Marketplace

V3 Terraform CLI capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local terraform CLI ingredient exposes bounded infrastructure-as-code operations for readiness, recursive format checking, and configuration validation. Project operations run from an explicit Terraform working directory cwd supplied at execution time, use Terraform's built-in machine-readable diagnostics where available, avoid caller-supplied Terraform flags, avoid shell wrappers, and never expose plan, apply, destroy, state, import, workspace, init, provider installation, module download, variable files, backend mutation, or arbitrary command execution. Format checking is read-only. Validation is approval-gated because Terraform may execute installed provider plugins while loading provider schemas. Requires terraform on PATH and an already initialized working directory when provider schemas are needed.

V3 deterministic image-OCR capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local tesseract CLI ingredient exposes bounded operations for readiness, installed language discovery, plain-text OCR, and TSV OCR with word boxes/confidence. Fixed-function and reproducible: OCR happens locally before any model sees the image, no caller-supplied Tesseract config files, no user words/patterns, no tessdata path override, no arbitrary flags, no stdin, and no shell wrapper. OCR outputs are faithful local file writes into engine-managed throwaway temp dirs, captured as result.file_ref, and consumed by downstream ai-* steps through Gateway-gated file refs. The source can be a data.file ref or a trusted local path. Requires the tesseract binary and requested language data on PATH (Debian/Ubuntu: apt install tesseract-ocr tesseract-ocr-eng; macOS: brew install tesseract). Local and no-egress, but image decoding still depends on Leptonica/Tesseract format parsers; prefer file_ref sources and keep the OCR stack patched.

V3 deterministic HTML cleanup and conversion capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local HTML Tidy CLI ingredient exposes readiness plus fixed HTML formatting and XHTML conversion operations. Fixed-function and reproducible: the executor materializes the source HTML and owns the throwaway output directory, while tidy writes fixed result files that are captured as result.file_ref. Write-tier but approval=never: tidy writes only to an engine-managed output dir, exposes no arbitrary flags or config file, and never streams source bytes through op-step values. Requires the tidy binary on PATH (Debian/Ubuntu: apt install tidy; macOS: brew install tidy-html5). Local and no-egress.

API capability pack for bounded Todoist API v1 operations against https://api.todoist.com only. Reads active tasks, fixed daily task views (today, overdue, upcoming, no-date, priority-1), flexible filtered task views, projects, sections, labels, and comments, and supports approval-gated task creation, metadata updates, moves, close/reopen actions, and comment creation. Bundles a scheduled daily task digest, an AI-assisted task/project brief, and an approval-gated task intake workflow. This is intended for daily personal and one-person-company task capture, triage, follow-up, and project review workflows. Enroll a Todoist personal token or OAuth access token connection as bearer auth; no credential is embedded in the manifest. The pack intentionally excludes deletes, bulk operations, project/section/label mutation, reminders, file uploads, collaboration/admin settings, templates/import/export, webhooks, arbitrary sync commands, and arbitrary API passthrough.

Workflow pack for Recued-created Todoist tasks. It composes the Todoist capability pack with a closure ledger: create one owner-approved task, optionally in one live Todoist project, persist only the connection/task/project linkage in data.shared, and let a scheduled watcher re-read that exact task until Todoist reports it checked, completed, or deleted. Completion closes the Recued row; deletion marks it for owner review instead of silently treating it as done. This pack does not replace Todoist due dates, reminders, filters, labels, sections, projects, recurring-task behavior, templates, automations, webhooks, native task completion controls, or general task reporting; it adds Recued-visible closure state for Todoist tasks Recued created.

Workflow pack for Recued-created Todoist task comments. It composes the Todoist capability pack with a closure ledger: add one owner-approved comment to an existing Todoist task, persist only the connection/task/comment linkage in data.shared, and let a scheduled watcher re-read that exact task and comment until Todoist reports the task checked, completed, deleted, or the comment deleted. Completion closes the Recued row; deletion marks it for owner review instead of silently treating it as done. This pack does not replace Todoist comments, native notifications, task completion controls, reminders, filters, labels, sections, projects, recurring-task behavior, templates, automations, webhooks, or general task reporting; it adds Recued-visible closure state for task comments Recued created.

