@zackbart/connecta 0.34.0 → 0.35.0

package/documentation/operating.md

@@ -7,7 +7,12 @@ and credentials are the deployment operator's responsibility; use
 
 ## Choose the call path
 
-Connecta exposes six top-level tools. Read [the tool table](./meta-tools.md#the-six-tools)
+A [native pool](./meta-tools.md#native-tool-surface) lists individual operations.
+Use your host's tool search, call a known operation directly, and follow its
+repair or authorization handoff. Use `execute_code` for combined work when
+listed; without code, page results through the listed `read_result` tool.
+
+Meta endpoints expose six top-level tools. Read [the tool table](./meta-tools.md#the-six-tools)
 for exact arguments and result envelopes. Follow the endpoint's supplied
 instructions and `skills` usage guide for deployment-specific context.
 
@@ -24,7 +29,7 @@ descriptions. On a writable endpoint, programs and `call_destructive_tool` may
 write within the caller's grants, and `execute_code` is annotated as a write;
 the client controls approval. On a read-only endpoint, search and describe omit
 write tools and every write call is refused with `read_only_endpoint`, even one
-a connector guide names; tell the user rather than looking for another route. Never change pool, identity, or `readOnly` to work
+a connector guide names; tell the user rather than looking for another route. A connector marked Read-only serves only read-classified tools even on a writable endpoint; writes and unclassified tools are omitted from search/describe and refused on every call path. Endpoint and connector restrictions compose by OR. Never change pool, identity, or `readOnly` to work
 around a refusal.
 [Routing between the call surfaces](./meta-tools.md#routing-between-the-call-surfaces)
 owns the full decision rules.
@@ -100,6 +105,12 @@ values. Treat it as evidence, not a provider contract; handle missing fields.
 
 ## Large results and resources
 
+MCP request bodies default to a 4 MiB limit on every endpoint. Deployment code
+can set `admission.requests.maxBodyBytes`; `describeConfig()` reports its value
+and source. An oversized body returns 413 before tool dispatch. See
+[request admission and body limits](./architecture.md#admission-in-two-places)
+for Node's separate pre-auth buffer and the listen-classification bound.
+
 Direct calls may return a preview and a result handle. Page the handle through
 `connecta.result` in a program using the returned offset and byte limits, or
 reduce the data in the original program. Handles are short-lived and bound to
@@ -122,10 +133,23 @@ and status do not begin consent on their own. Follow
 [argument recovery](./meta-tools.md#argument-recovery) for the specific failure.
 
 A dispatched write is never automatically replayed. An ambiguous timeout may
-mean the provider applied it; inspect state or ask for the missing decision
-before issuing it again. [Retry semantics](./code-mode.md#retry-semantics) and
+mean the provider applied it; inspect state to check whether it took effect, or
+ask for the missing decision, before any fresh call. [Retry semantics](./code-mode.md#retry-semantics) and
 [writes](./code-mode.md#writes) describe program outcomes and write accounting.
 
+## Read failure records
+
+Failure logs and connector status report checked facts without downstream
+error text. A failure record can include `httpStatus`, an integer from 100
+through 599; status messages can include `with HTTP <status>`. Recorded status
+is retained when a write's 401 had no mapped authorization verdict, when a Google write reports
+an unknown outcome, and when a response exceeds the connector's byte ceiling.
+If no answer was recorded, the field is absent. The status alone does not
+prove whether a write took effect or permit replaying it.
+
+For example, a `crm` write answered HTTP 503 can log `httpStatus: 503` while
+its outcome stays unknown. Inspect the target before repeating the call.
+
 ## Contributor reference
 
 ### Implementation and evidence

package/documentation/operator-tests.md

@@ -61,7 +61,7 @@ pool member, who gets the member page, with no tabs, on every path.
 | Activity             | No calls                             | Activity              | Member page, no activity request    |
 | Settings             | Snapshot without connectors or pools | Config                | Member page, no configuration facts |
 
-Populated Overview has a failing connector, drift, auth and credential problems
+Populated Overview has a failing connector, auth and credential problems
 and a tokenless agent in its attention list. Populated Endpoints shows who can use each endpoint; populated Tokens has one
 agent per slot state, with pools and last seen.
 
