@zackbart/connecta 0.30.0 → 0.32.0

package/dist/providers/notion/skill.generated.js

@@ -1,10 +1,11 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "\n## Identity before routing\n\nThis explicit `surface: \"api\"` connection acts as an internal integration.\nIts `integration_*` tools are canonical for bot-scoped/headless operations.\nHosted MCP is the default and acts as its OAuth-authorized user. Authorization\nis not equivalent: an integration token cannot authorize hosted MCP, and user\nOAuth cannot reproduce the integration bot's ownership/sharing boundary.\nConfigure each under a separate connector id and authorize it independently.\nDo not switch to a user identity to recover a failed integration operation.\n\nUse the bot tools when the task requires that integration identity. Use hosted\n`notion-search`, `notion-fetch`, `notion-get-users`, `notion-get-comments`,\n`notion-create-pages`, `notion-update-page`, and `notion-create-comment` for\nuser-owned content work. Hosted MCP additionally covers sessions, agents,\nattachments and broader workspace operations. REST tool names are not MCP aliases.\n\n\n\n## Databases contain data sources\n\nA Notion database is a container; the rows and the schema live in a *data\nsource* inside it. The two ids are not interchangeable and Notion rejects the\nwrong one.\n\n- The id in a Notion database URL is a **database id**.\n- `integration_get_database` turns it into the `data_sources` list — usually one entry.\n- `integration_get_data_source_schema` and `integration_query_data_source` take that\n  **data_source_id**, and so does `integration_create_page` when adding a row.\n\nSo the sequence for \"find rows in this database\" is `integration_get_database` →\n`integration_get_data_source_schema` → `integration_query_data_source`. `integration_search` returns data\nsources directly and skips the first step.\n\n## Property quirks that break writes\n\n- Property names in filters, sorts, and writes must match the schema exactly,\n  including case. Read `integration_get_data_source_schema` before composing one.\n- `select` and `status` writes must use an existing option name; inventing\n  one fails. The schema lists the valid options.\n- Writes **replace** a property. Sending one item to a `multi_select` or\n  `relation` drops the others, so send the complete intended value.\n- `rollup`, `formula`, `unique_id`, and the created/edited fields are\n  computed. They cannot be written.\n- A page's title column is rarely called \"title\" — pass `title_property` from\n  the schema when creating or updating a row.\n- Notion truncates `title`, `rich_text`, `relation`, and `people` at 25\n  entries. `integration_get_page` reports each one in `truncated_properties` as\n  `{ name, id }`; pass that `id` as `property_id` to\n  `integration_get_page_property` for the complete value.\n\n## Reading page content\n\n`integration_get_page` returns properties. `integration_get_page_content` returns the body as flat\nblocks. Nested blocks (toggles, list children, table rows) need `depth`, and\neach level multiplies requests — a deep read stops at an internal ceiling and\nreports `truncated: true` rather than spending the whole rate-limit budget.\n\n## Appending is append-only\n\n`integration_append_blocks` adds children and nothing else. It cannot move, reorder, or\nreplace an existing block, and a block appended through the API can never be\nrelocated by it afterwards. Get the position right the first time with\n`position` and `after_block_id`. Notion caps one call at 100 blocks.\n\n## Lean by default, raw on request\n\nEvery read projects Notion's payload down to ids, plain text, and flattened\nproperty values. Where the dropped detail can matter — `integration_search`, `integration_get_page`,\n`integration_get_page_content`, `integration_get_page_property`, `integration_get_data_source_schema`,\n`integration_query_data_source`, `integration_list_comments` — pass `raw: true` to get Notion's\nuntouched response instead. It is much larger; reach for it only when a\nspecific field is missing. Narrow `integration_query_data_source` and `integration_get_page` with\n`properties` instead whenever the goal is fewer fields, not more.\n\n`integration_get_page_content` with `raw: true` returns one level exactly as Notion\nsent it and does not walk nested children, so `depth` is ignored alongside\nit. A block type this projection does not model keeps its payload under\n`raw` on the block itself, so nothing silently flattens to an empty string.\n\n## Failures worth reading carefully\n\n- **404** means \"no such object\" *or* \"not shared with this integration\", and\n  Notion will not say which. Never conclude a page was deleted from it; check\n  that the page is shared with the integration in Notion.\n- **403** is not an expired token. The integration is missing a capability\n  (comment capabilities are off by default) or the object was never shared.\n  Re-authorizing cannot fix it; an operator must change it in Notion.\n- **429** carries a retry window. Notion allows roughly three requests per\n  second per integration, so wait it out rather than retrying immediately.\n\n## No escape hatch\n\nThis connection has no guarded raw-REST tool, deliberately. Notion's public\nAPI is small and slow-moving enough for the named surface to cover it, so\nthere is no `notion_api_*` to reach for — an operation absent from the tool\nlist is absent from this connection, not hidden behind a generic call.\n\n## Writes and pagination\n\n- Notion has **no idempotency key**. A retried `integration_create_page` or\n  `integration_add_comment` creates a duplicate. Confirm with `integration_search` before repeating\n  a write that may have partially succeeded.\n- List tools take `page_size` (max 100) and return `has_more` with\n  `next_cursor`. Pass a cursor back verbatim — it is opaque and must never be\n  parsed or constructed. Follow pages inside `execute_code` and reduce there.\n# Notion MCP usage\n\nOfficial MCP interface: tool names, descriptions, argument schemas, and result\nschemas come from Notion's live server. Connecta preserves that catalog and\napplies release-reviewed classification. Reviewed writes stay writes even when Notion claims they only read.\n\nWorkspace purpose: \n\n- This connection acts as its OAuth-authorized user. The separately configured\n  `surface: \"api\"` connection retains required internal-integration operations\n  under `integration_*` names, including headless content writes, cursor-complete\n  queries, exact JSON blocks and property items. No identity fallback occurs.\n- Discover the live catalog before assuming a tool exists. Notion can gate\n  tools by workspace, account, client, and rollout independently of Connecta.\n- Start broad discovery with `notion-search`, then use `notion-fetch` on\n  the exact page, database, data source, or object before changing it.\n- Use the live input schema as the contract. Notion owns these MCP schemas;\n  the REST schemas in Connecta's API interface do not apply to MCP tools with\n  similar names.\n- Session and agent tools can launch asynchronous work. Read session state and\n  events before sending another message, waiting, or stopping a session.\n- File uploads and attachment tools create durable workspace state. Keep\n  downloads inside the requested task and do not expose signed attachment URLs.\n- An `auth_required` failure means this connector's OAuth grant is missing or\n  expired. Run `authorize_connector` for this connector id, then retry.\n",