API capability pack for bounded Together AI REST API operations against https://api.together.ai/v1 only. Enroll a Together AI bearer API-key connection named togetherai; no credential is embedded in this manifest. The pack reads the model catalog, creates non-streaming chat completions, legacy text completions, embeddings, rerank responses, prompt-only image generations, and reads deployment, deployment-log, and hardware inventory for open-model inference, RAG preparation, relevance review, image ideation, model selection, and dedicated-capacity operations. Generation, embedding, rerank, and image calls are read-tier inference calls that consume Together AI quota but do not create durable customer resources through this pack. The pack intentionally excludes streaming, tool/function calling, arbitrary extra request fields, OpenAI Assistants/Threads/Runs, file upload/download/delete, batches, audio speech/transcription/translation, video generation, image edits/inpainting/reference images/image LoRAs, disable_safety_checker, model upload, fine-tune job mutation, deployment create/update/delete, endpoint/secret/storage mutation, code interpreter/sandbox APIs, external base URLs, custom host switching, and arbitrary Together AI API passthrough.

API capability pack for bounded Toggl Track API v9 operations against https://api.track.toggl.com/api/v9 only. Reads the current user, workspaces, clients, projects, tasks, and time entries for daily solo-business time tracking. Writes cover approval-gated client, project, task, and time-entry create/update/stop operations for ordinary timesheet setup and cleanup. Enroll a Toggl Track API connection as HTTP Basic auth using the email/username and API token/password pair documented by Toggl; no credential is embedded in the manifest. The pack intentionally excludes account/profile edits, workspace settings, organizations, users, groups, billing, invoices, expenses, reports, reminders, webhooks, deletes, archive/restore endpoints, bulk edits, imports, exports, sharing management, approvals, and arbitrary API passthrough.

V3 deterministic codebase language statistics capability pack. By-value connector composition (service_kind=cli, no separate ingredient): the local tokei CLI counts files, lines, code, comments, and blanks for one trusted local source tree and returns aggregate JSON via the codebase.language_stats catalog operation. Fixed-function and reproducible: no arbitrary tokei flags, no previous-run input file, no per-file path listing, no hidden-file override, no ignore-file bypass, no shell wrapper, and no network egress. Requires tokei on PATH (macOS: brew install tokei; Rust environments: cargo install tokei). Local and no-egress.

Full-capacity Trello REST API v1 capability pack against https://api.trello.com only. Reads members, boards, Workspaces, lists, cards, actions/comments, labels, checklists/check items, attachments, custom fields, search results, and webhooks; action lists page automatically and assigned visible cards sync as a read-only task Source. Approval-gated writes create/update/archive boards and lists, create/update/archive cards, move and assign cards, add/update/delete comments, manage labels and checklists, add URL attachments, update custom-field values, and manage webhooks. Card create/update use Trello's documented JSON-body alternative; other writes retain their documented query placement. The pack excludes enterprise and membership administration, board permission/invitation/voting governance, Power-Up/plugin management, token expansion, batch or arbitrary passthrough, file-upload bodies, voting, and stickers.

Workflow pack for Recued-created Trello cards. It composes the Trello capability pack with a closure ledger: create one owner-approved card in one live Trello list, persist only the connection/board/list/card linkage in data.shared, and let a scheduled watcher re-read that exact card until Trello reports it archived, due-complete, or in a configured terminal list. This pack does not replace Trello card archive controls, due-complete controls, list workflows, board views, reminders, Butler automation, native notifications, webhooks, comments, checklists, member assignment, labels, attachments, or general project reporting; it adds Recued-visible closure state for Trello cards Recued created.

Workflow pack for Recued-created Trello card comments. It composes the Trello capability pack with a closure ledger: add one owner-approved comment to an existing Trello card, persist only the connection/card/comment linkage in data.shared, and let a scheduled watcher re-read that exact card until Trello reports it archived, due-complete, or in a configured terminal list. This pack does not replace Trello card comments, native notifications, card archive or due-complete controls, board views, reminders, Butler automation, webhooks, or general project reporting; it adds Recued-visible closure state for card comments Recued created.