@@ -102,7 +102,13 @@ empty catalog counts zero.
 `test/browser/operator-overview.spec.ts` covers the Overview on the frozen v2
 fixtures: the status pill, stat labels and numbers, map columns, dashed read-only grants and dotted
 tokenless access; attention rows with their fix links, a copied fix prompt equal
-to the catalogue's text and a failing connector sorted first; the hover
+to the catalogue's text, config order through a staggered full refresh, prototype-named
+connector IDs during loading and failure, and stable single-card height when
+its catalog empties. A single long-id, long-title card at 320, 390, 1024 and
+1440px covers all eight status labels, both auth scopes, with and without the
+Read-only badge, tools and an action. Text rows stay single-line, full text
+remains accessible, links stay focusable, and the detail header and Overview
+attention rows retain their height; the hover
 sentence replacing the legend, and dimming; keyboard focus in column order with each node's sentence
 as its accessible name, Enter opening an endpoint's row and a connector; the
 narrow list, whose caller chips link where their map nodes do; an empty deployment; and a member at `/` getting the member page
@@ -169,6 +175,9 @@ updates run only through `workflow_dispatch`.
 On a matching Linux runner, `pnpm install --frozen-lockfile`, install Chromium with the command above,
 then run `pnpm run test:browser:snapshots`. The normal command is
 `pnpm run test:browser`. Missing baselines fail CI; retries cannot bless them.
+Visual comparisons run in their own Playwright project without retries, so a
+mismatch fails on its first attempt. When any attempt fails, CI uploads
+the HTML report, actual/expected/diff images and traces as `playwright-report`.
 Set `OPERATOR_VISUAL_INSPECT=1` to retain local screenshots under ignored
 `test-results/` for inspection, without updating committed baselines.
 

package/documentation/operator-ui.md

@@ -42,15 +42,15 @@ No select menu displays configuration. Copy is short labels; a failure names
 what to do next in one or two sentences and never quotes a route's or
 downstream's text.
 
-| Path               | Page                                                   | Who        |
-| ------------------ | ------------------------------------------------------ | ---------- |
-| `/`                | Overview (a member gets the member page)               | Maintainer |
-| `/endpoints`       | Endpoints; `#mcp/<pool>` opens that row                | Maintainer |
-| `/connectors`      | Connectors list; `?view=matrix` for the matrix         | Maintainer |
-| `/connectors/<id>` | Connector detail; `#tools`, `#connection`, `#activity` | Maintainer |
-| `/activity`        | Activity                                               | Maintainer |
-| `/tokens`          | Tokens, when token management is open to the viewer    | Maintainer |
-| `/settings`        | Settings                                               | Maintainer |
+| Path               | Page                                                         | Who        |
+| ------------------ | ------------------------------------------------------------ | ---------- |
+| `/`                | Overview (a member gets the member page)                     | Maintainer |
+| `/endpoints`       | Endpoints; `#mcp/<pool>` opens that row                      | Maintainer |
+| `/connectors`      | Connectors list; `?view=matrix` for the matrix               | Maintainer |
+| `/connectors/<id>` | Connector detail; `#tools`, `#connection`, `#activity`       | Maintainer |
+| `/activity`        | Activity                                                     | Maintainer |
+| `/tokens`          | Tokens, when agents are declared or token management is open | Maintainer |
+| `/settings`        | Settings                                                     | Maintainer |
 
