@zackbart/connecta 0.36.0 → 0.36.2

package/dist/providers/cloudflare/api.js

@@ -157,7 +157,7 @@ export const UPLOADS = [
  * pin, zone creation must name a pinned account, and the rest is public data.
  * Every other unscoped operation is refused under a pin (default deny).
  */
-export const PIN_SAFE_UNSCOPED = new Set([
+const PIN_SAFE_UNSCOPED = new Set([
     "GET /user",
     "GET /user/tokens/verify",
     "GET /accounts",
@@ -177,7 +177,7 @@ export const PIN_SAFE_UNSCOPED = new Set([
     "POST /graphql",
 ]);
 /** Why each family of unscoped operations is refused under a pin; `test` checks every one is covered. */
-export const PIN_REFUSED_UNSCOPED = {
+const PIN_REFUSED_UNSCOPED = {
     accounts: "creates or moves accounts outside the pin",
     analytics: "queries datasets across every account; use POST /accounts/{account_tag}/analytics/sql",
     api: "is an internal health route",
@@ -445,18 +445,18 @@ export const cloudflareIndex = new CloudflareIndex(cloudflareDiscovery(openapi),
     title: "Cloudflare",
     slashParams: SLASH_PARAMS,
 });
-export const getUser = get("getUser", "/user", { success: Schema.Unknown });
-export const verifyToken = get("verifyToken", "/user/tokens/verify", { success: Schema.Unknown });
-export const verifyAccountToken = get("verifyAccountToken", "/accounts/:account_id/tokens/verify", {
+const getUser = get("getUser", "/user", { success: Schema.Unknown });
+const verifyToken = get("verifyToken", "/user/tokens/verify", { success: Schema.Unknown });
+const verifyAccountToken = get("verifyAccountToken", "/accounts/:account_id/tokens/verify", {
     params: { account_id: Schema.String },
     success: Schema.Unknown,
 });
 const PageQuery = { page: Schema.optionalKey(Integer), per_page: Schema.optionalKey(Integer) };
-export const listAccounts = get("listAccounts", "/accounts", {
+const listAccounts = get("listAccounts", "/accounts", {
     query: { ...PageQuery, name: Schema.optionalKey(Schema.String) },
     success: Schema.Unknown,
 });
-export const listZones = get("listZones", "/zones", {
+const listZones = get("listZones", "/zones", {
     query: {
         ...PageQuery,
         name: Schema.optionalKey(Schema.String),
@@ -465,7 +465,7 @@ export const listZones = get("listZones", "/zones", {
     },
     success: Schema.Unknown,
 });
-export const graphqlQuery = post("graphqlQuery", "/graphql", {
+const graphqlQuery = post("graphqlQuery", "/graphql", {
     payload: Schema.Struct({
         query: Schema.String,
         variables: Schema.optionalKey(Schema.Record(Schema.String, Schema.Unknown)),

package/dist/providers/cloudflare/lib/config.d.ts

@@ -1,7 +1,7 @@
 /** Cloudflare's v4 REST base. Override only for a proxy or a test double. */
 export declare const CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
 /** The two key schemes Cloudflare's v4 API accepts. */
-export type CloudflareKeyAuth = "apiToken" | "globalApiKey";
+type CloudflareKeyAuth = "apiToken" | "globalApiKey";
 /** Accounts and zones a connector may touch; everything else is refused. */
 export interface CloudflarePin {
     accountIds?: readonly string[];
@@ -14,3 +14,4 @@ export interface CloudflareRestOptions {
     zoneId: string | undefined;
     pin: CloudflarePin | undefined;
 }
+export {};

package/dist/providers/docs/api.js

@@ -12,7 +12,7 @@ export const DOCS = {
     notFound: "ambiguous",
 };
 const DocumentId = { documentId: Schema.String };
-export const getDocument = get("getDocument", "/documents/:documentId", {
+const getDocument = get("getDocument", "/documents/:documentId", {
     params: DocumentId,
     query: {
         includeTabsContent: Schema.optionalKey(Schema.String),

package/dist/providers/drive/api.js

@@ -18,7 +18,7 @@ export const DRIVE = {
 };
 const FileId = { fileId: Schema.String };
 const PermissionId = { ...FileId, permissionId: Schema.String };
-export const getFile = get("getFile", "/files/:fileId", { params: FileId, success: Schema.Unknown });
+const getFile = get("getFile", "/files/:fileId", { params: FileId, success: Schema.Unknown });
 const OPERATIONS = [
     get("listFiles", "/files", { success: Schema.Unknown }),
     post("createFile", "/files", { payload: Schema.Unknown, success: Schema.Unknown }),