+    "content": "\n## Notion's data model\n\n- A database is a container; its rows and schema live in a *data source*\n  inside it. Queries, schema reads, and new rows take the data source, and\n  Notion rejects a database id in its place.\n- Property names in filters, sorts, and writes must match the schema exactly,\n  including case. Read the schema before composing one.\n- A `status` write must use an existing option name; inventing one fails.\n  A new `select` or `multi_select` name does not fail: when the connection\n  can write to the data source, Notion adds it to the schema as a new\n  option. Use the options the schema lists unless a schema change is meant.\n- Writes **replace** a property. Sending one item to a `multi_select` or\n  `relation` drops the others, so send the complete intended value.\n- `rollup`, `formula`, `unique_id`, and the created and edited fields are\n  computed. They cannot be written.\n- A data source's title column is rarely called \"title\". Read its name from\n  the schema before creating or renaming a row.\n- Notion has **no idempotency key**. A retried page create or comment makes a\n  duplicate. Confirm with a search before repeating a write that may have\n  partially succeeded.\n",
     "instructionsHeading": "Workspace instructions",
     "fragments": {
-        "guide_0": "\n## Identity before routing\n\nThis explicit `surface: \"api\"` connection acts as an internal integration.\nIts `integration_*` tools are canonical for bot-scoped/headless operations.\nHosted MCP is the default and acts as its OAuth-authorized user. Authorization\nis not equivalent: an integration token cannot authorize hosted MCP, and user\nOAuth cannot reproduce the integration bot's ownership/sharing boundary.\nConfigure each under a separate connector id and authorize it independently.\nDo not switch to a user identity to recover a failed integration operation.\n\nUse the bot tools when the task requires that integration identity. Use hosted\n`notion-search`, `notion-fetch`, `notion-get-users`, `notion-get-comments`,\n`notion-create-pages`, `notion-update-page`, and `notion-create-comment` for\nuser-owned content work. Hosted MCP additionally covers sessions, agents,\nattachments and broader workspace operations. REST tool names are not MCP aliases.\n\n\n\n## Databases contain data sources\n\nA Notion database is a container; the rows and the schema live in a *data\nsource* inside it. The two ids are not interchangeable and Notion rejects the\nwrong one.\n\n- The id in a Notion database URL is a **database id**.\n- `integration_get_database` turns it into the `data_sources` list — usually one entry.\n- `integration_get_data_source_schema` and `integration_query_data_source` take that\n  **data_source_id**, and so does `integration_create_page` when adding a row.\n\nSo the sequence for \"find rows in this database\" is `integration_get_database` →\n`integration_get_data_source_schema` → `integration_query_data_source`. `integration_search` returns data\nsources directly and skips the first step.\n\n## Property quirks that break writes\n\n- Property names in filters, sorts, and writes must match the schema exactly,\n  including case. Read `integration_get_data_source_schema` before composing one.\n- `select` and `status` writes must use an existing option name; inventing\n  one fails. The schema lists the valid options.\n- Writes **replace** a property. Sending one item to a `multi_select` or\n  `relation` drops the others, so send the complete intended value.\n- `rollup`, `formula`, `unique_id`, and the created/edited fields are\n  computed. They cannot be written.\n- A page's title column is rarely called \"title\" — pass `title_property` from\n  the schema when creating or updating a row.\n- Notion truncates `title`, `rich_text`, `relation`, and `people` at 25\n  entries. `integration_get_page` reports each one in `truncated_properties` as\n  `{ name, id }`; pass that `id` as `property_id` to\n  `integration_get_page_property` for the complete value.\n\n## Reading page content\n\n`integration_get_page` returns properties. `integration_get_page_content` returns the body as flat\nblocks. Nested blocks (toggles, list children, table rows) need `depth`, and\neach level multiplies requests — a deep read stops at an internal ceiling and\nreports `truncated: true` rather than spending the whole rate-limit budget.\n\n## Appending is append-only\n\n`integration_append_blocks` adds children and nothing else. It cannot move, reorder, or\nreplace an existing block, and a block appended through the API can never be\nrelocated by it afterwards. Get the position right the first time with\n`position` and `after_block_id`. Notion caps one call at 100 blocks.\n\n## Lean by default, raw on request\n\nEvery read projects Notion's payload down to ids, plain text, and flattened\nproperty values. Where the dropped detail can matter — `integration_search`, `integration_get_page`,\n`integration_get_page_content`, `integration_get_page_property`, `integration_get_data_source_schema`,\n`integration_query_data_source`, `integration_list_comments` — pass `raw: true` to get Notion's\nuntouched response instead. It is much larger; reach for it only when a\nspecific field is missing. Narrow `integration_query_data_source` and `integration_get_page` with\n`properties` instead whenever the goal is fewer fields, not more.\n\n`integration_get_page_content` with `raw: true` returns one level exactly as Notion\nsent it and does not walk nested children, so `depth` is ignored alongside\nit. A block type this projection does not model keeps its payload under\n`raw` on the block itself, so nothing silently flattens to an empty string.\n\n## Failures worth reading carefully\n\n- **404** means \"no such object\" *or* \"not shared with this integration\", and\n  Notion will not say which. Never conclude a page was deleted from it; check\n  that the page is shared with the integration in Notion.\n- **403** is not an expired token. The integration is missing a capability\n  (comment capabilities are off by default) or the object was never shared.\n  Re-authorizing cannot fix it; an operator must change it in Notion.\n- **429** carries a retry window. Notion allows roughly three requests per\n  second per integration, so wait it out rather than retrying immediately.\n\n## No escape hatch\n\nThis connection has no guarded raw-REST tool, deliberately. Notion's public\nAPI is small and slow-moving enough for the named surface to cover it, so\nthere is no `notion_api_*` to reach for — an operation absent from the tool\nlist is absent from this connection, not hidden behind a generic call.\n\n## Writes and pagination\n\n- Notion has **no idempotency key**. A retried `integration_create_page` or\n  `integration_add_comment` creates a duplicate. Confirm with `integration_search` before repeating\n  a write that may have partially succeeded.\n- List tools take `page_size` (max 100) and return `has_more` with\n  `next_cursor`. Pass a cursor back verbatim — it is opaque and must never be\n  parsed or constructed. Follow pages inside `execute_code` and reduce there.\n",
