@zackbart/connecta 0.15.0 → 0.16.0

package/dist/connectors/guarded-fetch.js

@@ -0,0 +1,289 @@
+/**
+ * The mechanical half of a hand-written connector's HTTP transport.
+ *
+ * Every `api()` surface that speaks HTTP re-derives the same handful of safety
+ * properties: the request lands inside the base URL and nowhere else, the
+ * credential rides exactly one origin, an unreachable provider becomes a typed
+ * failure instead of a raw `TypeError`, and the response is read with a
+ * ceiling on it. Cloudflare and Notion each grew a private copy of that
+ * machinery, subtly different in ways neither author intended, and a third
+ * author would have grown a third.
+ *
+ * What this deliberately does not own is *meaning*. It never reads a status
+ * code, never decides a 403 is recoverable, and never invents an
+ * authentication scheme: `authenticate` supplies the headers, and the caller's
+ * mapper reads the response. That split is not fastidiousness — Notion's 403
+ * (a capability the integration was never granted, which re-authorizing cannot
+ * fix) and Cloudflare's 403 (a token scope) want opposite next moves, and no
+ * shared helper can tell them apart without provider knowledge it has no
+ * business holding.
+ *
+ * Web APIs only: this is reachable from the root entry and stays that way.
+ */
+import { ConnectorCallError } from "../errors.js";
+/** Statuses that instruct a client to re-send somewhere else. Never followed. */
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Statuses the HTTP spec defines as carrying no body at all. */
+const BODILESS_STATUSES = new Set([204, 205, 304]);
+const decoder = new TextDecoder();
+const encoder = new TextEncoder();
+/**
+ * A base URL is deployment configuration, so a bad one is a structural mistake
+ * and throws where it is written rather than on the first call that uses it.
+ */
+function confinementBase(provider, baseUrl) {
+    let base;
+    try {
+        base = new URL(baseUrl);
+    }
+    catch {
+        throw new Error(`${provider} baseUrl must be an absolute URL: ${baseUrl}`);
+    }
+    const loopback = base.hostname === "localhost" ||
+        base.hostname === "127.0.0.1" ||
+        base.hostname === "[::1]";
+    if (base.protocol !== "https:" && !(base.protocol === "http:" && loopback)) {
+        throw new Error(`${provider} baseUrl must be https (http is allowed only for a loopback proxy or test double): ${baseUrl}`);
+    }
+    if (base.username || base.password) {
+        throw new Error(`${provider} baseUrl must not embed URL credentials; authentication belongs in headers.`);
+    }
+    if (base.search || base.hash) {
+        throw new Error(`${provider} baseUrl must not carry a query or fragment: ${baseUrl}`);
+    }
+    return base;
+}
+/**
+ * Resolve a provider-relative path beneath the base and prove it stayed there.
+ *
+ * The proof is the point. `new URL` normalizes `..` and percent-escapes for
+ * us, which is convenient and also exactly how a path escapes its prefix, so
+ * the origin and prefix are re-checked *after* normalization rather than
+ * before it.
+ */
+function confinedUrl(provider, base, basePath, request) {
+    const path = request.path;
+    if (!path.startsWith("/")) {
+        throw new ConnectorCallError("invalid_args", `A ${provider} request path is provider-relative and must begin with "/".`);
+    }
+    if (path.includes("?") || path.includes("#")) {
+        throw new ConnectorCallError("invalid_args", `A ${provider} request path carries no query or fragment; put query parameters in the query argument.`);
+    }
+    let url;
+    try {
+        url = new URL(`${base.origin}${basePath}${path}`);
+    }
+    catch {
+        throw new ConnectorCallError("invalid_args", `A ${provider} request path did not resolve to a valid URL.`);
+    }
+    if (url.origin !== base.origin ||
+        !`${url.pathname}/`.startsWith(`${basePath}/`)) {
+        throw new ConnectorCallError("invalid_args", `A ${provider} request path escaped the connector's base URL.`);
+    }
+    for (const [key, value] of Object.entries(request.query ?? {})) {
+        if (value === undefined)
+            continue;
+        url.searchParams.set(key, String(value));
