@zackbart/connecta 0.39.0 → 0.41.0

package/documentation/meta-tools.md

@@ -120,9 +120,11 @@ read-only endpoint nothing writes: `search_tools`, `connecta.search`, and
 `connecta.describe` omit write tools as if the connector lacked them, and
 every write call through `call_tool`, `call_destructive_tool`, or a program is
 refused before validation or dispatch with `read_only_endpoint`,
-`retryable: false`, and no `nextAction`. Connector guides are not filtered and
-may still name such a write. No route on that endpoint writes; the agent
-reports it. Connecta
+`retryable: false`, and an explicit statement that no write route exists here.
+Bootstrap instructions state the serving endpoint’s actual write policy. Connector
+guides preserve their authored Markdown and prepend the effective read-only
+endpoint or connection restriction: steps that change data will be refused.
+The agent reports the limitation and can ask the operator for a writable connection. Connecta
 never pauses, replays, or approves a program.
 
 Both search routes return the flat page specified under
@@ -373,7 +375,7 @@ even when a connector has that id, whose guide stays at `connector:usage` or
 `Connector "<id>" has no usage guide.`; any other unknown name fails as an
 unknown skill. Names containing `:`, including URIs, never fall back to a bare
 id. MCP `skills/get` resolves names the same way; `resources/read` accepts only
-document URIs.
+document URIs. Canonical names and document/root URIs take priority over compatibility aliases. An alias shared by multiple guides fails as ambiguous; use the canonical URI.
 
 A connector-scoped lexical miss keeps that connector's guide metadata under
 `queryAnalysis`. This matters for generic wrappers whose broad tool name
@@ -405,12 +407,16 @@ connector inventory, budgets, the endpoint's read-only setting, and whether any
 visible connector has a guide. No catalog outcome, call, authorization state,
 or other live status reaches `tools/list` or the instructions, so the
 always-loaded surface stays byte-stable for a client's prompt cache.
-The instructions are the same on every endpoint except one addition: at
+Instructions reflect the surface and endpoint write policy, subject to connector
+restrictions. When all admitted connectors are read-only, instructions state that
+writes are unavailable. They also include pool scope: at
 `/mcp/<pool>` and `/agent/<pool>`, a pool that sets a
-[`description`](./auth.md#pools) has it appended after `This endpoint: `, so
+[`description`](./auth.md#pools) has it placed first after `Use skills. `, so
 the model learns that endpoint's scope, for example
-`This endpoint: Team tier: shared tools only. For someone's own mail or files, ask them to message you one-on-one.`
-Plain `/mcp` never carries one. The description changes no tool or tool
+`Use skills. Team tier: shared tools only. For someone's own mail or files, ask them to message you one-on-one.`
+The guide pointer precedes the scope so both appear in the first 512 characters
+for a description of up to 500 characters. The routing rules follow. Meta instructions use compact equivalent routing rules
+when a scope is present. Plain `/mcp` never carries one. The description changes no tool or tool
 description, and `initialize` and `server/discover` stay `cacheScope: "private"`,
 so a client keeps what it learned per endpoint. Connector
 guides stay scoped to the deployment that listed them even when two deployments
@@ -419,17 +425,36 @@ the short conditional guide pointers in its tool definitions.
 
 ### Native Skills extension
 
+The [Skills extension](https://github.com/modelcontextprotocol/ext-skills) is Beta under
+[SEP-3392](https://modelcontextprotocol.io/seps/3392-extension-lifecycle): breaking
+revisions can reuse its ID. The released settings define no `revision`; Connecta
+refuses downstream declarations with an explicit revision rather than enabling
+unknown semantics. Upward handlers remain Connecta-owned to preserve caller views.
+
 Connecta declares `resources: {}` and `io.modelcontextprotocol/skills`, then
 serves `skills/list`, `skills/get`, `resources/list` and `resources/read` from
 the same registry as `skills` and `connecta.skill`. These methods return
-`resultType: "complete"`, `ttlMs: 0` and `cacheScope: "private"`. Listing pages
+`resultType: "complete"` and `cacheScope: "private"`. Local-only caller views
+advertise `ttlMs: 300000` (five minutes); any visible downstream skill source
+keeps `ttlMs: 0`, including reads of local guides on that view. Clients must key
+private caches by endpoint and authenticated caller. No request-bound catalog or
+digest promise is retained across requests. Listing pages
 contain at most five complete skills: usage first, required connector guides
 next, other connector guides, downstream skills, then the investigation guide.
 Subsequent pages use `cursor`/`nextCursor`. Local lookup works without listing.
 
