@zackbart/connecta 0.30.0 → 0.32.0

package/dist/providers/vercel/skill.generated.js

@@ -1,11 +1,10 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "`. Every named account-scoped tool accepts a `teamId` override; pass `null` to target the token owner's personal account.\n## REST complement routing\n\nHosted MCP is the default. Configure this complement with `surface: \"api\"`\nand a separate connector id and access-token credential. OAuth and API-token\nstores are independent; failures never switch identity or replay a write.\nTeam defaults route calls and do not constrain the token's permissions.\n\nUse hosted `list_teams`, `list_projects`, `get_project`, `list_deployments`,\n`get_deployment`, `get_deployment_build_logs` or `list_deployment_events`,\n`get_runtime_logs`, `list_project_domains`, `add_project_domain`, and\n`cancel_deployment` for the corresponding operations. Follow their live schemas,\nnot the removed REST argument shapes. Read deployment status before logs and\nnarrow log windows.\n\nThis complement retains `verify_project_domain`, `remove_project_domain`,\nand `delete_deployment` because the reviewed category\npages do not publish equivalent tools. Hosted `request_promote` moves an existing\nbuild to production and does not rebuild it (the rolling-releases category\nprovides the equivalent that the deployments category does not list). New deployments use hosted\n`create_deployment` or `deploy_to_vercel`.\n\n## Environment values\n\n`list_project_env_vars` never decrypts or returns values. Set `upsert: false` on\n`upsert_project_env_var` for create-only writes that refuse to overwrite. `upsert_project_env_var`,\n`update_project_env_var`, and `delete_project_env_var` return metadata without\nvalues. Create/update values are write input only. The hosted connector excludes\n`filter_project_envs`, `get_project_env`, `create_project_env`, and\n`edit_project_env`, whose published contracts lack these response protections.\nEnvironment changes apply to future deployments.\n\n## REST gaps and uploads\n\n`vercel_api_get` and `vercel_api_mutate` reach uncovered endpoints. They refuse\npaths owned by the canonical hosted or value-safe named tools, including\nproject creation/update, pause/unpause and protection bypass. Ownership covers\nthe published tool categories, not just the old reviewed classifier names;\nunreviewed live tools remain fail-closed writes. Do not use a\nraw hatch to restore a removed duplicate. `upload_file` on MCP owns deployment\nfile uploads; `vercel_api_upload` retains other raw-body endpoints and explicit\nheaders. It never reads a local file. Paths include the API version and cannot\nbe absolute URLs. Query parameters are name/value pairs; `personalAccount: true`\nomits this connection's default team. Rate-limit failures carry vendor retry timing.\n# Vercel MCP usage\n\nOfficial MCP surface: tool names, descriptions, argument schemas, and result\nschemas come from Vercel's live server. Connecta preserves retained vendor contracts and\napplies release-reviewed classification. Reviewed writes stay writes even when Vercel claims they only read.\n\nAccount purpose: \n\n- Hosted MCP owns discovery, deployments, logs, project-domain listing/adding,\n  cancellation and file uploads. Use the separately configured REST complement\n  for value-safe project environment variables, uncovered lifecycle/domain\n  operations and REST gaps. It has its own connector id and credential.\n- Discover the live catalog before assuming a tool exists. Vercel can change\n  the surface independently of a Connecta release, and account features may\n  affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access. A configured API `teamId` is a routing default, not an authorization boundary.\n- MCP pagination and arguments follow the live MCP schemas; do not apply API pagination or argument shapes to them.\n- Resolve team, project, deployment, run, thread, and order ids with the list\n  and get tools. Do not guess opaque ids.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error\n  clusters, and runtime logs. Narrow time windows before raising result limits.\n- Purchase tools change billing. Read a quote first and carry its price,\n  idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL\n  it returns as a credential and do not expose it outside the requested task.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update\n  live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or\n  expired. Run `authorize_connector` for this connector id, then retry.\n",
+    "content": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
     "instructionsHeading": "Account instructions",
     "fragments": {
-        "guide_0": "`. Every named account-scoped tool accepts a `teamId` override; pass `null` to target the token owner's personal account.",
-        "guide_1": "\n## REST complement routing\n\nHosted MCP is the default. Configure this complement with `surface: \"api\"`\nand a separate connector id and access-token credential. OAuth and API-token\nstores are independent; failures never switch identity or replay a write.\nTeam defaults route calls and do not constrain the token's permissions.\n\nUse hosted `list_teams`, `list_projects`, `get_project`, `list_deployments`,\n`get_deployment`, `get_deployment_build_logs` or `list_deployment_events`,\n`get_runtime_logs`, `list_project_domains`, `add_project_domain`, and\n`cancel_deployment` for the corresponding operations. Follow their live schemas,\nnot the removed REST argument shapes. Read deployment status before logs and\nnarrow log windows.\n\nThis complement retains `verify_project_domain`, `remove_project_domain`,\nand `delete_deployment` because the reviewed category\npages do not publish equivalent tools. Hosted `request_promote` moves an existing\nbuild to production and does not rebuild it (the rolling-releases category\nprovides the equivalent that the deployments category does not list). New deployments use hosted\n`create_deployment` or `deploy_to_vercel`.\n\n## Environment values\n\n`list_project_env_vars` never decrypts or returns values. Set `upsert: false` on\n`upsert_project_env_var` for create-only writes that refuse to overwrite. `upsert_project_env_var`,\n`update_project_env_var`, and `delete_project_env_var` return metadata without\nvalues. Create/update values are write input only. The hosted connector excludes\n`filter_project_envs`, `get_project_env`, `create_project_env`, and\n`edit_project_env`, whose published contracts lack these response protections.\nEnvironment changes apply to future deployments.\n\n## REST gaps and uploads\n\n`vercel_api_get` and `vercel_api_mutate` reach uncovered endpoints. They refuse\npaths owned by the canonical hosted or value-safe named tools, including\nproject creation/update, pause/unpause and protection bypass. Ownership covers\nthe published tool categories, not just the old reviewed classifier names;\nunreviewed live tools remain fail-closed writes. Do not use a\nraw hatch to restore a removed duplicate. `upload_file` on MCP owns deployment\nfile uploads; `vercel_api_upload` retains other raw-body endpoints and explicit\nheaders. It never reads a local file. Paths include the API version and cannot\nbe absolute URLs. Query parameters are name/value pairs; `personalAccount: true`\nomits this connection's default team. Rate-limit failures carry vendor retry timing.\n",
-        "guide_2": "# Vercel MCP usage\n\nOfficial MCP surface: tool names, descriptions, argument schemas, and result\nschemas come from Vercel's live server. Connecta preserves retained vendor contracts and\napplies release-reviewed classification. Reviewed writes stay writes even when Vercel claims they only read.\n\nAccount purpose: ",
