@zackbart/connecta 0.18.3 → 0.20.0

package/documentation/connectors.md

@@ -160,6 +160,29 @@ is that machinery extracted once ([#341](https://github.com/zackbart/connecta/is
 one `guardedFetch({ provider, baseUrl, headers, maxResponseBytes, authenticate })`
 factory returning the transport a connector sends every request through.
 
+```ts
+const send = guardedFetch({
+  provider: "Billing",
+  baseUrl: "https://billing.internal.example/v1",
+  maxResponseBytes: 4 * 1024 * 1024,
+  headers: { Accept: "application/json" },
+  authenticate: async (ctx) => {
+    const token = await ctx.credential?.get();
+    if (!token) throw new ConnectorCallError("auth_required", "...");
+    return { Authorization: `Bearer ${token}` };
+  },
+});
+
+const invoice = await send(
+  { method: "GET", path: `/invoices/${id}` },
+  ctx,
+  (response) => {
+    if (!response.ok) throw billingFailure(response.status);
+    return response.json();
+  },
+);
+```
+
 What it owns is mechanical and provider-independent:
 
 - **Confinement.** A request path is provider-relative, carries no query or
@@ -212,7 +235,7 @@ supplies the third caller that would settle it.
 ## MCP version skew
 
 Connecta deliberately sits between protocol generations
-([full revision inventory](./mcp-2026-07-28.md)):
+([full revision inventory](https://github.com/zackbart/connecta/blob/main/records/mcp-2026-07-28.md)):
 
 - **Inbound:** `/mcp` serves both the 2026-07-28 revision and legacy 2025
   clients. Modern clients negotiate with `server/discover` and do not send

package/documentation/linear.md

@@ -179,4 +179,4 @@ settings at construction.
 This connection is audited against
 [the provider conventions](./provider-conventions.md). Its verdict per
 convention, including every recorded exception, is the Linear section of
-[the provider audit](./provider-audit.md).
+[the provider audit](https://github.com/zackbart/connecta/blob/main/records/provider-audit.md).

package/documentation/meta-tools.md

@@ -192,36 +192,10 @@ offsets and totals refer to that exact compact text.
 A `call_tool` truncation notice carries both the historical `resultId` and an
 exact `nextAction: { tool: "get_result", arguments: { id, offset: 0 } }`. The
 handle is therefore
-directly actionable without copying an identifier out of prose; re-calling with
-`fields` remains the smaller alternative when projection is possible. Program results and oversized discovery responses carry no such
-route — paging a program's return value is a refused shape, because a program
-can shrink anything before it returns.
-
-`fields` keeps its historical flat `{ "<path>": value }` result when every
-requested dot-path resolves. Dot notation traverses objects; append `[]` to an
-array field before continuing, as in `results[].id`. Empty arrays resolve to
-empty arrays. An exact downstream
-`$connecta` field is always escaped under `data`. If any path misses—or that
-reserved name is selected—the result carries matches under `data` and reserves `$connecta` for a
-`type: "field_projection"` recovery record naming each `unmatchedFields`
-entry. A path that resolves for only some array elements stays in `data` and
-appears in `partialFields`; its unresolved positions serialize as `null`, while
-the recovery record distinguishes them from genuine downstream nulls. A path
-that misses every element appears in `unmatchedFields` and is omitted from
-`data`. Both lists scale with requested paths, never with array length. When a
-miss matches a declared array path except for `[]`, the record also carries the
-traversal hint. The discriminator means downstream fields
-named `data`, `projection`,
-or `$connecta` remain ordinary values nested under `data`, never apparent
-metadata. A declared output schema contributes a bounded `availableFields`
-list and a `schemaCoverage` verdict. Only a completely analyzed, closed schema
-can label paths `invalidFields`; open, patterned, tuple, unresolvable, cyclic,
-`$ref`-sibling, or traversal-limited shapes stay `partial`. Traversal bounds
-depth, nodes, path count, individual path characters/bytes, and cumulative path
-characters/bytes before sorting or rendering. Without a schema, Connecta
-reports only observed misses and does not pretend it knows the complete runtime
-shape. API values and JSON-parseable downstream MCP text blocks follow the same
-rule.
+directly actionable without copying an identifier out of prose. Program results
+and oversized discovery responses carry no such route — paging a program's
+return value is a refused shape, because a program can shrink anything before
+it returns.
 