 `/access` redirects to `/endpoints`, `/tools` to `/connectors`, and `/config`
 to `/settings`, replacing the history entry. Connector hashes `#config`,
@@ -68,15 +68,16 @@ parameters such as signed handoffs. A pool member sees the
   marks; a tokenless agent's mark is hollow). A dot legend counts each segment
   kind; the first two tiles link to their pages. At 760px and below the tiles
   sit two up, with People · Agents as one row across both.
-- **Needs attention.** One row per connector whose health is not ok, failing
-  first, then one per agent in a pool whose token is missing or revoked. A
+- **Needs attention.** One row per connector whose health is not ok, in
+  configuration order, then one per agent in a pool whose token is missing or revoked. A
   row names the problem ("crm needs authorization"), the endpoints it
   affects ("Affects /mcp and /mcp/team") or the agent URL it can't connect at,
-  and links to the existing fix: Connect, Replace key, Inspect or Review on
+  and links to the existing fix: Connect, Replace key or Inspect on
   the connector's Connection tab, or Issue token on Tokens. A row with a
-  problem code or drift also has Copy fix prompt. A problem keeps its row and
+  problem code also has Copy fix prompt. A problem keeps its row and
   prompt when the connector's detail read failed, prefixed "Details didn't
-  load". With no rows it reads "All clear".
+  load". Surviving connector rows retain their order as individual reads settle,
+  even when their severity changes. With no rows it reads "All clear".
 - **Who reaches what.** The [connection map](#connection-map).
 
 ### Connection map
@@ -108,6 +109,10 @@ instead of "0 tools".
 
 ### Endpoints
 
+Pool endpoint rows show the effective surface (`meta` or `native`) and whether
+code is on. These are read-only facts from deployment configuration; change
+`surface` and `executeCode` in deployment code.
+
 One row each for `/mcp` and every pool: the path, a read-only pill on a
 read-only endpoint, a copyable URL, who can use it, its connectors as colored
 monograms (four, then "+N"), its tool count over a read and write bar, and a
@@ -134,15 +139,37 @@ cells for the root), guarded grants' live verdicts, and read-only mode.
 ### Connectors
 
 One card per connector: title and id, one status pill, a Shared or Per person
-badge, its tool count over a read and write bar, and when it was last called.
+badge, a Read-only badge when connector `readOnly` is enabled, its tool count over a read and write bar, and when it was last called.
 All, Needs attention and Healthy filter the cards, with counts, beside a
 search field. A connector that is not fine adds one action (Connect, Replace
-key, Inspect, or Review for drift) that opens its Connection tab.
+key or Inspect) that opens its Connection tab.
 
 Every view shares one verdict per connector: the server's problem code first
 (a failed catalog reads "Catalog failed", never "Connected"), then a failed
-detail read ("Couldn't load", with no fix prompt), then a non-ok status, then
-catalog drift.
+detail read ("Couldn't load", with no fix prompt), then a non-ok status.
+Catalog drift is informational: it stays in the connector's Connection panel
+with its fix prompt and in Activity, and never affects health or attention.
+
+Health does not bounce while details load. A connector whose detail read is
+in flight (its `/ui/data` row is `loading`, during sign-in, Retry or a
+connector's Refresh) keeps the verdict the page last showed for it on every
+view (cards, filter counts, the Overview headline, bar, attention list and map,
+Endpoints and the connector page) until that read settles, never "Loading
+details" or an in-between verdict. A connector with no earlier verdict shows
+its contract status. Each connector changes only when its own read settles,
+so one slow read never holds back the others and no row moves for an
+in-between verdict. A new signed-in identity starts fresh. Cards reserve the action footer
+even when no action is needed and the tool bar row even when the catalog is
+empty. Each card header keeps its title, status and id/scope badges on single
+lines; long text truncates with ellipsis and retains its full value on hover
+and for screen readers. The connector detail header and Overview attention
+text follow the same rule, and truncated links remain keyboard focusable.
+Wider status labels never change the card height.
+
+The top bar uses an icon-only Search button (⌘K or Ctrl+K opens the palette).
+Deployment names stay on one line with ellipsis and their full name on hover;
+a name matching the product label is omitted. Tabs scroll horizontally when
+needed, moving to a second row on narrow screens.
 