V3 local filesystem security capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local trivy CLI ingredient exposes bounded project operations for readiness, dependency/IaC security scanning, and CycloneDX SBOM generation. Operations accept one trusted filesystem target, avoid caller-supplied Trivy flags, avoid shell wrappers, and keep findings or SBOM output as JSON. Security scans use filesystem target mode, vuln+misconfig scanners only, JSON output, and no output file; they expose no container image scan, Kubernetes scan, repo clone, server/client mode, secret scanning, license-policy scan, caller-supplied config/check/template/VEX/ignorefile paths, registry credentials, module/plugin actions, or arbitrary command execution. Approval is ask because Trivy may update vulnerability and check databases before scanning. Requires trivy on PATH. Network egress may occur for Trivy database/check updates.

V3 local secret-discovery capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local trufflehog CLI ingredient exposes bounded operations for readiness, filesystem secret scans, and local Git-history secret scans. Filesystem scans accept one trusted file or directory and Git scans run from an explicit project directory cwd against file://.; both return JSONL findings. Fixed-function and reproducible at the invocation boundary: JSON output, no verification/API login checks, no update check, no GitHub/GitLab/cloud/container/CI/Elasticsearch/Jenkins/Postman sources, no caller-supplied config, no custom verifier endpoints, no detector include/exclude lists, no archive expansion, no output-file write, no stdin, no arbitrary flags, and no shell wrapper. Findings use TruffleHog's --fail exit code and are represented as successful JSONL output; real scan errors still fail. Requires trufflehog on PATH. Local and no-egress when used with --no-verification and --no-update.

One-install Twilio API front door over four bounded feature packs and five workflows. It admits 186 of 197 operations from the hash-pinned Twilio 2010-04-01 OpenAPI document. The compatibility root preserves 21 safe prior operation IDs, routes, argument keys, approval contracts, and cache behavior while dependencies add 165 operations. The former account.read route is intentionally removed because Twilio returns auth_token in the Account response. Seven credential-bearing responses, two credential-bearing SIP writes, and one live validation-code response are excluded fail-closed. New reads are uncached and require no approval, every new mutation requires approval, form mutations use closed typed fields, and unsafe JSON integers remain exact strings.

Twilio balance, notifications, API-key metadata, signing-key metadata, SIP domains and access controls, usage records, and usage-trigger administration. This bounded leaf carries 57 hash-pinned Twilio 2010-04-01 operations. Every mutation requires approval, reads are uncached and require no approval, form mutations expose closed typed fields, JSON responses preserve unsafe integers, and Basic credentials come only from the enrolled connection. Credential-bearing routes and the live caller-ID validation-code route are excluded fail-closed.

Twilio conferences, participants, queues, members, recordings, transcriptions, recording add-on results, and payload metadata. This bounded leaf carries 38 hash-pinned Twilio 2010-04-01 operations. Every mutation requires approval, reads are uncached and require no approval, form mutations expose closed typed fields, JSON responses preserve unsafe integers, and Basic credentials come only from the enrolled connection. Credential-bearing routes and the live caller-ID validation-code route are excluded fail-closed.

Twilio messaging, media metadata, calls, call events, notifications, Pay sessions, streams, SIPREC, real-time transcription, and user-defined call messages. This bounded leaf carries 22 hash-pinned Twilio 2010-04-01 operations. Every mutation requires approval, reads are uncached and require no approval, form mutations expose closed typed fields, JSON responses preserve unsafe integers, and Basic credentials come only from the enrolled connection. Credential-bearing routes and the live caller-ID validation-code route are excluded fail-closed.

Twilio address, application, Connect App, available-number, incoming-number, assigned add-on, outgoing caller ID, and short-code administration. This bounded leaf carries 48 hash-pinned Twilio 2010-04-01 operations. Every mutation requires approval, reads are uncached and require no approval, form mutations expose closed typed fields, JSON responses preserve unsafe integers, and Basic credentials come only from the enrolled connection. Credential-bearing routes and the live caller-ID validation-code route are excluded fail-closed.