 ## Lexical discovery
 

package/documentation/mixpanel.md

@@ -145,4 +145,4 @@ either way and still needs restrained use.
 This connection is audited against
 [the provider conventions](./provider-conventions.md). Its verdict per
 convention, including every recorded exception, is the Mixpanel section of
-[the provider audit](./provider-audit.md).
+[the provider audit](https://github.com/zackbart/connecta/blob/main/records/provider-audit.md).

package/documentation/notion.md

@@ -268,4 +268,4 @@ from this connection, not hidden behind a generic call.
 This connection is audited against
 [the provider conventions](./provider-conventions.md). Its verdict per
 convention, including every recorded exception, is the Notion section of
-[the provider audit](./provider-audit.md).
+[the provider audit](https://github.com/zackbart/connecta/blob/main/records/provider-audit.md).

package/documentation/operations.md

@@ -96,14 +96,14 @@ optional.
 | `admission.requests?` | 16 active / 32 queued / 5 s / 1 s | global FIFO `/mcp` capacity, taken before auth ([request admission](./request-admission.md)) |
 | `admission.code?` | 2 active / 8 queued / 5 s / 1 s | fallback pool for an executor that owns no `acquire()`; ignored with a warning when it does |
 
-Options removed in earlier releases throw with their migration named rather
-than falling back to a default: `toolkits`
-([#178](https://github.com/zackbart/connecta/issues/178)), `credentials.health`
-([#179](https://github.com/zackbart/connecta/issues/179)), `surface` and
-`calls.maxBatchResultBytes`
-([#273](https://github.com/zackbart/connecta/issues/273)), and the flat v0.6
-paths. Silently ignoring a removed option is how a deployment ends up running a
-policy its config file says it has.
+An unknown own option throws before construction does deployment work. The
+check covers the top level, every configuration group, admission pools,
+branding icons, and server icons; the error names the rejected path without
+copying its value. Removed options such as `toolkits`, `credentials.health`,
+`surface`, `calls.maxBatchResultBytes`, and the flat v0.6 paths now take that
+same path. The [upgrade guide](./upgrading.md#removed-options-that-throw) keeps
+their historical mappings. Silently ignoring either a typo or a removed option
+is how a deployment runs a policy its config file does not describe.
 
 ### Deployment as a release unit
 
@@ -150,7 +150,7 @@ are in it and that no unshippable path leaked in — including any
 Cloudflare-named connector or storage path (`connectors/cloudflare`,
 `storage/cloudflare`) anywhere in the artifact, `dist/` and `examples/` alike —
 derives the shipped guide list from which guides still carry a stub marker,
-hands the packed path list to `scripts/check-packed-links.mjs`, and then runs
+hands the packed path list to `check-doc-links --packed`, and then runs
 `connecta init` and builds and runs the generated deployment's own container.
 