package/dist/providers/drive/lib/hatch.js

@@ -8,7 +8,7 @@ export const driveIndex = new OperationIndex(openapi, {
     title: "Google Drive",
     pathMatching: "uri-template",
 });
-export const DRIVE_REFUSALS = {
+const DRIVE_REFUSALS = {
     "GET /apps": "This operation has not been admitted to the narrow Drive execution allowlist; use the named file and permission workflows.",
     "GET /apps/{appId}": "This operation has not been admitted to the narrow Drive execution allowlist; use the named file and permission workflows.",
     "GET /changes": "This operation has not been admitted to the narrow Drive execution allowlist; use the named file and permission workflows.",

package/dist/providers/drive/tools.js

@@ -1138,7 +1138,7 @@ function guarded(tool) {
         }),
     };
 }
-export function buildTool(connection, tool) {
+function buildTool(connection, tool) {
     const isRead = tool.annotations.readOnlyHint;
     const isList = ["search_files", "list_folder_items", "list_permissions", "list_shared_drives"].includes(tool.name);
     const output = asRecord(catalogSchema(tool.contract.output, "output"));

package/dist/providers/forms/api.js

@@ -17,7 +17,7 @@ export const FORMS = {
     notFound: "ambiguous",
 };
 const FormId = { formId: Schema.String };
-export const getForm = get("getForm", "/forms/:formId", { params: FormId, success: Schema.Unknown });
+const getForm = get("getForm", "/forms/:formId", { params: FormId, success: Schema.Unknown });
 const OPERATIONS = [
     getForm,
     post("createForm", "/forms", {

package/dist/providers/forms/lib/hatch.js

@@ -15,7 +15,7 @@ export const FORMS_REQUEST_KINDS = [
     "updateFormInfo",
     "updateSettings",
 ];
-export const FORMS_REFUSALS = {
+const FORMS_REFUSALS = {
     "POST /forms/{formId}:setPublishSettings": "Publishing and response availability changes require separate product authorization; the owner can change them in Forms.",
     "POST /forms/{formId}/watches": "Watch registration creates persistent Pub/Sub delivery and requires separate product authorization.",
     "GET /forms/{formId}/watches": "Watch administration is outside this connection; manage watches through the approved operator workflow.",

package/dist/providers/forms/tools.js

@@ -16,7 +16,7 @@ import { googleBatchGuard } from "../_shared/google/hatch.js";
 const MAX_PAGE_SIZE = 100;
 const DEFAULT_PAGE_SIZE = 25;
 /** A listed answer is cut here; get_response returns it whole. */
-export const LIST_ANSWER_CHARS = 2_000;
+const LIST_ANSWER_CHARS = 2_000;
 /** A form or item title or description is cut here in get_form's projection. */
 const DESCRIPTION_CHARS = 2_000;
 /** ...and bounded here in bytes, so escaped control characters cannot grow it. */

package/dist/providers/github/api.js

@@ -13,7 +13,7 @@ import { resultSafety } from "../../http/safety.js";
 import { connect, get, operations } from "../../http/vendor.js";
 const repository = { owner: Schema.String, repo: Schema.String };
 const success = Schema.Unknown;
-export const GitHubApi = indexedVendor("GitHub", githubIndex, [
+const GitHubApi = indexedVendor("GitHub", githubIndex, [
     get("repository", "/repos/:owner/:repo", { params: repository, success }),
 ]);
 function rateLimited(status, retry, remaining) {

package/dist/providers/github/lib/discovery.js

@@ -106,7 +106,7 @@ export const GITHUB_VERDICTS = {
     [MERGE]: "refuse",
     ...Object.fromEntries([...INTERNAL_READS].map((key) => [key, "refuse"])),
 };
-export const GITHUB_NAMED = {
+const GITHUB_NAMED = {
     [MERGE]: "merge_pull_request",
     "GET /installation/repositories": "list_scopes",
     "GET /search/repositories": "search_scoped",
@@ -114,7 +114,7 @@ export const GITHUB_NAMED = {
     "GET /search/code": "search_scoped",
 };
 const adapter = githubPage("https://api.github.com");
-export const GITHUB_PAGES = Object.fromEntries(githubIndex.ops
+const GITHUB_PAGES = Object.fromEntries(githubIndex.ops
     .filter((op) => {
     const key = `${op.method} ${op.path}`;
     return (READ_PERMISSIONS[key] && githubIndex.contract(op).parameters.some((p) => p.in === "query" && p.name === "page"));

