@zackbart/connecta 0.28.1 → 0.29.0

package/dist/providers/slides/skill.generated.js

@@ -0,0 +1,9 @@
+// Generated by scripts/generate-providers.mjs; do not edit.
+export const skill = {
+    "content": "# Google Slides usage\n\nActs as the signed-in person in Google Slides through Workspace delegation: read, create, and edit the decks they can open.\n\nConnection purpose: \n\n## Whose decks\n\nEvery call acts as the Workspace account deployment config maps the caller\nto, and reaches exactly the decks that person can open. No argument names an\naccount. A call with none mapped fails `auth_required`; only an operator can\nchange the mapping. A deck the person cannot see and one that does not exist\nfail alike — Google does not say which.\n\n## Finding a deck\n\nSlides cannot list or search decks; that is Google Drive's job. Take the id\nfrom a Drive search or from a URL (`/presentation/d/<id>/`).\n\n## Reading\n\n- `get_presentation` returns each slide's text in reading order (top to\n  bottom, then left to right), speaker notes, and alt text for images,\n  videos, and charts. Empty placeholders are listed with their id and type;\n  lines and other empty shapes are counted in `omittedElements`. `index`\n  is 0-based, the numbering `create_slide` takes.\n- Nothing is cut without a way back. Text past `maxCharsPerSlide`, or past\n  what one result can carry (about 192 KB), ends with a marker, and its\n  element's `textCursor` (the slide's `notesCursor` for notes) is a\n  `get_page` cursor that continues from the cut. A slide too crowded to\n  list whole gives `elementsNotShown` and an `elementsCursor`.\n- `get_page` reads any page by objectId — a slide, a layout (its\n  placeholders' types and indexes, for `placeholderIdMappings`), a master,\n  a notes page (`notesPageId`), or the notes master (`notesMasterId`) —\n  listing every element, groups opened,\n  and continuing long text across pages from `page.nextCursor`.\n- `list_layouts` lists masters and their layouts; `get_presentation`\n  previews them, and `layoutsCursor` continues where the preview stops.\n- `raw: true` returns Slides' own JSON: `get_presentation` a page of\n  slides, `get_page` the page and its top-level elements. One too large\n  for a result is named (`rawNotShown`) or sent in `rawJson` chunks;\n  join the chunks' `json` in order and parse.\n- Every cursor is bound to the deck and the revision it was read at. A\n  `conflict` on a cursor means the deck changed: start again without one.\n  A page may hold fewer rows than `limit`; follow `page.nextCursor`.\n- `get_slide_thumbnail` returns a link, never the image. The link opens as\n  this person for about 30 minutes; do not share it.\n\n## Writing\n\n- `create_presentation` and `create_slide` are additive. A new slide is\n  empty: fill it with `batch_update_presentation` (`insertText` into its\n  placeholders, after reading their ids with `get_presentation`).\n- `replace_all_text` changes every literal match, case-sensitive unless\n  `matchCase: false`. Pass `requiredRevisionId` to refuse a deck that\n  changed since you read it.\n- `batch_update_presentation` takes Slides' own Request objects and always\n  requires the `revisionId` from the read the requests were built on. All\n  requests apply or none do, except comment changes (below). Each write\n  returns the new `revisionId` for the next one. A `conflict` means the\n  deck changed since that read: re-read it, rebuild the requests, and send\n  them with the new `revisionId`. Its replies keep every id at every depth\n  whole, in every reply; text is cut first, and a large reply's other fields\n  are named in `cut`. Ids too many for this tool's 192 KiB budget are all\n  returned anyway, without text; past 256 KiB, more than a program can\n  receive, call the tool directly and page with `connecta.result`. A batch\n  whose ids pass even that returns its comment state and `repliesNotShown`;\n  read what it made with `list_comments`, `get_presentation`, or\n  `get_page`, and do not send it again.\n- An id or revision too long to copy into a result is left out and flagged\n  (`revisionIdNotShown`), never cut. A failure that says the write\n  applied means Google answered 2xx: do not repeat it; re-read instead.\n- Nothing here shares, moves, or deletes a deck.\n\n## Comments\n\n- `list_comments` lists the deck's threads, or one page's with\n  `pageObjectId` (a speaker-notes comment is on the notes page). Each has\n  its `commentId`, `status` (OPEN or RESOLVED), where it is anchored\n  (`pageObjectIds`, `objectIds`), the `quote` it was made on, its\n  `headPost`, and `replies`. A post's `author.user` (`users/…`) is\n  the stable id; `displayName` is only a name. Slides gives no `user`\n  for an anonymous or imported post. Text too long for one result continues\n  on the next page: a row with `continued` picks up its thread where the\n  last stopped, and `repliesOffset` counts the replies before it. Its\n  cursor is bound to the threads and their anchors as well as the revision,\n  so a comment added or moved between pages is a `conflict` too. Reading\n  comments needs comment access; a view-only account is refused.\n- The projection leaves out each post's HTML (`contentHtml`), whether it\n  came from a copied deck, and the text and cell ranges an anchor covers.\n  `raw: true` returns each thread as Slides sends it, with\n  `commentAnchors` added (its anchors, each with its `pageObjectId`),\n  in `rawJson` chunks when one is too large.\n- `create_comment` and `create_comment_reply` are additive and return\n  every new id whole. `update_comment_thread` resolves, reopens, or\n  reassigns a thread (one at a time; a reassignment needs `content`),\n  replacing its status or assignee, and is destructive,\n  like `update_comment_post`, `delete_comment`, and\n  `delete_comment_reply`; Slides allows the last three only to the\n  post's author. Comments notify people the way the Slides editor does.\n- Slides saves comment changes apart from the rest of a write. When it does\n  not confirm they saved, the result carries `commentUpdateState` — for\n  example `ALL_FAILED_UNKNOWN_REASON` — and the write's other changes may\n  still have applied. Do not repeat it: re-read with `list_comments`, then\n  decide.\n",
+    "instructionsHeading": "Connection instructions",
+    "fragments": {
+        "guide_0": "# Google Slides usage\n\nActs as the signed-in person in Google Slides through Workspace delegation: read, create, and edit the decks they can open.\n\nConnection purpose: ",
