@zackbart/connecta 0.21.0 → 0.21.2

package/dist/providers/revenuecat.js

@@ -41,6 +41,7 @@ const READ_ONLY_TOOLS = new Set([
     // Customers and subscriptions
     "get-customer",
     "get-customer-center-config",
+    "get-refund-request-preferences",
     "get-subscription",
     "list-customer-events",
     "list-customers",
@@ -157,7 +158,7 @@ function sharedUsageGuide() {
 - \`get-chart-data\` is the metrics path: read \`get-chart-options-schema\` for the chart you want before calling it, rather than guessing an option name. \`get-overview-metrics\` and \`get-revenue-metric\` answer the summary questions in one call.
 - \`create-paywall-ai\`, \`edit-paywall-ai\`, and \`set-product-store-state\` are asynchronous. They return a task or operation id; poll it with \`get-paywall-ai-task\` or \`get-product-store-state-operation\` rather than assuming the work finished when the call returned.
 - This connection's tool list is not a fixed set. RevenueCat gates parts of its MCP catalog by plan, platform, and beta enrollment — paywall AI editing, benchmarks, experiments, virtual currencies, and the account-billing tools are the usual absentees — so search this connector for what it actually exposes rather than assuming a documented tool is here.
-- \`render-paywall-screenshot\` is unclassified on purpose: RevenueCat's reference gives it no access column, so it fails closed onto \`call_destructive_tool\` until a release reviews it.
+- \`render-paywall-screenshot\` is unclassified on purpose because RevenueCat's reference gives it no access column. The current server marks it read-only, which Connecta preserves; without that annotation it fails closed onto \`call_destructive_tool\`.
 - RevenueCat meters API v2 per minute and per domain, and the domains differ: 480 requests per minute for customer information and virtual currencies, 60 for project configuration and audiences, 25 for charts and metrics. It answers a breach with \`429\`, a \`Retry-After\` header, and a \`backoff_ms\` field. Back off on that rather than retrying immediately, and expect chart sweeps to hit the ceiling long before customer reads do.
 - Treat every create, update, archive, unarchive, attach, detach, delete, publish, unpublish, grant, assign, and submit operation as a write. Connecta routes the maintained write catalog through \`call_destructive_tool\`; newly added tools also fail closed until a release classifies them.
 - An \`auth_required\` failure means this connector's RevenueCat authorization is missing or expired: run \`authorize_connector\` for this connector id, then retry the same call unchanged. A rejected argument, a permission gap, or a plan restriction comes back in RevenueCat's own words instead — read it rather than re-authorizing.

package/dist/providers/stripe.js

@@ -37,16 +37,16 @@ const READ_ONLY_TOOLS = new Set([
     "stripe_api_search",
     "stripe_api_details",
     "stripe_api_read",
-    "get_stripe_account_info",
     "get_balance_summary",
+    "list_available_accounts_or_orgs",
+    "manage_stripe_accounts",
     "search_stripe_documentation",
-    "stripe_implementation_planner",
 ]);
-/** Reviewed writes, including refund rationale: `documentation/stripe.md`. */
+/** Reviewed writes, including mixed read/create tools: `documentation/stripe.md`. */
 const WRITE_TOOLS = new Map([
     ["stripe_api_write", "destructive"],
-    ["create_refund", "destructive"],
-    ["stripe_report", "additive"],
+    ["stripe_implementation_planner", "additive"],
+    ["stripe_analytics", "additive"],
     ["send_stripe_mcp_feedback", "additive"],
 ]);
 /** Release-reviewed manifest; see provider conventions P5 and P13. */
@@ -149,7 +149,8 @@ ${accountInstructions
 function sharedUsageGuide(rate) {
     return `
 - Four generic tools reach any Stripe API method. Find the method with \`stripe_api_search\`, read its parameters with \`stripe_api_details\`, then call \`stripe_api_read\` (GET) or \`stripe_api_write\` (POST/PATCH/PUT/DELETE). Never guess a path or a parameter name — \`stripe_api_details\` is cheaper than a rejected write.
-- Prefer a dedicated tool when one covers the task: \`get_stripe_account_info\` for account information, \`get_balance_summary\` for balances, \`create_refund\` for refunds, \`stripe_report\` for reports. One call instead of three, and a refund named \`create_refund\` reads far more clearly in the approval a human sees than the same refund buried in \`stripe_api_write\` arguments.
+- Prefer a dedicated tool when one covers the task: \`get_balance_summary\` for balances and \`stripe_analytics\` for Sigma or Metrics reporting. Use \`stripe_api_search\` for everything else instead of assuming a retired dedicated tool still exists.
+- \`stripe_implementation_planner\` and the query-execution intents of \`stripe_analytics\` create provider-side planning or query-run state. Connecta therefore routes both through \`call_destructive_tool\` as non-destructive writes; their retrieval paths stay behind the same tool boundary.
 - \`stripe_api_write\` carries the blast radius of the entire write API — every POST, PATCH, PUT, and DELETE, from a customer edit to a subscription cancellation. State the method and path explicitly; expect approval on every call.
 - Lists are cursor-paginated: \`limit\` defaults to 10 and caps at 100, \`starting_after\` and \`ending_before\` take an object id and are mutually exclusive, and \`has_more\` says whether to continue. Page inside \`execute_code\`.
 - Any \`stripe_api_read\` list or \`stripe_api_search\` that returns full objects belongs inside \`execute_code\`, projected to the fields the question needs before \`return\`. Neither \`limit\` nor \`expand\` substitutes for that: an unprojected list of customers or invoices truncates long before it answers, and a projected one keeps the customer's name, email, and address out of the transcript.