 That last step enforces the packed-link policy, which is one sentence: **every
@@ -224,39 +224,43 @@ in.
 | `catalog.test.ts` | lexical ranking and the compact schema renderer — `const`, `allOf` beside siblings, `$ref`, the depth limit, per-schema caching, and 2020-12 keyword compatibility |
 | `clerk.test.ts` | protected-resource metadata, the browser sign-in config, OAuth and session tokens, cached best-effort activity labels with their caps, the hand-applied `azp` rejection, and the `allowedDomains` allowlist including every lookalike that must not be repaired into a match |
 | `cloudflare-provider.test.ts` | `cloudflare()` construction, tool surface, request building, projections, typed failures, and credential test |
-| `cloudflare-registry.test.ts` | the same provider inside a real deployment: discovery including compact page bounds, addressing, and admission through the registry |
 | `code-first-surface.test.ts` | the seven-tool surface itself — an executor required, every removed option and top-level tool refused, compact always-loaded routing pinned below 1,000 characters, complete on-demand usage served, and `connecta.ui` findable before connector search |
 | `codemode-compat.test.ts` | the `Executor` seam staying structurally compatible with `@cloudflare/codemode`'s `DynamicWorkerExecutor`, enforced by `tsc` |
-| `config.test.ts` | the grouped `ConnectaConfig` boundary — each group forwarding to its internals, malformed admission bounds failing construction, and one complete migration error for legacy own-properties |
+| `config.test.ts` | the grouped `ConnectaConfig` boundary — each group forwarding to its internals, malformed admission bounds failing construction, and unknown own-properties rejected by their complete path before construction does work |
 | `credentials.test.ts` | the pure stored-shape classifier (containment, not equality) and the AES-GCM vault: round-trip, ciphertext bound to its connector id, named field sets, masked metadata, wrong-key rejection, deletion, coexistence with OAuth keys |
 | `d1-activity-example.test.ts` | the Worker example's deployment-owned D1 activity store: actor namespace round-trip, payload-free friction reconstructed from the persisted code, and agreement with the package's friction table |
 | `downstream-oauth.test.ts` | `KvOAuthProvider` round-trips and races, `auth_required` versus `error`, `startAuth`/`finishAuth`, callback refusal equality, bounded diagnostics, and HTML escaping |
 | `errors.test.ts` | `ConnectorCallError` codes, retryable defaults and overrides, `retryAfterMs` round-trip, typed-over-heuristic classification, `AbortError` as a retryable timeout, and framing errors |
 | `execute.test.ts` | the code-mode host bridge: identifier sanitization, MCP-result unwrapping, sandbox provider construction, authenticated thrown-failure framing, fail-closed filtering of destructive and unannotated tools, MCP/code-mode invocation parity, and payload-free describe diagnostics |
 | `execute-emit.test.ts` | `connecta.emit` (M1–M10) — block validation, budgets, the provider, delivery after the result envelope on success only, and the defaults |
-| `execute-ui.test.ts` | `connecta.ui` (U1–U9) — validation, multiplicity and budget, the provider, `_meta` delivery, and the Apps shell |
+| `execute-ui.test.ts` | display-only `connecta.ui` (U1–U13) — one-string validation, multiplicity and budget, the provider, `_meta` delivery, shell isolation, and the absence of a payload-to-host call path |
 | `executor-admission.test.ts` | the portable bounded FIFO both pools use: active and queue ceilings, stable retryable overload, queue timeout, cancellation removal, idempotent release, shutdown |
 | `guarded-fetch.test.ts` | the guarded transport — construction, request building, destination confinement, and response handling |
 | `guest-api-contract.test.ts` | the shared guest contract on the Dynamic Worker, including caught call, typed inline describe recovery, discovery, utility, batch, and budget failure codes; plus the real authority boundary — local `data:` fetch, denied egress, unresolved DNS, empty environment paths, unavailable filesystem/HTTP builtins, and present runtime globals |
-| `linear-provider.test.ts` / `linear-registry.test.ts` | the Linear proxy's construction, classification, and guide; then the same connector inside a real deployment |
-| `meta-tools.test.ts` | the registry-backed meta-tools: bounded discovery with page and address maxima, compact descriptions and the complete on-demand usage skill, compact and JSON schemas with constraints, typed describe recovery and suggestions, structured errors, connector-guide selection and summary bounds, stored-credential drift, catalog health, field projection, truncation and `get_result`, per-connector result bounds, probe timeouts, and unavailable or unknown browse recovery |
-| `mixpanel-provider.test.ts` / `mixpanel-registry.test.ts` | the Mixpanel proxy, its conditional-input guide and complete reviewed schema-digest manifest, then the same connector inside a real deployment |
-| `notion-provider.test.ts` / `notion-registry.test.ts` | Notion's deliberate tool surface, including declined expanded page inputs, request construction, lean projections, both pagination conventions, error mapping, and writes; then the connector in a real deployment |
+| `linear-provider.test.ts` | the Linear proxy's construction, classification, and guide |
+| `meta-tools-call.test.ts` | registry-backed calls: structured errors, truncation and `get_result`, per-connector result bounds, JSON representation failures, MCP content bounds, and offset alignment |
+| `meta-tools-search.test.ts` | registry-backed discovery: bounded search with page and address maxima, compact and JSON schemas with constraints, typed describe recovery and suggestions, and structured-result compatibility |
+| `meta-tools.test.ts` | the remaining registry-backed meta-tools: the complete on-demand usage skill, connector-guide selection and summary bounds, stored-credential drift, catalog health, authorization, probe timeouts, and unavailable or unknown browse recovery |
+| `mixpanel-provider.test.ts` | the Mixpanel proxy, its conditional-input guide and complete reviewed schema-digest manifest |
+| `notion-provider.test.ts` | Notion's deliberate tool surface, including declined expanded page inputs, request construction, lean projections, both pagination conventions, error mapping, and writes |
 | `operator-boundary.test.ts` | the operator row of the decisions table, after every mutation route: authentication material managed without moving a declared structure, and the one honest exception — a credential write making a remote catalog appear, which is discovery arriving, not an operator editing the deployment |
 | `operator-store.test.ts` | `src/operator-ui/app/store.ts` against a fake browser: the Clerk listener, `gate()`, the generation fence, and the request path |
 | `provider-conventions.test.ts` | the conventions a test can hold: hand-written providers refusing schemas they cannot enforce (H5), their compact discovery schemas staying complete (H7), Cloudflare stating its second pagination convention in the schema (H10), and Notion saying it has no escape hatch (H14) |