API capability pack for bounded Typeform API operations against https://api.typeform.com only. Reads workspaces, forms, form copy and translation payloads, submitted and partial form responses, image/theme inventory, and webhook configuration for lead intake, customer feedback, surveys, and lightweight support handoff workflows. Enroll a Typeform personal access token or OAuth access token connection as bearer auth; no credential is embedded in the manifest. The pack can approval-gate creating one form from explicit fields/settings and create/update one webhook destination for practical intake automation. It intentionally excludes form full update/delete, response deletion, webhook deletion, webhook signing-secret setting or rotation, image/theme mutation or upload/delete, workspace member changes, and arbitrary API passthrough.

V3 TypeScript compiler capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local tsc CLI ingredient exposes bounded project operations for readiness and TypeScript type-check diagnostics. Type-checking runs from an explicit project directory cwd supplied at execution time, uses one tsconfig path, disables emit, disables incremental state writes, disables pretty/ANSI output, avoids caller-supplied compiler flags, avoids shell wrappers, and keeps type errors visible as text output. The pack exposes no watch mode, build mode, JavaScript/declaration emit, plugin installation, package manager invocation, stdin, environment override, or arbitrary command execution. Requires tsc on PATH. Local and no-egress.

V3 deterministic ZIP archive capability pack. By-value connector composition (service_kind=cli, no separate ingredient): the local unzip CLI exposes readiness, archive listing, verbose metadata listing, CRC integrity testing, and extraction of one requested ZIP entry into an engine-managed output directory. Read operations are path-based because member names, metadata, and test diagnostics are stdout value output. Extraction materializes the source ZIP and writes only under an engine-managed output directory, while -j strips archive paths from the extracted filename. Fixed-function and reproducible: no recursive all-entry extraction, overwrite target, password, text conversion, archive mutation, wildcard expansion knobs, caller-chosen filesystem target, or arbitrary unzip flags. Requires unzip on PATH (Debian/Ubuntu: apt install unzip; macOS: unzip is commonly installed with system tools). Local and no-egress.

V3 Astral uv Python toolchain capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local uv CLI ingredient exposes bounded project operations for readiness, lockfile freshness checks, dependency tree inspection, requirements export, CycloneDX SBOM generation, dependency vulnerability audit, and pytest execution through uv. Project operations run from an explicit project directory cwd supplied at execution time through the native cli_invocation cwd field, avoid caller-supplied uv flags, avoid shell wrappers, and keep diagnostics visible as text or JSON output. Lock, tree, and export operations use locked/check/offline/no-Python-download modes and never write the lockfile or sync the environment. Dependency audit is approval-gated because package inventory is sent to the fixed OSV advisory service. Test execution is approval-gated because pytest imports and executes project code in the discovered uv environment. Requires uv on PATH.

Vercel teams, users, access groups, authentication, firewall security, billing metadata, AI Gateway, and observability administration. Generated from the current hash-pinned official Vercel OpenAPI document. Reads are uncached; sensitive reads are marked sensitive-read. Every mutation is grant-off and approval-gated, and administrative or destructive changes require approval every run.

Vercel Edge Config, cache invalidation, feature flags, environment variables, artifacts, and container-registry operations. Generated from the current hash-pinned official Vercel OpenAPI document. Reads are uncached; sensitive reads are marked sensitive-read. Every mutation is grant-off and approval-gated, and administrative or destructive changes require approval every run.

Vercel projects, deployments, aliases, checks, routes, rolling releases, project membership, and sandbox runtime operations. Generated from the current hash-pinned official Vercel OpenAPI document. Reads are uncached; sensitive reads are marked sensitive-read. Every mutation is grant-off and approval-gated, and administrative or destructive changes require approval every run.

Vercel domains, registrar, DNS, certificates, Secure Compute networking, connectors, and bulk redirects. Generated from the current hash-pinned official Vercel OpenAPI document. Reads are uncached; sensitive reads are marked sensitive-read. Every mutation is grant-off and approval-gated, and administrative or destructive changes require approval every run.

V3 deterministic shell-script lint capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local shellcheck CLI ingredient exposes bounded project operations for readiness and shell-script lint diagnostics. Lints run from an explicit project directory cwd supplied at execution time, inspect one trusted local shell script path, and return JSON diagnostics via the shell.script_lint catalog operation. Fixed-function and reproducible: no arbitrary shellcheck flags, no shell wrapper, no sourced-file following, no caller-supplied rc/config path, and no network egress. Findings are represented as JSON output instead of failing the op; real invocation errors still fail. Requires shellcheck on PATH (Debian/Ubuntu: apt install shellcheck; macOS: brew install shellcheck). Local and no-egress.

