mcp-scraper 0.15.0 → 0.16.0

package/docs/specs/google-drive-bulk-access-and-mcp-schema-passthrough-spec.md

@@ -0,0 +1,1680 @@
+# Google Drive Bulk Access and MCP Schema Passthrough
+
+- Status: Phase 1 interactive tools live; deterministic bulk, native connection MCP, broader writes, and Google OAuth review remain gated
+- Spec date: 2026-07-12
+- Primary repos: `mcp-scraper`, `mcp-scraper-scheduler`, `mcpscraper-web`, `mcpscraper-sdk`
+- Primary provider key: `google-drive`
+
+## Phase 1 production receipt — 2026-07-12
+
+- Nango production has the exact source-controlled 12-function Drive inventory: ten bounded reads plus the additive `create-drive-folder` and `copy-drive-file` actions.
+- The scheduler exposes the live-policy intersection as 10 reads and 2 actions, injects exact per-schedule grants into transient Mastra toolsets, and audits classified mutations without storing argument values.
+- The current tenant-owned Drive connection is healthy. Its explicitly authorized action switch is on; newly connected accounts still default to actions off.
+- The fixed public MCP remains a 156-tool provider-neutral surface. `describe_service_connection_tool` returned live 64-character schema hashes for both a Drive read and action; `get-about` and a one-item `list-drive-files` page passed through production.
+- This receipt covers interactive Phase 1 only. Deterministic `connection_sync`, background Proxy/Blob file transfer, native connection-scoped MCP `tools/list`, `upload-document`, broader mutations, and a reversible production write fixture are not shipped.
+
+## Executive decision
+
+Google Drive becomes the first complete connected-data provider with two deliberately separate execution paths:
+
+1. **Interactive tools:** tenant-scoped, schema-discoverable tools for small live reads and separately gated writes.
+2. **Deterministic bulk:** a checkpointed background export/sync service that inventories files, follows Drive change tokens, streams downloadable content through Nango Proxy into private object storage, and returns manifests rather than file bytes in MCP JSON.
+
+Nango remains the production OAuth and credential boundary for the REST/bulk path. The optional Google remote MCP has a separate OAuth credential boundary. The Google Drive REST API, reached through Nango Proxy, is the authoritative path for complete inventory, incremental reconciliation, and large downloads. Google's official remote Drive MCP is useful as a feature-flagged interactive provider and protocol-conformance target, but it is Developer Preview, exposes only eight tools, filters files for generative-AI eligibility, and returns downloads as base64. It must not be the bulk-transfer foundation.
+
+MCP does not define a `tools/describe` RPC. The proper protocol surface is `tools/list`, where each Tool already carries its input schema, optional output schema, description, and annotations. MCP Scraper will therefore provide:
+
+- a **protocol-native connection MCP endpoint** whose `tools/list` projects the selected connection's callable provider tools; and
+- a backward-compatible ordinary tool, `describe_service_connection_tool`, for agents using the fixed root MCP and its generic read/action bridges.
+
+The compatibility tool is useful, but it must never be described as a new MCP protocol method.
+
+## Canonical Build Spec
+
+- **Request:** Make Google Drive operational first, including large/bulk downloads, scheduled ingestion, full live schema discovery, and safe read/write expansion.
+- **Lane:** MCP Build using Mastra, with Mastra Build for deterministic scheduled execution.
+- **Capability:** Google Drive Bulk Access + Connection-Scoped MCP Tool Projection.
+- **Audience:** MCP Scraper users connecting personal or workspace Google Drives; MCP clients; Mastra scheduled agents; operators reviewing production readiness.
+- **User-Facing Outcome:** A user connects their own Drive, asks for a bounded corpus such as “give me the last 7 days of Drive files,” receives a private manifest and downloadable artifacts without repeated tool calls, and can grant exact Drive tools to a scheduled action.
+- **Target Runtime:** Vercel-hosted MCP Scraper API and HTTP MCP; Vercel-hosted Mastra scheduler with Inngest; Nango Cloud OAuth/MCP/Proxy; Postgres scheduler state; private Vercel Blob delivery.
+- **Inputs:** Tenant identity, tenant-owned connection ID, access profile, Drive selection, time range or Drive query, content policy, export formats, byte/file/call limits, exact scheduled tool grants.
+- **Source Materials:** Current main/scheduler code, live sanitized production inventory, MCP stable specification 2025-11-25, Google Drive API and remote MCP documentation, Nango Drive/Proxy/limits documentation, Vercel Blob documentation.
+- **Missing Context:** Final Google Cloud OAuth verification status; whether the existing Cloud project is on Google's May 2026 quota model; proven Nango Proxy behavior for Range and redirected Drive long-running download URLs; proven cross-invocation Blob multipart resume; final customer retention/entitlement policy.
+- **Questions Asked:** Is a custom describe method proper MCP? Can Nango Actions carry large files? Can Google's remote MCP replace Drive REST for complete exports?
+- **Answers Received:** No, native discovery is `tools/list`; no, Nango Actions cap output at 2 MB; no, Google's remote MCP is interactive/preview and not a complete or resumable inventory path.
+- **Evidence Plan:** Source audit, sanitized live inventory, official documentation, isolated unit/contract tests, staging OAuth/reconnect, provider tool discovery, large-file streaming test, shared-drive pagination test, scheduled occurrence receipt, production smoke.
+- **Evidence Acquired:** The original baseline had an auth-failed connection and zero live Drive functions. Phase 1 now has a healthy tenant connection, 12 deployed source-controlled functions, a 10-read/2-action live intersection, rich compatibility schemas, two successful bounded production reads, audited scheduled-action injection, and an explicitly enabled current-account action gate. Drive export/sync state remains absent by design.
+- **Agents:** Scheduled Action Agent for interactive schedules; deterministic connection-sync worker for automatic ingestion; no LLM in bulk traversal or byte transfer.
+- **Skills:** `mastra-agentic-development` for capability compilation and release receipts; full MCP release workflow for final cross-repo deployment.
+- **Workflows:** Connect/reconnect; live tool discovery; bounded live read; gated action; initial Drive snapshot; change-token reconciliation; content transfer; scheduled Drive sync; artifact renewal/cleanup; schema-change invalidation.
+- **Tools:** Existing generic connection tools, extended generic export-job tools, provider-native connection-scoped Drive tools, internal REST/Proxy adapters.
+- **MCP:** Root fixed MCP remains provider-neutral; connection MCP exposes dynamic tools through `tools/list`; compatibility describe returns a sanitized Tool projection; v1 remains stateless and does not advertise `tools.listChanged`.
+- **Data Shape:** Connection capability snapshot, export job, checkpoint, file manifest record, private artifact record, schema snapshot, schedule run receipt.
+- **Signals:** OAuth connected/reconnected/failed; tool inventory changed; export queued/progress/partial/complete/failed/cancelled; schedule occurrence claimed/completed; artifact expiring/expired.
+- **Background Tasks:** Initial inventory, changes reconciliation, per-file transfer, Blob multipart upload, manifest finalization, artifact cleanup, schema cache refresh.
+- **Guardrails:** Tenant ownership, live-policy intersection, exact schedule grant, action switch, destructive-action denylist, restricted-scope disclosure, remote-MCP eligibility awareness, explicit REST `canDownload`/restriction/encryption/error skip policy, prompt-injection treatment, SSRF host allowlist, no credentials or raw provider download URLs in results.
+- **Observability:** Per-job counts/bytes/calls/retries, per-file typed status, tool/schema revision, schedule quota receipt, structured safe error codes, Nango/Drive request traces without content or tokens.
+- **Enforcement:** Fail closed when live inventory and policy differ; reauthorize after scope changes; never return large bytes through MCP or Nango Actions; one scheduled occurrence consumes one scheduled-event unit; release fails on surface/inventory drift.
+- **Persistence:** Nango owns credentials; scheduler Postgres owns routes, checkpoints, records, export jobs, and run receipts; private Blob owns content and manifests; database stores artifact references, never binary bodies.
+- **Deployment:** Source-controlled Nango functions, scheduler, main API/MCP, frontend, SDK/package, generated manifest/MCPB, Vercel production, npm production, live proof.
+- **Done Contract:** A reauthorized Drive connection exposes the exact live approved toolset; a last-seven-days export paginates My Drive and shared drives without model loops; large content streams to owner-scoped private artifacts; a scheduled `connection_sync` resumes from Drive change tokens and bills once; both custom describe and native `tools/list` return valid sanitized schemas; all surfaces and production receipts agree.
+- **Phase Gates:** Detailed in “Release sequence and phase gates.”
+- **Receipt Requirements:** Commit SHAs, Nango deploy inventory, sanitized connection/tool proof, test output, Vercel deployment IDs, npm versions, MCP tool count/manifest parity, sample export/job/Blob/schedule receipts.
+- **Remaining Gaps:** Raw paginated Nango MCP catalog capture is proven for Phase 1. Nango Range/LRO streaming and cross-invocation multipart resume remain unproven; Google OAuth verification/CASA is an external gate; official Drive MCP remains preview; final storage/egress entitlements require a product decision.
+
+## Product contract in plain language
+
+The following user experiences must work:
+
+### Connect Drive
+
+The user opens Integrations, clicks Google Drive, chooses an access profile, approves Google OAuth, and returns to a connected card that reports what is actually callable. Connections are isolated by tenant and account. No other user shares the credential or its Drive data.
+
+The first production profile is **Full Drive read** because complete inventory and bulk download require `drive.readonly`. A Picker-limited profile can be offered separately, but it must say that it does not cover the whole Drive.
+
+### Ask for a bounded corpus
+
+Example: “Give me everything modified in Google Drive during the last seven days, including file contents where possible.”
+
+One call to `export_connected_service_data` validates the request and either:
+
+- completes a small metadata-only export inline; or
+- creates an idempotent background export job and returns `jobId`, progress/status, preview metadata, and eventually a private manifest artifact.
+
+The model never loops once per file. The server owns enumeration, pagination, retries, change reconciliation, content eligibility, transfers, and manifests.
+
+### Download a folder or a large corpus
+
+The server streams each eligible file to a private Blob artifact. The MCP result contains metadata and artifact handles, not base64. The manifest records every success, skip, failure, and continuation state. A 5 GB file is a transfer job, not a tool response.
+
+### Schedule ingestion
+
+The user can create a `connection_sync` schedule and bind the Drive connection. At the due time, the scheduler claims one occurrence, performs a bounded deterministic slice, saves its checkpoint, and emits a receipt. Internal pages and file downloads do not each count as scheduled events. Retrying the same leased occurrence does not double bill.
+
+### Use provider-native schemas
+
+An MCP client pointed at the connection-scoped endpoint receives the Drive tools directly in `tools/list`. A client using MCP Scraper's fixed root endpoint can call `describe_service_connection_tool` before using the generic read/action bridge.
+
+## Pre-implementation baseline
+
+This table records the state observed before Phase 1 implementation. The production receipt above is the current source of truth.
+
+| Layer | Current Google Drive state | Required state |
+|---|---|---|
+| OAuth/Nango catalog | One integration; one connection with auth error / `reauth_required` | Production credentials, explicit scope profile, active reauthorized connection |
+| Live Nango functions | 0 reads, 0 actions | Source-controlled deployed functions; live catalog matches policy |
+| Scheduler static policy | Five legacy reads, zero actions | Policy generated/reviewed against the deployed function manifest |
+| Mastra agent schedule | Generic injection works but Drive injects nothing | Exact connection-scoped Drive tools bind into eligible runs |
+| Deterministic sync | Drive unsupported | Initial snapshot + Drive Changes adapter with checkpoints |
+| Bulk export | Gmail/Calendar/Zoom/Resend only | Drive datasets and background job path |
+| Blob delivery | Private 7-day JSONL artifacts already work | Reuse for manifest; add per-file private streaming/multipart artifacts |
+| Root MCP describe | Resend only; Nango returns 501 | Nango and remote-MCP transports supported |
+| Native schema discovery | No connection-scoped dynamic MCP | Connection endpoint implements native `tools/list`/`tools/call` |
+| Frontend | Connected card can say “scheduler tools pending” | Scope-aware connect/reconnect, real readiness, export/schedule controls |
+| SDK/CLI | No connected-service SDK contract | Typed connection/export/schema/job client in public SDK |
+
+Existing foundations to reuse:
+
+- exact tenant-owned connection records without storing credentials;
+- live Nango tool discovery and per-schedule grants;
+- deterministic `connection_sync` run claiming, quotas, leases, checkpoints, records, and receipts;
+- private Blob artifacts with owner checks, seven-day retention, 15-minute signed URLs, renewal, and cleanup;
+- generic MCP list/read/action/export bridges.