 A List / Matrix toggle (`?view=matrix`) switches to a table of connectors by
 endpoint, `/mcp` first. A row header is the connector's monogram and name, plus
@@ -169,7 +196,7 @@ tabs:
 - **Connection.** An Authentication card (mode, OAuth client mechanism, who
   manages it, OAuth actions, and the credential card with masked last four,
   field states, and Replace, Test and Remove); a Diagnostics card of tiles
-  (catalog age, last call, drift counts) with a fix prompt beside each
+  (catalog age and last call) with a fix prompt beside each
   problem; and a Configuration card. Its badges name the kind (Remote MCP,
   HTTP API or Custom), provider, auth scope, endpoint host and usage guide.
   The auth row names the mode and draws each auth fact as a mono badge
@@ -181,6 +208,13 @@ tabs:
 - **Activity.** The [Activity](#activity) page for that connector, without
   connector chips or monograms.
 
+#### Read catalog changes
+
+Catalog refresh activity reports added, removed, and changed tool counts within
+its identity partition. The UI no longer compares tools with a release-reviewed
+manifest or shows schema-pin coverage. Check live annotations and deployment
+classification in the catalog when reviewing exposure.
+
 ### Settings
 
 The configuration snapshot as tiles, tagged "Defined in code", with no
@@ -213,9 +247,13 @@ editing controls. An empty section is not drawn.
 
 ### Tokens
 
-One row per agent declared in code, in `GET /ui/access-tokens` order: agent
-mark and name, pools as chips, a state pill (No token, Issued or Revoked), the
-issue or revoke date, and last seen ("never" when null). The heading note
+One row per agent declared in code, including OIDC-only agents when the token
+module is absent: agent mark and name, supported credentials (Agent token,
+Vercel OIDC, or both), pools as chips, a token state pill (Not configured, No
+token, Issued or Revoked), the issue or revoke date, and last seen ("never"
+when unknown). Not configured means the managed token module is absent and
+has no token controls; No token means that module has an unissued slot.
+An OIDC binding works independently of the token's state. The heading note
 reads "Declared in code"; nothing creates or renames an agent. Narrow screens
 stack each row into a card.
 
@@ -264,13 +302,13 @@ red when the calls span more than a minute.
 
 The top bar is one row: the mark, branding and deployment name, the section
 links (Overview, Endpoints, Connectors, Activity, Tokens, Settings), then
-Search (the command palette, also ⌘K or Ctrl+K), Appearance, and Account
+icon-only Search (the command palette, also ⌘K or Ctrl+K), Appearance, and Account
 (the signed-in account with Sign out or Change token). The mark is connecta's
 drawn "C" only when no product name, owner or favicon is configured; with
 `branding.favicon.svg` it is that SVG; otherwise there is none. The sign-in
 gate shows the same mark above "Sign in". Below 820px the section links move
 to a second row that scrolls sideways and keeps the current section in view,
-and Search shrinks to its icon. A member's top bar has only branding and
+with Search remaining an icon. A member's top bar has only branding and
 Account. The command palette searches visible pages, connectors and tools,
 opening connector results on Tools.
 
