fix(connectors): correct defects found validating against live API docs

Validated all 10 new connectors against live provider documentation.
Fixes below; each was verified against the vendor's published spec.

Data loss (sync engine hard-deletes documents past an unflagged cap):
- mintlify: an empty discovery (llms.txt AND sitemap both 404, or an
  HTML-200 llms.txt) returned zero documents without listingCapped,
  which reconciles every stored document away. Now throws.
- zoho-desk: listingCapped never fired at the default caps, since
  500/50 and 500/100 are exact multiples and the flag was only set on
  a mid-page overshoot.
- trello: archived-list cards vanished from an unflagged listing, and
  listingCapped latched permanently on any list of 1000+ cards.
- google-vault: a mid-sync config change left the cursor with no kind,
  discarding the rest of the matters page without the flag.
- pagerduty: more=true with zero incidents ended the listing unflagged.

Correctness:
- zoho-desk: desk.zoho.ca does not resolve; Canada is desk.zohocloud.ca.
  Added the missing SG and AE data centers.
- zoho-desk: modifiedTime is absent from GET /tickets, so the stub and
  hydrated hashes never matched and every ticket re-embedded each sync.
- trello: dateLastActivity is documented to miss some edits, so the hash
  now folds in the badges counters that arrive with the listing.
- microsoft-dataverse: every knowledge article has an internal root
  container that also sets islatestversion, duplicating every document.
- pagerduty: the 10,000-record ceiling bounds offset + limit, so the
  guard admitted a request that 400s after any short page.
- sftp: the incremental cutoff compared against a remote clock, silently
  skipping same-second writes on every subsequent sync.
- box: extracted_text gave up before polling when a representation had
  not been generated yet.
- mintlify: a site whose .md route 404s hydrated every page to nothing
  while validateConfig still passed.

Security:
- microsoft-dataverse: environmentUrl accepted any public HTTPS host
  while every request attaches a bearer token. Pinned to Microsoft's
  Dataverse domains.
- sftp: getDocument used stat, which follows symlinks, so a link under
  rootPath resolved to its target. Now lstat.
- sftp: filenames from readdir were composed into paths unchecked.
- trello: user-supplied board ids were interpolated into URL paths raw.

Resource bounds:
- microsoft-excel: the usedRange metadata read was unbounded, so a
  silently-ignored $select would have buffered the whole grid.
- sftp: no read timeout (readyTimeout covers only the handshake), an
  unbounded pending-directory queue, and oversized files growing the
  listing without limit.
- microsoft-excel: getDocument refetched the workbook and sheet list
  per worksheet.

Coverage: box file extensions, trello attachments and members, zoho-desk
ticket resolution, google-slides WordArt, google-vault Chat holds,
mintlify sitemap-index following.

Author: waleedlatif1

apps/sim/connectors/box/box.ts

@@ -108,15 +108,17 @@ const PLAIN_TEXT_EXTENSIONS = new Set([
 ])
 
 /**
- * Binary/proprietary formats for which Box documents an `extracted_text`
- * representation (see the representation "Supported File Types" table). Content
- * for these is pulled from the representation rather than the raw bytes.
+ * Formats Box lists with `Text? = Yes` in the representation "Supported File
+ * Types" table whose raw bytes are not usable as UTF-8 (binary, proprietary, or
+ * markup-heavy). Content for these is pulled from the `extracted_text`
+ * representation rather than from `GET /files/:id/content`.
  */
 const REPRESENTATION_EXTENSIONS = new Set([
   'boxcanvas',
   'boxnote',
   'doc',
   'docx',
+  'fdx',
   'gdoc',
   'gsheet',
   'gslide',
@@ -130,6 +132,8 @@ const REPRESENTATION_EXTENSIONS = new Set([
   'ppt',
   'pptx',
   'rtf',
+  'vi',
+  'webdoc',
   'wpd',
   'xbd',
   'xdw',
@@ -329,14 +333,13 @@ async function fetchExtractedText(
   accessToken: string,
   entry: BoxRepresentationEntry
 ): Promise<string | null> {
-  const urlTemplate = entry.content?.url_template
   const infoUrl = entry.info?.url
-  if (!urlTemplate) return null
-
+  let urlTemplate = entry.content?.url_template
   let state = entry.status?.state
+  if (!urlTemplate && !infoUrl) return null
 