+
+## Architectural decisions
+
+### D1. Nango + Drive REST is the production bulk path
+
+Nango handles OAuth and token refresh. Inventory and transfer calls use the Nango Proxy so MCP Scraper never handles long-lived Google credentials.
+
+Nango Actions must not carry file bytes. Nango Cloud limits action output to 2 MB and explicitly directs large payloads to Proxy. Action/functions may return metadata or create a job; they cannot be the content channel.
+
+### D2. Google's remote Drive MCP is optional interactive infrastructure
+
+Google's Developer Preview endpoint is `https://drivemcp.googleapis.com/mcp/v1`. It currently documents eight tools:
+
+- reads: `search_files`, `list_recent_files`, `get_file_metadata`, `get_file_permissions`, `read_file_content`, `download_file_content`;
+- writes: `create_file`, `copy_file`.
+
+It is the first external conformance target for generic schema passthrough because it exposes live MCP Tool schemas. It is not the authoritative bulk path because:
+
+- `download_file_content` returns base64 in MCP JSON;
+- there are no change tokens, full corpora traversal, Range checkpoints, or bulk job primitives;
+- Developer Preview eligibility filters can omit IRM/CAA/CSE/malware/trash content that the user can otherwise see;
+- the exposed tool surface can change before general availability.
+
+V1 raw discovery may verify all eight upstream schemas, but the public connection policy hard-blocks `download_file_content` because its unbounded base64 result violates the large-payload contract. `read_file_content` has a gateway response-byte cap and remains for bounded interactive use. Users requesting bytes are routed to `export_connected_service_data`. The two writes remain hidden until action scope/switch/policy permit them.
+
+Ship this adapter behind `GOOGLE_DRIVE_REMOTE_MCP_ENABLED=false` by default. Enabling it does not remove or replace the Nango Drive connection.
+
+The default product connection remains the Nango `google-drive` row. A Google remote-MCP credential, when explicitly enabled, is a separate `remote_mcp` connection with provider key `google-drive-remote-mcp-preview` and must be labeled as interactive/preview with bulk and scheduled-sync support disabled. Do not silently create two Drive credentials from one Connect click or imply that the preview connection is the bulk connection.
+
+Google's current preview setup asks the OAuth client for both `drive.readonly` and `drive.file`. Treat that consent contract independently from the Nango profiles below, and still hide `create_file`/`copy_file` until MCP Scraper's action switch and policy permit them.
+
+### D3. One connection has one credential owner
+
+Every call resolves:
+
+```text
+authenticated MCP Scraper identity
+  -> tenant-owned external connection row
+  -> provider config + connection id
+  -> Nango credential or remote-MCP OAuth storage
+  -> live provider tool/API call
+```
+
+A connection ID is routing input, never authorization. Missing and foreign connections return the same public 404 shape.
+
+### D4. Large data is a job and manifest, not model context
+
+The model receives only high-signal progress, previews, counts, warnings, and artifact handles. File bodies go from Drive through Nango Proxy to private Blob. The manifest is JSONL and references per-file artifact IDs.
+
+Do not build a giant in-memory ZIP in Vercel v1. A manifest plus individual artifacts is resumable, deduplicable, and failure-transparent. A bundle job can be added later.
+
+### D5. Native MCP schemas come from `tools/list`
+
+There is no custom JSON-RPC `tools/describe`. The gateway asks the upstream connection for `tools/list`, intersects it with MCP Scraper policy, sanitizes it, and either:
+
+- returns the Tool objects from the connection MCP's own `tools/list`; or
+- returns one selected Tool through the ordinary compatibility tool.
+
+Provider annotations are display/planning hints, not authorization. Classification and callability come from MCP Scraper policy and account state.
+
+### D6. Exposure is an intersection, not a union
+
+For every surface:
+
+```text
+callable tools
+= live upstream tools
+  intersect source-controlled read/action classification
+  intersect active tenant-owned connection
+  minus administrative denylist
+  intersect per-account action switch for mutations
+  intersect per-schedule grant when scheduled
+```
+
+Catalog, UI, root MCP, connection MCP, scheduler binding, and execution validation must all consume the same resolved capability snapshot.
+
+## System boundaries
+
+| Component | Owns | Must not own |
+|---|---|---|
+| Nango | OAuth credentials, token refresh, authenticated Proxy, deployed small functions | Bulk file bodies, product billing, tenant job manifests |
+| Mastra scheduler | Scheduled occurrence, export job state/execution, deterministic traversal, checkpoints, exact tool grants, private Blob writes, run receipts | Provider credentials, public/signed artifact authorization |
+| MCP Scraper main API | User auth, generic MCP/API contract, job create/status/cancel facade, owner-checked signed artifact delivery | Direct long-lived Google credentials, long-running transfer execution |
+| Private Blob | Per-file content and JSONL manifests | Authorization decisions, provider tokens |
+| Root MCP | Stable generic connection/job tools | Hundreds of always-on provider schemas |
+| Connection MCP | Dynamic callable provider tool projection | Cross-tenant or cross-connection tool aggregation |
+| LLM agent | Interpreting intent and using bounded tools | Pagination loops, binary transfer, retry/checkpoint correctness |
+
+## OAuth and connection profiles
+
+### Required profiles
+
+| Profile | Drive scope | Capability | Release posture |
+|---|---|---|---|
+| `selected_files` | `https://www.googleapis.com/auth/drive.file` | Files created by/opened with/explicitly selected for the app; Picker-compatible read/write | Optional limited-access product mode |
+| `full_read` | `https://www.googleapis.com/auth/drive.readonly` | View and download all files the user can access | Default for this bulk milestone |
+| `full_read_write` | `https://www.googleapis.com/auth/drive` | Arbitrary accessible-file mutations | Later, restricted, separate approval and action gates |
+
+`drive.metadata.readonly` is insufficient because it cannot download content. `drive.file` is intentionally not advertised as whole-Drive access.
+
+Gate 1 Nango authorization requests the exact normalized set `openid`, `profile`, `email`, and `https://www.googleapis.com/auth/drive.readonly` (subject to Google's current identity-scope naming). No union of historical scopes is accepted implicitly.
+
+Full Drive scopes are restricted. If MCP Scraper stores or transmits restricted-scope data server-side, Google verification and a security assessment may be required. Release status must show this as an external gate, not silently downgrade the scope.
+
+### Connection record additions
+
+Add or derive these non-secret fields:
+
+```ts
+interface DriveConnectionCapabilities {
+  accessProfile: 'selected_files' | 'full_read' | 'full_read_write'
+  grantedScopes: string[]
+  reconnectRequired: boolean
+  toolRevision: string | null
+  schemaRevision: string | null
+  supportsFullInventory: boolean
+  supportsContentDownload: boolean
+  supportsActions: boolean
+  lastCapabilityRefreshAt: string | null
+}
+```
+
+Do not store access or refresh tokens in scheduler/main databases.
+
+Persist the non-secret state on `mem_external_connections` (or a versioned generic `capabilities JSONB` with equivalent indexes):
+
+```sql
+ALTER TABLE mem_external_connections
+  ADD COLUMN IF NOT EXISTS transport TEXT NOT NULL DEFAULT 'nango',
+  ADD COLUMN IF NOT EXISTS access_profile TEXT,
+  ADD COLUMN IF NOT EXISTS granted_scopes TEXT[] NOT NULL DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS scope_hash TEXT,
+  ADD COLUMN IF NOT EXISTS reconnect_required BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS capability_state JSONB NOT NULL DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS artifact_owner_key TEXT;
+
+ALTER TABLE mem_external_connections
+  DROP CONSTRAINT IF EXISTS mem_external_connections_identity_provider_connection_uniq;
+ALTER TABLE mem_external_connections
+  ADD CONSTRAINT mem_external_connections_identity_transport_provider_connection_uniq
+  UNIQUE (identity, transport, provider_config_key, connection_id);
+```
+
+Add a check constraint limiting `transport` to `nango` or `remote_mcp` using the repo's duplicate-safe migration pattern. Every existing row backfills to `nango`. Routing switches on this persisted discriminator first, never on whether a provider-specific credential row happens to exist; the preview provider key provides an additional explicit boundary.
+
+Main gives every internal user/tenant one random immutable `artifact_owner_key` stored on the user record and copies it to scheduler connection/job state. Generate it once for existing users on first migration/use. New Drive artifacts use this stable namespace; never derive ownership from the current MCP Scraper API key, email, or OAuth credential, so API-key rotation and email changes do not orphan artifacts. It is an identifier, not a download credential.
+
+Persist pending intent without storing the Nango session token/link:
+
+```sql
+CREATE TABLE IF NOT EXISTS mem_pending_connection_authorizations (
+  id TEXT PRIMARY KEY,
+  identity TEXT NOT NULL,
+  provider_config_key TEXT NOT NULL,
+  requested_access_profile TEXT NOT NULL,
+  requested_scopes TEXT[] NOT NULL,
+  nango_connection_id TEXT,
+  session_correlation_hash TEXT NOT NULL,
+  status TEXT NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  CHECK (status IN ('pending','reconciling','active','reauth_required','failed','expired'))
+);
+```
+
+The browser receives the authorization ID and one-time Nango connect URL; only the correlation hash is durable. Reconcile requires the authenticated owner plus the authorization ID and expires/rejects stale sessions.
+
+Gate 1 exposes only `full_read`. `selected_files` is not selectable until Picker UI, selected-file/folder grant persistence, and Nango metadata synchronization are implemented. `full_read_write` remains a later reconnect/approval path.
+
+### Reauthorization contract
+
+Any change to required scopes marks the scheduler connection `reauth_required`; main maps that to the existing public `needs_reauth` plus `reconnectRequired=true`. The connect session pins the requested profile and exact scopes. The current product has no Nango callback state machine, so add this exact reconciliation contract:
+
+1. main creates the signed Nango connect/reconnect session and persists the requested profile against the pending connection authorization;
+2. after the OAuth popup returns, the frontend calls the authenticated connection reconcile endpoint; a verified Nango auth/connection webhook may trigger the same idempotent reconcile path;
+3. scheduler fetches the Nango connection status and a non-secret granted-scope list;
+4. preferred scope source is a source-controlled Nango post-connection hook that copies only the OAuth response's normalized `scope` names into connection metadata; Gate 0 must prove that hook/metadata path;
+5. if Nango cannot expose scope metadata safely, the reviewed fallback fetches credentials with a narrowly scoped backend key, extracts only `scope` in memory, immediately discards tokens, and never logs/persists the credential payload;
+6. scheduler runs capability probes, updates the external connection row, and main returns the resolved readiness state.
+
+After reconciliation:
+
+1. verify Nango connection status;
+2. verify the granted scope set;
+3. run a bounded `about.get` and one-file metadata smoke;
+4. refresh live tool inventory;
+5. persist only sanitized capability state;
+6. show `Connected` only when the selected profile is actually usable.
+
+For `selected_files` later, the Picker response's file/folder IDs are sent to an authenticated main route, ownership/profile are checked, and the server writes only those IDs to Nango connection metadata and versioned connection/schedule configuration. Client-provided IDs never expand a full-read profile or bypass provider ACL checks.
+
+## Source-controlled Drive tool surface
+
+The Nango dashboard is not the source of truth. Drive functions live under `nango-integrations/google-drive/`, are imported from `nango-integrations/index.ts`, compile in CI, deploy in the release, and produce a checked-in generated capability manifest.
+
+Names below are the public provider-tool contract. If a current Nango template uses a different name, either preserve it consistently or add an explicit alias at the adapter boundary. Policy-only names are a release failure.
