@zackbart/connecta 0.4.1 → 0.5.0

package/src/skills.ts

@@ -1,3 +1,5 @@
+import type { Connector } from "./types.js";
+
 export const CONNECTA_INSTRUCTIONS =
   'Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas="compact"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2–10 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results. For the detailed workflow, call skills({ name: "usage" }) once per task.';
 
@@ -53,11 +55,192 @@ async () => {
 \`\`\`
 `;
 
+/**
+ * Appended to USAGE_SKILL only when the deployment actually has at least one
+ * connector guide. A deployment with none — every deployment that has not
+ * adopted the feature — keeps the base guide byte-for-byte, rather than paying
+ * context for an instruction to fetch guides that do not exist.
+ */
+export const CONNECTOR_GUIDES_SECTION = `
+## Per-connector guides
+
+Some connectors here ship their own usage guide — preferred tools, address quirks, pagination conventions, rate-limit etiquette, query patterns. \`skills({})\` lists each one as \`connector:<connectorId>\`; fetch it with \`skills({ name: "connector:<connectorId>" })\`. \`search_tools\` and \`describe_tools\` set \`guide\` on matches whose connector has one. Read a connector's guide before working with it for the first time in a task.
+`;
+
+/** True when at least one of `connectors` carries a usage guide. */
+export function hasConnectorGuides(connectors: readonly Connector[]): boolean {
+  return connectors.some(
+    (connector) => connectorGuide(connector) !== undefined,
+  );
+}
+
+/** The built-in usage guide, plus the guides section when there is one to point at. */
+export function usageSkill(connectors: readonly Connector[]): string {
+  return hasConnectorGuides(connectors)
+    ? USAGE_SKILL + CONNECTOR_GUIDES_SECTION
+    : USAGE_SKILL;
+}
+
 export const AVAILABLE_SKILLS = [
   {
     name: "usage",
     description:
       "How to choose among Connecta discovery, direct, batch, destructive, and code-mode tools.",
-    content: USAGE_SKILL,
+    content: usageSkill,
   },
 ] as const;
+
+/**
+ * Namespace for operator-authored per-connector guides. Built-in skill names
+ * are bare identifiers and never contain ":", so `connector:<id>` cannot
+ * collide with one — not even when a connector's id is literally "usage".
+ * The prefixed form is the ONLY way to reach a connector guide: a bare
+ * connector id is never resolved, so nothing shadows anything silently.
+ */
+export const CONNECTOR_SKILL_PREFIX = "connector:";
+
+/** The skill name that fetches `connector`'s guide. */
+export function connectorSkillName(connectorId: string): string {
+  return `${CONNECTOR_SKILL_PREFIX}${connectorId}`;
+}
+
+/** The connector's guide, or undefined when it declares none (or a blank one). */
+export function connectorGuide(connector: Connector): string | undefined {
+  const guide = connector.usageGuide;
+  return guide && guide.trim() !== "" ? guide : undefined;
+}
+
+const SUMMARY_LENGTH = 120;
+
+/** A `---`/`***`/`___` rule, which also opens and closes YAML frontmatter. */
+const RULE_RE = /^\s*(?:-{3,}|\*{3,}|_{3,})\s*$/;
+
+/** A fenced code block's delimiter. */
+const FENCE_RE = /^\s*(?:```|~~~)/;
+
+/**
+ * Markup that carries no summary text of its own: horizontal rules, HTML
+ * comments, and table rows. Skipped so a guide that opens with one is
+ * summarized by its first real line instead of by punctuation.
+ */
+const NOT_SUMMARY_RE = /^\s*(?:<!--|\|)|^\s*(?:-{3,}|\*{3,}|_{3,})\s*$/;
+
+/** Drop a leading YAML frontmatter block — metadata, not summary text. */
+function withoutFrontmatter(lines: string[]): string[] {
+  let start = 0;
+  while (start < lines.length && lines[start].trim() === "") start++;
+  if (start >= lines.length || !RULE_RE.test(lines[start])) return lines;
+  const close = lines.findIndex((line, i) => i > start && RULE_RE.test(line));
+  return close === -1 ? lines : lines.slice(close + 1);
+}
+
+/**
