@zackbart/connecta 0.29.0 → 0.31.0

package/dist/providers/infisical/skill.generated.js

@@ -0,0 +1,8 @@
+// Generated by scripts/generate-providers.mjs; do not edit.
+export const skill = {
+    "content": "Start with `list_projects` for project IDs and environment slugs, then `list_folders` for absolute paths.\n\nKeep value reads narrow. `list_secrets` returns identifiers only by default, even if the server sends values or comments; use `get_secret` or opt into `includeValues` only when needed. These explicit reads return secrets, including values and comments. Comments are available only from these value-read tools. Do not echo values unless the user asks. Imports follow the same value policy.\n\nValues can reference secrets as `${env.KEY}`. Value reads expand references by default. Use `expandReferences: false` to read the literal reference before editing; updating a value changes only that secret, not the secrets it references. Updates send only named changes. Writes omit values and report `pendingApproval` when an environment's change policy requires approval.\n\nEvery value-free result returns only checked identifiers: UUID or legacy 24-hex IDs, secret keys, positive integer versions, known type/approval enums, environment and tag slugs, absolute paths, and ISO timestamps. Projects expose IDs and environment identifiers; folders expose IDs and paths. Project slugs are withheld because Infisical can derive them from free-text project names. Comments, descriptions, free-form names, reminder notes, and arbitrary nested objects are withheld. `metadataOmitted: true` reports dropped or unavailable metadata; success or pending-approval context remains available. Identifier fields outside the conservative grammar are dropped.\n\nKnown, accepted residual risk: environment slugs are returned as required routing identifiers. Infisical's UI derives them from environment names by default, so secrets entered in those names can appear in returned slugs. Operators must not put secrets in environment names or slugs. Secrets placed in identifiers or key names are out of scope.\n\nThe provider assumes an honest Infisical server and protects against careless human entry of secrets in free text. It does not match submitted values or defend against a malicious server encoding values into valid identifiers. Submitted secret data never joins credential redaction, so later calls in the same program keep their authorized arguments. Client credentials and tokens retain request-scoped credential protection.\n\nThis finite surface has no guarded raw-REST tool. These endpoints return complete collections without a page cursor; narrow the path and avoid recursive/value listings to stay below Connecta's 8 MiB response ceiling. Temporary result paging does not reduce the upstream response size.\n\nUniversal Auth tokens remain in memory only and refresh before expiry. Reads may retry once after a rejected token. Writes refresh a rejected token for a later explicit call and return the auth failure without resending; reconcile the target before another call. Recovery echoes marked `argsRedacted` omit secret values, secret comments, and folder descriptions, so any new call requires the original arguments. The operator's machine identity must belong to each project with the right role; a 403 needs an operator to fix membership or role. US cloud is the default; set `baseUrl: \"https://eu.infisical.com/api\"` for EU cloud or your self-hosted HTTPS API base including `/api`. Preserve the connector id and the `clientId`/`clientSecret` fields when migrating existing credentials.\n\nNo default call budget is assumed. Operators can supply `callAdmission` for their instance's limits. The credential test performs a Universal Auth login only, without reading projects or secrets.\n",
+    "instructionsHeading": "Organization instructions",
+    "fragments": {
+        "guide": "Start with `list_projects` for project IDs and environment slugs, then `list_folders` for absolute paths.\n\nKeep value reads narrow. `list_secrets` returns identifiers only by default, even if the server sends values or comments; use `get_secret` or opt into `includeValues` only when needed. These explicit reads return secrets, including values and comments. Comments are available only from these value-read tools. Do not echo values unless the user asks. Imports follow the same value policy.\n\nValues can reference secrets as `${env.KEY}`. Value reads expand references by default. Use `expandReferences: false` to read the literal reference before editing; updating a value changes only that secret, not the secrets it references. Updates send only named changes. Writes omit values and report `pendingApproval` when an environment's change policy requires approval.\n\nEvery value-free result returns only checked identifiers: UUID or legacy 24-hex IDs, secret keys, positive integer versions, known type/approval enums, environment and tag slugs, absolute paths, and ISO timestamps. Projects expose IDs and environment identifiers; folders expose IDs and paths. Project slugs are withheld because Infisical can derive them from free-text project names. Comments, descriptions, free-form names, reminder notes, and arbitrary nested objects are withheld. `metadataOmitted: true` reports dropped or unavailable metadata; success or pending-approval context remains available. Identifier fields outside the conservative grammar are dropped.\n\nKnown, accepted residual risk: environment slugs are returned as required routing identifiers. Infisical's UI derives them from environment names by default, so secrets entered in those names can appear in returned slugs. Operators must not put secrets in environment names or slugs. Secrets placed in identifiers or key names are out of scope.\n\nThe provider assumes an honest Infisical server and protects against careless human entry of secrets in free text. It does not match submitted values or defend against a malicious server encoding values into valid identifiers. Submitted secret data never joins credential redaction, so later calls in the same program keep their authorized arguments. Client credentials and tokens retain request-scoped credential protection.\n\nThis finite surface has no guarded raw-REST tool. These endpoints return complete collections without a page cursor; narrow the path and avoid recursive/value listings to stay below Connecta's 8 MiB response ceiling. Temporary result paging does not reduce the upstream response size.\n\nUniversal Auth tokens remain in memory only and refresh before expiry. Reads may retry once after a rejected token. Writes refresh a rejected token for a later explicit call and return the auth failure without resending; reconcile the target before another call. Recovery echoes marked `argsRedacted` omit secret values, secret comments, and folder descriptions, so any new call requires the original arguments. The operator's machine identity must belong to each project with the right role; a 403 needs an operator to fix membership or role. US cloud is the default; set `baseUrl: \"https://eu.infisical.com/api\"` for EU cloud or your self-hosted HTTPS API base including `/api`. Preserve the connector id and the `clientId`/`clientSecret` fields when migrating existing credentials.\n\nNo default call budget is assumed. Operators can supply `callAdmission` for their instance's limits. The credential test performs a Universal Auth login only, without reading projects or secrets.\n"
+    }
+};