package/dist/providers/gmail/api.js

@@ -22,7 +22,7 @@ const Page = {
     maxResults: Schema.optionalKey(Schema.String),
     pageToken: Schema.optionalKey(Schema.String),
 };
-export const listLabels = get("listLabels", "/labels", { success: Schema.Unknown });
+const listLabels = get("listLabels", "/labels", { success: Schema.Unknown });
 const OPERATIONS = [
     get("listThreads", "/threads", {
         query: { ...Page, includeSpamTrash: Schema.optionalKey(Schema.String) },

package/dist/providers/granola/api.js

@@ -0,0 +1,155 @@
+import { Effect, Schema } from "effect";
+import { ConnectorCallError } from "../../errors.js";
+import { Refusal, StatusFailure } from "../../http/errors.js";
+import { Credentials } from "../../http/services.js";
+import { restSafety } from "../../http/safety.js";
+import { get } from "../../http/vendor.js";
+import { indexedVendor } from "../_shared/rest/kit.js";
+import { OperationIndex } from "../_shared/rest/operation-index.js";
+import { valueSafety } from "../_shared/rest/value-safety.js";
+import { openapi } from "./openapi.generated.js";
+import { GRANOLA_VALUE_SAFETY, READS } from "./safety.js";
+export const index = new OperationIndex(openapi, { vendor: "granola", title: "Granola" });
+export const verdicts = Object.fromEntries(index.ops.map((op) => [
+    `${op.method} ${op.path}`,
+    READS.has(`${op.method} ${op.path}`) ? "read" : "refuse",
+]));
+const listSpaces = get("listSpaces", "/v1/spaces", {
+    query: { page_size: Schema.optionalKey(Schema.Number) },
+    success: Schema.Unknown,
+});
+export const GranolaApi = indexedVendor("Granola", index, [listSpaces]);
+const reviewed = valueSafety(GRANOLA_VALUE_SAFETY, () => index);
+export const safety = () => ({
+    reviewed: restSafety(reviewed, index),
+    sensitiveFields: { names: [], choice: "drop" },
+});
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+const printableToken = (value) => /^[!-~]+$/.test(value);
+const page = {
+    param: "cursor",
+    in: "query",
+    decode(cursor) {
+        if (typeof cursor !== "string" ||
+            !cursor.trim() ||
+            [...cursor].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127) ||
+            /^[a-z][a-z0-9+.-]*:/i.test(cursor))
+            throw new ConnectorCallError("invalid_args", "This cursor contains no valid Granola page token.");
+        return cursor;
+    },
+    next(data) {
+        const body = object(data);
+        if (body.hasMore === false && (body.cursor === null || body.cursor === undefined))
+            return null;
+        if (body.hasMore === true && typeof body.cursor === "string" && body.cursor.trim()) {
+            try {
+                return page.decode(body.cursor);
+            }
+            catch {
+                /* Fail closed on malformed vendor metadata. */
+            }
+        }
+        throw new ConnectorCallError("connector_call_failed", "Granola returned inconsistent paging metadata.", {
+            retryable: false,
+        });
+    },
+};
+export const pages = Object.fromEntries([...READS].filter((op) => op !== "GET /v1/notes/{note_id}").map((op) => [op, page]));
+/** The compact index preserves bounds/formats but omits vendor regex patterns. */
+export function binding({ connection }) {
+    return {
+        review: "Exact pinned note/folder/space identifier patterns before dispatch; standard JSON GET framing through Connection.sendPath.",
+        refuse(call) {
+            if (call.op.path.includes("{note_id}") && !/^\/v1\/notes\/not_[a-z0-9]{14}(?:\/transcript)?$/i.test(call.path))
+                return "Use a discovered Granola not_ API identifier with 14 alphanumeric characters, not a web-link UUID.";
+            for (const [key, prefix] of [
+                ["folder_id", "fol"],
+                ["space_id", "spa"],
+            ]) {
+                const value = call.query[key];
+                if (value !== undefined &&
+                    (typeof value !== "string" || !new RegExp(`^${prefix}_[a-z0-9]{14}$`, "i").test(value)))
