@zackbart/connecta 0.41.0 → 0.42.0

package/dist/http/hatch.js

@@ -25,6 +25,8 @@ import { Integer, isMaxChars, isMinChars } from "./json-schema.js";
 import { boundCursor, StandardPage } from "./paging.js";
 import { Classification, Dispatches, IdempotencyKey, RequestSecrets, Signal } from "./services.js";
 import { read, write } from "./tools.js";
+/** A page that reports more data it cannot continue must never read as the complete answer. */
+const CONTINUATION_WITHHELD = "This result is incomplete: more data exists and continuation was withheld.";
 const indexedOperations = new WeakMap();
 function operationsOf(index) {
     let operations = indexedOperations.get(index);
@@ -204,7 +206,7 @@ export function hatch(options) {
         }
         return fieldsInput(fieldsNote(first ?? preferred));
     };
-    const fieldsNote = (example) => fieldsDescription("data", example, `Copy declared paths from ${name}_api_details response.fields. Applied after value safety and privacy filtering.`);
+    const fieldsNote = (example) => fieldsDescription("data", example, `Copy declared paths from ${name}_api_details response.fields. A withheld value reads "[redacted]".`);
     const verdictOf = (op) => verdicts.get(`${op.method} ${op.path}`) ?? "refuse";
     const refusalOf = (op) => connection.safety.refusal?.({ method: op.method, template: op.path }) ?? options.binding?.refusal?.(op);
     const discoveryRefusals = new Map();
@@ -259,7 +261,7 @@ export function hatch(options) {
             }
             : {}),
         warnings: Schema.optionalKey(Schema.Array(Schema.String).annotate({
-            description: `${options.binding?.warnings ? "Reviewed warnings preserved after fields selection, and " : ""}fields entries that matched nothing in this nonempty response, with the properties declared where matching stopped. At most 10 warnings of 512 characters, then an omitted count.`,
+            description: `${options.binding?.warnings ? "Reviewed warnings preserved after fields selection, and " : ""}fields entries that matched nothing in this nonempty response, with the properties declared where matching stopped${pages.size ? ", and a notice when continuation was withheld" : ""}. At most 10 warnings of 512 characters, then an omitted count.`,
         })),
     });
     const hasTotals = [...pages.values()].some((adapters) => adapters.some((adapter) => adapter.total !== undefined));
@@ -268,11 +270,14 @@ export function hatch(options) {
             ...callEnvelope.fields,
             page: Schema.optionalKey(Schema.Struct({
                 ...StandardPage.fields,
+                hasMore: Schema.Boolean.annotate({
+                    description: "True without nextCursor means this data is incomplete and continuation was withheld.",
+                }),
                 ...(hasTotals ? { total: Schema.optionalKey(Integer.check(Schema.isGreaterThanOrEqualTo(0))) } : {}),
                 param: Schema.String.annotate({
                     description: options.pageCursor === "argument"
                         ? "Vendor parameter restored from cursor; pass nextCursor as the top-level cursor."
-                        : "Put nextCursor in this vendor parameter, unchanged.",
+                        : "Put nextCursor unchanged in query[param] or body[param], as page.in says, and keep every other argument.",
                 }),
                 in: Schema.Literals(["query", "body"]),
             })),
@@ -1223,6 +1228,7 @@ export function hatch(options) {
         // Roots were checked before dispatch; the pinned index cannot say whether a
         // deeper level is closed, so a nested miss is reported, never refused.
         const warnings = boundWarnings([
+            ...(page?.hasMore && page.nextCursor === undefined ? [CONTINUATION_WITHHELD] : []),
             ...(options.binding?.warnings && "warnings" in answer ? (answer.warnings ?? []) : []),
             ...fieldsMisses(answered, args.fields, index
                 .fields(op)

package/dist/http/paging.js

@@ -20,7 +20,7 @@ export const StandardPage = Schema.Struct({
 });
 /** The input field that carries a cursor back. */
 export const Cursor = Schema.String.check(Schema.isMinLength(1)).annotate({
-    description: "Opaque nextCursor from the previous page. Pass it back unchanged.",
+    description: "Opaque page.nextCursor from the previous page. Pass it back unchanged with the same arguments.",
 });
 /**
  * Lookahead paging, for a vendor that returns no `has_more`: ask for one row