-        "guide_1": "# Notion MCP usage\n\nOfficial MCP interface: tool names, descriptions, argument schemas, and result\nschemas come from Notion's live server. Connecta preserves that catalog and\napplies release-reviewed classification. Reviewed writes stay writes even when Notion claims they only read.\n\nWorkspace purpose: ",
-        "guide_2": "\n\n- This connection acts as its OAuth-authorized user. The separately configured\n  `surface: \"api\"` connection retains required internal-integration operations\n  under `integration_*` names, including headless content writes, cursor-complete\n  queries, exact JSON blocks and property items. No identity fallback occurs.\n- Discover the live catalog before assuming a tool exists. Notion can gate\n  tools by workspace, account, client, and rollout independently of Connecta.\n- Start broad discovery with `notion-search`, then use `notion-fetch` on\n  the exact page, database, data source, or object before changing it.\n- Use the live input schema as the contract. Notion owns these MCP schemas;\n  the REST schemas in Connecta's API interface do not apply to MCP tools with\n  similar names.\n- Session and agent tools can launch asynchronous work. Read session state and\n  events before sending another message, waiting, or stopping a session.\n- File uploads and attachment tools create durable workspace state. Keep\n  downloads inside the requested task and do not expose signed attachment URLs.\n- An `auth_required` failure means this connector's OAuth grant is missing or\n  expired. Run `authorize_connector` for this connector id, then retry.\n"
+        "oauth_head": "# Notion MCP usage\n\nOfficial MCP interface: tool names, descriptions, argument schemas, and result\nschemas come from Notion's live server. Connecta preserves that catalog and\napplies release-reviewed classification. Reviewed writes stay writes even when Notion claims they only read.\n\nWorkspace purpose: ",
+        "oauth": "\n\n- This connection acts as its OAuth-authorized user and reaches what that user\n  can. It holds no integration token. An internal integration (bot) is a\n  separate connector with `auth: { type: \"token\" }` under another id; never\n  switch to it to recover a failed call here.\n- Discover the live catalog before assuming a tool exists. Notion can gate\n  tools by workspace, account, client, and rollout independently of Connecta.\n  `notion-get-tool-access` reports what the workspace's plan allows.\n- Start broad discovery with `notion-search`, then use `notion-fetch` on\n  the exact page, database, data source, or object before changing it.\n- Use the live input schema as the contract. Notion owns these MCP schemas;\n  the REST schemas of Connecta's token connector do not apply to MCP tools with\n  similar names.\n- Session and agent tools can launch asynchronous work. Read session state and\n  events before sending another message, waiting, or stopping a session.\n- File uploads and attachment tools create durable workspace state. Keep\n  downloads inside the requested task and do not expose signed attachment URLs.\n  `notion-download-skill` returns a signed, expiring archive URL by design;\n  the token connector's REST redaction does not apply to hosted tools, so\n  use that URL for the download and do not repeat it in replies.\n- Connecta's generic REST tools (`notion_api_*`) and the `integration_*`\n  helpers exist only on a token connector.\n- An `auth_required` failure means this connector's OAuth grant is missing or\n  expired. Run `authorize_connector` for this connector id, then retry.\n",
+        "key": "\n## Identity and tools\n\nThis is Connecta's REST connector to `api.notion.com`, acting as one internal\nintegration (a bot) with an operator-managed integration token. It reaches\nexactly the pages and data sources shared with that integration, and the\nintegration's capabilities decide which calls succeed: comment and\nuser-information capabilities are off by default. It never acts as a person.\nHosted Notion MCP is a separate OAuth connector.\n\n- Named tools cover the common path and flatten Notion's payloads:\n  `integration_search` (titles), `integration_get_page` (properties),\n  `integration_get_page_content` (blocks as text),\n  `integration_get_data_source_schema`, and `integration_query_data_source`\n  (rows). `integration_create_page` and `integration_append_blocks` author\n  Notion's rich-text and block shapes from plain text, Markdown, or checklists.\n- Four generic tools reach every other operation in the pinned API index.\n  `notion_api_search` finds operations, not content. `notion_api_details`\n  returns one operation's parameters. `notion_api_read` calls GETs plus the\n  read-only POST queries: search, data source and meeting note queries, and\n  agent, session, and session event queries. `notion_api_write` calls every\n  other POST, PATCH, and DELETE with `method` and `path` stated.\n- Every generic call is checked against the index before it is sent. An\n  unknown path returns the nearest operations, and an unknown or missing\n  parameter returns `validation.issues` with the accepted names. Nothing\n  reached Notion, so fix the call from that answer.\n- The generic set replaces the old one-operation tools. Read a database\n  container with `GET /v1/databases/{database_id}`, users with `GET /v1/users`\n  or `GET /v1/users/me`, and comments with `GET /v1/comments`. Update\n  properties, trash or restore (`in_trash`) with `PATCH /v1/pages/{page_id}`,\n  and comment with `POST /v1/comments` (`rich_text` or `markdown`).\n- Refused by design: Notion's OAuth token endpoints (`/v1/oauth/*`) and\n  multipart file sends. Import a file with `POST /v1/file_uploads` and\n  `mode: \"external_url\"` instead.\n- Notion-hosted file URLs in pages and blocks are pre-signed: Connecta\n  withholds their signature, credential, and security-token parameters, so a\n  returned URL names the file but does not download it. File links inside\n  page Markdown come back as Notion sent them: use one only for its download\n  and do not repeat it in replies. Credential-named\n  fields read as `\"[redacted]\"`, a database property named like a credential\n  (`API token`) included. Failures of the OAuth, file upload, bot user, and\n  agent operations carry Notion's code, not its message.\n- Not here: the hosted MCP's user identity, its search across connected\n  apps, page duplication, team and skill search, attachment downloads, and\n  page-to-skill conversion. Those need an OAuth connector.\n\n## Databases contain data sources\n\n- The id in a Notion database URL is a **database id**.\n  `GET /v1/databases/{database_id}` through `notion_api_read` lists its\n  `data_sources`, usually one. `integration_search` returns data sources\n  directly and skips that step.\n- `integration_get_data_source_schema` and `integration_query_data_source`\n  take the **data_source_id**, and so does `integration_create_page` when\n  adding a row.\n\nSo the sequence for \"find rows in this database\" is the database read, then\n`integration_get_data_source_schema`, then `integration_query_data_source`.