@zackbart/connecta 0.34.0 → 0.35.0

package/documentation/code-mode.md

@@ -33,10 +33,10 @@ new behavior.
 
 ## Deploy-time capability
 
-The `executor` passed to `createConnecta()` is required. `tools/list` is exactly
-six — `execute_code`, `search_tools`, `call_tool`, `call_destructive_tool`,
-`authorize_connector` and `skills`. Construction fails when the
-executor is missing, and the removed `surface` option is rejected rather than
+The `executor` passed to `createConnecta()` is required. The
+[six-tool surface](./meta-tools.md#the-six-tools) is defined in the meta-tool
+reference. Construction fails when the
+executor is missing, and the removed deployment-level `surface` option is rejected rather than
 ignored ([#273](https://github.com/zackbart/connecta/issues/273)), as are the
 pause-only `execute.resumableWrites` and `execute.pausedRunTtlSeconds`
 ([#672](https://github.com/zackbart/connecta/issues/672)).
@@ -70,9 +70,7 @@ through `admission`. Lease release disposes RPC and loader handles independently
 of guest settlement. `bindings`, `modules`, or `globalOutbound` violate `P2`.
 The [Worker example](../examples/worker/README.md#code-mode) has the full setup.
 
-Replace `import { DynamicWorkerExecutor } from "@cloudflare/codemode";` with
-`import { workerExecutor } from "@zackbart/connecta/worker";` and use the wiring above.
-Keep the peer. Unbranded executors throw, including bundled upstream copies.
+Keep the Worker's optional peer. Unbranded executors throw, including bundled upstream copies.
 Shipped executors carry a non-enumerable `Symbol.for("connecta.executor")` version/lifecycle brand.
 Custom sandboxes import `customExecutor` from `@zackbart/connecta`, then configure
 `executor: customExecutor(myExecutor, { lifecycle: "self-managed" })`. They own guest termination
@@ -283,7 +281,7 @@ signature is byte-identical to the one `search_tools` returns.
 integration is ambiguous. `safety: "readOnly"` selects stored read verdicts;
 `"approvalRequired"` selects stored write verdicts; omitted or `"all"` selects
 both. Search and describe rows carry `classification`. These filters grant no
-authority and change no call admission decision. On a read-only endpoint,
+authority and change no call admission decision. On a read-only endpoint or connector,
 search and describe omit write tools (`W12`): a write is absent from every
 filter, and describing one is `unknown_tool`. `connecta.skill` guides are not
 filtered and may name such a write; calling it is still refused.
@@ -569,12 +567,12 @@ direct calls; and `input_required_invalid`, `input_required_limit`,
 | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
 | `unknown_address`            | no visible connector owns the tool address or grants the resource reader                                                                                                                              | false         |
 | `unknown_tool`               | the connector has no such tool                                                                                                                                                                        | false         |
-| `read_only_endpoint`         | a program on a read-only endpoint attempted a write (`E4`)                                                                                                                                            | false         |
+| `read_only_endpoint`         | a program on a read-only endpoint or connector attempted a write (`E4`)                                                                                                                               | false         |
 | `auth_required`              | the credential is missing, expired, or rejected                                                                                                                                                       | false         |
 | `invalid_args`               | arguments or discovery bounds were rejected                                                                                                                                                           | false         |
 | `not_found`                  | the downstream answered and the resource is not there — the one code that says skip this id rather than stop, raised only where the provider tells absence from a permission gap                      | false         |
 | `conflict`                   | the write named a base version someone else already moved past; nothing changed. `details.current` says where things stand (at most 20 whole-number entries) — re-read, reapply, retry with that base | false         |
-| `input_required_unsupported` | a downstream asked for input; use `nextAction` for the equivalent direct call                                                                                                                         | false         |
+| `input_required_unsupported` | a downstream asked for input; a read gets `nextAction` for the equivalent direct call, a write is an unknown outcome (`writeOutcome: "unknown"`) to reconcile before any fresh call                   | false         |
 | `rate_limited`               | the downstream reported a rate limit                                                                                                                                                                  | true          |
 | `unavailable`                | the downstream is down or unreachable; optional sanitized `details.host` and `details.code` describe the transport failure without paths, queries, credentials, or provider prose                     | true          |
 | `timeout`                    | a call or sandbox deadline expired; details name operation, stage, elapsedMs, and deadlineMs                                                                                                          | per operation |
@@ -594,7 +592,7 @@ direct calls; and `input_required_invalid`, `input_required_limit`,
 sentence. A program cannot recover credentials — only an operator can — so stop
 and let the failure reach the model.