 The local document URIs are `skill://connecta/usage/SKILL.md` and
 `skill://connecta/connectors/<slug>/SKILL.md`. A valid Agent Skills connector ID
-is its slug; other IDs use `connector-` followed by a stable SHA-256 prefix.
+is its slug; other IDs use a readable normalized ID slug plus a 12-character
+SHA-256 suffix. Generated slugs reserve every configured connector ID and append
+a deterministic numeric suffix on collision. Avoid a connector ID equal to another
+connector's generated name: allocation depends on the IDs a catalog can see, so
+adding one moves the other guide to a suffixed name.
+The former `connector-<48-character-hash>` names, roots and file URIs remain
+resolvable aliases. Construction warns, without rejecting a guide, when its
+summary has no English task verb or operation noun from the advisory heuristic
+(for example, a credential-only scope statement). Set `usageGuide.summary`
+to say when to load it; non-English prose may produce a false-positive warning.
 The suffix makes each
 document a valid Agent Skills file; the roots `skill://connecta/usage` and
 `skill://connecta/connectors/<connector-id>` also resolve. Provider guides are
@@ -459,6 +484,19 @@ from skill manifests; neither skill catalogs nor file bodies enter its response
 cache. A failed or malformed opted-in listing fails the entire skills catalog,
 with no partial cache. Known local guides remain readable during an outage.
 
+On `skills` and program `connecta.skill` reads, downstream text is prefixed with
+a fixed third-party origin sentence naming the connector (bounded to 128 ID
+characters). This prefix has no closing delimiter. `skills` listings carry the
+same sentence before each downstream description, collapsed to one line, in text
+and structured output. Program `connecta.read` applies it to text contents whose
+URI uses the `skill:` scheme or ends in `SKILL.md`; a downstream's other resources
+are returned as ordinary data, and binary contents are not labeled. Maintained and
+deployment guides remain unlabeled. Native `skills/get` metadata and `resources/read`
+contents stay unchanged so original manifest digests remain verifiable; adding a
+label there would break integrity checks. A native host must attach its own origin
+label when it loads verified content into model context, as the Skills extension
+requires.
+
 Downstream files are proxied byte-exact, including CRLF and binary supporting
 files, within 512 files and 16 MiB per skill. Catalog metadata is bounded to
 1,024 entries and 8 MiB. The existing request-scoped agent boundary redacts
@@ -905,6 +943,16 @@ fulfill downstream input.
 
 ## Authorization recovery
 
+Every native pool lists `authorize_connector`, including pools without code.
+If a connector’s tools are missing, use its id from that tool’s granted-connector
+list to request a typed handoff. Give the URL and instructions to the operator;
+after repair the host must refresh its tool list before it can call the repaired
+tools (the cache hint is 300 seconds). A host that keeps its first list needs a
+reconnect or a new conversation; on a pool with `execute_code`, a program can call
+them by address without one.
+Listing never creates a handoff. Authorization accepts only connectors already
+granted to this request; it cannot enable a connector or expand pool scope.
+
 On MCP 2026-07-28, a host declaring `elicitation.url` receives
 `resultType: "input_required"` when an eligible call or program needs recoverable
 connector authentication and the admitted identity may manage that connector.
@@ -1119,11 +1167,47 @@ Activity records each of these refusals with the coarse `friction` class derived
 from its typed error code — `tool_not_found`, `schema_retry`,
 `destructive_reroute`, `auth_required` — and clamps the caller-authored
 `connectorId`, `toolName`, and `address` it keeps, both under
-[code mode](./code-mode.md#activity)'s `V2` and `V3`. A `call_tool` result too
+[code mode](./code-mode.md#activity)'s `V2` and `V3`. Optional
+[operation history](./operator-ui.md#opt-in-to-operation-history) records
+search, skill and result reads with fixed names, without arguments or payloads;
+it is off by default and separate from downstream-call counts. A `call_tool` result too
 large to return inline is the one exception: it is friction
 (`result_too_large`) on a call whose `outcome` is still `"success"`, so it
 carries no `errorCode`.
 