\n\n## Reading\n\n- `integration_get_page` returns properties. To read or summarize a whole\n  body, prefer `notion_api_read` `GET /v1/pages/{page_id}/markdown`: one\n  request returns every nested level as Markdown (headings, lists, to-dos,\n  toggles, tables, code, links, mentions, equations). A huge page comes back\n  with `truncated: true` and the unread blocks in `unknown_block_ids`; read\n  each id as a `page_id` on the same path.\n- `integration_get_page_content` returns the body as flat blocks with ids,\n  for quoting a block or appending after one. Nested blocks (toggles, list\n  children, table rows) need `depth`, and each level multiplies requests. A\n  deep read stops at an internal ceiling and reports `truncated: true` rather\n  than spending the whole rate-limit budget.\n- Notion truncates `title`, `rich_text`, `relation`, and `people` at 25\n  entries. `integration_get_page` reports each in `truncated_properties` as\n  `{ name, id }`; read the complete value with `notion_api_read`\n  `GET /v1/pages/{page_id}/properties/{property_id}` and follow its cursor.\n- Every named read projects Notion's payload to ids, plain text, and\n  flattened property values. Pass `raw: true` for Notion's untouched response\n  when a specific field is missing. It is much larger. Narrow\n  `integration_query_data_source` and `integration_get_page` with `properties`\n  when the goal is fewer fields. `integration_get_page_content` with\n  `raw: true` returns one level and ignores `depth`.\n\n## Writing content\n\n`integration_append_blocks` adds children and nothing else. It cannot move,\nreorder, or replace an existing block, and a block appended through the API can\nnever be relocated by it afterwards. Get the position right the first time with\n`position` and `after_block_id`. Notion caps one call at 100 blocks. Text\nlonger than Notion's 2,000-character run limit is split into runs for you.\n\nFor formatted content, write Markdown to a page with `notion_api_write`\n`PATCH /v1/pages/{page_id}/markdown`. Append with\n`{\"type\":\"insert_content\",\"insert_content\":{\"content\":\"## Notes\\n- one\",\"position\":{\"type\":\"end\"}}}`\n(`start` prepends). Edit text in place with `update_content`, whose\n`content_updates` are `{ old_str, new_str }` pairs copied exactly from the\npage's Markdown, and `replace_content` swaps the whole page for `new_str`.\nNotion refuses an edit that would delete a child page or database with a\n`validation_error` naming them. Removing ordinary text needs no flag; to delete\nthose children, set `allow_deleting_content: true` inside the command body\n(`{\"type\":\"update_content\",\"update_content\":{\"content_updates\":[…],\"allow_deleting_content\":true}}`),\nand leave it out unless the task is to delete them. `integration_create_page`\ntakes the same Markdown for a new page's body.\n\n## Pagination\n\n- Named list tools take `page_size` (max 100) and return `has_more` with\n  `next_cursor`; pass it back as `start_cursor`.\n- Generic results arrive as `{ status, data, page? }`. On a list,\n  `page.next` is the cursor and `page.param` is `start_cursor`: send it in\n  `query` for a GET, and in `body` when `page.in` is `body`, as on the POST\n  queries. Pass `select` dot paths relative to `data`, such as `results.id`;\n  `page` survives any `select`.\n- A view query is created with `notion_api_write`\n  `POST /v1/views/{view_id}/queries`, a write because Notion stores it until\n  `expires_at`. Its first page names the continuation in `page.path`: read\n  `GET /v1/views/{view_id}/queries/{query_id}` with `start_cursor` in `query`.\n- Meeting-note queries have no cursor. `limit` caps at 50, and\n  `page.hasMore` without `page.next` means more notes exist: narrow the\n  filter (for example by `created_time`) rather than paging.\n- A data source query stops at 10,000 rows. `integration_query_data_source`\n  then returns `incomplete: true`, and a generic query `page.hasMore` without\n  `page.next`: narrow the filter rather than trusting the count.\n- Cursors are opaque: never parse or construct one. Follow pages inside\n  `execute_code` and reduce there.\n\n## Failures worth reading carefully\n\n- **404** means \"no such object\" *or* \"not shared with this integration\", and\n  Notion will not say which. Never conclude a page was deleted from it; check\n  that the page is shared with the integration in Notion.\n- **403** is not an expired token. The integration is missing a capability\n  (comment capabilities are off by default), the object was never shared, or\n  the workspace is past its plan's block limit; Notion's message says which.\n  Re-authorizing cannot fix it; an operator must change it in Notion.\n- **429** carries a retry window. Notion allows each integration 180 requests\n  a minute (600 on Business and Enterprise) plus a budget shared by the whole\n  workspace; Connecta admits 180 calls a minute, three at a time, per runtime.\n  Wait out the window rather than retrying immediately. A 429 that says the\n  integration's API access is blocked is not retryable.\n- **5xx on a write** may still have been saved. When Notion names the\n  object it committed, the failure says so: read that object instead of\n  repeating the write. Otherwise check the target before trying again.\n",
+        "shared": "\n## Notion's data model\n\n- A database is a container; its rows and schema live in a *data source*\n  inside it. Queries, schema reads, and new rows take the data source, and\n  Notion rejects a database id in its place.\n- Property names in filters, sorts, and writes must match the schema exactly,\n  including case. Read the schema before composing one.\n- A `status` write must use an existing option name; inventing one fails.\n  A new `select` or `multi_select` name does not fail: when the connection\n  can write to the data source, Notion adds it to the schema as a new\n  option. Use the options the schema lists unless a schema change is meant.\n- Writes **replace** a property. Sending one item to a `multi_select` or\n  `relation` drops the others, so send the complete intended value.\n- `rollup`, `formula`, `unique_id`, and the created and edited fields are\n  computed. They cannot be written.\n- A data source's title column is rarely called \"title\". Read its name from\n  the schema before creating or renaming a row.\n- Notion has **no idempotency key**. A retried page create or comment makes a\n  duplicate. Confirm with a search before repeating a write that may have\n  partially succeeded.\n"
     }
 };

package/dist/providers/notion/value-safety.js

@@ -0,0 +1,31 @@
+// Notion's reviewed value-safety table (#801), on the shared mechanism in
+// `../_shared/rest/value-safety.ts`: every operation the detector flags in
+// the pinned spec (`value-safety.candidates.json`) has one verdict here, and
+// `value-safety.node.test.ts` runs the shared harness over it.
+//
+// Notion's API returns little that is a credential: an integration token
+// never appears in a response. The OAuth endpoints mint, introspect, and
+// revoke tokens with a public integration's client secret and are refused.
+// A file upload's `upload_url` is Notion's own send endpoint and needs the
+// integration token, so it is kept. Notion-hosted file URLs in pages and
+// blocks are pre-signed: the shared URL rule withholds their signature,
+// credential, and security-token query parameters on every response, so a
+// returned URL names the file without granting access to it.