+                    return `Use a discovered Granola ${prefix}_ API identifier for ${key}.`;
+            }
+            return undefined;
+        },
+        send: (call, options) => connection.sendPath({
+            method: call.method,
+            path: call.path,
+            template: call.op.path,
+            query: Object.entries(call.query).map(([key, value]) => [key, String(value)]),
+        }, options),
+    };
+}
+export const authenticate = Effect.gen(function* () {
+    const values = yield* (yield* Credentials).values.pipe(Effect.mapError((error) => new Refusal({ error })));
+    const key = values?.value?.trim();
+    if (!key || !printableToken(key))
+        return yield* Effect.fail(new Refusal({
+            error: new ConnectorCallError("auth_required", "An operator must configure a valid Granola workspace API key in this connection's credential slot."),
+        }));
+    return { Authorization: `Bearer ${key}` };
+});
+export const errors = {
+    provider: "Granola",
+    facts: () => ({}),
+    numericFacts: {
+        retryAfterMs: {
+            header: "retry-after",
+            format: "retry-after",
+            review: "HTTP Retry-After delay on rate-limited responses.",
+        },
+    },
+    meanings: { unknownId: "connector_call_failed", provesAbsence: false, conflicts: [] },
+    detail: ({ status }) => `Granola returned HTTP ${status}.`,
+    unreadable: "Granola returned an invalid JSON success body.",
+    statuses: {
+        401: () => ({
+            code: "auth_required",
+            words: (detail) => `${detail} The workspace API key is invalid or revoked; an operator must replace it.`,
+        }),
+        403: () => ({
+            code: "provider_permission_denied",
+            words: (detail) => `${detail} Check the workspace key's access and the space's Granola API integration.`,
+        }),
+        404: () => ({
+            code: "connector_call_failed",
+            words: (detail) => `${detail} The note is inaccessible, missing, or has no generated summary/transcript; this does not prove absence.`,
+        }),
+        413: () => ({
+            code: "connector_call_failed",
+            words: (detail) => `${detail} If include=transcript was requested, read /v1/notes/{note_id}/transcript in pages, then read note details without include. No automatic fallback or extra request was sent.`,
+        }),
+        429: ({ retryAfterMs }) => ({
+            code: "rate_limited",
+            retryAfterMs: retryAfterMs ?? 5_000,
+            words: (detail) => `${detail} The workspace shares a burst of 25 requests per 5 seconds and a sustained 5 requests/second. Wait before retrying.`,
+        }),
+    },
+};
+/** Validate framing, independently of optional response fields and the caller's field selection. */
+export const result = (body, answer) => {
+    const root = object(body);
+    const path = answer.operation.template;
+    const key = path === "/v1/notes"
+        ? "notes"
+        : path === "/v1/folders"
+            ? "folders"
+            : path === "/v1/spaces"
+                ? "spaces"
+                : path.endsWith("/transcript")
+                    ? "transcript"
+                    : undefined;
+    const valid = key
+        ? Array.isArray(root[key]) && typeof root.hasMore === "boolean"
+        : typeof root.id === "string" && /^not_[a-zA-Z0-9]{14}$/.test(root.id);
+    return valid
+        ? Effect.succeed(body)
+        : Effect.fail(new StatusFailure({ status: answer.status, headers: answer.headers, body: {}, operation: answer.operation }));
+};
+export const probe = {
+    operation: listSpaces,
+    request: { query: { page_size: 1 } },
+    check: (values) => !values.value?.trim() || !printableToken(values.value.trim()) ? "Enter a Granola workspace API key." : undefined,
+    describe: () => "Authenticated to the accessible Granola spaces. This does not prove access to every workspace note or verify the key's ownership type.",
+};

