@jskit-ai/connectors-catalog 0.1.1

package/src/shared/ai.js

@@ -0,0 +1,63 @@
+import { createSchema } from "json-rest-schema";
+import snapshot from "./ai-models.json" with { type: "json" };
+
+const DEFAULT_AI_MODEL = "opencode/big-pickle";
+const aiAccessLabels = Object.freeze({
+  "free-no-setup": "Free · no account or key",
+  "free-with-connection": "Free · connection required",
+  paid: "Paid · connection required",
+  unknown: "Pricing unknown · check provider"
+});
+// These direct API-key routes need no coding subscription or cloud identity
+// exchange. Other upstream entries remain available as framework metadata.
+const directProviders = new Set(["opencode", "zai", "openai", "anthropic", "deepseek", "google", "openrouter",
+  "groq", "mistral", "xai", "cerebras", "togetherai", "perplexity"]);
+const aiCatalogue = Object.freeze({ ...snapshot, providers: Object.freeze(snapshot.providers.map((provider) => Object.freeze({
+  ...provider, connection: directProviders.has(provider.id) ? "api-key" : "framework",
+  models: Object.freeze(provider.models.map((model) => Object.freeze({ ...model, key: `${provider.id}/${model.id}`, providerId: provider.id })))
+}))) });
+const models = new Map(aiCatalogue.providers.flatMap((provider) => provider.models.map((model) => [model.key, model])));
+
+function getAiModel(key) { return models.get(key); }
+
+function listAiModels({ providerId, access, includeDeprecated = false, configurableOnly = false } = {}) {
+  const order = ["free-no-setup", "free-with-connection", "paid", "unknown"];
+  return aiCatalogue.providers.filter((provider) => (!providerId || provider.id === providerId) &&
+    (!configurableOnly || provider.connection === "api-key"))
+    .flatMap((provider) => provider.models).filter((model) =>
+      (includeDeprecated || model.status !== "deprecated") && (!access || model.access === access))
+    .sort((a, b) => a.key === DEFAULT_AI_MODEL ? -1 : b.key === DEFAULT_AI_MODEL ? 1 :
+      order.indexOf(a.access) - order.indexOf(b.access) || a.key.localeCompare(b.key));
+}
+
+const modelItems = Object.freeze(listAiModels({ configurableOnly: true }).map((model) => Object.freeze({
+  value: model.key, title: `${model.name} (${model.providerId})`, props: { subtitle: aiAccessLabels[model.access] }
+})));
+const aiDefinition = Object.freeze({
+  id: "ai", name: "AI", description: "Choose an app AI model and whose account pays. Big Pickle starts without an account or key.",
+  accountModes: ["shared", "per-user"], authenticationMethods: ["none", "api-key"], scopes: [],
+  authenticationMethodsForSettings: (settings = {}) => getAiModel(settings.model ?? DEFAULT_AI_MODEL)?.access === "free-no-setup"
+    ? ["none", "api-key"] : ["api-key"],
+  authenticationLabels: { none: "Free access · no account or key", "api-key": "Use a provider API key" },
+  authenticationHint: "Your app calls the provider directly. A shared account belongs to the app administrator; individual accounts belong to each signed-in app user.",
+  settingsSchema: createSchema({ model: { type: "string", defaultTo: DEFAULT_AI_MODEL,
+    enum: modelItems.map((item) => item.value) } }),
+  settingsFields: [{ name: "model", label: "AI model", searchable: true, items: modelItems,
+    credentialScope: (key) => getAiModel(key)?.providerId,
+    hint: (settings = {}) => {
+      const model = getAiModel(settings.model ?? DEFAULT_AI_MODEL);
+      return `${model ? `${model.name}: ${aiAccessLabels[model.access]}. ` : ""}Search by provider or model. Catalogue dated 10 September 2026; availability can change. No automatic paid fallback.`;
+    } }],
+  apiKeyReferenceHint: "Use an environment reference for an administrator key. For individual accounts, use a private reference your app resolves for the authenticated user. Never put a key in this file.",
+  setup: {
+    url: "https://opencode.ai/docs/zen/",
+    steps: [
+      "Big Pickle and other choices labelled no account or key need no registration. Save and use this model through your application's AI library.",
+      "For a connected model, create a regular API key in that provider's dashboard. Z.AI's GLM-4.7-Flash uses a regular Z.AI key; its Coding Plan is a different product.",
+      "For a shared account, store the administrator's key in Env. For individual accounts, your application must provide private key entry, storage and disconnect controls for each authenticated user.",
+      "Saving selects configuration; it does not verify a provider account or install an AI library into your application. Follow the AI connection guide for the selected framework."
+    ]
+  }
+});
+
+export { aiCatalogue, aiAccessLabels, aiDefinition, DEFAULT_AI_MODEL, getAiModel, listAiModels };