+import { refuse, safe } from "../_shared/rest/value-safety.js";
+const OAUTH = "Notion's OAuth token endpoints are not reachable through Connecta: they mint and revoke credentials with a public integration's client secret, which this connector never holds.";
+const UPLOAD = "A file upload's upload_url is Notion's own send endpoint, which needs the integration token; it grants nothing alone.";
+const AGENT = "Custom agents name their connected MCP server's host, never its URL or credentials.";
+const OPERATIONS = {
+    "POST /v1/oauth/token": refuse(OAUTH),
+    "POST /v1/oauth/introspect": refuse(OAUTH),
+    "POST /v1/oauth/revoke": refuse(OAUTH),
+    "GET /v1/users/me": safe("Answers the integration's bot user; no token."),
+    "GET /v1/file_uploads": safe(UPLOAD, ["results.upload_url"]),
+    "POST /v1/file_uploads": safe(UPLOAD, ["upload_url"]),
+    "GET /v1/file_uploads/{file_upload_id}": safe(UPLOAD, ["upload_url"]),
+    "POST /v1/file_uploads/{file_upload_id}/complete": safe(UPLOAD, ["upload_url"]),
+    "POST /v1/file_uploads/{file_upload_id}/send": safe(UPLOAD, ["upload_url"]),
+    "POST /v1/agents/query": safe(AGENT, ["results.connections.account.server_host"]),
+    "GET /v1/agents/{agent_id}": safe(AGENT, ["connections.account.server_host"]),
+};
+export const NOTION_VALUE_SAFETY = { title: "Notion", operations: OPERATIONS };

package/dist/providers/planning-center/index.d.ts

@@ -4,6 +4,12 @@ export declare const PLANNING_CENTER_API_BASE_URL = "https://api.planningcentero
 /** The products behind `/<app>/v2`, in the order their guides list them. */
 export declare const PLANNING_CENTER_APPS: readonly ["people", "services", "groups", "check-ins", "calendar", "registrations", "giving", "publishing", "webhooks", "api"];
 export type PlanningCenterApp = (typeof PLANNING_CENTER_APPS)[number];
+/**
+ * A product a deployment may remove from this connection. People is the one
+ * it may not: every product joins through its person ids, and the credential
+ * test reads `/people/v2/me`.
+ */
+export type PlanningCenterExcludableApp = Exclude<PlanningCenterApp, "people">;
 /**
  * One reviewed `X-PCO-API-Version` per product, sent on every request.
  *
@@ -46,6 +52,27 @@ export interface PlanningCenterOptions {
     userAgent?: string;
     /** Default `per_page` for list tools. Defaults to 25; Planning Center's maximum is 100. */
     defaultPageSize?: number;
+    /**
+     * Products this connection never reaches, e.g. `["giving"]` for a
+     * deployment that keeps agents away from donor and financial data. Their
+     * named tools leave the catalog, the guide and description stop naming
+     * them, and the hatches refuse their paths before any request is sent.
+     * While any product is excluded, hatch paths must be literal, People lists
+     * are unreachable, and existing webhook subscriptions and their payloads
+     * are refused, because each could carry an excluded product's data.
+     * Defaults to none.
+     *
+     * Exclusion guarantees agents reach no excluded-product endpoint, no live
+     * cross-product query (People lists), and no webhook payload or
+     * subscription toggle. It does not hide records the church's automations
+     * or staff have copied into a reachable product: a Giving automation that
+     * adds first-time donors to a People workflow leaves readable workflow
+     * cards, as do notes, custom fields, and form answers. For a hard
+     * boundary, use a personal access token from a user with No Access in
+     * the excluded product; Planning Center sets permissions per product, per
+     * user, and a token carries its user's. Exclusion is defense in depth.
+     */
+    excludeApps?: readonly PlanningCenterExcludableApp[];
     /**
      * Replaces the default per-runtime budget (100 calls per 20 seconds, five at
      * a time). Split it when two connections share one token's user, because

package/dist/providers/planning-center/index.js

@@ -237,7 +237,7 @@ function isApp(value) {
  * normalization the guarded transport applies — so `..` cannot carry a request
  * from `/people/v2` to `/oauth` or anywhere else outside a product.
  */
-function appForPath(path) {
+function appForPath(path, apps) {
     let normalized;
     if (path.startsWith("/") && !path.startsWith("//")) {
         try {
@@ -249,10 +249,145 @@ function appForPath(path) {
     }
     const app = normalized === undefined ? undefined : APP_PATH.exec(normalized)?.[1];
     if (!app || !isApp(app)) {
-        throw new ConnectorCallError("invalid_args", `A Planning Center path begins with /<app>/v2, where app is one of ${PLANNING_CENTER_APPS.join(", ")} — for example /people/v2/people. No host, query string, or traversal.`);
+        throw new ConnectorCallError("invalid_args", `A Planning Center path begins with /<app>/v2, where app is one of ${apps.join(", ")} — for example /people/v2/people. No host, query string, or traversal.`);
     }
     return app;
 }
+/** Display names, in guide order. The guide never lists `api` as a product. */
+const APP_TITLES = {
+    people: "People",
+    services: "Services",
+    groups: "Groups",
+    "check-ins": "Check-Ins",
+    calendar: "Calendar",
+    registrations: "Registrations",
+    giving: "Giving",
+    publishing: "Publishing",
+    webhooks: "Webhooks",
+    api: "API",
+};
+/**
+ * A path's segments, each percent-decoded once, or a refusal when the path is
+ * not literal. While a product is excluded no path may lean on normalization:
+ * a dot segment, an empty segment, a backslash, whitespace, or an encoded
+ * `/`, `\`, `?`, `#`, or `%` could each mean one thing here and another to a
+ * server that decodes or resolves it, so none is admitted at all rather than
+ * reasoned about.
+ */
+function literalSegments(path) {
+    const ambiguous = () => new ConnectorCallError("invalid_args", "While this deployment excludes a Planning Center product, a path must be literal: no . or .. segments, empty segments, backslashes, whitespace, or percent-encoded /, \\, ?, #, or %.");
+    if (!path.startsWith("/"))
+        throw ambiguous();
+    const raw = path.slice(1).split("/");
+    return raw.map((segment, index) => {
+        if (segment === "" && index !== raw.length - 1)
+            throw ambiguous();
+        let decoded;
+        try {
+            decoded = decodeURIComponent(segment);
+        }
+        catch {
+            throw ambiguous();
+        }
+        const control = [...decoded].some((char) => char <= " " || char === "\x7f");
+        if (decoded === "." || decoded === ".." || control || /[/\\?#%]/.test(decoded))
+            throw ambiguous();
+        return decoded;
+    });
+}
+/**
+ * People resources a list is built from or answers with. A list's conditions
+ * can draw on any product — a Giving condition makes a donor list — and one
+ * list can be a condition of another, so while any product is excluded none
+ * of them is read, by path or by `include`.