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.21.0";
+export declare const CONNECTA_VERSION = "0.21.2";

package/dist/version.js

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.21.0";
+export const CONNECTA_VERSION = "0.21.2";

package/documentation/architecture.md

@@ -20,6 +20,23 @@ isolate or process —
 on Workers that means a lazy module-scope singleton, which is why both
 deployment shapes build it outside the request handler.
 
+An OAuth `remoteMcp()` connector also owns a runtime-local refresh completion
+gate. It coordinates credential mutation across concurrent request scopes but
+never shares their clients, transports, or responses, and never lets a follower
+cancel the owner. Every participant still awaits the refresh inside its own
+request lifetime; a cancelled follower leaves the shared owner untouched and
+removes only its own wait. The owner's request signal belongs to its token
+fetch. Cancelling that owner fails current joiners too because promoting one
+could replay a refresh token the authorization server already consumed.
+
+The coordinator retains the owner's abort signal only through one temporary
+listener on the exact active refresh. Save, failure, cancellation, or
+generation retirement removes it along with the map entry. It never retains a
+token response, client, or transport. If cancellation lands after a valid
+response while its credential write is still running, a generation-keyed
+identity marker rejects new owners until that exact write finishes. The marker
+contains no promise and generation retirement removes it.
+
 **Per request, and no longer.** The MCP server, its transport, downstream MCP
 clients, abort signals, and the connector scope a probe opens all belong to the
 request that created them. `Nothing request-bound survives a request` is an

package/documentation/auth.md

@@ -65,7 +65,7 @@ Worker-level Access runs before every connecta route. Consequently:
   OAuth discovery paths when Managed OAuth is enabled.
 
 The [Worker example](../examples/worker/) carries the complete deployment shape
-and the [upgrade guide](./upgrading.md#0200--0210) gives the reversible Clerk
+and the [upgrade guide](./upgrading.md#0200--0212) gives the reversible Clerk
 migration.
 
 ## Clerk configuration is checked at construction

package/documentation/cloudflare.md

@@ -153,6 +153,18 @@ every constrained field, endpoint-specific pagination bounds, and a description
 on every property. `test/cloudflare-provider.test.ts` walks the surface and
 asserts those properties rather than leaving them as a claim.
 
+The per-setting zone tools accept Cloudflare's current non-empty setting ids,
+including `webmcp_enabled` and `webmcp_packs`. Cloudflare's
+[rendered setting reference](https://developers.cloudflare.com/api/resources/zones/subresources/settings/)
+and current OpenAPI now agree on both beta ids. Results preserve the value and
+the actual `editable` flag Cloudflare returned; Connecta does not apply the
+document's defaults locally.
+
+KV namespace jurisdiction is creation-only. `create_kv_namespace` accepts
+`eu`, `fedramp`, or `us`, and namespace reads preserve the returned value.
+R2 uses a different enum: `default`, `eu`, `us`, or `fedramp`, sent through
+`cf-r2-jurisdiction` by all eight named R2 operations.
+
 ### What the named surface deliberately leaves out
 
 A named tool is a permanent line item in every deployment's catalog, so the
@@ -206,7 +218,7 @@ connection *calls*, dropping the tool drops the row — so
 rather than by a recorded exception. A path reached only through a hatch is
 named by the caller, so it was never a touched endpoint.
 
-The surviving 47 named tools all refuse malformed arguments locally, which is
+The surviving 48 named tools all refuse malformed arguments locally, which is
 the one thing no escape hatch can do: a hatch's path is an opaque string, so it
 can only check that a path is a path.
 
@@ -318,6 +330,12 @@ renamed to `camelCase`. A zone comes back as `id`, `name`, `status`, `paused`,
 `type`, `accountId`, `accountName`, `plan`, `nameServers`, and timestamps —
 not the forty-field object Cloudflare sends.
 
+Every named tool declares useful top-level output keys. Zone settings, Worker
+settings and deployments, KV namespaces and bulk operations, rulesets, R2 CORS,
+and Pages resources use maintained result schemas instead of an open
+"Cloudflare object" declaration. The three raw escape hatches remain open by
+design because their result fields depend on the caller-supplied endpoint.
+
 Paginated lists add a `page` object derived from `result_info`:
 `{ page, perPage, count, totalCount, totalPages, hasMore }`. `hasMore` is the
 field to branch on.

package/documentation/code-mode.md

@@ -746,7 +746,7 @@ Worker renders arguments with `String()` (so an object logs as
 latter two. Only the three captured everywhere are contract (`R5`); rendering is
 not.
 