-        "guide_3": "\n\n- Hosted MCP owns discovery, deployments, logs, project-domain listing/adding,\n  cancellation and file uploads. Use the separately configured REST complement\n  for value-safe project environment variables, uncovered lifecycle/domain\n  operations and REST gaps. It has its own connector id and credential.\n- Discover the live catalog before assuming a tool exists. Vercel can change\n  the surface independently of a Connecta release, and account features may\n  affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access. A configured API `teamId` is a routing default, not an authorization boundary.\n- MCP pagination and arguments follow the live MCP schemas; do not apply API pagination or argument shapes to them.\n- Resolve team, project, deployment, run, thread, and order ids with the list\n  and get tools. Do not guess opaque ids.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error\n  clusters, and runtime logs. Narrow time windows before raising result limits.\n- Purchase tools change billing. Read a quote first and carry its price,\n  idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL\n  it returns as a credential and do not expose it outside the requested task.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update\n  live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or\n  expired. Run `authorize_connector` for this connector id, then retry.\n"
+        "oauth": "\n\nTool names, descriptions, argument schemas, and result schemas come from Vercel's live server. Connecta applies release-reviewed classification; reviewed writes stay writes even when Vercel claims they only read.\n\n- Discover the live catalog before assuming a tool exists. Vercel can change the surface independently of a Connecta release, and account features may affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access.\n- MCP pagination and arguments follow the live MCP schemas; do not apply REST pagination or argument shapes to them.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error clusters, and runtime logs.\n- `get_project_env` and `filter_project_envs` can return decrypted environment values, so Connecta reviews them as writes, and a read-only endpoint refuses them. Prefer reading variable keys and targets without values.\n- Purchase tools change billing. Read a quote first and carry its price, idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL it returns as a credential and do not expose it outside the requested task.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or expired. Run `authorize_connector` for this connector id, then retry.\n",
+        "key": "\n\n- This is Connecta's REST connector to `api.vercel.com`, holding one operator-managed access token. A default team routes calls; it does not narrow what the token can reach.\n- `vercel_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `vercel_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `vercel_api_read` calls GET operations, plus reviewed POSTs that only read: `POST /v2/observability/query`, registrar availability, price, and search, and `POST /v8/artifacts`. `vercel_api_write` calls every other POST, PUT, PATCH, and DELETE, with `method` and `path` stated; a read-only endpoint refuses it.\n- Paths are concrete and carry the version search returned: `/v13/deployments/dpl_123`, not `/deployments/dpl_123`. Pass `query` and `body` as JSON objects named as `vercel_api_details` lists them. Every call is checked against the pinned index before it is sent: an unknown path returns the nearest operations, and an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Vercel, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `until` (a millisecond timestamp from `pagination.next`) on most lists, `cursor` on newer ones. Lists belong inside `execute_code`; pass `select` (dot paths such as `deployments.uid` and `deployments.state`) to keep only the fields the question needs.\n- `list_teams` returns team ids and slugs and the connection's default team. `get_deployment_build_logs` reads a deployment's build events without following live output. `get_runtime_logs` collects the runtime log stream for at most `waitMs` or `maxRows`, then stops and says why. Generic reads refuse `follow` and the runtime-log stream, which never end on their own.\n- `vercel_api_upload` sends explicit text or base64 bytes to an octet-stream operation, such as `POST /v2/files` before a deployment (Connecta computes `x-vercel-digest`). `vercel_api_write` sends JSON only.\n- Environment values never come back. `list_project_env_vars` never decrypts. `upsert_project_env_var` (`upsert: false` for create-only), `update_project_env_var`, and `delete_project_env_var` return metadata without values; values are write input only. Generic reads refuse `GET /v1/projects/{idOrName}/env/{id}`, `GET /v10/projects/{idOrName}/env`, `GET /v1/env/{id}`, and any `decrypt`, and Connecta replaces the value of every environment variable in any result with `\"[redacted]\"`, including project reads, shared variables, and audit events.\n- Other secrets read as `[redacted]` in every result: credential-named fields and their whole contents (`token`, `secret`, `password`, `jwt`, `credentials`, `Authorization`, …), protection-bypass secrets (each bypass's metadata stays under a numbered placeholder), deploy hook URLs, drain and webhook headers and signing secrets (including the one a new webhook or drain returns), drain and webhook destination URLs and external route, rewrite, and redirect destinations beyond their scheme and host, the args and values of every header, cookie, and query rule (route transforms and conditions, firewall conditions), team invite codes, synced Global Config items, and credentials inside other URLs. Failures of every reviewed operation, and of any operation whose request takes a credential-named field, say only the status and a reviewed code. Read or rotate withheld secrets in the Vercel dashboard. A `[redacted]` field is never the real value; do not send it back.\n- Refused by design: endpoints that mint credentials (access tokens, AI Gateway API keys, project OIDC and trace tokens, Connect and SSO tokens, Edge Config tokens, KMS-signed tokens, Flags SDK keys, protection-bypass secrets, installation credential rotation), Connect authorization requests, project transfer requests (the code lets another team claim the project), KMS signing, a domain move-out (its answer is a transfer token), Global Config items, backups, and tokens, and domain transfer auth codes. Each refusal names its reason.\n- The hosted OAuth connection's documentation search, runtime error clusters, toolbar threads, agent runs, web analytics summaries, purchase quotes, `deploy_to_vercel`, and access grants for protected URLs do not exist with a token. Configure an OAuth connector for those.\n- A `429` carries Vercel's reset time; Vercel meters endpoints separately, so wait before retrying the same operation. An `auth_required` failure means the token is missing, expired, or outside this team: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. A rejected argument comes back in Vercel's own words; read it rather than replacing the token.\n",
+        "shared": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n"
     }
 };

package/dist/providers/vercel/value-safety.js

@@ -0,0 +1,328 @@
+// Vercel's reviewed value-safety table (decision 0005, "Value safety"), on the
+// shared mechanism in `../_shared/rest/value-safety.ts`.
+//
+// No tool response, success or error, returns a credential (API, service, or
+// bypass tokens, signing secrets, deploy-hook and other bearer URLs, private
+// keys, authorization verifiers, auth headers) or a stored secret value
+// (environment variables, Global Config items), unless a reviewed named tool
+// exists to return it. Three layers, strongest first:
+//
+// 1. Refuse by operation. `scripts/value-safety.mjs` flags every operation in
+//    the pinned spec whose response may carry one (committed as
+//    `value-safety.candidates.json`); each needs a verdict here, and
+//    `value-safety.node.test.ts` runs the shared harness over this table.
+// 2. Reviewed field paths for `redact` verdicts, applied to every success body
+//    on every path (generic tools, HEAD data, named tools, logs, uploads)
+//    before cursors or `select` read it. Every reviewed operation, and every
+//    one whose request accepts a credential-named field, also answers
+//    failures with fixed messages, never the vendor's text.