API capability pack for bounded Shippo shipping operations against https://api.goshippo.com only. Enroll a Shippo API token connection named shippo using Authorization: ShippoToken <token>; no credential is embedded in the manifest. The pack reads and creates addresses, parcels, shipments/rates, label transactions, tracking status, orders, and refunds for ecommerce shipping workflows. It bundles a scheduled shipping operations digest, a shipment/rate brief, a tracking brief, an approval-gated rate-shopping workflow, and an always-approval label purchase workflow. Writes are limited to one address, parcel, shipment, label transaction, or refund at a time. The pack intentionally excludes carrier-account mutation, batches, pickups, manifests, customs write helpers, webhooks, OAuth/platform account management, arbitrary API passthrough, and credential-bearing arguments.

API capability pack for bounded ShipStation API V2 operations against https://api.shipstation.com only. Enroll a ShipStation API-key connection named shipstation; no credential is embedded in the manifest. The pack reads shipments and rates, labels and tracking, fulfillments, inventory levels and inventory warehouses, shipping warehouses, purchase orders, suppliers, and carrier services. It bundles read-only fulfillment and inventory briefs plus approval-gated shipment creation, label purchase, and purchase-order receipt workflows. Label purchase, label void, shipment cancellation, and purchase-order receipt always require approval because they can incur charges, reverse fulfillment state, or change physical inventory. Shipment definitions remain explicit caller input and may use ShipStation's supported optional fields, including sales-order creation. The pack intentionally excludes carrier disconnect/funding, warehouse and supplier administration, batches, manifests, pickups, webhooks, tag and document mutation, bulk rate comparison, arbitrary label creation, arbitrary API passthrough, and credential-bearing arguments.

API capability pack for bounded Shopify Admin GraphQL operations over the 2026-04 Admin API. Enroll a shopify API connection with base_url set to the merchant shop host, for example https://example.myshopify.com; each operation posts to /admin/api/2026-04/graphql.json. The connection must carry a Shopify Admin API access token using Shopify's X-Shopify-Access-Token header. The pack reads shop metadata, products, product variants, inventory items and levels, customers, orders, fulfillments, and tracking details through fixed GraphQL documents. It also bundles a scheduled store operations digest, an AI-assisted order and fulfillment review brief, and approval-gated order triage update workflow. The bundled recipes only use order.note.update and order.tags.add as writes. It exposes only narrow approval-gated daily writes: turn a product on/off, rename a product, update one variant price, update an internal order note, and add/remove order tags. It does not expose arbitrary GraphQL, storefront buyer APIs, product creation, inventory edits, fulfillment creation or updates, refunds, cancellations, order edit sessions, webhooks, or app billing.

Workflow pack for Shopify order customer replies. It composes the Shopify capability pack with Email / Outbox and the existing outbound response loop: read one order and its customer context, draft a grounded plain-text response, send only when send_reply is explicitly enabled so the mail-send approval boundary handles the customer-facing write, then watch the customer reply and surface actionable responses for owner follow-up or conversion. Shopify remains read-only in this workflow; it does not edit orders, fulfillments, products, prices, inventory, refunds, cancellations, notes, tags, arbitrary GraphQL, storefront buyer APIs, Shopify Inbox, Shop product reviews, or Shopify Flow automations.

One-install Shortcut REST v3 front door over three bounded domain packs and nine operating workflows. It admits 142 of 143 operations in the current official contract, including every JSON REST feature and all six deprecated milestone aliases. The sole exclusion is multipart file upload, which the current static JSON REST composition cannot serialize; file reads/updates/deletes and URL-backed linked-file creation remain available. A documentary read-only Story Source mirrors non-archived stories through stable next-token search pagination and fresh detail reads. Enroll a Shortcut-Token header connection at https://api.app.shortcut.com; the token grants complete access to its workspace and must never be rendered or logged. Reads are uncached; content-, people-, repository-, file-, and integration-sensitive reads are marked sensitive-read except Source sync/read and bounded workspace metadata. Every mutation is grant-off and approval-gated. Bundled chat workflows use approval-free read metadata only, while content reviews and all writes are non-chat.