 
-**E4.** A tool classified as a write never runs on a read-only endpoint
+**E4.** A tool classified as a write never runs on a read-only endpoint or connector
 (`W12`). A program's call is refused with `read_only_endpoint` before
 validation and before anything is sent. The refusal carries no `nextAction` and
 echoes no arguments: no route on that endpoint writes, so the program reports
@@ -619,7 +617,7 @@ when empty. An empty string reports `program_error` with
 program-authored throw is `program_error`. `details.name` is a bounded engine
 error name; `details.line` is the source line when the runtime supplies one,
 otherwise null. Fixed hints repair imports/require/filesystem access, shadowed
-`connecta`, and invented globals such as `callTool` and `mixpanel`.
+`connecta`, and invented globals such as `callTool`.
 
 An unchanged uncaught host error retains its classification through Error
 identity. A new error containing its message is a new program error. Copied
@@ -702,7 +700,7 @@ errors retain their contributing connectors as well.
 Search counts, ranking, and term analysis retain every searched connector,
 including matches outside the returned page or beyond the requested offset.
 Each page rechecks current auth,
-grants, pool membership, and the endpoint's `readOnly`. Reading a stash inside a program carries
+grants, pool membership, and endpoint OR connector `readOnly`. Reading a stash inside a program carries
 its dependencies forward to any new return stash. The page cap is the smallest
 of the deployment cap and contributing connectors' effective `maxResultBytes`.
 Read-only endpoints cannot page write results. A UUID is a handle, never a grant.
@@ -877,7 +875,12 @@ Programs and direct calls use the same invocation deadline and stages. A call's
 and request ceilings still bound the whole run. Timeout details are agent-facing;
 operator records retain only checked classifications and numeric facts.
 A dispatched write timeout becomes `write_outcome_unknown` and retains its
-deadline details even when the program catches the failure. The final program
+deadline details even when the program catches the failure. A completed
+maintained-provider call that reports a timeout keeps `timeout` when its complete
+request ledger records an auxiliary resource read and proves that no call-owned
+request or kit auxiliary falsely declared as a read departed, unless an explicit `writeOutcome: "unknown"` overrides that
+proof. Custom `api()` and `remoteMcp()` connectors, invocation deadlines and
+cancellation without a complete answer retain conservative write outcomes. The final program
 error includes the first timeout in `details`; multiple write timeouts also
 appear in `timeouts`, bounded to ten entries.
 
@@ -908,6 +911,13 @@ because connecta enforces them above the sandbox:
 | Result                                                                                  | 24,000 serialized characters                                                                                 |
 | Logs presented to the model                                                             | 4,000 characters                                                                                             |
 
+For any tool whose output declares `page`, continue while `page.hasMore` is true.
+When approaching the program's host-call limit, return `page.nextCursor` before
+the call that would exceed it and continue in the next program with the same
+arguments and that cursor; don't restart.
+For example, return `{ nextCursor: result.page.nextCursor }` after reducing the
+current page, then pass that cursor to the tool in the next program.
+
 Every `call`, `read`, `search`, `describe`, `result`, and `skill` spends one host
 call on entry, before resolution, validation, or dispatch; automatic transfer
 pages of a paged result do not. Catching a local refusal refunds nothing.
@@ -1023,10 +1033,21 @@ sent and records nothing: it was never an attempt (`W9`).