-| `registry.test.ts` | construction and id validation, startup warnings, address resolution, catalog TTL/persistence/completeness, agent-only stale-while-revalidate with cross-request single-flight shared with blocking reads in both start orders, owned teardown, invalidation/fingerprint guards, blocking diagnostics, and broken-connector isolation |
+| `provider-registry.test.ts` | all six maintained providers inside real deployments: boot, description, address, catalog, storage, credential, admission, and activity isolation; plus provider-specific discovery and guide contracts |
+| `registry.test.ts` | construction and id validation, startup warnings, address resolution, version 2 catalog TTL/persistence/completeness, agent-only stale-while-revalidate with cross-request single-flight shared with blocking reads in both start orders, owned teardown, invalidation/fingerprint guards, blocking diagnostics, and broken-connector isolation |
 | `remote-mcp.test.ts` | `remoteMcp()` against an in-process server through the `_transportFactory` seam: passthrough, downstream `isError`, Workers-safe output-schema validation, request-scoped client reuse and at-most-once scope close; plus the real transport's manual redirect policy, destination guard, credential containment, and downstream session termination |
-| `remote-mcp-credential.test.ts` | `remoteMcp()` drawing a static key from `/credentials`: the declared slot and its refusal of named fields and bad header names, header framing (bearer, bare, and the two `Basic` forms) observed on the wire, an empty slot failing as `auth_required` rather than reaching the downstream, a value carrying a control character refused before framing and absent from every surface — `call_tool`, `status`, the Test result, `lastError`, and the thrown error — rotation replacing the cached client and a connect already in flight while a wiped value fails the next call, the Test action's catalog probe and scope close, the cleartext-destination warning, and the vault and `authorize_connector` handoff end to end |
+| `remote-mcp-credential.test.ts` | `remoteMcp()` drawing a static key from `/credentials`: the declared slot and its refusal of named fields and bad header names, header framing (bearer, bare, and the two `Basic` forms) observed on the wire, an empty slot failing as `auth_required` rather than reaching the downstream, a value carrying a control character refused before framing and absent from every surface — `call_tool`, `status`, the Test result, the payload-free activity event, and the thrown error — rotation replacing the cached client and a connect already in flight while a wiped value fails the next call, the Test action's catalog probe and scope close, the cleartext-destination warning, and the vault and `authorize_connector` handoff end to end |
 | `remote-mcp-pagination.test.ts` | the `tools/list` cursor chain in both directions — exact cursor handoff, first-wins dedup, a failed later page rejecting rather than returning its prefix, the runaway backstops, the tool-metadata re-prime across pages, and paginated catalogs reaching the discovery path |
 | `request-admission.test.ts` | `/mcp` bounded before auth, the stable 503 and `Retry-After`, health and operator responsiveness under saturation, payload-free counters, queued cancellation, shutdown rejection while active work drains, and the separate fallback code pool |
 | `result-shapes.test.ts` | passive output-shape learning: value-free bounded inference, merging, 256-entry LRU eviction, 24-hour expiry, runtime isolation, read-only admission, declared-schema precedence, definition-change invalidation, discovery provenance, and failure isolation |
-| `revenuecat-provider.test.ts` / `revenuecat-registry.test.ts` | the RevenueCat proxy's per-project key scoping and account-wide OAuth guides, its purpose-bearing summary, the argued borderline verdicts in its digest-free manifest, and the deliberately unclassified `render-paywall-screenshot`; then two project-scoped keys as two connectors in a real deployment |
-| `server.test.ts` | end-to-end `/mcp` (401 → compact initialize instructions → seven compact definitions with bounded connector inventory → complete usage skill → `call_tool`), conditional guide pointers, open routes, Clerk `.well-known` metadata without network, code mode, and deferred catalog reads through both discovery surfaces |
+| `revenuecat-provider.test.ts` | the RevenueCat proxy's per-project key scoping and account-wide OAuth guides, its purpose-bearing summary, the argued borderline verdicts in its digest-free manifest, and the deliberately unclassified `render-paywall-screenshot` |
+| `server.test.ts` | end-to-end `/mcp` (401 → compact initialize instructions → seven compact definitions with bounded connector inventory and exact model-only Apps metadata → complete usage skill → `call_tool`), conditional guide pointers, open routes, Clerk `.well-known` metadata without network, code mode, and deferred catalog reads through both discovery surfaces |
 | `server-route-contracts.test.ts` | the route contracts `server.ts` must keep byte-identical: every built-in answered ahead of connector routes inside the security wrapper, open data-free shells with framing denied, per-route auth and same-origin requirements with exact 401/403/405 bodies, and OAuth `verifyState`-before-`finishAuth` ordering |
 | `startup-warnings.test.ts` | every construction-time `logger.warn` and, as importantly, the conditions that must *not* trigger one: open mode with a credential or OAuth connector, `publicUrl` unset beside OAuth, dropped branding and `uiAuth` URLs, a missing `verifyState`, a credential test-hook mismatch, and an unusable `calls.maxResultBytes` |
-| `stripe-provider.test.ts` / `stripe-registry.test.ts` | the Stripe proxy's mixed-mode OAuth and fixed-mode header contracts, admission, exact account selectors, and no-guess rule; then fixed credentials in a real deployment |
-| `ui.test.ts` | the server shell and `/ui/*` routes and the app's pure state rules from `view.ts` — filtering, page routing and capability states, credential management, gated `/ui/data` with broken-connector isolation and registry-owned catalog-observation containment, and the URL safety gates |
+| `stripe-provider.test.ts` | the Stripe proxy's mixed-mode OAuth and fixed-mode header contracts, admission, exact account selectors, and no-guess rule |
+| `operator-view.test.ts` | the app's pure state rules from `view.ts`: filtering, page routing, capability states, activity summaries, drift display, and identity reset |
+| `ui-credentials.test.ts` | credential-management routes: save, test, delete, validation, authentication, same-origin checks, and multi-field credential shapes |
+| `ui.test.ts` | the server shell and remaining `/ui/*` routes: gated `/ui/data` with broken-connector isolation and registry-owned catalog-observation containment, plus the URL safety gates |
 | `validate.test.ts` | `validateToolInput()` — a returned (not thrown) `invalid_args` naming the path, `additionalProperties: false` enforcement, per-schema validator caching, and an unusable schema passed through with one warning |
 