+// 3. The shared key-name heuristic, defense in depth only, over every body:
+//    any subtree under a credential-named key, labelled key/value records
+//    whose label is credential-named, environment-variable containers, and
+//    URLs with userinfo or credential query parameters.
+//
+// Residual risk, as with Infisical: a secret a person typed into a free-text
+// name, description, log line, or identifier is out of scope.
+import { redact, refuse as refusal, safe, under, } from "../_shared/rest/value-safety.js";
+/** A refusal's reason reads as a sentence about the operation: "It mints …". */
+const refuse = (reason) => refusal(`It ${reason}`);
+/** A project object: env values, deploy hooks, and protection-bypass secrets. */
+const PROJECT = [
+    "env[].value",
+    "env[].vsmValue",
+    "env[].legacyValue",
+    "link.deployHooks[].url",
+    "protectionBypass@keys",
+    // Header, cookie, and query conditions on internal and firewall routes.
+    "internalRoutes[].has[?header].value",
+    "internalRoutes[].missing[?header].value",
+    "security.firewallRoutes[].has[?header].value",
+    "security.firewallRoutes[].missing[?header].value",
+];
+/** Project metadata whose names contain a credential word. */
+const PROJECT_ALLOW = [
+    "protectionBypass",
+    "oidcTokenConfig",
+    "security.firewallBypassIps",
+    "usageStatus.bypassThrottleUntil",
+    "dismissedToasts[].value",
+];
+const DRAIN = [
+    "delivery.secret",
+    "delivery.headers{}",
+    "origin:delivery.endpoint",
+    "origin:delivery.endpoint.traces",
+    "secret",
+    "headers{}",
+    "origin:url",
+];
+const SHARED_ENV = ["data[].value", "created[].value", "updated[].value", "failed[].error.value"];
+const PROJECT_ENV = ["value", "legacyValue", "vsmValue", "[].value", "[].legacyValue"];
+const CONNECTOR_ALLOW = ["appTokens", "userTokens"];
+const PROJECT_REASON = "Project objects embed environment values, deploy hook URLs, and protection-bypass secrets.";
+const DRAIN_REASON = "Drains store destination credentials (headers, URLs whose path or query can be a bearer secret) and a signing secret.";
+const WEBHOOK = ["secret", "origin:url"];
+const WEBHOOK_REASON = "Webhooks carry a signing secret and a destination URL whose path can be a bearer secret.";
+/** Route rules: a transform that sets a credential-named header carries the credential in `args`. */
+/**
+ * Route rules: every header, cookie, or query transform's `args` and every
+ * header, cookie, or query condition's `value` go, whatever the target key's
+ * form (a string, or a predicate object such as `{ eq: "Authorization" }`);
+ * a header-name list would always miss one (`X-Auth-Key`).
+ */
+const ROUTE_TRANSFORMS = [
+    "transforms[].args",
+    "has[?header].value",
+    "missing[?header].value",
+    // Headers a route sets, and the locale cookie it reads (its name is credential vocabulary).
+    "headers{}",
+    "locale.cookie",
+];
+const DEPLOYMENT = [
+    ...under(["routes[]", "services[].routes[]", "services[].rewrites[]", "services[].redirects[]"], ROUTE_TRANSFORMS),
+    "services[].headers[].headers[].value",
+    "services[].headers[].has[?header].value",
+    "services[].headers[].missing[?header].value",
+];
+const DEPLOYMENT_REASON = "Deployment routes can set credential-named headers (transforms with target.key Authorization) whose args are the credential.";
+const ROUTE_REASON = "Route transforms can set credential-named headers whose args are the credential.";
+const ENV_REASON = "Environment-variable bodies carry decrypted or encrypted values.";
+const NO_SECRET_REASON = "Answers status or nothing; the flag is the operation's name, not its response.";
+const EDGE_ITEMS = "returns Global Config item values, which may be secrets; read them from your application with the Edge Config SDK.";
+const MINT = "mints a credential and returns it in cleartext.";
+const MODEL_CONFIG = "AI Gateway routing configuration; its descriptions mention tokens as model usage units.";
+const KMS_POLICY = "Issuer policies name environments and claims; signing keys stay with Vercel.";
+/** A firewall rule's header, cookie, and query conditions: their values can be credentials (an `X-Auth-Key` match). */
+const FIREWALL_CONDITIONS = [
+    "conditionGroup[].conditions[?header].value",
+    "conditionGroup[].conditions[?header].values",
+];
+/** Every firewall config shape: rules, rulesets, and top-level conditions, active, draft, and versions. */
+const FIREWALL = under(["rules[]", "rulesets[]", "conditions[]"], FIREWALL_CONDITIONS);
+const FIREWALL_REASON = "Firewall rules match header, cookie, and query values, which can be credentials a rule checks for (an X-Auth-Key).";
+const TEAM_INVITE = "Teams carry inviteCode, which lets its holder join the team (visible to owners).";
+/**
+ * The reviewed verdict for every flagged operation, keyed `METHOD /path`.
+ * `refuse` is never sent by the generic tools; named tools that need one of
+ * these operations project it themselves (value-safe environment variables).