@@ -365,18 +403,36 @@ The maintainer view carries:
   code or credential material.
 - `root`: plain `/mcp`, its `readOnly`, and its `maintainers`, people only.
 - `pools`: every declared pool with `humanPath` (`/mcp/<name>`), `agentPath`
-  (`/agent/<name>`), `readOnly`, `owner` (the Workspace address its agents act
+  (`/agent/<name>`), `readOnly`, effective `surface` (`meta` or `native`),
+  `executeCode` (whether code is enabled), `owner` (the Workspace address its agents act
   as), its declared `tools` (never intersected; no `requireReadOnly` is ever
   true), and its `members`, agents as `{ kind: "agent", name }`. Every listed
   person carries a `label` from the same directory lookup activity actor
   labels use, on an interactive read only, and `null` without a directory
   (Cloudflare Access) or an entry. An open deployment's anonymous maintainer
   reads every `owner` as `null`.
-- `agents`: every agent declared in code, with its pools, its token slot
-  (`state`, `issuedAt`, `revokedAt`, `revision`) exactly as
-  `GET /ui/access-tokens` lists it, and `lastSeenAt`, the newest visible
-  activity row recorded for that agent, or `null` when activity is off or
-  none is visible. A slot read that fails answers 503 rather than drop agents.
+- `agents`: every agent declared in code, in deployment order, with its pools
+  and `credentialTypes` (`access_token`, `vercel_oidc`, or both). These are
+  immutable deployment descriptions: the token kind requires the managed
+  access-token module, and OIDC requires that agent's own workload binding.
+  They grant nothing. `token` is `null` when the token module is absent;
+  otherwise its slot (`state`, `issuedAt`, `revokedAt`, `revision`) is exactly
+  what `GET /ui/access-tokens` lists, including an unissued `state: "none"`.
+  A failed or incomplete slot read answers 503 rather than drop agents.
+  `lastSeenAt` is the newest sampled successful agent-endpoint admission or
+  visible historical activity timestamp, or `null` when unknown or withheld.
+  Admission means credential verification and membership in that declared pool
+  succeeded; it does not promise a completed call. Invalid credentials,
+  refused/undeclared pools and human routes record nothing. The observation
+  stores only the declared name and timestamp, independently of activity.
+  Admission observations sample at most once per minute: a valid stored time
+  less than 60 seconds behind the candidate skips the write, and an older
+  candidate never moves the time backwards. This is minute-level admission
+  evidence, not an exact timestamp for every request. Each observation uses at
+  most two atomic storage attempts under the smaller of the configured probe
+  deadline and 500 ms, within the request lifetime. Failure, timeout or
+  contention can lose a sample; a later eligible admission can try again.
+  Observation never refuses admission or retries MCP or tool work.
 - `matrix`: a cell per connector for plain `/mcp` (`pool: null`) and for each
   pool that serves it, with that endpoint's tool names or `"all"` and
   `runsAs`. A Workspace connector with a subject mapping is
@@ -400,10 +456,12 @@ The maintainer view carries:
   mechanism when known. Static and unobserved catalogs have a null age;
   persisted catalogs retain their original fetch time.
 - `live.activity`: available, unconfigured, forbidden, or unavailable history.
-  Last-call and last-seen lookups need the activity permission and read gate,
+  Historical last-call and last-seen lookups need the activity permission and read gate,
   scan up to 1,000 recent rows, filter connector/tool grants, restrict personal
   connectors to the caller's activity identity, and copy a validated timestamp
-  and outcome only. A null means unknown or absent in that window.
+  and outcome only. Admission last-seen reads require a maintainer and honor
+  the configured activity read gate, including when history is unavailable;
+  they work with no activity module. A null means unknown or withheld.
 - `connectors: []`.
 
 The member view is exactly that member's projection: `config`,
@@ -497,7 +555,14 @@ duplicate summary, token, config, detail or body reads. The passive retry schedu
 stays bounded and does not reset its budget on a deadline. Retry remains available
 during recovery configuration loading and supersedes and aborts the old cycle;
 identity changes, navigation and connector-page unmount also cancel it. Navigation
-that cancels pending data schedules a bounded reread for the destination. Failed reads retry after
+that cancels pending data schedules a bounded reread for the destination. A scoped OAuth poll publishes only its connector's detail and live row. It does
+not supersede a pending full admission or catalog/auth cycle, release its
+recovery guard, or clear its deadline. That full cycle still publishes other
+connectors as they settle and decides recovery, retaining the newer polled row
+even when its summary was pending or its deadline exposed Retry. Only a newer
+full cycle, mutation, identity change, or sign-out fences older work. Owed
+publication neither spends nor resets the failed-read retry budget and adds no
+timer. Failed reads retry after
 2, 2, 4, and 8 seconds. Refusals preserve the throttle and retry budget. After
 those four automatic retries, a focus return can request one more read after
 the eight-second backoff, without replenishing the automatic budget. Retry
@@ -554,6 +619,11 @@ names, descriptions or schemas enter the event. Private catalog changes require
 a matching principal owner even when the connector uses shared auth. Empty credential declarations
 report `credential_required` before running a connector status or catalog probe.
 
