@zackbart/connecta 0.26.3 → 0.27.0

package/dist/storage/file.js

@@ -2,6 +2,23 @@ import { chmodSync, closeSync, existsSync, futimesSync, mkdirSync, openSync, rea
 import { randomUUID } from "node:crypto";
 import { hostname } from "node:os";
 import { dirname, resolve } from "node:path";
+function validEntry(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) &&
+        "value" in value && typeof value.value === "string" &&
+        (!("exp" in value) || (typeof value.exp === "number" && Number.isFinite(value.exp)));
+}
+function makeEntry(value, ttlSeconds) {
+    if (ttlSeconds !== undefined && !Number.isFinite(ttlSeconds)) {
+        throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
+    }
+    if (!ttlSeconds)
+        return { value };
+    const exp = Date.now() + ttlSeconds * 1000;
+    if (!Number.isFinite(exp)) {
+        throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
+    }
+    return { value, exp };
+}
 const HEARTBEAT_MS = 15_000;
 const STALE_LOCK_MS = 60_000;
 const localLocks = new Map();
@@ -272,12 +289,19 @@ export function fileStorage(path, opts = {}) {
             // Non-POSIX filesystem or a race on the file — leave the mode as-is.
         }
     };
-    let data = {};
+    let data = Object.create(null);
     try {
         if (existsSync(path)) {
             tighten();
             try {
-                data = JSON.parse(readFileSync(path, "utf8"));
+                const loaded = JSON.parse(readFileSync(path, "utf8"));
+                if (loaded === null || typeof loaded !== "object" || Array.isArray(loaded)) {
+                    throw new TypeError("Expected a state object");
+                }
+                if (!Object.values(loaded).every(validEntry)) {
+                    throw new TypeError("Expected string values and finite expiry timestamps");
+                }
+                data = Object.assign(Object.create(null), loaded);
             }
             catch (error) {
                 // Never let a damaged state file be silently replaced by an empty one:
@@ -299,7 +323,7 @@ export function fileStorage(path, opts = {}) {
                     `moved to ${quarantine}, starting from empty state. Downstream ` +
                     `OAuth connectors must be re-authorized and stored credentials ` +
                     `re-entered.`);
-                data = {};
+                data = Object.create(null);
             }
         }
     }
@@ -315,13 +339,14 @@ export function fileStorage(path, opts = {}) {
         // Reads only prune memory; they do not rewrite the state file.
         const now = Date.now();
         for (const [key, entry] of Object.entries(data)) {
-            if (entry.exp && now > entry.exp)
+            if (entry.exp !== undefined && now >= entry.exp)
                 delete data[key];
         }
         const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
         // 0o600 on the tmp file; the atomic rename below preserves it, so the live
         // state file is never briefly world-readable.
         const fd = openSync(tmp, "wx", 0o600);
+        let committed = false;
         try {
             try {
                 writeFileSync(fd, JSON.stringify(data));
@@ -331,9 +356,13 @@ export function fileStorage(path, opts = {}) {
             }
             lock.assertHeld();
             renameSync(tmp, path);
+            committed = true;
         }
         finally {
-            rmSync(tmp, { force: true });
+            // A successful rename already removed the temp path. Cleanup must not
+            // turn a committed snapshot into a failure that callers roll back.
+            if (!committed)
+                rmSync(tmp, { force: true });
         }
         tighten();
     };
@@ -341,7 +370,7 @@ export function fileStorage(path, opts = {}) {
         const e = data[key];
         if (!e)
             return null;
-        if (e.exp && Date.now() > e.exp) {
+        if (e.exp !== undefined && Date.now() >= e.exp) {
             delete data[key];
             return null;
         }
@@ -358,19 +387,32 @@ export function fileStorage(path, opts = {}) {
         async set(key, value, opts) {
             assertOpen();
             lock.assertHeld();
-            data[key] = {
-                value,
-                ...(opts?.ttlSeconds
-                    ? { exp: Date.now() + opts.ttlSeconds * 1000 }
-                    : {}),
-            };
-            persist();
+            const previous = fresh(key);
+            data[key] = makeEntry(value, opts?.ttlSeconds);
+            try {
+                persist();
+            }
+            catch (error) {
+                if (previous)
+                    data[key] = previous;
+                else
+                    delete data[key];
+                throw error;
+            }
         },
         async delete(key) {
             assertOpen();
             lock.assertHeld();
+            const previous = fresh(key);
             delete data[key];
-            persist();
+            try {
+                persist();
+            }
+            catch (error) {
+                if (previous)
+                    data[key] = previous;
+                throw error;
+            }
         },
         async list(prefix) {
             assertOpen();
@@ -395,12 +437,7 @@ export function fileStorage(path, opts = {}) {
                 delete data[key];
             }
             else {
-                data[key] = {
-                    value: next,
-                    ...(opts?.ttlSeconds
-                        ? { exp: Date.now() + opts.ttlSeconds * 1000 }
-                        : {}),
-                };
+                data[key] = makeEntry(next, opts?.ttlSeconds);
             }
             try {
                 persist();