+Recovery actions outside the tool namespace use `nextAction.action` and a
+`purpose`: `reconnect_host` repairs inbound HTTP authentication (separate from
+connector OAuth), `contact_operator` reports catalog or utility availability,
+`inspect_capabilities` requests a supporting client/operation, and
+`recover_result` requests a retained handle or an honest missing-output report.
+Unsupported task, Skills, and resource capabilities use the non-retryable
+`unsupported_capability` code with `inspect_capabilities`. Missing or expired handles have `code: not_found`; storage outages retain
+`code: unavailable`. Neither action authorizes anything or replays writes.
+Unknown skill names and connectors without a guide retain their local lookup
+diagnostic with `code: not_found` and a `nextAction` calling `skills` with no
+name to discover available names. They do not request service restoration.
+The search output schema describes action discriminators compactly; action
+advice is additive, while catalog error and authorization handoff fields retain
+their detailed contracts.
+A spent read continuation's fresh-call action takes precedence over generic
+retry advice, while auth and provider permission repair prerequisites and unknown-write reconciliation remain
+in force. HTTP 401/403 responses preserve the adapter status and challenge. JSON responses
+carry the host recovery envelope. Custom non-JSON responses preserve their body
+and lifetime, with the same typed facts in `Connecta-Error-Code`,
+`Connecta-Recovery`, and JSON-encoded `Connecta-Next-Action` headers (also exposed
+to cross-origin hosts).
+
+## Recovery limits
+
+Typed `invalid_args` failures without validation findings point to scoped schema
+inspection. `not_found` asks the caller to verify the resource id, account and
+visibility. `unavailable` asks the operator to restore connector availability.
+These use `nextAction` for an executable action and `retry` for explicit limits.
+An uncertain write has no safe replay action: read its target to reconcile its
+outcome before deciding on any fresh operation. Host authentication requires
+reconnecting the host; downstream authorization handoffs repair credentials;
+provider permission denial requires the resource owner to grant access.
+
 ## Argument recovery
 
 Standard API hatches refuse marker containment in request paths and query
@@ -1437,10 +1521,17 @@ pool's surface.
 | Each visible downstream tool | Named `<connector>__<tool>`; object input constraints and local references preserved; no `outputSchema`; `_meta["dev.connecta/address"]` is its address           |
 | `execute_code`               | Unless `executeCode: false`. Each downstream tool's description then ends with `Program address: <connector>.<tool>`, the address `connecta.call` takes           |
 | `read_result`                | Only with `executeCode: false`: `{ id, offset?, page?, maxBytes? }` pages a stashed result exactly as `connecta.result` does, with the same bindings and rechecks |
+| `authorize_connector`        | Always; requests the existing typed authorization handoff for a granted connector                                                                                 |
 | `skills`                     | Always                                                                                                                                                            |
 
-`search_tools`, `call_tool`, `call_destructive_tool`, and `authorize_connector`
-are not listed. Auth failures still carry their handoff in the error envelope.
+`search_tools`, `call_tool`, and `call_destructive_tool` are not listed. Auth failures still carry their handoff in the error envelope.
+
+Native tool descriptions append `Guide: skills <name>` when their connector has
+guidance. Call `skills` with `{name:"<name>"}` to read it. The name is the same
+allocated readable name listed by `skills`, including collision suffixes; a
+name reserved for a built-in guide uses its canonical connector skill URI. This
+compact pointer repeats on each tool so host search results retain it; connectors
+without guides add nothing. It depends only on the admitted connector roster.
 