+ */
+const LIST_RESOURCES = new Set(["lists", "list_results", "rules", "conditions"]);
+/** The People tools that read or refresh a list, removed with any exclusion. */
+const LIST_TOOLS = new Set(["list_lists", "list_list_people", "run_list"]);
+/** The webhook subscription collections, current and 2018-08-01. */
+const SUBSCRIPTION_COLLECTIONS = new Set(["webhook_subscriptions", "subscriptions"]);
+/**
+ * Refuse, before anything is sent, a request that would reach an excluded
+ * product. It reads literal segments, so it runs twice: on the path as given,
+ * and on the exact URL the transport is about to fetch (`admit`), which is the
+ * one that counts. Five doors lead to an excluded product:
+ *
+ * - its own paths, in any case or percent-encoding of a literal segment;
+ * - People lists, rules, conditions, and results, whose criteria can come from
+ *   the excluded product, by path or by `include`;
+ * - a new webhook subscription to its events, which delivers its records to
+ *   any URL — so a new subscription must name a reachable product's event;
+ * - an existing subscription, changed by id: a path names a subscription by
+ *   id, not by product, so no subscription is enabled, disabled, deleted, or
+ *   re-keyed while any product is excluded; and
+ * - webhook event and delivery payloads, which carry the record that fired
+ *   them, refused for every subscription for the same reason.
+ *
+ * People documents no other `include` or attribute that reaches another
+ * product's records.
+ */
+function refuseExcluded(segments, query, request, excluded) {
+    const disabled = (app, detail) => new ConnectorCallError("provider_permission_denied", `Planning Center ${APP_TITLES[app]} (/${app}/v2) is disabled in this deployment, so this connection ${detail}. Retrying will not help; only an operator can remove "${app}" from excludeApps.`, { retryable: false });
+    const because = (detail) => new ConnectorCallError("provider_permission_denied", `This deployment disables Planning Center ${series([...excluded].map((name) => APP_TITLES[name]))}, and ${detail} Retrying will not help.`, { retryable: false });
+    const lower = segments.map((segment) => segment.toLowerCase());
+    const app = lower[0] ?? "";
+    if (isApp(app) && excluded.has(app))
+        throw disabled(app, "does not reach its endpoints");
+    // Lists are refused and workflows are not. A list is a live query: reading
+    // it evaluates its conditions, Giving ones included, at read time, so it
+    // is the excluded product's API by another path. A workflow card is a
+    // stored People record. A Giving automation can create one, but so can
+    // staff, and once created it is People data, like a note or custom field
+    // value typed from a donor's details. Exclusion guards products' APIs,
+    // not provenance; refusing workflows would cost every exclusion a core
+    // People feature and argue equally for notes, fields, forms, and groups.
+    // The hard boundary is the token user's own per-product permissions.
+    const lists = "a People list's conditions can draw on a disabled product, so this connection reads no list, list result, rule, or condition.";
+    if (app === "people" && lower.some((segment) => LIST_RESOURCES.has(segment)))
+        throw because(lists);
+    for (const [key, value] of query) {
+        if (/include/i.test(key) &&
+            value
+                .toLowerCase()
+                .split(/[\s,.]+/)
+                .some((part) => LIST_RESOURCES.has(part))) {
+            throw because(lists);
+        }
+    }
+    if (app !== "webhooks")
+        return;
+    if (lower.some((segment) => /^(?:events|deliveries)\b/.test(segment))) {
+        throw because("a webhook event or delivery payload may carry any product's records, so this connection does not read them. Subscriptions themselves stay readable.");
+    }
+    if (request.method === "GET" || request.method === "HEAD")
+        return;
+    const resource = lower.slice(2).filter((segment) => segment !== "");
+    if (request.method !== "POST" || resource.length !== 1 || !SUBSCRIPTION_COLLECTIONS.has(resource[0])) {
+        throw because("a webhook subscription's id does not name its product, so this connection does not enable, disable, delete, or re-key an existing subscription.");
+    }
+    const data = asRecord(request.body)["data"];
+    const name = Array.isArray(data) ? undefined : asRecord(asRecord(data)["attributes"])["name"];
+    const event = typeof name === "string" ? /^([a-z-]+)\.v2\.events\./.exec(name.trim().toLowerCase())?.[1] : undefined;
+    if (event === undefined || !isApp(event)) {
+        throw because("a new webhook subscription must name one product's event, such as people.v2.events.person.created, in data.attributes.name.");
+    }
+    if (excluded.has(event))
+        throw disabled(event, "cannot subscribe to its webhook events");
+}
+/**
+ * The exclusion, enforced on the exact URL about to be fetched: after the
+ * transport has resolved and encoded it, so what is checked is what Planning
+ * Center routes. The origin and base path are asserted again here, not taken
+ * on trust from the confinement before it.