package/dist/storage/memory.js

@@ -13,6 +13,13 @@ export function memoryStorage() {
         return e;
     };
     const write = (key, value, ttlSeconds) => {
+        if (ttlSeconds !== undefined && !Number.isFinite(ttlSeconds)) {
+            throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
+        }
+        const exp = ttlSeconds ? Date.now() + ttlSeconds * 1000 : undefined;
+        if (exp !== undefined && !Number.isFinite(exp)) {
+            throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
+        }
         // Rotate through at most 16 existing keys. Live entries cannot keep an
         // expired tail resident forever, and no request starts a background job.
         for (let i = 0; i < 16; i++) {
@@ -25,7 +32,7 @@ export function memoryStorage() {
         }
         map.set(key, {
             value,
-            ...(ttlSeconds ? { exp: Date.now() + ttlSeconds * 1000 } : {}),
+            ...(exp !== undefined ? { exp } : {}),
         });
     };
     return {

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.26.3";
+export declare const CONNECTA_VERSION = "0.27.0";

package/dist/version.js

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.26.3";
+export const CONNECTA_VERSION = "0.27.0";

package/documentation/architecture.md

@@ -407,7 +407,8 @@ shape from building, in someone else's repository rather than this one.
 
 ## Effect inside
 
-The core runs on Effect v4; no API a deployment touches does. `createConnecta`,
+The core runs on stable Effect v4, exact-pinned to `4.0.0`; no API a deployment
+touches does. `createConnecta`,
 `remoteMcp()`, `api()`, the `Connector` contract, and every shipped `.d.ts`
 are Promise-shaped and name no Effect type, so a connector author never meets a
 second async paradigm. The reason for the rewrite is the first section of this
@@ -569,8 +570,48 @@ the operator and activity routes cost about +100 KB gzip on `./ui` and +130 KB
 on `./activity`, and matching the wire format meant opting out of most of what
 it does: unowned paths fall through rather than 404, a wrong method is a JSON
 405, and the content-type and size checks run before a body is read. The root
-entry may import only `effect` itself (`test/purity.test.ts`); nothing in
-`src/` uses `effect/unstable/*`, which would have to stay behind a subpath.
+entry may import only `effect` itself (`test/purity.test.ts`). Effect v4's
+area imports, such as `effect/http-api` and `effect/ai`, would have to stay
+behind a subpath. APIs tagged `@stability unstable` can still change in minor
+releases, so stable v4 keeps the exact pin.
+
+The stable `4.0.0` release was re-evaluated on 2026-10-01 with
+[`scripts/probes/effect-v4-evaluation.mjs`](https://github.com/zackbart/connecta/blob/main/scripts/probes/effect-v4-evaluation.mjs).
+Run `npm run build`, then `node scripts/probes/effect-v4-evaluation.mjs output.json`.
+The [raw observations](https://github.com/zackbart/connecta/blob/main/scripts/probes/effect-v4-evaluation-2026-10-01.json)
+are synthetic Node requests and neutral esbuild bundles, not live-client or
+workerd lifetime verification. Bundle figures add representative prototypes
+alongside the current code; they do not claim savings from removing old code.
+
+Two native input schemas with validation and JSON Schema rendering add 62,148
+bytes gzip to the root, taking it from 303,083 to 365,231 against a 339,526
+cap. Effect can reject excess properties when both decoding and rendering use
+`onExcessProperty: "error"`; its default strips them. The generated schemas
+still differ from the exact meta-tool goldens, including record rendering and
+composed numeric bounds. A Schema replacement would need to preserve that
+contract, memoized rendering, and the raw-argument checks used by resumable
+writes. Both MCP SDK packages still depend on Zod, so changing our inputs alone
+does not remove Zod from an installation.
+
+A one-endpoint `HttpApi` prototype adds 106,634 bytes gzip to `./ui` and 106,453
+to `./activity`. Even plain `HttpRouter` adds 45,324 to `./ui`, taking it to
+130,023 against a 128,983 cap. Both default handlers return an empty 404 for a
+wrong method and an unowned path; our routes need a JSON 405 for the former
+and module fallthrough for the latter. Their `toWebHandler` also builds its
+layer immediately and owns a runner, so adopting it would require proving
+global-scope safety and preserving our scheduler and response-lifetime rules.
+The existing Effect route programs keep those rules without this routing layer.
+
+Effect's MCP server has a separate compatibility gate. Its `2026-07-28`
+adapter accepted a stateless `tools/list`, but its `2025-06-18` adapter refused
+a fresh request with 400. Initialization issued a session, and that session's
+next request returned 404 on a fresh handler; Connecta served the same fresh
+legacy list with 200 JSON and no session. The stable package exports no MCP
+client, so it also cannot replace our downstream SDK and OAuth implementation.
+[Issue #622](https://github.com/zackbart/connecta/issues/622) records the server
+parity requirements. These measurements support keeping the current MCP,
+validation, and routing implementations; stable v4 alone does not establish a
+replacement's benefit or compatibility.
 