+ * One line describing a guide, for the cheap list view: the guide's first
+ * meaningful line (heading marks and list bullets stripped), falling back to
+ * the connector's own description when the guide opens with nothing but
+ * markup.
+ */
+function summarizeGuide(connector: Connector, guide: string): string {
+  let inFence = false;
+  for (const raw of withoutFrontmatter(guide.split("\n"))) {
+    if (FENCE_RE.test(raw)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence) continue;
+    if (raw.trim() === "" || NOT_SUMMARY_RE.test(raw)) continue;
+    const line = raw
+      // `\s*` (not `\s+`) so a bare `#` strips to nothing and is skipped, and
+      // an unspaced `#Heading` is still read as a heading.
+      .replace(/^\s*#{1,6}\s*/, "")
+      .replace(/^\s*[-*+]\s+/, "")
+      .replace(/\s+/g, " ")
+      .trim();
+    if (line === "") continue;
+    return line.length <= SUMMARY_LENGTH
+      ? line
+      : `${line.slice(0, SUMMARY_LENGTH - 1).trimEnd()}…`;
+  }
+  return connector.description ?? `Usage guide for "${connector.id}".`;
+}
+
+export interface SkillListing {
+  name: string;
+  description: string;
+}
+
+/**
+ * Every fetchable skill: the built-in guides plus one entry per connector that
+ * carries a usage guide. Derived from the connector list passed in — the single
+ * place guide visibility is decided. The `skills` meta-tool passes its
+ * connection's `registry.listConnectors()`, so a toolkit-scoped session lists
+ * only in-scope guides, and `resolveSkill` below reports an out-of-scope
+ * `connector:<id>` exactly as it reports an unknown connector.
+ */
+export function listSkills(connectors: readonly Connector[]): SkillListing[] {
+  const listing: SkillListing[] = AVAILABLE_SKILLS.map((skill) => ({
+    name: skill.name,
+    description: skill.description,
+  }));
+  for (const connector of connectors) {
+    const guide = connectorGuide(connector);
+    if (!guide) continue;
+    listing.push({
+      name: connectorSkillName(connector.id),
+      description: summarizeGuide(connector, guide),
+    });
+  }
+  return listing;
+}
+
+export type SkillLookup =
+  { found: true; content: string } | { found: false; message: string };
+
+/**
+ * Resolve one skill name. Built-in names match exactly; connector guides are
+ * reachable only through the `connector:` prefix. Every miss — unknown name,
+ * unknown connector, connector without a guide — is an explicit error, never a
+ * silent fallback to the generic guide.
+ */
+export function resolveSkill(
+  name: string,
+  connectors: readonly Connector[],
+): SkillLookup {
+  const builtIn = AVAILABLE_SKILLS.find((skill) => skill.name === name);
+  if (builtIn) return { found: true, content: builtIn.content(connectors) };
+  const available = () =>
+    listSkills(connectors)
+      .map((skill) => skill.name)
+      .join(", ");
+  if (name.startsWith(CONNECTOR_SKILL_PREFIX)) {
+    const id = name.slice(CONNECTOR_SKILL_PREFIX.length);
+    const connector = connectors.find((c) => c.id === id);
+    if (!connector) {
+      return {
+        found: false,
+        message: `Unknown connector "${id}". Available skills: ${available()}.`,
+      };
+    }
+    const guide = connectorGuide(connector);
+    if (!guide) {
+      return {
+        found: false,
+        message: `Connector "${id}" has no usage guide. Available skills: ${available()}.`,
+      };
+    }
+    return { found: true, content: guide };
+  }
+  const bare = connectors.find((c) => c.id === name);
+  if (bare) {
+    return {
+      found: false,
+      message: connectorGuide(bare)
+        ? `Unknown skill "${name}". Connector guides are fetched as "${connectorSkillName(name)}". Available: ${available()}.`
+        : `Connector "${name}" has no usage guide. Available skills: ${available()}.`,
+    };
+  }
+  return {
+    found: false,
+    message: `Unknown skill "${name}". Available: ${available()}.`,
+  };
+}