+        "guide_1": "\n\n## Whose decks\n\nEvery call acts as the Workspace account deployment config maps the caller\nto, and reaches exactly the decks that person can open. No argument names an\naccount. A call with none mapped fails `auth_required`; only an operator can\nchange the mapping. A deck the person cannot see and one that does not exist\nfail alike — Google does not say which.\n\n## Finding a deck\n\nSlides cannot list or search decks; that is Google Drive's job. Take the id\nfrom a Drive search or from a URL (`/presentation/d/<id>/`).\n\n## Reading\n\n- `get_presentation` returns each slide's text in reading order (top to\n  bottom, then left to right), speaker notes, and alt text for images,\n  videos, and charts. Empty placeholders are listed with their id and type;\n  lines and other empty shapes are counted in `omittedElements`. `index`\n  is 0-based, the numbering `create_slide` takes.\n- Nothing is cut without a way back. Text past `maxCharsPerSlide`, or past\n  what one result can carry (about 192 KB), ends with a marker, and its\n  element's `textCursor` (the slide's `notesCursor` for notes) is a\n  `get_page` cursor that continues from the cut. A slide too crowded to\n  list whole gives `elementsNotShown` and an `elementsCursor`.\n- `get_page` reads any page by objectId — a slide, a layout (its\n  placeholders' types and indexes, for `placeholderIdMappings`), a master,\n  a notes page (`notesPageId`), or the notes master (`notesMasterId`) —\n  listing every element, groups opened,\n  and continuing long text across pages from `page.nextCursor`.\n- `list_layouts` lists masters and their layouts; `get_presentation`\n  previews them, and `layoutsCursor` continues where the preview stops.\n- `raw: true` returns Slides' own JSON: `get_presentation` a page of\n  slides, `get_page` the page and its top-level elements. One too large\n  for a result is named (`rawNotShown`) or sent in `rawJson` chunks;\n  join the chunks' `json` in order and parse.\n- Every cursor is bound to the deck and the revision it was read at. A\n  `conflict` on a cursor means the deck changed: start again without one.\n  A page may hold fewer rows than `limit`; follow `page.nextCursor`.\n- `get_slide_thumbnail` returns a link, never the image. The link opens as\n  this person for about 30 minutes; do not share it.\n\n## Writing\n\n- `create_presentation` and `create_slide` are additive. A new slide is\n  empty: fill it with `batch_update_presentation` (`insertText` into its\n  placeholders, after reading their ids with `get_presentation`).\n- `replace_all_text` changes every literal match, case-sensitive unless\n  `matchCase: false`. Pass `requiredRevisionId` to refuse a deck that\n  changed since you read it.\n- `batch_update_presentation` takes Slides' own Request objects and always\n  requires the `revisionId` from the read the requests were built on. All\n  requests apply or none do, except comment changes (below). Each write\n  returns the new `revisionId` for the next one. A `conflict` means the\n  deck changed since that read: re-read it, rebuild the requests, and send\n  them with the new `revisionId`. Its replies keep every id at every depth\n  whole, in every reply; text is cut first, and a large reply's other fields\n  are named in `cut`. Ids too many for this tool's 192 KiB budget are all\n  returned anyway, without text; past 256 KiB, more than a program can\n  receive, call the tool directly and page with `connecta.result`. A batch\n  whose ids pass even that returns its comment state and `repliesNotShown`;\n  read what it made with `list_comments`, `get_presentation`, or\n  `get_page`, and do not send it again.\n- An id or revision too long to copy into a result is left out and flagged\n  (`revisionIdNotShown`), never cut. A failure that says the write\n  applied means Google answered 2xx: do not repeat it; re-read instead.\n- Nothing here shares, moves, or deletes a deck.\n\n## Comments\n\n- `list_comments` lists the deck's threads, or one page's with\n  `pageObjectId` (a speaker-notes comment is on the notes page). Each has\n  its `commentId`, `status` (OPEN or RESOLVED), where it is anchored\n  (`pageObjectIds`, `objectIds`), the `quote` it was made on, its\n  `headPost`, and `replies`. A post's `author.user` (`users/…`) is\n  the stable id; `displayName` is only a name. Slides gives no `user`\n  for an anonymous or imported post. Text too long for one result continues\n  on the next page: a row with `continued` picks up its thread where the\n  last stopped, and `repliesOffset` counts the replies before it. Its\n  cursor is bound to the threads and their anchors as well as the revision,\n  so a comment added or moved between pages is a `conflict` too. Reading\n  comments needs comment access; a view-only account is refused.\n- The projection leaves out each post's HTML (`contentHtml`), whether it\n  came from a copied deck, and the text and cell ranges an anchor covers.\n  `raw: true` returns each thread as Slides sends it, with\n  `commentAnchors` added (its anchors, each with its `pageObjectId`),\n  in `rawJson` chunks when one is too large.\n- `create_comment` and `create_comment_reply` are additive and return\n  every new id whole. `update_comment_thread` resolves, reopens, or\n  reassigns a thread (one at a time; a reassignment needs `content`),\n  replacing its status or assignee, and is destructive,\n  like `update_comment_post`, `delete_comment`, and\n  `delete_comment_reply`; Slides allows the last three only to the\n  post's author. Comments notify people the way the Slides editor does.\n- Slides saves comment changes apart from the rest of a write. When it does\n  not confirm they saved, the result carries `commentUpdateState` — for\n  example `ALL_FAILED_UNKNOWN_REASON` — and the write's other changes may\n  still have applied. Do not repeat it: re-read with `list_comments`, then\n  decide.\n"
+    }
+};

package/dist/providers/{stripe.d.ts → stripe/index.d.ts}

@@ -1,5 +1,4 @@
-import { type RemoteMcpAuth } from "../connectors/remote-mcp.js";
-import type { Connector } from "../types.js";
+import { type RemoteMcpAuth } from "../../connectors/remote-mcp.js";
 /** Which Stripe environment a static credential reaches. */
 export type StripeMode = "production" | "sandbox";
 /** Stripe publishes one hosted MCP endpoint for every account and mode. */
@@ -34,21 +33,15 @@ export interface StripeOAuthOptions extends StripeCommonOptions {
  */
 export interface StripeHeaderOptions extends StripeCommonOptions {
     auth: Exclude<RemoteMcpAuth, {
-        type: "oauth";
+        type: "oauth" | "request";
     }>;
     mode: StripeMode;
     /** Act as one Connect account by sending Stripe's `Stripe-Account` header. */
     connectedAccount?: string;
 }
 export type StripeOptions = StripeOAuthOptions | StripeHeaderOptions;
-/**
- * One release-reviewed manifest, used both to classify a live tool and as the
- * baseline the drift check compares against, so the annotation a caller gets and
- * the verdict a check reads can never disagree. Stripe publishes no stability or
- * deprecation policy for this tool set, so treat it as unversioned: an
- * unclassified, unannotated name fails closed onto the approval path (P5).