package/src/shared/algolia.js

@@ -0,0 +1,29 @@
+import { createSchema } from "json-rest-schema";
+import { secretReference } from "@jskit-ai/connectors-core/shared/configuration";
+
+const algoliaDefinition = Object.freeze({
+  id: "algolia", name: "Algolia", description: "Search and maintain index records, and check indexing completion.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  settingsSchema: createSchema({
+    applicationId: { type: "string", required: true, minLength: 1, maxLength: 63,
+      validator: (value) => /^[a-z0-9]+$/iu.test(value) || "Enter the application ID using letters and digits." },
+    publicApiKeyRef: { ...secretReference, required: false }
+  }),
+  settingsFields: [
+    { name: "applicationId", label: "Application ID", hint: "Copy the ID from your Algolia application's API Keys page. This ID can be public." },
+    { name: "publicApiKeyRef", environmentCredential: { label: "Public frontend API key", public: true }, label: "Public API key reference (optional)", placeholder: "env:ALGOLIA_SEARCH_KEY",
+      hint: "Optional search-only key for your frontend. Enter its reference; your app decides whether to publish its value." }
+  ],
+  setup: {
+    url: "https://www.algolia.com/doc/guides/security/api-keys",
+    steps: [
+      "Select the intended Algolia application, open API Keys and copy its Application ID into Application ID here.",
+      "Open All API Keys, then New API Key. Give the key a description, select List indices (listIndexes) and Search (search), add Add records (addObject) for indexing/task status and Delete records (deleteObject) for deletion only when needed. Restrict Indices to those this application needs, and choose Create. These operations do not require the Admin API key.",
+      "Copy the new backend key. Enter env:ALGOLIA_API_KEY in API key reference here and save. Choose Set credential in Env for ALGOLIA_API_KEY, paste its value and save it there.",
+      "If the frontend will search Algolia directly, create a separate key with Search (search) access restricted to indices safe for those users to read. Enter env:ALGOLIA_SEARCH_KEY in Public API key reference (optional), save, then use its Set credential in Env link to store that key value.",
+      "Return here and choose Connect account (or Verify again for an existing connection). Check connection only reads the application’s saved status. No OAuth registration or callback URL is needed. Verification lists indices with the backend key; it does not validate the optional frontend key.",
+      "If access fails, check the Application ID, selected indices, permissions and key expiry. Your framework owns publishing the optional frontend key; keep the backend key server-side."
+    ]
+  }
+});
+export { algoliaDefinition };