 
 ## Writes
 
+Kit write tools refuse whole `[redacted]` string values (including decoded
+spellings) and withheld links in argument keys/values with `invalid_args`
+before the program runs. Longer prose may mention the marker: for example,
+`{ body: "the log says [redacted]" }` is accepted. Standard hatches and typed
+kit requests refuse any marker containment in paths and queries, including on
+reads. Obtain the original value/link or omit the field when a whole value is
+withheld. Admission checks agent arguments rather than bodies later composed
+from internal reads. Legacy non-kit and remote MCP tools keep their own rules.
+
 Whether an endpoint writes belongs to deployment code. Every deployment sets
 `readOnly` for `/mcp` explicitly; construction fails without it. Each named pool inherits
 the deployment's `readOnly` unless it sets its own, in either direction. The
-client owns approval; Connecta answers one question per endpoint: can it write.
+client owns approval. Every connector also accepts optional `readOnly?: boolean`
+(default `false`), enforced on every endpoint. Effective read-only is endpoint OR
+connector; setting connector `false` cannot reopen a read-only endpoint.
 
 ```ts
 createConnecta({
@@ -1053,13 +1074,21 @@ all calls this deployment can make through it.
 
 | Precedence | Evidence                                                 | Result                                                                                                                                           |
 | ---------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
-| 1          | Exact deployment `classification[connectorId][toolName]` | `read` or `write`, even over a stale provider review                                                                                             |
+| 1          | Exact deployment `classification[connectorId][toolName]` | `read`, `write`, or `hidden`, even over a stale provider review                                                                                  |
 | 2          | `Connector.classification` provider review               | Reviewed writes remain writes; a stale schema digest makes a read a write; an explicit downstream contradiction also invalidates a reviewed read |
 | 3          | Downstream annotations                                   | Read only when `readOnlyHint === true && destructiveHint !== true`; otherwise write                                                              |
 
 Unknown connector override keys fail construction. Unknown static tool keys
-fail construction; unknown remote tool keys fail publication of the whole
-catalog. Overrides are exact tool names, including names containing dots.
+fail construction. An absent runtime-discovered tool leaves its override
+dormant and emits an operator warning once per catalog change; the override applies if the name returns.
+Hidden tools are absent from search and describe and refuse every call, including
+a guessed name. `"write"` selects the host approval path. MCP recovery sends a
+tool only once when either its effective or source class is write, even when an
+override changes write to read. The source class is the verified provider review
+where present during migration, otherwise the server annotations. It also governs
+authorization recovery, program re-runs and ambiguous failure outcomes: after
+dispatch, an unknown outcome has no retry or wait advice, including on timeout or
+cancellation. Overrides are exact tool names, including names containing dots.
 They are never inferred from descriptions or arguments.
 
 **W9.** Programs on a writable endpoint may write. A dispatched write is awaited even
@@ -1069,8 +1098,11 @@ write makes the run fail `write_outcome_unknown` with
 `writes: { succeeded, failed, unknown }`, regardless of its return value.
 A failed program that already wrote carries those counts on its error. No
 write is automatically retried, including an ambiguous timeout. A downstream
-refusal or a tool's `isError` can establish failure; a timeout or an unanswered
-transport failure leaves the outcome unknown.
+refusal can establish failure only when it covers the whole call: a request
+connecta never sent, or an HTTP 4xx refusal (not 408) of the only request the
+call dispatched. A write's `isError`, a timeout, an unanswered transport
+failure, and a custom connector that composed several calls leave the outcome
+unknown.
 
 **W10.** `execute.maxWrites`, default 10, bounds a program's writes in
 addition to the host-call budget. It is checked after argument validation and
@@ -1094,7 +1126,10 @@ omit write tools from `search_tools`, `connecta.search`, and
 `connecta.describe`, and refuse every write call through `call_tool`,
 `call_destructive_tool`, and programs with `read_only_endpoint` before
 validation or dispatch. Guides and skills are documentation and may still name
-those tools. `tools/list` is the same six tools on both. Approval belongs to the client.
+those tools. Meta endpoints list the same six tools in both modes.