package/src/toolkits.ts

@@ -0,0 +1,215 @@
+// Toolkits: named, operator-defined scoped views over one deployment's
+// registry, selected per client connection with `?toolkit=<name>` on /mcp.
+//
+// A connecta deployment belongs to an ORG; a toolkit is the view a GROUP OF
+// TEAM MEMBERS inside that org gets — a "support" toolkit seeing Zendesk and
+// Notion, an "exec" toolkit that also sees Gmail. This module only *defines and
+// validates* scopes. Enforcement lives in one place: `ScopedRegistry`
+// (src/registry.ts), which every meta-tool inherits through `RegistryView`.
+
+import type { Connector } from "./types.js";
+
+/** Toolkit names share the connector-id grammar: URL-safe, no separators. */
+export const TOOLKIT_NAME_RE = /^[a-z0-9_-]+$/;
+
+/** One named scope, declared in `ConnectaConfig.toolkits` (config as code). */
+export interface ToolkitDefinition {
+  /** Connector ids this toolkit may see. Required, and at least one. */
+  connectors: string[];
+  /**
+   * Optional finer grain: full tool addresses (`"<connectorId>.<toolName>"`).
+   * Naming ANY address of a connector narrows that connector to exactly the
+   * addresses named; connectors with no entry here keep their whole tool list.
+   */
+  includeTools?: string[];
+  /** Optional tool addresses to hide, applied after `includeTools`. */
+  excludeTools?: string[];
+  /** Operator note. Never sent to clients — this is documentation for config. */
+  description?: string;
+}
+
+/** `ConnectaConfig.toolkits` — toolkit name → definition. */
+export type ToolkitConfig = Record<string, ToolkitDefinition>;
+
+/** A validated toolkit: the visibility predicate the scoped registry consults. */
+export interface Toolkit {
+  readonly name: string;
+  readonly description?: string;
+  /** True when `connectorId` is inside this toolkit's scope. */
+  hasConnector(connectorId: string): boolean;
+  /** True when `<connectorId>.<toolName>` is inside this toolkit's scope. */
+  hasTool(connectorId: string, toolName: string): boolean;
+}
+
+/**
+ * Split `"<connectorId>.<toolName>"` on the FIRST dot — connector ids contain
+ * no dots, so a downstream tool name may. Returns null for a malformed address.
+ */
+export function splitAddress(
+  address: string,
+): { connectorId: string; toolName: string } | null {
+  const dot = address.indexOf(".");
+  if (dot <= 0 || dot === address.length - 1) return null;
+  return {
+    connectorId: address.slice(0, dot),
+    toolName: address.slice(dot + 1),
+  };
+}
+
+/** Group tool addresses by connector id, validating each against the toolkit. */
+function toolFilter(
+  name: string,
+  addresses: string[] | undefined,
+  connectorIds: ReadonlySet<string>,
+  staticTools: ReadonlyMap<string, ReadonlySet<string>>,
+  field: "includeTools" | "excludeTools",
+): Map<string, Set<string>> {
+  const byConnector = new Map<string, Set<string>>();
+  if (addresses !== undefined && !Array.isArray(addresses)) {
+    // A bare string would otherwise iterate character by character and produce
+    // a stream of confusing address errors; anything else would throw "not
+    // iterable" from deep inside the loop. Name the field instead.
+    throw new Error(
+      `Toolkit "${name}" ${field} must be an array of "<connectorId>.<toolName>" addresses.`,
+    );
+  }
+  if (
+    addresses !== undefined &&
+    addresses.length === 0 &&
+    field === "includeTools"
+  ) {
+    // An empty allowlist reads as "only these tools" but would behave as "all
+    // of them" — the one shape here that fails OPEN. (An empty excludeTools is
+    // an honest no-op and is allowed.)
+    throw new Error(
+      `Toolkit "${name}" has an empty includeTools: remove it to expose every tool, or list the addresses this toolkit may use.`,
+    );
+  }
+  for (const address of addresses ?? []) {
+    const parts = splitAddress(address);
+    if (!parts) {
+      throw new Error(
+        `Toolkit "${name}" ${field} entry "${address}" is not a tool address: expected "<connectorId>.<toolName>".`,
+      );
+    }
+    if (!connectorIds.has(parts.connectorId)) {
+      // A typo here would silently do nothing, quietly widening the scope the
+      // operator believes they wrote. Fail at construction instead.
+      throw new Error(
