots.get(root);
+            if (!storage || pending.some(({ address, found }) => !found || address?.store !== root))
+                return Effect.void;
+            const misses = pending.filter(({ found }) => found && !found.hit);
+            if (!misses.length)
+                return Effect.void;
+            return Effect.map(load(storage, misses.map(({ address }) => address.key)), (values) => {
+                misses.forEach(({ found }, i) => {
+                    if (found && !found.hit)
+                        found.record(values[i] ?? null);
+                });
+            });
+        });
+    }
     /** `read` for a Promise-shaped caller, without another Effect edge. */
     async readPromise(storage, key, load, fresh = false) {
         const found = this.lookup(storage, key, fresh);

package/dist/skills.js

@@ -35,7 +35,7 @@ export function endpointInstructions(description, native) {
 /** Instructions for pools whose host searches the listed native tools. */
 export function nativeInstructions(executeCode) {
     const routes = routeNames(executeCode ? "native-code" : "native");
-    return `Each tool here is one operation; annotations classify reads/writes. Call known tools directly; ${executeCode ? `combine work in ${routes.program} using the program addresses in tool descriptions.` : "find tools with your host's search."} Read-only endpoints omit and refuse writes. Never repeat a write for output. Give auth handoffs to the user/operator. Follow nextAction to page with ${executeCode ? `connecta.result in ${routes.program}` : "read_result"}. ${routes.skills} lists guidance.`;
+    return `Each tool here is one operation; annotations classify reads/writes. Call known tools directly; ${executeCode ? `combine work in ${routes.program} using the program addresses in tool descriptions.` : "find tools with your host's search."} Read-only endpoints omit and refuse writes. Never repeat a write for output. Give auth handoffs to the user/operator. Tools missing? Call authorize_connector; after repair, reconnect to refresh your list. Follow nextAction to page with ${executeCode ? `connecta.result in ${routes.program}` : "read_result"}. ${routes.skills} lists guidance.`;
 }
 /** True when at least one of `connectors` carries a usage guide. */
 export function hasConnectorGuides(connectors) {

package/dist/storage/sql-native.js

@@ -27,7 +27,7 @@ import { Effect } from "effect";
 import { activityBehaviorFacts, activityPackageVersion, activityClientFact, InvalidActivityCursorError, } from "../activity.js";
 import { assertKnownOptions, ConfigError, keys, optionsOf } from "../config-schema.js";
 import { agentFrictionForCode } from "../activity-friction.js";
-import { validateStorageKey } from "./keys.js";
+import { accessTokenKeys, validateStorageKey } from "./keys.js";
 const sql = (text, ...params) => ({
     sql: text,
     params,
@@ -107,6 +107,31 @@ export function nativeSqlStorage(driver) {
                 return yield* current(key);
             });
         },
+        accessToken(hash) {
+            return Effect.gen(function* () {
+                const key = accessTokenKeys.lookup(hash);
+                yield* ensure();
+                // The links select candidate rows only. Admission still parses every
+                // raw value and addresses it by its physical key, so JSON extraction
+                // differences (e.g. duplicate fields) cannot substitute another slot.
+                // json_valid guards malformed stored JSON; expiry uses the DB clock.
+                const rows = yield* driver.all(sql(`WITH lookup AS (
+            SELECT key, value FROM connecta_kv WHERE key = ? AND ${live}
+          ), record AS (
+            SELECT key, value FROM connecta_kv WHERE key = ? ||
+              (SELECT CASE WHEN json_valid(value) THEN json_extract(value, '$.id') END FROM lookup)
+              AND ${live}
+          ), slot AS (
+            SELECT key, value FROM connecta_kv WHERE key = ? ||
+              (SELECT CASE WHEN json_valid(value) THEN json_extract(value, '$.agent') END FROM record)
+              AND ${live}
+          )
+          SELECT key, ${textColumn("value")} FROM lookup
+          UNION ALL SELECT key, ${textColumn("value")} FROM record
+          UNION ALL SELECT key, ${textColumn("value")} FROM slot`, key, accessTokenKeys.recordPrefix, accessTokenKeys.agent("")));
+                return new Map(rows.map((row) => [row.key, textOf(row.value, row.value_bytes, "Stored access token metadata")]));
+            });
+        },
         getMany(keys) {
             return Effect.gen(function* () {
                 for (const key of keys)