+ */
+const VALUE_SAFETY = {
+    "PATCH /aliases/{id}/protection-bypass": refuse("creates a shareable link that bypasses Deployment Protection."),
+    "POST /api-keys": refuse("mints an AI Gateway API key and returns it in cleartext."),
+    "POST /v1/connect/authorize/{connector}": refuse("starts a Connect authorization for a caller-chosen subject and returns its verifier and device code."),
+    "POST /v1/connect/connectors": safe("Connector capability metadata; appTokens and userTokens describe grants, not tokens.", CONNECTOR_ALLOW),
+    "GET /v1/connect/connectors/{connector}": safe("Connector capability metadata.", CONNECTOR_ALLOW),
+    "POST /v1/connect/connectors/{connector}/managed/eject": safe("Connector capability metadata.", CONNECTOR_ALLOW),
+    "PATCH /v1/connect/connectors/{connector}/trigger-destinations": safe("Connector capability metadata.", CONNECTOR_ALLOW),
+    "GET /v2/connect/connectors": safe("Connector capability metadata.", under(["connectors[]"], CONNECTOR_ALLOW)),
+    "PATCH /v2/connect/connectors/{connector}": safe("Connector capability metadata.", under(["connector"], CONNECTOR_ALLOW)),
+    "POST /v1/connect/token/{connector}": refuse("mints a token for a Connect connector."),
+    "GET /v1/drains": redact(DRAIN_REASON, under(["drains[]"], DRAIN)),
+    "POST /v1/drains": redact(DRAIN_REASON, DRAIN),
+    "POST /v1/drains/test": redact("Answers a delivery test; treated as part of the drain family.", DRAIN),
+    "GET /v1/drains/{id}": redact(DRAIN_REASON, DRAIN),
+    "PATCH /v1/drains/{id}": redact(DRAIN_REASON, DRAIN),
+    "DELETE /v1/drains/{id}": safe(NO_SECRET_REASON),
+    "GET /v1/log-drains": redact(DRAIN_REASON, under(["drains[]", "[]"], DRAIN)),
+    "POST /v1/log-drains": redact(DRAIN_REASON, DRAIN),
+    "GET /v1/log-drains/{id}": redact(DRAIN_REASON, DRAIN),
+    "DELETE /v1/log-drains/{id}": safe(NO_SECRET_REASON),
+    "GET /v2/integrations/log-drains": redact(DRAIN_REASON, under(["[]"], DRAIN)),
+    "POST /v2/integrations/log-drains": redact(DRAIN_REASON, DRAIN),
+    "DELETE /v1/integrations/log-drains/{id}": safe(NO_SECRET_REASON),
+    "GET /v1/webhooks": redact(WEBHOOK_REASON, under(["[]", "webhooks[]"], WEBHOOK)),
+    "POST /v1/webhooks": redact(WEBHOOK_REASON, WEBHOOK),
+    "GET /v1/webhooks/{id}": redact(WEBHOOK_REASON, WEBHOOK),
+    "DELETE /v1/webhooks/{id}": safe(NO_SECRET_REASON),
+    "GET /v1/env": redact(ENV_REASON, SHARED_ENV),
+    "POST /v1/env": redact(ENV_REASON, SHARED_ENV),
+    "PATCH /v1/env": redact(ENV_REASON, SHARED_ENV),
+    "DELETE /v1/env": redact(ENV_REASON, SHARED_ENV),
+    "GET /v1/env/{id}": refuse("returns a shared environment variable's decrypted value."),
+    "PATCH /v1/env/{id}/unlink/{projectId}": redact(ENV_REASON, ["value"]),
+    "GET /v1/global-config": safe("Global Config metadata: ids, slugs, sizes, and digests, without items."),
+    "POST /v1/global-config": safe("Answers the created Global Config's metadata."),
+    "GET /v1/global-config/{edgeConfigId}": safe("Global Config metadata without items."),
+    "PUT /v1/global-config/{edgeConfigId}": safe("Answers the updated Global Config's metadata."),
+    "DELETE /v1/global-config/{edgeConfigId}": safe(NO_SECRET_REASON),
+    "GET /v1/global-config/{edgeConfigId}/backups": safe("Lists backup versions and sizes, without items."),
+    "GET /v1/global-config/{edgeConfigId}/backups/{edgeConfigBackupVersionId}": refuse(EDGE_ITEMS),
+    "POST /v1/global-config/{edgeConfigId}/backups/{edgeConfigBackupVersionId}/restore": safe(NO_SECRET_REASON),
+    "GET /v1/global-config/{edgeConfigId}/item/{edgeConfigItemKey}": refuse(EDGE_ITEMS),
+    "GET /v1/global-config/{edgeConfigId}/items": refuse(EDGE_ITEMS),
+    "PATCH /v1/global-config/{edgeConfigId}/items": safe("Answers a status; item values are write input only."),
+    "GET /v1/global-config/{edgeConfigId}/schema": safe("A JSON Schema for items, without values."),
+    "POST /v1/global-config/{edgeConfigId}/schema": safe("Answers the schema, without values."),
+    "DELETE /v1/global-config/{edgeConfigId}/schema": safe(NO_SECRET_REASON),
+    "POST /v1/global-config/{edgeConfigId}/token": refuse(MINT),
+    "GET /v1/global-config/{edgeConfigId}/token/{token}": refuse("returns a Global Config read token."),
+    "GET /v1/global-config/{edgeConfigId}/tokens": refuse("returns every Global Config read token in cleartext."),
+    "DELETE /v1/global-config/{edgeConfigId}/tokens": safe(NO_SECRET_REASON),
+    "GET /v1/installations/{integrationConfigurationId}/resources/{resourceId}/experimentation/global-config": refuse(EDGE_ITEMS),
+    "PUT /v1/installations/{integrationConfigurationId}/resources/{resourceId}/experimentation/global-config": redact("Answers the synced Global Config, items included; item values can be secrets.", ["items"]),
+    "HEAD /v1/installations/{integrationConfigurationId}/resources/{resourceId}/experimentation/global-config": safe("Headers only; the heuristic still covers them."),
+    "POST /v1/installations/{integrationConfigurationId}/credentials/revoke": safe(NO_SECRET_REASON),
+    "POST /v1/installations/{integrationConfigurationId}/credentials/rotate": refuse("rotates an installation credential and returns the new access token."),
+    "PUT /v1/installations/{integrationConfigurationId}/resources/{resourceId}/secrets": safe("Answers nothing; secrets are write input only."),
+    "POST /v1/integrations/sso/token": refuse("exchanges an integration SSO code for access, ID, and refresh tokens."),
+    "POST /v1/kms/issuers/{issuerId}/keys": safe("Answers public key material and key metadata; private keys stay with Vercel."),
+    "POST /v1/kms/issuers/{issuerId}/keys/{keyId}/activate": safe("Answers key metadata."),
+    "POST /v1/kms/issuers/{issuerId}/keys/{keyId}/revoke": safe("Answers issuer metadata; tokenClaims are policy, not tokens."),
+    "POST /v1/kms/issuers/{issuerId}/sign/message": refuse("signs a message with the issuer's private key, acting as the organization."),
+    "POST /v1/kms/issuers/{issuerId}/sign/token": refuse("signs a token with the issuer's private key."),
+    "GET /v1/microfrontends/groups/{groupId}/projects": redact(PROJECT_REASON, under(["projects[]"], PROJECT), under(["projects[]"], PROJECT_ALLOW)),