+
+### Phase 1 safe reads
+
+Gate 1 deploys this exact minimal set before broader parity work:
+
+| Source file under `nango-integrations/google-drive/actions/` | Public tool | Bounded input contract | Purpose |
+|---|---|---|---|
+| `get-about.ts` | `get-about` | Empty object / reviewed fields mask only | User/storage/export-format capabilities |
+| `list-shared-drives.ts` | `list-shared-drives` | `pageSize<=100`, opaque `pageToken` | Page shared drives |
+| `list-drive-files.ts` | `list-drive-files` | `q`, `corpora`, optional `driveId`, `pageSize<=100`, opaque `pageToken`, bounded `orderBy` | Page normalized file metadata for an agent |
+| `get-file-metadata.ts` | `get-file-metadata` | Required `fileId`, reviewed field set | One file/folder metadata record |
+| `folder-content.ts` | `folder-content` | Required `folderId`, optional `driveId`, `pageSize<=100`, opaque `pageToken` | One bounded folder page |
+| `get-changes-start-page-token.ts` | `get-changes-start-page-token` | Optional `driveId` | Establish one corpus checkpoint |
+| `list-drive-changes.ts` | `list-drive-changes` | Required opaque `pageToken`, optional `driveId`, `pageSize<=100`, `includeRemoved=true`, `includeCorpusRemovals=true` | Page normalized changes/removals |
+| `fetch-google-doc.ts` | `fetch-google-doc` | Required `fileId`, `maxChars<=65,536` | Bounded normalized Doc text |
+| `fetch-google-sheet.ts` | `fetch-google-sheet` | Required `fileId`, optional `sheetName`, bounded rows/cells/bytes | Export XLSX/CSV through Drive, parse locally, and return bounded normalized Sheet data; no cell-range promise in v1 |
+| `fetch-document.ts` | `fetch-document` | Required `fileId`, `maxBytes<=65,536` | Bounded small-file content; never base64 large data |
+
+Each file exports its Nango action definition plus explicit Zod/input/output models, is imported from the provider index, and has a dry-run fixture. `nango-integrations/index.ts` imports the provider barrel. `nango-integrations/google-drive/models.ts` contains shared normalized File/Change/page envelopes. Exact Google endpoints, fields, required scopes, and safe error codes are documented beside each action.
+
+`fetch-google-sheet` uses only Drive export/download in v1 and a reviewed bounded/streaming workbook parser in scheduler/Nango function code. If the exported workbook exceeds the parser's safe byte/cell budget, return a typed normalized-content-unavailable result while the archive export can still proceed through the bulk job. A future true cell-range tool must explicitly enable the Google Sheets API and scope it; it is not implied here.
+
+Later safe-read expansion, after the minimal set and bulk path are proven: `find-file`, `get-shared-drive`, permission get/list, revision get/list, and comment/reply get/list. These names must not enter policy before their source functions and live schemas exist.
+
+The deterministic bulk worker calls Drive REST through its internal Proxy adapter with internal page sizes up to 1,000; it does not loop the agent-facing 100-item tools. Internal inventory/byte-transfer functions do not become model-callable merely to make the scheduler work. The schedule grant identifies the approved Drive connection and read intent, while the deterministic adapter remains constrained by source-controlled read-only provider policy.
+
+### Gated writes
+
+Writes are classified from a source-controlled manifest, hidden from connection `tools/list` until `actions_enabled=true`, and require an exact schedule grant in scheduled runs.
+
+| Tier | Candidate operations | Initial policy |
+|---|---|---|
+| Additive | upload document from an MCP Scraper artifact, create folder, copy file, create comment/reply | Enable after scope/schema/E2E review |
+| Mutating | move file, update metadata/content, update comment/reply, update permission, hide/unhide shared drive | Account action switch + exact grant + audit |
+| Destructive/high impact | delete/trash file, empty trash, delete permission/comment/reply/shared drive, ownership transfer, public-link mutation | Hard-block from schedules in v1; separate reviewed rollout |
+
+Binary upload arguments use an owner-checked `artifactId` or authenticated upload handle. They never accept an arbitrary server path, raw provider URL, or unbounded base64 string.
+
+The first write candidate is exactly `upload-document` in `actions/upload-document.ts`, accepting an owner-checked artifact/upload handle plus bounded destination/name/MIME metadata. Broader rows above are a roadmap, not Gate 1 inventory. Before any Drive write ships, replace the current generic action audit behavior with a provider-neutral structural redactor (secret/token/body/content/binary fields removed or hashed) and a safe provider-error mapper; raw action inputs and raw Google/Nango error messages must not enter `args_redacted` or public errors.
+
+### Capability manifest
+
+Generate a manifest with, at minimum:
+
+```json
+{
+  "providerConfigKey": "google-drive",
+  "generatedAt": "RFC3339",
+  "liveRevision": "sha256:...",
+  "tools": [
+    {
+      "name": "list-drive-files",
+      "classification": "read",
+      "scheduleEligible": true,
+      "destructive": false,
+      "requiredAccessProfiles": ["full_read", "full_read_write"],
+      "inputSchemaHash": "sha256:...",
+      "outputSchemaHash": "sha256:..."
+    }
+  ]
+}
+```
+
+CI and production smoke compare this with Nango live `tools/list`. Unknown live tools and policy-only tools remain unavailable and fail the release report.
+
+## Drive inventory and reconciliation
+
+### Selection model
+
+```ts
+type DriveSelection =
+  | { kind: 'all_accessible' }
+  | { kind: 'my_drive' }
+  | { kind: 'shared_drives'; driveIds: string[] }
+  | { kind: 'folders'; folderIds: string[]; followShortcuts?: boolean }
+  | { kind: 'files'; fileIds: string[] }
+  | { kind: 'query'; q: string; driveIds?: string[] }
+```
+
+`all_accessible` requires a full-read/full-write profile. Picker-scoped connections accept only file/folder selections already granted to the app.
+
+### Full inventory
+
+For a whole-Drive initial scan:
+
+1. fully paginate `drives.list` and freeze the selected shared-drive ID set for this cycle;
+2. create one corpus entry for the user and one for each selected shared drive;
+3. obtain `changes.getStartPageToken` for the user corpus and separately with `driveId` for every shared-drive corpus before inventorying that corpus;
+4. enumerate the user corpus with `trashed=false` and `includeItemsFromAllDrives=false` to reduce shared-drive overlap;
+5. enumerate each shared drive with `corpora=drive`, `driveId`, `supportsAllDrives=true`, and `includeItemsFromAllDrives=true`;
+6. follow every opaque `nextPageToken`;
+7. if `incompleteSearch=true`, narrow the corpus rather than accepting an incomplete result;
+8. replay `changes.list` separately for each corpus from its saved token with `includeCorpusRemovals=true` and the appropriate `driveId`/all-drives flags;
+9. persist each corpus's `newStartPageToken` only after the final change page for that corpus succeeds.
+
+Use `pageSize=1000` for internal REST enumeration where Google permits it. Agent-facing `list-drive-files` stays smaller (default 50, maximum 100) to bound model output.
+
+The user corpus and per-shared-drive corpora can overlap. Deduplicate by stable file ID plus provider version while retaining the corpus/drive provenance used to discover the item. Maintain a change-token checkpoint for the user corpus and for each shared drive that participates in the selection.
+
+Request explicit fields rather than the default partial File response. Minimum manifest fields:
+
+```text
+id,name,mimeType,parents,driveId,createdTime,modifiedTime,
+size,version,headRevisionId,resourceKey,
+md5Checksum,sha1Checksum,sha256Checksum,
+capabilities(canDownload,canReadRevisions),
+shortcutDetails(targetId,targetMimeType),trashed
+```
+
+Folder traversal uses bounded breadth-first queries and cycle detection. Shortcuts are metadata by default; following targets requires `followShortcuts=true` and a visited-ID set.
+
+### Incremental sync
+
+Drive change tokens are authoritative. Do not implement the recurring schedule as “scan modifiedTime with a seven-day overlap forever.”
+
+Checkpoint shape:
+
+```ts
+interface DriveCorpusCheckpointV1 {
+  corpusKey: 'user' | `drive:${string}`
+  driveId: string | null
+  phase: 'awaiting_start_token' | 'inventory' | 'reconcile' | 'changes' | 'complete'
+  inventoryPageToken: string | null
+  initialStartPageToken: string | null
+  changePageToken: string | null
+  committedStartPageToken: string | null
+  inventoryComplete: boolean
+}
+
+interface DriveSyncCheckpointV1 {
+  version: 1
+  selectionHash: string
+  sharedDriveListPageToken: string | null
+  sharedDriveListingComplete: boolean
+  activeCorpusKey: string | null
+  corpora: Record<string, DriveCorpusCheckpointV1>
+  pendingContentIds: string[] // bounded to 100; larger queues live in job-item rows
+  cycleStartedAt: string
+  lastSuccessfulAt: string | null
+}
+```
+
+Tokens are opaque. Validate checkpoint type and size, but never parse or transform provider tokens.
+
+Change records include additions, modifications, removals, and lost access. Persist corpus provenance. A corpus removal updates that provenance and becomes a global tombstone only when the item is actually deleted/lost or no selected corpus still contains it; moving between corpora must not falsely delete it.
+
+## Content download and export policy
+
+### User-selectable content policy
+
+```ts
+type DriveContentPolicy =
+  | 'manifest_only'
+  | 'metadata_only'
+  | 'text_and_workspace'
+  | 'all_downloadable'
+```
+
+Default for “last seven days” is `text_and_workspace`. Default for an explicit “download everything” request is `all_downloadable`, subject to configured limits.
+
+`text_and_workspace` produces a normalized AI-ready representation (plain text/Markdown for Docs; bounded row/cell JSONL or CSV parsed from a Drive-exported Sheet workbook) plus metadata. Slides are archive-exported in v1 and record `normalizedContentStatus='unavailable_v1'`; normalized Slides text requires a later explicit Slides/PPTX parsing adapter and tests. `all_downloadable` may additionally preserve an archive-format binary. Do not confuse DOCX/XLSX/PPTX archive exports with normalized content an agent can reason over.
+
+### Eligibility
+
+Google's generative-AI eligibility filtering applies to its Developer Preview remote MCP, not automatically to direct Drive REST enumeration. For the Nango/REST bulk path, MCP Scraper applies an explicit skip policy using ACL/provider errors, `capabilities.canDownload`, download/content restrictions, trash, encryption/state metadata where available, and abuse/malware signals where surfaced. Never set an abuse acknowledgement automatically. Record a typed skip reason while retaining allowed metadata.
+
+Provider content is always `untrustedContent=true`. It is data, never instructions for the scheduler or agent.
+
+### Ordinary blob files
+
+Use Drive `files.get?alt=media&supportsAllDrives=true` through Nango Proxy and stream the response directly to private Blob.
+
+- Preserve content type, content length, ETag, revision/checksum metadata.
+- Bind every transfer checkpoint to immutable source identity: file ID plus version/head revision/checksum (or a canonical fallback version key).
+- Use byte `Range` and a persisted offset only when the response is `206` and `Content-Range` exactly matches the requested source interval. A `200` response restarts from byte zero; never append it to prior parts.
+- Follow only allowlisted Google/Nango redirect hosts.
+- Apply bounded adaptive concurrency and exponential backoff for 403/429/5xx.
+- Verify a provider checksum when available and always compute the stored SHA-256.
+
+When a file cannot reliably finish inside one Vercel invocation, use an application-managed multipart transfer rather than one long `put()` call:
+
+1. create a private Blob multipart upload and persist its upload ID/path;
+2. request a bounded Drive byte range through Nango Proxy;
+3. upload that range as one Blob part;
+4. persist part number, ETag, next source offset, bytes, and a per-part SHA-256;
+5. renew the job lease and continue in another background invocation;
+6. complete the multipart upload only after every expected byte is present;
+7. finalize a reviewed serializable incremental SHA-256 state that was checkpointed after each sequential source part, and compare provider checksums where available; a final Blob reread is allowed only for objects proven to fit one invocation;
+8. abort the multipart upload on terminal cancellation/expiry.
+
+The job item is not `complete` until Blob completion and checksum validation succeed. A crashed invocation can replay the current part idempotently without creating a second visible artifact.
+
+### Google Workspace-native files
+
+Choose a deterministic default export format, overridable per request:
+
+| Source type | Default export | Alternate |
+|---|---|---|
+| Google Docs | DOCX | PDF, Markdown, plain text |
+| Google Sheets | XLSX | PDF, CSV/TSV first sheet |
+| Google Slides | PPTX | PDF, image first slide |
+| Google Drawings | PDF | PNG, SVG |
+| Apps Script | JSON | — |
+| Google Forms | ZIP through long-running download | Typed unsupported status if unavailable |
+| Google Sites | `text/raw` through long-running download | Typed unsupported status if unavailable |
+| Jamboard | PDF through long-running download | Typed unsupported status if unavailable |
+| Google Vids | MP4 through long-running download | — |
+
+Simple `files.export` has a 10 MB output limit and does not support Range. For larger supported native content and types such as Forms/Vids, call `POST files.download` with the file's resource key and persist the returned Operation name/expiry. If the initial Operation has `done=true`, consume its `response.downloadUri` immediately and do not poll it. Otherwise poll `operations.get` as the same user with jittered exponential backoff, forwarding the resource key, until done/error/expiry; then forward the resource key again on the final download request.