+    }
+    return url;
+}
+function oversized(provider, limit, detail) {
+    return new ConnectorCallError("connector_call_failed", `${provider} returned ${detail}, past this connector's ${limit}-byte response ceiling.`, { retryable: false });
+}
+/** The response body as a `ReadableStream`, or null when there is none to read. */
+function readableBody(response) {
+    const body = response.body;
+    return body && typeof body.getReader === "function"
+        ? body
+        : null;
+}
+/** Read a stream to the ceiling and stop there — never past it. */
+async function drain(provider, stream, limit) {
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > limit) {
+                await reader.cancel().catch(() => { });
+                throw oversized(provider, limit, "more bytes than it may");
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const body = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return body;
+}
+/**
+ * Wrap a `Response` in the bounded read surface.
+ *
+ * Three paths, for one honest reason. A status the spec says carries no body
+ * is answered as empty without touching the response at all. Otherwise, when
+ * the runtime hands back a readable body — every real response on Node and on
+ * Workers — the ceiling is enforced *while* reading, so an oversized payload
+ * is abandoned rather than buffered. When it does not, there is nothing to
+ * meter mid-flight: `bytes()` and `text()` read the body whole and check the
+ * ceiling against what came back, and `json()` — with no bytes of its own to
+ * count — takes the stand-in at its word. That last path is the weaker
+ * guarantee and says so, but a real `fetch` Response with a body always
+ * streams, so it is not a path a provider takes in production; it is what a
+ * hand-built test double gets.
+ */
+function boundedResponse(provider, response, limit) {
+    if (BODILESS_STATUSES.has(response.status)) {
+        return {
+            status: response.status,
+            ok: response.ok,
+            headers: response.headers,
+            bytes: async () => new Uint8Array(),
+            text: async () => "",
+            json: async () => undefined,
+        };
+    }
+    const stream = readableBody(response);
+    let read;
+    const bytes = () => {
+        read ??= stream
+            ? drain(provider, stream, limit)
+            : response.arrayBuffer().then((buffer) => {
+                if (buffer.byteLength > limit) {
+                    throw oversized(provider, limit, `${buffer.byteLength} bytes`);
+                }
+                return new Uint8Array(buffer);
+            });
+        return read;
+    };
+    return {
+        status: response.status,
+        ok: response.ok,
+        headers: response.headers,
+        bytes,
+        async text() {
+            if (stream)
+                return decoder.decode(await bytes());
+            const body = await response.text();
+            const size = encoder.encode(body).length;
+            if (size > limit)
+                throw oversized(provider, limit, `${size} bytes`);
+            return body;
+        },
+        async json() {
+            // No stream means no bytes to count: a stand-in that answers `json()`
+            // directly is taken at its word, which is the one accessor on the one
+            // path where the ceiling cannot be applied.
+            if (!stream)
+                return await response.json();
+            const body = decoder.decode(await bytes());
+            return body.trim() === "" ? undefined : JSON.parse(body);
+        },
+    };
+}
+/**
+ * Build the guarded transport one hand-written connector sends every request
+ * through.
+ *
+ * ```ts
+ * const send = guardedFetch({
+ *   provider: "Billing",
+ *   baseUrl: "https://billing.internal.example/v1",
+ *   maxResponseBytes: 4 * 1024 * 1024,
+ *   headers: { Accept: "application/json" },
+ *   authenticate: async (ctx) => {
+ *     const token = await ctx.credential?.get();
+ *     if (!token) throw new ConnectorCallError("auth_required", "…");
+ *     return { Authorization: `Bearer ${token}` };
+ *   },
+ * });
+ *