   for (let attempt = 0; attempt <= REPRESENTATION_POLL_ATTEMPTS; attempt++) {
-    if (state === 'success' || state === 'viewable') {
+    if ((state === 'success' || state === 'viewable') && urlTemplate) {
       const buffer = await downloadWithinLimit(
         urlTemplate.replace('{+asset_path}', ''),
         accessToken
@@ -358,6 +361,7 @@ async function fetchExtractedText(
     } else {
       const info = (await response.json()) as BoxRepresentationEntry
       state = info.status?.state ?? 'pending'
+      urlTemplate = info.content?.url_template ?? urlTemplate
     }
 
     if (state !== 'success' && state !== 'viewable') {

apps/sim/connectors/google-slides/google-slides.ts

@@ -54,12 +54,14 @@ interface SlidesTableRow {
 
 /**
  * A page element on a slide. Exactly one of the visual properties is set;
- * only `shape`, `table`, and `elementGroup` can carry extractable text.
+ * only `shape`, `table`, `wordArt`, and `elementGroup` can carry extractable
+ * text — `image`, `video`, `line`, `sheetsChart`, and `speakerSpotlight` do not.
  */
 interface SlidesPageElement {
   objectId?: string
   shape?: { text?: SlidesTextContent }
   table?: { tableRows?: SlidesTableRow[] }
+  wordArt?: { renderedText?: string }
   elementGroup?: { children?: SlidesPageElement[] }
 }
 
@@ -108,6 +110,9 @@ function collectElementText(
     const shapeText = extractTextContent(element.shape?.text)
     if (shapeText.trim()) parts.push(shapeText)
 
+    const wordArtText = element.wordArt?.renderedText
+    if (wordArtText?.trim()) parts.push(wordArtText.trim())
+
     const rows = element.table?.tableRows
     if (rows) {
       for (const row of rows) {
@@ -443,8 +448,10 @@ export const googleSlidesConnector: ConnectorConfig = {
       } else {
         const probeParams = new URLSearchParams({
           pageSize: '1',
-          q: `mimeType = '${PRESENTATION_MIME_TYPE}'`,
+          q: `trashed = false and mimeType = '${PRESENTATION_MIME_TYPE}'`,
           fields: 'files(id)',
+          supportsAllDrives: 'true',
+          includeItemsFromAllDrives: 'true',
         })
         const response = await fetchWithRetry(
           `https://www.googleapis.com/drive/v3/files?${probeParams.toString()}`,

apps/sim/connectors/google-vault/google-vault.ts

@@ -220,6 +220,9 @@ function renderHold(hold: VaultHold, matterId: string): string {
       String(hold.query.driveQuery.includeSharedDriveFiles)
     )
   }
+  if (hold.query?.hangoutsChatQuery?.includeRooms !== undefined) {
+    appendLine(lines, 'Includes chat spaces', String(hold.query.hangoutsChatQuery.includeRooms))
+  }
   const coveredData = hold.query?.voiceQuery?.coveredData
   if (coveredData && coveredData.length > 0) {
     appendLine(lines, 'Covered Voice data', coveredData.join(', '))
@@ -474,13 +477,28 @@ export const googleVaultConnector: ConnectorConfig = {
       }
     } else {
       const matterIds = state.matterIds ?? []
-      const matterId = matterIds[state.matterIndex ?? 0]
+      const matterIndex = state.matterIndex ?? 0
+      const matterId = matterIds[matterIndex]
       const kind = kinds[state.kindIndex ?? 0]
 
