@zackbart/connecta 0.15.1 → 0.16.1

package/dist/providers/stripe.js

@@ -1,4 +1,5 @@
 import { remoteMcp, } from "../connectors/remote-mcp.js";
+import { vettedCatalog, withVettedCatalog } from "../catalog-drift.js";
 /** Stripe publishes one hosted MCP endpoint; the credential selects the mode. */
 export const STRIPE_MCP_ENDPOINT = "https://mcp.stripe.com/";
 /**
@@ -66,60 +67,21 @@ const WRITE_TOOLS = new Map([
     ["send_stripe_mcp_feedback", "additive"],
 ]);
 /**
- * Fill in downstream silence; keep reviewed destructive tools fail-closed.
+ * The manifest this release reviewed: both lists in one place, which is what
+ * makes the classification the connector applies and the drift check that runs
+ * beside it the same fact (P13). No schema digests yet — no release has read
+ * Stripe's live schemas and written them down, and an invented digest would
+ * report a change that never happened. `npm run drift:check -- --record` reads
+ * them from a live account and prints the block to paste in
+ * ([#351](https://github.com/zackbart/connecta/issues/351)).
  *
- * Silence is what a vetted classification is for, and an explicit downstream
- * annotation otherwise wins in both directions. `destructiveHint: true` or
- * `readOnlyHint: false` on an allowlisted read name is the downstream telling
- * us this release's allowlist is stale; `readOnlyHint: true` on a name no
- * release has classified says the same thing from the other side. The single
- * place a vetted verdict still overrides the downstream is a name this release
- * reviewed and filed destructive: there connecta knows what the tool does, and
- * a claim to the contrary is a downstream bug rather than news
- * ([#310](https://github.com/zackbart/connecta/issues/310),
- * [#315](https://github.com/zackbart/connecta/issues/315)).
+ * Exported because the maintainer-run check compares against this manifest and
+ * *names* what moved, which the runtime check deliberately cannot.
  */
-function vettedSafety(definition) {
-    const downstream = definition.annotations ?? {};
-    if (READ_ONLY_TOOLS.has(definition.name)) {
-        if (downstream.destructiveHint === true ||
-            downstream.readOnlyHint === false) {
-            return definition;
-        }
-        return {
-            ...definition,
-            annotations: {
-                ...downstream,
-                readOnlyHint: true,
-                destructiveHint: downstream.destructiveHint ?? false,
-            },
-        };
-    }
-    if (WRITE_TOOLS.get(definition.name) === "destructive") {
-        return {
-            ...definition,
-            annotations: {
-                ...downstream,
-                readOnlyHint: false,
-                destructiveHint: true,
-            },
-        };
-    }
-    // Maintained additive writes and tools this release has never seen land here
-    // alike. Fill-in only: a silent tool is not read-only, so drift still fails
-    // closed onto `call_destructive_tool`, and neither population gets a
-    // `destructiveHint` it has not earned. A tool that arrives explicitly
-    // read-only keeps that annotation — on a name no release has reviewed, the
-    // downstream's own word is the only evidence there is, and rewriting it
-    // would be an overrule rather than a fill-in.
-    return {
-        ...definition,
-        annotations: {
-            ...downstream,
-            readOnlyHint: downstream.readOnlyHint ?? false,
-        },
-    };
-}
+export const STRIPE_VETTED_CATALOG = vettedCatalog({
+    reads: READ_ONLY_TOOLS,
+    writes: WRITE_TOOLS,
+});
 /** Stripe key prefixes carry their own mode; only a clear reading counts. */
 const LIVE_KEY = /\b(?:sk|rk|pk)_live_/;
 const TEST_KEY = /\b(?:sk|rk|pk)_test_/;
@@ -189,11 +151,14 @@ ${copy.warning}
 - Prefer a dedicated tool when one covers the task: \`get_stripe_account_info\` for which account this is, \`get_balance_summary\` for balances, \`create_refund\` for refunds, \`stripe_report\` for reports. One call instead of three, and a refund named \`create_refund\` reads far more clearly in the approval a human sees than the same refund buried in \`stripe_api_write\` arguments.