+    "POST /v1/projects/traces/session": refuse("mints a trace session token for a deployment."),
+    "POST /v1/projects/{idOrName}/avatar": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "DELETE /v1/projects/{idOrName}/avatar": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "DELETE /v1/projects/{idOrName}/env": redact(ENV_REASON, PROJECT_ENV),
+    "GET /v1/projects/{idOrName}/env/{id}": refuse("returns one environment variable's decrypted value. Read its metadata with list_project_env_vars."),
+    "PATCH /v1/projects/{idOrName}/protection-bypass": refuse("generates Protection Bypass for Automation secrets."),
+    "POST /v1/projects/{idOrName}/token": refuse("mints a project OIDC token."),
+    "GET /v1/projects/{projectIdOrName}/feature-flags/sdk-keys": safe("Lists SDK key metadata with masked partialKeyValue."),
+    "PUT /v1/projects/{projectIdOrName}/feature-flags/sdk-keys": refuse("mints a Flags SDK key and returns it in cleartext."),
+    "DELETE /v1/projects/{projectIdOrName}/feature-flags/sdk-keys/{hashKey}": safe(NO_SECRET_REASON),
+    "PATCH /v1/projects/{projectId}/microfrontends": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "GET /v1/projects/{projectId}/routes": redact(ROUTE_REASON, under(["routes[].route"], ROUTE_TRANSFORMS)),
+    "POST /v1/projects/{projectId}/routes": redact(ROUTE_REASON, under(["route.route"], ROUTE_TRANSFORMS)),
+    "POST /v1/projects/{projectId}/routes/generate": redact(ROUTE_REASON, [
+        ...under(["route"], ROUTE_TRANSFORMS),
+        "route.actions[].headers[].value",
+        "route.conditions[?header].value",
+    ]),
+    "PATCH /v1/projects/{projectId}/routes/{routeId}": redact(ROUTE_REASON, under(["route.route"], ROUTE_TRANSFORMS)),
+    "GET /v1/registrar/domains/{domain}/auth-code": refuse("returns the domain's transfer authorization code, which lets its holder move the domain to another registrar."),
+    "GET /v1/security/firewall/bypass": safe("IP bypass rules are firewall configuration: addresses, not secrets."),
+    "POST /v1/security/firewall/bypass": safe("IP bypass rules are firewall configuration."),
+    "DELETE /v1/security/firewall/bypass": safe("IP bypass rules are firewall configuration."),
+    "GET /v1/security/firewall/config": redact(FIREWALL_REASON, under(["active", "draft", "versions[]"], FIREWALL)),
+    "PUT /v1/security/firewall/config": redact(FIREWALL_REASON, under(["active", "draft", "versions[]"], FIREWALL)),
+    "POST /v1/security/firewall/config/generate-rule": redact(FIREWALL_REASON, under(["rule"], FIREWALL_CONDITIONS)),
+    "GET /v1/security/firewall/config/{configVersion}": redact(FIREWALL_REASON, FIREWALL),
+    "POST /v1/security/firewall/config/{configVersion}/activate": redact(FIREWALL_REASON, FIREWALL),
+    "POST /v1/storage/stores/integration/direct": safe("store.secrets lists secret names and lengths, never values.", [
+        "store.secrets",
+        "store.secretRotationRequestedBy",
+        "store.secretRotationRequestedReason",
+    ]),
+    "GET /v1/vcr/repository/{idOrName}/images/{imageIdOrDigest}": redact("Image layer environment entries are build-time NAME=value pairs.", ["image.layers[].env"]),
+    "GET /v10/projects": redact(PROJECT_REASON, under(["projects[]", "[]"], PROJECT), under(["projects[]", "[]"], PROJECT_ALLOW)),
+    "GET /v10/projects/{idOrName}/env": refuse("returns environment values beside their metadata. Use list_project_env_vars, which never decrypts or returns a value."),
+    "POST /v10/projects/{idOrName}/env": redact(ENV_REASON, [
+        "created.value",
+        "created.vsmValue",
+        "created.legacyValue",
+        "created[].value",
+        "created[].vsmValue",
+        "created[].legacyValue",
+        "failed[].error.value",
+    ]),
+    "POST /v11/projects": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "PATCH /v12/deployments/{id}/cancel": redact(DEPLOYMENT_REASON, DEPLOYMENT),
+    "POST /v13/deployments": redact(DEPLOYMENT_REASON, DEPLOYMENT),
+    "GET /v13/deployments/{idOrUrl}": redact(DEPLOYMENT_REASON, DEPLOYMENT),
+    "GET /v2/deployments/{id}/aliases": redact("Aliases carry protection-bypass secrets as map keys.", ["aliases[].protectionBypass@keys"], ["aliases[].protectionBypass"]),
+    "POST /v2/deployments/{id}/aliases": safe("Answers the alias assignment."),
+    "GET /v2/user": safe("ipBypass lists firewall IP rules, not secrets.", ["user.resourceConfig.security.ipBypass"]),
+    "PATCH /v3/domains/{domain}": redact("A move-out answers a transfer token; Connecta refuses move-out by body, and redacts any token.", ["token"]),
+    "GET /v3/events": redact("Audit events carry environment variables (with or without key or type) and credential metadata in payloads.", [
+        "events[].payload.newEnvVar.value",
+        "events[].payload.oldEnvVar.value",
+        "events[?env].payload.value",
+        "events[?env].payload.vsmValue",
+        "events[].payload.apiKey",
+        "events[].payload.credential",
+        "events[].payload.inviteCode",
+        "events[].payload.gitCredentialSource",
+    ]),
+    "POST /v3/user/tokens": refuse("mints a Vercel access token."),
+    "DELETE /v3/user/tokens/{tokenId}": safe(NO_SECRET_REASON),
+    "GET /v4/aliases": redact("Aliases carry protection-bypass secrets as map keys.", ["aliases[].protectionBypass@keys"], ["aliases[].protectionBypass"]),
+    "GET /v4/aliases/{idOrAlias}": redact("Aliases carry protection-bypass secrets as map keys.", ["protectionBypass@keys"], ["protectionBypass"]),
+    "GET /v5/user/tokens/{tokenId}": safe("Answers token metadata (`token` is an object of ids, prefix, suffix, and scopes).", ["token"]),
+    "GET /v6/user/tokens": safe("Lists token metadata, never token values.", ["tokens"]),
+    "GET /v9/projects/{idOrName}": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "PATCH /v9/projects/{idOrName}": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "PATCH /v9/projects/{idOrName}/env/{id}": redact(ENV_REASON, PROJECT_ENV),
+    "DELETE /v9/projects/{idOrName}/env/{id}": redact(ENV_REASON, PROJECT_ENV),
+    // Flagged by description or a transfer/claim/invite family (round 3).