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CONNECTA_VERSION = "0.39.0";
+export declare const CONNECTA_VERSION = "0.40.0";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.39.0";
+export const CONNECTA_VERSION = "0.40.0";

package/documentation/architecture.md

@@ -340,7 +340,7 @@ without storage reads, decryption or hashing. Catalog invalidation (including
 operator refresh and OAuth connect/disconnect/restart) advances a counter for the
 registry's cache store; built-in vault set/clear advances a counter for that vault.
 These weakly held counters contain no catalogs, credentials or caller identity;
-catalogs and derived views remain request-local. A moved fence replaces the
+registry catalogs and derived views remain request-local. A moved fence replaces the
 retained read and its search views, and prevents joining an older registry flight.
 Changes made through another process/isolate or directly in storage need not be
 observed mid-request; the next request uses the durable generation and auth checks.
@@ -619,6 +619,18 @@ Only complete, intake-redacted tools/list, resources/list and
 resources/templates/list successes are stored. Resource payloads are not cached. SDK default
 in-memory caching is replaced, so raw catalogs never enter it.
 
+A warm isolate retains at most four validated stored JSON catalogs, with a
+combined accounting budget of 8 MiB (twice serialized input bytes, key bytes and
+64 bytes per object property/array slot; larger entries bypass reuse).
+These deeply frozen facts contain no request context, transport, signal,
+callback or promise, and require neither weak references nor cleanup timers.
+Reuse follows the same manifest TTL checks, complete chunk reads, recomputed
+SHA-256 fingerprint and fresh generation/credential acceptance fence as a cold
+read. Its key binds the stored entry, current private owner/deployment partition
+(even for public entries), and chunk fingerprint. Request-specific credential
+redaction and TTL intake still run every time. Eviction affects performance
+only; SQL remains authoritative.
+
 Stored catalog and negotiation keys use deployment-keyed partitions. A remote
 connector's whole cache configuration and negotiation input enter a stored key
 only through HMAC-SHA-256 (`src/storage-digest.ts`) under a key that never
@@ -643,6 +655,28 @@ refresh baselines within 48 hours, verdicts within six hours), so each remote
 connector's partitions refill once after the upgrade with one handshake and
 listing.
 
+Warm remote resolution batches the negotiation verdict and locating generation
+when their physical keys share an observed SQL store. Private and public
+manifest probes share a `getMany` statement; their normal precedence and public
+scope check still apply. These batches contain only reads. Catalog addresses
+use the listing's pinned OAuth identity and locating generation; they authorize
+nothing. After chunk verification, acceptance re-reads the OAuth identity and
+generation separately and refuses a changed epoch or token digest. The invocation
+gate checks disconnect first, then reads tokens separately to refuse absent
+credentials and observe current expiry and the invalidation fingerprint. Token
+removal, expiry, scope and replacement can change without advancing the epoch;
+epoch fences alone cannot protect these values. The SDK's later token read may
+return no tokens and omit Authorization, so it does not replace invocation's
+token-presence refusal. The transport also refuses tokenless MCP requests on
+passive OAuth paths, regardless of provider history; an explicit authorization
+start may probe for the SDK's challenge. A refused tool send binds its private
+failure provenance to the undispatched physical request. Invocation accepts it
+only for the owning boundary and whole logical call; error fields, copied
+connectors, and refusals after a send cannot supply that proof.
+Connection reuse and SDK dispatch retain their fresh
+epoch or token reads; no credential read is prefetched.
+Stores with replaced methods or separate backing stores retain individual reads.
+
 A remote connector's `listTools` without a live connection in its request
 reads this cache before connecting. It derives the same partition a connect
 binds (the admitted principal, the caller's credential digest, or the owner's