package/dist/providers/notion/index.d.ts

@@ -1,19 +1,9 @@
 import type { ConnectorCallAdmissionPolicy } from "../../types.js";
-/** Notion's REST origin. Every tool below speaks to exactly this host. */
-export declare const NOTION_API_BASE_URL = "https://api.notion.com";
+export { NOTION_API_BASE_URL, NOTION_API_VERSION } from "./rest.js";
 /** Notion's official hosted MCP endpoint. */
 export declare const NOTION_MCP_ENDPOINT = "https://mcp.notion.com/mcp";
-/**
- * Pinned with no override. Notion's date-named versions keep working
- * indefinitely, which makes an override look harmless; it is not. `2026-03-11`
- * is where databases split into data sources, `archived` became `in_trash`, and
- * block append took a `position` object instead of an `after` string. Every
- * projection and write body here assumes those shapes, so an older version would
- * return quietly wrong results rather than fail loudly.
- */
-export declare const NOTION_API_VERSION = "2026-03-11";
 interface NotionCommonOptions {
-    /** Human-readable display name; defaults identify the selected interface. */
+    /** Human-readable display name; defaults identify the selected implementation. */
     title?: string;
     /** Downstream auth ownership. Defaults to one shared deployment grant. */
     authScope?: "shared" | "personal";
@@ -24,31 +14,45 @@ interface NotionCommonOptions {
     /** Connector-specific inline result limit; omit to inherit the deployment. */
     maxResultBytes?: number;
 }
-/** Connecta's maintained hand-written Notion REST interface. */
-export interface NotionApiOptions extends NotionCommonOptions {
-    /** Select integration-owned REST operations explicitly; hosted user MCP is the default. */
-    surface: "api";
+/**
+ * Notion's official hosted MCP server, acting as the OAuth-authorized user.
+ * OAuth only: no integration token reaches the hosted endpoint.
+ */
+export interface NotionOAuthOptions extends NotionCommonOptions {
+    auth: {
+        type: "oauth";
+    };
+    /** Optional per-runtime downstream call-admission policy. */
+    callAdmission?: ConnectorCallAdmissionPolicy;
+    /** Refused: the hosted server holds no operator credential. */
+    credentialLabel?: never;
+    /** Refused: hosted tools own their own paging. */
+    defaultPageSize?: never;
+}
+/**
+ * Connecta's REST connector to `api.notion.com`, acting as one internal
+ * integration with an operator-managed token pasted into the connection in
+ * the operator UI.
+ */
+export interface NotionTokenOptions extends NotionCommonOptions {
+    auth: {
+        type: "token";
+    };
     /** Operator-facing label for the integration token. */
     credentialLabel?: string;
     /**
-     * Default `page_size` for list-shaped tools when the caller omits one.
+     * Default `page_size` for the named list tools when the caller omits one.
      * Defaults to 25; Notion's maximum is 100.
      */
     defaultPageSize?: number;
 }
-/** Notion's official hosted MCP interface, authenticated through OAuth. */
-export interface NotionMcpOptions extends NotionCommonOptions {
-    surface?: "mcp";
-    /** Optional per-runtime downstream call-admission policy. */
-    callAdmission?: ConnectorCallAdmissionPolicy;
-}
-/** Explicit integration-owned REST options; use NotionConnectionOptions for either identity. */
-export interface NotionOptions extends NotionApiOptions {
-}
-/** Select one Notion interface when deployment configuration constructs it. */
-export type NotionConnectionOptions = NotionOptions | NotionMcpOptions;
-/** A maintained Notion connection using the selected provider interface. */
-export declare const notion: import("../../provider.js").ProviderFactory<NotionConnectionOptions>;
+/** `auth` selects the implementation: hosted MCP over OAuth, or REST with a token. */
+export type NotionOptions = NotionOAuthOptions | NotionTokenOptions;
+/**
+ * A maintained Notion connection. `auth` selects the implementation: OAuth
+ * reaches Notion's hosted MCP server as the authorizing user; an integration
+ * token reaches Connecta's REST connector to `api.notion.com` as that bot.
+ */
+export declare const notion: import("../../provider.js").ProviderFactory<NotionOptions>;
 /** @deprecated Read `notion.definition.classify` instead. Kept for existing imports. */
 export declare const NOTION_MCP_VETTED_CATALOG: import("../../catalog-drift.js").VettedCatalog;
-export {};