+ * const invoice = await send({ method: "GET", path: `/invoices/${id}` }, ctx, (response) => {
+ *   if (!response.ok) throw billingFailure(response.status);
+ *   return response.json();
+ * });
+ * ```
+ */
+export function guardedFetch(options) {
+    const { provider, maxResponseBytes: limit } = options;
+    if (!Number.isInteger(limit) || limit < 1) {
+        throw new Error(`${provider} maxResponseBytes must be a whole number of bytes >= 1; received ${String(limit)}.`);
+    }
+    const base = confinementBase(provider, options.baseUrl);
+    // "" for a root base, so joining never doubles the separator.
+    const basePath = base.pathname.replace(/\/+$/, "");
+    const constantHeaders = { ...options.headers };
+    return async function send(request, ctx, map) {
+        if (request.body !== undefined && request.rawBody !== undefined) {
+            throw new Error(`A ${provider} request cannot carry both a JSON body and a raw body.`);
+        }
+        const url = confinedUrl(provider, base, basePath, request);
+        const headers = { ...constantHeaders };
+        for (const [name, value] of Object.entries(request.headers ?? {})) {
+            if (value !== undefined)
+                headers[name] = value;
+        }
+        if (request.body !== undefined && !hasHeader(headers, "content-type")) {
+            headers["Content-Type"] = "application/json";
+        }
+        // Authentication is applied last and may not be shadowed. A caller-shaped
+        // header that reaches this point wearing the credential's name is a bug
+        // worth failing on, not a precedence question worth resolving quietly.
+        for (const [name, value] of Object.entries(await options.authenticate(ctx))) {
+            const shadow = hasHeader(headers, name);
+            if (shadow) {
+                throw new ConnectorCallError("invalid_args", `A ${provider} request may not set the ${shadow} header; authentication is connector-owned.`);
+            }
+            headers[name] = value;
+        }
+        let response;
+        try {
+            response = await fetch(url.toString(), {
+                method: request.method,
+                headers,
+                ...(request.body !== undefined
+                    ? { body: JSON.stringify(request.body) }
+                    : request.rawBody !== undefined
+                        ? { body: request.rawBody }
+                        : {}),
+                // Never follow a redirect. A 3xx is an instruction to re-send the
+                // connector's credential to whatever origin the Location names, and a
+                // confinement a redirect can undo was never a confinement. There is no
+                // ambient credential to omit besides that — neither runtime's `fetch`
+                // keeps a cookie jar — so the headers `authenticate` returned are the
+                // only authority the request carries.
+                redirect: "manual",
+                ...(ctx.signal ? { signal: ctx.signal } : {}),
+            });
+        }
+        catch (cause) {
+            throw new ConnectorCallError("unavailable", `Could not reach the ${provider} API: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+        }
+        if (REDIRECT_STATUSES.has(response.status)) {
+            await response.body?.cancel().catch(() => { });
+            throw new ConnectorCallError("connector_call_failed", `${provider} answered HTTP ${response.status} with a redirect; this connector talks to exactly one origin and never forwards its credential to another.`, { retryable: false });
+        }
+        const declared = Number(response.headers.get("content-length"));
+        if (Number.isFinite(declared) && declared > limit) {
+            await response.body?.cancel().catch(() => { });
+            throw oversized(provider, limit, `a declared ${declared} bytes`);
+        }
+        return await map(boundedResponse(provider, response, limit), ctx);
+    };
+}
+/** The stored spelling of a header already present, case-insensitively. */
+function hasHeader(headers, name) {
+    const wanted = name.toLowerCase();
+    return Object.keys(headers).find((key) => key.toLowerCase() === wanted);
+}