 ### Node-bound (`NODE_ONLY_SUITES`)
@@ -282,15 +286,15 @@ justification for *not* re-running it in workerd, so "it was easier" is not one.
 | `quickjs-log-limits.test.ts` | bounded `console.*` capture — per-entry cut, cumulative character and transport budgets, escape-heavy floods preserving the guest result | runs the Node QuickJS child-process executor |
 | `suite-partition.test.ts` | this partition, including itself: every `*.test.ts` in exactly one list, stale entries and empty reasons refused | walks the test directory to guard the partition |
 | `template-file-activity.test.ts` | the Node template's own activity store — persistence across restart, torn-line repair, newest-first paging, and compaction past the slack window | runs it against real files |
-| `upgrade-guide.test.ts` | the [upgrade guide](./upgrading.md)'s claims about somebody else's deployment — the generated file inventory, the seven tool names doctor demands, version boundaries that actually shipped, a bump target that is this release, and the three places a reader finds it | reads the guide, the template tree, and the CLI with Node filesystem APIs |
-| `version.test.ts` | `CONNECTA_VERSION` matching `package.json` | reads `package.json` with Node filesystem APIs |
+| `upgrade-guide.test.ts` | the [upgrade guide](./upgrading.md)'s claims about somebody else's deployment — the generated file inventory, the seven tool names doctor demands, version boundaries that actually shipped, the exact newest boundary and generation B endpoint matching this release, a bump target that is this release, and the three places a reader finds it | reads the guide, the template tree, and the CLI with Node filesystem APIs |
+| `version.test.ts` | `CONNECTA_VERSION` matching `package.json` and the Node template's exact dependency pin | reads both package manifests with Node filesystem APIs |
 