+[Native pools](./meta-tools.md#native-tool-surface) list individual downstream
+tools and omit writes when read-only. They retain `execute_code` by default;
+`executeCode: false` replaces it with `read_result`. Approval belongs to the client.
 `readOnly` grants no tool or connector access and cannot be set by guest code,
 request arguments, or a downstream catalog. `execute.approval`,
 `Connector.approval`, per-tool approval exemptions, and pool `trust` are

package/documentation/deploying.md

@@ -3,7 +3,8 @@
 Use this guide when creating or maintaining a deployment. For changes to the
 Connecta package itself, follow [repository policy](https://github.com/zackbart/connecta/blob/main/AGENTS.md).
 For work through an already connected endpoint, use [Operating an endpoint](./operating.md).
-[All agent routes](./README.md) are in the index.
+[All agent routes](./README.md) are in the index. For a cursor signing-key error,
+follow [cursor-key recovery](#recover-a-cursor-signing-key).
 
 ## Choose a deployment
 
@@ -13,7 +14,8 @@ For work through an already connected endpoint, use [Operating an endpoint](./op
 | Docker             | [Container setup in the same Node template](../templates/node/README.md#run-it-in-docker) | Same source and config, persistent named volume                              |
 | Cloudflare Workers | [Worker example](../examples/worker/README.md#deploy)                                     | Workers Paid plan, Worker Loader binding, one D1 database, Cloudflare Access |
 
-These are the two deployment shapes. Docker packages the Node project.
+These are the two deployment shapes. Docker packages the Node project, and
+Alchemy deploys the Worker.
 Templates and their configuration files own the full runnable steps and
 environment-variable names; follow them rather than rebuilding their setup
 from the contract reference.
@@ -50,24 +52,84 @@ Follow the [template README](../templates/node/README.md) for storage paths,
 backups, Docker provisioning, secrets, and optional modules. Run the deployment's
 `npm run typecheck` after configuration changes.
 
+Retain the Node template's `undici` dependency and serve with `listen` from
+`@zackbart/connecta/node`. `listen()` installs the owned sender for every
+maintained-provider request, reads included, remote MCP writes, and downstream
+OAuth token exchange/refresh, dynamic registration and revocation POSTs.
+Its separate pre-auth request buffer defaults to 4 MiB, matching core's
+authenticated `admission.requests.maxBodyBytes` default. To accept larger MCP
+bodies, configure both core and `listen(..., { maxBodyBytes })`; a smaller
+platform, proxy or adapter cap still wins. See
+[request body limits](./architecture.md#admission-in-two-places).
+A Node host serving `connecta.fetch` without `listen()` has no owned sender:
+every maintained-provider write, every reviewed POST read and every remote MCP
+write is refused before sending. Downstream OAuth credential POSTs also require
+that sender; discovery GETs retain native fetch. Resource writes worked in 0.34.1;
+credential POSTs used native fetch through 0.34.1. For example, an `assistant` using
+`vercel_api_read` to POST `/v1/registrar/domains/availability` needs that
+transport even on a read-only endpoint. A Node deployment using only the root
+entry refuses those requests before sending them. Workers use their native
+fetch transport.
+
+By default, Node's `listen()` handles SIGTERM and SIGINT: it stops accepting
+connections, closes idle connections and accepted sockets without a first HTTP
+request, closes request and code admission, reaps sandbox children, and drains
+active responses and deferred work. A connection serving an active response
+closes as soon as all its admitted responses finish, including SSE, without
+waiting for the normal keepalive timeout or for the client to close. Normal
+keepalive before shutdown is unchanged. Its shutdown deadline defaults to ten seconds
+(`shutdownTimeoutMs`). For example, retain the template's `listen(connecta, port)` when running it under
+Docker Compose so `docker compose stop` uses this cleanup.
+
+The owned Node sender connects directly by default. To send maintained-provider
+requests (including reads), remote MCP writes and OAuth credential POSTs through an HTTP(S) CONNECT
+proxy, set `proxy` explicitly on `listen`:
+
+```ts
+listen(connecta, { port: 3000, proxy: "http://proxy.example.com:8080" });
+```
+
+The URL must have an HTTP or HTTPS scheme and no path, query or fragment.