package/src/shared/amazon-redshift.js

@@ -0,0 +1,51 @@
+import { createSchema } from "json-rest-schema";
+import { awsSettings, awsFields, awsCredentials } from "./aws.js";
+
+const regions = [
+  ["us-east-1", "N. Virginia"], ["us-east-2", "Ohio"], ["us-west-1", "N. California"], ["us-west-2", "Oregon"],
+  ["ca-central-1", "Canada Central"], ["ca-west-1", "Calgary"], ["mx-central-1", "Mexico Central"], ["sa-east-1", "São Paulo"],
+  ["eu-west-1", "Ireland"], ["eu-west-2", "London"], ["eu-west-3", "Paris"], ["eu-central-1", "Frankfurt"],
+  ["eu-central-2", "Zurich"], ["eu-north-1", "Stockholm"], ["eu-south-1", "Milan"], ["eu-south-2", "Spain"],
+  ["il-central-1", "Tel Aviv"], ["me-south-1", "Bahrain"], ["me-central-1", "UAE"], ["af-south-1", "Cape Town"],
+  ["ap-east-1", "Hong Kong"], ["ap-east-2", "Taipei"], ["ap-south-1", "Mumbai"], ["ap-south-2", "Hyderabad"],
+  ["ap-southeast-1", "Singapore"], ["ap-southeast-2", "Sydney"], ["ap-southeast-3", "Jakarta"], ["ap-southeast-4", "Melbourne"],
+  ["ap-southeast-5", "Malaysia"], ["ap-southeast-6", "New Zealand"], ["ap-southeast-7", "Thailand"],
+  ["ap-northeast-1", "Tokyo"], ["ap-northeast-2", "Seoul"], ["ap-northeast-3", "Osaka"]
+];
+const databaseName = { type: "string", required: true, noTrim: true, minLength: 1, maxLength: 127,
+  validator: (value) => (![...value].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127) && value.trim().length > 0 && new TextEncoder().encode(value).length <= 127) || "Enter a database identifier of at most 127 UTF-8 bytes." };
+const common = { ...awsSettings,
+  deploymentType: { type: "string", enum: ["serverless", "provisioned"], defaultTo: "serverless" },
+  region: { ...awsSettings.region, enum: regions.map(([value]) => value) },
+  database: databaseName
+};
+const serverlessSchema = createSchema({ ...common,
+  workgroup: { type: "string", required: true, minLength: 3, maxLength: 63, pattern: "^[a-z0-9-]+$" }
+});
+const provisionedSchema = createSchema({ ...common,
+  clusterIdentifier: { type: "string", required: true, minLength: 1, maxLength: 63, pattern: "^[a-z][a-z0-9]*(-[a-z0-9]+)*$" },
+  databaseUser: { ...databaseName, required: false }
+});
+
+const amazonRedshiftDefinition = Object.freeze({
+  id: "amazon-redshift", name: "Amazon Redshift", description: "Inspect tables and run queries in a serverless workgroup or provisioned cluster.",
+  ...awsCredentials, scopes: [],
+  settingsSchema: (settings = {}) => settings.deploymentType === "provisioned" ? provisionedSchema : serverlessSchema,
+  settingsFields: [
+    { name: "deploymentType", label: "Deployment type", items: [{ value: "serverless", title: "Serverless" }, { value: "provisioned", title: "Provisioned cluster" }] },
+    { name: "region", label: "AWS Region", items: regions.map(([value, title]) => ({ value, title: `${title} (${value})` })), hint: "Use the warehouse's region. Availability depends on your AWS account and deployment type." },
+    ...awsFields.filter((field) => field.name !== "region"),
+    { name: "workgroup", label: "Workgroup name", placeholder: "analytics", hint: "The serverless workgroup name, without an ARN or URL." },
+    { name: "clusterIdentifier", label: "Cluster identifier", placeholder: "analytics-cluster" },
+    { name: "database", label: "Database", placeholder: "dev" },
+    { name: "databaseUser", label: "Database user (optional)", placeholder: "report_reader", hint: "Leave blank to use the database identity derived from IAM." }
+  ],
+  setup: { url: "https://docs.aws.amazon.com/redshift/latest/mgmt/data-api.html", steps: [
+    "Select the warehouse's account and region in Amazon Redshift, then copy its serverless workgroup name or provisioned cluster identifier and database name.",
+    "Grant only the Data API actions your app uses: ListDatabases, ListSchemas, ListTables, DescribeTable, ExecuteStatement, DescribeStatement, GetStatementResult and CancelStatement. Serverless also needs redshift-serverless:GetCredentials; provisioned IAM users need redshift:GetClusterCredentialsWithIAM, or redshift:GetClusterCredentials for an explicit database user. Database grants control which SQL it can execute.",
+    "Save the configuration, then use Set credential in Env for the access key ID, secret key and any session token. Return and choose Connect account. No OAuth app or callback is needed for this shared mode. Renew temporary credential values together.",
+    "Connecting lists tables in the configured database. Starting SQL requires a separate application authorization decision."
+  ] }
+});
+
+export { amazonRedshiftDefinition };

