Release 0.21.1

CHANGELOG.md

@@ -2,6 +2,50 @@
 
 All notable changes to this package are documented here.
 
+## 0.21.1 — 2026-08-30
+
+This patch aligns the handwritten Cloudflare and Notion contracts and the four
+hosted-provider manifests with their current catalogs. Existing deployments
+need no configuration or storage migration. Cloudflare programs that depend on
+provider fields outside the maintained `get_zone_setting` or
+`get_worker_settings` projections should pass `raw: true`. Stripe's server has
+retired three dedicated tool names, so programs that hardcoded them must search
+the current catalog and use the generic API tools or `stripe_analytics`.
+
+### Added
+
+- **Current Cloudflare jurisdictions.** All eight R2 bucket tools accept the
+  `us` jurisdiction alongside `default`, `eu`, and `fedramp`. KV namespace
+  creation accepts its separate `eu`, `fedramp`, and `us` set and preserves
+  jurisdiction on namespace reads (#498, #499).
+- **Current hosted-provider classifications.** Linear's workspace, template,
+  and issue-sharing tools join its plan-aware reviewed superset. RevenueCat's
+  refund-request preferences are read-only, and Mixpanel's metadata fill is a
+  destructive Lexicon update (#512).
+
+### Changed
+
+- **Useful Cloudflare result schemas.** All 48 named tools now declare their
+  maintained output keys. Zone settings and Worker settings project stable
+  camel-case fields by default and expose the provider response through
+  `raw: true`; rulesets, deployments, KV bulk operations, R2 CORS, and Pages
+  reuse named schemas instead of an empty object contract (#488).
+- **Stripe's current eleven tools.** Account listing, account-management links,
+  and analytics replace the retired account-info, refund, and report tools.
+  The integration planner and analytics are additive writes because their tool
+  boundaries can create provider-side guide or query-run state (#512).
+
+### Fixed
+
+- Worker settings retain VPC binding identity and observability fields,
+  rulesets retain origin-range metadata, and zone setting ids include
+  Cloudflare's current WebMCP settings (#500, #501, #502, #503).
+- Notion preserves every documented `verification.does_not_equal` value, and
+  Cloudflare's recorded KV bulk and zone-setting specifications match the
+  current published documents (#504, #509).
+- Mixpanel records the current schemas for all 64 classified tools, including
+  the three experiment contracts that changed since the prior review (#512).
+
 ## 0.21.0 — 2026-08-28
 
 Cloudflare Access becomes the canonical interactive-auth path for Worker

documentation/auth.md

@@ -65,7 +65,7 @@ Worker-level Access runs before every connecta route. Consequently:
   OAuth discovery paths when Managed OAuth is enabled.
 
 The [Worker example](../examples/worker/) carries the complete deployment shape
-and the [upgrade guide](./upgrading.md#0200--0210) gives the reversible Clerk
+and the [upgrade guide](./upgrading.md#0200--0211) gives the reversible Clerk
 migration.
 
 ## Clerk configuration is checked at construction

documentation/linear.md

@@ -110,9 +110,10 @@ the connector is present and reports `auth_required`. See
 
 The wrapper classifies Linear's documented `list_*`, `get_*`, and
 `search_documentation` tools as reads, and its `save_*`, `create_*`, `delete_*`,
-`resolve_*`, `submit_*`, and `merge_*` tools as writes. An unfamiliar tool the
-downstream leaves unannotated fails closed onto `call_destructive_tool` until a
-Connecta release reviews it.
+`resolve_*`, `submit_*`, `merge_*`, `share_issue`, and `unshare_issue` tools as
+writes. Sharing changes an existing issue's access, so both halves are
+destructive. An unfamiliar tool the downstream leaves unannotated fails closed
+onto `call_destructive_tool` until a Connecta release reviews it.
 
 That classification fills in downstream silence and otherwise preserves
 explicit annotations. A tool on the read allowlist arriving with
@@ -136,7 +137,8 @@ though some calls only create. The genuine creates are `create_issue_label` and
 ## The catalog is not a fixed set
 
 Linear's hosted `tools/list` varies by workspace plan and enabled features:
-customer requests, releases, and code review do not appear in every workspace.
+customer requests, releases, code review, templates, and explicit issue sharing
+do not appear in every workspace.
 The maintained allowlists are therefore a superset — a classified name a
 workspace never returns costs nothing, and a genuinely new tool fails closed.
 Agents should search this connector's catalog for what the workspace actually

documentation/mixpanel.md

@@ -84,7 +84,7 @@ the maintained guide carries the missing call guidance:
 A read-only live audit on 2026-08-13 confirmed all three refusals against the
 US hosted endpoint. They are reported upstream as
 [`mixpanel/mixpanel-headless#202`](https://github.com/mixpanel/mixpanel-headless/issues/202).
-The vetted catalog records the same audit's schema digests for all 63 tools,
+The vetted catalog records current schema digests for all 64 tools,
 so a later schema correction or regression appears by tool name in the
 maintainer drift check. The guide can then shrink when the downstream schema
 becomes complete; Connecta does not absorb the defect permanently.
@@ -110,8 +110,10 @@ rest) leave `destructiveHint` unset; `readOnlyHint: false` already routes them
 through the destructive path, and asserting destruction only inflates the
 approval copy the host shows a human.
 