package/dist/providers/granola/index.d.ts

@@ -0,0 +1,10 @@
+/** One workspace-owned Granola REST API key, managed in the encrypted vault. */
+export interface GranolaOptions {
+    purpose: string;
+    title?: string;
+    instructions?: string;
+    maxResultBytes?: number;
+    /** Common connector restriction; no value enables unreviewed operations or writes. */
+    readOnly?: boolean;
+}
+export declare const granola: import("../../provider.js").ProviderFactory<GranolaOptions>;

package/dist/providers/granola/index.js

@@ -0,0 +1,68 @@
+import { keys, optionsOf } from "../../config-schema.js";
+import { defineApiProvider } from "../../http/provider.js";
+import { GranolaApi, authenticate, binding, errors, index, pages, probe, result, safety, verdicts } from "./api.js";
+import { granolaTools } from "./tools.js";
+import { skill } from "./skill.generated.js";
+export const granola = defineApiProvider({
+    name: "granola",
+    title: "Granola",
+    readme: "Granola",
+    options: optionsOf()(keys("purpose", "title", "instructions", "maxResultBytes", "readOnly")),
+    skill,
+    bundle: {
+        baselineGzip: 360040,
+        note: "./providers/granola standalone measured 360,040 B gzip with Homebrew Node 22 on 2026-10-27. This includes the shared Effect provider kit, paid once per deployment; provider entries are reported, not capped, and standalone sizes are not additive.",
+    },
+    vendor: GranolaApi,
+    baseUrl: () => "https://public-api.granola.ai",
+    description: (options) => `Granola workspace meeting notes: ${options.purpose}`,
+    authScope: () => "shared",
+    maxResponseBytes: 4 * 1024 * 1024,
+    timeoutMs: 30_000,
+    headers: { Accept: "application/json" },
+    idempotencyKey: false,
+    defaultCallAdmission: {
+        rules: [
+            {
+                maxConcurrency: 2,
+                maxQueueSize: 25,
+                queueTimeoutMs: 5_000,
+                retryAfterMs: 1_000,
+                budget: { kind: "rolling-window", maxCalls: 25, windowMs: 5_000 },
+            },
+        ],
+    },
+    credential: {
+        label: "Granola workspace API key",
+        description: "Workspace-owned key from Settings → Connectors → Workspace API keys (Business or Enterprise admin). Public notes and API-enabled spaces only; not a personal key or MCP OAuth token. Stored encrypted and sent only to public-api.granola.ai.",
+        placeholder: "grn_…",
+    },
+    authenticate,
+    errors,
+    safety,
+    result,
+    probe,
+    guide: (options) => ({
+        heading: "Granola usage",
+        summary: "Read workspace notes and transcripts; discover accessible spaces and folders before filtering.",
+        context: [
+            `Workspace purpose: ${options.purpose}`,
+            "One shared workspace API key over REST. This connection exposes only reviewed reads.",
+        ],
+        required: true,
+    }),
+    hatch: {
+        name: "granola",
+        title: "Granola",
+        index,
+        verdicts,
+        pages,
+        pageCursor: "argument",
+        binding,
+        pathExample: "/v1/notes",
+        notes: () => ({
+            read: "Omit query.cursor initially; pass page.nextCursor unchanged as top-level cursor with the same path and query. Note/folder/space page_size defaults to 10 (maximum 30); transcripts default to 50 (maximum 100).",
+        }),
+    },
+    tools: granolaTools,
+});