+        `Toolkit "${name}" ${field} entry "${address}" names connector "${parts.connectorId}", which is not in this toolkit's connectors list.`,
+      );
+    }
+    // Static-only, exactly like the registry's convention checks: an in-code
+    // connector's tool list is known now, so a misspelled name — an exclude
+    // that silently excludes nothing — is caught. Remote catalogs are fetched
+    // lazily over the network and cannot be checked at construction.
+    const known = staticTools.get(parts.connectorId);
+    if (known && !known.has(parts.toolName)) {
+      throw new Error(
+        `Toolkit "${name}" ${field} entry "${address}" names no tool on connector "${parts.connectorId}".`,
+      );
+    }
+    const tools = byConnector.get(parts.connectorId) ?? new Set<string>();
+    tools.add(parts.toolName);
+    byConnector.set(parts.connectorId, tools);
+  }
+  return byConnector;
+}
+
+/**
+ * Validate one toolkit definition against the deployment's connectors.
+ *
+ * Structural mistakes THROW at construction rather than warn: a typo'd id in
+ * an allowlist is a scope the operator did not write, and a scope nobody wrote
+ * is not one an operator can reason about. (A toolkit scopes visibility, not
+ * identity — it is not itself an access check; see the module header and
+ * documentation.md §16.) Tool names are checked only for connectors that expose
+ * `staticTools` (i.e. `api()`); a remote connector's catalog is fetched lazily
+ * over the network and is unknown at construction time.
+ */
+function resolveToolkit(
+  name: string,
+  definition: ToolkitDefinition,
+  known: ReadonlySet<string>,
+  staticTools: ReadonlyMap<string, ReadonlySet<string>>,
+): Toolkit {
+  if (!TOOLKIT_NAME_RE.test(name)) {
+    throw new Error(
+      `Invalid toolkit name "${name}": must match ${TOOLKIT_NAME_RE.source}`,
+    );
+  }
+  if (
+    !Array.isArray(definition.connectors) ||
+    definition.connectors.length === 0
+  ) {
+    throw new Error(
+      `Toolkit "${name}" selects no connectors: list at least one connector id in "connectors".`,
+    );
+  }
+  const connectorIds = new Set<string>();
+  for (const id of definition.connectors) {
+    if (!known.has(id)) {
+      throw new Error(
+        `Toolkit "${name}" references unknown connector "${id}".`,
+      );
+    }
+    connectorIds.add(id);
+  }
+  const includes = toolFilter(
+    name,
+    definition.includeTools,
+    connectorIds,
+    staticTools,
+    "includeTools",
+  );
+  const excludes = toolFilter(
+    name,
+    definition.excludeTools,
+    connectorIds,
+    staticTools,
+    "excludeTools",
+  );
+  return {
+    name,
+    ...(definition.description ? { description: definition.description } : {}),
+    hasConnector: (connectorId) => connectorIds.has(connectorId),
+    hasTool: (connectorId, toolName) => {
+      if (!connectorIds.has(connectorId)) return false;
+      const include = includes.get(connectorId);
+      if (include && !include.has(toolName)) return false;
+      return !excludes.get(connectorId)?.has(toolName);
+    },
+  };
+}
+
+/**
+ * Validate every declared toolkit against the connector set. Returns undefined
+ * when no toolkits are configured, so an existing deployment keeps exactly its
+ * current (unscoped) behavior.
+ */
+export function resolveToolkits(
+  toolkits: ToolkitConfig | undefined,
+  connectors: readonly Connector[],
+): ReadonlyMap<string, Toolkit> | undefined {
+  if (!toolkits) return undefined;
+  // Object.entries (not a keyed lookup) so no config key — `__proto__` and
+  // friends included — can ever resolve through the prototype chain. Names are
+  // then held in a Map, which has no prototype to pollute.
+  const entries = Object.entries(toolkits);
+  if (entries.length === 0) return undefined;
+  const known = new Set(connectors.map((connector) => connector.id));
+  const staticTools = new Map<string, ReadonlySet<string>>();
+  for (const connector of connectors) {
+    if (connector.staticTools) {
+      staticTools.set(
+        connector.id,
+        new Set(connector.staticTools.map((tool) => tool.name)),
+      );
+    }
+  }
+  const resolved = new Map<string, Toolkit>();
+  for (const [name, definition] of entries) {
+    resolved.set(name, resolveToolkit(name, definition, known, staticTools));
+  }
+  return resolved;
+}