- */
-export declare const STRIPE_VETTED_CATALOG: import("../catalog-drift.js").VettedCatalog;
 /** A maintained Stripe hosted-MCP connection. */
-export declare function stripe(id: string, options: StripeOptions): Connector;
+export declare const stripe: import("../../provider.js").ProviderFactory<StripeOptions>;
+/** @deprecated Read `stripe.definition.classify` instead. Kept for existing imports. */
+export declare const STRIPE_VETTED_CATALOG: import("../../catalog-drift.js").VettedCatalog;
 export {};

package/dist/providers/stripe/index.js

@@ -0,0 +1,266 @@
+import { skill } from "./skill.generated.js";
+import { remoteMcp, withCredentialDefaults } from "../../connectors/remote-mcp.js";
+import { reviewedCatalog } from "../../catalog-drift.js";
+import { keys, optionsOf, strings, variants } from "../../config-schema.js";
+import { CREDENTIAL } from "../../connectors/option-shapes.js";
+import { defineProvider } from "../../provider.js";
+/** Stripe publishes one hosted MCP endpoint for every account and mode. */
+export const STRIPE_MCP_ENDPOINT = "https://mcp.stripe.com/";
+/**
+ * Stripe documents no MCP-specific limit, so these transcribe the account limit
+ * MCP traffic spends: 100 requests per second live, 25 in a sandbox. OAuth takes
+ * the sandbox rule (`mode ?? "sandbox"` below) because one session can reach
+ * either mode and the policy is fixed before the account-scoped call begins.
+ * The `maxConcurrency` figures are Connecta's own choice — Stripe says
+ * per-account and per-endpoint concurrency limits exist but publishes no number.
+ */
+const STRIPE_ADMISSION = {
+    production: {
+        rules: [
+            {
+                maxConcurrency: 8,
+                queueTimeoutMs: 5_000,
+                retryAfterMs: 1_000,
+                budget: { kind: "rolling-window", maxCalls: 100, windowMs: 1_000 },
+            },
+        ],
+    },
+    sandbox: {
+        rules: [
+            {
+                maxConcurrency: 4,
+                queueTimeoutMs: 5_000,
+                retryAfterMs: 1_000,
+                budget: { kind: "rolling-window", maxCalls: 25, windowMs: 1_000 },
+            },
+        ],
+    },
+};
+/**
+ * Reviewed in #705's provider audit against https://docs.stripe.com/mcp.
+ * Retains the release-reviewed inventory, including names absent from today's
+ * public reference. Live annotations were not reverified without credentials.
+ * No schema digest is asserted without a captured schema to review.
+ */
+const STRIPE_CLASSIFICATION = {
+    tools: {
+        "stripe_api_search": {
+            "verdict": "read",
+            "reason": "Searches API method contracts and object records; it does not invoke mutating methods.",
+        },
+        "stripe_api_details": {
+            "verdict": "read",
+            "reason": "Reads the parameter contract for an API method; it does not execute that method.",
+        },
+        "stripe_api_read": {
+            "verdict": "read",
+            "reason": "The vendor restricts this generic tool to HTTP GET; all mutating methods use stripe_api_write.",
+        },
+        "get_stripe_account_info": { "verdict": "read", "reason": "Reads metadata for the selected Stripe account." },
+        "get_balance_summary": {
+            "verdict": "read",
+            "reason": "Retrieves Stripe balance summary information without changing vendor state.",
+        },
+        "list_metrics": {
+            "verdict": "read",
+            "reason": "Retrieves Stripe metrics information without changing vendor state.",
+        },
+        "explain_metric": {
+            "verdict": "read",
+            "reason": "Explains an existing metric definition without creating an analytics run.",
+        },
+        "metric_drilldown": { "verdict": "read", "reason": "Reads the breakdown of an existing metric." },
+        "show_metric_app": { "verdict": "read", "reason": "Displays an existing metric app without changing its data." },
+        "list_available_accounts_or_orgs": {
+            "verdict": "read",
+            "reason": "Retrieves Stripe available accounts or orgs information without changing vendor state.",
+        },
+        "manage_stripe_accounts": {
+            "verdict": "read",
+            "reason": "Selects account context for the session; the reviewed contract does not mutate payment or account records.",
+        },
+        "search_stripe_documentation": {
+            "verdict": "read",
+            "reason": "Searches Stripe reference documentation without accessing payment mutations.",
+        },
+        "stripe_api_write": {
+            "verdict": "destructive",
+            "reason": "Can dispatch POST, PATCH, PUT, or DELETE across the Stripe API, including edits and cancellations.",
+        },
+        "create_refund": {
+            "verdict": "destructive",
+            "reason": "Moves money and changes an existing payment; a refund cannot be undone.",
+        },
+        "stripe_implementation_planner": {
+            "verdict": "write",
+            "reason": "Creates or continues provider-side planning state.",
+        },
+        "stripe_analytics": {
+            "verdict": "write",
+            "reason": "Mixes retrieval with durable query-run creation, so the whole tool is a write.",
+        },
+        "stripe_report": {
+            "verdict": "write",
+            "reason": "May create durable report-run state, so retrieval paths cannot make the whole tool read-only.",
+        },
+        "send_stripe_mcp_feedback": {
+            "verdict": "write",
+            "reason": "Submits feedback to Stripe, creating provider-side state.",
+        },
+    },
+};
+/** Stripe key prefixes carry their own mode; only a clear reading counts. */
+const LIVE_KEY = /\b(?:sk|rk|pk)_live_/;
+const TEST_KEY = /\b(?:sk|rk|pk)_test_/;
+/**
+ * Refuse a recognizable key/mode mismatch. This is the only mode guard Connecta
+ * can offer, and it needs the key as a literal header to read the prefix: an
+ * operator-managed key is not in the deployment file, so its declared mode
+ * stands alone and a key pointed at the other environment fails at Stripe.