+
+Use Range on the final long-running download URI only when the Operation reports `partialDownloadAllowed=true`. Workspace exports otherwise restart from byte zero after interruption. If the deployed project/provider path cannot complete that flow, return a typed `native_export_too_large_or_unsupported` manifest status rather than truncating silently.
+
+### Byte boundaries
+
+Initial defaults, configurable by environment and plan:
+
+| Boundary | Default |
+|---|---:|
+| Inline normalized text per file | 64 KiB |
+| Synchronous metadata export | Existing 240 s / 5,000 records / 50 MB aggregate bounds |
+| Per-file v1 content cap | 5 GiB soft guard; higher by plan after proof |
+| Blob multipart threshold | 100 MiB |
+| Job maximum files | 100,000 default plan guard |
+| Job maximum stored bytes | Plan-specific, explicit in planning result |
+| Manifest retention | 7 days default |
+| Signed download URL | 15 minutes |
+
+The transfer design supports objects beyond the soft guard; the guard is a product/cost boundary, not an excuse to buffer. Vercel Blob supports multipart transfer and much larger objects.
+
+## Export job contract
+
+### Root MCP tools
+
+Keep provider-neutral names:
+
+1. `export_connected_service_data` — validates and starts or completes an export.
+2. `get_connected_data_export_status` — returns durable job progress and final artifacts.
+3. `cancel_connected_data_export` — requests cancellation; already completed artifacts remain until expiry.
+4. `renew_connected_data_download` — renews an owner-scoped manifest or file-artifact URL.
+
+Optional later: `plan_connected_data_export` for whole-account jobs with cost/size estimates. A bounded last-seven-days export does not require a separate planning round trip.
+
+MCP Tasks are currently an experimental protocol capability, so the first release must not depend on client task support. If a client negotiates Tasks later, the same durable `jobId` can back an MCP Task while the explicit status/cancel tools remain the compatibility path.
+
+Do not add one top-level tool for every Drive provider action. Provider-native actions belong on the connection MCP and behind the existing generic bridges.
+
+Static MCP annotations:
+
+| Tool | `readOnlyHint` | `destructiveHint` | `idempotentHint` | Note |
+|---|---:|---:|---:|---|
+| `export_connected_service_data` | false | false | false | Creates internal job/artifact state; request-level idempotency is enforced when a job key is supplied, but the static tool supports existing non-keyed small exports |
+| `get_connected_data_export_status` | true | false | true | Owner-scoped status read |
+| `cancel_connected_data_export` | false | false | true | Repeated cancellation converges; never mutates Drive |
+| `renew_connected_data_download` | true | false | false | Mints a fresh short-lived URL without changing provider data |
+
+Public main routes retain the existing export route and add exact status/cancel routes. Scheduler adds corresponding authenticated internal create/get/cancel routes. All three resolve identity/ownership independently; the job ID alone is never authority.
+
+### Drive datasets
+
+Extend the dataset union:
+
+```ts
+type DriveDataset =
+  | 'drive_files'       // file/folder metadata and content artifact references
+  | 'drive_changes'     // normalized additions/modifications/removals
+  | 'drive_snapshot'    // complete bounded inventory + requested content
+```
+
+`auto` maps a Google Drive connection to `drive_files` for a time-bounded request and `drive_snapshot` when `selection.kind='all_accessible'` without a time filter.
+
+### Input schema
+
+```ts
+interface ExportConnectedServiceDataInputV2 {
+  connectionId: string
+  dataset?: ExistingDataset | DriveDataset | 'auto'
+  lastDays?: number
+  from?: string
+  to?: string
+  selection?: DriveSelection
+  contentPolicy?: DriveContentPolicy
+  exportFormats?: Partial<Record<string, string>>
+  maxItems?: number
+  maxBytes?: string
+  delivery?: 'auto' | 'artifact'
+  idempotencyKey?: string
+  continuation?: ExistingContinuation | ConnectedExportJobContinuation
+}
+
+interface ConnectedExportJobContinuation {
+  kind: 'job_resume'
+  token: string
+  previousJobId: string
+  expiresAt: string
+}
+```
+
+Rules:
+
+- Time ranges are half-open: `modifiedTime >= from && modifiedTime < to`.
+- `idempotencyKey` is required when the call can create a background job; duplicate keys for the same tenant/connection/request hash return the same job.
+- `maxBytes` is a decimal string to avoid JavaScript integer loss.
+- Existing synchronous datasets keep the current 5,000-record cap. A queued Drive job may accept a higher plan-bounded `maxItems` (100,000 by default) because it checkpoints across invocations instead of returning those records inline.
+- Whole-Drive selection requires a full access profile.
+- Continuations remain signed/bound to tenant, connection, dataset, selection hash, range, content policy, and provider cursor.
+
+### Output schema
+
+```ts
+type ExportConnectedServiceDataOutputV2 =
+  | {
+      kind: 'inline_complete'
+      ok: true
+      exportId: string
+      status: 'complete' | 'partial'
+      providerConfigKey: string
+      dataset: string
+      range: { from: string; to: string }
+      counts: ConnectedExportCounts
+      records?: unknown[]
+      preview: unknown[]
+      manifestArtifact?: ConnectedArtifactDescriptor
+      continuation: ConnectedDataContinuation | null
+      warnings: string[]
+      untrustedContent: true
+    }
+  | {
+      kind: 'job_accepted'
+      ok: true
+      jobId: string
+      status: 'queued' | 'running'
+      requestHash: string
+      statusTool: 'get_connected_data_export_status'
+      warnings: string[]
+      untrustedContent: true
+    }
+  | {
+      kind: 'terminal_error'
+      ok: false
+      errorCode: string
+      error: string
+      retryable: boolean
+    }
+
+interface ConnectedExportCounts {
+  pages: number
+  listed: number
+  exported: number
+  failed: number
+  filteredOutsideRange: number
+  contentFetched: number
+  contentArtifacted: number
+  contentUnavailable: number
+  bytesRead: string
+  bytesStored: string
+  googleQuotaUnits: string
+}
+
+interface GetConnectedDataExportStatusOutput {
+  kind: 'job_status'
+  ok: true
+  jobId: string
+  status: 'queued' | 'running' | 'complete' | 'partial' | 'failed' | 'cancelled'
+  counts: ConnectedExportCounts
+  preview: unknown[]
+  manifestArtifact?: ConnectedArtifactDescriptor
+  fileArtifacts?: ConnectedArtifactDescriptor[] // capped preview only
+  continuation?: ConnectedExportJobContinuation
+  warnings: string[]
+  retryable: boolean
+  errorCode?: string
+  untrustedContent: true
+}
+
+interface CancelConnectedDataExportOutput {
+  kind: 'cancel_requested' | 'already_terminal'
+  ok: true
+  jobId: string
+  status: 'queued' | 'running' | 'complete' | 'partial' | 'failed' | 'cancelled'
+}
+```
+
+Large artifact lists are read from the manifest, not returned as an unbounded array. A typed synchronous continuation resumes the bounded collector; a typed `job_resume` continuation starts a new owner/request-bound job after a partial terminal limit. Neither is interchangeable with a bare background `jobId`.
+
+Each MCP implementation has an exact input/output schema and executor/API route. When a manifest signed URL is present, the tool result should include a standard MCP `resource_link` in addition to conforming `structuredContent` and a short serialized JSON text block for older clients. Never embed binary content as an MCP resource body.
+
+### Background job persistence
+
+Add scheduler-owned tables (names may follow the existing `mem_` convention):
+
+```sql
+CREATE TABLE mem_connected_export_jobs (
+  id TEXT PRIMARY KEY,
+  identity TEXT NOT NULL,
+  artifact_owner_key TEXT NOT NULL,
+  external_connection_id TEXT NOT NULL,
+  provider_config_key TEXT NOT NULL,
+  schedule_id TEXT,
+  schedule_snapshot JSONB,
+  scheduled_for TIMESTAMPTZ,
+  idempotency_key TEXT NOT NULL,
+  request_hash TEXT NOT NULL,
+  request_schema_version INTEGER NOT NULL,
+  request JSONB NOT NULL,
+  status TEXT NOT NULL,
+  checkpoint JSONB NOT NULL DEFAULT '{}',
+  checkpoint_revision BIGINT NOT NULL DEFAULT 0,
+  counts JSONB NOT NULL DEFAULT '{}',
+  entitlement_reservation JSONB NOT NULL DEFAULT '{}',
+  manifest_artifact_id TEXT,
+  error_code TEXT,
+  retryable BOOLEAN NOT NULL DEFAULT false,
+  cancel_requested_at TIMESTAMPTZ,
+  attempt INTEGER NOT NULL DEFAULT 0,
+  heartbeat_at TIMESTAMPTZ,
+  next_retry_at TIMESTAMPTZ,
+  lease_owner TEXT,
+  lease_expires_at TIMESTAMPTZ,
+  retention_expires_at TIMESTAMPTZ,
+  cleanup_state TEXT NOT NULL DEFAULT 'pending',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  started_at TIMESTAMPTZ,
+  completed_at TIMESTAMPTZ,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE (identity, external_connection_id, idempotency_key),
+  FOREIGN KEY (external_connection_id, identity)
+    REFERENCES mem_external_connections (id, identity) ON DELETE RESTRICT,
+  CHECK (status IN ('queued','running','complete','partial','failed','cancelled')),
+  CHECK (cleanup_state IN ('pending','eligible','running','complete','failed'))
+);
+
+CREATE TABLE mem_connected_export_items (
+  job_id TEXT NOT NULL,
+  provider_file_id TEXT NOT NULL,
+  provider_version_key TEXT NOT NULL,
+  status TEXT NOT NULL,
+  source_metadata JSONB NOT NULL,
+  artifact_id TEXT,
+  bytes_stored BIGINT,
+  sha256 TEXT,
+  retry_count INTEGER NOT NULL DEFAULT 0,
+  error_code TEXT,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (job_id, provider_file_id, provider_version_key),
+  FOREIGN KEY (job_id) REFERENCES mem_connected_export_jobs (id) ON DELETE CASCADE,
+  CHECK (status IN ('pending','metadata_only','transferring','artifacted','skipped','failed','cancelled'))
+);
+
+CREATE TABLE mem_connected_export_transfers (
+  job_id TEXT NOT NULL,
+  provider_file_id TEXT NOT NULL,
+  provider_version_key TEXT NOT NULL,
+  source_kind TEXT NOT NULL,
+  source_operation_name TEXT,
+  source_operation_expires_at TIMESTAMPTZ,
+  partial_download_allowed BOOLEAN NOT NULL DEFAULT false,
+  source_offset BIGINT NOT NULL DEFAULT 0,
+  expected_bytes BIGINT,
+  part_size_bytes INTEGER NOT NULL,
+  blob_pathname TEXT NOT NULL,
+  blob_upload_id TEXT,
+  completed_parts JSONB NOT NULL DEFAULT '[]',
+  part_hashes JSONB NOT NULL DEFAULT '[]',
+  sha256_state BYTEA,
+  attempt INTEGER NOT NULL DEFAULT 0,
+  heartbeat_at TIMESTAMPTZ,
+  next_retry_at TIMESTAMPTZ,
+  lease_owner TEXT,
+  lease_expires_at TIMESTAMPTZ,
+  cancel_requested_at TIMESTAMPTZ,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (job_id, provider_file_id, provider_version_key),
+  FOREIGN KEY (job_id, provider_file_id, provider_version_key)
+    REFERENCES mem_connected_export_items (job_id, provider_file_id, provider_version_key)
+    ON DELETE CASCADE,
+  CHECK (source_kind IN ('blob_range','workspace_export','drive_lro'))
+);
+
+CREATE INDEX IF NOT EXISTS mem_connected_export_jobs_claim_idx
+  ON mem_connected_export_jobs (status, next_retry_at, lease_expires_at, created_at);
+CREATE INDEX IF NOT EXISTS mem_connected_export_jobs_owner_idx
+  ON mem_connected_export_jobs (identity, created_at DESC);
+CREATE INDEX IF NOT EXISTS mem_connected_export_transfers_claim_idx
+  ON mem_connected_export_transfers (next_retry_at, lease_expires_at, updated_at);
+```
+
+Credentials, signed URLs, file bodies, and raw provider error payloads do not enter these tables.
