@zackbart/connecta 0.36.0 → 0.36.1

package/documentation/operator-tests.md

@@ -190,8 +190,17 @@ OAuth provider validates the code exchange and PKCE. Credential Test calls a
 loopback downstream endpoint. Operator APIs, cookie/bearer admission, CSRF,
 assets, handoffs, callbacks, and encrypted storage use production code.
 
-The flows cover Clerk sign-in/reload/sign-out; OAuth connect/consent/callback/
-connected reread/reload; and credential save/test/replace/remove. They collect
+The flows use a real SQLite file and cover Clerk sign-in/reload/sign-out,
+actual Settings provenance and asset cache validators; OAuth
+connect/consent/callback/connected reread/disconnect; and credential
+save/test/replace/remove. They close and reopen the app, database and vault
+before rereading OAuth and credential state. A rejected SQL replacement leaves
+the previous secret usable downstream after restart. Trigger rows read from an
+independent SQL connection require one save, one replacement and one removal;
+reads and the rejected save commit no credential writes. Actual MCP calls
+check that credential edits preserve a reader pool's read access and refusal. Activity renders
+successful calls recorded before the SQLite restart without exposing either
+credential value. They collect
 CSP violations across every document and popup, and fail on unexpected network
 traffic. No credentials enter visual fixtures or screenshot baselines.
 

package/documentation/operator-ui.md

@@ -644,8 +644,7 @@ and each personal connector's exact `manage`;
 The Overview's map and attention rows are pure functions of the contract in
 [connection-map.ts](https://github.com/zackbart/connecta/blob/main/src/operator-ui/connection-map.ts)
 and [overview.ts](https://github.com/zackbart/connecta/blob/main/src/operator-ui/overview.ts),
-covered by `test/operator-connection-map.test.ts` and
-`test/operator-overview.test.ts`; `src/operator-ui/styles/overview.css` holds
+exercised in Chromium by `test/browser/operator-overview.spec.ts`; `src/operator-ui/styles/overview.css` holds
 the page's styles.
 
 `src/operator-ui/config-summary.ts` maps the snapshot and its provenance to

package/documentation/providers.md

@@ -7,6 +7,95 @@ roster](./integrating.md#add-or-remove-a-connector) covers the general
 procedure and the providers not listed here. Agent guidance for each
 provider ships with its connection's usage guide, not here.
 
+## Granola
+
+```ts
+import { granola } from "@zackbart/connecta/providers/granola";
+
+const notes = granola("granola", { purpose: "Shared workspace meeting notes" });
+```
+
+Use a **workspace API key**, created by a Business or Enterprise workspace
+admin in Granola desktop Settings → Connectors → Workspace API keys → Create
+new key. Save it in this connection's credential slot through the operator UI;
+configure an encrypted vault as described in [shared credentials](./auth.md#connect-a-shared-credential).
+The shared, single-secret field is `value`. The provider fixes the origin to
+`https://public-api.granola.ai`, uses bearer authentication, and exposes reads
+only. It accepts `purpose`, optional `title`, `instructions`, and
+`maxResultBytes` and the common `readOnly` restriction. Even `readOnly: false`
+exposes only the five reviewed reads; it accepts no inline secret, origin override, personal auth
+scope, or option enabling writes.
+
+Workspace keys belong to the workspace, survive their creator leaving and do
+not expire; an admin can revoke them. They reach public notes and spaces with
+Granola API access enabled. For an existing space an admin uses Integrations →
+Granola API → Allow access with a workspace API key. Folders inherit the space
+setting. Workspace ownership does not grant unrelated private notes or the
+owner's private handwritten notes. Discover accessible IDs before filtering.
+Only notes with a generated summary and transcript are returned; a 404 does
+not prove absence. A successful credential test confirms accessible spaces,
+not the key's ownership type or access to every meeting. Granola enforces
+these permissions; Connecta cannot infer workspace versus personal key type
+from the secret. Do not substitute a personal API key or MCP OAuth token.
+
+The REST surface is `granola_api_search`, `granola_api_details`, and
+`granola_api_read`. Search discovers API operations, not meeting content.
+Reads cover `/v1/notes`, `/v1/notes/{note_id}`,
+`/v1/notes/{note_id}/transcript`, `/v1/folders`, and `/v1/spaces`. Use API IDs
+(`not_`, `fol_`, `spa_`), not UUIDs copied from web links. Date/folder/space
+filters and response `fields` narrowing follow the reviewed operation details.
+Audit, legal holds, webhook management and writes are refused, even if their
+contracts appear in operation discovery.
+
+Omit `query.cursor` on the first read. Continue with `page.nextCursor` as the
+top-level `cursor`, retaining the path and query filters. Continuations are
+bound to that request and are not raw Granola tokens. The vendor uses
+`query.page_size`: notes/folders/spaces default to 10 with maximum 30;
+transcripts default to 50 with maximum 100. Empty pages can have more data.
+No total count is inferred. HTTP 413 when using `include: "transcript"`
+requires a new note-detail read without include and paged transcript reads;
+the provider sends no hidden fallback requests. Photo download URLs grant
+unauthenticated access and are always withheld. Meeting text and sent
+credentials cross the same value-safety boundary before selection or paging.
+
+Granola documents 25 requests per 5-second burst and 5 requests/second
+sustained, shared across the workspace key's scope. The default per-runtime
+admission is 25 calls in a rolling 5-second window with concurrency 2. Other
+processes and integrations share the vendor allowance; the local counter
+cannot enforce a workspace-wide limit. A 429 returns `rate_limited` and
+Retry-After when supplied (otherwise a 5-second hint); calls are not retried
+automatically. Requests have a 30-second deadline and 4 MiB response ceiling.
+Oversized responses fail without presenting a partial success; inline result
+cuts retain the standard `truncated` paths.
+
+For hosted Granola MCP, use a distinct generic `remoteMcp()` connection to
+`https://mcp.granola.ai/mcp` with its user OAuth or enterprise-managed
+authorization. Granola MCP does not accept workspace API keys or service
+accounts. Its natural-language search is not a REST-provider capability.
+See [Granola's workspace-key guide](https://docs.granola.ai/help-center/sharing/integrations/granola-api#workspace-api-keys)
+and [API overview](https://docs.granola.ai/introduction).
+
+### Migrate a deployment-local Granola API adapter
+
+Replace the local `api("granola", …)` construction with
+`granola("granola", { purpose: "Shared workspace meeting notes" })`, retaining
+the same encrypted vault, encryption key, connector ID, shared owner and
+single-secret `value` field. The provider reuses that credential without
+copying it. Existing addresses `granola.granola_api_search`,
+`granola.granola_api_details`, and `granola.granola_api_read` remain stable.
+Keep existing pool references to `granola`. A differently named or personal
+credential field requires the operator to save a workspace key in the shared
+slot; do not read out or copy stored secrets through an agent.
+
+Compare local argument contracts before replacing the factory: the maintained
+search is operation discovery, details uses an indexed operation, and read
+uses a relative path and query. Replace raw `query.cursor` continuations with
+the bound top-level `cursor`, and start new pagination sequences after the
+upgrade. Responses use `{ status, data, page? }`. Remove local write tools or
+natural-language-search assumptions; do not keep duplicate factories with the
+same connector ID. If a local adapter used other tool names, update its
+callers explicitly. No data migration or downstream write is required.
+
 ## API sources and tool inventory
 