package/dist/http/provider.js

@@ -46,7 +46,7 @@ const missingGrant = {
 };
 /** An ordinary Promise connector factory; Effect remains inside the kit. */
 export function defineApiProvider(definition) {
-    const { displayTitle, description, authScope, vendor, baseUrl, maxResponseBytes, timeoutMs, headers, admit, transport, defaultCallAdmission, pageSize: declaredPageSize, idempotencyKey, credential, oauth, oauthWrite401, grant, grantRenewal, authenticate, errors, safety, result, inBandRefusals, probe, guide, transformGuide, hatch: declaredHatch, tools, tagConnector, searchSynonyms, ...metadata } = definition;
+    const { displayTitle, description, authScope, vendor, baseUrl, maxResponseBytes, timeoutMs, headers, admit, transport, defaultCallAdmission, pageSize: declaredPageSize, idempotencyKey, credential, oauth, oauthWrite401, grant, grantRenewal, authenticate, publicIdentifierHeaders, errors, safety, result, inBandRefusals, probe, guide, transformGuide, hatch: declaredHatch, tools, tagConnector, searchSynonyms, ...metadata } = definition;
     if (searchSynonyms !== undefined &&
         !(Array.isArray(searchSynonyms) &&
             searchSynonyms.length > 0 &&
@@ -95,18 +95,13 @@ export function defineApiProvider(definition) {
         kind: "api",
         kit: {
             operations: operations(vendor),
-            ...(pageSize ? { pageSize } : {}),
             ...(hatchOptions
                 ? {
                     hatch: {
                         name: hatchOptions.name,
                         verdicts: hatchOptions.verdicts,
                         ...(hatchOptions.fieldsRoot ? { fieldsRoot: hatchOptions.fieldsRoot } : {}),
-                        ...(hatchOptions.pageCursor && Object.keys(hatchOptions.pages ?? {}).length
-                            ? { paging: hatchOptions.pageCursor }
-                            : {}),
                     },
-                    refusesWithheld: true,
                 }
                 : {}),
             ...(meanings ? { errors: meanings } : {}),
@@ -134,6 +129,7 @@ export function defineApiProvider(definition) {
                 ...(headers === undefined ? {} : { headers }),
                 ...(admit === undefined ? {} : { admit }),
                 authenticate: typeof authenticate === "function" ? authenticate(options) : authenticate,
+                ...(publicIdentifierHeaders === undefined ? {} : { publicIdentifierHeaders }),
                 ...configured,
             });
             const connected = connect(vendor, oauth || machineGrant

package/dist/http/vendor.js

@@ -342,6 +342,7 @@ export function connect(vendor, guarded, options) {
                 method: declared.method,
                 template: declared.path,
                 ...(sendOptions?.flags ? { flags: sendOptions.flags } : {}),
+                ...(sendOptions?.context ? { context: sendOptions.context } : {}),
             };
             return Effect.flatMap(admitAddress({
                 params: request.params,
@@ -370,7 +371,11 @@ export function connect(vendor, guarded, options) {
                     request.form !== undefined ||
                     request.emptyForm))
                 return Effect.fail(new RequestRefused({ message: "A raw body cannot accompany a bulk item or another body encoding." }));
-            return Effect.flatMap(admitAddress({ path, query: request.query }), () => Effect.flatMap(options.safety.resolve(method, path), (operation) => settle({ ...operation, ...(sendOptions?.flags ? { flags: sendOptions.flags } : {}) }, Effect.suspend(() => {
+            return Effect.flatMap(admitAddress({ path, query: request.query }), () => Effect.flatMap(options.safety.resolve(method, path), (operation) => settle({
+                ...operation,
+                ...(sendOptions?.flags ? { flags: sendOptions.flags } : {}),
+                ...(sendOptions?.context ? { context: sendOptions.context } : {}),
+            }, Effect.suspend(() => {
                 let built = HttpClientRequest.make(method)(path, request.query ? { urlParams: parameterPairs(request.query) } : {});
                 if (request.headers)
                     built = HttpClientRequest.setHeaders(built, request.headers);