+ */
+function assertModeMatchesKey(id, mode, auth) {
+    if (auth.type !== "headers")
+        return;
+    for (const value of Object.values(auth.headers)) {
+        const keyMode = LIVE_KEY.test(value) ? "production" : TEST_KEY.test(value) ? "sandbox" : undefined;
+        if (keyMode !== undefined && keyMode !== mode) {
+            throw new Error(`stripe("${id}") declares mode "${mode}" but its auth headers carry a ` +
+                `${keyMode === "production" ? "live" : "test"}-mode Stripe key.`);
+        }
+    }
+}
+function resolveAuth(id, options) {
+    const auth = withCredentialDefaults(options.auth ?? { type: "oauth" }, {
+        credential: {
+            label: "Secret or restricted API key",
+            description: "A Stripe secret or restricted API key for this connector's declared mode. Stripe sends it as a bearer token; it is stored encrypted and never displayed.",
+            placeholder: "sk_… or rk_…",
+        },
+    });
+    const connectedAccount = options.connectedAccount?.trim();
+    if (connectedAccount === undefined || connectedAccount === "")
+        return auth;
+    if (!connectedAccount.startsWith("acct_")) {
+        throw new Error(`stripe("${id}") connectedAccount must be a Stripe account id ("acct_...").`);
+    }
+    if (auth.type === "oauth") {
+        throw new Error(`stripe("${id}") cannot reach a connected account over OAuth; Stripe ` +
+            `requires a restricted API key for Stripe-Account calls.`);
+    }
+    if (auth.type === "credential" || auth.type === "request") {
+        // `Stripe-Account` is a second header beside the credential's own, and the
+        // credential shape assembles exactly one. A Connect connector therefore
+        // still takes its restricted key as a literal header.
+        throw new Error(`stripe("${id}") cannot reach a connected account with an ` +
+            `operator-managed credential; Stripe-Account is a second static ` +
+            `header, so declare auth: { type: "headers" } for this connector.`);
+    }
+    return {
+        type: "headers",
+        headers: { ...auth.headers, "Stripe-Account": connectedAccount },
+    };
+}
+function oauthUsageGuide(purpose, instructions) {
+    const accountInstructions = instructions?.trim();
+    return `# Stripe usage
+
+Scope: live and sandbox accounts. Connector purpose: ${purpose}${skill.fragments.guide_0}${sharedUsageGuide("100 requests per second in live mode and 25 in sandbox mode")}
+${accountInstructions ? `\n## ${skill.instructionsHeading}\n\n${accountInstructions}\n` : ""}`;
+}
+const MODE_COPY = {
+    production: {
+        title: "Stripe (production)",
+        blurb: "production — live money and real customers",
+        warning: "This is a PRODUCTION Stripe connection. Every write moves real money against real customers, and a refund cannot be undone. If a request could plausibly be a rehearsal, route it to a sandbox connector instead.",
+    },
+    sandbox: {
+        title: "Stripe (sandbox)",
+        blurb: "sandbox — test data, no real money",
+        warning: "This is a SANDBOX Stripe connection. Nothing here is real money and none of these objects exist in production, so never answer a question about live revenue, payouts, or a named customer from this connector.",
+    },
+};
+function fixedModeUsageGuide(mode, purpose, instructions) {
+    const copy = MODE_COPY[mode];
+    const accountInstructions = instructions?.trim();
+    return `# Stripe usage
+
+Mode: ${mode}. Connector purpose: ${purpose}
+
+${copy.warning}${skill.fragments.guide_1}${sharedUsageGuide(`${mode === "production" ? "100" : "25"} requests per second`)}
+${accountInstructions ? `\n## ${skill.instructionsHeading}\n\n${accountInstructions}\n` : ""}`;
+}
+function sharedUsageGuide(rate) {
+    return `${skill.fragments.guide_2}${rate}${skill.fragments.guide_3}`;
+}
+/** The closed options stripe() accepts; see `assertKnownOptions`. */
+const STRIPE_OPTIONS = optionsOf()({
+    ...keys("title", "authScope", "purpose", "instructions", "maxResultBytes", "mode", "connectedAccount"),
+    auth: variants("type", {
+        oauth: keys("type"),
+        headers: optionsOf()({ ...keys("type"), headers: strings() }).shape,
+        credential: optionsOf()({
+            ...keys("type", "header", "scheme"),
+            credential: CREDENTIAL,
+        }).shape,
+    }),
+});
+/** A maintained Stripe hosted-MCP connection. */
+export const stripe = defineProvider({
+    name: "stripe",
+    title: "Stripe",
+    kind: "mcp",
+    readme: "Stripe",
+    bundle: { "baselineGzip": 129103, "maxGzip": 189103 },
+    skill,
+    options: STRIPE_OPTIONS,
+    classify: STRIPE_CLASSIFICATION,
+    create: stripeConnector,
+});
+function stripeConnector(id, options, provider) {
+    const purpose = options.purpose.trim();
+    const auth = resolveAuth(id, options);
+    const mode = "mode" in options ? options.mode : undefined;
+    if (auth.type === "oauth" && mode !== undefined) {
+        throw new Error(`stripe("${id}") cannot declare a connector-wide mode for OAuth; Stripe returns mode with each account.`);
+    }
+    if (auth.type !== "oauth" && mode !== "production" && mode !== "sandbox") {
+        throw new Error(`stripe("${id}") with headers or credential auth requires mode ` + `"production" or "sandbox".`);
+    }
+    // Only a literal header can be inspected. An operator-managed credential is
+    // not readable at construction — there is nothing in the deployment file to
+    // read — so the declared mode stands alone, and a key pointed at the other
+    // one is Stripe's own refusal to report.
+    if (auth.type === "headers") {
+        assertModeMatchesKey(id, mode, auth);
+    }
+    const copy = mode === undefined ? undefined : MODE_COPY[mode];
+    const connector = remoteMcp(id, {
+        url: STRIPE_MCP_ENDPOINT,
+        ...provider.connectorOptions,
+        title: options.title ?? copy?.title ?? "Stripe",
+        description: mode === undefined
+            ? `Stripe payments (live and sandbox accounts) — ${purpose}`
+            : `Stripe payments (${copy?.blurb}) — ${purpose}`,
+        auth,
+        requireHttps: true,
+        classify: provider.classify,
+        callAdmission: STRIPE_ADMISSION[mode ?? "sandbox"],
+        usageGuide: {
+            content: mode === undefined
+                ? oauthUsageGuide(purpose, options.instructions)
+                : fixedModeUsageGuide(mode, purpose, options.instructions),
+            // Explicit rather than derived: fixed credentials must lead with mode,
+            // while OAuth must lead with its account-scoped selector pair.
+            summary: mode === undefined
+                ? "Live and sandbox Stripe accounts. List accounts; carry the returned stripe_context and livemode before acting."