 **Names.** A name is a pure function of the connector id and downstream tool
 name, so it survives catalog refreshes. It is `<connector>__<tool>` when the
@@ -1484,7 +1575,7 @@ window, a native `tools/list` carries a 300-second private cache hint, against
 an hour on meta endpoints. This hint does not guarantee that a host refreshes
 its cached annotations; the stale-approval race is accepted on writable pools.
 
-**Listing.** `tools/list` is one page with no cursor (Eve 0.90 reads only the
+**Listing.** `tools/list` is one page with no cursor (Eve's MCP client reads only the
 first page). A pool listing more than 1,000 tools fails `tools/list` with a
 JSON-RPC error asking the operator to narrow the pool; nothing is silently
 dropped. A connector whose catalog cannot load is left out of that listing
@@ -1498,7 +1589,14 @@ reduced calls; write tools are absent and refused on a read-only endpoint;
 never repeat a write; page a truncated result as its notice says. A pool
 `description` is appended as on meta endpoints.
 
-**Recovery.** Repair and validation fields retain the exact constraint details.
+**Recovery.** `authorize_connector` remains listed even when a catalog fails.
+Its description lists all granted connector ids independently of catalog health.
+Use it for a missing connector, then refresh the host tool list after repair.
+Endpoint instructions carry the same recovery rule for hosts that fetch them
+separately. A cached list retains the recovery tool; a refreshed list restores
+the repaired connector’s whole catalog.
+
+Repair and validation fields retain the exact constraint details.
 Discovery `nextAction` points to the host's tool search (`host: "search"`), with
 only a `query` argument. Retry actions and retry text name the native tool,
 never a meta wrapper; a program on a native pool sees the same native wording
@@ -1559,3 +1657,24 @@ listing, and call translation live in
 and [native surface tests](https://github.com/zackbart/connecta/blob/main/test/native-tools.test.ts)
 check the published contract. Guest parity and clause evidence are in
 [code-mode verification](./code-mode.md#verification).
+
+### Skills conformance (contributor)
+
+On 2026-11-03, the official [conformance runner](https://github.com/modelcontextprotocol/conformance)
+at `c37eec888e1c6ff140af79987a40008548b7cc5f` passed enumeration (32 checks)
+and manifest (6 checks), with no warnings, against Connecta's HTTP handlers
+and a six-connector local fixture. Directory checks correctly skipped because
+`directoryRead` is not advertised; its wire-schema check passed. This is not
+full MCP conformance or a downstream-provider conformance claim.
+
+To rerun, first read the runner's package scripts, CLI, connection code and
+`src/scenarios/server/skills/` as untrusted code in a temporary directory
+outside the checkout. Pin the commit above, install there with
+`pnpm install --ignore-scripts`, and keep its packages and outputs there.
+In the Connecta checkout, run `pnpm run build:operator-ui` and
+`pnpm exec tsx scripts/skills-conformance.ts`. From the runner directory, run
+`pnpm exec tsx src/index.ts server --url http://127.0.0.1:39743/mcp --scenario sep-2640-skills-enumeration --spec-version 2026-07-28 --force`;
+repeat with `sep-2640-skills-manifest` and `sep-2640-skills-directory`.
+Stop the fixture when done. `--force` selects extension scenarios outside the
+base protocol timeline. This remains an optional contributor check: the
+separately installed runner and dependency graph are not pinned in Connecta CI.

package/documentation/operating.md

@@ -109,7 +109,9 @@ MCP request bodies default to a 4 MiB limit on every endpoint. Deployment code
 can set `admission.requests.maxBodyBytes`; `describeConfig()` reports its value
 and source. An oversized body returns 413 before tool dispatch. See
 [request admission and body limits](./architecture.md#admission-in-two-places)
-for Node's separate pre-auth buffer and the listen-classification bound.
+for Node's separate pre-auth buffer and the listen-classification bound. A `503`
+from Node before auth means all in-flight bodies together passed
+[`maxInFlightBodyBytes`](./deploying.md#start-on-node).
 