 - \`stripe_api_write\` carries the blast radius of the entire write API — every POST, PATCH, PUT, and DELETE, from a customer edit to a subscription cancellation. State the method and path explicitly; expect approval on every call.
 - Lists are cursor-paginated: \`limit\` defaults to 10 and caps at 100, \`starting_after\` and \`ending_before\` take an object id and are mutually exclusive, and \`has_more\` says whether to continue. Page inside \`execute_code\` and reduce before returning.
+- Resolve ids before acting; never guess one. Stripe ids are typed prefixes — \`cus_\` customer, \`sub_\` subscription, \`ch_\` charge, \`pi_\` payment intent, \`in_\` invoice, \`acct_\` account — and a plausible-looking id belongs to a different object or to nobody. Find the object with \`stripe_api_search\` (or a list endpoint through \`stripe_api_read\`) and carry the \`id\` it returned into the write.
+- This account's tool list is not a fixed set. Stripe gates parts of its MCP catalog by account, integration, and beta enrollment, so search this connector for what it actually exposes rather than assuming a documented tool is here.
 - Amounts are integers in the currency's minor unit: \`1099\` is 10.99 USD, and zero-decimal currencies like JPY take \`10\` for 10 JPY. Never send a decimal.
 - Send an \`Idempotency-Key\` on every write you might retry, if the tool accepts it, and reuse the same key for the retry. A retry with a fresh key is a second charge, not a second attempt.
 - Stripe answers a rate limit with \`429\` and a \`Stripe-Rate-Limited-Reason\` header; back off on that rather than retrying immediately. This account's documented ceiling is ${rate} requests per second, and any single endpoint is capped at 25 per second regardless of mode, so paging one list is the real constraint.
 - Use \`search_stripe_documentation\` when the shape of an object or a flow is unclear; it is a read and costs nothing but a call.
 - Treat every create, update, delete, refund, and report run as a write. Connecta routes the maintained write catalog through \`call_destructive_tool\`; newly added tools also fail closed until classified.
+- An \`auth_required\` failure means this connector's Stripe authorization is missing or expired: run \`authorize_connector\` for this connector id, then retry the same call unchanged. A rejected argument or a plan restriction comes back in Stripe's own words instead — read it rather than re-authorizing.
 ${accountInstructions
         ? `\n## Account instructions\n\n${accountInstructions}\n`
         : ""}`;
@@ -218,16 +183,22 @@ export function stripe(id, options) {
         auth,
         requireHttps: true,
         callAdmission: STRIPE_ADMISSION[mode],
-        usageGuide: usageGuide(mode, purpose, options.instructions),
+        usageGuide: {
+            content: usageGuide(mode, purpose, options.instructions),
+            // Explicit rather than derived: production versus sandbox is the fact an
+            // agent must not get wrong, and the derived summary would be the
+            // "Mode: … Account purpose: …" line with the operator's prose eating the
+            // budget ([#342](https://github.com/zackbart/connecta/issues/342)).
+            summary: mode === "production"
+                ? "PRODUCTION: writes move real money. Generic api tools, id prefixes, minor units, idempotency."
+                : "Sandbox: test data only, never live figures. Generic api tools, id prefixes, minor units.",
+            // Not `required`. The four generic tools are the routing decision, and
+            // the mode warning already rides the title and description; a guide
+            // forced into every call would pay for the same paragraph repeatedly.
+        },
         ...(options.maxResultBytes !== undefined
             ? { maxResultBytes: options.maxResultBytes }
             : {}),
     });
-    return {
-        ...connector,
-        async listTools(ctx) {
-            return (await connector.listTools(ctx)).map(vettedSafety);
-        },
-    };
+    return withVettedCatalog(connector, STRIPE_VETTED_CATALOG);
 }
-//# sourceMappingURL=stripe.js.map