-Experiments and Feature Flags — 15 of the 63 classified tools — are Mixpanel
-beta surfaces. Expect their names and schemas to move faster than the rest.
+Experiments and Feature Flags are Mixpanel beta surfaces. Their three changed
+schemas were reviewed again on 2026-08-30. The same review added
+`Fill-Event-Metadata` as a destructive write because it applies generated names
+and descriptions to existing Lexicon events.
 
 ## Rate limits
 

documentation/operations.md

@@ -247,11 +247,11 @@ in.
 | `executor-admission.test.ts` | the portable bounded FIFO both pools use: active and queue ceilings, stable retryable overload, queue timeout, cancellation removal, idempotent release, shutdown |
 | `guarded-fetch.test.ts` | the guarded transport — construction, request building, destination confinement, and response handling |
 | `guest-api-contract.test.ts` | the shared guest contract on the Dynamic Worker, including caught call, typed inline describe recovery, discovery, utility, batch, and budget failure codes; plus the real authority boundary — local `data:` fetch, denied egress, unresolved DNS, empty environment paths, unavailable filesystem/HTTP builtins, and present runtime globals |
-| `linear-provider.test.ts` | the Linear proxy's construction, classification, and guide |
+| `linear-provider.test.ts` | the Linear proxy's construction, guide, plan-aware catalog superset, and current workspace, template, and issue-sharing classifications |
 | `meta-tools-call.test.ts` | registry-backed calls: structured errors, truncation and `get_result`, per-connector result bounds, JSON representation failures, MCP content bounds, and offset alignment |
 | `meta-tools-search.test.ts` | registry-backed discovery: bounded search with page and address maxima, compact and JSON schemas with constraints, typed describe recovery and suggestions, and structured-result compatibility |
 | `meta-tools.test.ts` | the remaining registry-backed meta-tools: the complete on-demand usage skill, connector-guide selection and summary bounds, stored-credential drift, catalog health, authorization, probe timeouts, and unavailable or unknown browse recovery |
-| `mixpanel-provider.test.ts` | the Mixpanel proxy, its conditional-input guide and complete reviewed schema-digest manifest |
+| `mixpanel-provider.test.ts` | the Mixpanel proxy, its conditional-input guide, destructive metadata fill, and complete 64-tool schema-digest manifest |
 | `notion-provider.test.ts` | Notion's deliberate tool surface, including declined expanded page inputs, request construction, lean projections, both pagination conventions, error mapping, and writes |
 | `operator-boundary.test.ts` | the operator row of the decisions table, after every mutation route: authentication material managed without moving a declared structure, and the one honest exception — a credential write making a remote catalog appear, which is discovery arriving, not an operator editing the deployment |
 | `operator-store.test.ts` | `src/operator-ui/app/store.ts` against a fake browser: the Clerk listener, ambient Access requests without a browser-readable token, `gate()`, the generation fence, and the request path |
@@ -263,11 +263,11 @@ in.
 | `remote-mcp-pagination.test.ts` | the `tools/list` cursor chain in both directions — exact cursor handoff, first-wins dedup, a failed later page rejecting rather than returning its prefix, the runaway backstops, the tool-metadata re-prime across pages, and paginated catalogs reaching the discovery path |
 | `request-admission.test.ts` | `/mcp` bounded before auth, the stable 503 and `Retry-After`, health and operator responsiveness under saturation, payload-free counters, queued cancellation, shutdown rejection while active work drains, and the separate fallback code pool |
 | `result-shapes.test.ts` | passive output-shape learning: value-free bounded inference, merging, 256-entry LRU eviction, 24-hour expiry, runtime isolation, read-only admission, declared-schema precedence, definition-change invalidation, discovery provenance, and failure isolation |
-| `revenuecat-provider.test.ts` | the RevenueCat proxy's per-project key scoping and account-wide OAuth guides, its purpose-bearing summary, the argued borderline verdicts in its digest-free manifest, and the deliberately unclassified `render-paywall-screenshot` |
+| `revenuecat-provider.test.ts` | the RevenueCat proxy's per-project key scoping and account-wide OAuth guides, its purpose-bearing summary, the refund-preference read and argued borderline verdicts in its digest-free manifest, and the deliberately unclassified `render-paywall-screenshot` |
 | `server.test.ts` | end-to-end `/mcp` (401 → compact initialize instructions → seven compact definitions with bounded connector inventory and exact model-only Apps metadata → complete usage skill → `call_tool`), conditional guide pointers, open routes, Clerk `.well-known` metadata without network, code mode, and deferred catalog reads through both discovery surfaces |
 | `server-route-contracts.test.ts` | the route contracts `server.ts` must keep byte-identical: every built-in answered ahead of connector routes inside the security wrapper, open data-free shells with framing denied, per-route auth and same-origin requirements with exact 401/403/405 bodies, and OAuth `verifyState`-before-`finishAuth` ordering |
 | `startup-warnings.test.ts` | every construction-time `logger.warn` and, as importantly, the conditions that must *not* trigger one: open mode with a credential or OAuth connector, `publicUrl` unset beside OAuth, dropped branding and `uiAuth` URLs, a missing `verifyState`, a credential test-hook mismatch, and an unusable `calls.maxResultBytes` |
-| `stripe-provider.test.ts` | the Stripe proxy's mixed-mode OAuth and fixed-mode header contracts, admission, exact account selectors, and no-guess rule |
+| `stripe-provider.test.ts` | the Stripe proxy's mixed-mode OAuth and fixed-mode header contracts, current eleven-tool classifications, admission, exact account selectors, and no-guess rule |
 | `operator-view.test.ts` | the app's pure state rules from `view.ts`: filtering, page routing, capability states, activity summaries, drift display, and identity reset |
 | `ui-credentials.test.ts` | credential-management routes: save, test, delete, validation, authentication, same-origin checks, and multi-field credential shapes |
 | `ui.test.ts` | the server shell and remaining `/ui/*` routes: gated `/ui/data` with broken-connector isolation and registry-owned catalog-observation containment, plus the URL safety gates |