package/dist/providers/granola/openapi.generated.js

@@ -0,0 +1,30 @@
+import { compactOpenApi } from "../_shared/rest/compact-index.js";
+export const openapi = compactOpenApi({
+    source: "https://docs.granola.ai/api-reference/openapi.json",
+    revision: "sha256:3f1a93ae6380",
+    digest: "sha256:3f1a93ae6380feb5297df8115855486224f82bea236eaf1fd916072843f5759d",
+    version: "1.0.0",
+    servers: ["https://public-api.granola.ai"],
+    tags: ["audit", "folders", "legal-holds", "notes", "spaces", "webhook-endpoints"],
+    ops: [
+        ["GET", "/v1/audit", "get/v1/audit", "List audit events", 0],
+        ["GET", "/v1/folders", "get/v1/folders", "List folders", 1],
+        ["GET", "/v1/legal-holds", "get/v1/legal-holds", "List legal holds", 2],
+        ["POST", "/v1/legal-holds", "post/v1/legal-holds", "Create legal hold", 2],
+        ["GET", "/v1/legal-holds/{hold_id}", "get/v1/legal-holds/{hold_id}", "Get legal hold", 2],
+        ["PATCH", "/v1/legal-holds/{hold_id}", "patch/v1/legal-holds/{hold_id}", "Update legal hold", 2],
+        ["DELETE", "/v1/legal-holds/{hold_id}", "delete/v1/legal-holds/{hold_id}", "Release legal hold", 2],
+        ["GET", "/v1/legal-holds/{hold_id}/custodians", "get/v1/legal-holds/{hold_id}/custodians", "List legal hold custodians", 2],
+        ["POST", "/v1/legal-holds/{hold_id}/custodians", "post/v1/legal-holds/{hold_id}/custodians", "Add legal hold custodians", 2],
+        ["DELETE", "/v1/legal-holds/{hold_id}/custodians/{custodian_id}", "delete/v1/legal-holds/{hold_id}/custodians/{custodian_id}", "Remove legal hold custodian", 2],
+        ["GET", "/v1/notes", "get/v1/notes", "List notes", 3],
+        ["GET", "/v1/notes/{note_id}", "get/v1/notes/{note_id}", "Get note", 3],
+        ["GET", "/v1/notes/{note_id}/transcript", "get/v1/notes/{note_id}/transcript", "Get transcript", 3],
+        ["GET", "/v1/spaces", "get/v1/spaces", "List spaces", 4],
+        ["GET", "/v1/webhook-endpoints", "get/v1/webhook-endpoints", "List webhook endpoints", 5],
+        ["POST", "/v1/webhook-endpoints", "post/v1/webhook-endpoints", "Create webhook endpoint", 5],
+        ["PATCH", "/v1/webhook-endpoints/{webhook_endpoint_id}", "patch/v1/webhook-endpoints/{webhook_endpoint_id}", "Update webhook endpoint", 5],
+        ["DELETE", "/v1/webhook-endpoints/{webhook_endpoint_id}", "delete/v1/webhook-endpoints/{webhook_endpoint_id}", "Delete webhook endpoint", 5],
+    ],
+    fields: "{\"p\":[\"attachments\",\"attachments[].height\",\"attachments[].id\",\"attachments[].object\",\"attachments[].type\",\"attachments[].url\",\"attachments[].width\",\"attendees\",\"attendees[].email\",\"attendees[].name\",\"calendar_event\",\"covers_entire_workspace\",\"created_at\",\"created_by\",\"cursor\",\"custodian_count\",\"custodians\",\"custodians[].added_at\",\"custodians[].id\",\"custodians[].object\",\"custodians[].removed_at\",\"custodians[].user\",\"deleted\",\"deleted_at\",\"description\",\"enabled\",\"events\",\"events[].action\",\"events[].actor\",\"events[].collected_at\",\"events[].context\",\"events[].data\",\"events[].id\",\"events[].object\",\"events[].occurred_at\",\"folder_ids\",\"folder_membership\",\"folder_membership[].id\",\"folder_membership[].name\",\"folder_membership[].object\",\"folder_membership[].parent_folder_id\",\"folder_membership[].space_id\",\"folders\",\"folders[].id\",\"folders[].name\",\"folders[].object\",\"folders[].parent_folder_id\",\"folders[].space_id\",\"hasMore\",\"id\",\"legal_holds\",\"legal_holds[].covers_entire_workspace\",\"legal_holds[].created_at\",\"legal_holds[].custodian_count\",\"legal_holds[].description\",\"legal_holds[].id\",\"legal_holds[].name\",\"legal_holds[].object\",\"legal_holds[].released_at\",\"name\",\"notes\",\"notes[].created_at\",\"notes[].deleted_at\",\"notes[].id\",\"notes[].object\",\"notes[].owner\",\"notes[].title\",\"notes[].updated_at\",\"object\",\"owner\",\"private_notes_markdown\",\"private_notes_text\",\"released\",\"released_at\",\"removed\",\"removed_at\",\"scopes\",\"signing_secret\",\"space_membership\",\"space_membership[].id\",\"space_membership[].name\",\"space_membership[].object\",\"spaces\",\"spaces[].id\",\"spaces[].name\",\"spaces[].object\",\"summary_markdown\",\"summary_text\",\"title\",\"transcript\",\"transcript[].end_time\",\"transcript[].speaker\",\"transcript[].start_time\",\"transcript[].text\",\"updated