+                : mode === "production"
+                    ? "PRODUCTION: real money. This static credential has one fixed live-mode scope."
+                    : "Sandbox: test data only. This static credential has one fixed sandbox scope.",
+            // Not `required`. The four generic tools are the routing decision; a
+            // guide forced into every call would pay for the same prose repeatedly.
+        },
+    });
+    return connector;
+}
+/** @deprecated Read `stripe.definition.classify` instead. Kept for existing imports. */
+export const STRIPE_VETTED_CATALOG = reviewedCatalog(stripe.definition.classify, 'defineProvider("stripe")');

package/dist/providers/stripe/skill.generated.js

@@ -0,0 +1,11 @@
+// Generated by scripts/generate-providers.mjs; do not edit.
+export const skill = {
+    "content": "\n\nThis OAuth session may expose both live and sandbox Stripe accounts. Discover the live account-selection tools, select the intended account and mode, then carry exact context fields such as `stripe_context` and `livemode` wherever the schema requires them. A live-mode write moves real money; a sandbox write changes test data. Never infer the account or mode from connector metadata.\n\n- Discover account and mode with the live account-selection tools before every account-scoped read or write. The published inventory has changed account-tool names; do not assume `list_available_accounts_or_orgs` is available. Select the intended result and carry the exact context fields required by the live schema unchanged. If the account, mode, or supported selector is ambiguous, stop and ask; never guess.\n- Organization accounts are not Stripe Connect connected accounts. A Connect call requires a separate connector with a deployment-configured restricted key plus Stripe's documented `Stripe-Account` header; OAuth does not support that path.\n\n\n- Organization accounts are not Stripe Connect connected accounts. A Connect call requires a deployment-configured restricted key plus Stripe's documented `Stripe-Account` header; OAuth does not support that path. Do not try to turn an organization-account call into a Connect call inside tool arguments.\n\n- Four generic tools reach any Stripe API method. Find the method with `stripe_api_search`, read its parameters with `stripe_api_details`, then call `stripe_api_read` (GET) or `stripe_api_write` (POST/PATCH/PUT/DELETE). Never guess a path or a parameter name — `stripe_api_details` is cheaper than a rejected write.\n- Prefer a dedicated tool when one covers the task: `get_balance_summary` for balances and `stripe_analytics` for Sigma or Metrics reporting. Use `stripe_api_search` for everything else instead of assuming a retired dedicated tool still exists.\n- `stripe_implementation_planner` and the query-execution intents of `stripe_analytics` create provider-side planning or query-run state. Connecta therefore classifies both as writes and enforces the configured pool trust policy; their retrieval paths stay behind the same tool boundary.\n- `stripe_api_write` carries the blast radius of the entire write API — every POST, PATCH, PUT, and DELETE, from a customer edit to a subscription cancellation. State the method and path explicitly; execution follows the configured pool trust policy.\n- Lists are cursor-paginated: `limit` defaults to 10 and caps at 100, `starting_after` and `ending_before` take an object id and are mutually exclusive, and `has_more` says whether to continue. Page inside `execute_code`.\n- Any `stripe_api_read` list or `stripe_api_search` that returns full objects belongs inside `execute_code`, projected to the fields the question needs before `return`. Neither `limit` nor `expand` substitutes for that: an unprojected list of customers or invoices truncates long before it answers, and a projected one keeps the customer's name, email, and address out of the transcript.\n- Search filters on a documented per-resource field set, not on arbitrary attributes. Charges search takes `amount`, `created`, `currency`, `customer`, `status`, `refunded`, `disputed`, `metadata`, `billing_details.address.postal_code`, and `payment_method_details.<source>.*` card fields — there is no `payment_intent` field. When the field you want is not searchable, retrieve the parent object and follow its reference (the PaymentIntent's `latest_charge`) instead of retrying the search with another spelling.\n- The account → `stripe_api_search` → `stripe_api_details` → `stripe_api_read` sequence is one program, not four turns: resolve the method once, then call that method as many times as the investigation needs in the same run.\n- Decline outcomes live on the charge — `outcome`, `failure_code`, `failure_message` — reached from the PaymentIntent's `latest_charge`, so \"why did this payment fail\" is a PaymentIntent read followed by one charge read.\n- Resolve ids before acting; never guess one. Stripe ids are typed prefixes — `cus_` customer, `sub_` subscription, `ch_` charge, `pi_` payment intent, `in_` invoice, `acct_` account — and a plausible-looking id belongs to a different object or to nobody. Find the object with `stripe_api_search` (or a list endpoint through `stripe_api_read`) and carry the `id` it returned into the write.\n- This connection's tool list is not a fixed set. Stripe gates parts of its MCP catalog by account, integration, and beta enrollment, so search this connector for what it actually exposes rather than assuming a documented tool is here.\n- Amounts are integers in the currency's minor unit: `1099` is 10.99 USD, and zero-decimal currencies like JPY take `10` for 10 JPY. Never send a decimal.\n- Send an `Idempotency-Key` on every write you might retry, if the tool accepts it, and reuse the same key for the retry. A retry with a fresh key is a second charge, not a second attempt.\n- Stripe answers a rate limit with `429` and a `Stripe-Rate-Limited-Reason` header; back off on that rather than retrying immediately. Stripe documents an account ceiling of , and any single endpoint is capped at 25 per second regardless of mode, so paging one list is the real constraint.\n- Use `search_stripe_documentation` when the shape of an object or a flow is unclear; it is a read and costs nothing but a call.\n- Treat every create, update, delete, refund, and report run as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n- An `auth_required` failure means this connector's Stripe authorization is missing or expired: run `authorize_connector` for this connector id, then retry the same call unchanged. A rejected argument or a plan restriction comes back in Stripe's own words instead — read it rather than re-authorizing.\n",
+    "instructionsHeading": "Account instructions",
+    "fragments": {