package/src/shared/amplitude.js

@@ -0,0 +1,28 @@
+import { createSchema } from "json-rest-schema";
+
+const amplitudeDefinition = Object.freeze({
+  id: "amplitude", name: "Amplitude", description: "Query and manage Amplitude content through an authorized assistant MCP connection.",
+  accountModes: ["assistant"], authenticationMethods: ["oauth2"],
+  scopes: [
+    { value: "mcp:read", label: "Read Amplitude content (required for verification)", recommended: true },
+    { value: "mcp:write", label: "Create and edit Amplitude content" },
+    { value: "offline_access", label: "Refresh access without repeating sign-in", recommended: true }
+  ],
+  settingsSchema: createSchema({ region: { type: "string", enum: ["us", "eu"], defaultTo: "us" } }),
+  settingsFields: [{ name: "region", label: "Region", hint: "Choose the region containing your Amplitude account and register the client there.",
+    items: [{ value: "us", title: "United States" }, { value: "eu", title: "European Union" }] }],
+  setup: {
+    clientRegistrationEndpoint: (settings = {}) => settings.region === "eu"
+      ? "https://mcp.eu.amplitude.com/register" : "https://mcp.amplitude.com/register",
+    url: "https://amplitude.com/docs/amplitude-ai/amplitude-mcp/other-clients",
+    steps: [
+      "Select the account's US or EU region and the permissions needed. Set the Suggested callback URL to the route your application actually serves. With a new Client ID, choose Register client and connect: Vibe64 saves the returned client ID in configuration and the secret and callback in development Env. There is no developer-console app form in this flow.",
+      "For an existing client, enter its Client ID and store its secret and exact registered callback in the referenced Env variables. The manual registration request below remains available for CLI users. If registration fails, inspect the provider and Env before retrying; a client may already exist.",
+      "Keep Read Amplitude content selected so registration and verification can succeed. Save configuration, begin consent and sign into Amplitude. If access is blocked, an administrator opens Settings → Content Access → MCP to check organization access, then Org Settings → Role Management → AI Features to grant Use MCP (read) and, only when needed, Use MCP (write) to the intended user and projects.",
+      "The runtime verifies tool discovery without calling a tool. The assistant host must authorize each tool name and its arguments separately.",
+      "This connects the assistant owner's account. It does not send analytics events, attach tools automatically or implement app-user login."
+    ]
+  }
+});
+
+export { amplitudeDefinition };

package/src/shared/atlassian.js

@@ -0,0 +1,43 @@
+const atlassianDefinition = Object.freeze({
+  id: "atlassian", name: "Atlassian", description: "Use Jira, Confluence and other Atlassian tools through the assistant owner's Rovo MCP connection.",
+  accountModes: ["assistant"], authenticationMethods: ["oauth2"],
+  scopes: [
+    { value: "read:me", label: "Read your profile", recommended: true },
+    { value: "read:account", label: "Read your account", recommended: true },
+    { value: "offline_access", label: "Refresh access without repeating sign-in", recommended: true },
+    { value: "email", label: "Read your email address" },
+    { value: "read:jira:agent-interface", label: "Read Jira content", recommended: true },
+    { value: "write:jira:agent-interface", label: "Create and edit Jira content" },
+    { value: "search:jira:agent-interface", label: "Search Jira", recommended: true },
+    { value: "delete:jira:agent-interface", label: "Delete Jira content" },
+    { value: "manage:jira:agent-interface", label: "Manage Jira" },
+    { value: "read:confluence:agent-interface", label: "Read Confluence content", recommended: true },
+    { value: "write:confluence:agent-interface", label: "Create and edit Confluence content" },
+    { value: "search:confluence:agent-interface", label: "Search Confluence", recommended: true },
+    { value: "search:rovo:agent-interface", label: "Search with Rovo" },
+    { value: "search:code:agent-interface", label: "Search code" },
+    { value: "read:all:twg", label: "Read Teamwork Graph content" },
+    { value: "write:all:twg", label: "Write Teamwork Graph content" },
+    ...["goals", "projects", "bitbucket", "loom", "talent", "teams", "artifacts", "focus"].flatMap((product) => {
+      const name = product[0].toUpperCase() + product.slice(1);
+      return [
+        { value: `read:${product}:agent-interface`, label: `Read ${name} content` },
+        { value: `write:${product}:agent-interface`, label: `Create and edit ${name} content` }
+      ];
+    })
+  ],
+  setup: {
+    clientRegistrationEndpoint: "https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3/dcr/register",
+    url: "https://support.atlassian.com/atlassian-ai-gateway/docs/configure-oauth-2-1/",
+    steps: [
+      "Choose permissions and the Suggested callback URL, then select Register client and connect to create this application's Rovo MCP v2 client and save credentials in development Env. Manual registration is also available below. Use your assistant host's exact callback URL; old v1 clients and tokens do not carry over.",
+      "For an existing or manually registered client, enter its Client ID. Store its Client Secret and callback URL through Env, then enter their references here.",
+      "Choose only the products and permissions your assistant needs. Content writes, deletes and administration start disabled.",
+      "Save and select Connect account, sign into Atlassian and review the product and site permissions on its consent screen.",
+      "The runtime lists available tools without executing them. Your host must authorize the exact tool and arguments, including the destination site or project.",
+      "This connects the assistant owner's account; it does not configure app-user login or attach tools automatically."
+    ]
+  }
+});
+
+export { atlassianDefinition };