Shortcut epics, objectives, legacy milestones, iterations, categories, projects, key results, health, and planning workflow operations. Generated from the hash-pinned official Shortcut REST v3 OpenAPI contract. The connection owns the complete Shortcut-Token header and the fixed https://api.app.shortcut.com origin; no credential or routing input is recipe-controlled. Read caching is disabled. Content-, people-, repository-, file-, and integration-sensitive reads are marked sensitive-read except the two installed Story Source operations; every mutation is grant-off and approval-gated. Shortcut API tokens grant complete access to one workspace and must never be rendered or logged.

Shortcut story CRUD, bulk actions, comments, tasks, reactions, history, search, story links, file metadata, linked files, and external-link lookups. Generated from the hash-pinned official Shortcut REST v3 OpenAPI contract. The connection owns the complete Shortcut-Token header and the fixed https://api.app.shortcut.com origin; no credential or routing input is recipe-controlled. Read caching is disabled. Content-, people-, repository-, file-, and integration-sensitive reads are marked sensitive-read except the two installed Story Source operations; every mutation is grant-off and approval-gated. Shortcut API tokens grant complete access to one workspace and must never be rendered or logged.

Shortcut documents, templates, custom fields, groups, labels, members, workflows, repositories, and generic webhook integration operations. Generated from the hash-pinned official Shortcut REST v3 OpenAPI contract. The connection owns the complete Shortcut-Token header and the fixed https://api.app.shortcut.com origin; no credential or routing input is recipe-controlled. Read caching is disabled. Content-, people-, repository-, file-, and integration-sensitive reads are marked sensitive-read except the two installed Story Source operations; every mutation is grant-off and approval-gated. Shortcut API tokens grant complete access to one workspace and must never be rendered or logged.

API capability pack for bounded Slack Web API calls against https://slack.com/api only. Reads auth identity, users, conversations, members, channel history, thread replies, message permalinks, reactions, file metadata, bookmarks, and pinned items, and supports approval-gated message posting, thread replies, message updates, emoji reactions, bookmark creation, and message pinning. Bundles a scheduled channel activity digest, an AI-assisted thread brief, and an approval-gated channel update workflow. This is intended for daily personal, team, and one-person-company communication workflows: inspect channels, find people, summarize recent messages, reply in context, correct a sent bot/user message, save useful channel links, pin important messages, inspect shared file metadata, and acknowledge work with a reaction. Enroll a Slack bot or user token connection as bearer auth; no credential is embedded in the manifest. The pack intentionally excludes message deletes, channel create/archive/rename/topic/purpose changes, open/join/leave/invite/kick flows, file upload/download/delete, bookmark edit/remove, pin remove, user/admin/profile mutation, reminders, stars, workflow/view APIs, SCIM/Audit Logs/Admin APIs, search passthrough, and arbitrary Web API passthrough.

API capability pack for bounded Smartsheet REST API operations against https://api.smartsheet.com/2.0. Enroll a Smartsheet API or OAuth bearer connection named smartsheet with least-privilege read scopes plus WRITE_SHEETS only when approval-gated row or discussion writes are installed. The pack reads the current user, workspaces, workspace children, sheets, columns, rows, discussions, row discussions, reports, and report detail for portfolio review, sheet briefs, and collaboration workflows. It bundles a scheduled workspace portfolio digest, an AI-assisted sheet brief, and approval-gated workflows for adding rows, updating rows, and replying to discussions. Writes are limited to one sheet row batch or one discussion/comment target at a time. The pack intentionally excludes deletes, sharing and permission changes, imports, attachments and downloads, webhooks, group and user administration, copy or move operations, folder or workspace creation, send-email and update-request endpoints, automation mutation, proof mutation, favorites, token endpoints, and arbitrary Smartsheet API passthrough.