+ */
+function admit(baseUrl, url, request, excluded) {
+    const base = new URL(baseUrl);
+    const basePath = base.pathname.replace(/\/+$/, "");
+    if (url.origin !== base.origin || !url.pathname.startsWith(`${basePath}/`) || url.hash) {
+        throw new ConnectorCallError("invalid_args", "A Planning Center request left the Planning Center API origin.");
+    }
+    refuseExcluded(literalSegments(url.pathname.slice(basePath.length)), url.searchParams, request, excluded);
+}
 function errorDetail(payload, status) {
     const parts = [];
     for (const entry of asArray(asRecord(payload)["errors"])) {
@@ -309,9 +444,12 @@ function planningCenterFailure(status, headers, payload) {
         retryable: false,
     });
 }
-function planningCenterCall(send, versions) {
+function planningCenterCall(send, versions, excluded) {
+    const apps = PLANNING_CENTER_APPS.filter((app) => !excluded.has(app));
     return async (request, ctx) => {
-        const app = appForPath(request.path);
+        if (excluded.size > 0)
+            refuseExcluded(literalSegments(request.path), [], request, excluded);
+        const app = appForPath(request.path, apps);
         return await send(compact({
             method: request.method,
             path: request.path,
@@ -787,11 +925,11 @@ function personAttributes(args) {
     };
 }
 const WORKFLOW_CARD_ACTIONS = ["promote", "go_back", "skip_step", "snooze", "unsnooze", "remove", "restore"];
-function tools(call, defaultPageSize) {
+function tools(call, defaultPageSize, excluded) {
     const perPage = (args) => args["perPage"] ?? defaultPageSize;
     const list = (spec) => listTool(call, defaultPageSize, spec);
-    return [
-        // --- Hatches ------------------------------------------------------------
+    // --- Hatches --------------------------------------------------------------
+    const hatches = [
         {
             name: "pco_api_get",
             description: "Call any Planning Center GET endpoint in any product and return its untouched JSON:API body. Prefer a named read; this one does not flatten or resolve includes.",
@@ -813,7 +951,7 @@ function tools(call, defaultPageSize) {
         },
         {
             name: "pco_api_mutate",
-            description: "Call any Planning Center POST, PATCH, or DELETE endpoint with a JSON:API body. The approval-gated hatch for writes, actions, and money movement no named tool covers.",
+            description: `Call any Planning Center POST, PATCH, or DELETE endpoint with a JSON:API body. The approval-gated hatch for ${excluded.has("giving") ? "writes and actions" : "writes, actions, and money movement"} no named tool covers.`,
             annotations: DESTRUCTIVE,
             inputSchema: input({
                 method: {
@@ -844,7 +982,9 @@ function tools(call, defaultPageSize) {
                 }), ctx)) ?? null,
             }),
         },
-        // --- People -------------------------------------------------------------
+    ];
+    // --- People ---------------------------------------------------------------
+    const people = [
         {
             name: "get_me",
             description: "Get the Planning Center person this token acts as, with the organization's name and time zone. Supplies personId for my-schedule and assignee questions.",
@@ -1292,7 +1432,9 @@ function tools(call, defaultPageSize) {
                 };
             },
         }),
-        // --- Services -----------------------------------------------------------
+    ];
+    // --- Services -------------------------------------------------------------
+    const services = [
         list({
             name: "list_service_types",
             description: "List Services service types — the recurring services such as Sunday Morning. Supplies serviceTypeId for plans and teams.",
@@ -1596,7 +1738,9 @@ function tools(call, defaultPageSize) {
                 keys: relatedMany(row, "keys", index).map((key) => pick(key, ["name", "starting_key", "ending_key"])),
             }),
         }),
-        // --- Groups -------------------------------------------------------------
+    ];
+    // --- Groups ---------------------------------------------------------------
+    const groups = [
         list({
             name: "list_groups",
             description: "List Groups groups with type, schedule, and member count. Archived groups are excluded unless asked for; the API cannot create a group.",
@@ -1712,7 +1856,9 @@ function tools(call, defaultPageSize) {
                 group_id: relId(row, "group") ?? null,
             }),
         }),
-        // --- Check-Ins (read-only product) ---------------------------------------
+    ];
+    // --- Check-Ins (read-only product) -----------------------------------------
+    const checkIns = [
         list({
             name: "list_check_in_events",
             description: "List Check-Ins events, the recurring things people check in to. Supplies eventId for event periods and check-ins.",
@@ -1806,7 +1952,9 @@ function tools(call, defaultPageSize) {
                 event_period_id: relId(row, "event_period") ?? null,
             }),
         }),
-        // --- Calendar (events read-only) ----------------------------------------
+    ];
+    // --- Calendar (events read-only) ------------------------------------------
+    const calendar = [
         list({
             name: "list_calendar_event_instances",
             description: "List what is on the Calendar in a date range: each occurrence with times and location, recurrence expanded. Events cannot be written through the API.",
@@ -1848,7 +1996,9 @@ function tools(call, defaultPageSize) {
                 event_id: relId(row, "event") ?? null,
             }),
         }),
-        // --- Registrations (read-only product) ----------------------------------
+    ];
+    // --- Registrations (read-only product) ------------------------------------
+    const registrations = [
         list({
             name: "list_signups",
             description: "List Registrations signups (registration events) with open, close, and capacity state. Read-only: the API cannot register anyone.",
@@ -1917,7 +2067,9 @@ function tools(call, defaultPageSize) {
                 person_id: relId(row, "person") ?? null,
             }),
         }),
-        // --- Giving (reads; money moves only through pco_api_mutate) -------------
+    ];
+    // --- Giving (reads; money moves only through pco_api_mutate) ---------------
+    const giving = [
         list({
             name: "list_donations",
             description: "List Giving donations with their fund designations, newest first, by date, fund, or donor. Amounts are integer cents. Read-only.",
@@ -2075,7 +2227,9 @@ function tools(call, defaultPageSize) {
                 designations: designations(row, index),
             }),
         }),
-        // --- Webhooks -----------------------------------------------------------
+    ];
+    // --- Webhooks -------------------------------------------------------------
+    const webhooks = [
         {
             name: "list_webhook_subscriptions",
             description: "List the organization's webhook subscriptions: event name, URL, and active state. Never returns the signing secret; that needs pco_api_get.",
@@ -2104,18 +2258,117 @@ function tools(call, defaultPageSize) {
             },
         },
     ];
+    return {
+        hatches,
+        apps: {
+            people,
+            services,
+            groups,
+            "check-ins": checkIns,
+            calendar,
+            registrations,
+            giving,
+            publishing: [],
+            webhooks,
+            api: [],
+        },
+    };
 }
 // ---------------------------------------------------------------------------
 // Guide and construction
 // ---------------------------------------------------------------------------
-function usageGuide(purpose, instructions) {
+/** `a, b, and c`, the way the guide and description list products. */
+function series(items) {
+    return items.length < 3 ? items.join(" and ") : `${items.slice(0, -1).join(", ")}, and ${items.at(-1)}`;
+}
+/** The products the description names: those with named tools for staff work. */
+const DESCRIBED_APPS = [
+    "people",
+    "services",
+    "groups",
+    "check-ins",
+    "calendar",
+    "registrations",
+    "giving",
+];
+/** What a person id joins in each other product, for the guide's identity rule. */
+const PERSON_JOINS = [
+    ["services", "Services schedules"],
+    ["groups", "Groups memberships"],
+    ["giving", "Giving donations"],
+    ["check-ins", "Check-Ins"],
+];
+/**
+ * The maintained guide for the products this connection reaches. Every
+ * product-specific line is its own fragment, so an excluded product is
+ * neither described, pinned, nor named by a tool the guide points to, and an
+ * exclusion adds the line stating what the hatches refuse. With nothing
+ * excluded, the text is the whole guide as before; the `published` fragment
+ * is that same text without a purpose.