-      if (!matterId || !kind) {
+      if (!matterId || kinds.length === 0) {
         nextState = state.nextMattersPageToken
           ? { phase: 'matters', mattersPageToken: state.nextMattersPageToken }
           : undefined
+      } else if (!kind) {
+        /**
+         * The enabled child kinds shrank while a cursor was in flight (the user
+         * turned holds or saved queries off mid-sync), so the remaining children of
+         * this matter are not listed. Skipping them silently would let deletion
+         * reconciliation hard-delete still-existing documents.
+         */
+        if (syncContext) syncContext.listingCapped = true
+        nextState =
+          matterIndex + 1 < matterIds.length
+            ? { ...state, matterIndex: matterIndex + 1, kindIndex: 0, childPageToken: undefined }
+            : state.nextMattersPageToken
+              ? { phase: 'matters', mattersPageToken: state.nextMattersPageToken }
+              : undefined
       } else {
         try {
           const page = await fetchChildPage(accessToken, matterId, kind, state.childPageToken)

apps/sim/connectors/microsoft-dataverse/meta.ts

@@ -23,7 +23,8 @@ export const microsoftDataverseConnectorMeta: ConnectorMeta = {
       type: 'short-input',
       required: true,
       placeholder: 'https://myorg.crm.dynamics.com',
-      description: 'The base URL of your Dataverse or Dynamics 365 environment.',
+      description:
+        'The base URL of your Dataverse or Dynamics 365 environment, e.g. https://myorg.crm.dynamics.com.',
     },
     {
       id: 'tableName',
@@ -45,8 +46,9 @@ export const microsoftDataverseConnectorMeta: ConnectorMeta = {
       title: 'OData Filter',
       type: 'short-input',
       required: false,
-      placeholder: 'e.g. statecode eq 0',
-      description: 'Optional OData $filter expression appended to the connector filter.',
+      placeholder: 'e.g. statecode eq 3',
+      description:
+        'Optional OData $filter expression combined with the connector filter. Knowledge articles sync in every state — add statecode eq 3 to index only published ones.',
     },
     {
       id: 'maxRecords',

apps/sim/connectors/microsoft-dataverse/microsoft-dataverse.ts

@@ -51,7 +51,11 @@ interface DataverseTable {
   numberField?: string
   /** Option-set column whose formatted value is surfaced as the status tag. */
   statusField?: string
-  /** Connector-owned filter always applied to listings and hydrations. */
+  /**
+   * Connector-owned `$filter` applied to every listing. `getDocument` retrieves by
+   * primary key, which takes no filter, so this only ever shapes which records the
+   * listing surfaces.
+   */
   baseFilter?: string
 }
 
@@ -71,16 +75,23 @@ const TABLES: Record<string, DataverseTable> = {
     htmlFields: ['content'],
     numberField: 'articlepublicnumber',
     statusField: 'statecode',
-    // Every published revision is stored as its own row; only the latest is indexable.
-    baseFilter: 'islatestversion eq true',
+    /**
+     * Every article version is its own row, and Dataverse additionally creates one
+     * hidden root record per article that acts as the container for all versions and
+     * translations. Indexing either produces duplicates of the same article, so the
+     * listing keeps only the latest non-root version.
+     *
+     * @see https://learn.microsoft.com/en-us/power-apps/developer/data-platform/reference/entities/knowledgearticle
+     */
+    baseFilter: 'islatestversion eq true and isrootarticle eq false',
   },
   annotation: {
     entitySet: 'annotations',
     logicalName: 'annotation',
     idField: 'annotationid',
     titleField: 'subject',
     untitled: 'Untitled Note',
-    listFields: ['annotationid', 'subject', 'modifiedon', 'objecttypecode'],
+    listFields: ['annotationid', 'subject', 'modifiedon'],
     contentFields: ['notetext', 'filename', 'mimetype'],
     // Rich-text notes are stored as HTML; plain notes pass through unchanged.
     htmlFields: ['notetext'],
@@ -157,15 +168,31 @@ const FIELD_LABELS: Record<string, string> = {
 /** Raised when the user-supplied environment URL is structurally unusable. */
 class InvalidEnvironmentUrlError extends Error {}
 