package/dist/index.d.ts

@@ -41,6 +41,6 @@ export type { Registry } from "./registry.js";
 export type { RemoteMcpOptions, RemoteMcpAuth, RemoteMcpRequestAuth, RemoteMcpRedirectPolicy, } from "./connectors/remote-mcp.js";
 export type { AgentRequestPrincipal, HumanRequestPrincipal, PrincipalForwarding, PrincipalRequestToken, RequestPrincipal, RequestPrincipalPolicy, RequestToken, RequestTokenInput, } from "./request-token.js";
 export type { ApiHandlerContext, ApiOAuthAccess, ApiOAuthClientAuthentication, ApiOAuthConfig, ApiOptions, ApiTool, } from "./connectors/api.js";
-export type { ConnectaBranding, ConnectaTheme, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, AgentRouteNames, ConnectorContext, ConnectorAuthDescription, ConnectorDescription, ConnectorToolDescription, ConnectorUsageGuide, ConnectorSkill, ConnectorSkillResourceContents, DescribedEndpoint, ConnectorStatus, CredentialFailureClass, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, InboundAuthRuntimeContext, UiAuthConfig, AuthResult, AuthenticatedIdentity, IdentityReference, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
+export type { ConnectaBranding, ConnectaTheme, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCatalogPeek, ConnectorCredentialValues, AgentRouteNames, ConnectorContext, ConnectorAuthDescription, ConnectorDescription, ConnectorToolDescription, ConnectorUsageGuide, ConnectorSkill, ConnectorSkillResourceContents, DescribedEndpoint, ConnectorStatus, CredentialFailureClass, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, InboundAuthRuntimeContext, UiAuthConfig, AuthResult, AuthenticatedIdentity, IdentityReference, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
 export type { ActivityActor, ActivityCatalogChange, ActivityCallSource, ActivityOutcome, ActivityPage, ActivityReadActor, ActivityReadEvent, ActivityReader, ActivityReadGate, ActivityReadPage, ActivitySink, ActivityStore, AgentFriction, ToolCallActivityEvent, } from "./activity.js";
 export { META_TOOL_NAMES } from "./meta-tool-names.js";

package/dist/index.js

@@ -211,6 +211,11 @@ export function createConnecta(config) {
     const requestAdmission = new AdmissionController(resolved.admission.requests);
     let codeAdmission;
     let executor = resolved.executor;
+    if (executor.deadlineMs !== undefined && executor.deadlineMs >= resolved.execute.watchdogMs) {
+        logger.warn(`[connecta] The executor's ${executor.deadlineMs}ms deadline does not end before execute.watchdogMs ` +
+            `(${resolved.execute.watchdogMs}ms), so programs end at the watchdog. Raise execute.watchdogMs ` +
+            "above it if your MCP clients allow requests that long.");
+    }
     // Read the identity off the configured executor, before any wrapper hides
     // it behind an anonymous object literal.
     const configuredExecutorName = executorName(executor);