+ */
+function usageGuide(purpose, instructions, excluded) {
+    const fragments = skill.fragments;
+    const has = (app) => !excluded.has(app);
+    const pair = (a, b, both, onlyA, onlyB) => has(a) && has(b) ? both : has(a) ? onlyA : has(b) ? onlyB : "";
+    const apps = PLANNING_CENTER_APPS.filter(has);
+    const joins = PERSON_JOINS.filter(([app]) => has(app)).map(([, label]) => label);
     const organizationInstructions = instructions?.trim();
-    return `${skill.fragments.guide_0}${purpose}${skill.fragments.guide_1}${PLANNING_CENTER_APPS.map((app) => `${app} ${PLANNING_CENTER_API_VERSIONS[app]}`).join(", ")}${skill.fragments.guide_2}${organizationInstructions ? `\n## ${skill.instructionsHeading}\n\n${organizationInstructions}\n` : ""}`;
+    return [
+        fragments.heading,
+        apps
+            .filter((app) => app !== "api")
+            .map((app) => APP_TITLES[app])
+            .join(", "),
+        fragments.purpose,
+        purpose,
+        fragments.identity,
+        joins.length > 0 ? series(joins) : "every People record",
+        fragments.conventions,
+        has("services") ? fragments.plans : "",
+        fragments.writes,
+        excluded.size === 0 ? fragments.people : fragments.people_without_lists,
+        has("services") ? fragments.services : "",
+        has("groups") ? fragments.groups : "",
+        pair("check-ins", "registrations", fragments.check_ins_registrations, fragments.check_ins, fragments.registrations),
+        has("calendar") ? fragments.calendar : "",
+        has("giving") ? fragments.giving : "",
+        pair("publishing", "api", fragments.publishing_api, fragments.publishing, fragments.api),
+        fragments.hatches,
+        apps.map((app) => `${app} ${PLANNING_CENTER_API_VERSIONS[app]}`).join(", "),
+        fragments.pins,
+        excluded.size === 0 ? "" : fragments.disabled,
+        fragments.limits,
+        organizationInstructions ? `\n## ${skill.instructionsHeading}\n\n${organizationInstructions}\n` : "",
+    ].join("");
+}
+/**
+ * `excludeApps` as a set, refusing at construction what cannot be meant
+ * (INV-11): a product Planning Center does not have, a misspelling, or People.
+ */
+function excludedApps(value) {
+    const excluded = new Set();
+    if (value === undefined)
+        return excluded;
+    const excludable = PLANNING_CENTER_APPS.filter((app) => app !== "people").join(", ");
+    if (!Array.isArray(value)) {
+        throw new Error(`planningCenter() excludeApps must be an array of app names from: ${excludable}.`);
+    }
+    for (const entry of value) {
+        if (entry === "people") {
+            throw new Error('planningCenter() excludeApps cannot exclude "people": every product joins through People person ids, and the credential test reads /people/v2/me.');
+        }
+        if (typeof entry !== "string" || !isApp(entry)) {
+            const lower = typeof entry === "string" ? entry.trim().toLowerCase() : "";
+            throw new Error(`planningCenter() excludeApps has unknown app ${JSON.stringify(entry)}; expected any of ${excludable}.${isApp(lower) && lower !== "people" ? ` App names are lowercase path segments: "${lower}".` : ""}`);
+        }
+        excluded.add(entry);
+    }
+    return excluded;
 }
 /** The closed options planningCenter() accepts; see `assertKnownOptions`. */
 const PLANNING_CENTER_OPTIONS = optionsOf()({
     ...PROVIDER_COMMON,
-    ...keys("userAgent", "defaultPageSize", "baseUrl"),
+    ...keys("userAgent", "defaultPageSize", "excludeApps", "baseUrl"),
 });
 /** A maintained Planning Center Online connection over the REST API. */
 export const planningCenter = asProviderFactory({
@@ -2145,19 +2398,25 @@ function planningCenterConnector(id, options) {
     if (!userAgent || /[\r\n]/.test(userAgent)) {
         throw new Error("planningCenter() userAgent must be a non-empty single line.");
     }
+    const excluded = excludedApps(options.excludeApps);
     const auth = PERSONAL_ACCESS_TOKEN;
+    const baseUrl = options.baseUrl?.trim() || PLANNING_CENTER_API_BASE_URL;
     const send = guardedFetch({
         provider: "Planning Center",
-        baseUrl: options.baseUrl?.trim() || PLANNING_CENTER_API_BASE_URL,
+        baseUrl,
         headers: { Accept: "application/json", "User-Agent": userAgent },
         maxResponseBytes: PLANNING_CENTER_MAX_RESPONSE_BYTES,
         authenticate: (ctx) => auth.headers(ctx),
+        ...(excluded.size > 0
+            ? { admit: (url, request) => admit(baseUrl, url, request, excluded) }
+            : {}),
     });
-    const call = planningCenterCall(send, PLANNING_CENTER_API_VERSIONS);
+    const call = planningCenterCall(send, PLANNING_CENTER_API_VERSIONS, excluded);
+    const surface = tools(call, defaultPageSize, excluded);
     return api(id, {
         ...(options.authScope ? { authScope: options.authScope } : {}),
         title: options.title ?? "Planning Center",
-        description: `Planning Center church management — People, Services, Groups, Check-Ins, Calendar, Registrations, and Giving: ${purpose}`,
+        description: `Planning Center church management — ${series(DESCRIBED_APPS.filter((app) => !excluded.has(app)).map((app) => APP_TITLES[app]))}: ${purpose}`,
         credential: auth.credential,
         async testCredentials(values, ctx) {
             try {
@@ -2186,7 +2445,7 @@ function planningCenterConnector(id, options) {
         },
         callAdmission: options.callAdmission ?? PLANNING_CENTER_ADMISSION,
         usageGuide: {
-            content: usageGuide(purpose, options.instructions),
+            content: usageGuide(purpose, options.instructions, excluded),
             summary: "Person ids join every product, offset paging, per-product write limits, JSON:API hatches, pinned versions.",
             // Deliberately not `required`. Every named tool's schema is complete
             // enough to call it on its own; the guide carries the cross-product
@@ -2194,6 +2453,9 @@ function planningCenterConnector(id, options) {
             // it leaves the named surface or hits one of them.
         },
         ...(options.maxResultBytes !== undefined ? { maxResultBytes: options.maxResultBytes } : {}),
-        tools: tools(call, defaultPageSize),
+        tools: [
+            ...surface.hatches,
+            ...PLANNING_CENTER_APPS.flatMap((app) => (excluded.has(app) ? [] : surface.apps[app])).filter((tool) => excluded.size === 0 || !LIST_TOOLS.has(tool.name)),
+        ],
     });
 }