_at\",\"url\",\"url_redacted\",\"web_url\",\"webhook_endpoints\",\"webhook_endpoints[].created_at\",\"webhook_endpoints[].created_by\",\"webhook_endpoints[].enabled\",\"webhook_endpoints[].events\",\"webhook_endpoints[].folder_ids\",\"webhook_endpoints[].id\",\"webhook_endpoints[].object\",\"webhook_endpoints[].scopes\",\"webhook_endpoints[].url\",\"webhook_endpoints[].url_redacted\"],\"d\":[[14,26,27,28,29,30,31,32,33,34,48],[14,42,43,44,45,46,47,48],[14,48,50,51,52,53,54,55,56,57,58],[11,12,15,24,49,59,68,73],[49,68,72,73],[14,16,17,18,19,20,21,48],[16,17,18,19,20,21],[49,68,74,75],[14,48,60,61,62,63,64,65,66,67],[0,1,2,3,4,5,6,7,8,9,10,12,23,36,37,38,39,40,41,49,68,69,70,71,78,79,80,81,86,87,88,89,90,91,92,93,94,97],[14,48,89,90,91,92,93],[14,48,82,83,84,85],[98,99,100,101,102,103,104,105,106,107,108],[12,13,25,26,35,49,68,76,77,95,96],[12,13,25,26,35,49,68,76,95,96],[22,49,68]],\"o\":[0,1,2,3,3,3,4,5,6,7,8,9,10,11,12,13,14,15]}",
+}, { "length": 3267, "definitions": "[{\"a\":[{\"t\":\"string\",\"f\":\"date\"},{\"t\":\"string\",\"f\":\"date-time\"}]},{\"t\":\"object\",\"p\":{\"email\":{\"t\":\"string\",\"f\":\"email\"},\"id\":{\"t\":\"string\"}}},{\"t\":\"string\",\"e\":[\"note.access_granted\",\"note.edited\",\"note.generated\"]}]", "parameters": ["[\"action\",\"query\",0,{\"t\":\"string\"}]", "[\"occurred_before\",\"query\",0,{\"$\":0}]", "[\"occurred_after\",\"query\",0,{\"$\":0}]", "[\"cursor\",\"query\",0,{\"t\":\"string\"}]", "[\"page_size\",\"query\",0,{\"t\":\"integer\",\"l\":1,\"u\":30}]", "[\"created_before\",\"query\",0,{\"$\":0}]", "[\"created_after\",\"query\",0,{\"$\":0}]", "[\"updated_after\",\"query\",0,{\"$\":0}]", "[\"folder_id\",\"query\",0,{\"t\":\"string\"}]", "[\"space_id\",\"query\",0,{\"t\":\"string\"}]", "[\"include\",\"query\",0,{\"t\":\"string\",\"e\":[\"transcript\"]}]", "[\"page_size\",\"query\",0,{\"t\":\"integer\",\"l\":1,\"u\":100}]"], "operations": [[[0, 1, 2, 3, 4], "0"], [[3, 4], "0"], [[3, 4], "0"], [[], "[\"application/json\",{\"t\":\"object\",\"p\":{\"name\":{\"t\":\"string\",\"d\":\"A name for the matter this hold preserves\"},\"description\":{\"t\":[\"string\",\"null\"],\"d\":\"Free text describing the matter\"},\"covers_entire_workspace\":{\"t\":\"boolean\",\"d\":\"Whether the hold covers every member of your workspace, current and future.\"},\"custodians\":{\"t\":\"array\",\"d\":\"Users to name individually when the hold is created\",\"i\":{\"$\":1}}},\"r\":[\"name\",\"covers_entire_workspace\"]}]"], 0, [[], "[\"application/json\",{\"t\":\"object\",\"p\":{\"name\":{\"t\":\"string\",\"d\":\"A new name for the matter\"},\"description\":{\"t\":[\"string\",\"null\"],\"d\":\"New free text for the matter, or null to clear it\"},\"covers_entire_workspace\":{\"t\":\"boolean\",\"d\":\"Whether the hold covers every member of your workspace.\"}}}]"], 0, [[3, 4], "0"], [[], "[\"application/json\",{\"t\":\"object\",\"p\":{\"custodians\":{\"t\":\"array\",\"d\":\"Users to name on this hold\",\"i\":{\"$\":1}}},\"r\":[\"custodians\"]}]"], 0, [[5, 6, 7, 8, 3, 4, 9], "0"], [[10], "0"], [[3, 11], "0"], [[3, 4], "0"], 0, [[], "[\"application/json\",{\"t\":\"object\",\"p\":{\"url\":{\"t\":\"string\",\"f\":\"uri\",\"d\":\"The publicly reachable HTTPS URL to deliver events to\"},\"scopes\":{\"t\":\"array\",\"d\":\"Which notes to receive events for.\",\"i\":{\"t\":\"string\",\"e\":[\"personal\",\"public\",\"workspace\"]}},\"events\":{\"t\":\"array\",\"d\":\"Event names to subscribe to.\",\"i\":{\"$\":2}},\"folder_ids\":{\"t\":\"array\",\"d\":\"Restrict delivery to notes in these folders or any of their subfolders.\",\"i\":{\"t\":\"string\"}}},\"r\":[\"url\",\"scopes\"]}]"], [[], "[\"application/json\",{\"t\":\"object\",\"p\":{\"url\":{\"t\":\"string\",\"f\":\"uri\",\"d\":\"The publicly reachable HTTPS URL to deliver events to.\"},\"scopes\":{\"t\":\"array\",\"d\":\"Which notes to receive events for; replaces the current scopes.\",\"i\":{\"t\":\"string\",\"e\":[\"personal\",\"public\",\"workspace\"]}},\"events\":{\"t\":\"array\",\"d\":\"Event names to subscribe to; replaces the current subscriptions.\",\"i\":{\"$\":2}},\"folder_ids\":{\"t\":\"array\",\"d\":\"Restrict delivery to notes in these folders or any of their subfolders; replaces the current folder filter.\",\"i\":{\"t\":\"string\"}},\"enabled\":{\"t\":\"boolean\",\"d\":\"Pause (`false`) or resume (`true`) event deliveries.\"}}}]"], 0] });