package/src/shared/aws.js

@@ -0,0 +1,72 @@
+import { createSchema } from "json-rest-schema";
+import { secretReference } from "@jskit-ai/connectors-core/shared/configuration";
+
+const regions = [
+  ["us-east-1", "N. Virginia"], ["us-east-2", "Ohio"], ["us-west-1", "N. California"], ["us-west-2", "Oregon"],
+  ["eu-west-1", "Ireland"], ["eu-west-2", "London"], ["eu-west-3", "Paris"], ["eu-central-1", "Frankfurt"],
+  ["eu-north-1", "Stockholm"], ["ap-southeast-1", "Singapore"], ["ap-southeast-2", "Sydney"],
+  ["ap-northeast-1", "Tokyo"], ["ap-northeast-2", "Seoul"], ["ap-south-1", "Mumbai"],
+  ["sa-east-1", "São Paulo"], ["ca-central-1", "Canada Central"], ["me-south-1", "Bahrain"], ["af-south-1", "Cape Town"]
+];
+const awsSettings = {
+  region: { type: "string", enum: regions.map(([value]) => value), defaultTo: "us-east-1" },
+  accessKeyIdRef: secretReference,
+  sessionTokenRef: { ...secretReference, required: false }
+};
+const awsFields = [
+  { name: "region", label: "AWS Region", items: regions.map(([value, title]) => ({ value, title: `${title} (${value})` })) },
+  { name: "accessKeyIdRef", environmentCredential: { label: "AWS access key ID", public: false }, label: "Access key ID reference", placeholder: "env:AWS_ACCESS_KEY_ID", hint: "Store the access key ID in Env and enter its reference." },
+  { name: "sessionTokenRef", environmentCredential: { label: "AWS session token", public: false }, label: "Session token reference (optional)", placeholder: "env:AWS_SESSION_TOKEN", hint: "Required with temporary STS credentials. The host must renew all three credential bindings before they expire." }
+];
+const awsCredentials = {
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"],
+  apiKeyReferenceLabel: "Secret access key reference",
+  apiKeyReferenceHint: "Use a reference such as env:AWS_SECRET_ACCESS_KEY. Credentials belong to the configured AWS account; host defaults are never used."
+};
+const bucketName = {
+  type: "string", required: true, minLength: 3, maxLength: 63,
+  validator: (value) => (/^[a-z0-9][a-z0-9.-]*[a-z0-9]$/u.test(value) && !value.includes("..") &&
+    !/^\d+\.\d+\.\d+\.\d+$/u.test(value) && !/^(xn--|sthree-|amzn-s3-demo-)/u.test(value) &&
+    !/(-s3alias|--ol-s3|\.mrap|--x-s3|--table-s3|-an)$/u.test(value)) || "Enter a general purpose S3 bucket name, not an ARN, URL or directory bucket."
+};
+const awsS3Definition = Object.freeze({
+  id: "aws-s3", name: "AWS S3", description: "List bucket objects and create short-lived download or upload URLs.",
+  ...awsCredentials,
+  permissionsHint: "These choices limit the application's operations. AWS IAM and bucket policies decide actual access; selecting a permission does not grant it in AWS.",
+  scopes: [
+    { value: "read", label: "List and download objects from bucket", required: true, recommended: true },
+    { value: "write", label: "Also upload objects via pre-signed URLs", recommended: true }
+  ],
+  settingsSchema: createSchema({ ...awsSettings, bucket: bucketName }),
+  settingsFields: [{ name: "bucket", label: "Bucket name", placeholder: "my-app-files" }, ...awsFields],
+  setup: { url: "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html", steps: [
+    "In Amazon S3, select a general purpose bucket and copy its name and region. Keep public access blocked.",
+    "Use an IAM identity limited to this bucket: ListBucket and GetObject, plus PutObject only for uploads. Additional encryption permissions may be required.",
+    "For an IAM-user key, sign in as that user, open the account menu > Security credentials > Access keys > Create access key. Review the alternatives, then choose Other > Next > Create access key. Copy the ID and secret before closing; the secret is shown only once. For temporary role credentials, obtain all three values from your deployment administrator.",
+    "Enter env:AWS_ACCESS_KEY_ID as the access key ID reference and env:AWS_SECRET_ACCESS_KEY as the secret reference. For temporary credentials also enter env:AWS_SESSION_TOKEN; otherwise leave the session-token reference empty. Save configuration, then use each Set credential in Env link to save its actual value in this project's Env. Return here and choose Connect. No OAuth app or callback URL is needed.",
+    "For browser downloads or uploads, open Amazon S3 > General purpose buckets > your bucket > Permissions > Cross-origin resource sharing (CORS) > Edit. Allow your app's exact origin, GET for downloads and PUT for uploads, and any request headers your app sends. Save changes. Add the custom-domain origin when it changes; do not make the bucket public to fix a CORS error.",