package/documentation/auth.md

@@ -651,6 +651,11 @@ agent's slot is `issued` naming exactly that record. Nothing else counts: a
 lookup or record the slot does not name is inert garbage. Every mutation
 commits by one `compareAndSet` on the slot and only moves forward; no security
 outcome depends on cleanup or on undoing a write.
+Admission reads this state afresh on every request; successful token verdicts
+are never cached. D1 and SQLite read the lookup, record, and slot in one
+statement, with the same validation and expiry checks. Custom storage adapters
+retain the sequential reads. Rotation and revocation therefore retain their
+next-request refusal bound.
 
 - **Rotate** writes the new record and its lookup (inert), checks the
   request's signal, then compare-and-sets the slot from what it read to
@@ -1345,6 +1350,16 @@ code, so `remoteMcp()` refuses it as personal at construction.
 
 ## Downstream OAuth state at rest
 
+An OAuth remote MCP connector requires an access token on passive MCP requests,
+including handshakes, catalog requests, and tool dispatches, even if the server
+accepts anonymous requests. This requirement survives provider replacement.
+If the SDK cannot obtain a token at send time, Connecta returns OAuth recovery
+before sending. A locally refused write counts as failed, without reconciliation;
+a write that may already have left remains unknown and is never replayed.
+Only an explicit authorization start may probe the MCP endpoint without a token
+for the SDK's challenge, never to call a tool. Authorization-server discovery,
+client registration, token exchange, and refresh retain their OAuth flows.
+
 Each owner of an OAuth connector (the deployment when shared, each principal
 when personal) has one **grant record**, `oauth:grant` in the connector's
 namespace: the live **epoch**, the latest consent's state digest, and one
@@ -1432,7 +1447,7 @@ with the gate a call passes:
 | Stored grant        | Status                                                      | Start (Connect, Continue, Restart, `authorize_connector`)                                                                                                                                                                                                                          |
 | ------------------- | ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Disconnected        | `auth_required`; the downstream is not asked                | Replaces the epoch, then proceeds as for no tokens                                                                                                                                                                                                                                 |
-| No tokens           | Connects; `auth_required` even when the downstream answers  | Connects first, so a 401's `resource_metadata` starts consent as before. A downstream that answers without credentials still gets consent, discovered from RFC 9728 metadata at the configured URL's well-known locations. The start answers `auth_required` with the consent URL. |
+| No tokens           | `auth_required`; tokenless MCP requests are refused locally | Connects first, so a 401's `resource_metadata` starts consent as before. A downstream that answers without credentials still gets consent, discovered from RFC 9728 metadata at the configured URL's well-known locations. The start answers `auth_required` with the consent URL. |
 | Tokens (any expiry) | Connects; `ok`, or `auth_required` when a 401 needs consent | Connects; `ok` without starting a flow when healthy                                                                                                                                                                                                                                |
 
 A start without a challenge runs the same SDK flow as a 401 without

package/documentation/integrating.md

@@ -345,8 +345,8 @@ check shared behavior. Provider-specific tests remain beside each provider.
 
 Use [`@zackbart/connecta-eve`](https://github.com/zackbart/connecta/blob/main/packages/connecta-eve/README.md)
 in the Eve app for an app-owned connection and endpoint instructions refreshed
-once per turn. It requires Node 24 and Eve 0.90.x, and installs separately from
-Connecta. Follow its README for the two agent files, token environment variables,
+once per turn. It installs separately from Connecta. Follow its README for the
+supported Node and Eve versions, the two agent files, token environment variables,
 optional write approval and Vercel OIDC token source. Configure the server's
 [agent and pool membership](./auth.md#issue-rotate-or-revoke-an-agent-token)
 before connecting.

package/documentation/meta-tools.md

@@ -905,6 +905,16 @@ fulfill downstream input.
 
