@zackbart/connecta 0.28.0 → 0.29.0

package/dist/providers/drive/skill.generated.js

@@ -0,0 +1,9 @@
+// Generated by scripts/generate-providers.mjs; do not edit.
+export const skill = {
+    "content": "# Google Drive usage\n\nActs as the signed-in person's own Google Drive through Workspace delegation: what they can open, and nothing they cannot.\n\nConnection purpose: \n\n## Whose Drive\n\nEvery call acts as the Workspace address deployment config maps the caller\nto, and reaches exactly the files that person can open, shared drives\nincluded. No argument names an account. A call with none mapped fails\n`auth_required`; only an operator can change the mapping. A missing file\nand one this person cannot see fail alike — Google does not distinguish them.\n\n## Finding files\n\n- `search_files` takes Drive query syntax: `name contains 'x'`,\n  `fullText contains 'x'`, `mimeType = '…'`, `'<folderId>' in parents`,\n  `modifiedTime > '2026-01-01T00:00:00'`. Quote values with single quotes.\n  Trashed files are left out unless `includeTrashed`. `incompleteSearch:\n  true` means Drive gave up before searching everything; narrow the query or\n  the corpus. Shared drives: `list_shared_drives`, then `corpora: \"drive\"`\n  with its `driveId`.\n- Page with `page.nextCursor` and the same arguments; a cursor from another\n  tool or other arguments is refused. A page can stop short of `limit` to\n  stay under `maxBytes`; the cursor resumes at the first row left out, and\n  fails `conflict` if that page changed meanwhile — start over then.\n- Ids come from these reads or a Drive URL (`/d/<id>/`, `/folders/<id>`);\n  never guess one.\n\n## Reading content\n\n- `get_file_content` exports Docs as Markdown, Sheets as CSV of the\n  **first sheet only**, and Slides as plain text; reads text files as text;\n  and returns other files as base64 when the encoded file fits the result. Anything else — a\n  larger binary, a drawing, a form, a folder, a shortcut — comes back as\n  `format: \"unavailable\"` with a `note`, never as an empty success.\n- Text is capped by `maxChars`; a cut ends with a truncation marker and\n  `contentTruncated: true`. Drive exports at most 10 MB.\n- Every read stays under `maxBytes` of JSON. The default is what one result\n  can carry into `execute_code`, so a program always receives it. A larger\n  `maxBytes` (up to 4 MiB — a binary of up to 1 MiB) reaches only a direct\n  `call_tool`, which pages it with `connecta.result`.\n\n## Writing\n\n- `create_folder` and `restore_file` add without losing or exposing\n  anything.\n- A new file takes its folder's sharing, not its source's: `create_file`\n  and `copy_file` into a shared folder disclose that content to everyone\n  the folder is shared with, so both are approved like any destructive write.\n  Check the destination with `list_permissions` first. `convertTo`\n  imports content as a Google Doc, Sheet, or Slides file.\n- `update_file_content` replaces the whole content; send all of it.\n  `update_file` renames; `move_file` changes the folder and with it who\n  inherits access.\n- `trash_file` is recoverable for 30 days with `restore_file`. There is no\n  permanent delete and no ownership transfer.\n- `share_file` emails no one unless `sendNotificationEmail: true`. Check\n  `list_permissions` before and after changing access, and confirm with the\n  person before sharing with `anyone` or a whole domain.\n",
+    "instructionsHeading": "Connection instructions",
+    "fragments": {
+        "guide_0": "# Google Drive usage\n\nActs as the signed-in person's own Google Drive through Workspace delegation: what they can open, and nothing they cannot.\n\nConnection purpose: ",
+        "guide_1": "\n\n## Whose Drive\n\nEvery call acts as the Workspace address deployment config maps the caller\nto, and reaches exactly the files that person can open, shared drives\nincluded. No argument names an account. A call with none mapped fails\n`auth_required`; only an operator can change the mapping. A missing file\nand one this person cannot see fail alike — Google does not distinguish them.\n\n## Finding files\n\n- `search_files` takes Drive query syntax: `name contains 'x'`,\n  `fullText contains 'x'`, `mimeType = '…'`, `'<folderId>' in parents`,\n  `modifiedTime > '2026-01-01T00:00:00'`. Quote values with single quotes.\n  Trashed files are left out unless `includeTrashed`. `incompleteSearch:\n  true` means Drive gave up before searching everything; narrow the query or\n  the corpus. Shared drives: `list_shared_drives`, then `corpora: \"drive\"`\n  with its `driveId`.\n- Page with `page.nextCursor` and the same arguments; a cursor from another\n  tool or other arguments is refused. A page can stop short of `limit` to\n  stay under `maxBytes`; the cursor resumes at the first row left out, and\n  fails `conflict` if that page changed meanwhile — start over then.\n- Ids come from these reads or a Drive URL (`/d/<id>/`, `/folders/<id>`);\n  never guess one.\n\n## Reading content\n\n- `get_file_content` exports Docs as Markdown, Sheets as CSV of the\n  **first sheet only**, and Slides as plain text; reads text files as text;\n  and returns other files as base64 when the encoded file fits the result. Anything else — a\n  larger binary, a drawing, a form, a folder, a shortcut — comes back as\n  `format: \"unavailable\"` with a `note`, never as an empty success.\n- Text is capped by `maxChars`; a cut ends with a truncation marker and\n  `contentTruncated: true`. Drive exports at most 10 MB.\n- Every read stays under `maxBytes` of JSON. The default is what one result\n  can carry into `execute_code`, so a program always receives it. A larger\n  `maxBytes` (up to 4 MiB — a binary of up to 1 MiB) reaches only a direct\n  `call_tool`, which pages it with `connecta.result`.\n\n## Writing\n\n- `create_folder` and `restore_file` add without losing or exposing\n  anything.\n- A new file takes its folder's sharing, not its source's: `create_file`\n  and `copy_file` into a shared folder disclose that content to everyone\n  the folder is shared with, so both are approved like any destructive write.\n  Check the destination with `list_permissions` first. `convertTo`\n  imports content as a Google Doc, Sheet, or Slides file.\n- `update_file_content` replaces the whole content; send all of it.\n  `update_file` renames; `move_file` changes the folder and with it who\n  inherits access.\n- `trash_file` is recoverable for 30 days with `restore_file`. There is no\n  permanent delete and no ownership transfer.\n- `share_file` emails no one unless `sendNotificationEmail: true`. Check\n  `list_permissions` before and after changing access, and confirm with the\n  person before sharing with `anyone` or a whole domain.\n"
+    }
+};