+Optional URL username/password credentials authenticate CONNECT only; they are
+never forwarded to the destination. Load credential-bearing URLs from the
+host's secret configuration. The sender validates the option before listening,
+uses an owned proxy dispatcher for each send, and closes it when the response
+ends or is canceled. TLS certificates for both proxy and destination use Node's
+normal trust configuration; TLS interception requires operator-configured trust.
+
+The sender ignores `NODE_USE_ENV_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY` and global
+dispatchers. Remote MCP reads retain native fetch and its proxy settings; the
+explicit `proxy` option controls only owned sends. Set the host's native-fetch
+proxy policy too if the remote server requires proxy egress for discovery and
+reads. CONNECT failure before destination dispatch is a known unsent failure;
+a connection failure after a write dispatch is unknown and non-retryable.
+Neither case automatically repeats the write. A credential POST is never
+replayed by the sender, including after HTTP 421, a reset or a 503. An uncertain
+refresh requires authorization again; Connecta blocks the spent refresh
+fingerprint rather than redeeming it twice. Once a refresh claim has been
+submitted, that protection remains conservative even if proxy setup later fails.
+Use a fresh authorization flow to reconcile. OAuth discovery remains on native
+fetch and needs its own host proxy policy. These credential POST requirements
+change the native-fetch behavior of 0.34.1.
+
 ## Start on Workers
 
-Follow the [Worker example](../examples/worker/README.md#deploy) to create D1,
-set secrets, configure `PUBLIC_URL` and `LOADER`, and deploy with Wrangler.
-When copying it into a separate repository, follow
-[the separate-project installation](../examples/worker/README.md#copied-into-its-own-repository)
-and pin Connecta's exact version. The optional `@cloudflare/codemode` peer
-must be installed for the Worker executor.
-
-Attach Cloudflare Access to the Worker destination. Interactive MCP clients
-need Managed OAuth, Dynamic Client Registration, and the documented redirect
-allowlist. Machines are declared agents: they use `/agent/<pool>` with the
-agent's `cta_` bearer as their only credential, once the
-[agent bypass application](#agent-endpoints-behind-cloudflare-access) exists;
-Access service identity alone is refused. Keep
-`enable_request_signal`, construct Connecta once per isolate, and pass `ctx`
-through to `fetch`. The example owns those details and
-[the machine-token procedure](../examples/worker/README.md#machine-tokens).
+Use the [Worker example](../examples/worker/README.md) as the canonical runnable
+setup and upgrade guide. Alchemy deploys that example's stack; it owns the
+Worker, D1 database, Worker Loader, secrets, and Access applications.
+
+| Task                                 | Canonical procedure                                                                                                                                                                                            |
+| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Copy and install a deployment        | [Separate-project installation](../examples/worker/README.md#copied-into-its-own-repository), including exact versions, peers, ignore files, and trusted tooling                                               |
+| Deploy or update the stack           | [Deploy](../examples/worker/README.md#deploy), including account permissions and consistent stage selection                                                                                                    |
+| Protect secrets and retain data      | [Secrets and state](../examples/worker/README.md#secrets-and-state) and [destroying and recovering](../examples/worker/README.md#destroying-and-recovering)                                                    |
+| Configure human and agent access     | [Cloudflare Access](../examples/worker/README.md#cloudflare-access), [agent bypass](../examples/worker/README.md#let-agents-through-access), and [machine tokens](../examples/worker/README.md#machine-tokens) |
+| Move an existing Wrangler deployment | [Take over existing resources](../examples/worker/README.md#moving-a-wrangler-deployed-worker-to-alchemy)                                                                                                      |
+| Run locally and verify a deploy      | [Local development](../examples/worker/README.md#local-development) and [verification](../examples/worker/README.md#verify-after-deploying)                                                                    |
+
+Retain the example's [compatibility flags and entrypoint wiring](../examples/worker/README.md#files).