 The core's cost is recorded rather than guessed. Against 0.24.4 the root entry
 grew from 235,346 to 279,526 bytes gzip, the Worker example from 263,949 to

package/documentation/auth.md

@@ -64,9 +64,10 @@ also work on older adapters without `compareAndSet`; **new issuance requires
 atomic `compareAndSet`**, because counting records before writing admits too many
 concurrent creates. Active capacity defaults to 100, configurable with
 `accessTokens(storage, { maxActive: 200 })`, up to 1,000. A durable reservation
-counts before a secret is written. An interrupted create can consume capacity
-without returning a token; it is never automatically retried or released after
-an uncertain write. Avoid creating new tokens through old-version instances once
+counts before a secret is written. Failures before lookup publication release
+their reservation; an uncertain lookup write retains its metadata and capacity
+so an operator can revoke it, even when creation returned no secret. Creation is
+never automatically retried. Avoid creating new tokens through old-version instances once
 new-version issuance has started, since those instances do not honor reservations.
 
 Secrets contain 256 random bits and only their SHA-256 digests persist. Creation
@@ -285,7 +286,9 @@ remoteMcp("linear", { url: "https://mcp.linear.app/mcp", authScope: "personal",
 A personal connector is absent — not refused — from any request without a
 stable namespaced principal. For a principal that can see one, connecta
 partitions connector storage, vault records, catalog caches, OAuth generations,
-and observed result shapes under an opaque SHA-256 identity key. Keep namespaces
+and observed result shapes under an opaque SHA-256 identity key. Refreshes
+coalesce within one owner; another owner's authorization epoch cannot retire
+that refresh. Keep namespaces
 and principal ids stable across upgrades; changing either selects different
 partitions. Literal `auth: { type: "headers" }` cannot be personal, because its
 secret lives in deployment code; `remoteMcp()` refuses that combination at

package/examples/worker/README.md

@@ -118,7 +118,7 @@ Keep this example's Worker on Wrangler. A copied deployment may use
 [Alchemy](https://alchemy.run) to manage its KV namespace, optional D1 databases
 and R2 bucket, and the Access application without adding Alchemy to connecta or
 changing this template. In that deployment, install `alchemy@2.0.0-beta.79`
-and `effect@4.0.0-rc.117` at exact versions. The latter is connecta's own
+and `effect@4.0.0` at exact versions. The latter is connecta's own
 Effect pin; check `npm ls effect` for one resolved copy after installation.
 The following `alchemy.run.ts` is a resource stack, not a Worker deployment:
 
@@ -193,8 +193,9 @@ deleting the state store loses Alchemy's record of what it owns.
 