package/src/types.ts

@@ -135,6 +135,23 @@ export interface Connector {
   /** How call_tool wraps results. "mcp" passes the content array through; anything else is JSON-wrapped. */
   kind?: "mcp" | "api";
   description?: string;
+  /**
+   * Max inline result size (bytes) for this connector's tools before
+   * call_tool/batch_call truncate and stash the full text for get_result
+   * paging. Overrides the deployment-wide `ConnectaConfig.maxResultBytes`;
+   * omit to inherit it (which itself defaults to 50_000). Must be a whole
+   * number of bytes >= 1; anything else warns at startup and is ignored, so
+   * the connector inherits the deployment-wide cap.
+   */
+  maxResultBytes?: number;
+  /**
+   * Optional agent-facing usage guide (markdown) for this connector — preferred
+   * tools, address quirks, pagination conventions, rate-limit etiquette, good
+   * query patterns. Listed by the `skills` meta-tool as `connector:<id>` and
+   * returned verbatim by `skills({ name: "connector:<id>" })`. Keep it concise
+   * and imperative; it is read by agents, not operators.
+   */
+  usageGuide?: string;
   /** Optional operator-managed credential slot rendered inside this connector's /ui card. */
   credential?: ConnectorCredentialConfig;
   /** Optional server-side check used by /ui's Test action. */
@@ -262,7 +279,9 @@ export interface ConnectaBranding {
    * `/favicon.svg`, `ico` at `/favicon.ico`; omit either to keep the default
    * for that format. Use `href` instead to point the page at an icon you host
    * elsewhere (it replaces the `/favicon.svg` link in the page head; the
-   * `/favicon.*` routes still serve whatever `svg`/`ico` provide).
+   * `/favicon.*` routes still serve whatever `svg`/`ico` provide). `href` must
+   * be an absolute `http(s)` URL or a root-relative path; anything else falls
+   * back to the default mark.
    */
   favicon?: {
     svg?: string;

package/src/ui.ts

@@ -24,32 +24,74 @@ interface ResolvedBranding {
   themeColor: string;
 }
 
+export const DEFAULT_FAVICON_HREF = "/favicon.svg";
+
+/**
+ * Branding arrives from operator config, which is untyped at a JS call site, so
+ * every field is treated as `unknown`: a non-string is read as unset rather than
+ * throwing on `.trim()`. Rendering must degrade to defaults for a malformed
+ * value, never fail — `createConnecta` calls this during construction.
+ */
+function trimmedString(value: unknown): string | undefined {
+  return typeof value === "string" ? value.trim() || undefined : undefined;
+}
+
 export function resolveBranding(
   branding?: ConnectaBranding,
 ): ResolvedBranding {
-  const productName = branding?.productName?.trim() || "Connecta";
-  const ownerName = branding?.ownerName?.trim();
+  const productName = trimmedString(branding?.productName) ?? "Connecta";
+  const ownerName = trimmedString(branding?.ownerName);
   // Operator branding URLs become masthead/callback hrefs, so a non-http(s)
   // scheme (javascript:, data:) is dropped the same as an unset URL — the
   // callers already render a <span> instead of an <a> when it is absent.
-  const productUrl = branding?.productUrl?.trim();
-  const ownerUrl = branding?.ownerUrl?.trim();
+  const productUrl = trimmedString(branding?.productUrl);
+  const ownerUrl = trimmedString(branding?.ownerUrl);
+  const faviconHref = trimmedString(branding?.favicon?.href);
   return {
     productName,
     ...(productUrl && isSafeHttpUrl(productUrl) ? { productUrl } : {}),
     ...(ownerName ? { ownerName } : {}),
     ...(ownerUrl && isSafeHttpUrl(ownerUrl) ? { ownerUrl } : {}),
     description:
-      branding?.description?.trim() ||
+      trimmedString(branding?.description) ??
       `Manage the services this ${productName} instance makes available to agents.`,
     pageTitle:
-      branding?.pageTitle?.trim() ||
+      trimmedString(branding?.pageTitle) ??
       (ownerName ? `${productName} — ${ownerName}` : productName),
-    faviconHref: branding?.favicon?.href?.trim() || "/favicon.svg",
-    themeColor: branding?.themeColor?.trim() || "#ffffff",
+    faviconHref:
+      faviconHref && isSafeIconHref(faviconHref)
+        ? faviconHref
+        : DEFAULT_FAVICON_HREF,
+    themeColor: trimmedString(branding?.themeColor) ?? "#ffffff",
   };
 }
 