package/dist/connectors/remote-mcp.d.ts

@@ -90,4 +90,3 @@ export declare function redirectSafeFetch(connectorId: string, policy?: RemoteMc
  * server or hide other connectors).
  */
 export declare function remoteMcp(id: string, opts: RemoteMcpOptions): Connector;
-//# sourceMappingURL=remote-mcp.d.ts.map

package/dist/connectors/remote-mcp.js

@@ -848,4 +848,3 @@ export function remoteMcp(id, opts) {
     }
     return connector;
 }
-//# sourceMappingURL=remote-mcp.js.map

package/dist/credentials.d.ts

@@ -115,4 +115,3 @@ export declare class CredentialVault {
     delete(connectorId: string): Promise<void>;
 }
 export {};
-//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.js

@@ -286,4 +286,3 @@ export class CredentialVault {
         await this.storage.delete(storageKey(connectorId));
     }
 }
-//# sourceMappingURL=credentials.js.map

package/dist/errors.d.ts

@@ -146,4 +146,3 @@ export declare function framingError(code: string, message: string): CallErrorDe
  * heuristic.
  */
 export declare function classifyCallError(err: unknown, fallbackCode?: string): CallErrorDetails;
-//# sourceMappingURL=errors.d.ts.map

package/dist/errors.js

@@ -220,4 +220,3 @@ export function classifyCallError(err, fallbackCode = "connector_call_failed") {
         retryable: RETRYABLE_MESSAGE_RE.test(message),
     };
 }
-//# sourceMappingURL=errors.js.map

package/dist/execute.d.ts

@@ -191,4 +191,3 @@ export declare function registerExecuteTool(server: McpServer, registry: Registr
     maxEmittedBlocks?: number;
 }): void;
 export {};
-//# sourceMappingURL=execute.d.ts.map

package/dist/execute.js

@@ -1019,4 +1019,3 @@ export function registerExecuteTool(server, registry, ctx) {
         }
     });
 }
-//# sourceMappingURL=execute.js.map

package/dist/executor-admission.d.ts

@@ -69,10 +69,20 @@ export declare class AdmissionController {
 }
 /** Preserve the one-method Workers seam while recognizing richer Node executors. */
 export declare function isAdmittingExecutor(executor: Executor): executor is AdmittingExecutor;
+/**
+ * Best-effort name for the configured sandbox, for `/health` and through it
+ * `connecta doctor` — which otherwise has to guess, and guessed QuickJS at
+ * every deployment including the Workers one ([#368]). The executor seam is
+ * structural, so this reads what is already there: an explicit `name`, else
+ * the constructor name a class-shaped executor carries for free. The value is
+ * a stranger's string bound for a public response body and an operator's
+ * terminal, so it is sanitized rather than trusted; nothing identifiable
+ * reports nothing, and doctor says so instead of naming a sandbox.
+ */
+export declare function executorName(executor: Executor): string | undefined;
 /**
  * Give a structurally-compatible but otherwise unbounded executor the same
  * admission contract as the built-in Node executor. The wrapper owns only the
  * queue; closing the underlying runtime remains the Connecta lifecycle's job.
  */
 export declare function withExecutorAdmission(executor: Executor, admission: AdmissionController): AdmittingExecutor;
-//# sourceMappingURL=executor-admission.d.ts.map

package/dist/executor-admission.js

@@ -205,6 +205,34 @@ export function isAdmittingExecutor(executor) {
     return ("acquire" in executor &&
         typeof executor.acquire === "function");
 }
+/** Terminal- and JSON-safe upper bound for an executor's self-reported name. */
+const MAX_EXECUTOR_NAME_LENGTH = 40;
+/**
+ * Best-effort name for the configured sandbox, for `/health` and through it
+ * `connecta doctor` — which otherwise has to guess, and guessed QuickJS at
+ * every deployment including the Workers one ([#368]). The executor seam is
+ * structural, so this reads what is already there: an explicit `name`, else
+ * the constructor name a class-shaped executor carries for free. The value is
+ * a stranger's string bound for a public response body and an operator's
+ * terminal, so it is sanitized rather than trusted; nothing identifiable
+ * reports nothing, and doctor says so instead of naming a sandbox.
+ */
+export function executorName(executor) {
+    const declared = executor.name;
+    const ctor = executor.constructor;
+    const raw = typeof declared === "string" && declared.trim()
+        ? declared
+        : typeof ctor?.name === "string" && ctor.name !== "Object"
+            ? ctor.name
+            : "";
+    const cleaned = raw
+        .replace(/[^\w .+-]+/g, " ")
+        .replace(/\s+/g, " ")
+        .trim()
+        .slice(0, MAX_EXECUTOR_NAME_LENGTH)
+        .trim();
+    return cleaned || undefined;
+}
 /**
  * Give a structurally-compatible but otherwise unbounded executor the same
  * admission contract as the built-in Node executor. The wrapper owns only the
@@ -238,4 +266,3 @@ export function withExecutorAdmission(executor, admission) {
         admissionSnapshot: () => admission.snapshot(),
     };
 }
-//# sourceMappingURL=executor-admission.js.map