package/dist/invocation.js

@@ -4,12 +4,12 @@ import { routePhrases } from "./agent-routes.js";
 import { authCall, registerAuthMethod } from "./auth/native.js";
 import { withAuthorizationHandoffEffect } from "./authorization-handoff.js";
 import { hasControlCharacters } from "./tool-name.js";
-import { cloneTool, isWriteLike, writeRefusal } from "./tool-safety.js";
+import { cloneTool, isWriteLike, READ_PROGRAM_SOURCE, readProgramRefuses, writeRefusal } from "./tool-safety.js";
 import { Cause, Context, Effect, Exit } from "effect";
 import { CallAdmissionError, isCallAdmissionError } from "./call-admission.js";
-import { boundedEchoText, classificationCode, classifyCallError, classifyWithoutAdvice, ConnectorCallError, echoedCallArgs, framingError, keyResendAdviceOf, resendAdviceOf, withResendAdvice, } from "./errors.js";
+import { boundedEchoText, clipText, classificationCode, classifyCallError, classifyWithoutAdvice, ConnectorCallError, echoedCallArgs, framingError, keyResendAdviceOf, resendAdviceOf, withResendAdvice, } from "./errors.js";
 import { downstreamValue } from "./mcp-result.js";
-import { carryFailureFacts, classifiedFailure, failureRecord, logFailure, recordedToolName, } from "./operator-record.js";
+import { carryFailureFacts, classifiedFailure, failureRecord, logFailure, recordedToolName, labelErrorClass, } from "./operator-record.js";
 import { splitAddress } from "./registry.js";
 import { causeError, runEdge, withDeadlineEffect } from "./runtime/run.js";
 import { schemaExample, validateCatalogToolInput } from "./validate.js";
@@ -84,7 +84,18 @@ function isCallerCancellation(error, signal) {
  * write it is a 2xx reply after which the handler may have applied it.
  */
 class DownstreamToolError extends Error {
+    /** Everything it said, kept for a program's report; the message is what fits a result. */
+    #text;
+    constructor(text) {
+        super(clipText(text));
+        this.#text = text;
+    }
+    fullText() {
+        return this.#text;
+    }
 }
+// Records tell the tool's own answer from a transport or runtime failure.
+labelErrorClass(DownstreamToolError, "DownstreamToolError");
 function isTimeoutFailure(error) {
     const code = error.details?.code;
     return (error.code === "timeout" ||
@@ -97,10 +108,10 @@ function assertRawMcpSuccess(kind, result) {
     const mcpResult = result;
     if (!mcpResult.isError)
         return;
-    throw new DownstreamToolError(boundedEchoText(mcpResult.content
+    throw new DownstreamToolError(mcpResult.content
         ?.filter((block) => block.type === "text")
         .map((block) => block.text ?? "")
-        .join("") || "Downstream tool call failed"));
+        .join("\n") || "Downstream tool call failed");
 }
 /**
  * Whether a failed attempt is the downstream tool's own answer. For a read:
@@ -116,6 +127,14 @@ function answeredFailure(error, write, call) {
         return error instanceof DownstreamToolError || isKnownProviderFailure(error);
     return knownCallFailure(call, error);
 }
+/**
+ * What a write gate decided about one consequential call. A dispatch goes on
+ * to admission and the connector; a refusal ends the call with `error`,
+ * recorded as an ordinary failed attempt unless `unrecorded` — a write
+ * refused only because its program already returned was never an attempt.
+ */
+/** Both program routes: no direct-call continuation applies to their calls. */
+const isProgram = (source) => source === "execute_code" || source === READ_PROGRAM_SOURCE;
 export { InvocationFailure } from "./invocation-failure.js";
 const withoutExample = ({ example: _example, ...stated }) => stated;
 /**
@@ -165,6 +184,7 @@ export class InvocationService {
             const recoveryState = recoveryRecord();
             let preInvocationAuthFailure = false;
             let answered = false;
+            let failureText;
             // A dispatched failure's advice to send it again, composed by enrich
             // only once the outcome allows it (resendAdvice), and its advice to
             // reuse an idempotency key, only where that key protects the whole
@@ -175,6 +195,10 @@ export class InvocationService {
             context.sentSecrets?.include(sentSecrets);
             // A write gate's refusal that is no attempt; see WriteGateDecision.
             let unrecorded = false;
+            // The gate's refusal states its own deadline facts; nothing timed out here.
+            let gateRefused = false;
+            // The deadline this call runs under, once its classification is known.
+            let timeoutMs = context.timeoutMs;
             let resolved;
             let activityTarget;
             // The address as written, used for activity when resolution never reached
@@ -223,8 +247,7 @@ export class InvocationService {
                         ? { ...error, nextAction: error.nextAction ?? utilityRecovery(error.code, error.message).nextAction }
                         : error;
                 const recovery = recoveryState.facts;
-                const enteredWrite = dispatchedToConnector &&
-                    ((resolved !== undefined && resolved.definition.classification !== "read") || sentSourceWrite());
+                const enteredWrite = dispatchedToConnector && ((resolved !== undefined && isWriteLike(resolved.definition)) || sentSourceWrite());
                 // A known answer alone is not dispatch evidence. Require an owned,
                 // complete ledger with a positively recorded auxiliary resource read;
                 // an empty ledger, custom entry or interruption proves nothing.
@@ -243,7 +266,7 @@ export class InvocationService {
                     return {
                         ...error,
                         code: "write_outcome_unknown",