+Activity label resolvers receive an optional `AbortSignal`. Pass it to user-directory
+fetches and stop work when it aborts: the reader has left or the label lookup
+budget has expired. Clerk label lookups follow the same lifetime and discard
+late answers after cancellation.
+
 ## Contributor reference
 
 ### Source and tests

package/documentation/provider-auth-migration.md

@@ -1,6 +1,11 @@
 # Provider auth migration
 
-Use this upgrade guide when moving a Stripe, Notion, Vercel, or Cloudflare
+Hosted selections described in this historical migration are now removed.
+For Stripe, Vercel, Cloudflare, Notion, Mixpanel, and GitHub hosted connections,
+use the [current hosted MCP migration guide](./hosted-mcp-migration.md).
+The API migrations below remain applicable.
+
+Use this upgrade guide when moving a Stripe, Vercel, or Cloudflare
 deployment from 0.30 to 0.31, where `auth` selects each provider's
 implementation.
 [Deployment upgrades](./deploying.md#upgrade-an-existing-deployment) cover other
@@ -13,6 +18,31 @@ uses one implementation: configure two ids for both.
 
 ## Stripe
 
+For current API-key setup, use [Maintained provider setup](./providers.md#stripe).
+For the 0.35 argument and paging changes, use [Stripe surface migration](./provider-migration-0.35.md#stripe).
+
+## Choose OAuth or an API key
+
+Import `stripe` from `@zackbart/connecta/providers/stripe`. Choose one of two setup paths:
+
+```ts
+// OAuth: Stripe's hosted MCP. Authorize the connection with Stripe.
+stripe("billing", { purpose: "Payments", auth: { type: "oauth" } });
+stripe("billing", { purpose: "Revenue reports", auth: { type: "oauth" }, readOnly: true });
+
+// API key: Connecta's REST connector. Paste the key into this connection in the operator UI.
+stripe("billing", { purpose: "Payments", auth: { type: "apiKey" }, mode: "production" });
+stripe("billing", { purpose: "Revenue reports", auth: { type: "apiKey" }, mode: "production", readOnly: true });
+```
+
+For an API key, set `mode` to `"production"` or `"sandbox"` to match the key.
+Use a secret (`sk_`) or restricted (`rk_`) key. For read-only access, prefer a
+restricted `rk_` key configured with only read permissions: Stripe enforces
+those permissions too. Connecta's `readOnly: true` omits non-read tools and
+refuses their calls on every endpoint. Omit it for the default writable connector;
+endpoint restrictions still apply. OAuth needs no `mode` and can reach both live
+and sandbox accounts through Stripe's account selectors.
+
 Stripe's hosted MCP server stops accepting secret keys and untagged
 restricted keys on 2026-10-31; Stripe still documents agent-tagged restricted
 keys for it. Connecta's hosted Stripe connection is OAuth only either way, and
@@ -62,7 +92,8 @@ or a generated one as `Idempotency-Key` and return it (DELETE sends none).
 Caller-supplied keys may contain up to 255 characters. An ambiguous POST write
 also returns the key in `uncertainCall.recovery.idempotencyKey`, including when
 the call deadline interrupts it. See [argument recovery](./meta-tools.md#argument-recovery)
-before retrying.
+before retrying: a custom connector that wraps or composes Stripe calls gets
+the key as a diagnostic only, never advice to reuse it.
 Every request, v1 and v2, sends `Stripe-Version: 2026-09-30.endive`, the
 version of the pinned index, whatever the account's default API version, so
 response shapes and accepted parameters follow that version. Check fields
@@ -78,56 +109,9 @@ connector need an OAuth connector beside it. Read the connector runtime guide wi
 