+/**
+ * Registrable domains Microsoft serves Dataverse environments from — commercial and
+ * regional clouds (`*.crm[N].dynamics.com`), China (21Vianet), US Government and DoD,
+ * and the legacy German cloud. Matching on the registrable domain rather than each
+ * regional `crmN` prefix keeps new Microsoft regions working without a code change.
+ */
+const DATAVERSE_HOST_SUFFIXES = [
+  '.dynamics.com',
+  '.dynamics.cn',
+  '.dynamics.de',
+  '.microsoftdynamics.us',
+  '.appsplatform.us',
+] as const
+
 /**
  * Normalizes a user-supplied Dataverse environment URL to a bare `https://host` origin.
  *
- * The value reaches the connector straight from the add-connector modal, so it is
- * validated structurally here and every request built from it goes through
- * `secureFetchWithRetry` (DNS + private-IP rejection + IP-pinned connection).
+ * The value reaches the connector straight from the add-connector modal and every
+ * request built from it carries the user's OAuth bearer token, so the host is pinned
+ * to Microsoft's Dataverse domains — otherwise an arbitrary origin here would receive
+ * that token. Requests additionally go through `secureFetchWithRetry` (DNS +
+ * private-IP rejection + IP-pinned connection).
  *
  * @throws {InvalidEnvironmentUrlError} when the value is empty, non-HTTPS, carries
- *   credentials, or is not a parseable absolute URL.
+ *   credentials, is not a parseable absolute URL, or is not a Dataverse host.
  */
 function normalizeEnvironmentUrl(raw: unknown): string {
   const value = typeof raw === 'string' ? raw.trim() : ''
@@ -188,8 +215,11 @@ function normalizeEnvironmentUrl(raw: unknown): string {
   if (parsed.username || parsed.password) {
     throw new InvalidEnvironmentUrlError('Environment URL must not contain credentials')
   }
-  if (!parsed.hostname) {
-    throw new InvalidEnvironmentUrlError('Environment URL must include a host')
+  const hostname = parsed.hostname.toLowerCase()
+  if (!DATAVERSE_HOST_SUFFIXES.some((suffix) => hostname.endsWith(suffix))) {
+    throw new InvalidEnvironmentUrlError(
+      'Environment URL must be a Dataverse environment, e.g. https://myorg.crm.dynamics.com'
+    )
   }
 
   return parsed.origin
@@ -452,8 +482,11 @@ export const microsoftDataverseConnector: ConnectorConfig = {
       return null
     }
 
-    const select = [...table.listFields, ...table.contentFields].join(',')
-    const url = `${environmentUrl}/api/data/${API_VERSION}/${table.entitySet}(${externalId})?$select=${encodeURIComponent(select)}`
+    // Selects every listing column too: `recordToStub` rebuilds the stub from this
+    // record, so `contentHash` only stays stable if `modifiedon` comes back here.
+    const params = new URLSearchParams()
+    params.set('$select', [...table.listFields, ...table.contentFields].join(','))
+    const url = `${environmentUrl}/api/data/${API_VERSION}/${table.entitySet}(${externalId})?${params.toString()}`
 
     const response = await dataverseGet(url, accessToken, false)
 

apps/sim/connectors/microsoft-excel/meta.ts

@@ -20,9 +20,9 @@ export const microsoftExcelConnectorMeta: ConnectorMeta = {
       title: 'Drive ID (SharePoint)',
       type: 'short-input',
       required: false,
-      placeholder: 'Leave empty for OneDrive',
+      placeholder: 'Leave empty for your own OneDrive',
       description:
-        'The SharePoint document library (drive) ID holding the workbook. Leave empty to use your personal OneDrive.',
+        'The SharePoint document library (drive) ID holding the workbook. Leave empty to use your own OneDrive for Business. Workbooks stored in consumer OneDrive are not supported by the Excel API.',
     },
     {
       id: 'spreadsheetSelector',