-                        message: `${error.message} Its outcome is unknown. Check the target before repeating this call.`,
+                        message: `${error.message} It was sent once; its outcome is unknown. Check the target before repeating this call.`,
                         retryable: false,
                         ...(sentSourceWrite() ? { writeOutcome: "unknown" } : {}),
                         connector: target.connector.id,
@@ -286,7 +309,9 @@ export class InvocationService {
                         writeOutcome: "unknown",
                         ...(!recovery && error.retry === undefined
                             ? {
-                                retry: "No safe replay action exists. Re-read the target to reconcile whether the write took effect.",
+                                retry: error.toolAnswered
+                                    ? "Its outcome is unknown: its handler ran before it answered, so check its target before acting. Give the user any approval link or request id in the message. Connecta will not resend it; a call the tool's words ask for is a new call."
+                                    : "No safe replay action exists. Re-read the target to reconcile whether the write took effect.",
                             }
                             : {}),
                     };
@@ -425,10 +450,15 @@ export class InvocationService {
                             },
                             connector: target.connector.id,
                             operation: `${target.connector.id}.${target.toolName}`,
-                            nextAction: this.catalog.searchRecovery({
-                                query: target.toolName,
-                                connector: target.connector.id,
-                            }, "Inspect the current input shape if the validation findings are not sufficient."),
+                            // Findings naming the fix lead on their own; a search would only cost a turn.
+                            ...(error.validation.issues?.length && error.validation.acceptedKeys && !error.validation.truncated
+                                ? {}
+                                : {
+                                    nextAction: this.catalog.searchRecovery({
+                                        query: target.toolName,
+                                        connector: target.connector.id,
+                                    }, "Only if the validation above is not enough: inspect the schema."),
+                                }),
                             retry: `Correct the listed arguments and retry ` + `${target.connector.id}.${target.toolName}.`,
                         };
                     case "not_found":
@@ -444,7 +474,7 @@ export class InvocationService {
                             return error;
                         // The continuation nonce is spent. Let the input boundary supply
                         // its fresh-call action instead of generic availability advice.
-                        if (context.source !== "execute_code" &&
+                        if (!isProgram(context.source) &&
                             downstreamContinuation(this.catalog.requestScope, target.connector.id, `${target.connector.id}.${target.toolName}`))
                             return error;
                         return {
@@ -462,7 +492,7 @@ export class InvocationService {
                 // a write. No connector failure arrives, so the logical call's
                 // recorded requests alone decide whether a 401 left it unknown.
                 if (dispatchedToConnector &&
-                    (resolved?.definition.classification !== "read" || sentSourceWrite()) &&
+                    (resolved === undefined || isWriteLike(resolved.definition) || sentSourceWrite()) &&
                     (error.code === "cancelled" || isTimeoutFailure(error))) {
                     const departed = settleWrite(logicalCall?.sent ?? [], undefined, true);
                     if (departed !== undefined) {
@@ -487,13 +517,13 @@ export class InvocationService {
                 // Read before any step below rebuilds the details: Q8's verdict is final.
                 const settled = isSettledWrite(error);
                 // Attach host deadline facts before write recovery changes the code.
-                if (isTimeoutFailure(error)) {
+                if (isTimeoutFailure(error) && !gateRefused) {
                     const elapsedMs = Date.now() - started;
                     const operation = boundedEchoText(address, 512);
                     error = {
                         ...error,
-                        message: `Operation "${operation}" timed out during ${stage} after ${elapsedMs}ms (effective deadline ${context.timeoutMs}ms).`,
-                        details: { ...error.details, operation, stage, elapsedMs, ...defined({ deadlineMs: context.timeoutMs }) },
+                        message: `Operation "${operation}" timed out during ${stage} after ${elapsedMs}ms (effective deadline ${timeoutMs}ms).`,
+                        details: { ...error.details, operation, stage, elapsedMs, ...defined({ deadlineMs: timeoutMs }) },
                     };
                 }
                 // Downstream diagnostics were redacted under payload rules where they entered.
@@ -506,6 +536,7 @@ export class InvocationService {
                     ...defined({ resolved }),
                     dispatched: dispatchedToConnector,
                     ...(dispatchedToConnector ? { answered } : {}),
+                    ...defined({ failureText }),
                     error: details,
                 });