 ## Notion
 
-Every `notion()` call must now name `auth`. 0.30 defaulted to hosted MCP and
-selected the REST interface with `surface: "api"`; `surface` is gone:
-
-```ts
-connectors: [
-  notion("notion", { purpose: "Workspace content as the signed-in user", auth: { type: "oauth" } }),
-  notion("notion_bot", { purpose: "Internal integration content", auth: { type: "token" } }),
-]
-```
-
-| 0.30 configuration                                                                                                                        | Now                                                                                                                  |
-| ----------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
-| No `surface`, or `surface: "mcp"`                                                                                                         | `auth: { type: "oauth" }`. Same endpoint, reviewed catalog, grant, and optional `callAdmission`.                     |
-| `surface: "api"`                                                                                                                          | `auth: { type: "token" }`. The integration token stored for the same connector id carries over; run its Test action. |
-| `credentialLabel` or `defaultPageSize`                                                                                                    | Token only, as before. Under OAuth they are refused by name at construction.                                         |
-| `integration_search`, `_get_page`, `_get_page_content`, `_get_data_source_schema`, `_query_data_source`, `_create_page`, `_append_blocks` | Unchanged names and contracts. `integration_append_blocks` also takes `checklist`.                                   |
-| `integration_get_database`                                                                                                                | `notion_api_read` `GET /v1/databases/{database_id}`.                                                                 |
-| `integration_get_page_property`                                                                                                           | `notion_api_read` `GET /v1/pages/{page_id}/properties/{property_id}`; `truncated_properties` names it.               |
-| `integration_list_users`, `integration_get_self`                                                                                          | `notion_api_read` `GET /v1/users` or `GET /v1/users/me`.                                                             |
-| `integration_list_comments`, `integration_add_comment`                                                                                    | `notion_api_read` `GET /v1/comments`; `notion_api_write` `POST /v1/comments`.                                        |
-| `integration_update_page_properties`, `integration_trash_page`                                                                            | `notion_api_write` `PATCH /v1/pages/{page_id}` with `properties`, or `in_trash` to trash or restore.                 |
-
-Both auth variants accept optional `callAdmission`. On a token connector it
-replaces the whole default policy of 180 calls per minute and 3 concurrent
-per runtime. Malformed policies throw at construction. Notion's
-[request limits](https://developers.notion.com/reference/request-limits) allow
-600 requests per minute per connection on Business and Enterprise and 180 on
-other plans, with a separate workspace-wide limit shared by all connections.
-Account for other runtimes and tools that make multiple HTTP requests when
-choosing an override.
-
-The token connector gains Connecta's generic REST tools over Notion's pinned
-API index (`notion_api_search`, `notion_api_details`, `notion_api_read`,
-`notion_api_write`), so every public operation is reachable with the bot's
-token: views, page moves and Markdown, meeting notes, custom agents and
-sessions, file uploads by `external_url`, and data source changes. Every call
-is checked against the index before it is sent, and results arrive as
-`{ status, data, page? }`. The read-only POST queries (search, data source,
-meeting notes, agents, sessions, and session events) use `notion_api_read`;
-`page.in: "body"` says their cursor goes back in the body. Notion's OAuth token
-endpoints and multipart file sends are refused. The 0.29 reconciliation table
-and the `surface: "api"` complement rules no longer apply to Notion.
-
-Lost per mode. A token connector acts as the integration bot, never as a
-person, and has none of the hosted MCP's search across connected apps, page
-duplication, team and skill search, attachment downloads, or page-to-skill
-conversion. An OAuth connector acts as the user, and has none of the generic
-REST tools or the `integration_*` projections and authoring helpers. Configure
-both ids when a deployment needs both; a failed call is never retried on the
-other. Read the connector runtime guide with `connecta.skill("connector:<id>")` in `execute_code` for its usage conventions.
+The maintained Notion API provider is removed in 0.35. See the
+[provider removal migration](./provider-migration-0.35.md#remove-infisical-notion-and-mixpanel)
+and use generic `remoteMcp()` for the hosted server.
 