Workflow pack for Recued-created Smartsheet row discussions. It composes the Smartsheet capability pack with a closure ledger: create one owner-approved row-level discussion/comment on an existing Smartsheet row, persist only the connection/sheet/row/discussion linkage in data.shared, and let a scheduled watcher re-read that exact row until a configured status column reaches a terminal value. Terminal rows close the Recued row; unreadable rows remain open until a future watcher pass can prove terminal state. This pack does not replace Smartsheet discussions, comments, automations, update requests, reminders, notifications, reports, dashboards, sharing, attachments, proofs, or sheet permissions; it adds Recued-visible closure state for row discussions Recued created.

API capability pack for bounded Snyk REST API reads against https://api.snyk.io/rest only, pinned with version=2024-10-15 on every operation. Enroll a Snyk connection named snyk that injects Authorization with either the documented token header or bearer auth; no credential is embedded in this manifest. The pack reads groups, organizations, projects, issues, targets, collections, and inventory assets for security posture review, vulnerability triage, asset inventory, and developer remediation planning. It bundles a scheduled security posture digest and an AI-assisted issue investigation brief. This slice is read-only: it intentionally excludes deletes, ignore/resolution mutation, project/target/collection mutation, invite and membership administration, app secrets, service account secrets, SSO, settings, policy mutation, export jobs, SBOM uploads/tests, package issue POST queries, and arbitrary Snyk API passthrough.

V3 deterministic audio-transform capability pack. By-value connector composition (service_kind=cli, no separate ingredient): the local SoX CLI exposes readiness, local audio header inspection, duration probing, ASR-friendly WAV conversion, normalized ASR-friendly WAV conversion, telephony WAV conversion, and fixed 30-second preview WAV extraction. Fixed-function and reproducible: conversion happens locally before any model sees the audio. Write-tier operations write only to an engine-managed throwaway output dir and captured WAVs are surfaced as result.file_ref; downstream audio.transcribe / ai-* steps consume them through Gateway-gated file refs. The transform source can be a data.file ref or a trusted local path; path-based inspection ops return stdout text and intentionally do not materialize file_ref input. The pack exposes no arbitrary SoX effects, effect files, combiner modes, playback/recording devices, shell wrapper, stdin/stdout audio pipes, caller-controlled output path, environment override, or network egress. Requires the sox binary and relevant codec support on PATH (Debian/Ubuntu: apt install sox; macOS: brew install sox).

V3 guarded local SQLite read capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local sqlite3 CLI ingredient exposes bounded operations for readiness, schema inspection, table/object inventory, file/page stats, attached database listing, integrity checks, quick checks, foreign-key violation counts, and read-only SQL reports. Bundles a manual read-only query report and a scheduled query-result watch so users can turn local app/business SQLite files into dashboards and alerts. Database operations use sqlite3 safe mode, read-only open mode, JSON output, and PRAGMA query_only=ON; approval is ask because schema, health, and query output can reveal local database contents and arbitrary SELECT text can still be expensive. Requires sqlite3 on PATH (Debian/Ubuntu: apt install sqlite3; macOS: sqlite3 is commonly installed with system tools). Local and no-egress.

One-install Square front door preserving all 21 existing compatibility contracts, adding 277 operations across five bounded domain packs, and bundling 32 non-chat operating workflows. It admits 298 of 334 operations from immutable official OpenAPI commit f9ff8da9443ade43f823f9100f390b9797c1dcd6 at Square-Version 2026-07-15. The pack matches and executes only against the production origin https://connect.squareup.com; the separate Square sandbox origin is documented but not admitted. The explicit exclusions are 26 deprecated routes, three OAuth token-lifecycle routes, four multipart binary uploads, and three executable storefront-snippet routes. Coverage spans payments, refunds, checkout, cards, bank accounts, disputes, Terminal, catalog, inventory, orders, vendors, customers, loyalty, gift cards, bookings, workforce, locations, merchants, invoices, subscriptions, events, and webhooks. Existing root reads retain their 60-second cache and approval behavior; every new leaf mutation is grant-off and approval-gated, and every new leaf read is uncached. Unsafe response integers remain exact strings, nested int64 and provider-keyed-map request bodies use bounded raw JSON, and documented cursor collections walk automatically where the request can be composed safely. No write is hidden behind a read contract, no arbitrary passthrough exists, and no Square record is misrepresented as a task, note, or user-work project Source.