-**X5. Leftover authority.** QuickJS blocks imports and has no `fetch`, `process`, timers, `crypto`, or `WebSocket`. A Dynamic Worker has those globals plus a non-contract set of runtime builtins through `import()` and `process.getBuiltinModule()`, including `node:path`, `node:crypto`, `node:net`, `node:tls`, `node:dns`, `node:module`, and `cloudflare:workers`. The upstream set can drift; this list is not an allowlist.
+**X5. Leftover authority.** QuickJS blocks imports and has no `fetch`, `process`, timers, `crypto`, or `WebSocket`. Its Node child starts with an explicitly empty process environment rather than inheriting deployment variables or `NODE_OPTIONS`. A Dynamic Worker has those globals plus a non-contract set of runtime builtins through `import()` and `process.getBuiltinModule()`, including `node:path`, `node:crypto`, `node:net`, `node:tls`, `node:dns`, `node:module`, and `cloudflare:workers`. The upstream set can drift; this list is not an allowlist.
 The supported Worker construction is exactly `new DynamicWorkerExecutor({ loader })`. Do not pass `bindings`, `modules`, or `globalOutbound`: each can grant ambient configuration, code, or egress. Under it, `process.env`, lexical `this.env`, and `cloudflare:workers.env` are empty; `node:fs`, `node:http`, and `node:https` are unavailable through either access route; external `fetch`, `WebSocket`, `node:net`, and `node:tls` fail with workerd's outbound-denial error; DNS lookup ends unresolved; and `fetch("data:...")` resolves locally.
 `P2` is the portable contract. Programs use none of this runtime-only authority, including timers and `crypto`, because the same code fails on QuickJS. The `execute_code` description and served `usage` skill say so before an agent writes code.
 
@@ -832,7 +832,7 @@ the upstream `Executor` shape assignable.
 | Clauses | Test |
 | --- | --- |
 | `P1`, `P5` | `test/guest-api-contract.test.ts` (TypeScript syntax), `test/quickjs-executor.test.ts` (`normalizeCode`) |
-| `P2`, `X5` | `test/guest-api-contract.test.ts` (Dynamic globals plus loader-only filesystem, HTTP, environment, egress, DNS, and local `data:` boundaries), `test/guest-api-contract-quickjs.test.ts` (exact absent globals and blocked imports), `test/deployment-shapes.test.ts` (loader-only Worker construction) |
+| `P2`, `X5` | `test/guest-api-contract.test.ts` (Dynamic globals plus loader-only filesystem, HTTP, environment, egress, DNS, and local `data:` boundaries), `test/guest-api-contract-quickjs.test.ts` (exact absent globals and blocked imports), `test/quickjs-child-stderr.test.ts` (empty child-process environment), `test/deployment-shapes.test.ts` (loader-only Worker construction) |
 | `P3`, `X9` | `test/guest-api-contract.test.ts`, `test/execute.test.ts` |
 | `P4` | `test/guest-api-contract.test.ts` (no cross-run leakage), `test/execute.test.ts` (one catalog load per connector per execution) |
 | `A1`, `A2` | `test/guest-api-contract.test.ts`, `test/execute.test.ts` (sanitizing), `test/server.test.ts` (bounded live connector inventory) |

package/documentation/linear.md

@@ -110,9 +110,10 @@ the connector is present and reports `auth_required`. See
 
 The wrapper classifies Linear's documented `list_*`, `get_*`, and
 `search_documentation` tools as reads, and its `save_*`, `create_*`, `delete_*`,
-`resolve_*`, `submit_*`, and `merge_*` tools as writes. An unfamiliar tool the
-downstream leaves unannotated fails closed onto `call_destructive_tool` until a
-Connecta release reviews it.
+`resolve_*`, `submit_*`, `merge_*`, `share_issue`, and `unshare_issue` tools as
+writes. Sharing changes an existing issue's access, so both halves are
+destructive. An unfamiliar tool the downstream leaves unannotated fails closed
+onto `call_destructive_tool` until a Connecta release reviews it.
 
 That classification fills in downstream silence and otherwise preserves
 explicit annotations. A tool on the read allowlist arriving with
@@ -136,7 +137,8 @@ though some calls only create. The genuine creates are `create_issue_label` and
 ## The catalog is not a fixed set
 
 Linear's hosted `tools/list` varies by workspace plan and enabled features:
-customer requests, releases, and code review do not appear in every workspace.
+customer requests, releases, code review, templates, and explicit issue sharing
+do not appear in every workspace.
 The maintained allowlists are therefore a superset — a classified name a
 workspace never returns costs nothing, and a genuinely new tool fails closed.
 Agents should search this connector's catalog for what the workspace actually

package/documentation/mixpanel.md

@@ -84,7 +84,7 @@ the maintained guide carries the missing call guidance:
 A read-only live audit on 2026-08-13 confirmed all three refusals against the
 US hosted endpoint. They are reported upstream as
 [`mixpanel/mixpanel-headless#202`](https://github.com/mixpanel/mixpanel-headless/issues/202).
-The vetted catalog records the same audit's schema digests for all 63 tools,
+The vetted catalog records current schema digests for all 64 tools,
 so a later schema correction or regression appears by tool name in the
 maintainer drift check. The guide can then shrink when the downstream schema
 becomes complete; Connecta does not absorb the defect permanently.
@@ -110,8 +110,10 @@ rest) leave `destructiveHint` unset; `readOnlyHint: false` already routes them
 through the destructive path, and asserting destruction only inflates the
 approval copy the host shows a human.
 