                 // A write refused only because its program had already returned
@@ -547,6 +578,11 @@ export class InvocationService {
             // expected, and a throw anywhere in it — a defect, to Effect — is
             // classified like a failure, as the async body this replaced did.
             const dispatch = (callSignal) => Effect.gen({ self: this }, function* () {
+                if (context.refusal) {
+                    gateRefused = true;
+                    return context.refusal;
+                }
+                let pastDeadline;
                 const admissionSignal = context.dispatchSignal
                     ? AbortSignal.any([context.dispatchSignal, ...(callSignal ? [callSignal] : [])])
                     : callSignal;
@@ -573,17 +609,20 @@ export class InvocationService {
                 activityTarget = target;
                 argumentEcho = echoedCallArgs(args ?? {}, target.definition.inputSchema);
                 sentSecrets.arguments(args ?? {}, target.definition.inputSchema);
-                const write = target.definition.classification !== "read";
-                const writeLike = isWriteLike(target.definition);
+                // Admission and presentation follow the served class. Dispatch and failure
+                // handling follow this: a source write served as a read still sends once.
+                const write = isWriteLike(target.definition);
+                if (write && context.writeTimeoutMs !== undefined)
+                    timeoutMs = context.writeTimeoutMs;
                 const canonicalAddress = `${target.connector.id}.${target.toolName}`;
-                const input = context.source !== "execute_code"
+                const input = !isProgram(context.source)
                     ? downstreamContinuation(this.catalog.requestScope, target.connector.id, canonicalAddress)
                     : undefined;
                 if (input)
                     recordDownstreamArgumentEcho(this.catalog.requestScope, argumentEcho);
                 const expectedDigest = replayClassificationDigest(this.catalog.requestScope, canonicalAddress);
                 if (expectedDigest !== undefined &&
-                    (writeLike ||
+                    (write ||
                         target.classificationFresh !== true ||
                         (yield* Effect.promise(() => classificationDigest(target.definition))) !== expectedDigest)) {
                     return {
@@ -594,9 +633,15 @@ export class InvocationService {
                 const connectorReadOnly = target.connector.readOnly === true;
                 const refusal = writeRefusal(target.definition.classification, context.source, context.readOnly || connectorReadOnly);
                 if (refusal === "read_only_endpoint") {
-                    return framingError("read_only_endpoint", `Tool "${canonicalAddress}" is a write, and ${connectorReadOnly ? `connector "${target.connector.id}"` : "this endpoint"} is read-only. No write route exists ${connectorReadOnly ? "for this connection" : "on this endpoint"}. Ask the operator for a writable connection if writes are required.`);
+                    return framingError("read_only_endpoint", `Tool "${canonicalAddress}" is a write, and ${connectorReadOnly ? `connector "${target.connector.id}"` : "this endpoint"} is read-only. No write route exists ${connectorReadOnly ? "for this connection" : "on this endpoint"}; tell the user. Only the operator can provide a writable connection.`);
+                }
+                // Below the sandbox: no guest code can reach past this, and catching it sends nothing.
+                if (context.source === READ_PROGRAM_SOURCE) {
+                    if (readProgramRefuses(target.definition)) {
+                        return framingError("destructive_tool_requires_approval", `Tool "${canonicalAddress}" can write, so ${READ_PROGRAM_SOURCE} refused it and nothing was sent. Use call_destructive_tool for this one call, or execute_code for a program that writes; the MCP host can request approval for either.`);
+                    }
                 }
-                if (refusal === "destructive_tool_requires_approval") {
+                else if (refusal === "destructive_tool_requires_approval") {
                     return framingError("destructive_tool_requires_approval", `Tool "${canonicalAddress}" is a write. ${routePhrases(context).writeNeedsApproval}`);
                 }
                 // Remote MCP tools advertise their input schema in the catalog. Validate
@@ -614,10 +659,11 @@ export class InvocationService {
                         return classifyCallError(invalid);
                 }
                 // Source writes keep program write accounting; only effective writes spend W10 budget.
-                if (writeLike && context.beforeWrite) {
+                if (write && context.beforeWrite) {
                     const decision = yield* context.beforeWrite(target, args ?? {});
                     if (decision.kind === "refuse") {
                         unrecorded = decision.unrecorded === true;
+                        gateRefused = true;
                         return decision.error;
                     }
                 }
@@ -627,7 +673,7 @@ export class InvocationService {
                 const call = (permit) => Effect.gen({ self: this }, function* () {
                     const operationContext = this.registry.contextFor(target.connector.id, this.catalog.baseUrl, this.catalog.requestScope, defined({
                         signal: callSignal,
-                        timeoutMs: context.timeoutMs,
+                        timeoutMs,
                         defer: this.catalog.defer,
                         routes: context.routes,
                     }));