+
+`provider_version_key` uses, in order, Drive `version`, `headRevisionId`, a provider checksum, or a canonical hash of `(modifiedTime,size,mimeType)`; the fallback is explicit so files lacking one field remain processable. A reused idempotency key with the same request hash returns the existing job. The same key with a different request hash returns HTTP 409 `idempotency_key_conflict`.
+
+Implement schema migration and transactional repository methods, not ad hoc SQL in routes: `createOrGetJob`, `claimJobSlice`, `renewJobLease`, `upsertItem`, `checkpointTransfer`, `requestCancellation`, `finalizeJob`, and `claimCleanup`. Claims use compare-and-set status/lease predicates, heartbeat before expiry, bounded attempts, `next_retry_at`, and connection-scoped concurrency locks.
+
+Every checkpoint transaction increments `checkpoint_revision` and uses compare-and-set `(job id, lease owner, prior checkpoint_revision)`. Event IDs use the committed revision, so duplicate or reordered events cannot ambiguously execute the same slice.
+
+Jobs retain an immutable schedule snapshot rather than cascading with a deleted schedule. Disconnect is a soft status transition while retained jobs/artifacts exist; hard connection deletion is restricted until cleanup has removed Blob objects and eligible job rows. Item/job cascades are used only by the cleanup repository after artifact deletion succeeds, preventing orphaned private objects and lost audit state.
+
+### Background workflow and state machine
+
+The scheduler owns this execution path and registers it in `src/mastra/index.ts` alongside existing functions.
+
+```text
+main authenticated export route
+  -> scheduler POST /api/internal/connected-exports
+  -> transaction: ownership + capability + entitlement + create/get job
+  -> emit mcp-scraper/connected-export.requested { jobId }
+  -> Inngest function id connected-export-slice
+  -> claim lease and run one bounded deterministic slice
+  -> complete/partial/fail/cancel OR emit ...connected-export.continue { jobId }
+  -> finalizer streams DB item rows into private JSONL manifest
+  -> main status route returns owner-checked artifact/resource link
+```
+
+Exact states and transitions:
+
+```text
+queued  -> running | cancelled
+running -> running        (checkpoint + continuation event)
+running -> complete       (all planned items terminal, manifest finalized)
+running -> partial        (bounded user limit reached with explicit remaining work)
+running -> failed         (non-retryable or retry budget exhausted)
+running -> cancelled      (cancel observed between safe units)
+```
+
+Rules:
+
+- Inngest event payload contains only `jobId`; the worker reloads tenant/connection state from Postgres.
+- Event idempotency is `connected-export:${jobId}:${checkpointRevision}`.
+- Concurrency is one active slice per external connection and a plan-bounded tenant maximum (default four worker slices, two ad-hoc jobs).
+- One slice reserves at most 210 seconds of work inside the 300-second function ceiling, leaving final checkpoint/event headroom.
+- Default binary part is 32 MiB (subject to Blob multipart minimum/maximum validation in Gate 0); metadata pages may repeat within the slice until headroom.
+- Check cancellation before every provider page, LRO poll, Range request, Blob part, and finalization batch.
+- Retryable 403/429/5xx honors `Retry-After`, persists `next_retry_at`, and emits/schedules a continuation with jittered exponential backoff; no blocking sleep holds the Vercel invocation.
+- Default transfer attempt cap is eight; provider-specific non-retryable codes terminate only the item when safe, while connection/auth failures pause/fail the job.
+- Heartbeat and lease renew after each page/part. A later worker can claim an expired lease and replay only the uncommitted page/part.
+- Cancel aborts any open multipart upload, marks unfinished items cancelled, finalizes a cancellation manifest when possible, and releases unused entitlement reservation.
+- Job finalization queries item rows in a stable key order and streams JSONL to Blob; it never accumulates the full manifest in memory.
+- The current synchronous `collectConnectedDataExport` remains for small existing datasets and bounded Drive metadata only. Drive background snapshot/content jobs bypass it completely.
+- If the initial Inngest send fails after the job transaction, a one-minute recovery function re-emits eligible queued/expired-lease jobs. Duplicate delivery is harmless because job and slice claims are idempotent.
+
+### Entitlements, abuse controls, and settlement
+
+Ad-hoc exports do not inherit the scheduled-occurrence billing implementation. Before queueing, atomically enforce/reserve:
+
+- maximum active jobs per tenant and per connection;
+- plan maximum files, source bytes, stored bytes, and retention;
+- daily/monthly storage and egress allowance;
+- provider/API call ceiling and Google quota-unit budget;
+- optional MCP Scraper credit estimate for transfer/storage work.
+
+Known-size jobs reserve bytes up front. Unknown-size native exports reserve a floor and extend the reservation before crossing it; failure to extend pauses or ends the job with `entitlement_limit_reached`, never an overage surprise. Completion/cancellation reconciles actual files/bytes/calls, settles credits, and releases the unused reservation. Download/renew routes enforce egress allowance and rate limits.
+
+`scheduledEventUnits` is MCP Scraper product billing: one claimed schedule occurrence consumes one unit through the existing `mem_connection_sync_runs` claim path. A linked export job or continuation slice never charges another scheduled event. `googleQuotaUnits` is provider usage: one occurrence can consume many units across `files.list`, `files.get`, `files.download`, and `operations.get`. Store/report them separately and never label Google quota units as scheduled events.
+
+### Artifact retention and deduplication decision
+
+V1 artifacts are **job-scoped and not deduplicated across jobs**. That makes manifest-child cleanup safe and avoids reference counting. The same job/item/version remains idempotent through its unique key and multipart checkpoint.
+
+- Ad-hoc manifests and archive binaries expire after seven days by default.
+- Scheduled sync records persist normalized metadata and plan-bounded, deterministically chunked AI-ready text/table content in Postgres/vault/table when allowed.
+- A scheduled record's archive artifact reference is explicitly ephemeral and includes `artifactExpiresAt` plus `artifactState`.
+- After cleanup, mark the reference `expired_rehydratable`; do not leave a seemingly live dead pointer. A later authorized read can enqueue rehydration from the source version when still available.
+- Cross-job content-addressed deduplication and durable archives require a later reference-counted retention design and are not silently implied by the versioned pathname.
+
+### Manifest record
+
+Each JSONL item is self-describing:
+
+```json
+{
+  "type": "drive_file",
+  "schemaVersion": 1,
+  "connectionId": "opaque-public-id",
+  "providerFileId": "...",
+  "name": "Q3 plan",
+  "path": ["My Drive", "Planning", "Q3 plan"],
+  "parents": ["..."],
+  "driveId": null,
+  "sourceMimeType": "application/vnd.google-apps.document",
+  "exportMimeType": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "createdTime": "RFC3339",
+  "modifiedTime": "RFC3339",
+  "providerVersion": "...",
+  "providerChecksums": {"md5": null, "sha1": null, "sha256": null},
+  "canDownload": true,
+  "contentStatus": "artifacted",
+  "artifact": {
+    "artifactId": "connected-data-content/...",
+    "filename": "Q3-plan.docx",
+    "contentType": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    "bytes": "123456",
+    "sha256": "...",
+    "expiresAt": "RFC3339"
+  },
+  "warnings": [],
+  "untrustedContent": true
+}
+```
+
+The stored manifest contains artifact IDs, not reusable signed URLs. Status/renew calls mint short-lived URLs after owner verification.
+
+## Private Blob storage
+
+Do not force binary files through the current string-only `createConnectedDataArtifact`. Keep that helper as the legacy manifest/NDJSON path and introduce a scheduler-owned binary artifact contract exposed through the versioned internal API:
+
+```ts
+type ConnectedArtifactDescriptor =
+  | { kind: 'manifest'; artifactId: string; contentType: 'application/x-ndjson'; bytes: string; sha256: string; expiresAt: string }
+  | { kind: 'binary'; artifactId: string; contentType: string; filename: string; bytes: string; sha256: string; expiresAt: string }
+
+interface ConnectedBinaryArtifactWriter {
+  beginMultipart(...): Promise<TransferHandle>
+  uploadPart(...): Promise<CompletedPart>
+  completeMultipart(...): Promise<ConnectedArtifactDescriptor>
+  abortMultipart(...): Promise<void>
+  putStream(...): Promise<ConnectedArtifactDescriptor>
+}
+```
+
+The concrete cross-repo boundary is a versioned authenticated scheduler JSON API, not a pretend repo-local shared module. Scheduler alone implements the Drive binary writer, owner parsing, allowed prefixes, TTLs, signing, and cleanup. Main validates the versioned response with its own Zod contract and exposes the public facade.
+
+Required internal scheduler operations include job create/get/cancel plus `artifact_renew` and bounded `manifest_read`. Main forwards authenticated identity, stable artifact-owner key, job ID, and artifact ID over the existing internal-control authentication; scheduler rechecks the job/owner and returns a short-lived URL or manifest window. Contract fixtures with `apiVersion: 1` run in both repos and release parity tests compare them.
+
+Suggested prefixes:
+
+```text
+connected-data-exports/{ownerId}/{jobId}/manifest-....jsonl
+connected-data-content/{ownerId}/{jobId}/{providerFileId}/{versionHash}/{safeFilename}
+```
+
+Requirements:
+
+- `access: private` for every object;
+- pathname owner is the immutable persisted `artifact_owner_key`, matched against the authenticated user's current stable key on every public access;
+- random suffix or collision-safe content version;
+- streaming body; never `arrayBuffer()` the entire file;
+- automatic `multipart: true` above 100 MiB only for transfers proven to finish in one invocation; manual multipart sessions for cross-invocation transfers;
+- SHA-256 computed while streaming;
+- bounded filename normalization and content-type validation;
+- renewal checks owner, retention, and artifact/job status;
+- cleanup deletes manifest and child content artifacts;
+- hosted mode fails closed when private Blob is not configured.
+
+The existing artifact reader remains manifest/text-only. Refactor its hosted implementation to issue bounded Blob range reads instead of buffering the complete artifact before slicing. Binary artifacts are delivered through signed downloads/resource links and must never enter the UTF-8 window reader. Owner, expiry, renewal, and cleanup explicitly accept both approved prefixes.
+
+Existing short-lived artifacts created under the legacy API-key-derived prefix remain readable by the legacy path until their seven-day TTL and are not renamed. Every new Drive job uses the stable owner key contract.
+
+## Scheduled Drive sync
+
+### Policy
+
+Add Drive to `CONNECTION_SYNC_REQUIRED_TOOLS` with deterministic read primitives only. Do not include `upload-document` or any mutation.
+
+Recommended logical requirements:
+
+```ts
+'google-drive': [
+  'list-drive-files',
+  'list-shared-drives',
+  'get-changes-start-page-token',
+  'list-drive-changes'
+]
+```
+
+Content transfer is an internal adapter capability checked separately; it is not an agent permission masquerading as a tool grant.
+
+### Execution
+
+1. Claim the unique `(identity, scheduleId, scheduledFor)` occurrence.
+2. Consume one MCP Scraper `scheduledEventUnit` atomically through the existing occurrence claim.
+3. Acquire a per-connection advisory/lease lock.
+4. Load and validate the Drive checkpoint.
+5. Run a fair bounded slice within the existing 240-second sync budget and 300-second Vercel ceiling.
+6. Persist raw metadata/content artifact references and checkpoint before best-effort vault/table mirroring.
+7. Mark `ok`, `partial`, or `failed` with per-connection totals.
+8. Resume on the next occurrence or safe continuation task without charging the same occurrence twice.
+
+### Stored records
+
+Use `drive_file`, `drive_folder`, and `drive_content_chunk` record types. Fetch/store content only when the source version, head revision, or checksum changes. AI-ready text/table content larger than one record is deterministically chunked (default 64 KiB UTF-8 chunks) with file/version/chunk index and content hashes so it can persist without one giant JSONB payload. Database payloads hold normalized metadata, normalized chunks, and artifact references; archive/binary bodies remain in Blob.
+
+### Schedule configuration
+
+```ts
+interface DriveScheduleConfig {
+  selection: DriveSelection
+  contentPolicy: DriveContentPolicy
+  exportFormats?: Partial<Record<string, string>>
+  maxFilesPerOccurrence: number
+  maxBytesPerOccurrence: string
+  mirrorToVault: boolean
+  mirrorToTable: boolean
+}
+```
+
+Persist this on the exact schedule-connection binding:
+
+```sql
+ALTER TABLE mem_scheduled_action_connections
+  ADD COLUMN IF NOT EXISTS provider_config JSONB NOT NULL DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS provider_config_version INTEGER NOT NULL DEFAULT 1,
+  ADD COLUMN IF NOT EXISTS provider_config_hash TEXT;
+```
+
+`set_scheduled_action_connections` and the dashboard binding API accept a provider-discriminated config, validate it server-side, canonicalize/hash it, and return the resolved config. A selection/profile/content-policy change that invalidates an existing Drive checkpoint requires explicit confirmation, clears or archives the old checkpoint transactionally, and starts a new inventory cycle. Unknown config fields fail closed.