-Experiments and Feature Flags — 15 of the 63 classified tools — are Mixpanel
-beta surfaces. Expect their names and schemas to move faster than the rest.
+Experiments and Feature Flags are Mixpanel beta surfaces. Their three changed
+schemas were reviewed again on 2026-08-30. The same review added
+`Fill-Event-Metadata` as a destructive write because it applies generated names
+and descriptions to existing Lexicon events.
 
 ## Rate limits
 

package/documentation/operations.md

@@ -233,13 +233,13 @@ in.
 | `catalog.test.ts` | lexical ranking and the compact schema renderer — `const`, `allOf` beside siblings, `$ref`, the depth limit, per-schema caching, and 2020-12 keyword compatibility |
 | `clerk.test.ts` | protected-resource metadata, the browser sign-in config, OAuth and session tokens, cached best-effort activity labels with their caps, the hand-applied `azp` rejection, and the `allowedDomains` allowlist including every lookalike that must not be repaired into a match |
 | `cloudflare-access-auth.test.ts` | trusted `ctx.access` human and service identities, absent/error fail-closed behavior, service-token MCP admission without operator mutation, human same-origin mutation, and the Clerk-to-ambient shell switch |
-| `cloudflare-provider.test.ts` | `cloudflare()` construction, tool surface, request building, projections, typed failures, and credential test |
+| `cloudflare-provider.test.ts` | `cloudflare()` construction, tool surface, current R2 and KV jurisdictions, useful output declarations, request building, projections including additive provider fields, typed failures, and credential test |
 | `code-first-surface.test.ts` | the seven-tool surface itself — an executor required, every removed option and top-level tool refused, compact always-loaded routing pinned below 1,000 characters, complete on-demand usage served, and `connecta.ui` findable before connector search |
 | `codemode-compat.test.ts` | the `Executor` seam staying structurally compatible with `@cloudflare/codemode`'s `DynamicWorkerExecutor`, enforced by `tsc` |
 | `config.test.ts` | the grouped `ConnectaConfig` boundary — each group forwarding to its internals, malformed admission bounds failing construction, and unknown own-properties rejected by their complete path before construction does work |
 | `credentials.test.ts` | the pure stored-shape classifier (containment, not equality) and the AES-GCM vault: round-trip, ciphertext bound to its connector id, named field sets, masked metadata, wrong-key rejection, deletion, coexistence with OAuth keys |
 | `d1-activity-example.test.ts` | the Worker example's deployment-owned D1 activity store: actor namespace round-trip, payload-free friction reconstructed from the persisted code, and agreement with the package's friction table |
-| `downstream-oauth.test.ts` | `KvOAuthProvider` round-trips and races, `auth_required` versus `error`, `startAuth`/`finishAuth`, callback refusal equality, bounded diagnostics, and HTML escaping |
+| `downstream-oauth.test.ts` | `KvOAuthProvider` round-trips and generation races, runtime-local rotating-token refresh coordination across request scopes, refresh failure/retry, `auth_required` versus `error`, `startAuth`/`finishAuth`, callback refusal equality, bounded diagnostics, and HTML escaping |
 | `errors.test.ts` | `ConnectorCallError` codes, retryable defaults and overrides, `retryAfterMs` round-trip, typed-over-heuristic classification, `AbortError` as a retryable timeout, and framing errors |
 | `execute.test.ts` | the code-mode host bridge: identifier sanitization, MCP-result unwrapping, sandbox provider construction, authenticated thrown-failure framing, fail-closed filtering of destructive and unannotated tools, MCP/code-mode invocation parity, and payload-free describe diagnostics |
 | `execute-emit.test.ts` | `connecta.emit` (M1–M10) — block validation, budgets, the provider, delivery after the result envelope on success only, and the defaults |
@@ -247,11 +247,11 @@ in.
 | `executor-admission.test.ts` | the portable bounded FIFO both pools use: active and queue ceilings, stable retryable overload, queue timeout, cancellation removal, idempotent release, shutdown |
 | `guarded-fetch.test.ts` | the guarded transport — construction, request building, destination confinement, and response handling |
 | `guest-api-contract.test.ts` | the shared guest contract on the Dynamic Worker, including caught call, typed inline describe recovery, discovery, utility, batch, and budget failure codes; plus the real authority boundary — local `data:` fetch, denied egress, unresolved DNS, empty environment paths, unavailable filesystem/HTTP builtins, and present runtime globals |
-| `linear-provider.test.ts` | the Linear proxy's construction, classification, and guide |
+| `linear-provider.test.ts` | the Linear proxy's construction, guide, plan-aware catalog superset, and current workspace, template, and issue-sharing classifications |
 | `meta-tools-call.test.ts` | registry-backed calls: structured errors, truncation and `get_result`, per-connector result bounds, JSON representation failures, MCP content bounds, and offset alignment |
 | `meta-tools-search.test.ts` | registry-backed discovery: bounded search with page and address maxima, compact and JSON schemas with constraints, typed describe recovery and suggestions, and structured-result compatibility |
 | `meta-tools.test.ts` | the remaining registry-backed meta-tools: the complete on-demand usage skill, connector-guide selection and summary bounds, stored-credential drift, catalog health, authorization, probe timeouts, and unavailable or unknown browse recovery |
-| `mixpanel-provider.test.ts` | the Mixpanel proxy, its conditional-input guide and complete reviewed schema-digest manifest |
+| `mixpanel-provider.test.ts` | the Mixpanel proxy, its conditional-input guide, destructive metadata fill, and complete 64-tool schema-digest manifest |
 | `notion-provider.test.ts` | Notion's deliberate tool surface, including declined expanded page inputs, request construction, lean projections, both pagination conventions, error mapping, and writes |