@@ -666,19 +712,27 @@ export class InvocationService {
                         const code = classifyCallError(causeError(cause, connectorContext.signal)).code;
                         preInvocationAuthFailure = code === "auth_required" || code === "downstream_oauth_required";
                     })));
-                    // Cancellation can arrive during admission or context construction.
+                    // Reflect.apply, never the function's own `call` or `apply`
+                    // property, which anyone holding the function could replace.
+                    const options = { definition: cloneTool(target.definition), ...defined({ input }) };
+                    const entry = callEntry(connector, callTool);
+                    // The final gate. Cancellation can arrive during admission or context
+                    // construction, and resolution, admission or auth can spend the deadline.
+                    // Nothing is awaited from here to the connector call below, so a call
+                    // refused here is proven unsent and one let through left in time (INV-9).
                     if (admissionSignal?.aborted)
                         throw admissionSignal.reason;
+                    if (context.dispatchDeadline && Date.now() >= context.dispatchDeadline.at) {
+                        gateRefused = true;
+                        pastDeadline = context.dispatchDeadline.refusal(canonicalAddress);
+                        return undefined;
+                    }
                     dispatchedToConnector = true;
                     recordCallEntry(this.catalog.requestScope, {
                         address: canonicalAddress,
-                        classification: writeLike ? "write" : "read",
+                        classification: write ? "write" : "read",
                         fresh: target.classificationFresh === true,
                     }, target.definition);
-                    // Reflect.apply, never the function's own `call` or `apply`
-                    // property, which anyone holding the function could replace.
-                    const options = { definition: cloneTool(target.definition), ...defined({ input }) };
-                    const entry = callEntry(connector, callTool);
                     if (entry)
                         return yield* entry(target.toolName, args ?? {}, options).pipe(Effect.provideContext(viewServices(connectorContext)));
                     return yield* Effect.tryPromise({
@@ -707,6 +761,8 @@ export class InvocationService {
                     const reply = yield* timed((elapsed) => {
                         connectorMs += elapsed;
                     }, call(permit));
+                    if (pastDeadline)
+                        return { pastDeadline };
                     if (target.connector.kind === "mcp" && isDownstreamInputResult(reply)) {
                         // The downstream suspended for input. A handler asks for
                         // input from inside its run, so a write may already have
@@ -747,8 +803,15 @@ export class InvocationService {
                     // An inner call's verdict that does not hold for this one is withdrawn.
                     if (failureWrite && !answered)
                         forgetProviderFailure(details);
+                    // The tool's own words, which a program's write accounting keeps.
+                    if (failureWrite && attemptError === thrown && thrown instanceof DownstreamToolError) {
+                        details.toolAnswered = true;
+                        failureText = thrown.fullText();
+                    }
                     return details;
                 }
+                if ("pastDeadline" in attempt.value)
+                    return attempt.value.pastDeadline;
                 if ("inputRequired" in attempt.value) {
                     inputRequiredValue = { value: attempt.value.value };
                     return undefined;
@@ -777,6 +840,7 @@ export class InvocationService {
                 ? withDeadlineEffect(dispatch, {
                     ...defined({
                         timeoutMs: context.timeoutMs,
+                        extendMs: () => (timeoutMs ?? 0) - (context.timeoutMs ?? 0),
                         signal: context.requestSignal,
                     }),
                     timeoutError: new ConnectorCallError("timeout", `Tool call timed out after ${context.timeoutMs}ms`),
@@ -801,7 +865,7 @@ export class InvocationService {
             // Q8 settles a result too: a write an undeclared 401 left unknown is no
             // success, whatever its handler made of the 401, and its result is not
             // processed.
-            if (dispatchedToConnector && (completed.definition.classification !== "read" || sentSourceWrite())) {
+            if (dispatchedToConnector && (isWriteLike(completed.definition) || sentSourceWrite())) {
                 const unknown = settleWriteResult(logicalCall?.sent ?? []);
                 if (unknown) {
                     failureAdvice = failureKeyAdvice = undefined;
@@ -818,7 +882,7 @@ export class InvocationService {
                 resultProcessingMs += elapsed;
             }, Effect.tap(withDeadlineEffect(() => processing, {
                 ...defined({
-                    timeoutMs: context.timeoutMs === undefined ? undefined : Math.max(1, context.timeoutMs - (Date.now() - started)),
+                    timeoutMs: timeoutMs === undefined ? undefined : Math.max(1, timeoutMs - (Date.now() - started)),
                     signal: context.requestSignal,
                 }),
                 timeoutError: new ConnectorCallError("timeout", "Result processing exceeded the tool call deadline."),