+
+The UI must state that one due occurrence counts as one MCP Scraper scheduled event even when it performs many internal calls/Google quota units.
+
+## MCP-native connection tool projection
+
+### Protocol endpoint
+
+Add this exact v1 tenant-authenticated endpoint:
+
+```text
+POST https://mcpscraper.dev/mcp/connections/{connectionId}
+```
+
+Add a parameterized Hono route before the existing root `/mcp` handler. Export/reuse the root caller-auth resolver, resolve the tenant-owned connection, build a per-request dynamic MCP server/tool catalog, and then hand the JSON-RPC body to the stateless Streamable HTTP transport. The route verifies ownership on every request and never trusts a prior list response.
+
+V1 deliberately matches the current stateless root transport (`sessionIdGenerator: undefined`). `GET` and `DELETE` return 405. The server does **not** advertise `capabilities.tools.listChanged` and does not promise asynchronous notifications. Tool/action/reconnect changes produce a new catalog revision on the next request; revision-bound cursors from the old catalog fail with a refresh-required error. Stateful session routing and `notifications/tools/list_changed` are a later phase.
+
+The endpoint supports:
+
+- `initialize`;
+- `tools/list` with opaque cursor pagination;
+- the client-sent `notifications/initialized` notification;
+- `tools/call` with exact policy/action enforcement.
+
+The conformance sequence is `initialize -> client sends notifications/initialized -> tools/list -> tools/call`. The endpoint uses the canonical `https://mcpscraper.dev/mcp` protected-resource metadata and token audience; it is an authenticated subresource, not a new OAuth audience. Its 401 challenge points to the same protected-resource metadata. Do not put credentials in the URL. The `connectionId` is safe routing input only after authentication/ownership validation. An opaque signed handle may replace it later without changing the protocol contract.
+
+Apply one shared Streamable HTTP protocol guard to root and connection endpoints:
+
+- if `Origin` is present, parse it and require an exact configured trusted origin; reject invalid/untrusted origins with 403; authenticated non-browser clients may omit Origin, but wildcard acceptance is forbidden;
+- require `Accept` to include both `application/json` and `text/event-stream`, otherwise 406;
+- validate `MCP-Protocol-Version` on non-initialize requests against the supported/negotiated version set, otherwise return the protocol error/400 required by the SDK contract;
+- a valid JSON-RPC notification, including client `notifications/initialized`, returns HTTP 202 with no body;
+- enforce content type/body/size and the existing auth guard before creating the per-request MCP server.
+
+### Upstream catalog adapter
+
+Define a provider-neutral interface:
+
+```ts
+interface ConnectedMcpCatalogAdapter {
+  listTools(input: {
+    identity: string
+    connectionId: string
+    cursor?: string
+  }): Promise<{
+    protocolVersion: string | null
+    tools: ProviderToolDefinition[]
+    nextCursor: string | null
+    upstreamRevision: string
+  }>
+
+  callTool(input: {
+    identity: string
+    connectionId: string
+    name: string
+    arguments: Record<string, unknown>
+  }): Promise<CallToolResult>
+}
+```
+
+Implementations:
+
+- `NangoConnectedMcpCatalogAdapter`: uses a low-level `@modelcontextprotocol/sdk` Client/Streamable HTTP transport with the same tenant-scoped Nango provider/connection headers, initializes once for the request/cache refresh, calls raw `listTools({cursor})`, and follows every upstream cursor.
+- `RemoteMcpCatalogAdapter`: uses the same low-level client against the stored tenant-scoped remote MCP OAuth connection, including Google Drive preview when enabled.
+
+Do not implement passthrough through `MCPClient.listToolsetsWithErrors()` alone: the current Mastra abstraction converts schemas into tool handles and can discard raw title/icons/output-schema details and upstream pagination. Deep-clone the raw MCP Tool JSON before any Mastra conversion, then sanitize that clone. Never infer tool schemas from a hand-written TypeScript type when the live upstream MCP exposes them.
+
+`upstreamRevision` is not expected from MCP. The gateway computes it as SHA-256 over a canonical serialization of the complete sanitized upstream Tool catalog in deterministic tool-name order. The downstream catalog revision is a second hash over `upstreamRevision`, source-controlled policy revision, connection/reconnect generation, transport, and current action-switch state. Cursors and caches bind to that downstream revision.
+
+Extend each connection returned by `list_service_connections` with non-secret discovery metadata:
+
+```ts
+{
+  mcpEndpoint: string | null
+  schemaDiscovery: 'connection_tools_list' | 'compatibility_describe'
+  toolRevision: string | null
+}
+```
+
+The frontend may offer “Copy connection MCP URL,” and an agent can use the same endpoint value without constructing it. Authentication is still required; possession of the URL grants nothing.
+
+### Downstream Tool projection
+
+Preserve these standard Tool fields when valid:
+
+```ts
+interface SanitizedConnectedTool {
+  name: string
+  title?: string
+  description?: string
+  inputSchema: Record<string, unknown>
+  outputSchema?: Record<string, unknown>
+  annotations?: {
+    title?: string
+    readOnlyHint?: boolean
+    destructiveHint?: boolean
+    idempotentHint?: boolean
+    openWorldHint?: boolean
+  }
+  icons?: Array<{ src: string; mimeType?: string; sizes?: string[]; theme?: 'light' | 'dark' }>
+  execution?: { taskSupport: 'forbidden' | 'optional' | 'required' }
+}
+```
+
+Do not forward arbitrary `_meta`, credential hints, upstream session IDs, auth challenges, or executable content. Unknown extensions are stripped unless explicitly reviewed. Preserve `execution.taskSupport` only when the gateway implements equivalent task semantics. V1 rejects a tool with `taskSupport='required'`; it may expose an optional task tool only as `forbidden` with an explicit compatibility warning or after implementing the optional path.
+
+When an exposed Tool includes `outputSchema`, its `tools/call` response must return conforming `structuredContent` and should also include serialized JSON in a TextContent block for older clients. Schema passthrough without output conformance is a release failure.
+
+Tool names are unchanged on a one-connection endpoint. If a future aggregate endpoint combines connections, namespace names deterministically and retain the upstream name internally; do not solve a future collision problem in the first endpoint.
+
+### Callability behavior
+
+- Safe reads in the live-policy intersection appear.
+- Actions appear only while `actions_enabled=true`.
+- Admin-blocked tools never appear.
+- Changing the action switch, reconnecting, deploying provider tools, or changing policy invalidates the catalog revision. V1 clients observe it on the next request; a future stateful transport may add list-changed notifications.
+- `tools/call` repeats all checks; a prior `tools/list` result is not an authorization grant.
+
+### Pagination and caching
+
+- Downstream cursors are opaque, signed, connection/revision-bound, and expire with the session/cache window.
+- Follow upstream pagination with hard page/tool/byte limits.
+- Positive sanitized catalog cache: at most 60 seconds.
+- Transient negative cache: at most 5 seconds.
+- Always re-check tenant ownership, connection status, action switch, and policy on a cache hit.
+- Cache key includes transport, external connection row ID, provider key, reconnect generation/`updatedAt`, and upstream revision.
+- Never cache clients, tokens, foreign-connection decisions, or raw `_meta`.
+
+## Compatibility schema-description tool
+
+Keep `describe_service_connection_tool` because the root MCP intentionally exposes stable generic bridges rather than every provider tool.
+
+### Input
+
+```ts
+interface DescribeServiceConnectionToolInputV2 {
+  connectionId: string
+  tool: string
+  fresh?: boolean
+}
+```
+
+### Output
+
+```ts
+interface DescribeServiceConnectionToolOutputV2 {
+  ok: boolean
+  tool?: {
+    name: string
+    title: string | null
+    description: string | null
+    classification: 'read' | 'action'
+    callable: boolean
+    blockedReason: 'actions_disabled' | 'inactive_connection' | null
+    transport: 'nango' | 'remote_mcp'
+    providerConfigKey: string
+    protocolVersion: string | null
+    schemaSource: 'live_tools_list'
+    inputSchema: Record<string, unknown>
+    outputSchema?: Record<string, unknown>
+    annotations?: Record<string, unknown>
+    icons?: Array<Record<string, unknown>>
+    execution?: { taskSupport: 'forbidden' | 'optional' | 'required' }
+    schemaHash: string
+    fetchedAt: string
+  }
+  retryable?: boolean
+  errorCode?: string
+  error: string | null
+}
+```
+
+An action may be described while actions are disabled so the UI/agent can explain what enabling actions would grant. It remains `callable=false`, and connection-native `tools/list` omits it until enabled.
+
+### Scheduler route
+
+Add a strict internal route beside existing Nango read/action routes:
+
+```text
+POST /api/internal/nango/connections/actions/describe
+```
+
+Flow:
+
+1. validate identity, connection ID, and exact tool name;
+2. resolve an active tenant-owned connection;
+3. classify the name through local policy and reject collisions/unknown/admin-blocked tools;
+4. open the low-level connection-scoped MCP SDK client using the Nango/remote transport adapter;
+5. follow raw `tools/list` pagination and find the exact live Tool;
+6. deep-clone the raw Tool JSON and validate/sanitize that clone before any Mastra Standard Schema conversion;
+7. sanitize, hash, cache, disconnect, and return.
+
+Main API dispatches the existing route to Resend or Nango/remote MCP rather than returning 501 for every non-Resend transport.
+
+### Schema validation
+
+Reject or normalize definitions that violate any of these bounds:
+
+- root `inputSchema.type` must be `object`;
+- `outputSchema`, when present, must be an object-root schema for stable MCP compatibility;
+- maximum serialized sanitized Tool: 256 KiB;
+- maximum schema nesting depth: 32;
+- maximum property count: 2,000;
+- maximum title: 200 characters;
+- maximum description: 12,000 characters;
+- tool name follows MCP length/character guidance and exactly matches the requested live name;
+- icon entries are bounded HTTPS/data descriptors and are never fetched server-side during discovery;
+- external/remote `$ref` is rejected; local references must be resolved or preserved safely within the bounded schema;
+- secret-looking defaults/examples, credential values, `_meta`, and unknown auth extensions are stripped;
+- upstream name must exactly equal the requested name.
+
+Treat provider descriptions as untrusted text. They may guide arguments, never override MCP Scraper policy.
+
+### Safe error contract
+
+| Status | Code | Meaning |
+|---:|---|---|
+| 400 | `tool_not_allowed` / `invalid_schema` | Name outside policy or malformed upstream schema |
+| 404 | `connection_not_found` | Missing or foreign connection, same public response |
+| 409 | `connection_inactive` | Reauthorization or repair needed |
+| 429 | `upstream_rate_limited` | Retryable |
+| 502 | `tool_discovery_failed` / `live_tool_missing` | Live inventory cannot satisfy policy |
+| 503 | `connection_transport_unavailable` | Nango/remote MCP/config temporarily unavailable |
+
+Main control clients preserve safe upstream status/code/retryability instead of collapsing all failures to 502.
+
+This requires two prerequisite error-boundary fixes. Scheduler `safeRouteError` maps provider errors to stable codes, preserves safe 429 versus 503 semantics, and never returns raw Nango/Google messages. Main `NangoControlError`/`controlRequest` accepts and safely forwards reviewed 400/404/409/429/502/503 plus `code` and `retryable` instead of converting every non-2xx response to 502/503. The `fresh` describe option is rate-limited and cannot bypass ownership/policy checks.
+
+## Security and guardrails
+
+### Tenant and credential isolation
+
+- Resolve identity from authenticated caller only.
+- Query connection by `(identity, externalConnectionId)`.
+- Keep Nango connection IDs/provider config keys out of user-visible logs where unnecessary.
+- Never return OAuth codes/tokens, Nango secrets, Blob read/write/admin tokens, or standalone signing tokens. A short-lived owner-authorized presigned download URL/resource link is an intentional delivery result; it is never logged or persisted in manifests/DB and expires after the declared window.
+- Encrypt remote-MCP OAuth state with the existing remote credential storage.
+
+### Provider/API safety
+
+- Nango Proxy base URL is fixed to Google Drive API or an allowlisted Google download origin.