 | `operator-boundary.test.ts` | the operator row of the decisions table, after every mutation route: authentication material managed without moving a declared structure, and the one honest exception — a credential write making a remote catalog appear, which is discovery arriving, not an operator editing the deployment |
 | `operator-store.test.ts` | `src/operator-ui/app/store.ts` against a fake browser: the Clerk listener, ambient Access requests without a browser-readable token, `gate()`, the generation fence, and the request path |
@@ -263,11 +263,11 @@ in.
 | `remote-mcp-pagination.test.ts` | the `tools/list` cursor chain in both directions — exact cursor handoff, first-wins dedup, a failed later page rejecting rather than returning its prefix, the runaway backstops, the tool-metadata re-prime across pages, and paginated catalogs reaching the discovery path |
 | `request-admission.test.ts` | `/mcp` bounded before auth, the stable 503 and `Retry-After`, health and operator responsiveness under saturation, payload-free counters, queued cancellation, shutdown rejection while active work drains, and the separate fallback code pool |
 | `result-shapes.test.ts` | passive output-shape learning: value-free bounded inference, merging, 256-entry LRU eviction, 24-hour expiry, runtime isolation, read-only admission, declared-schema precedence, definition-change invalidation, discovery provenance, and failure isolation |
-| `revenuecat-provider.test.ts` | the RevenueCat proxy's per-project key scoping and account-wide OAuth guides, its purpose-bearing summary, the argued borderline verdicts in its digest-free manifest, and the deliberately unclassified `render-paywall-screenshot` |
+| `revenuecat-provider.test.ts` | the RevenueCat proxy's per-project key scoping and account-wide OAuth guides, its purpose-bearing summary, the refund-preference read and argued borderline verdicts in its digest-free manifest, and the deliberately unclassified `render-paywall-screenshot` |
 | `server.test.ts` | end-to-end `/mcp` (401 → compact initialize instructions → seven compact definitions with bounded connector inventory and exact model-only Apps metadata → complete usage skill → `call_tool`), conditional guide pointers, open routes, Clerk `.well-known` metadata without network, code mode, and deferred catalog reads through both discovery surfaces |
 | `server-route-contracts.test.ts` | the route contracts `server.ts` must keep byte-identical: every built-in answered ahead of connector routes inside the security wrapper, open data-free shells with framing denied, per-route auth and same-origin requirements with exact 401/403/405 bodies, and OAuth `verifyState`-before-`finishAuth` ordering |
 | `startup-warnings.test.ts` | every construction-time `logger.warn` and, as importantly, the conditions that must *not* trigger one: open mode with a credential or OAuth connector, `publicUrl` unset beside OAuth, dropped branding and `uiAuth` URLs, a missing `verifyState`, a credential test-hook mismatch, and an unusable `calls.maxResultBytes` |
-| `stripe-provider.test.ts` | the Stripe proxy's mixed-mode OAuth and fixed-mode header contracts, admission, exact account selectors, and no-guess rule |
+| `stripe-provider.test.ts` | the Stripe proxy's mixed-mode OAuth and fixed-mode header contracts, current eleven-tool classifications, admission, exact account selectors, and no-guess rule |
 | `operator-view.test.ts` | the app's pure state rules from `view.ts`: filtering, page routing, capability states, activity summaries, drift display, and identity reset |
 | `ui-credentials.test.ts` | credential-management routes: save, test, delete, validation, authentication, same-origin checks, and multi-field credential shapes |
 | `ui.test.ts` | the server shell and remaining `/ui/*` routes: gated `/ui/data` with broken-connector isolation and registry-owned catalog-observation containment, plus the URL safety gates |
@@ -291,7 +291,7 @@ justification for *not* re-running it in workerd, so "it was easier" is not one.
 | `package-surface.test.ts` | the published boundary — built output shipped, the `exports` map carrying exactly the documented subpaths plus `./package.json`, only generic factories, platform storage kept in examples, Clerk and QuickJS behind optional subpaths, dependency-free Cloudflare Access behind its Worker subpath, every provider independently importable, and the Cloudflare API provider free of bare specifiers | walks the package tree with Node filesystem APIs |
 | `purity.test.ts` | the import-graph guardrail ([architecture](./architecture.md#import-graph-purity)) — the core stays Workers-clean | walks the source import graph with Node filesystem APIs |
 | `quickjs-child-entry.test.ts` | a missing QuickJS child entry failing before `fork()`, with the expected path and the bundler-externalization constraint | mocks Node child-process and filesystem APIs |
-| `quickjs-child-stderr.test.ts` | abnormal child exits retaining only an 8 KiB stderr tail, included in the parent-side diagnostic | mocks Node child-process streams |
+| `quickjs-child-stderr.test.ts` | the QuickJS child-process boundary: an explicitly empty environment despite parent secrets and `NODE_OPTIONS`, plus abnormal exits retaining only an 8 KiB stderr tail in the parent-side diagnostic | mocks Node child-process streams |
 | `quickjs-executor.test.ts` | the child-process sandbox — code normalization, lazy namespace proxies, bounded IPC, separate guest-CPU and wall budgets, saturation, cancellation and shutdown, crash and OOM recovery, host-call hangs, stalled-promise detection | runs the Node QuickJS child-process executor |
 | `quickjs-log-limits.test.ts` | bounded `console.*` capture — per-entry cut, cumulative character and transport budgets, escape-heavy floods preserving the guest result | runs the Node QuickJS child-process executor |
 | `suite-partition.test.ts` | this partition, including itself: every `*.test.ts` in exactly one list, stale entries and empty reasons refused | walks the test directory to guard the partition |