 Maintained providers pair reviewed API contracts and indexes with Connecta's
@@ -143,6 +232,20 @@ discovery for your deployment's catalog.
 
 </details>
 
+<details>
+<summary>Granola (3 tools)</summary>
+
+[Setup](#granola). **API source:** [Upstream OpenAPI](https://docs.granola.ai/api-reference/openapi.json).
+
+- **Named reads:** None.
+- **Named writes:** None.
+- **API reads:** `granola_api_details`, `granola_api_read`, `granola_api_search`.
+- **API writes:** None.
+
+**Contributor evidence (optional):** [contracts, adapters and review](https://github.com/zackbart/connecta/tree/main/src/providers/granola).
+
+</details>
+
 <details>
 <summary>Overflow (17 tools)</summary>
 
@@ -1318,6 +1421,13 @@ would change existing payment settings. Deletes, voids, delivery, payment
 execution, batch and other accounting writes remain unavailable. The API hatch
 refuses POSTs even when named writes are enabled.
 
+Sparse field preservation, a current SyncToken and requestid do not establish
+that an invoice update cannot send email. For example, changing only DueDate
+on an invoice with NeedToSend and enabled card/ACH payments retains those
+settings; omitting email fields does not disable them. Do not reset delivery or
+payment settings to work around the unavailable update, or replace the invoice
+with a new one. No unsent-only update tool is currently exposed either.
+
 Each write requires `requestId`, a stable identifier for the exact intent,
 unique across all requests/tools for this company: 1–50 ASCII letters, digits,
 underscores or hyphens, beginning with a letter or digit. It is sent as Intuit's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of six meta-tools.",
@@ -107,6 +107,10 @@
       "types": "./dist/providers/gmail/index.d.ts",
       "import": "./dist/providers/gmail/index.js"
     },
+    "./providers/granola": {
+      "types": "./dist/providers/granola/index.d.ts",
+      "import": "./dist/providers/granola/index.js"
+    },
     "./providers/overflow": {
       "types": "./dist/providers/overflow/index.d.ts",
       "import": "./dist/providers/overflow/index.js"
@@ -191,7 +195,7 @@
     "preeval:outcomes": "node scripts/generate-version.mjs && pnpm run build:operator-ui",
     "eval:perf": "tsx eval/run-perf.ts",
     "eval:report": "tsx eval/report.ts",
-    "check:static": "node --test scripts/check-provider-exemptions.test.mjs && pnpm run format:check && pnpm run check:providers-generated && pnpm run check:docs && pnpm run check:changes && pnpm run check:operator-ui && pnpm run check:clerk-sdk && pnpm run check:lint && pnpm run check:unused && pnpm run typecheck",
+    "check:static": "pnpm run format:check && pnpm run check:providers-generated && pnpm run check:docs && pnpm run check:changes && pnpm run check:operator-ui && pnpm run check:clerk-sdk && pnpm run check:lint && pnpm run check:unused && pnpm run typecheck",
     "check:build": "pnpm run build && pnpm run check:declarations && pnpm run check:bundle",
     "check:fast": "pnpm run check:static && vitest run --config vitest.config.node.ts --changed origin/main --passWithNoTests",
     "check": "pnpm run check:static && pnpm run test && pnpm run check:build",

package/templates/node/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.12.0",
-    "@zackbart/connecta": "0.36.0",
+    "@zackbart/connecta": "0.36.1",
     "quickjs-emscripten": "0.32.0",
     "undici": "6.29.1"
   },