package/dist/providers/forms/index.d.ts

@@ -0,0 +1,54 @@
+import { type GoogleWorkspaceOptions } from "../_shared/google/workspace.js";
+export type { GoogleServiceAccount, GoogleSubjectContext, GoogleWorkspaceOptions, GoogleWorkspaceSubject, } from "../_shared/google/workspace.js";
+/**
+ * The Forms API root. Every path the tools send sits beneath `/forms`; there
+ * is no user segment, because a form is a Drive file the token's subject can
+ * or cannot open.
+ */
+export declare const FORMS_API_BASE_URL = "https://forms.googleapis.com/v1";
+/**
+ * Exactly the scopes this connection requests, and exactly what the Admin
+ * console's domain-wide delegation entry must list (comma-separated there).
+ * `forms.body` reads and edits forms; responses are read-only.
+ */
+export declare const FORMS_SCOPES: readonly ["https://www.googleapis.com/auth/forms.body", "https://www.googleapis.com/auth/forms.responses.readonly"];
+/** Options for {@link forms}: the shared Workspace delegation options. */
+export type FormsOptions = GoogleWorkspaceOptions;
+/**
+ * A maintained Google Forms connection acting as each signed-in Workspace
+ * user through a delegated service account.
+ *
+ * Setup, once per Workspace (shared with every Workspace provider):
+ *
+ * 1. In a Google Cloud project, enable the **Google Forms API**.
+ * 2. Create a service account. Grant it no IAM roles: delegation, not project
+ *    permission, is what reaches users' forms.
+ * 3. Create a JSON key for it. If key creation is refused, the organization
+ *    policy `iam.disableServiceAccountKeyCreation` is enforced; an org policy
+ *    administrator can override it for this project alone.
+ * 4. Copy the service account's numeric **client ID** (the key's `client_id`).
+ * 5. As a Workspace super admin: Admin console → Security → Access and data
+ *    control → API controls → Manage Domain Wide Delegation → Add new (or edit
+ *    the entry another Workspace provider already made for this client ID, and
+ *    append to its scopes). Paste the client ID and exactly these scopes,
+ *    comma-separated ({@link FORMS_SCOPES}):
+ *    `https://www.googleapis.com/auth/forms.body,https://www.googleapis.com/auth/forms.responses.readonly`.
+ *    A new grant can take up to 24 hours to apply.
+ * 6. Configure inbound auth: a `subject` function is never asked about an
+ *    open deployment's anonymous requests, which fail `auth_required`.
+ *    Then give the deployment the key as a secret and map callers to accounts:
+ *
+ * ```ts
+ * forms("forms", {
+ *   purpose: "Event registration forms and their responses",
+ *   serviceAccount: env.GOOGLE_SERVICE_ACCOUNT_JSON,
+ *   subject: (identity) => accounts[identity.principal?.id ?? ""],
+ * });
+ * ```
+ *
+ * Listing forms needs Drive, which this connection does not request; pair it
+ * with a Drive connection for that. `create_form` is an additive write the
+ * host approves through call_destructive_tool or a trusted program;
+ * `update_form_info` and `batch_update_form` are destructive.
+ */
+export declare const forms: import("../../provider.js").ProviderFactory<GoogleWorkspaceOptions>;