package/documentation/provider-conventions.md

@@ -693,8 +693,10 @@ Cloudflare keep/prune half of that judgment was made in
 [#350](https://github.com/zackbart/connecta/issues/350): 30 keep, 18 improve,
 3 prune, measured per tool in
 [`eval/current-version/results/issue-350-evidence.md`](https://github.com/zackbart/connecta/blob/main/eval/current-version/results/issue-350-evidence.md).
-Its eighteen `improve` rows are H8 and H9 misses on tools that clearly earn
-their place, so they are this audit's work, not a second removal argument.
+Its eighteen `improve` rows were H8 and H9 misses on tools that clearly earned
+their place. Issue #488 resolved them with useful output keys and maintained
+projections; the measurements remain the reason those tools stayed rather than
+a second removal argument.
 
 Each provider's own guide ([Cloudflare](./cloudflare.md),
 [Linear](./linear.md), [Mixpanel](./mixpanel.md), [Notion](./notion.md),

package/documentation/revenuecat.md

@@ -152,17 +152,18 @@ names the `authorize_connector` recovery. A permission gap, a plan restriction,
 or a rejected argument arrives as RevenueCat wrote it and is not an
 authorization problem.
 
-## The ninety-five tools, and what they are classified as
+## The ninety-six tools, and what they are classified as
 
 RevenueCat's
 [tool reference](https://www.revenuecat.com/docs/tools/mcp/tools-reference),
-read on **2026-08-18**, documents ninety-five tools in a Read/Write table.
-Ninety-four carry an access column and are classified here: **50 read-only, 15
-additive writes, 29 destructive writes.**
+read on **2026-08-30**, documents ninety-six tools. Ninety-five carry an access
+column and are classified here: **51 read-only, 15 additive writes, 29
+destructive writes.**
 
 Reads are every `Read` row, verbatim — the nine project and app reads, the four
 product reads, the entitlement, offering, targeting, paywall, customer, virtual
-currency, chart, webhook, and SDK reads, and `get-paywall-ai-task`.
+currency, chart, webhook, and SDK reads, `get-paywall-ai-task`, and
+`get-refund-request-preferences`.
 
 Writes follow the verb where the verb is honest: `archive-*` and `unarchive-*`
 flip an existing object's active state, `update-*`, `delete-*`, `publish-*`,
@@ -191,14 +192,15 @@ beside the row:
 `create-webhook-integration` deserves a sentence too. No existing integration
 changes, so the verb reads additive — but with filters omitted the new one
 "starts delivering" every customer event in the project to a URL the caller
-typed. Customer data leaving the account is the `create_refund` argument again:
-filed destructive on consequence, so the approval copy says what is at stake.
+typed. Customer data leaving the account makes it destructive on consequence,
+so the approval copy says what is at stake.
 
 **`render-paywall-screenshot` is deliberately unclassified.** RevenueCat's
-reference gives it no access column at all, so no release has reviewed what it
-does. It fails closed onto `call_destructive_tool` rather than being guessed
-into the read path because its name sounds harmless (P5). The guide names it,
-so an agent does not read the approval prompt as a bug.
+reference gives it no access column. The current live server explicitly marks
+it read-only, so that catalog keeps it callable from `execute_code`; if a later
+catalog omits the annotation, it fails closed onto `call_destructive_tool`.
+Connecta preserves the provider's current annotation without inventing a
+release classification from the tool's harmless-sounding name (P5).
 
 That classification fills in downstream silence and otherwise preserves explicit
 annotations. A tool on the read allowlist arriving with `destructiveHint: true`
@@ -242,7 +244,7 @@ API v2 meters per minute and **per domain**
 | Charts & Metrics | 25 |
 
 A `ConnectorCallAdmissionPolicy` carries exactly one rule, so a connector-wide
-budget has to pick one of those six numbers for all ninety-five tools.
+budget has to pick one of those six numbers for all ninety-six tools.
 Transcribing 25 would throttle a customer read loop to a nineteenth of its
 documented allowance; transcribing 480 would leave a chart sweep unprotected.
 Neither is the provider's limit, and both would look like RevenueCat being
@@ -281,15 +283,13 @@ still needs restrained use.
 