 ### Outside `npm run check`
 
 | Suite | Covers |
 | --- | --- |
 | `browser/operator-ui.spec.ts` | the operator wiring in a real browser: Clerk loader order across its version redirect and a real load failure, the shell staying open until authentication, credential and access-token and OAuth flows end to end, drift shown without naming a tool, and every failure and empty state |
-| `browser/program-ui.spec.ts` | the Apps shell in a real browser: a bound view merging fixed and declared arguments and correlating concurrent reads, and the one-string payload receiving no read bridge ([program UI read calls](./program-ui-read-calls.md)) |
+| `browser/program-ui.spec.ts` | the display-only Apps shell in a real browser: local payload JavaScript runs, `connecta` stays absent, and forged payload messages never become host tool calls |
 
 **The `_transportFactory` seam.** `RemoteMcpOptions._transportFactory` is
 internal, not public API: when set, `remoteMcp()` uses that `Transport` instead

package/documentation/provider-conventions.md

@@ -183,10 +183,9 @@ tokens.
 
 ### H8 — Every tool declares an `outputSchema`
 
-Declared outputs are what produce `outputKeys` and the `fields` projection's
-`availableFields`, and they let a program reduce a result without first
-fetching one to look at. Connecta measured *declared* output schemas at 0 of 30
-tools on one real deployment and 3 of 30 on another
+Declared outputs produce `outputKeys` and let a program reduce a result without
+first fetching one to look at. Connecta measured *declared* output schemas at 0
+of 30 tools on one real deployment and 3 of 30 on another
 ([#282](https://github.com/zackbart/connecta/issues/282)) — nearly every tool an
 agent meets is a shape it can only learn by calling. A maintained provider has
 no excuse to join that majority.
@@ -651,7 +650,7 @@ runs this document against each of the six providers and returns a verdict per
 convention: **meets**, **misses** (with the fix), or **not applicable** (with
 the reason). A convention is never quietly skipped, and an accepted miss is
 recorded as a provider-specific exception with its argument, not left blank.
-Its six reports live in [provider-audit.md](./provider-audit.md), and the
+Its six reports live in [provider-audit.md](https://github.com/zackbart/connecta/blob/main/records/provider-audit.md), and the
 mechanically checkable half of the hand-written bar runs on every test run in
 [`test/provider-conventions.test.ts`](https://github.com/zackbart/connecta/blob/main/test/provider-conventions.test.ts) —
 so a convention that was met once stays met, or fails loudly.

package/documentation/revenuecat.md

@@ -298,4 +298,4 @@ still needs restrained use.
 This connection is audited against
 [the provider conventions](./provider-conventions.md). Its verdict per
 convention is the RevenueCat section of
-[the provider audit](./provider-audit.md).
+[the provider audit](https://github.com/zackbart/connecta/blob/main/records/provider-audit.md).

package/documentation/stripe.md

@@ -251,4 +251,4 @@ about rather than read:
 This connection is audited against
 [the provider conventions](./provider-conventions.md). Its verdict per
 convention, including every recorded exception, is the Stripe section of
-[the provider audit](./provider-audit.md).
+[the provider audit](https://github.com/zackbart/connecta/blob/main/records/provider-audit.md).

package/documentation/upgrading.md

@@ -57,7 +57,7 @@ exist so far:
 | --- | --- | --- |
 | **pre-template** | before 0.10.2 | no `connecta init` existed; hand-written, or copied from the retired `examples/node` |
 | **A** | 0.10.2 – 0.15.1 | `.env.example`, `.gitignore`, `AGENTS.md`, `CLAUDE.md`, `README.md`, `package.json`, `src/index.ts`, `tsconfig.json` |
-| **B** | 0.16.0 – 0.18.3 | adds `.dockerignore`, `Dockerfile`, `docker-compose.yml`, and `src/file-activity.ts`; `src/index.ts` grows the four commented operator blocks; `.env.example` ships `CONNECTA_TOKEN=` empty |
+| **B** | 0.16.0 – 0.20.0 | adds `.dockerignore`, `Dockerfile`, `docker-compose.yml`, and `src/file-activity.ts`; `src/index.ts` grows the four commented operator blocks; `.env.example` ships `CONNECTA_TOKEN=` empty |
 
 Generation A is a decade in template years and identifying it precisely does
 not matter, because you are about to reconstruct it exactly rather than guess
@@ -106,7 +106,7 @@ know what to preserve, once to know what to re-verify at the end.
 ### Bump the pin and install
 
 ```sh
-npm pkg set dependencies.@zackbart/connecta=0.18.3
+npm pkg set dependencies.@zackbart/connecta=0.20.0
 npm install
 ```
 