documentation/revenuecat.md

@@ -152,17 +152,18 @@ names the `authorize_connector` recovery. A permission gap, a plan restriction,
 or a rejected argument arrives as RevenueCat wrote it and is not an
 authorization problem.
 
-## The ninety-five tools, and what they are classified as
+## The ninety-six tools, and what they are classified as
 
 RevenueCat's
 [tool reference](https://www.revenuecat.com/docs/tools/mcp/tools-reference),
-read on **2026-08-18**, documents ninety-five tools in a Read/Write table.
-Ninety-four carry an access column and are classified here: **50 read-only, 15
-additive writes, 29 destructive writes.**
+read on **2026-08-30**, documents ninety-six tools. Ninety-five carry an access
+column and are classified here: **51 read-only, 15 additive writes, 29
+destructive writes.**
 
 Reads are every `Read` row, verbatim — the nine project and app reads, the four
 product reads, the entitlement, offering, targeting, paywall, customer, virtual
-currency, chart, webhook, and SDK reads, and `get-paywall-ai-task`.
+currency, chart, webhook, and SDK reads, `get-paywall-ai-task`, and
+`get-refund-request-preferences`.
 
 Writes follow the verb where the verb is honest: `archive-*` and `unarchive-*`
 flip an existing object's active state, `update-*`, `delete-*`, `publish-*`,
@@ -191,14 +192,15 @@ beside the row:
 `create-webhook-integration` deserves a sentence too. No existing integration
 changes, so the verb reads additive — but with filters omitted the new one
 "starts delivering" every customer event in the project to a URL the caller
-typed. Customer data leaving the account is the `create_refund` argument again:
-filed destructive on consequence, so the approval copy says what is at stake.
+typed. Customer data leaving the account makes it destructive on consequence,
+so the approval copy says what is at stake.
 
 **`render-paywall-screenshot` is deliberately unclassified.** RevenueCat's
-reference gives it no access column at all, so no release has reviewed what it
-does. It fails closed onto `call_destructive_tool` rather than being guessed
-into the read path because its name sounds harmless (P5). The guide names it,
-so an agent does not read the approval prompt as a bug.
+reference gives it no access column. The current live server explicitly marks
+it read-only, so that catalog keeps it callable from `execute_code`; if a later
+catalog omits the annotation, it fails closed onto `call_destructive_tool`.
+Connecta preserves the provider's current annotation without inventing a
+release classification from the tool's harmless-sounding name (P5).
 