package/dist/registry.d.ts

@@ -1,4 +1,5 @@
-import type { Connector, ConnectorContext, ConnectorStatus, KVStorage, Logger, ToolDef } from "./types.js";
+import type { CatalogDriftReport, Connector, ConnectorContext, ConnectorStatus, KVStorage, Logger, ToolDef } from "./types.js";
+import { type CatalogDriftActivityContext } from "./activity.js";
 import { type CredentialVault } from "./credentials.js";
 import { type CallAdmissionPermit, type ConnectorCallAdmissionSnapshot } from "./call-admission.js";
 /**
@@ -61,6 +62,12 @@ export interface RegistryOptions {
      * to the default 50_000.
      */
     maxResultBytes?: number;
+    /**
+     * Where payload-free catalog-drift observations go. Present only when the
+     * deployment configured an activity store; drift is reported through
+     * connector status either way.
+     */
+    catalogDriftActivity?: Omit<CatalogDriftActivityContext, "logger">;
 }
 export type ConnectorOperationOptions = Pick<ConnectorContext, "signal" | "timeoutMs">;
 /**
@@ -121,6 +128,8 @@ export declare class Registry implements RegistryView {
     private readonly requestCatalogLoads;
     /** Deployment-wide observations — every call, whatever view made it. */
     private readonly health;
+    /** Last drift counts reported to activity, per connector, in this runtime. */
+    private readonly reportedDrift;
     private readonly ttlMs;
     private readonly staleMs;
     private readonly persistToolCatalog;
@@ -152,6 +161,30 @@ export declare class Registry implements RegistryView {
     }): Promise<CallAdmissionPermit>;
     /** Payload-free aggregate state for the open health endpoint. */
     callAdmissionSnapshot(): Record<string, ConnectorCallAdmissionSnapshot>;
+    /**
+     * Payload-free drift counts for the open health endpoint, so `connecta
+     * doctor` can report a stale allowlist without asking any downstream
+     * anything. Only connectors that ship a vetted manifest *and* have already
+     * served a refresh *in this runtime* appear — a process or isolate that has
+     * answered no catalog request yet honestly reports nothing, and drift is not
+     * persisted the way the catalog itself is.
+     *
+     * Every report is rebuilt by {@link boundedCatalogDrift} on the way out:
+     * `Connector.catalogDrift()` is the open plugin seam, and this snapshot is
+     * serialized into an unauthenticated response.
+     */
+    catalogDriftSnapshot(): Record<string, CatalogDriftReport>;
+    /**
+     * Turn the observation a refresh just took into at most one activity event.
+     *
+     * Emitted on change rather than on every refresh: an identical report every
+     * TTL is a heartbeat, not news, and the current counts are already on
+     * connector status. A first observation that is clean is not an event
+     * either — nothing moved — but a later return to clean is, because "the
+     * drift is gone" is exactly what an operator watching the timeline is
+     * waiting for.
+     */
+    private observeCatalogDrift;
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission(): void;
     /**
@@ -216,4 +249,3 @@ export declare class Registry implements RegistryView {
     /** Drop both in-memory and persisted tool catalogs. */
     invalidateStored(id: string): Promise<void>;
 }
-//# sourceMappingURL=registry.d.ts.map