+/**
+ * Names of the branding URLs the operator set that failed their gate and were
+ * replaced by a default. Lives beside the gates so the startup warning cannot
+ * drift from them, and takes `unknown` fields for the same reason
+ * `resolveBranding` does — a warning helper must never throw.
+ */
+export function droppedBrandingUrls(branding?: ConnectaBranding): string[] {
+  if (!branding) return [];
+  const resolved = resolveBranding(branding);
+  // A non-string still counts as "set": the operator meant to supply a URL, and
+  // that intent is exactly what the warning reports on. A blank string does not.
+  const isSet = (value: unknown) =>
+    typeof value === "string"
+      ? trimmedString(value) !== undefined
+      : value !== undefined && value !== null;
+  const faviconHref = branding.favicon?.href;
+  return [
+    ...(isSet(branding.productUrl) && !resolved.productUrl ? ["productUrl"] : []),
+    ...(isSet(branding.ownerUrl) && !resolved.ownerUrl ? ["ownerUrl"] : []),
+    ...(isSet(faviconHref) &&
+    trimmedString(faviconHref) !== resolved.faviconHref
+      ? ["favicon.href"]
+      : []),
+  ];
+}
+
 /**
  * A JS string literal safe to inline in a <script> block. JSON.stringify alone
  * leaves `/` untouched, so a value containing "</script>" would close the
@@ -74,6 +116,48 @@ export function isSafeHttpUrl(url: unknown): boolean {
   }
 }
 
+/**
+ * Only the second check's base; any origin works because the check is whether
+ * the href stays on whatever origin it is resolved against. It is deliberately
+ * never the sole gate: a value whose own authority equals this host (say
+ * `//connecta.invalid/x`) would resolve to this exact origin and pass, so the
+ * structural check below runs first and is what actually rejects `//host`.
+ */
+const SAME_ORIGIN_PROBE = "https://connecta.invalid";
+
+/** Removed anywhere in a URL by the parser, so a gate must ignore them too. */
+const URL_STRIPPED_CHARS = /[\t\n\r]/g;
+
+/**
+ * True for values allowed in the page's `<link rel="icon" href>`: an absolute
+ * `http(s)` URL (an icon the operator hosts elsewhere) or a path rooted at this
+ * origin. The relative carve-out is deliberate rather than accidental — the
+ * default href is the relative `/favicon.svg`, which `isSafeHttpUrl` alone would
+ * reject — and it is kept narrow on both ends.
+ *
+ * Root-relative only, because `/ui` and `/oauth/callback/<id>` sit at different
+ * depths and a document-relative path would resolve differently on each.
+ *
+ * "Root-relative" is enforced structurally: exactly one leading `/` followed by
+ * a character that is neither `/` nor `\`. Both of those would make the value an
+ * authority (`//host`, and `/\host` because the URL parser folds `\` to `/` in
+ * special schemes), pointing at an origin this server does not control. The test
+ * runs on a copy with tab/newline/CR removed, since the parser strips those
+ * anywhere and `/\t/host` would otherwise slip through as single-slash. The
+ * origin comparison that follows is defense in depth, not the authority check —
+ * on its own it would accept an authority that happened to equal the probe host.
+ */
+export function isSafeIconHref(href: unknown): boolean {
+  if (typeof href !== "string") return false;
+  if (isSafeHttpUrl(href)) return true;
+  if (!/^\/(?![/\\])/.test(href.replace(URL_STRIPPED_CHARS, ""))) return false;
+  try {
+    return new URL(href, SAME_ORIGIN_PROBE).origin === SAME_ORIGIN_PROBE;
+  } catch {
+    return false;
+  }
+}
+
 export interface UiTool {
   name: string;
   address: string;

package/src/version.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.4.1";
+export const CONNECTA_VERSION = "0.5.0";