+    "POST /projects/{idOrName}/transfer-request": refuse("returns a code that lets another team claim the project for 24 hours."),
+    "PUT /projects/transfer-request/{code}": safe("Accepts a transfer with a code the caller holds; answers transfer results."),
+    "GET /ai-gateway/virtual-model-configs": safe(MODEL_CONFIG),
+    "POST /ai-gateway/virtual-model-configs": safe(MODEL_CONFIG),
+    "PATCH /ai-gateway/virtual-model-configs": safe(MODEL_CONFIG),
+    "GET /ai-gateway/virtual-model-configs/list": safe(MODEL_CONFIG),
+    "GET /ai-gateway/virtual-model-configs/{vmcSlug}": safe(MODEL_CONFIG),
+    "PATCH /ai-gateway/virtual-model-configs/{vmcSlug}": safe(MODEL_CONFIG),
+    "GET /v1/ai-gateway/routers": safe(MODEL_CONFIG),
+    "POST /storage/stores/blob": safe("store.kind names the store type; no token is returned."),
+    "GET /storage/stores/{id}": safe("A store's metadata; projectsMetadata lists environment variable names, not values."),
+    "GET /v1/installations/{integrationConfigurationId}/resources/{resourceId}": safe("customClaims are OIDC claim configuration, not tokens."),
+    "GET /v1/integrations/configuration/{id}/products": redact("protocols.authentication describes supported auth flows, not credentials; a product's log and trace drain protocols carry destination headers.", [
+        "products[].protocols.logDrain.headers{}",
+        "products[].protocols.traceDrain.headers{}",
+        "origin:products[].protocols.logDrain.endpoint",
+        "origin:products[].protocols.traceDrain.endpoint",
+    ]),
+    "GET /v1/kms/issuers": safe(KMS_POLICY),
+    "POST /v1/kms/issuers": safe(KMS_POLICY),
+    "GET /v1/kms/issuers/{issuerId}": safe(KMS_POLICY),
+    "PATCH /v1/kms/issuers/{issuerId}": safe(KMS_POLICY),
+    "POST /v1/kms/issuers/{issuerId}/policies": safe(KMS_POLICY),
+    "PATCH /v1/kms/issuers/{issuerId}/policies/{kind}/{policyKey}": safe(KMS_POLICY),
+    "GET /v1/registrar/domains/{domain}/transfer": safe("Answers a transfer-in status only."),
+    "POST /v1/registrar/domains/{domain}/transfer": safe("Answers an order id; the auth code is request input only."),
+    "DELETE /v1/teams/{teamId}/invites/{inviteId}": safe(NO_SECRET_REASON),
+    "GET /v2/teams": redact(TEAM_INVITE, ["teams[].inviteCode"]),
+    "GET /v2/teams/{teamId}": redact(TEAM_INVITE, ["inviteCode"]),
+    "PATCH /v2/teams/{teamId}": redact(TEAM_INVITE, ["inviteCode"]),
+    "GET /v3/teams/{teamId}/members": safe("emailInviteCodes lists pending invitations (email, role, expiry) without codes.", ["emailInviteCodes"]),
+    "POST /v2/teams/{teamId}/members": safe("Answers the invited email, role, and permissions; no invite link or code."),
+    "POST /v7/domains": safe("Answers the added domain's metadata."),
+    "POST /v9/domains/{domain}/claim": safe("Claims by verified TXT record and answers domain metadata; issues nothing."),
+};
+/**
+ * Vercel's reviewed table. Environment-variable endpoints answer bodies that
+ * are environment variables whether or not each carries a `key`, so their
+ * values go whole; `permissions` maps list action scopes under resource
+ * names, which the heuristic leaves.
+ */
+export const VERCEL_VALUE_SAFETY = {
+    title: "Vercel",
+    operations: VALUE_SAFETY,
+    envBodies: /^\/v\d+\/(?:env(?:\/|$)|projects\/\{[^}]+\}\/env(?:\/|$))/,
+    scopeMaps: ["permissions"],
+    fields: Object.fromEntries([
+        ["env", "Environment names and variable-name lists; values inside environment containers go structurally."],
+        ["environments", "Environment slugs or ids a policy or variable applies to."],
+        ["environmentVariables", "Environment variable names a store connects, never values."],
+        ["type", "A variable's or record's type (plain, encrypted, sensitive, secret)."],
+        ["visibility", "A variable's visibility setting."],
+        ["keys", "Rate-limit key kinds (ip, ja4) and changed variable names."],
+        ["logHeaders", "Header names a firewall rule logs."],
+        ["log_headers", "Header names the firewall logs."],
+        ["signingKeys", "KMS signing key metadata and public key material; private keys stay with Vercel."],
+        ["bindings", "Service-to-service binding names and targets."],
+        ["canaryResponseHeader", "Whether a canary response sets a header; a boolean."],
+        ["inferenceRegion", "An AI Gateway routing region."],
+        ["providerTimeouts", "Provider timeouts in milliseconds."],
+        ["redirectUri", "A connector's registered OAuth redirect URI, public by design."],
+        ["supportsRevocation", "Whether a connector can revoke tokens; a boolean."],
+        ["claims", "OIDC claim matchers a policy requires, not tokens."],
+        ["customClaims", "OIDC claim configuration, not tokens."],
+        ["limited", "Whether a record is limited by the token's privileges; a boolean."],
+        ["enforced", "Whether SAML is enforced; a boolean."],
+        ["kind", "A store or record kind."],
+        ["budget", "An AI Gateway key's spend budget."],
+        ["origin", "How a token was issued (manual, oauth)."],
+        ["scope", "A token's scope (user, team, project)."],
+        ["issuedBefore", "A revocation cutoff timestamp."],
+        ["issuerUrl", "The OIDC issuer URL, public by design."],
+        ["oidcSubject", "The OIDC subject claim, an identifier."],
+        ["next", "A pagination cursor; it grants nothing."],
+        ["partialKeyValue", "A masked SDK key preview."],
+        ["appUrlRegistrationSupport", "Whether a partner accepts app URLs; a boolean."],
+        ["disjunctiveProductionSecretPolicy", "A team policy setting."],
+        ["sensitiveEnvironmentVariablePolicy", "A team policy setting."],
+        ["strictPasswordProtectionSettings", "A team policy setting."],
+    ].map(([name, reason]) => [name, { verdict: "keep", reason }])),
+};

package/dist/providers/wispr-flow/index.d.ts

@@ -0,0 +1,14 @@
+import { type RemoteMcpAuth } from "../../connectors/remote-mcp.js";
+import { type ProviderOptions } from "../../provider.js";
+/** Wispr Flow's hosted Streamable HTTP endpoint, without a trailing slash. */
+export declare const WISPR_FLOW_MCP_ENDPOINT = "https://api.wisprflow.ai/connect/mcp";
+type WisprFlowOAuth = Extract<RemoteMcpAuth, {
+    type: "oauth";
+}>;
+export interface WisprFlowOptions extends ProviderOptions {
+    /** OAuth only; defaults to browser authorization with the advertised scopes. */
+    auth?: WisprFlowOAuth;
+}
+/** A maintained Wispr Flow Notetaker hosted-MCP connection. */
+export declare const wisprFlow: import("../../provider.js").ProviderFactory<WisprFlowOptions>;
+export {};

package/dist/providers/wispr-flow/index.js

@@ -0,0 +1,117 @@
+import { remoteMcp } from "../../connectors/remote-mcp.js";
+import { keys, optionsOf, variants } from "../../config-schema.js";
+import { defineProvider, PROVIDER_COMMON } from "../../provider.js";
+import { skill } from "./skill.generated.js";
+/** Wispr Flow's hosted Streamable HTTP endpoint, without a trailing slash. */
+export const WISPR_FLOW_MCP_ENDPOINT = "https://api.wisprflow.ai/connect/mcp";
+/**
+ * Reviewed public-source superset, 2026-10-13. Scalekit documents 14 reads;
+ * Claude's connector directory adds four task tools. Wispr's own help page
+ * describes read-only access, so the task writes remain classified even if
+ * this account never exposes them. No authenticated catalog or schemas were
+ * captured. Vendor names, schemas and results remain live.