+The [agent bypass notes](#agent-endpoints-behind-cloudflare-access) below record
+verified ingress behavior and the cases that still require verification.
 
 ## Agent endpoints behind Cloudflare Access
 
@@ -76,7 +138,8 @@ alone and which ignores Access context entirely
 ([agent endpoints](./auth.md#agent-endpoints)). Behind Access, the edge must
 let those requests through without an Access login or service token. The P0
 probe ([observations](./architecture.md#production-access-bypass-for-agent-endpoints))
-verified this shape on 2026-10-15:
+verified this shape on 2026-10-15. The Worker example's `alchemy.run.ts`
+declares both applications:
 
 1. Keep the Worker-level application, whose destination is
    `{ "type": "worker", "worker_id": "<the Worker script tag>" }`, exactly as
@@ -166,6 +229,27 @@ personal connectors in their pools.
 [Auth](./auth.md#principals-visibility-and-operators) owns maintainers and members;
 [Clerk setup](./auth.md#clerk-oauth-tokens-and-operator-sessions) owns resource-bound
 tokens and `aud_claim_enabled`. A person's operator session is not an MCP token.
+Several deployments can share one Clerk instance with one Organization each;
+[Clerk Organizations](./auth.md#one-clerk-instance-one-organization-per-deployment)
+owns that setup and its isolation tradeoff.
+
+Public deployments require ingress rate limiting on all authenticated routes,
+including agent, operator, connection-start, and callback paths. Connecta's
+fixed bound of 16 active inbound authorizations per loaded core/process or
+isolate fast-refuses with retryable 503 `authentication_busy` and `Retry-After: 1`.
+A separate allowance of 16 abandoned operations holds stalled work after its
+hard deadline plus one second of grace. While it is full, new authentication
+receives the same 503, the log records `authentication_abandoned_saturated`,
+and `/health` reports `admission.authentication.abandonedSaturated: true`.
+Stalled work counts until it settles or until the garbage collector frees
+everything that could settle it, as after Cloudflare cancels an invocation.
+That second release is eventual, never timed, and needs `FinalizationRegistry`:
+on Workers, `enable_weak_ref` or a compatibility date of 2025-05-05 or later.
+`/health` reports `admission.authentication.unreachableRelease`.
+These bounds limit outstanding work, not requests per second or a quota shared by several
+isolates or deployments. Budget ingress across the identity-provider account;
+see [authentication capacity](./auth.md#authentication-capacity-and-ingress-limiting)
+for route coverage and the interaction with MCP execution admission.
 
 Every deployment must set `readOnly` in its configuration; startup fails without
 it, and the template and Worker example set `readOnly: false`. Each named pool
@@ -230,14 +314,74 @@ Bump the exact package pin, read the [changelog](../CHANGELOG.md) for every
 intervening release, and apply the relevant migration before startup. `init`
 does not merge changes into an existing deployment.
 
+For an existing Node deployment, add the Node entry's pinned optional peer
+before starting the upgraded package: `npm install --save-exact undici@6.29.1`.
+The current Node template already declares this dependency.
+
+For 0.35.0, serve Node with `listen` from `@zackbart/connecta/node`, as the
+current template does. Without `listen()`, a host serving `connecta.fetch` has
+no owned sender: every maintained-provider write, every reviewed POST read and
+every remote MCP write is refused before sending, although each worked in 0.34.1.
+Downstream OAuth token, registration and revocation POSTs also require that
+sender. With `listen()`, every maintained-provider request, reads included,
+remote MCP writes and those credential POSTs use the owned sender. Configure
+`listen(..., { proxy })` explicitly for HTTP(S) CONNECT proxy egress; ambient
+`NODE_USE_ENV_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY` and host proxy dispatchers do
+not configure it. Remote MCP reads and OAuth discovery GETs retain native fetch
+and need their own host proxy policy. An uncertain refresh requires fresh
+authorization rather than replaying the spent token. See [Start on Node](#start-on-node).