 Verification for this optional path stops at the API and types. The fenced
 snippet was copied to an isolated `alchemy.run.ts` and passed `tsc --noEmit`
-with TypeScript 5.9.3, Alchemy 2.0.0-beta.79, and Effect 4.0.0-rc.117; no
-Alchemy deploy or adoption was run.
+with TypeScript 5.9.3, Alchemy 2.0.0-beta.79, and Effect 4.0.0, with
+`npm ls effect` confirming one resolved copy. No Alchemy deploy or adoption
+was run.
 [Alchemy's Worker resource](https://alchemy.run/cloudflare/compute/workers/)
 can declare `WorkerLoader`, domains, Browser Rendering, and cron wiring, but
 those properties are coupled to its script deploy. Its current full deploy

package/examples/worker/src/d1-storage.ts

@@ -18,8 +18,17 @@ import type { KVStorage } from "@zackbart/connecta";
 export function d1Storage(db: D1Database): KVStorage {
   // Every statement that tests liveness binds the current time as ?2.
   const live = "(expires_at_ms IS NULL OR expires_at_ms > ?2)";
-  const expiresAt = (now: number, ttlSeconds?: number) =>
-    ttlSeconds ? now + ttlSeconds * 1000 : null;
+  const expiresAt = (now: number, ttlSeconds?: number): number | null => {
+    if (ttlSeconds !== undefined && !Number.isFinite(ttlSeconds)) {
+      throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
+    }
+    if (!ttlSeconds) return null;
+    const expiry = now + ttlSeconds * 1000;
+    if (!Number.isFinite(expiry)) {
+      throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
+    }
+    return expiry;
+  };
   const changed = (result: D1Result) => result.meta.changes > 0;
   return {
     async get(key) {
@@ -31,6 +40,7 @@ export function d1Storage(db: D1Database): KVStorage {
     },
     async set(key, value, opts) {
       const now = Date.now();
+      const expiry = expiresAt(now, opts?.ttlSeconds);
       await db.batch([
         db
           .prepare(
@@ -46,7 +56,7 @@ export function d1Storage(db: D1Database): KVStorage {
              ON CONFLICT (key) DO UPDATE SET
                value = excluded.value, expires_at_ms = excluded.expires_at_ms`,
           )
-          .bind(key, value, expiresAt(now, opts?.ttlSeconds)),
+          .bind(key, value, expiry),
       ]);
     },
     async delete(key) {
@@ -56,7 +66,7 @@ export function d1Storage(db: D1Database): KVStorage {
       const { results } = await db
         .prepare(
           `SELECT key FROM connecta_kv
-           WHERE key >= ?1 AND substr(key, 1, length(?1)) = ?1 AND ${live}`,
+           WHERE key >= ?1 AND substr(CAST(key AS BLOB), 1, length(CAST(?1 AS BLOB))) = CAST(?1 AS BLOB) AND ${live}`,
         )
         .bind(prefix, Date.now())
         .all<{ key: string }>();
@@ -84,7 +94,19 @@ export function d1Storage(db: D1Database): KVStorage {
             .run(),
         );
       }
-      const expiry = expiresAt(now, opts?.ttlSeconds);
+      let expiry: number | null;
+      try {
+        expiry = expiresAt(now, opts?.ttlSeconds);
+      } catch (error) {
+        // Invalid write options do not change a failed comparison's result.
+        // Ordinary claims still use one atomic statement without this read.
+        const current = await db
+          .prepare(`SELECT value FROM connecta_kv WHERE key = ?1 AND ${live}`)
+          .bind(key, now)
+          .first<{ value: string }>();
+        if ((current?.value ?? null) !== expected) return false;
+        throw error;
+      }
       if (expected === null) {
         // Insert, or take over a row that has expired. A live row makes the
         // upsert's WHERE false, so nothing changes and the claim is refused.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.26.3",
+  "version": "0.27.0",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of eight meta-tools.",
@@ -154,7 +154,7 @@
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
-    "effect": "4.0.0-rc.117",
+    "effect": "4.0.0",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
@@ -186,7 +186,7 @@
     "preact": "^10.29.8",
     "quickjs-emscripten": "^0.32.0",
     "tsx": "^4.23.1",
-    "typescript": "^5.6.0",
+    "typescript": "^5.9.3",
     "vitest": "^4.1.6",
     "wrangler": "^4.114.0"
   }

package/templates/node/package.json

@@ -15,12 +15,12 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zackbart/connecta": "0.26.3",
+    "@zackbart/connecta": "0.27.0",
     "quickjs-emscripten": "0.32.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "tsx": "^4.23.1",
-    "typescript": "^5.6.0"
+    "typescript": "^5.9.3"
   }
 }