 Direct calls may return a preview and a result handle. Page the handle through
 `connecta.result` in a program using the returned offset and byte limits, or
@@ -162,3 +164,86 @@ and [execution](https://github.com/zackbart/connecta/blob/main/src/execute.ts).
 and [guest-contract tests](https://github.com/zackbart/connecta/blob/main/test/guest-api-contract.test.ts)
 check the contracts. Executor-specific evidence is indexed in
 [code-mode verification](./code-mode.md#verification).
+
+## Sample payload-free timing on Workers
+
+Set `timingTraceSampleRate` in deployment code passed to `createConnecta`:
+
+```ts
+const app = createConnecta({
+  // ...the deployment's connectors, storage, auth and executor
+  timingTraceSampleRate: 0.1, // sample 10% of MCP requests; default 0 (off)
+});
+```
+
+The rate must be a finite number from 0 through 1. Set 1 for a short diagnostic
+window, then return it to 0. Sampling is independent of the caller's
+`diagnostics` argument. Enable Workers observability logs in the deployment's
+Wrangler configuration (`observability.logs.enabled: true`). Its own sampling
+may reduce captured records further. The configured logger receives
+`connecta.timing` and one structured object when the MCP response body closes;
+`logger: "silent"` suppresses these records too. Consume or close streaming
+responses to finish their trace. An isolate-first-request flag means the first
+MCP request that reaches tracing in that isolate, including unsampled requests;
+it does not measure module boot.
+
+Each version-1 record contains elapsed request time, the first-request flag,
+weak-reference availability and aggregate operation families. Each family has
+`count`, `durationMs`, `bytes`, `statements`, `items` and `absent` totals.
+`catalog.accepted` counts complete accepted catalogs, serialized bytes and tools. Invocation
+`catalog`, `admission`, `connector` and `result` durations reuse the existing
+`diagnostics` segments. `catalog.cache.lookup` counts cache probes; `catalog.cache.hit` counts accepted
+unexpired entries. Lookups without hits can include misses, expiry, invalid
+entries or interrupted reads; they are not proof of live relisting.
+`catalog.validated.hit`/`miss` report immutable validation reuse.
+`catalog.decode` counts JSON decodes and their UTF-8 input bytes;
+`catalog.validate` and `catalog.intake` count those stages without timing them.
+These three count-only families always have `durationMs: 0`.
+`catalog.chunks` records accepted chunk bytes and counts. These counters do not
+identify a connector, owner or private/public partition.
+Concurrent spans can overlap; do not sum them as wall time.
+`memo.hit`, `memo.miss` and `memo.fresh` describe the request-read memo
+(`absent` counts null values, not cache failures). `d1.read`, `d1.write` and
+`d1.batch` count physical native D1 trips and SQL statements, including
+failed attempts. Batch count is one trip; statements is the batch length.
+All native D1 work carrying the request context shares these totals, including
+admission, credential and catalog work. Comparing them with `catalog` duration
+(the diagnostics `catalogMs` segment) does not isolate catalog storage.
+Returned D1 bytes measure serialized application results, not Cloudflare's wire
+encoding. Memo bytes measure UTF-8 stored values. Result bytes use the existing
+invocation measurement. No keys, tool names, owner identity, arguments, results,
+credentials or error text enter the record. Records retain totals only.
+
+On production Workers, `performance.now()` advances only across I/O. Durations
+are I/O-spanning elapsed observations, not CPU attribution: zero is ambiguous,
+and CPU work can appear in a later I/O interval. D1 durations are therefore not
+pure storage latency. Use counts, sizes, cache outcomes and the isolate-first-request
+flag to compare warm direct and one-call program requests with the same catalog.
+For per-invocation CPU, use Workers' invocation telemetry field
+[`$workers.cpuTimeMs`](https://developers.cloudflare.com/workers/observability/query-builder/).
+Deeper attribution requires [CPU profiling](https://developers.cloudflare.com/workers/runtime-apis/performance/).
+
+Only work carrying the MCP request's native context contributes D1 counters;
+standalone operator/background or custom Promise adapter work is outside that
+request trace. Sampling does not add reads, change TTLs, bypass generation or
+credential fences, or start authorization.
+
+For example, query a ten-minute window for a neutral Worker `assistant` (replace
+the millisecond timestamps with the window you need):
+
+```sh
+cf --profile assistant o11y telemetry query \
+  --query-id 00000000-0000-4000-8000-000000000001 \
+  --view events --limit 100 \
+  --timeframe-from 1793700000000 --timeframe-to 1793700600000 \
+  --parameters-order-by-value count --parameters-order-by-order desc \
+  --parameters-calculations '[{"operator":"count","alias":"count"}]' \
+  --parameters-filters '[{"key":"$workers.scriptName","operation":"eq","type":"string","value":"assistant"}]'
+```
+
+Select `connecta.timing` messages in the returned events and inspect their
+structured operation totals. Use the profile belonging to your deployment.
+The example reads telemetry only; it changes no Worker settings.
+
+The example passes CLI dry-run validation; server acceptance has not been verified.
+Use `--dry-run` to validate the request locally without querying telemetry.