package/dist/meta-output.js

@@ -1,7 +1,7 @@
 import { Validator } from "@cfworker/json-schema";
 import { CATALOG_SEARCH_RESULT_SCHEMA } from "./catalog-service.js";
 import * as z from "zod";
-import { advertisedSchema } from "./advertised-schema.js";
+import { advertisedSchema, openOutputSchema } from "./advertised-schema.js";
 const error = z
     .object({
     code: z.string(),
@@ -9,14 +9,13 @@ const error = z
     retryable: z.boolean(),
 })
     .passthrough();
-const format = z.enum(["json", "text"]);
 const counts = z.object({
     attempted: z.number().int().nonnegative(),
     admitted: z.number().int().nonnegative(),
     succeeded: z.number().int().nonnegative(),
     failed: z.number().int().nonnegative(),
 });
-export const EXECUTE_OUTPUT = advertisedSchema(z
+export const EXECUTE_OUTPUT = openOutputSchema(advertisedSchema(z
     .object({
     result: z.unknown().optional(),
     error: error.optional(),
@@ -26,19 +25,14 @@ export const EXECUTE_OUTPUT = advertisedSchema(z
     emittedDiscarded: z.number().int().nonnegative().optional(),
     diagnostics: z.record(z.string(), z.unknown()).optional(),
 })
-    .passthrough());
-export const SKILLS_OUTPUT = advertisedSchema(z
-    .object({
-    name: z.string().optional(),
-    text: z.string().optional(),
-    format: format.optional(),
-    skills: z.array(z.object({ name: z.string(), uri: z.string(), description: z.string() })).optional(),
-    error: error.optional(),
-})
-    .passthrough());
-// Catalog publication, SDK advertisement and validation share one schema.
+    .passthrough()), {
+    type: "object",
+    required: ["hostCalls"],
+    properties: { result: {}, error: { type: "object" }, hostCalls: { type: "object" }, logs: { type: "string" } },
+});
+// The server validates every page against the full catalog contract; clients get the open summary.
 const searchValidator = new Validator(CATALOG_SEARCH_RESULT_SCHEMA, "2020-12", false);
-export const SEARCH_OUTPUT = {
+export const SEARCH_OUTPUT = openOutputSchema({
     "~standard": {
         version: 1,
         vendor: "connecta",
@@ -50,12 +44,24 @@ export const SEARCH_OUTPUT = {
             output: () => CATALOG_SEARCH_RESULT_SCHEMA,
         },
     },
-};
-export const AUTHORIZE_OUTPUT = advertisedSchema(z
+}, {
+    type: "object",
+    required: ["catalogErrors", "tools", "total", "offset", "limit", "hasMore"],
+    properties: {
+        catalogErrors: { type: "array" },
+        tools: { type: "array", items: { type: "object", required: ["name", "address"] } },
+        total: { type: "integer" },
+        offset: { type: "integer" },
+        limit: { type: "integer" },
+        hasMore: { type: "boolean" },
+        nextOffset: { type: "integer" },
+    },
+});
+export const AUTHORIZE_OUTPUT = openOutputSchema(advertisedSchema(z
     .object({
     connector: z.string().optional(),
     recovery: z.string().optional(),
     message: z.string().optional(),
     error: error.optional(),
 })
-    .passthrough());
+    .passthrough()), { type: "object", properties: { connector: { type: "string" }, message: { type: "string" } } });

package/dist/meta-tool-names.d.ts

@@ -1,2 +1,2 @@
-/** The complete upward meta-tool set, shared with the CLI. */
+/** The upward meta-tool set every meta endpoint lists, shared with the CLI. */
 export declare const META_TOOL_NAMES: readonly string[];

package/dist/meta-tool-names.js

@@ -1,3 +1,3 @@
 import { META_TOOL_NAMES as names } from "../bin/meta-tool-names.mjs";
-/** The complete upward meta-tool set, shared with the CLI. */
+/** The upward meta-tool set every meta endpoint lists, shared with the CLI. */
 export const META_TOOL_NAMES = names;