+- Do not accept arbitrary `baseUrlOverride` from a user/tool argument.
+- Bound redirects, timeouts, response headers, and content lengths.
+- Honor `Retry-After`; apply jittered truncated exponential backoff.
+- Check actual Cloud quotas; do not hardcode concurrency from headline limits.
+
+As of this spec, Google's post-May-1-2026 model documents 1,000,000 quota units/minute/project, 325,000/minute/user/project, and 1 TB/day/project egress, while legacy-active projects may retain older quotas. Example costs include `files.get` at 5 units, `files.list` at 100, and `files.download` at 200; every `operations.get` poll also consumes provider quota. Treat these as observed planning inputs, read the deployed Cloud project's actual limits at release, and record units per operation rather than assuming one API request equals one unit.
+
+### Prompt injection
+
+- File text, comments, filenames, and descriptions are untrusted content.
+- Deterministic workers never execute instructions from provider content.
+- MCP output marks content untrusted and separates it from warnings/control metadata.
+- Scheduled agent reads retain existing injected-content defenses.
+
+### Writes
+
+- `actions_enabled` is false by default.
+- Exact action tool and arguments are audited with sensitive fields redacted.
+- Destructive operations are unavailable to schedules in v1.
+- Upload/copy/create operations use idempotency keys where the provider permits.
+- Permissions/public links/ownership transfer require separate product approval and clear UI copy.
+
+### Storage and retention
+
+- Private artifacts only.
+- Default seven-day retention is visible to the user and configurable by plan.
+- Deleting/disconnecting a connection can enqueue early artifact cleanup subject to retention/audit rules.
+- Blob lifecycle cleanup is idempotent and records counts/errors without filenames or content.
+
+## Observability
+
+### Metrics
+
+Record by provider, plan, and safe outcome class:
+
+- connection/reconnect success and scope mismatch;
+- live tool count by read/action/blocked classification;
+- schema discovery latency, pages, bytes, cache hit, invalid definitions;
+- export jobs queued/running/partial/complete/failed/cancelled;
+- files listed/eligible/skipped/downloaded/exported;
+- bytes read/stored, multipart uploads, Range resumes;
+- Drive/Nango status families, retry counts, rate-limit waits;
+- schedule occurrences, `scheduledEventUnits`, Google quota units, leased retries, checkpoint resumes;
+- artifact renewals/expiry/cleanup.
+
+### Safe structured logs
+
+Each event carries:
+
+```text
+requestId, identityHash, connectionPublicId, providerConfigKey,
+scheduleId?, occurrenceId?, jobId?, toolName?, schemaHash?,
+statusCode?, safeErrorCode?, retryable?, durationMs,
+files?, bytes?, pages?, attempt?
+```
+
+No file content, access token, full signed URL, raw Google error body, or sensitive filename is logged by default.
+
+### Run receipts
+
+Every scheduled Drive occurrence persists:
+
+- scheduled time, start/end, status, MCP Scraper scheduled-event unit consumed, and Google quota units observed;
+- connection and selection hash;
+- checkpoint before/after revision;
+- pages/files/changed/tombstoned/content counts;
+- bytes and artifacts created;
+- safe warnings/errors;
+- continuation needed;
+- linked export job IDs.
+
+## API, SDK, UI, and documentation surfaces
+
+### Main API/MCP
+
+Update:
+
+- connected dataset unions and validation;
+- export output/job status types;
+- Nango/remote MCP schema description dispatch;
+- connection-scoped MCP route;
+- descriptions for `read_service_connection`, `describe_service_connection_tool`, `export_connected_service_data`, and renewal/status/cancel tools;
+- generated MCP manifest and parity tests.
+
+### Scheduler
+
+Update:
+
+- Drive OAuth connect-session defaults;
+- source-controlled live read/action policy;
+- provider capability resolution;
+- Nango schema describe route;
+- Drive REST/Proxy inventory and content adapter;
+- Drive connected-data export page/job routes;
+- deterministic `connection_sync` policy/core/records/checkpoints/receipts;
+- export job tables and background functions.
+
+The scheduler owns execution and private-Blob operations for background Drive jobs because it already has Inngest and durable run/checkpoint state. Add a dedicated private Blob token and `@vercel/blob` there. The main API remains the public authorization/delivery facade: it authenticates the caller and invokes the scheduler's owner-checking internal status/renew/manifest-read endpoints. Main does not write or sign new Drive job artifacts.
+
+Do not add Drive to the legacy unmetered digest path.
+
+### Implementation file map
+
+Primary existing files to change or extend:
+
+| Repo | Existing surface | Change |
+|---|---|---|
+| main | `src/api/server.ts` | Dispatch Nango/remote schema descriptions; Drive export/job/status/cancel routes; connection MCP mount |
+| main | `src/api/nango-control.ts` | Typed describe/export-job scheduler clients with safe status preservation |
+| main | `src/api/connected-data-export.ts` | Drive datasets and queued/running states while preserving existing bounded exporters |
+| main | `src/api/connected-data-artifacts.ts` | Keep legacy manifest/text path; route new Drive artifact renew/window operations to scheduler internal API |
+| scheduler | new connected-artifact contract + binary writer modules | Approved prefixes/TTL/types plus streaming/manual-multipart/signing/cleanup implementation |
+| main | `src/mcp/mcp-tool-schemas.ts` | V2 connection/schema/export/job schemas |
+| main | `src/mcp/paa-mcp-server.ts` | Register generic status/cancel tools and update descriptions |
+| main | `src/mcp/mcp-routes.ts` | Export caller auth and mount stateless `/mcp/connections/:connectionId` before the root handler |
+| main | `src/mcp/http-mcp-tool-executor.ts`, `src/mcp/IMcpToolExecutor.ts` | Wire new contracts |
+| main | `nango-integrations/index.ts`, `nango-integrations/google-drive/**` | Source-controlled Drive functions and schemas |
+| scheduler | `src/mastra/lib/nango-api.ts` | Explicit Drive scopes and reviewed live read/action policy |
+| scheduler | `src/mastra/lib/nango-connection-client.ts` | Existing Mastra execution client remains for bound agent tools |
+| scheduler | new raw MCP catalog adapter | Low-level SDK initialize/paginated `tools/list` with raw Tool preservation |
+| scheduler | `src/mastra/routes/nango-integrations.ts` | Describe, Drive page/export/job internal routes |
+| scheduler | Nango connection reconcile/hook modules | Requested profile, post-connection scopes, capability probes, `needs_reauth` state |
+| scheduler | `src/mastra/lib/connection-sync-policy.ts` | Deterministic Drive required capabilities |
+| scheduler | `src/mastra/lib/connection-sync-core.ts` | Drive snapshot/changes/content dispatch |
+| scheduler | `src/mastra/db/external-connections.ts` | Capability/schedule-config/export job/item/transfer schema and repositories |
+| scheduler | `src/mastra/index.ts` | Register export slice/recovery/cleanup Inngest functions and 300-second limits |
+| scheduler | route error/action audit helpers | Structural redaction and stable safe provider status/error mapping |
+| scheduler | new `src/mastra/lib/google-drive-*.ts` modules | REST/Proxy inventory, changes, content transfer, manifest normalization |
+| scheduler | new background workflow/function files | Job leases, multipart slices, completion/cancellation |
+| frontend | `public/app.jsx` and compiled asset | Scope-aware Drive card/drawer/export/schedule/MCP URL UI |
+| tests/docs | connection/export/release suites and generated manifest | Cross-surface contracts and production receipts |
+
+The public SDK repo adds the corresponding connection/export/job types and methods; the web repo adds the marketing integrations/scheduling copy without becoming a second capability source of truth.
+
+### Environment contract
+
+Reference names only; never commit values:
+
+| Variable | Runtime | Purpose |
+|---|---|---|
+| existing Nango secret/MCP URL variables | scheduler | MCP catalog/calls and Proxy authentication |
+| existing `CONNECTED_DATA_READ_WRITE_TOKEN` | main | Legacy synchronous connected-data artifacts only |
+| `DRIVE_EXPORT_BLOB_READ_WRITE_TOKEN` | scheduler | Dedicated private Drive job store: write, multipart, sign, bounded manifest reads, cleanup |
+| existing scheduler internal-control secret | main + scheduler | Authenticated job/reconcile/status/cancel routes |
+| existing Inngest event/signing variables | scheduler | Export slice/recovery/cleanup execution |
+| `GOOGLE_DRIVE_REMOTE_MCP_ENABLED` | scheduler/main | Default false preview adapter gate |
+| `GOOGLE_DRIVE_REMOTE_MCP_URL` | scheduler | Defaults to Google's documented endpoint only when feature enabled |
+| `MCP_SCRAPER_CONNECTED_EXPORT_PART_BYTES` | scheduler | Default 32 MiB after Gate 0 validation |
+| `MCP_SCRAPER_CONNECTED_EXPORT_SLICE_BUDGET_MS` | scheduler | Default 210,000 ms under 300-second ceiling |
+| plan/entitlement limits | main/scheduler | File, byte, concurrency, storage, egress, retry, retention boundaries |
+
+Production startup/status fails closed for background content exports when the private store, internal auth, Inngest, or Nango Proxy prerequisites are missing. Metadata-only interactive reads may remain available and must report the narrower readiness state.
+
+### Frontend
+
+Integration card/drawer must show:
+
+- Google Drive logo and account identity;
+- access profile (`Selected files`, `Full Drive read`, or `Full Drive read/write`);
+- real status (`Needs reconnect`, `Connected`, `Tools unavailable`, `Ready for sync`);
+- actual read/action counts from resolved capabilities;
+- action toggle only when an action-capable scope/tool exists;
+- reconnect reason when scopes/functions changed;
+- bulk export controls and recent job state;
+- schedule Data Sync configuration for selection/content/limits;
+- artifact retention and scheduled-event billing copy.
+- if the optional Google preview MCP is enabled, a separate preview badge and disclosure that its OAuth setup includes `drive.file` even while downstream write tools are hidden.
+
+The integrations route and header/hamburger navigation must be present in production; tests assert both desktop and mobile navigation.
+
+### SDK/npm
+
+Add typed clients/types for:
+
+- list connections;
+- describe connection tool;
+- create/list connection MCP endpoint metadata if exposed through REST;
+- start export;
+- get/cancel export job;
+- renew artifact URL;
+- Drive selection/content policy/datasets/manifests.
+
+The SDK does not embed Google or Nango credentials. It calls MCP Scraper with the user's MCP Scraper auth.
+
+### Documentation
+
+Update README, integrations guide, scheduler guide, hosted skill, `llms.txt`/`llms-full.txt`, generated manifest, MCPB, and marketing surfaces. Clearly distinguish:
+
+- OAuth connected;
+- interactive tools live;
+- bulk/scheduled sync supported;
+- action scope and switch;
+- official Google remote MCP preview versus MCP Scraper's Nango/REST bulk path.
+
+## Test plan
+
+### Unit and contract
+
+- Drive OAuth profile -> exact scopes; changed scope -> reconnect required.
+- Post-connection scope metadata/reconcile path persists scopes only; tokens never reach DB/logs. Missing required scope produces `needs_reauth`.
+- Live function inventory intersects policy; stale policy-only tools never expose.
+- Read/action collision fails closed.
+- Admin-blocked and destructive scheduled tools never expose.
+- Action switch changes callability and catalog revision.
+- Nango describe returns exact input/output schema and safe annotations.
+- Description of disabled action succeeds with `callable=false`; action call fails.
+- Upstream second-page Tool is discoverable.
+- Schema root/size/depth/property/ref/secret sanitization bounds.
+- Cache rechecks ownership/status/policy and invalidates on reconnect/deploy/toggle.
+- Client disconnects on success and every error path.
+- Main preserves safe 400/404/409/429/502/503 errors.
+- Action audit redactor removes content/token/binary fields; public errors contain only safe codes.
+- Root MCP output schemas validate for every new result state.
+- Same idempotency key/same request returns one job; same key/different request returns 409.
+- Duplicate/reordered Inngest events and an expired worker lease do not duplicate a job, item, or Blob part.
+- Queued-job recovery re-emits work after an initial event-send failure.
+- Cancellation aborts multipart state and releases entitlement reservation.
+- Ad-hoc concurrency/file/byte/storage/egress limits fail before unbounded work and settle actual usage.
+
+### Inventory and change sync
+
+- My Drive with more than 1,000 files fully paginates.
+- Shared drive with more than 1,000 files fully paginates.