+ */
+const CLASSIFICATION = {
+    tools: {
+        get_account_info: { verdict: "read", reason: "Returns the signed-in identity and calendar display-name aliases." },
+        get_calendar_event: { verdict: "read", reason: "Retrieves an existing calendar event and its attendees." },
+        get_meeting: {
+            verdict: "read",
+            reason: "Retrieves recorded notes, the summary, attendees and requested transcript ranges.",
+        },
+        get_meeting_by_calendar_id: {
+            verdict: "read",
+            reason: "Finds the existing recording linked to a calendar event and reads its content.",
+        },
+        get_meeting_participants_enriched: {
+            verdict: "read",
+            reason: "Reads participant information and identifies the signed-in attendee.",
+        },
+        get_scratchpad_note: { verdict: "read", reason: "Returns a bounded range of an existing Scratchpad note." },
+        get_upcoming_meeting: {
+            verdict: "read",
+            reason: "Reads an upcoming event and an available pre-read without generating one.",
+        },
+        list_meeting_series: {
+            verdict: "read",
+            reason: "Lists recorded occurrences of an existing recurring meeting series.",
+        },
+        list_upcoming_meetings: {
+            verdict: "read",
+            reason: "Lists upcoming calendar events and already-available pre-reads.",
+        },
+        resolve_calendar_link: {
+            verdict: "read",
+            reason: "Matches a pasted calendar or conference URL to an existing event.",
+        },
+        resolve_share_link: {
+            verdict: "read",
+            reason: "Reads an accessible shared note without creating a link or changing sharing permissions.",
+        },
+        search_calendar_events: { verdict: "read", reason: "Finds existing calendar events by date, attendees or text." },
+        search_meetings: {
+            verdict: "read",
+            reason: "Finds recorded meetings by title, summary, notes, dates or linked attendees.",
+        },
+        search_scratchpad_notes: { verdict: "read", reason: "Finds existing Scratchpad notes by text." },
+        get_task: { verdict: "read", reason: "Retrieves an existing task without changing its state." },
+        search_tasks: { verdict: "read", reason: "Finds existing tasks without changing them." },
+        add_task: {
+            verdict: "write",
+            reason: "Creates a new task; the reviewed operation appends rather than replacing an existing task.",
+        },
+        update_task: { verdict: "destructive", reason: "Changes the state or fields of an existing task." },
+    },
+};
+const OPTIONS = optionsOf()({
+    ...PROVIDER_COMMON,
+    auth: variants("type", {
+        oauth: optionsOf()({
+            ...keys("type", "clientMetadataUrl", "scope"),
+            client: optionsOf()(keys("issuer", "clientId", "clientSecret", "tokenEndpointAuthMethod")),
+        }).shape,
+    }),
+});
+function accountSummary(purpose) {
+    const summary = `Account-wide Notetaker access: ${purpose}`;
+    const bytes = new TextEncoder().encode(summary);
+    if (bytes.byteLength <= 120)
+        return summary;
+    // Streaming decode drops an incomplete final code point; reserve three bytes for the ellipsis.
+    return `${new TextDecoder().decode(bytes.subarray(0, 117), { stream: true }).trimEnd()}…`;
+}
+/** A maintained Wispr Flow Notetaker hosted-MCP connection. */
+export const wisprFlow = defineProvider({
+    name: "wispr-flow",
+    title: "Wispr Flow",
+    kind: "mcp",
+    readme: "Wispr Flow",
+    skill,
+    classify: CLASSIFICATION,
+    options: OPTIONS,
+    bundle: {
+        baselineGzip: 169009,
+        maxGzip: 229009,
+        note: "./providers/wispr-flow initial measured baseline is 169,009 B gzip for the hosted-MCP wrapper; the cap retains the existing baseline + 60,000 B provider headroom policy.",
+    },
+    create(id, options, provider) {
+        const ownership = options.authScope === "personal"
+            ? "Each person authorizes separately and may reach a different account."
+            : "One shared authorization selects the account for everyone using this connector.";
+        return remoteMcp(id, {
+            url: WISPR_FLOW_MCP_ENDPOINT,
+            ...provider.connectorOptions,
+            title: options.title ?? "Wispr Flow",
+            description: `Wispr Flow Notetaker meetings, Scratchpad notes, calendar events and tasks: ${options.purpose}`,
+            auth: { type: "oauth", scope: "openid offline_access", ...options.auth },
+            requireHttps: true,
+            classify: provider.classify,
+            usageGuide: provider.usageGuide({
+                context: [
+                    `Account-wide Notetaker access: ${options.purpose}. Personal and work accounts hold separate content. ${ownership} Confirm the identity with get_account_info. Dictation history and Notetaker chat history are unavailable.`,
+                ],
+                summary: accountSummary(options.purpose),
+            }),
+        });
+    },
+});

package/dist/providers/wispr-flow/skill.generated.js

@@ -0,0 +1,8 @@
+// Generated by scripts/generate-providers.mjs; do not edit.