package/dist/registry.js

@@ -1,6 +1,8 @@
+import { recordCatalogDriftActivity, } from "./activity.js";
 import { storedCredentialShape, } from "./credentials.js";
 import { ConnectorCallError } from "./errors.js";
 import { ConnectorCallAdmissionController, } from "./call-admission.js";
+import { boundedCatalogDrift } from "./catalog-drift.js";
 import { fingerprintSerializedCatalog, snapshotCatalog, } from "./catalog-fingerprint.js";
 import { MAX_CATALOG_CHUNK_BYTES, MAX_CATALOG_TOOLS, MAX_SERIALIZED_CATALOG_BYTES, } from "./catalog-limits.js";
 import { mapSettledWithConcurrency } from "./concurrency.js";
@@ -122,6 +124,8 @@ export class Registry {
     requestCatalogLoads = new WeakMap();
     /** Deployment-wide observations — every call, whatever view made it. */
     health = new HealthLog();
+    /** Last drift counts reported to activity, per connector, in this runtime. */
+    reportedDrift = new Map();
     ttlMs;
     staleMs;
     persistToolCatalog;
@@ -247,6 +251,68 @@ export class Registry {
             admission.snapshot(),
         ]));
     }
+    /**
+     * Payload-free drift counts for the open health endpoint, so `connecta
+     * doctor` can report a stale allowlist without asking any downstream
+     * anything. Only connectors that ship a vetted manifest *and* have already
+     * served a refresh *in this runtime* appear — a process or isolate that has
+     * answered no catalog request yet honestly reports nothing, and drift is not
+     * persisted the way the catalog itself is.
+     *
+     * Every report is rebuilt by {@link boundedCatalogDrift} on the way out:
+     * `Connector.catalogDrift()` is the open plugin seam, and this snapshot is
+     * serialized into an unauthenticated response.
+     */
+    catalogDriftSnapshot() {
+        const snapshot = {};
+        for (const connector of this.connectors.values()) {
+            const report = boundedCatalogDrift(connector.catalogDrift?.());
+            if (report)
+                snapshot[connector.id] = report;
+        }
+        return snapshot;
+    }
+    /**
+     * Turn the observation a refresh just took into at most one activity event.
+     *
+     * Emitted on change rather than on every refresh: an identical report every
+     * TTL is a heartbeat, not news, and the current counts are already on
+     * connector status. A first observation that is clean is not an event
+     * either — nothing moved — but a later return to clean is, because "the
+     * drift is gone" is exactly what an operator watching the timeline is
+     * waiting for.
+     */
+    observeCatalogDrift(connector) {
+        const report = boundedCatalogDrift(connector.catalogDrift?.());
+        if (!report)
+            return;
+        const previous = this.reportedDrift.get(connector.id);
+        // Bounded counts, so a seam returning NaN cannot make every refresh look
+        // like a change and emit an event per refresh forever.
+        const counts = {
+            unclassifiedTools: report.unclassifiedTools,
+            unservedTools: report.unservedTools,
+            annotationConflicts: report.annotationConflicts,
+            schemaChanges: report.schemaChanges,
+        };
+        const unchanged = previous !== undefined &&
+            previous.unclassifiedTools === counts.unclassifiedTools &&
+            previous.unservedTools === counts.unservedTools &&
+            previous.annotationConflicts === counts.annotationConflicts &&
+            previous.schemaChanges === counts.schemaChanges;
+        if (unchanged)
+            return;
+        const clean = counts.unclassifiedTools === 0 &&
+            counts.unservedTools === 0 &&
+            counts.annotationConflicts === 0 &&
+            counts.schemaChanges === 0;
+        this.reportedDrift.set(connector.id, counts);
+        if (previous === undefined && clean)
+            return;
+        recordCatalogDriftActivity(this.opts.catalogDriftActivity
+            ? { ...this.opts.catalogDriftActivity, logger: this.opts.logger }
+            : undefined, { connectorId: connector.id, ...counts });
+    }
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission() {
         for (const admission of this.callAdmission.values())
@@ -535,6 +601,10 @@ export class Registry {
             return connector.staticTools;
         const generation = this.catalogGeneration(id);
         const tools = await connector.listTools(this.contextFor(id, baseUrl, requestScope, callOptions));
+        // The listing a maintained proxy just served is also the only catalog
+        // comparison connecta ever makes. It rides this refresh whether or not the
+        // result reaches a cache, because what drifted drifted.
+        this.observeCatalogDrift(connector);
         // The caller that began this refresh may still use its result, but a
         // credential/OAuth change that landed while listTools was in flight means
         // the listing must not enter either shared cache layer.
@@ -719,20 +789,31 @@ export class Registry {
         if (!connector)
             return { state: "error", message: "Unknown connector" };
         const ctx = this.contextFor(id, baseUrl, requestScope, callOptions);
+        // Whatever the state turns out to be, it carries the drift the last
+        // refresh saw. Reading it is a lookup, not a probe: a connector that has
+        // listed nothing yet reports nothing, and status never lists on its own to
+        // make the field appear.
+        // The report is rebuilt rather than spread through: what the seam returned
+        // is third-party output, and status is read by the operator UI and copied
+        // into responses.
+        const withDrift = (status) => {
+            const report = boundedCatalogDrift(connector.catalogDrift?.());
+            return report ? { ...status, catalogDrift: report } : status;
+        };
         if (connector.status) {
             try {
-                return await connector.status(ctx);
+                return withDrift(await connector.status(ctx));
             }
             catch (err) {
-                return { state: "error", message: msg(err) };
+                return withDrift({ state: "error", message: msg(err) });
             }
         }
         try {
             await this.getTools(id, baseUrl, requestScope, callOptions);
-            return { state: "ok" };
+            return withDrift({ state: "ok" });
         }
         catch (err) {
-            return { state: "error", message: msg(err) };
+            return withDrift({ state: "error", message: msg(err) });
         }
     }
     markCatalogInvalid(id) {
@@ -763,4 +844,3 @@ export class Registry {
             await this.deleteStoredCatalog(id);
     }
 }
-//# sourceMappingURL=registry.js.map

package/dist/retired-toolkits.d.ts

@@ -1,3 +1,2 @@
 /** Fail loudly when JavaScript callers pass the retired audience-scoping keys. */
 export declare function assertNoRetiredToolkitOptions(source: string, options: object): void;
-//# sourceMappingURL=retired-toolkits.d.ts.map