+- Multiple shared drives are isolated into corpora; `incompleteSearch` triggers narrowing.
+- `drives.list` itself paginates; every corpus has independent initial/current/committed change tokens.
+- Initial start token + inventory + reconciliation captures a mutation during crawl.
+- `nextPageToken` and final `newStartPageToken` commit correctly.
+- Removal/lost access creates a tombstone, while a corpus move only updates provenance.
+- Checkpoint resumes without skips or duplicates.
+- Non-advancing token fails partial with typed warning.
+- Selection change invalidates incompatible checkpoint.
+
+### Content transfer
+
+- Small UTF-8 text stays within inline bound.
+- Large text becomes an artifact.
+- Blob file streams through Nango Proxy without buffering or MCP base64.
+- Multipart is used above 100 MiB.
+- A matching `206`/`Content-Range` resumes the source revision; a `200` restarts from zero; source-version mismatch discards incompatible parts.
+- A worker stops after a committed multipart part, a new invocation resumes from persisted upload ID/parts/offset, and completion produces one valid object.
+- Workspace export under 10 MB succeeds.
+- Workspace export above 10 MB uses the exact long-running flow (including initial `done=true`, resource key, Operation expiry, and partial-download flag) or records typed unsupported status.
+- Sheet normalization parses only configured rows/cells/sheet name from a Drive export and fails typed when the parser budget is exceeded; no v1 cell-range claim appears in schema.
+- Slides return an archive artifact plus `normalizedContentStatus='unavailable_v1'` until a separately tested normalization adapter exists.
+- Remote-MCP eligibility-filter tests are separate from REST bulk skip-policy tests; REST `canDownload` false/restriction/encryption/trash/provider-error paths produce explicit manifest outcomes.
+- Content failure retains metadata.
+- Raw provider URL/token never appears in result, DB, or logs.
+- Cross-tenant artifact renew/read is denied.
+- 15-minute URL, seven-day expiry, and cleanup are enforced.
+- Cleanup marks scheduled archive references `expired_rehydratable`; no cross-job object is deleted because v1 has no cross-job deduplication.
+- Finalizer streams more manifest rows than fit memory and the window reader fetches only the requested Blob range.
+
+### Scheduler and billing
+
+- Drive binding is accepted only with exact deterministic read requirements.
+- Initial snapshot and incremental change modes persist records/checkpoints.
+- Changed-only content retrieval prevents repeated byte downloads.
+- 240-second budget exits partial with a durable checkpoint.
+- Fair connection slice prevents one Drive from starving other connections.
+- One scheduled occurrence consumes exactly one `scheduledEventUnit` while separately recording Google quota units.
+- Lease retry of the same occurrence does not double charge.
+- Concurrent occurrence/connection lock prevents overlapping Drive crawls.
+- Run receipt totals reconcile with stored records/artifacts.
+
+### MCP protocol
+
+- Connection endpoint `initialize -> client sends notifications/initialized -> tools/list -> tools/call` works with API key and OAuth caller.
+- `tools/list` returns only the selected connection's callable tools.
+- Read-only mode hides writes.
+- Every Tool has valid object-root `inputSchema`; output schemas validate structured content.
+- Cursor pagination is opaque and revision-bound.
+- V1 stateless connection/root transports do not advertise list-changed; a revision change invalidates an old cursor and the next request sees the new catalog.
+- Trusted/absent Origin behavior passes; an untrusted present Origin returns 403 on both root and connection endpoints.
+- Missing required dual Accept values returns 406; unsupported `MCP-Protocol-Version` is rejected; valid notifications return HTTP 202 with an empty body.
+- Compatibility describe matches the exact corresponding native Tool/schema hash.
+- Google's preview MCP live canary discovers its documented eight tools when feature flag and preview access are enabled.
+- The public preview connection hides `download_file_content`, `create_file`, and `copy_file` in read-only mode; bounded `read_file_content` enforces the gateway response cap.
+
+### Production smoke
+
+Using a dedicated test Drive/account:
+
+1. connect full-read profile and verify granted scope;
+2. prove nonzero live Nango tools and exact policy intersection;
+3. describe `list-drive-files` through root MCP;
+4. list the same tool through the connection MCP;
+5. export a seven-day metadata corpus spanning more than one page;
+6. export one small Google Doc;
+7. stream one binary larger than the inline/action limits to private Blob;
+8. run one scheduled Drive occurrence and verify one scheduled-event billing unit plus separately reported Google quota units;
+9. renew the manifest URL as owner and reject a different tenant;
+10. disconnect/reconnect or toggle actions and verify catalog revision behavior.
+
+## Release sequence and phase gates
+
+### Gate 0 — spec and source truth
+
+- This spec accepted.
+- Clean current release worktrees.
+- Live sanitized baseline saved in release receipt.
+- No secret material in artifacts.
+- Spike A proves low-level paginated Nango MCP `tools/list` capture preserves raw title, description, input/output schemas, annotations, icons, execution metadata, and cursors before Mastra conversion.
+- Spike B proves Nango Proxy streams Drive bodies, forwards a bounded Range, preserves `206`/`Content-Range`, handles `200` restart, and can follow or explicitly proxy a Drive LRO final download URI/resource key without credential leakage.
+- Spike C proves a manual private Vercel Blob multipart upload can persist upload ID/path/completed parts plus serializable incremental SHA-256 state, stop one invocation, resume/hash in another, complete once, and abort on cancellation.
+- Spike D proves the Nango post-connection metadata path for non-secret granted scopes, or approves the narrow in-memory credentials fallback.
+- Product decisions set ad-hoc file/byte/concurrency/storage/egress entitlements and confirm seven-day ephemeral archive retention.
+- Implementation does not begin past the affected boundary until its spike has a saved test/receipt.
+
+### Gate 1 — OAuth and live read tools
+
+- Google Cloud production OAuth credentials/scopes configured in Nango.
+- Google verification/security gate status recorded.
+- Source-controlled Drive functions compile/deploy.
+- The exact ten-tool Gate 1 read set, and no aspirational later tools, appears live.
+- Live catalog and policy manifest match.
+- Existing Drive account reauthorized and active.
+- Interactive safe reads work through generic root MCP and scheduled Mastra injection.
+
+### Gate 2 — native schema passthrough
+
+- Nango describe route and main dispatch shipped.
+- Connection-scoped MCP endpoint ships `tools/list`/`tools/call`.
+- Schema sanitization/pagination/cache/revision-invalidation/stateless transport tests pass.
+- Google remote MCP adapter remains feature-flagged but passes conformance test where preview access exists.
+
+### Gate 3 — deterministic metadata export
+
+- Drive datasets, inventory, shared-drive traversal, changes reconciliation, checkpoints, and manifests pass tests.
+- `export_connected_service_data(lastDays=7)` no longer loops provider reads through the model.
+- Main/scheduler contracts agree.
+
+### Gate 4 — large content and private artifacts
+
+- Stream/multipart/Range/LRO paths validated.
+- A transfer is interrupted after a committed part and resumes in another worker invocation without duplicated/corrupted bytes.
+- Per-file and manifest owner isolation/retention/renewal/cleanup pass.
+- No payload above 2 MB uses a Nango Action; no large body enters MCP JSON.
+
+### Gate 5 — scheduled automatic ingestion
+
+- Drive deterministic `connection_sync` adapter enabled.
+- UI exposes Drive schedule configuration.
+- Initial and incremental runs produce receipts.
+- One occurrence/one `scheduledEventUnit` invariant is proven; Google quota units are separately reconciled.
+
+### Gate 6 — writes
+
+- The reviewed `upload-document` action ships first; additional mutations require their own exact source/schema/policy entries.
+- Required scopes verified and reauthorization path proven.
+- Account action switch, exact grants, audit, and idempotency pass.
+- Destructive scheduled actions remain blocked until their own approved release.
+
+### Gate 7 — full surface release
+
+- Main, scheduler, web, and SDK repos committed/pushed.
+- Vercel main/scheduler/web production deployments ready.
+- npm packages published in the required order.
+- generated MCP manifest/MCPB/README/docs versions agree.
+- hosted and npm `tools/list` parity checks pass.
+- integrations and scheduler pages verified on desktop/mobile production.
+- final release receipt includes every deployment/version/proof result.
+
+## Done contract
+
+The work is not “done” because Google Drive shows a green OAuth dot. It is done only when all statements below are simultaneously true:
+
+- the connection is active with the intended access profile and granted scopes;
+- live provider functions exist and exactly match reviewed policy;
+- the user can discover and call safe interactive tools;
+- action tools are separately scoped, disabled by default, and exactly gated;
+- “last seven days” and folder/Drive exports are one server-owned operation, not N model calls;
+- initial inventory and Drive Changes reconciliation cover My Drive and shared drives;
+- large content streams into private tenant-owned artifacts with explicit per-file outcomes;
+- scheduled Drive sync resumes, stores changed records/content references, and bills once per occurrence;
+- connection-native `tools/list` returns sanitized live provider schemas;
+- root compatibility describe works for Nango and remote MCP transports;
+- UI, SDK, docs, generated manifests, npm, and Vercel production all reflect the same capability state;
+- production receipts prove the behavior with real Drive data without exposing secrets or content.
+
+## Explicit non-goals for the first release
+
+- Treating Nango's Picker-oriented `documents` sync as proof of complete whole-Drive coverage.
+- Returning binary/base64 content through MCP or Nango Actions.
+- Using Google's Developer Preview remote MCP as a backup/export API.
+- Autonomous Nango polling outside MCP Scraper scheduled-event billing.
+- Giant ZIP creation inside one Vercel request.
+- Enabling empty-trash, ownership transfer, public-link mutation, or destructive shared-drive actions in schedules.
+- Registering every provider action globally on the fixed root MCP.
+
+## Official references
+
+- [MCP stable Tool discovery and calls](https://modelcontextprotocol.io/specification/2025-11-25/server/tools)
+- [MCP stable schema reference](https://modelcontextprotocol.io/specification/2025-11-25/schema)
+- [MCP cursor pagination](https://modelcontextprotocol.io/specification/2025-11-25/server/utilities/pagination)
+- [MCP experimental Tasks](https://modelcontextprotocol.io/specification/2025-11-25/basic/utilities/tasks)
+- [Google Drive OAuth scopes and classifications](https://developers.google.com/workspace/drive/api/guides/api-specific-auth)
+- [Google Drive files.list](https://developers.google.com/workspace/drive/api/reference/rest/v3/files/list)
+- [Google Drive change start tokens](https://developers.google.com/workspace/drive/api/reference/rest/v3/changes/getStartPageToken)
+- [Google Drive changes.list](https://developers.google.com/workspace/drive/api/reference/rest/v3/changes/list)
+- [Google Drive change-log guidance](https://developers.google.com/workspace/drive/api/guides/about-changes)
+- [Google Drive download and export guide](https://developers.google.com/workspace/drive/api/guides/manage-downloads)
+- [Google Drive long-running downloads](https://developers.google.com/workspace/drive/api/guides/long-running-operations)
+- [Google Drive files.export and 10 MB limit](https://developers.google.com/workspace/drive/api/reference/rest/v3/files/export)
+- [Google Workspace export MIME mappings](https://developers.google.com/workspace/drive/api/guides/ref-export-formats)
+- [Google Drive error and backoff guidance](https://developers.google.com/workspace/drive/api/guides/handle-errors)
+- [Google Drive API usage limits](https://developers.google.com/workspace/drive/api/guides/limits)
+- [Google official remote Drive MCP setup](https://developers.google.com/workspace/drive/api/guides/configure-mcp-server)
+- [Google Drive MCP Tool reference](https://developers.google.com/workspace/drive/api/reference/mcp)
+- [Google Drive MCP file eligibility](https://developers.google.com/workspace/drive/api/guides/drive-mcp-server-file-eligibility)
+- [Google Drive MCP download_file_content](https://developers.google.com/workspace/drive/api/reference/mcp/tools_list/download_file_content)
+- [Nango Google Drive integration](https://nango.dev/docs/api-integrations/google-drive)
+- [Nango Google Drive files sync guide](https://nango.dev/docs/api-integrations/google-drive/how-to-use-google-drive-files-sync)
+- [Nango Proxy](https://nango.dev/docs/guides/platform/proxy-requests)
+- [Nango limits, including 2 MB Action output](https://nango.dev/docs/guides/platform/limits)
+- [Vercel Blob](https://vercel.com/docs/vercel-blob)
+- [Vercel Blob SDK and multipart uploads](https://vercel.com/docs/vercel-blob/using-blob-sdk)