+
+Authenticated MCP bodies now default to 4 MiB through
+`admission.requests.maxBodyBytes`; Node's separate pre-auth buffer also defaults
+to 4 MiB. Configure both core and `listen(..., { maxBodyBytes })` if a deployment
+must accept larger bodies. Smaller platform or proxy limits still apply.
+
+After a dispatched write reports an unknown outcome, read the target before
+making another write. Programs retain that outcome even when guest code catches
+the error; see [Writes](./code-mode.md#writes). Provider
+continuations now bind their connection, credential owner and read arguments;
+connections with caller-dependent downstream identities also bind the admitted
+caller and pool owner. Follow each provider's migration rules for old cursors.
+No database conversion or agent-token rotation is required solely for 0.35.0.
+
+Native pools and code-off result paging are optional; existing pools keep the
+meta-tool surface. See [Native tool surface](./meta-tools.md#native-tool-surface).
+Vercel workload admission and the separate Eve helper are also opt-in; existing
+agent tokens keep working. See [Vercel workload credentials](./auth.md#vercel-workload-credentials)
+and [Eve agents](./meta-tools.md#eve-agents).
+
+- [Provider migration for 0.35](./provider-migration-0.35.md) collects provider upgrade actions for 0.35.0, including removal of Infisical, Notion, and Mixpanel factories.
 - [Migration to 0.34](./migration-0.34.md) covers the Overview landing page, Endpoints at `/endpoints`, default browser titles, and Workspace discovery in owner-less agent pools. No storage migration or token rotation is needed from 0.33.
 - [Migration to 0.33](./migration-0.33.md) maps every removed access option to `maintainers`, pool `members`, and `agents`, moves agents to `/agent/<pool>`, and covers pool owners, token revisions, operator contract v2 with its operator route changes, and the pre-auth listen fix.
 - [Tokens issued before agents](./auth.md#agent-tokens-and-upgrading-from-earlier-tokens) stop admitting until each machine's token is bound once to a declared agent with `npm run adopt-token -- <token-id> <agent>` (Node) or `AccessTokenManager.adopt`, which keeps its secret. Human-bound tokens stay refused; issue those agents new tokens. Pool members name `"agent:<name>"` instead of matching token record ids.
 - [Node storage from 0.28](../templates/node/README.md#storage) uses `connecta migrate-state` to copy the JSON state into SQLite. Activity JSONL is not imported.
 - [Worker storage from 0.28](../examples/worker/README.md#upgrading-from-028) copies KV into D1 with a one-shot migration.
-- [Notion, Vercel, and Cloudflare for 0.29](./provider-migration-0.29.md) change defaults and retained API tool names.
+- [Worker deployments on Wrangler](../examples/worker/README.md#moving-a-wrangler-deployed-worker-to-alchemy) move to Alchemy once, adopting the Worker, D1 database, and Access applications so the script tag and Access AUD stay unchanged.
+- [Notion, Vercel, and Cloudflare for 0.29](./provider-migration-0.29.md) records historical defaults and retained API tool names.
 - [Executor wiring](./code-mode.md#deploy-time-capability) requires branded shipped executors or a self-managed custom executor.
 
+## Recover a cursor signing key
+
+Paged API discovery and bound list continuations use one signing key in the
+deployment store. A load failure returns retryable `unavailable` and names the
+cursor signing key without revealing its value. Restore database connectivity
+first, then retry the call. A valid key already cached by a process keeps working.
+
+If the stored key is corrupt, pause incoming traffic and stop every Node process
+(or prepare a fresh Worker version), then delete only this row from the
+existing SQLite/D1 database:
+
+```sql
+DELETE FROM connecta_kv WHERE key = 'continuation-key:v1:signing';
+```
+
+Restart all Node processes or switch all traffic to the fresh Worker version
+before accepting requests again, so no instance retains an older cached key.
+The next paged call creates one replacement key atomically. Do not print or
+inspect its value. Outstanding cursors signed with the old key fail
+`invalid_args`; start each affected search, details walk or list at its first
+page. Other deployment state and credentials remain in the database.
+
 ## Contributor reference
 
 ### Implementation and evidence