+export const skill = {
+    "content": "- This connection reaches Notetaker meetings, summaries, notes, transcripts, participants and their email addresses, and tasks; Scratchpad notes; calendar events and linked recordings; upcoming meetings with available pre-reads; recurring series; accessible shared notes; and account identity. Meeting results name folders you own or that are shared with you; meetings outside folders list none. Another account needs another authorization. Use `get_account_info` to check which identity this grant reaches.\n- OAuth browser authorization is the only supported auth method. There is no API key. Prefer Google, Apple, Microsoft or enterprise SSO and finish sign-in within about five minutes. Email-and-password sign-in may not complete authorization; Wispr's help pages disagree. Consent covers the account's existing content, without per-meeting consent.\n- Search first, then retrieve by the returned id: `search_meetings` → `get_meeting`, `search_scratchpad_notes` → `get_scratchpad_note`, or `search_calendar_events` → `get_calendar_event`. Resolve pasted URLs with `resolve_calendar_link` or `resolve_share_link` instead of guessing ids. Use `get_meeting_by_calendar_id` for the recording linked to an event; an event without a recording is not missing meeting content. `get_upcoming_meeting` is for future events. For `list_meeting_series`, \"no earlier occurrence\" can mean a one-off meeting or a recording without a linked calendar event, not a failure.\n- `search_meetings` matches titles, summaries and notes, not transcripts. Set `field` to `title`, `content` or `both`; use `query`, `since` and `until` to narrow the request. `attendee_emails` with `attendee_match` set to `any` or `all` only finds recordings linked to calendar events. A missing attendee-filter match does not prove a person never attended. Results include an excerpt and up to five attendees; retrieve the meeting for full content and attendees.\n- List and search tools page with `cursor` and `limit`, normally 25 items and at most 200. Pass the returned `next_cursor` verbatim while `has_more` is true. `list_upcoming_meetings` allows at most 50 items and `window_hours` defaults to 24 with a maximum of 168. A `truncated` result needs a narrower query, even after paging. Reduce results inside `execute_code` before returning them.\n- Notes and transcripts are character-bounded. Read the continuation marker and repeat with `view_content.start_char` or `view_transcript.start_char` set to its exact offset. Request `view_transcript: {}` when source detail matters, then continue through the required ranges. Enterprise note and transcript reads are recorded in audit logs; do not read transcripts speculatively. Summaries are complete. Transcript retention deletes transcripts and audio, not summaries; an unavailable transcript may have expired.\n- Shared-note links require your own meeting-access permissions. If a link copied from email is rejected, ask the user to open it in a browser and pass the final Wispr Flow URL. Transcripts require ownership or an explicit email invitation plus the owner's organization allowing transcript sharing. Domain, team or anyone-with-link access yields summaries only. Reauthorization cannot widen those permissions. Return the provided `share_link` when asked for a link; never fabricate one or assume the link changes who can read it.\n- Timestamps are UTC. Present them in the user's time zone. For a whole local day, supply `since` at local midnight with its UTC offset and `until` at the next local midnight; the upper bound is exclusive. Upcoming pre-reads may be absent because the desktop app generates them on demand; these reads do not generate them.\n- Both official help articles describe read-only access and list tasks or action items as readable, while Wispr's own Claude directory listing advertises \"Create, update, and search action items\" and names `add_task` and `update_task`. Discover this account's actual tools before using them. If exposed, `get_task` and `search_tasks` read, `add_task` creates a new task and is a write, and `update_task` changes existing task state and is destructive. Unknown tools without an explicit, uncontradicted read annotation fail closed.\n- Mac and Windows accounts need Notetaker and MCP access. Personal or organization HIPAA BAA coverage removes all MCP tools. Enterprise administrators can disable MCP or require an approved IP network; Scratchpad and cloud-access policies may further restrict results. An empty catalog or policy denial requires checking account access, not repeated authorization.\n- For \"Too many requests\" or repeated searches that temporarily fail without explanation, wait about one minute before retrying and avoid speculative fan-out. There is no maintained per-runtime admission default; the operator may configure `callAdmission` for this deployment.\n- An `auth_required` failure means this connector's Wispr Flow authorization is missing or expired: run `authorize_connector` for this connector id, then retry the same call unchanged. For guest calls, classification and routing, fetch `skills({ name: \"usage\" })`.\n",
+    "instructionsHeading": "Account instructions",
+    "fragments": {
+        "content": "- This connection reaches Notetaker meetings, summaries, notes, transcripts, participants and their email addresses, and tasks; Scratchpad notes; calendar events and linked recordings; upcoming meetings with available pre-reads; recurring series; accessible shared notes; and account identity. Meeting results name folders you own or that are shared with you; meetings outside folders list none. Another account needs another authorization. Use `get_account_info` to check which identity this grant reaches.\n- OAuth browser authorization is the only supported auth method. There is no API key. Prefer Google, Apple, Microsoft or enterprise SSO and finish sign-in within about five minutes. Email-and-password sign-in may not complete authorization; Wispr's help pages disagree. Consent covers the account's existing content, without per-meeting consent.\n- Search first, then retrieve by the returned id: `search_meetings` → `get_meeting`, `search_scratchpad_notes` → `get_scratchpad_note`, or `search_calendar_events` → `get_calendar_event`. Resolve pasted URLs with `resolve_calendar_link` or `resolve_share_link` instead of guessing ids. Use `get_meeting_by_calendar_id` for the recording linked to an event; an event without a recording is not missing meeting content. `get_upcoming_meeting` is for future events. For `list_meeting_series`, \"no earlier occurrence\" can mean a one-off meeting or a recording without a linked calendar event, not a failure.\n- `search_meetings` matches titles, summaries and notes, not transcripts. Set `field` to `title`, `content` or `both`; use `query`, `since` and `until` to narrow the request. `attendee_emails` with `attendee_match` set to `any` or `all` only finds recordings linked to calendar events. A missing attendee-filter match does not prove a person never attended. Results include an excerpt and up to five attendees; retrieve the meeting for full content and attendees.\n- List and search tools page with `cursor` and `limit`, normally 25 items and at most 200. Pass the returned `next_cursor` verbatim while `has_more` is true. `list_upcoming_meetings` allows at most 50 items and `window_hours` defaults to 24 with a maximum of 168. A `truncated` result needs a narrower query, even after paging. Reduce results inside `execute_code` before returning them.\n- Notes and transcripts are character-bounded. Read the continuation marker and repeat with `view_content.start_char` or `view_transcript.start_char` set to its exact offset. Request `view_transcript: {}` when source detail matters, then continue through the required ranges. Enterprise note and transcript reads are recorded in audit logs; do not read transcripts speculatively. Summaries are complete. Transcript retention deletes transcripts and audio, not summaries; an unavailable transcript may have expired.\n- Shared-note links require your own meeting-access permissions. If a link copied from email is rejected, ask the user to open it in a browser and pass the final Wispr Flow URL. Transcripts require ownership or an explicit email invitation plus the owner's organization allowing transcript sharing. Domain, team or anyone-with-link access yields summaries only. Reauthorization cannot widen those permissions. Return the provided `share_link` when asked for a link; never fabricate one or assume the link changes who can read it.\n- Timestamps are UTC. Present them in the user's time zone. For a whole local day, supply `since` at local midnight with its UTC offset and `until` at the next local midnight; the upper bound is exclusive. Upcoming pre-reads may be absent because the desktop app generates them on demand; these reads do not generate them.\n- Both official help articles describe read-only access and list tasks or action items as readable, while Wispr's own Claude directory listing advertises \"Create, update, and search action items\" and names `add_task` and `update_task`. Discover this account's actual tools before using them. If exposed, `get_task` and `search_tasks` read, `add_task` creates a new task and is a write, and `update_task` changes existing task state and is destructive. Unknown tools without an explicit, uncontradicted read annotation fail closed.\n- Mac and Windows accounts need Notetaker and MCP access. Personal or organization HIPAA BAA coverage removes all MCP tools. Enterprise administrators can disable MCP or require an approved IP network; Scratchpad and cloud-access policies may further restrict results. An empty catalog or policy denial requires checking account access, not repeated authorization.\n- For \"Too many requests\" or repeated searches that temporarily fail without explanation, wait about one minute before retrying and avoid speculative fan-out. There is no maintained per-runtime admission default; the operator may configure `callAdmission` for this deployment.\n- An `auth_required` failure means this connector's Wispr Flow authorization is missing or expired: run `authorize_connector` for this connector id, then retry the same call unchanged. For guest calls, classification and routing, fetch `skills({ name: \"usage\" })`.\n"
+    }
+};