package/dist/executor-result.d.ts

@@ -7,4 +7,3 @@ export declare function truncateExecuteText(text: string, max: number): string;
  * IPC. The parent repeats the guard for third-party Executor implementations.
  */
 export declare function prepareExecuteResultForTransport(outcome: ExecuteResult): ExecuteResult;
-//# sourceMappingURL=executor-result.d.ts.map

package/dist/executor-result.js

@@ -85,4 +85,3 @@ export function prepareExecuteResultForTransport(outcome) {
         };
     }
 }
-//# sourceMappingURL=executor-result.js.map

package/dist/executors/quickjs-child.d.ts

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=quickjs-child.d.ts.map

package/dist/executors/quickjs-child.js

@@ -128,4 +128,3 @@ process.on("disconnect", () => process.exit(0));
 // child that never becomes ready.
 await prepareQuickJs();
 send({ type: "ready" });
-//# sourceMappingURL=quickjs-child.js.map

package/dist/executors/quickjs-protocol.d.ts

@@ -68,4 +68,3 @@ export declare function hostCallLabel(payload: {
 }): string;
 export declare function serializedBytes(text: string): number;
 export declare function stringifyBounded(value: unknown, label: string, limit?: number): string;
-//# sourceMappingURL=quickjs-protocol.d.ts.map

package/dist/executors/quickjs-protocol.js

@@ -36,4 +36,3 @@ export function stringifyBounded(value, label, limit = MAX_QUICKJS_IPC_BYTES) {
     }
     return json;
 }
-//# sourceMappingURL=quickjs-protocol.js.map

package/dist/executors/quickjs-runtime.d.ts

@@ -23,4 +23,3 @@ export interface QuickJsExecutionResult extends ExecuteResult {
  * driving QuickJS, so a slow downstream does not consume the short CPU budget.
  */
 export declare function executeQuickJs(code: string, providers: ExecutorProvider[], options: QuickJsRuntimeOptions): Promise<QuickJsExecutionResult>;
-//# sourceMappingURL=quickjs-runtime.d.ts.map

package/dist/executors/quickjs-runtime.js

@@ -401,4 +401,3 @@ export async function executeQuickJs(code, providers, options) {
     }
     return finish(outcome);
 }
-//# sourceMappingURL=quickjs-runtime.js.map

package/dist/executors/quickjs.d.ts

@@ -28,4 +28,3 @@ export interface QuickJsExecutorOptions {
  * double-acquire deadlock at concurrency 1.
  */
 export declare function quickJsExecutor(options?: QuickJsExecutorOptions): AdmittingExecutor;
-//# sourceMappingURL=quickjs.d.ts.map

package/dist/executors/quickjs.js

@@ -102,6 +102,8 @@ function waitForReady(ready, signal) {
     });
 }
 class QuickJsChildPool {
+    /** What `/health` and `connecta doctor` call this sandbox (#368). */
+    name = "QuickJS";
     admission;
     slots;
     available;
@@ -535,4 +537,3 @@ class QuickJsChildPool {
 export function quickJsExecutor(options = {}) {
     return new QuickJsChildPool(options);
 }
-//# sourceMappingURL=quickjs.js.map