package/dist/providers/granola/safety.js

@@ -0,0 +1,37 @@
+import { safe, redact, refuse } from "../_shared/rest/value-safety.js";
+import { openapi } from "./openapi.generated.js";
+export const READS = new Set([
+    "GET /v1/notes",
+    "GET /v1/notes/{note_id}",
+    "GET /v1/notes/{note_id}/transcript",
+    "GET /v1/folders",
+    "GET /v1/spaces",
+]);
+export const GRANOLA_VALUE_SAFETY = {
+    title: "Granola",
+    operations: Object.fromEntries(openapi.ops.map(([method, path]) => {
+        const key = `${method} ${path}`;
+        return [
+            key,
+            !READS.has(key)
+                ? refuse("Only notes, note details, transcripts, folders and spaces are reviewed. Audit, legal holds, webhook management and writes are unavailable.")
+                : key === "GET /v1/notes/{note_id}"
+                    ? redact("Photo URLs grant unauthenticated access and are always withheld. Private handwritten note content (vendor-null for workspace keys) and space memberships describe API-key visibility, not credentials; their nested values still cross value safety.", ["attachments[].url"], ["private_notes_text", "private_notes_markdown", "space_membership"])
+                    : safe("Read-only meeting content and identifiers; no API credential is returned. Vendor error prose stays withheld."),
+        ];
+    })),
+    embeddedUrls: {
+        operations: {
+            "GET /v1/notes": ["notes[].title"],
+            "GET /v1/notes/{note_id}": [
+                "title",
+                "summary_text",
+                "summary_markdown",
+                "private_notes_text",
+                "private_notes_markdown",
+                "transcript[].text",
+            ],
+            "GET /v1/notes/{note_id}/transcript": ["transcript[].text"],
+        },
+    },
+};

package/dist/providers/granola/skill.generated.js

@@ -0,0 +1,5 @@
+// Generated by scripts/generate-providers.mjs; do not edit.
+export const skill = {
+    "content": "## Accessible meeting records\n\nWorkspace keys reach public workspace notes and spaces explicitly enabled for\nGranola API access. Folder permissions inherit their space's setting. They do\nnot grant unrelated private notes. Only notes with a generated AI summary and\ntranscript appear; a missing result does not establish that a meeting never\nhappened. The owner's private handwritten notes are null for workspace keys.\n\nDiscover actual note, folder and space IDs. API IDs use not_, fol_ and spa_\nprefixes; a web-link UUID, title or human name is not an API ID. Notes can\nbelong to several folders and spaces; folder parent_folder_id describes the\nhierarchy and space_id joins a folder to its space. Folder filtering includes\ndescendant folders. Null space_id can also mean an inaccessible space.\n\nOperation search searches the API contract, not meeting content. The REST API\noffers date, folder and space filters, with no natural-language meeting search.\nFilter accessible notes and inspect their contents to answer a topic question;\ndisclose the period and scope examined.\n\n## Transcript interpretation\n\nInline transcripts are optional. If including one fails with HTTP 413\n(TRANSCRIPT_TOO_LARGE), read note details without include and retrieve the\nseparate transcript endpoint through its complete continuation sequence. No\npartial transcript proves a complete quotation or count. An empty page can\nstill have a continuation; follow the returned paging state.\n\nSpeaker source describes the audio input, not a person's identity. macOS may\ndistinguish microphone from speaker audio. iOS currently uses microphone and\nmay supply anonymous diarization labels; do not invent attendee attribution.\nPreserve start/end timestamps when quoting. Summaries are AI-generated, so\nconfirm important wording against the transcript. Return only the relevant\npassages and identifying meeting metadata.\n\n## Conventions\n\n- **Paging:** while `page.hasMore` is true, continue with `page.nextCursor` unchanged. For `granola_api_details`, `granola_api_read`, `granola_api_search`, pass it as the top-level `cursor`; omit raw paging anchors on continuations. Keep the original method, path, filters, page size, fields and headers. The last page has no `nextCursor`. If `page.hasMore` is true without a cursor, the data is incomplete and continuation was withheld. When approaching execute_code's per-program call limit, return page.nextCursor before the call that would exceed it and continue in the next program; don't restart.\n- **Results:** `fields` narrows a read's result to the dot paths you name. `truncated` lists the dot paths a result cut for size; the ids that fetch what was cut stay in the result.\n- **Hatch:** `granola_api_search` finds this API's operations and reads no account data, `granola_api_details` shows one operation's contract, and `granola_api_read` calls a reviewed read. An operation without a reviewed verdict is refused. 13 operations are refused by design; use `granola_api_details` with the method and path to inspect the original operation summary and its separate refusal. Use details for refused methods outside the read/write call schemas; those methods remain unavailable.\n- **Writes:** a write is sent once and never retried. When its outcome is unknown, read the target before repeating it. Writes take no idempotency key.\n- **Errors:** codes come from the vendor's statuses and error facts, never its prose. An unknown id, or one these credentials cannot reach, fails as `connector_call_failed`; this API does not tell the two apart. It documents no conflict.\n- **Withheld values:** a value withheld for safety reads `\"[redacted]\"`. Writes refuse whole marker values and withheld links; longer prose may mention the marker. Paths and queries refuse any containment.",
+    "instructionsHeading": "Workspace instructions"
+};

package/dist/providers/granola/tools.js

@@ -0,0 +1,2 @@
+// The operation search/details/read hatch is the entire read-only surface.
+export const granolaTools = () => [];