+        "guide_0": "\n\nThis OAuth session may expose both live and sandbox Stripe accounts. Discover the live account-selection tools, select the intended account and mode, then carry exact context fields such as `stripe_context` and `livemode` wherever the schema requires them. A live-mode write moves real money; a sandbox write changes test data. Never infer the account or mode from connector metadata.\n\n- Discover account and mode with the live account-selection tools before every account-scoped read or write. The published inventory has changed account-tool names; do not assume `list_available_accounts_or_orgs` is available. Select the intended result and carry the exact context fields required by the live schema unchanged. If the account, mode, or supported selector is ambiguous, stop and ask; never guess.\n- Organization accounts are not Stripe Connect connected accounts. A Connect call requires a separate connector with a deployment-configured restricted key plus Stripe's documented `Stripe-Account` header; OAuth does not support that path.\n",
+        "guide_1": "\n\n- Organization accounts are not Stripe Connect connected accounts. A Connect call requires a deployment-configured restricted key plus Stripe's documented `Stripe-Account` header; OAuth does not support that path. Do not try to turn an organization-account call into a Connect call inside tool arguments.\n",
+        "guide_2": "\n- Four generic tools reach any Stripe API method. Find the method with `stripe_api_search`, read its parameters with `stripe_api_details`, then call `stripe_api_read` (GET) or `stripe_api_write` (POST/PATCH/PUT/DELETE). Never guess a path or a parameter name — `stripe_api_details` is cheaper than a rejected write.\n- Prefer a dedicated tool when one covers the task: `get_balance_summary` for balances and `stripe_analytics` for Sigma or Metrics reporting. Use `stripe_api_search` for everything else instead of assuming a retired dedicated tool still exists.\n- `stripe_implementation_planner` and the query-execution intents of `stripe_analytics` create provider-side planning or query-run state. Connecta therefore classifies both as writes and enforces the configured pool trust policy; their retrieval paths stay behind the same tool boundary.\n- `stripe_api_write` carries the blast radius of the entire write API — every POST, PATCH, PUT, and DELETE, from a customer edit to a subscription cancellation. State the method and path explicitly; execution follows the configured pool trust policy.\n- Lists are cursor-paginated: `limit` defaults to 10 and caps at 100, `starting_after` and `ending_before` take an object id and are mutually exclusive, and `has_more` says whether to continue. Page inside `execute_code`.\n- Any `stripe_api_read` list or `stripe_api_search` that returns full objects belongs inside `execute_code`, projected to the fields the question needs before `return`. Neither `limit` nor `expand` substitutes for that: an unprojected list of customers or invoices truncates long before it answers, and a projected one keeps the customer's name, email, and address out of the transcript.\n- Search filters on a documented per-resource field set, not on arbitrary attributes. Charges search takes `amount`, `created`, `currency`, `customer`, `status`, `refunded`, `disputed`, `metadata`, `billing_details.address.postal_code`, and `payment_method_details.<source>.*` card fields — there is no `payment_intent` field. When the field you want is not searchable, retrieve the parent object and follow its reference (the PaymentIntent's `latest_charge`) instead of retrying the search with another spelling.\n- The account → `stripe_api_search` → `stripe_api_details` → `stripe_api_read` sequence is one program, not four turns: resolve the method once, then call that method as many times as the investigation needs in the same run.\n- Decline outcomes live on the charge — `outcome`, `failure_code`, `failure_message` — reached from the PaymentIntent's `latest_charge`, so \"why did this payment fail\" is a PaymentIntent read followed by one charge read.\n- Resolve ids before acting; never guess one. Stripe ids are typed prefixes — `cus_` customer, `sub_` subscription, `ch_` charge, `pi_` payment intent, `in_` invoice, `acct_` account — and a plausible-looking id belongs to a different object or to nobody. Find the object with `stripe_api_search` (or a list endpoint through `stripe_api_read`) and carry the `id` it returned into the write.\n- This connection's tool list is not a fixed set. Stripe gates parts of its MCP catalog by account, integration, and beta enrollment, so search this connector for what it actually exposes rather than assuming a documented tool is here.\n- Amounts are integers in the currency's minor unit: `1099` is 10.99 USD, and zero-decimal currencies like JPY take `10` for 10 JPY. Never send a decimal.\n- Send an `Idempotency-Key` on every write you might retry, if the tool accepts it, and reuse the same key for the retry. A retry with a fresh key is a second charge, not a second attempt.\n- Stripe answers a rate limit with `429` and a `Stripe-Rate-Limited-Reason` header; back off on that rather than retrying immediately. Stripe documents an account ceiling of ",
+        "guide_3": ", and any single endpoint is capped at 25 per second regardless of mode, so paging one list is the real constraint.\n- Use `search_stripe_documentation` when the shape of an object or a flow is unclear; it is a read and costs nothing but a call.\n- Treat every create, update, delete, refund, and report run as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n- An `auth_required` failure means this connector's Stripe authorization is missing or expired: run `authorize_connector` for this connector id, then retry the same call unchanged. A rejected argument or a plan restriction comes back in Stripe's own words instead — read it rather than re-authorizing.\n"
+    }
+};

package/dist/providers/{tithely.d.ts → tithely/index.d.ts}

@@ -1,4 +1,4 @@
-import type { Connector, ConnectorCallAdmissionPolicy } from "../types.js";
+import type { ConnectorCallAdmissionPolicy } from "../../types.js";
 /** Tithe.ly's two published v1 endpoints, one per environment. */
 export declare const TITHELY_API_BASE_URLS: {
     readonly live: "https://tithe.ly/api/v1";
@@ -46,4 +46,4 @@ export interface TithelyOptions {
     baseUrl?: string;
 }
 /** A maintained Tithe.ly giving connection over the v1 REST API. */
-export declare function tithely(id: string, options: TithelyOptions): Connector;
+export declare const tithely: import("../../provider.js").ProviderFactory<TithelyOptions>;

package/dist/providers/{tithely.js → tithely/index.js}

@@ -1,8 +1,9 @@
+import { skill } from "./skill.generated.js";
 /**
  * Tithe.ly's giving API (v1), hand-written against the per-operation reference
  * at https://docs.tithe.ly/reference/introduction. No SDK exists to depend on,
  * and none would be welcome: this is a payments API, and every tool below was
- * chosen and written, not generated (ethos: OpenAPI ingestion is refused).
+ * chosen and written, not generated (decision record 0001: hand-authored tools).
  *
  * Facts the code leans on, each from the reference unless marked otherwise:
  *
@@ -44,13 +45,16 @@
  * Drift: there is no combined specification, but each reference page served
  * as `.md` embeds a one-operation OpenAPI 3.1 snippet. `scripts/drift-check.mjs`
  * assembles those snippets for the pages listed in
- * `scripts/drift/tithely-endpoints.json` and digests each operation like any
+ * `src/providers/tithely/drift.json` and digests each operation like any
  * other provider's, so `npm run providers:check -- --provider tithely` runs
  * credential-free.