package/dist/retired-toolkits.js

@@ -6,4 +6,3 @@ export function assertNoRetiredToolkitOptions(source, options) {
     throw new Error(`${source} options \`toolkits\` and \`unscoped\` were removed in issue ` +
         "#178. Deploy one connecta instance per audience instead; see ethos.md.");
 }
-//# sourceMappingURL=retired-toolkits.js.map

package/dist/routes/access-tokens.d.ts

@@ -4,4 +4,3 @@ import { type RouteContext } from "./shared.js";
  * is deliberately never an administrator credential and cannot reach here.
  */
 export declare function routeAccessTokens(context: RouteContext): Promise<Response | null>;
-//# sourceMappingURL=access-tokens.d.ts.map

package/dist/routes/access-tokens.js

@@ -81,4 +81,3 @@ export async function routeAccessTokens(context) {
         return privateJson({ error: msg(error) }, { status: 400 });
     }
 }
-//# sourceMappingURL=access-tokens.js.map

package/dist/routes/activity.d.ts

@@ -1,3 +1,2 @@
 import { type RouteContext } from "./shared.js";
 export declare function routeActivity(context: RouteContext): Promise<Response | null>;
-//# sourceMappingURL=activity.d.ts.map

package/dist/routes/activity.js

@@ -167,4 +167,3 @@ export async function routeActivity(context) {
         return privateJson({ error: "activity history is temporarily unavailable" }, { status: 503 });
     }
 }
-//# sourceMappingURL=activity.js.map

package/dist/routes/credentials.d.ts

@@ -1,3 +1,2 @@
 import { type RouteContext } from "./shared.js";
 export declare function routeCredentials(context: RouteContext): Promise<Response | null>;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/routes/credentials.js

@@ -167,4 +167,3 @@ export async function routeCredentials(context) {
     }
     return handleCredentialRequest(context, connectorId, match[2]);
 }
-//# sourceMappingURL=credentials.js.map

package/dist/routes/mcp.d.ts

@@ -5,4 +5,3 @@ export declare const MCP_CORS_HEADERS: {
     "Access-Control-Allow-Headers": string;
 };
 export declare function createMcpRoute(opts: ServerOptions): (context: RouteContext) => Promise<Response | null>;
-//# sourceMappingURL=mcp.d.ts.map

package/dist/routes/mcp.js

@@ -338,4 +338,3 @@ export function createMcpRoute(opts) {
         }
     };
 }
-//# sourceMappingURL=mcp.js.map

package/dist/routes/oauth.d.ts

@@ -1,4 +1,3 @@
 import { type RouteContext } from "./shared.js";
 export declare function routeOAuthManagement(context: RouteContext): Promise<Response | null>;
 export declare function routeOAuthCallback(context: RouteContext): Promise<Response | null>;
-//# sourceMappingURL=oauth.d.ts.map

package/dist/routes/oauth.js

@@ -260,4 +260,3 @@ export async function routeOAuthCallback(context) {
         return html(`Authorization failed: ${msg(err)}`, 500, opts.branding);
     }
 }
-//# sourceMappingURL=oauth.js.map

package/dist/routes/shared.d.ts

@@ -28,6 +28,8 @@ export interface ServerOptions {
     maxEmittedBlocks?: number;
     /** Required sandbox backing the execute_code meta-tool. */
     executor: Executor;
+    /** Sanitized identity of the configured sandbox, when it has one. */
+    executorName?: string;
     /** Global FIFO boundary for all non-preflight `/mcp` requests. */
     requestAdmission: AdmissionController;
     /** Encrypted connector-credential storage backing the Credentials page. */
@@ -80,4 +82,3 @@ export declare function authorizeUiAdmin(request: Request, baseUrl: string, auth
 }>;
 export declare function isSameOrigin(request: Request, baseUrl: string): boolean;
 export declare function withSecurityHeaders(response: Response, requestUrl: URL, path: string): Response;
-//# sourceMappingURL=shared.d.ts.map

package/dist/routes/shared.js

@@ -137,4 +137,3 @@ export function withSecurityHeaders(response, requestUrl, path) {
         headers,
     });
 }
-//# sourceMappingURL=shared.js.map

package/dist/routes/ui.d.ts

@@ -1,3 +1,2 @@
 import { type RouteContext } from "./shared.js";
 export declare function routeUi(context: RouteContext): Promise<Response | null>;
-//# sourceMappingURL=ui.d.ts.map