 ## Authorization recovery
 
+Every native pool lists `authorize_connector`, including pools without code.
+If a connector’s tools are missing, use its id from that tool’s granted-connector
+list to request a typed handoff. Give the URL and instructions to the operator;
+after repair the host must refresh its tool list before it can call the repaired
+tools (the cache hint is 300 seconds). A host that keeps its first list needs a
+reconnect or a new conversation; on a pool with `execute_code`, a program can call
+them by address without one.
+Listing never creates a handoff. Authorization accepts only connectors already
+granted to this request; it cannot enable a connector or expand pool scope.
+
 On MCP 2026-07-28, a host declaring `elicitation.url` receives
 `resultType: "input_required"` when an eligible call or program needs recoverable
 connector authentication and the admitted identity may manage that connector.
@@ -1437,10 +1447,10 @@ pool's surface.
 | Each visible downstream tool | Named `<connector>__<tool>`; object input constraints and local references preserved; no `outputSchema`; `_meta["dev.connecta/address"]` is its address           |
 | `execute_code`               | Unless `executeCode: false`. Each downstream tool's description then ends with `Program address: <connector>.<tool>`, the address `connecta.call` takes           |
 | `read_result`                | Only with `executeCode: false`: `{ id, offset?, page?, maxBytes? }` pages a stashed result exactly as `connecta.result` does, with the same bindings and rechecks |
+| `authorize_connector`        | Always; requests the existing typed authorization handoff for a granted connector                                                                                 |
 | `skills`                     | Always                                                                                                                                                            |
 
-`search_tools`, `call_tool`, `call_destructive_tool`, and `authorize_connector`
-are not listed. Auth failures still carry their handoff in the error envelope.
+`search_tools`, `call_tool`, and `call_destructive_tool` are not listed. Auth failures still carry their handoff in the error envelope.
 
 **Names.** A name is a pure function of the connector id and downstream tool
 name, so it survives catalog refreshes. It is `<connector>__<tool>` when the
@@ -1484,7 +1494,7 @@ window, a native `tools/list` carries a 300-second private cache hint, against
 an hour on meta endpoints. This hint does not guarantee that a host refreshes
 its cached annotations; the stale-approval race is accepted on writable pools.
 
-**Listing.** `tools/list` is one page with no cursor (Eve 0.90 reads only the
+**Listing.** `tools/list` is one page with no cursor (Eve's MCP client reads only the
 first page). A pool listing more than 1,000 tools fails `tools/list` with a
 JSON-RPC error asking the operator to narrow the pool; nothing is silently
 dropped. A connector whose catalog cannot load is left out of that listing
@@ -1498,7 +1508,14 @@ reduced calls; write tools are absent and refused on a read-only endpoint;
 never repeat a write; page a truncated result as its notice says. A pool
 `description` is appended as on meta endpoints.
 
-**Recovery.** Repair and validation fields retain the exact constraint details.
+**Recovery.** `authorize_connector` remains listed even when a catalog fails.
+Its description lists all granted connector ids independently of catalog health.
+Use it for a missing connector, then refresh the host tool list after repair.
+Endpoint instructions carry the same recovery rule for hosts that fetch them
+separately. A cached list retains the recovery tool; a refreshed list restores
+the repaired connector’s whole catalog.
+
+Repair and validation fields retain the exact constraint details.
 Discovery `nextAction` points to the host's tool search (`host: "search"`), with
 only a `query` argument. Retry actions and retry text name the native tool,
 never a meta wrapper; a program on a native pool sees the same native wording

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.39.0",
+  "version": "0.40.0",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of six meta-tools.",

package/templates/node/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.12.0",
-    "@zackbart/connecta": "0.39.0",
+    "@zackbart/connecta": "0.40.0",
     "quickjs-emscripten": "0.32.0",
     "undici": "6.29.1"
   },