package/dist/favicon.d.ts

@@ -1,2 +1 @@
 export declare const CONNECTA_FAVICON_ICO: Uint8Array<ArrayBufferLike>;
-//# sourceMappingURL=favicon.d.ts.map

package/dist/favicon.js

@@ -46,4 +46,3 @@ function buildIco() {
     return ico;
 }
 export const CONNECTA_FAVICON_ICO = buildIco();
-//# sourceMappingURL=favicon.js.map

package/dist/index.d.ts

@@ -192,7 +192,6 @@ export { CONNECTA_VERSION } from "./version.js";
 export type { Registry } from "./registry.js";
 export type { RemoteMcpOptions, RemoteMcpAuth, RemoteMcpRedirectPolicy, } from "./connectors/remote-mcp.js";
 export type { ApiOptions, ApiTool } from "./connectors/api.js";
-export type { Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectaBranding, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorUsageGuide, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, UiAuthConfig, AuthResult, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
-export type { ActivityActor, ActivityCallSource, ActivityOutcome, ActivityPage, ActivityReadActor, ActivityReadEvent, ActivityReader, ActivityReadGate, ActivityReadPage, ActivitySink, ActivityStore, AgentFriction, ToolCallActivityEvent, } from "./activity.js";
+export type { CatalogDriftCounts, CatalogDriftReport, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectaBranding, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorUsageGuide, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, UiAuthConfig, AuthResult, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
+export type { ActivityActor, ActivityCallSource, ActivityOutcome, ActivityPage, ActivityReadActor, ActivityReadEvent, ActivityReader, ActivityReadGate, ActivityReadPage, ActivitySink, ActivityStore, AgentFriction, CatalogDriftActivityEvent, ToolCallActivityEvent, } from "./activity.js";
 export { InvalidActivityCursorError } from "./activity.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -5,7 +5,7 @@ import { createFetchHandler } from "./server.js";
 import { droppedBrandingUrls, droppedUiAuthUrls } from "./ui.js";
 import { memoryStorage } from "./storage/memory.js";
 import { CONNECTA_VERSION } from "./version.js";
-import { AdmissionController, isAdmittingExecutor, withExecutorAdmission, } from "./executor-admission.js";
+import { AdmissionController, executorName, isAdmittingExecutor, withExecutorAdmission, } from "./executor-admission.js";
 const REQUEST_ADMISSION_DEFAULTS = {
     concurrency: 16,
     maxQueueSize: 32,
@@ -225,10 +225,26 @@ export function createConnecta(config) {
         throw new Error("accessTokens requires a Clerk auth provider: only an eligible Clerk " +
             "operator may create, rename, or revoke deployment access tokens");
     }
+    const serverInfo = {
+        ...config.serverInfo,
+        name: config.serverInfo?.name ?? "connecta",
+        version: config.serverInfo?.version ?? CONNECTA_VERSION,
+    };
     const registry = new Registry(config.connectors, {
         storage,
         logger,
         ...(credentialVault !== undefined ? { credentialVault } : {}),
+        ...(config.activity?.store !== undefined
+            ? {
+                catalogDriftActivity: {
+                    sink: config.activity.store,
+                    serverInfo,
+                    ...(config.activity.deploymentId !== undefined
+                        ? { deploymentId: config.activity.deploymentId }
+                        : {}),
+                },
+            }
+            : {}),
         ...(config.discovery?.catalogTtlSeconds !== undefined
             ? { toolCacheTtlSeconds: config.discovery.catalogTtlSeconds }
             : {}),
@@ -248,6 +264,9 @@ export function createConnecta(config) {
     const configuredCodeAdmission = admissionController(config.admission?.code, CODE_ADMISSION_DEFAULTS);
     let codeAdmission;
     let executor = config.executor;
+    // Read the identity off the configured executor, before any wrapper hides
+    // it behind an anonymous object literal.
+    const configuredExecutorName = executorName(executor);
     if (!isAdmittingExecutor(executor)) {
         codeAdmission = configuredCodeAdmission;
         executor = withExecutorAdmission(executor, codeAdmission);
@@ -261,11 +280,7 @@ export function createConnecta(config) {
         registry,
         auth: inboundAuth,
         ...(config.publicUrl !== undefined ? { publicUrl: config.publicUrl } : {}),
-        serverInfo: {
-            ...config.serverInfo,
-            name: config.serverInfo?.name ?? "connecta",
-            version: config.serverInfo?.version ?? CONNECTA_VERSION,
-        },
+        serverInfo,
         logger,
         ...(config.activity?.store !== undefined
             ? { activity: config.activity.store }
@@ -277,6 +292,9 @@ export function createConnecta(config) {
             ? { activityDeploymentId: config.activity.deploymentId }
             : {}),
         executor,
+        ...(configuredExecutorName !== undefined
+            ? { executorName: configuredExecutorName }
+            : {}),
         requestAdmission,
         ...(config.calls?.defaultTimeoutMs !== undefined
             ? { defaultToolTimeoutMs: config.calls.defaultTimeoutMs }
@@ -328,4 +346,3 @@ export { bearerToken } from "./auth/bearer.js";
 export { memoryStorage } from "./storage/memory.js";
 export { CONNECTA_VERSION } from "./version.js";
 export { InvalidActivityCursorError } from "./activity.js";
-//# sourceMappingURL=index.js.map