package/dist/routes/ui.js

@@ -121,4 +121,3 @@ export async function routeUi(context) {
     eligibleClerkOperator ? opts.credentialVault : undefined, Boolean(opts.activity?.list), credentialManagement, defer, eligibleClerkOperator, opts.discoveryConcurrency, accessTokenManagement);
     return privateJson(data);
 }
-//# sourceMappingURL=ui.js.map

package/dist/server.d.ts

@@ -8,4 +8,3 @@ export type { ServerOptions } from "./routes/shared.js";
  * wrapper is applied to every response.
  */
 export declare function createFetchHandler(opts: ServerOptions): (request: Request, runtimeContext?: RuntimeExecutionContext) => Promise<Response>;
-//# sourceMappingURL=server.d.ts.map

package/dist/server.js

@@ -103,6 +103,17 @@ export function createFetchHandler(opts) {
                     status: "ok",
                     connectors: registry.listConnectors().length,
                     server: opts.serverInfo,
+                    // Which sandbox, not how it is tuned: `connecta doctor` reports the
+                    // executor it just exercised rather than assuming one, and a
+                    // deployment whose executor identifies as nothing omits the key
+                    // instead of inviting a guess (#368).
+                    ...(opts.executorName !== undefined
+                        ? { executor: { name: opts.executorName } }
+                        : {}),
+                    // Counts only, from refreshes that already happened — the endpoint
+                    // asks no downstream anything, and `connecta doctor` reads it to
+                    // report a stale allowlist without a probe of its own (#343).
+                    catalogDrift: registry.catalogDriftSnapshot(),
                     admission: {
                         policy: "global-fifo",
                         requests: opts.requestAdmission.snapshot(),
@@ -158,4 +169,3 @@ export function createFetchHandler(opts) {
         return withSecurityHeaders(await route(), url, path);
     };
 }
-//# sourceMappingURL=server.js.map

package/dist/skills.d.ts

@@ -38,4 +38,3 @@ export type SkillLookup = {
  * silent fallback to the generic guide.
  */
 export declare function resolveSkill(name: string, connectors: readonly Connector[]): SkillLookup;
-//# sourceMappingURL=skills.d.ts.map

package/dist/skills.js

@@ -234,4 +234,3 @@ export function resolveSkill(name, connectors) {
         message: `Unknown skill "${name}". Available skills: ${available()}.`,
     };
 }
-//# sourceMappingURL=skills.js.map

package/dist/storage/file.d.ts

@@ -9,4 +9,3 @@ export interface FileStorageOptions {
  * subpath so the main entry stays Workers-clean.
  */
 export declare function fileStorage(path: string, opts?: FileStorageOptions): KVStorage;
-//# sourceMappingURL=file.d.ts.map

package/dist/storage/file.js

@@ -101,4 +101,3 @@ export function fileStorage(path, opts = {}) {
         },
     };
 }
-//# sourceMappingURL=file.js.map

package/dist/storage/memory.d.ts

@@ -1,4 +1,3 @@
 import type { KVStorage } from "../types.js";
 /** In-memory KV store with expiry. The default for dev and Node. */
 export declare function memoryStorage(): KVStorage;
-//# sourceMappingURL=memory.d.ts.map

package/dist/storage/memory.js

@@ -36,4 +36,3 @@ export function memoryStorage() {
         },
     };
 }
-//# sourceMappingURL=memory.js.map

package/dist/timeout.d.ts

@@ -18,4 +18,3 @@ export declare function withTimeout<T>(promise: Promise<T>, ms: number, label: s
  * any in-flight work that honors the signal.
  */
 export declare function withAbortableTimeout<T>(operation: (signal: AbortSignal) => Promise<T>, ms: number, label: string): Promise<T>;
-//# sourceMappingURL=timeout.d.ts.map

package/dist/timeout.js

@@ -63,4 +63,3 @@ export function withAbortableTimeout(operation, ms, label) {
         });
     });
 }
-//# sourceMappingURL=timeout.js.map

package/dist/tool-safety.d.ts

@@ -7,4 +7,3 @@ import type { ToolDef } from "./types.js";
  * approval-visible call path.
  */
 export declare function isExplicitlyReadOnly(definition: ToolDef): boolean;
-//# sourceMappingURL=tool-safety.d.ts.map