  */
-import { apiConnector as api, defined } from "../connectors/api-connector.js";
-import { guardedFetch, retryAfterMs, } from "../connectors/guarded-fetch.js";
-import { ConnectorCallError } from "../errors.js";
+import { apiConnector as api, defined } from "../../connectors/api-connector.js";
+import { guardedFetch, retryAfterMs, } from "../../connectors/guarded-fetch.js";
+import { ConnectorCallError } from "../../errors.js";
+import { keys, optionsOf } from "../../config-schema.js";
+import { PROVIDER_COMMON } from "../../connectors/option-shapes.js";
+import { asProviderFactory } from "../../provider.js";
 /** Tithe.ly's two published v1 endpoints, one per environment. */
 export const TITHELY_API_BASE_URLS = {
     live: "https://tithe.ly/api/v1",
@@ -68,9 +72,7 @@ const DEFAULT_PAGE_SIZE = 25;
 /** A full list page of fully embedded organizations stays far below this. */
 const TITHELY_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
 function asRecord(value) {
-    return value && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : {};
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function asArray(value) {
     return Array.isArray(value) ? value : [];
@@ -140,10 +142,7 @@ const operatorKeyPair = async (ctx) => {
 function detailFor(payload, status) {
     const root = asRecord(payload);
     const error = root["error"];
-    const message = text(root["reason"]) ??
-        text(root["message"]) ??
-        text(error) ??
-        text(asRecord(error)["message"]);
+    const message = text(root["reason"]) ?? text(root["message"]) ?? text(error) ?? text(asRecord(error)["message"]);
     return message ? `Tithe.ly: ${message.trim()}` : `Tithe.ly returned HTTP ${status}.`;
 }
 /**
@@ -161,7 +160,7 @@ function tithelyFailure(status, headers, payload) {
         return new ConnectorCallError("auth_required", `${detail} Tithe.ly rejected the key pair. It may be revoked, mistyped, or issued for the other environment — test keys work only on tithelydev.com, live keys only on tithe.ly. An operator must fix the keys on this connection.`);
     }
     if (status === 403) {
-        return new ConnectorCallError("connector_call_failed", `${detail} Tithe.ly refused the request: the key pair may not reach this resource, or API access may not be enabled for this environment. Tithe.ly does not say which.`, { retryable: false });
+        return new ConnectorCallError("provider_permission_denied", `${detail} Tithe.ly refused the request: the key pair may not reach this resource, or API access may not be enabled for this environment. Tithe.ly does not say which. Ask the account administrator to grant API access to this resource and environment.`, { retryable: false });
     }
     if (status === 404) {
         // Not `not_found`: nothing documents whether an id outside this key's
@@ -275,7 +274,7 @@ function projectFunds(organization) {
             return compact({
                 id: fund["id"] === undefined ? undefined : String(fund["id"]),
                 name: String(fund["name"] ?? ""),
-                status: status === undefined ? undefined : FUND_STATUS[status] ?? status,
+                status: status === undefined ? undefined : (FUND_STATUS[status] ?? status),
             });
         });
     }
@@ -691,7 +690,8 @@ function tools(send, defaultPageSize) {
             inputSchema: namedInput({ path: PATH_PROPERTY, query: QUERY_PROPERTY }, ["path"]),
             outputSchema: UNTOUCHED_RESULT,
             handler: async (args, ctx) => ({
-                result: (await callTithely(send, { method: "GET", path: String(args["path"]), query: pairs(args["query"]) }, ctx)) ?? null,
+                result: (await callTithely(send, { method: "GET", path: String(args["path"]), query: pairs(args["query"]) }, ctx)) ??
+                    null,
             }),
         },
         {
@@ -789,8 +789,14 @@ function tools(send, defaultPageSize) {
             description: "List gifts (charges) to one organization or from one donor, optionally within a created-date range, with gross, net, and fees in cents.",
             annotations: readOnly,
             inputSchema: namedInput({
-                organizationId: { ...ORGANIZATION_ID_PROPERTY, description: "Organization (org_…) the gifts went to. This or accountId is required." },
-                accountId: { ...ACCOUNT_ID_PROPERTY, description: "Donor account (user_…) that gave. This or organizationId is required." },
+                organizationId: {
+                    ...ORGANIZATION_ID_PROPERTY,
+                    description: "Organization (org_…) the gifts went to. This or accountId is required.",
+                },
+                accountId: {
+                    ...ACCOUNT_ID_PROPERTY,
+                    description: "Donor account (user_…) that gave. This or organizationId is required.",
+                },
                 createdAfter: {
                     type: ["integer", "string"],
                     minimum: 0,
@@ -815,7 +821,11 @@ function tools(send, defaultPageSize) {
                 if (after !== undefined && before !== undefined && after > before) {
                     throw new ConnectorCallError("invalid_args", "createdAfter is later than createdBefore, so no charge can match.");
                 }
-                const { rows, page } = await listPage(send, ctx, "/charges-list", "charge_id", args, defaultPageSize, { ...scopeFilters(args, "charges"), created_after: after, created_before: before });
+                const { rows, page } = await listPage(send, ctx, "/charges-list", "charge_id", args, defaultPageSize, {
+                    ...scopeFilters(args, "charges"),
+                    created_after: after,
+                    created_before: before,
+                });
                 return { charges: raw(args) ? rows : rows.map(projectCharge), page };
             },
         },
@@ -839,8 +849,14 @@ function tools(send, defaultPageSize) {
             description: "List recurring gifts for one organization or one donor: amount, fund, term, and start date. Does not list the charges they produced.",
             annotations: readOnly,
             inputSchema: namedInput({
-                organizationId: { ...ORGANIZATION_ID_PROPERTY, description: "Organization (org_…) receiving the gifts. This or accountId is required." },
-                accountId: { ...ACCOUNT_ID_PROPERTY, description: "Donor account (user_…) giving. This or organizationId is required." },
+                organizationId: {
+                    ...ORGANIZATION_ID_PROPERTY,
+                    description: "Organization (org_…) receiving the gifts. This or accountId is required.",
+                },
+                accountId: {
+                    ...ACCOUNT_ID_PROPERTY,
+                    description: "Donor account (user_…) giving. This or organizationId is required.",
+                },
                 limit,
                 cursor: CURSOR_PROPERTY,
                 order: ORDER_PROPERTY,
@@ -857,7 +873,11 @@ function tools(send, defaultPageSize) {
             description: "Get one recurring gift by id: amount in cents, fund, term, start date, organization, and donor name and email.",
             annotations: readOnly,
             inputSchema: namedInput({
-                recurringId: { type: "string", minLength: 1, description: "Recurring gift id (rc_…) from list_recurring_charges." },
+                recurringId: {
+                    type: "string",
+                    minLength: 1,
+                    description: "Recurring gift id (rc_…) from list_recurring_charges.",
+                },
                 raw: RAW_PROPERTY,
             }, ["recurringId"]),
             outputSchema: RECURRING_SCHEMA,
@@ -895,71 +915,7 @@ function usageGuide(purpose, environment, instructions) {
 
 ${where}
 
-Account purpose: ${purpose}
-
-## Giving data is sensitive
-
-- Donor names, emails, addresses, and gift amounts are pastoral data. Reduce
-  inside \`execute_code\`: page, filter, and total there, and return the
-  aggregate (sums by fund, month, or donor count), not donor rows, unless the
-  task needs named people.