@@ -130,7 +130,7 @@ Generate the *current* template beside the base you already made, into the same
 `$SCRATCH`:
 
 ```sh
-(cd "$SCRATCH" && npx @zackbart/connecta@0.18.3 init current)
+(cd "$SCRATCH" && npx @zackbart/connecta@0.20.0 init current)
 ```
 
 You now have a three-way merge with a real base: `$SCRATCH/base` is what this
@@ -186,7 +186,7 @@ A deployment older than 0.10.2 has no base to diff against. Do not try to
 manufacture one. Instead:
 
 1. `SCRATCH=$(mktemp -d)`, then
-   `(cd "$SCRATCH" && npx @zackbart/connecta@0.18.3 init current)` — there is no
+   `(cd "$SCRATCH" && npx @zackbart/connecta@0.20.0 init current)` — there is no
    `base` leg here, only the current template to read from.
 2. Copy `$SCRATCH/current` into the deployment file by file, **skipping
    `src/index.ts`**.
@@ -207,6 +207,39 @@ first, so cross them bottom-up: start at the oldest one still above this
 deployment's pin and work back up the page, because each boundary assumes the
 older ones are already done.
 
+### 0.19.0 → 0.20.0
+
+Three intake paths become deliberately strict. None changes storage, the two
+deployment shapes, or the exact seven-tool MCP surface.
+
+- `createConnecta` now rejects every unknown own configuration property by its
+  complete path. Remove typos and options retired before 0.19, including the
+  top-level `toolkits`, `credentialHealth`, `surface`, and `maxResultBytes`,
+  plus `credentials.health` and `calls.maxBatchResultBytes`. Connector, auth,
+  storage, activity-store, logger, deployment-metadata, and executor
+  implementations remain open objects; their implementation-specific fields
+  are not configuration typos.
+- `call_tool` and `call_destructive_tool` no longer accept `fields`. Put
+  projection in one `execute_code` program. For a legitimate oversized direct
+  read, call without `fields` and follow the returned `get_result` action; that
+  paging path remains part of the seven-tool surface.
+- `connecta.ui` accepts one HTML string and is display-only. Remove its second
+  read-binding argument and any page calls to `connecta.read`. Fetch and shape
+  data in the program before rendering, then return the same compact summary
+  the view initially displays. Views cannot call any Connecta tool.
+
+The Node template layout remains generation B. Reconcile it as usual after the
+version bump; no new deployment file or environment variable is required.
+
+### 0.18.3 → 0.19.0
+
+Nothing changes for a deployment. Bump the version and reconcile the template
+as usual; no configuration, storage, runtime, or model-facing boundary moved.
+The release deletes unreachable compatibility code and consolidates source and
+tests behind the same public behavior. Six design records also moved out of the
+npm package and now live only at their GitHub URLs. They were maintainer history,
+not deployment documentation.
+
 ### 0.18.2 → 0.18.3
 
 Nothing throws for an existing deployment, and the version bump alone crosses
@@ -442,9 +475,11 @@ built-in routes miss, so it can add a route and never shadow one
 
 ### Removed options that throw
 
-These fail at construction with their migration named rather than falling back
-to a default, because silently ignoring a removed option is how a deployment
-ends up running a policy its config file says it has:
+These fail at construction rather than falling back to a default, because
+silently ignoring a removed option is how a deployment runs a policy its config
+file says it has. Releases through 0.19 name the migration in the error. Version
+0.20's strict configuration boundary names the unknown path; this table remains
+the migration map:
 
 | Option | Removed in | Do |
 | --- | --- | --- |
@@ -452,7 +487,7 @@ ends up running a policy its config file says it has:
 | `credentials.health`, `credentialHealth` | 0.8.1 (#179) | delete; credentials fail at use |
 | `surface` | 0.11.0 (#273) | delete; there is one seven-tool surface |
 | `calls.maxBatchResultBytes` | 0.11.0 (#273) | delete; program batching is bounded by `execute_code`'s own limits |
-| flat v0.6 config paths | 0.7.0 | move into their groups — one complete migration error lists them ([operations](./operations.md#configuration)) |
+| flat v0.6 config paths | 0.7.0 | move into their groups ([operations](./operations.md#configuration)) |
 
 ## Verify