package/dist/tool-safety.js

@@ -9,4 +9,3 @@ export function isExplicitlyReadOnly(definition) {
     return (definition.annotations?.readOnlyHint === true &&
         definition.annotations?.destructiveHint !== true);
 }
-//# sourceMappingURL=tool-safety.js.map

package/dist/types.d.ts

@@ -159,11 +159,40 @@ export interface ConnectorContext {
     timeoutMs?: number;
 }
 type ConnectorStatusState = "ok" | "auth_required" | "error";
+/**
+ * How far a downstream catalog has moved away from the manifest a release
+ * reviewed. Four numbers and nothing else: names, schemas, and prose stay out
+ * of every surface this rides on, so a drift report can never become a payload
+ * ([#343](https://github.com/zackbart/connecta/issues/343)).
+ */
+export interface CatalogDriftCounts {
+    /** Live tools no release classified. Each one fails closed at call time. */
+    unclassifiedTools: number;
+    /** Classified names this catalog no longer serves — plan gating included. */
+    unservedTools: number;
+    /** Explicit downstream annotations that contradict a vetted verdict. */
+    annotationConflicts: number;
+    /** Tools whose reviewed schema digest no longer matches what arrived. */
+    schemaChanges: number;
+}
+/** One drift observation, taken while serving a catalog refresh. */
+export interface CatalogDriftReport extends CatalogDriftCounts {
+    /** When the observation was taken; never when a probe was scheduled. */
+    observedAt: string;
+}
 export interface ConnectorStatus {
     state: ConnectorStatusState;
     /** When state === "auth_required", the URL the operator should open. */
     authorizationUrl?: string;
     message?: string;
+    /**
+     * Drift observed the last time this connector served a catalog refresh *in
+     * this runtime*. Absent until one has happened — status reports what a
+     * refresh saw, and never asks a downstream a question of its own. The
+     * observation is not persisted the way the catalog is, so absence means this
+     * isolate or process has seen nothing, not that nothing drifted.
+     */
+    catalogDrift?: CatalogDriftReport;
 }
 /** The whole plugin contract — the one open seam. */
 export interface Connector {
@@ -212,6 +241,15 @@ export interface Connector {
      * fetched lazily over the network and are not known at construction time.
      */
     staticTools?: ToolDef[];
+    /**
+     * Optional: the drift this connector saw the last time it listed tools,
+     * or undefined when it has not listed any yet. Implemented by maintained
+     * hosted-MCP proxies, which compare the live catalog with the manifest a
+     * release reviewed *while* serving a refresh the deployment already asked
+     * for. It is a getter over an observation, never a probe: calling it makes
+     * no request, touches no credential, and returns counts only.
+     */
+    catalogDrift?(): CatalogDriftReport | undefined;
     listTools(ctx: ConnectorContext): Promise<ToolDef[]>;
     callTool(name: string, args: unknown, ctx: ConnectorContext): Promise<unknown>;
     /**
@@ -313,6 +351,13 @@ export interface ExecutorProvider {
  * NEVER back this with an unsandboxed eval — the code is untrusted.
  */
 export interface Executor {
+    /**
+     * What `/health` and `connecta doctor` call this sandbox. Optional, and
+     * sanitized and bounded before it is reported. A class-shaped executor gets
+     * its constructor name for free, but that is runtime metadata a bundler may
+     * rewrite; set this to say the same thing minification-proof.
+     */
+    readonly name?: string;
     execute(code: string, providers: ExecutorProvider[]): Promise<ExecuteResult>;
     /** Release runtime resources. Node's built-in pool implements this. */
     close?(): void | Promise<void>;
@@ -465,4 +510,3 @@ export interface InboundAuth {
     authorize(request: Request, baseUrl: string): AuthResult | Promise<AuthResult>;
 }
 export {};
-//# sourceMappingURL=types.d.ts.map

package/dist/types.js

@@ -1,3 +1,2 @@
 // Core contracts for connecta. Web-API only — no node: imports here.
 export {};
-//# sourceMappingURL=types.js.map

package/dist/ui.d.ts

@@ -115,4 +115,3 @@ export declare function buildUiData(registry: Registry, baseUrl: string, serverI
  * and activity data arrives only through the authenticated `/ui/*` APIs.
  */
 export declare function renderUiHtml(uiAuth?: UiAuthConfig, mcpUrl?: string, branding?: ConnectaBranding, nonce?: string, page?: OperatorPage): string;
-//# sourceMappingURL=ui.d.ts.map