-- Organization projections omit the payout bank's last four and the legal
-  contact's date of birth. \`raw: true\` and \`tithely_api_get\` return them;
-  do not reach for either to answer a giving question.
-
-## Ids and vocabulary
-
-- Ids carry their kind: \`org_\` organization, \`user_\` donor account,
-  \`ch_\` charge, \`rc_\` recurring gift, \`pm_\` payment method. Read them
-  from \`list_organizations\` and \`list_accounts\`; never guess one.
-- A fund is a Tithe.ly giving type: \`giving_type\` becomes \`fund\`.
-- Projections rename snake_case to camelCase, return amounts as integer
-  \`…Cents\`, and Unix-second dates as ISO 8601 UTC \`…At\`.
-  \`depositedAt\` may be \`"pending"\`. There is no deposits resource: net
-  amount and fees live on each charge.
-
-## Paging
-
-List tools return \`page.hasMore\` and \`page.nextCursor\`; pass the cursor
-back unchanged with the same \`order\`. \`list_charges\` and
-\`list_recurring_charges\` need \`organizationId\` or \`accountId\`.
-\`list_payment_methods\` is not paged.
-
-## Failures
-
-Tithe.ly answers most refusals with HTTP 200, \`status: "fail"\`, and a
-reason but no code. They arrive as \`connector_call_failed\`; read the reason
-rather than retrying blind.
-
-## Writes go through the mutate hatch
-
-Every Tithe.ly write moves money or changes a donor's payment state, so none
-has a named tool. \`tithely_api_mutate\` sends form fields as name/value pairs
-and always needs approval. Amounts are integer cents; card and bank tokens
-come only from Tithely.js in a browser, never from an agent.
-
-- \`POST /charges\`: account_id, pm_id, organization_id, amount,
-  giving_type, optional memo. \`POST /charge-once\` charges a Tithely.js token
-  without an account.
-- \`POST /refunds/{charge_id}\` refunds a charge.
-- \`POST /recurring\`: account_id, pm_id, organization_id, amount,
-  giving_type, term (weekly, monthly, bimonthly, fortnightly), start_date
-  (Unix seconds). \`DELETE /recurring/{recurring_id}\` stops future charges and
-  refunds nothing.
-- \`POST /payment-methods\` (account_id, token), \`POST
-  /payment-methods/{pm_id}\` (account_id plus fields to change), \`DELETE
-  /payment-methods/{pm_id}\` with query account_id.
-- \`POST /accounts\` and \`POST /accounts/{account_id}\` create and update
-  donor accounts.
-
-## Limits
-
-Tithe.ly publishes no rate limit, so this connection declares no call budget.
-An operator who knows one sets \`callAdmission\` on the connection. Only v1 is
-reachable; Tithe.ly's undocumented v2 is not.
-${accountInstructions
-        ? `\n## Account instructions\n\n${accountInstructions}\n`
-        : ""}`;
+Account purpose: ${purpose}${skill.fragments.guide_0}${accountInstructions ? `\n## ${skill.instructionsHeading}\n\n${accountInstructions}\n` : ""}`;
 }
 // --- Construction -----------------------------------------------------------------
 async function testKeyPair(send, environment, values, ctx) {
@@ -971,7 +927,7 @@ async function testKeyPair(send, environment, values, ctx) {
         const payload = await callTithely(send, { method: "GET", path: "/organizations-list", query: { limit: 1 } }, {
             ...ctx,
             credential: {
-                get: async (field) => (field ? values[field] ?? null : null),
+                get: async (field) => (field ? (values[field] ?? null) : null),
                 getAll: async () => values,
             },
         });
@@ -992,8 +948,23 @@ async function testKeyPair(send, environment, values, ctx) {
         };
     }
 }
+/** The closed options tithely() accepts; see `assertKnownOptions`. */
+const TITHELY_OPTIONS = optionsOf()({
+    ...PROVIDER_COMMON,
+    ...keys("environment", "defaultPageSize", "baseUrl"),
+});
 /** A maintained Tithe.ly giving connection over the v1 REST API. */
-export function tithely(id, options) {
+export const tithely = asProviderFactory({
+    name: "tithely",
+    title: "Tithe.ly",
+    kind: "api",
+    readme: "Tithe.ly",
+    bundle: { "baselineGzip": 18076, "maxGzip": 78076 },
+    skill,
+    options: TITHELY_OPTIONS,
+    create: tithelyConnector,
+});
+function tithelyConnector(id, options) {
     const purpose = options.purpose?.trim();
     if (!purpose) {
         throw new Error("tithely() requires a non-empty account purpose.");
@@ -1003,9 +974,7 @@ export function tithely(id, options) {
         throw new Error('tithely() requires environment: "live" (tithe.ly) or "test" (tithelydev.com). Tithe.ly keys are environment-specific and unrecognizable, so connecta will not guess.');
     }
     const defaultPageSize = options.defaultPageSize ?? DEFAULT_PAGE_SIZE;
-    if (!Number.isInteger(defaultPageSize) ||
-        defaultPageSize < 1 ||
-        defaultPageSize > MAX_PAGE_SIZE) {
+    if (!Number.isInteger(defaultPageSize) || defaultPageSize < 1 || defaultPageSize > MAX_PAGE_SIZE) {
         throw new Error(`tithely() defaultPageSize must be a whole number between 1 and ${MAX_PAGE_SIZE}.`);
     }
     const send = tithelyTransport(options.baseUrl?.trim() || TITHELY_API_BASE_URLS[environment], operatorKeyPair);