 ## Vercel
 
@@ -292,16 +276,7 @@ one; read or rotate withheld secrets in the vendor's dashboard.
   Failures of credential-bearing operations keep Stripe's type, code, and
   param but not its message. Create client-side sessions and links from your
   own server code.
-- **Notion** REST results and error text withhold the whole query and
-  fragment of canonical Notion file links, including links embedded in
-  Markdown and async task results. External proxy URLs keep their bytes;
-  AWS and Google signing-parameter values are withheld at any host. Writes
-  carrying the plain or encoded `[redacted]` placeholder in a Notion file
-  link's own query or fragment are refused before dispatch. See the
-  connector runtime guide through `connecta.skill("connector:<id>")` in `execute_code` for recognized hosts and scanning limits. Credential-named fields,
-  including database properties named like credentials, read as
-  `"[redacted]"`. Failures of the OAuth, file upload, bot user, and agent
-  operations keep Notion's code but not its message.
+
 - **Vercel** replaces environment values with `"[redacted]"` instead of
   dropping the field, and withholds Vercel's error text for every reviewed
   operation and every operation whose request takes a credential-named
@@ -319,4 +294,4 @@ one; read or rotate withheld secrets in the vendor's dashboard.
 [Decision 0005](https://github.com/zackbart/connecta/blob/main/decisions/0005-auth-selects-implementation.md)
 explains why auth selects the implementation. Maintained provider source
 skills and review tables live under `src/providers/` in the repository;
-`src/providers/vercel/value-safety.ts` owns Vercel's reviewed table.
+`src/providers/vercel/safety.ts` owns Vercel's reviewed table.

package/documentation/provider-migration-0.29.md

@@ -1,12 +1,17 @@
 # Notion, Vercel and Cloudflare migration for 0.29
 
+Hosted selections described in this historical migration are now removed.
+For Stripe, Vercel, Cloudflare, Notion, Mixpanel, and GitHub hosted connections,
+use the [current hosted MCP migration guide](./hosted-mcp-migration.md).
+The API migrations below remain applicable.
+
 Use this upgrade guide for an existing deployment.
 [Deployment upgrades](./deploying.md#upgrade-an-existing-deployment) cover other
 version changes; [integrating services](./integrating.md) covers new connectors.
 [The agent index](./README.md) routes package maintenance separately.
 
-This is the Phase 1 item 5d migration input for [Phase 5 release #709](https://github.com/zackbart/connecta/issues/709).
-Deploy it with the consolidated 0.29 release, not while the rework is in progress.
+This was the Phase 1 item 5d migration input for [Phase 5 release #709](https://github.com/zackbart/connecta/issues/709),
+which shipped as 0.29.0.
 Deployments that use Notion or Cloudflare must check their actual grants and
 connector ids in deployment configuration before that release.
 The provider audit establishes available auth modes, not production OAuth grants.
@@ -14,7 +19,7 @@ The provider audit establishes available auth modes, not production OAuth grants
 Cloudflare's part of this guide is superseded: `cloudflare()` now selects its
 implementation by `auth` and its key connector is complete on its own. Follow
 the [provider auth migration](./provider-auth-migration.md#cloudflare) for
-Cloudflare; the Cloudflare lines below record the 0.29 transition only.
+Cloudflare; the Cloudflare lines below record the transition shipped in 0.29.0 only.
 
 All three providers now default to hosted MCP. `surface: "api"` explicitly
 selects a REST complement and accepts only its API-specific options. The old
@@ -36,7 +41,7 @@ Notion has since moved to auth-selected implementations: `surface` is gone,
 and `auth: { type: "oauth" }` or `{ type: "token" }` selects hosted MCP or the
 REST connector. Upgrade with the
 [provider auth migration](./provider-auth-migration.md#notion); the rest of
-this paragraph records the 0.29 rules.
+this paragraph records the rules shipped in 0.29.0.
 Notion preserves headless/internal-integration capabilities. Add explicit
 `surface: "api"` to retain that identity and migrate old REST names to
 `integration_*`, for example `search` to `integration_search`, `create_page`
@@ -62,7 +67,7 @@ Writable endpoints may run `execute`; `readOnly` endpoints refuse it.
 
 Vercel's `surface` and ownership rules were later replaced: `auth` now selects
 the implementation. See the [provider auth migration](./provider-auth-migration.md#vercel).
-The 0.29 Vercel guidance follows for history. For Vercel, authorize the owning teams in hosted OAuth, migrate discovery/logs,
+The Vercel guidance shipped in 0.29.0 follows for history. For Vercel, authorize the owning teams in hosted OAuth, migrate discovery/logs,
 domain listing/adding, deployment cancellation and file uploads to live MCP
 schemas, and keep the independently authorized REST complement for value-safe
 project environment variables (including `upsert: false` create-only writes), domain verification/removal and deployment