 ## What is not verified
 
-- **Every tool name is transcribed from RevenueCat's published reference on
-  2026-08-18, not read from a live catalog.** No maintainer ran this against a
-  project with a real key before it shipped. A name the reference lists and the
-  server does not serve costs nothing; a tool the server serves and the
-  reference omits fails closed. The maintainer-run drift check with
-  `CONNECTA_DRIFT_REVENUECAT_KEY` set is what turns that into a finding with a
-  name attached.
-- **No input or output schema has been read**, which is why the manifest
-  carries no digests.
+- **The 2026-08-30 live review used a project-scoped catalog.** It proves the
+  additions that catalog serves, including `get-refund-request-preferences`,
+  but cannot prove a globally documented tool was removed. The manifest stays
+  a superset because plan, platform, and credential scope hide tools.
+- **No complete schema set has been recorded**, which is why the manifest
+  carries no digests. The review read the new live schemas, but its scoped
+  catalog omitted many classified writes.
 - **Whether `render-paywall-screenshot` mutates anything.** It has no access
   column, and guessing is exactly what P5 exists to prevent.
 

package/documentation/storage-and-credentials.md

@@ -107,3 +107,38 @@ the retired grant.
 The OAuth callback verifies the one-shot `state` first, then hands the complete
 query string—including RFC 9207 `iss`—to the SDK transport. One-shot state,
 verifier, and pending URL are cleared only after a successful exchange.
+
+Within one `remoteMcp()` runtime, one request scope owns refresh-token
+redemption for an OAuth generation. Concurrent scopes wait for the owner's
+token save or bounded failure, then either read storage again or receive that
+failure. A scope that had already read the retired refresh token reuses the
+newly stored rotating token locally instead of sending the retired value
+upstream. Force reauthorization retires the old generation's gate, and a
+failed flow releases ownership for a later attempt. The coordinator retains
+only a completion signal and one temporary owner-abort listener until that
+exact flight settles, never the token response or downstream transport. A
+follower may stop waiting when its own request is cancelled without cancelling
+the owner or poisoning the generation for later callers. If the owner's
+credential mutation fails, joined callers receive that same bounded failure
+instead of waking to redeem the unchanged token; a later independent call may
+retry. Non-success and malformed token responses settle current waiters at the
+fetch boundary, before any later authorization callback can itself fail.
+Cancelling the owner aborts its fetch and fails current joiners rather than
+promoting one: once a request reaches the authorization server, repeating its
+old refresh token is not known to be safe. If that cancellation lands while
+the valid response's credential write is already running, a same-generation
+attempt receives `temporarily_unavailable` until the exact write succeeds or
+fails. This mutation marker contains no retained promise; force
+reauthorization removes it when the old generation becomes unreadable.
+An additional opaque success identity lets a request recognize a refresh that
+completed after its issuer-aware token read even when the authorization server
+returned byte-identical credentials. The identity is generation-scoped and is
+discarded with the retired generation. Every authoritative storage-generation
+read also retires coordinator state from other epochs, so an externally
+advanced generation cannot be overwritten in runtime state by late old work.
+
+This guarantee is runtime-local. `KVStorage` has no atomic lock or
+compare-and-set operation, so separate processes or Worker isolates can still
+redeem the same refresh token concurrently. Generation envelopes continue to
+fence their writes, but Connecta does not claim cross-isolate exactly-once
+refresh.

package/documentation/stripe.md

@@ -139,38 +139,39 @@ boots but cannot list tools is usually a dashboard toggle, not a bad key.
 
 ## The eleven tools, and what they are classified as
 
-Stripe documents eleven tools on the hosted server. Seven are reads:
+Stripe currently serves eleven tools. Seven are reads:
 
 `stripe_api_search`, `stripe_api_details`, `stripe_api_read`,
-`get_stripe_account_info`, `get_balance_summary`,
-`search_stripe_documentation`, `stripe_implementation_planner`.
+`get_balance_summary`, `list_available_accounts_or_orgs`,
+`manage_stripe_accounts`, and `search_stripe_documentation`.
 
 Four are writes:
 
-`stripe_api_write` and `create_refund` are classified destructive;
-`stripe_report` and `send_stripe_mcp_feedback` are additive.
+`stripe_api_write` is destructive. `stripe_implementation_planner`,
+`stripe_analytics`, and `send_stripe_mcp_feedback` are additive.
 
 Two of those deserve a sentence. `stripe_api_read` is a read because Stripe
 documents it as the `GET` half of a generic pair — the tool is the read
 boundary, not whichever endpoint an agent names inside it, and its sibling
 `stripe_api_write` carries every `POST`, `PATCH`, `PUT`, and `DELETE`.
-`create_refund` is filed destructive despite its name: it reverses a settled
-charge and moves money back out, which is a mutation of something that already
-exists rather than a fresh object appearing beside it. Additive writes
-(`stripe_report`, `send_stripe_mcp_feedback`) leave `destructiveHint` unset;
+`stripe_implementation_planner` creates and continues provider-side guide
+state. `stripe_analytics` combines retrieval with query-run creation behind one
+tool. Stripe marks both not read-only and not destructive, so Connecta records
+them as additive writes. They leave `destructiveHint` unset. Their explicit
 `readOnlyHint: false` already routes them through `call_destructive_tool`, and
-asserting destruction only inflates the approval copy the host shows a human.
+asserting destruction would misstate their effect.
 