package/documentation/operator-ui.md

@@ -287,7 +287,7 @@ stack each row into a card.
 
 ### Activity
 
-Counts for the loaded history (calls, failed, tools, catalog changes), also
+Counts for the loaded history (calls, failed, tools, catalog changes, and opt-in operations), also
 in its accessible summary, and a strip of calls over time with failures in
 red when the calls span more than a minute.
 
@@ -304,7 +304,9 @@ red when the calls span more than a minute.
   row lists what was recorded: result, how it ran, classification, exact
   duration and size, caller, stable caller id, request id, client, and
   connecta version. Unrecorded fields are left out. Catalog changes are rows
-  with added, removed and changed counts.
+  with added, removed and changed counts. Opt-in operation rows use fixed names
+  (Search, Describe, Result page, Skill read, Program) and an Operation detail;
+  they do not count as calls, failed calls, friction, tools or last calls.
 - **Empty.** "No calls yet" with Refresh, or "No matches" with Clear filters.
 
 ### Navigation, gates and recovery
@@ -767,6 +769,53 @@ names, descriptions or schemas enter the event. Private catalog changes require
 a matching principal owner even when the connector uses shared auth. Empty credential declarations
 report `credential_required` before running a connector status or catalog probe.
 
+### Opt in to operation history
+
+Set `operations: true` on the existing activity module, for example
+`activity: activityHistory({ store, operations: true })`, where `store` is the
+configured platform activity store. The default is off: existing deployments
+emit no operation rows. Each admitted search, describe, result page, skill read
+and whole program adds one event through the existing detached sink. Workers
+attach its promise to `waitUntil`; Node does not await it in the response path.
+This adds storage writes and retention cleanup work for every operation.
+
+Rows use `kind: "operation"`, `source: "execute_code"`, and a fixed operation
+name. They contain duration, outcome, a checked error code, returned page
+byte count when already measured, and host-call counts for a program. No query, tool
+address supplied by a caller, skill name, result ID, code, arguments, result
+contents or raw error text enters the row. Custom history readers must exclude
+operation rows from call/friction counts. The public kind union adds
+`"operation"`; exhaustive consumers may need a new case even when their
+runtime configuration leaves recording off.
+
+Operation disclosure is deliberately conservative:
+
+- The existing maintainer permission and optional `readGate` still apply.
+- Scope means every connector visible to the admitted endpoint, rather than
+  just the connectors named by a particular argument. A single-connector scope
+  uses that connector ID; other scopes use a reserved operation ID internally.
+- Every connector in that scope must still be visible through a whole-connector
+  grant to both the reader and the recorded pool. Address-only grants do not
+  disclose operations. Removed pools/connectors or invalid scope metadata
+  withhold the entire row.
+- All human operations are owner-only. Scopes containing personal auth,
+  caller-bound auth or a dynamically discovered catalog are also owner-only,
+  since static configuration cannot prove the catalog public. Owner-only rows
+  require the recorded principal basis and an exact match to the reader's
+  admitted principal ID and namespace. An agent without a provable admitted
+  human owner has those rows withheld.
+- Shared machine operations over statically declared catalogs are visible to