Square invoices, subscriptions, event-log controls, and webhook-subscription administration operations. Generated from the immutable official Square OpenAPI commit f9ff8da9443ade43f823f9100f390b9797c1dcd6 and pinned to Square-Version 2026-07-15. Enroll one production seller connection with OAuth or a bearer access token; this pack matches and executes only against https://connect.squareup.com, not the separate Square sandbox origin. Every leaf read is uncached, every mutation is grant-off and requires approval, all JSON responses preserve unsafe integers as decimal strings, and nested int64 or provider-keyed-map request contracts use bounded raw JSON. Documented cursor collections walk automatically unless a raw JSON request makes safe cursor composition impossible. Deprecated routes, OAuth token lifecycle, unsupported multipart uploads, and executable storefront snippets are excluded. No Square object is declared as a task, note, or user-work project Source.

Square orders, order custom attributes, catalog, inventory, transfer orders, vendors, channels, and online sites operations. Generated from the immutable official Square OpenAPI commit f9ff8da9443ade43f823f9100f390b9797c1dcd6 and pinned to Square-Version 2026-07-15. Enroll one production seller connection with OAuth or a bearer access token; this pack matches and executes only against https://connect.squareup.com, not the separate Square sandbox origin. Every leaf read is uncached, every mutation is grant-off and requires approval, all JSON responses preserve unsafe integers as decimal strings, and nested int64 or provider-keyed-map request contracts use bounded raw JSON. Documented cursor collections walk automatically unless a raw JSON request makes safe cursor composition impossible. Deprecated routes, OAuth token lifecycle, unsupported multipart uploads, and executable storefront snippets are excluded. No Square object is declared as a task, note, or user-work project Source.

Square customers, groups, segments, custom attributes, loyalty accounts and rewards, and gift card operations. Generated from the immutable official Square OpenAPI commit f9ff8da9443ade43f823f9100f390b9797c1dcd6 and pinned to Square-Version 2026-07-15. Enroll one production seller connection with OAuth or a bearer access token; this pack matches and executes only against https://connect.squareup.com, not the separate Square sandbox origin. Every leaf read is uncached, every mutation is grant-off and requires approval, all JSON responses preserve unsafe integers as decimal strings, and nested int64 or provider-keyed-map request contracts use bounded raw JSON. Documented cursor collections walk automatically unless a raw JSON request makes safe cursor composition impossible. Deprecated routes, OAuth token lifecycle, unsupported multipart uploads, and executable storefront snippets are excluded. No Square object is declared as a task, note, or user-work project Source.

Square payments, refunds, payment links, cards, bank accounts, disputes, Terminal, devices, cash drawers, and Apple Pay operations. Generated from the immutable official Square OpenAPI commit f9ff8da9443ade43f823f9100f390b9797c1dcd6 and pinned to Square-Version 2026-07-15. Enroll one production seller connection with OAuth or a bearer access token; this pack matches and executes only against https://connect.squareup.com, not the separate Square sandbox origin. Every leaf read is uncached, every mutation is grant-off and requires approval, all JSON responses preserve unsafe integers as decimal strings, and nested int64 or provider-keyed-map request contracts use bounded raw JSON. Documented cursor collections walk automatically unless a raw JSON request makes safe cursor composition impossible. Deprecated routes, OAuth token lifecycle, unsupported multipart uploads, and executable storefront snippets are excluded. No Square object is declared as a task, note, or user-work project Source.

Square bookings, booking custom attributes, labor, team, merchant, location, and merchant and location custom-attribute operations. Generated from the immutable official Square OpenAPI commit f9ff8da9443ade43f823f9100f390b9797c1dcd6 and pinned to Square-Version 2026-07-15. Enroll one production seller connection with OAuth or a bearer access token; this pack matches and executes only against https://connect.squareup.com, not the separate Square sandbox origin. Every leaf read is uncached, every mutation is grant-off and requires approval, all JSON responses preserve unsafe integers as decimal strings, and nested int64 or provider-keyed-map request contracts use bounded raw JSON. Documented cursor collections walk automatically unless a raw JSON request makes safe cursor composition impossible. Deprecated routes, OAuth token lifecycle, unsupported multipart uploads, and executable storefront snippets are excluded. No Square object is declared as a task, note, or user-work project Source.