package/dist/invocation.d.ts

@@ -105,4 +105,3 @@ export declare class InvocationService {
     private invokeWithResolution;
 }
 export {};
-//# sourceMappingURL=invocation.d.ts.map

package/dist/invocation.js

@@ -457,4 +457,3 @@ export class InvocationService {
         }
     }
 }
-//# sourceMappingURL=invocation.js.map

package/dist/json-schema.d.ts

@@ -1,3 +1,2 @@
 export { Validator } from "@cfworker/json-schema";
 export type { OutputUnit, Schema, SchemaDraft, ValidationResult, } from "@cfworker/json-schema";
-//# sourceMappingURL=json-schema.d.ts.map

package/dist/json-schema.js

@@ -3,4 +3,3 @@
 // its own output, say) resolves the same implementation and version through an
 // explicit subpath rather than through npm hoisting.
 export { Validator } from "@cfworker/json-schema";
-//# sourceMappingURL=json-schema.js.map

package/dist/mcp-result.d.ts

@@ -6,4 +6,3 @@ import type { Connector } from "./types.js";
  * Non-MCP connectors already return plain values.
  */
 export declare function unwrapMcpResult(kind: Connector["kind"], result: unknown): unknown;
-//# sourceMappingURL=mcp-result.d.ts.map

package/dist/mcp-result.js

@@ -32,4 +32,3 @@ export function unwrapMcpResult(kind, result) {
     }
     return result;
 }
-//# sourceMappingURL=mcp-result.js.map

package/dist/meta-tools.d.ts

@@ -136,4 +136,3 @@ export declare function registerMetaTools(server: McpServer, registry: RegistryV
     activity?: ActivityRequestContext;
     requestSignal?: AbortSignal;
 }): void;
-//# sourceMappingURL=meta-tools.d.ts.map

package/dist/meta-tools.js

@@ -1178,4 +1178,3 @@ export function registerMetaTools(server, registry, ctx) {
         _meta: { ui: { visibility: ["model"] } },
     }, async (args) => mt.getResult(args));
 }
-//# sourceMappingURL=meta-tools.js.map

package/dist/node.d.ts

@@ -25,4 +25,3 @@ export interface ListenOptions {
  * dependencies beyond node core.
  */
 export declare function listen(connecta: Connecta, portOrOptions: number | ListenOptions): Server;
-//# sourceMappingURL=node.d.ts.map

package/dist/node.js

@@ -166,4 +166,3 @@ export function listen(connecta, portOrOptions) {
         server.listen(opts.port);
     return server;
 }
-//# sourceMappingURL=node.js.map