+  maintainers only when the complete scope passes those checks. This policy
+  can withhold single-connector work performed on a mixed endpoint.
+
+Existing D1 and SQLite activity tables need no new columns. The existing
+kind-tagged metadata text slot stores the checked operation scope and counts;
+legacy tool and catalog-change rows keep their format. The timeline shows
+operations separately and excludes them from call totals, friction, tool
+counts, call strips and last-call overlays.
+
+### Activity actor labels
+
 Activity label resolvers receive an optional `AbortSignal`. Pass it to user-directory
 fetches and stop work when it aborts: the reader has left or the label lookup
 budget has expired. Clerk label lookups follow the same lifetime and discard

package/documentation/providers.md

@@ -275,12 +275,12 @@ discovery for your deployment's catalog.
 </details>
 
 <details>
-<summary>QuickBooks Online (10 tools)</summary>
+<summary>QuickBooks Online (11 tools)</summary>
 
 [Setup](#quickbooks-online). **API source:** Hand-authored endpoint contracts. No vendored OpenAPI document.
 
 - **Named reads:** `get_company_info`, `get_record`, `get_report`, `search_records`.
-- **Named writes:** `create_customer`, `create_invoice`, `update_customer`.
+- **Named writes:** `create_customer`, `create_invoice`, `update_customer`, `update_unsent_invoice`.
 - **API reads:** `quickbooks_api_details`, `quickbooks_api_read`, `quickbooks_api_search`.
 - **API writes:** None.
 
@@ -1520,18 +1520,20 @@ Creation fixes EmailStatus to `NotSet` and IPN/online/card/ACH/PayPal/Affirm
 payment flags to false, accepts no email fields, and never calls a send endpoint.
 Intuit's documented autosend path requires company opt-in, enabled online
 payments and `NeedToSend` with BillEmail; the fixed creation body withholds
-those request conditions. Invoice updates remain unavailable because retaining
-an existing send-ready state is not established safe, and resetting that state
-would change existing payment settings. Deletes, voids, delivery, payment
-execution, batch and other accounting writes remain unavailable. The API hatch
-refuses POSTs even when named writes are enabled.
-
-Sparse field preservation, a current SyncToken and requestid do not establish
-that an invoice update cannot send email. For example, changing only DueDate
-on an invoice with NeedToSend and enabled card/ACH payments retains those
-settings; omitting email fields does not disable them. Do not reset delivery or
-payment settings to work around the unavailable update, or replace the invoice
-with a new one. No unsent-only update tool is currently exposed either.
+those request conditions.
+
+`update_unsent_invoice` changes only DocNumber. Supply caller-observed Id and
+SyncToken and an explicit docNumber. It reads the US company and invoice,
+requires USD, explicit NotSet, no DeliveryInfo and every IPN/online/card/ACH/
+PayPal/Affirm payment flag explicitly false. Unknown state, send-ready or
+delivered state and stale versions fail before POST; no newer version is
+substituted. The sparse body preserves omitted delivery/payment fields.
+No date edits are exposed. Applying autosend prerequisites to updates is an
+inference, not an update-specific Intuit no-email guarantee. NotSet and absent
+delivery information cannot prove there was never historical delivery.
+Do not reset state to qualify or replace an invoice to bypass a refusal.
+Deletes, voids, delivery, payment execution, batch and other accounting writes
+remain unavailable. The API hatch refuses POSTs even when named writes are enabled.
 