 That classification fills in downstream silence and otherwise preserves
-explicit annotations. It supplies the annotations Stripe leaves unset — Stripe
-documents no MCP annotations at all. A tool on the read allowlist arriving with
+explicit annotations. The current server annotates all eleven tools, while the
+manifest records what this release reviewed and exposes later contradictions.
+A tool on the read allowlist arriving with
 `destructiveHint: true` or `readOnlyHint: false` keeps exactly what the
 downstream said and stays behind `call_destructive_tool`. A tool on neither
 maintained list arriving with `readOnlyHint: true` keeps that too, and stays
 callable from `execute_code`. Both are the downstream telling you this release's
 allowlist is stale, and on a name no release has reviewed its word is the only
 evidence there is. One narrow fail-closed exception applies to a name this
-release reviewed and filed destructive: a `create_refund` claiming
+release reviewed and filed destructive: `stripe_api_write` claiming
 `readOnlyHint: true` is a downstream bug rather than news, and stays on the
 approval path.
 

package/documentation/upgrading.md

@@ -57,7 +57,7 @@ exist so far:
 | --- | --- | --- |
 | **pre-template** | before 0.10.2 | no `connecta init` existed; hand-written, or copied from the retired `examples/node` |
 | **A** | 0.10.2 – 0.15.1 | `.env.example`, `.gitignore`, `AGENTS.md`, `CLAUDE.md`, `README.md`, `package.json`, `src/index.ts`, `tsconfig.json` |
-| **B** | 0.16.0 – 0.21.0 | adds `.dockerignore`, `Dockerfile`, `docker-compose.yml`, and `src/file-activity.ts`; `src/index.ts` grows the four commented operator blocks; `.env.example` ships `CONNECTA_TOKEN=` empty |
+| **B** | 0.16.0 – 0.21.2 | adds `.dockerignore`, `Dockerfile`, `docker-compose.yml`, and `src/file-activity.ts`; `src/index.ts` grows the four commented operator blocks; `.env.example` ships `CONNECTA_TOKEN=` empty |
 
 Generation A is a decade in template years and identifying it precisely does
 not matter, because you are about to reconstruct it exactly rather than guess
@@ -106,7 +106,7 @@ know what to preserve, once to know what to re-verify at the end.
 ### Bump the pin and install
 
 ```sh
-npm pkg set dependencies.@zackbart/connecta=0.21.0
+npm pkg set dependencies.@zackbart/connecta=0.21.2
 npm install
 ```
 
@@ -130,7 +130,7 @@ Generate the *current* template beside the base you already made, into the same
 `$SCRATCH`:
 
 ```sh
-(cd "$SCRATCH" && npx @zackbart/connecta@0.21.0 init current)
+(cd "$SCRATCH" && npx @zackbart/connecta@0.21.2 init current)
 ```
 
 You now have a three-way merge with a real base: `$SCRATCH/base` is what this
@@ -186,7 +186,7 @@ A deployment older than 0.10.2 has no base to diff against. Do not try to
 manufacture one. Instead:
 
 1. `SCRATCH=$(mktemp -d)`, then
-   `(cd "$SCRATCH" && npx @zackbart/connecta@0.21.0 init current)` — there is no
+   `(cd "$SCRATCH" && npx @zackbart/connecta@0.21.2 init current)` — there is no
    `base` leg here, only the current template to read from.
 2. Copy `$SCRATCH/current` into the deployment file by file, **skipping
    `src/index.ts`**.
@@ -207,9 +207,10 @@ first, so cross them bottom-up: start at the oldest one still above this
 deployment's pin and work back up the page, because each boundary assumes the
 older ones are already done.
 
-### 0.20.0 → 0.21.0
+### 0.20.0 → 0.21.2
 
-This is additive for Node and existing Clerk deployments. The new Worker path
+0.21.2 adds no deployment migration beyond 0.21.0. The boundary is additive
+for Node and existing Clerk deployments. The new Worker path
 uses Cloudflare Access identity directly and removes Clerk only after the edge
 cutover has been verified. An agent can perform every repository edit; a human
 must attach Access, choose its policy, create service credentials, and enable
@@ -217,7 +218,7 @@ Managed OAuth in the Cloudflare dashboard.
 
 For a Worker currently using Clerk, keep rollback live through the cutover:
 
-1. Bump and install 0.21.0. Add the new provider **before** the existing Clerk
+1. Bump and install 0.21.2. Add the new provider **before** the existing Clerk
    provider, but remove nothing:
 
    ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.21.0",
+  "version": "0.21.2",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of seven meta-tools.",

package/templates/node/package.json

@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zackbart/connecta": "0.21.0",
+    "@zackbart/connecta": "0.21.2",
     "quickjs-emscripten": "0.32.0"
   },
   "devDependencies": {