 That classification fills in downstream silence and otherwise preserves explicit
 annotations. A tool on the read allowlist arriving with `destructiveHint: true`
@@ -242,7 +244,7 @@ API v2 meters per minute and **per domain**
 | Charts & Metrics | 25 |
 
 A `ConnectorCallAdmissionPolicy` carries exactly one rule, so a connector-wide
-budget has to pick one of those six numbers for all ninety-five tools.
+budget has to pick one of those six numbers for all ninety-six tools.
 Transcribing 25 would throttle a customer read loop to a nineteenth of its
 documented allowance; transcribing 480 would leave a chart sweep unprotected.
 Neither is the provider's limit, and both would look like RevenueCat being
@@ -281,15 +283,13 @@ still needs restrained use.
 
 ## What is not verified
 
-- **Every tool name is transcribed from RevenueCat's published reference on
-  2026-08-18, not read from a live catalog.** No maintainer ran this against a
-  project with a real key before it shipped. A name the reference lists and the
-  server does not serve costs nothing; a tool the server serves and the
-  reference omits fails closed. The maintainer-run drift check with
-  `CONNECTA_DRIFT_REVENUECAT_KEY` set is what turns that into a finding with a
-  name attached.
-- **No input or output schema has been read**, which is why the manifest
-  carries no digests.
+- **The 2026-08-30 live review used a project-scoped catalog.** It proves the
+  additions that catalog serves, including `get-refund-request-preferences`,
+  but cannot prove a globally documented tool was removed. The manifest stays
+  a superset because plan, platform, and credential scope hide tools.
+- **No complete schema set has been recorded**, which is why the manifest
+  carries no digests. The review read the new live schemas, but its scoped
+  catalog omitted many classified writes.
 - **Whether `render-paywall-screenshot` mutates anything.** It has no access
   column, and guessing is exactly what P5 exists to prevent.
 

documentation/stripe.md

@@ -139,38 +139,39 @@ boots but cannot list tools is usually a dashboard toggle, not a bad key.
 
 ## The eleven tools, and what they are classified as
 
-Stripe documents eleven tools on the hosted server. Seven are reads:
+Stripe currently serves eleven tools. Seven are reads:
 
 `stripe_api_search`, `stripe_api_details`, `stripe_api_read`,
-`get_stripe_account_info`, `get_balance_summary`,
-`search_stripe_documentation`, `stripe_implementation_planner`.
+`get_balance_summary`, `list_available_accounts_or_orgs`,
+`manage_stripe_accounts`, and `search_stripe_documentation`.
 
 Four are writes:
 
-`stripe_api_write` and `create_refund` are classified destructive;
-`stripe_report` and `send_stripe_mcp_feedback` are additive.
+`stripe_api_write` is destructive. `stripe_implementation_planner`,
+`stripe_analytics`, and `send_stripe_mcp_feedback` are additive.
 
 Two of those deserve a sentence. `stripe_api_read` is a read because Stripe
 documents it as the `GET` half of a generic pair — the tool is the read
 boundary, not whichever endpoint an agent names inside it, and its sibling
 `stripe_api_write` carries every `POST`, `PATCH`, `PUT`, and `DELETE`.
-`create_refund` is filed destructive despite its name: it reverses a settled
-charge and moves money back out, which is a mutation of something that already
-exists rather than a fresh object appearing beside it. Additive writes
-(`stripe_report`, `send_stripe_mcp_feedback`) leave `destructiveHint` unset;
+`stripe_implementation_planner` creates and continues provider-side guide
+state. `stripe_analytics` combines retrieval with query-run creation behind one
+tool. Stripe marks both not read-only and not destructive, so Connecta records
+them as additive writes. They leave `destructiveHint` unset. Their explicit
 `readOnlyHint: false` already routes them through `call_destructive_tool`, and
-asserting destruction only inflates the approval copy the host shows a human.
+asserting destruction would misstate their effect.
 
 That classification fills in downstream silence and otherwise preserves
-explicit annotations. It supplies the annotations Stripe leaves unset — Stripe
-documents no MCP annotations at all. A tool on the read allowlist arriving with
+explicit annotations. The current server annotates all eleven tools, while the
+manifest records what this release reviewed and exposes later contradictions.
+A tool on the read allowlist arriving with
 `destructiveHint: true` or `readOnlyHint: false` keeps exactly what the
 downstream said and stays behind `call_destructive_tool`. A tool on neither
 maintained list arriving with `readOnlyHint: true` keeps that too, and stays
 callable from `execute_code`. Both are the downstream telling you this release's
 allowlist is stale, and on a name no release has reviewed its word is the only
 evidence there is. One narrow fail-closed exception applies to a name this
-release reviewed and filed destructive: a `create_refund` claiming
+release reviewed and filed destructive: `stripe_api_write` claiming
 `readOnlyHint: true` is a downstream bug rather than news, and stays on the
 approval path.