 Each write requires `requestId`, a stable identifier for the exact intent,
 unique across all requests/tools for this company: 1–50 ASCII letters, digits,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of six meta-tools.",
@@ -173,8 +173,8 @@
     "build:operator-ui": "node scripts/build-operator-ui.mjs",
     "check:operator-ui": "node scripts/build-operator-ui.mjs --check",
     "check:clerk-sdk": "node scripts/build-clerk-sdk.mjs --check",
-    "build": "pnpm run providers:generate && pnpm run clean && tsc -p tsconfig.build.json && node scripts/prune-declarations.mjs",
-    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.operator-ui.json --noEmit",
+    "build": "node scripts/eval-runtime.mjs --build",
+    "typecheck": "node node_modules/typescript-native/bin/tsc -p tsconfig.json --noEmit && node node_modules/typescript-native/bin/tsc -p tsconfig.operator-ui.json --noEmit",
     "test": "vitest run",
     "test:browser:install": "playwright install chromium",
     "test:browser": "playwright test",
@@ -182,19 +182,20 @@
     "pretest:browser:snapshots": "pnpm run build:operator-ui",
     "test:node": "vitest run --config vitest.config.node.ts",
     "test:workers": "vitest run --project workers",
+    "check:node-shards": "node scripts/check-node-shards.mjs",
     "check:docs": "node scripts/check-doc-links.mjs",
     "check:lint": "oxlint -D correctness --report-unused-disable-directives .",
     "check:unused": "knip --include dependencies,unlisted,exports,nsExports,types,nsTypes",
-    "check:examples": "tsc -p tsconfig.template.node.json && tsc -p tsconfig.examples.worker.json",
+    "check:examples": "node node_modules/typescript/bin/tsc -p tsconfig.template.node.json && node node_modules/typescript/bin/tsc -p tsconfig.examples.worker.json",
     "check:security": "pnpm audit --prod --audit-level moderate",
     "check:package": "node scripts/check-package.mjs",
     "check:declarations": "node scripts/check-declarations.mjs --dist .",
     "check:bundle": "node scripts/bundle-size.mjs",
     "providers:check": "tsx scripts/drift-check.mjs --specs --manual",
-    "eval:selftest": "tsx eval/selftest.ts",
-    "eval:agent": "tsx eval/run-agent.ts",
-    "eval:smoke": "tsx eval/run-smoke.ts",
-    "eval:outcomes": "tsx eval/run-outcomes.ts",
+    "eval:selftest": "node --import tsx scripts/eval-runtime.mjs selftest",
+    "eval:agent": "node --import tsx scripts/eval-runtime.mjs run-agent",
+    "eval:smoke": "node --import tsx scripts/eval-runtime.mjs run-smoke",
+    "eval:outcomes": "node --import tsx scripts/eval-runtime.mjs run-outcomes",
     "preeval:outcomes": "node scripts/generate-version.mjs && pnpm run build:operator-ui",
     "eval:perf": "tsx eval/run-perf.ts",
     "eval:report": "tsx eval/report.ts",
@@ -279,6 +280,7 @@
     "react-dom": "^19.3.1",
     "tsx": "^4.23.15",
     "typescript": "^6.0.3",
+    "typescript-native": "npm:typescript@7.0.2",
     "undici": "6.29.1",
     "vite": "^8.3.4",
     "vitest": "^5.0.4",

package/templates/node/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.12.0",
-    "@zackbart/connecta": "0.39.0",
+    "@zackbart/connecta": "0.41.0",
     "quickjs-emscripten": "0.32.0",
     "undici": "6.29.1"
   },