+    "Connecting checks one listing page, not every object's permissions. URLs are temporary bearer credentials. If Connect fails, check bucket, region, IAM permissions and Env values; renew all three temporary credential values together when they expire, then reconnect."
+  ] }
+});
+const awsAthenaDefinition = Object.freeze({
+  id: "aws-athena", name: "AWS Athena", description: "Browse data catalogs and schemas; start, inspect, page through and cancel queries in a configured workgroup.",
+  ...awsCredentials, scopes: [],
+  settingsSchema: createSchema({ ...awsSettings,
+    workgroup: { type: "string", minLength: 1, maxLength: 128, defaultTo: "primary", pattern: "^[a-zA-Z0-9._-]+$" },
+    resultLocation: { type: "string", minLength: 1, maxLength: 1024, validator: (value) =>
+      /^s3:\/\/[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]\/(?:[^\s?#\\]*)$/u.test(value) || "Enter an s3://bucket/prefix/ location without query parameters or fragments." }
+  }),
+  settingsFields: [...awsFields,
+    { name: "workgroup", label: "Workgroup (optional)", placeholder: "primary", hint: "Defaults to primary. Query access is restricted to this workgroup." },
+    { name: "resultLocation", label: "Query result location (optional)", placeholder: "s3://my-query-results/athena/", hint: "Leave blank when the workgroup supplies its own result storage. Enforced workgroup settings take precedence." }
+  ],
+  setup: { url: "https://docs.aws.amazon.com/athena/latest/ug/creating-workgroups.html", steps: [
+    "In the Athena console, select the region and open Workgroups in the navigation pane. Select an existing SQL workgroup, or choose Create workgroup, enter its name, choose Athena SQL and AWS Identity and Access Management (IAM) authentication. This connector does not use Spark or IAM Identity Center workgroups.",
+    "For S3-backed results, set Location of query result to an existing s3://bucket/prefix/ path. Configure encryption and query scan limits; select Override client-side settings if the workgroup must enforce its settings, then Create workgroup or save your edits. Grant the backend identity athena:GetWorkGroup, athena:StartQueryExecution, athena:GetQueryExecution, athena:GetQueryResults and athena:StopQueryExecution for this workgroup, plus the necessary source-data, S3 result and encryption permissions. For browsing, also grant athena:ListDataCatalogs, athena:ListDatabases and athena:ListTableMetadata with the appropriate catalog access; Glue-backed catalogs require glue:GetDatabase, glue:GetDatabases, glue:GetTable and glue:GetTables on the allowed catalog/database/table resources.",
+    "For an IAM-user key, sign in as that user, open the account menu > Security credentials > Access keys > Create access key. Review the alternatives, then choose Other > Next > Create access key. Copy the ID and secret before closing; the secret is shown only once. For temporary role credentials, obtain all three values from your deployment administrator.",
+    "Enter env:AWS_ACCESS_KEY_ID as Access key ID reference and env:AWS_SECRET_ACCESS_KEY as Secret access key reference. For temporary credentials also enter env:AWS_SESSION_TOKEN. Save configuration, then use each Set credential in Env link to save the actual value in this project. Return here and choose Connect account. No OAuth app or callback URL is needed.",
+    "Connecting reads workgroup metadata without running SQL. It does not prove table or result access. If connection fails, check the region, workgroup, IAM policy and Env values; renew all three temporary credential values together when expired and reconnect. Running SQL is a separate, billable operation that your application must authorize. Query failures can require catalog, source-data, result-bucket or encryption permissions even when connection succeeds."
+  ] }
+});
+
+export { awsS3Definition, awsAthenaDefinition, awsSettings, awsFields, awsCredentials };

package/src/shared/canva.js

@@ -0,0 +1,66 @@
+import { createSchema } from "json-rest-schema";
+import { validateSchemaPayload } from "@jskit-ai/kernel/shared/validators";
+
+function validateCanvaClientId(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:" && url.pathname !== "/" && !url.username && !url.password && !url.search && !url.hash && url.href === value) return true;
+  } catch { /* Report a field error below. */ }
+  return "Use the exact HTTPS URL of your client metadata JSON, including its path, without credentials, query or fragment.";
+}
+
+const canvaDefinition = Object.freeze({
+  id: "canva", name: "Canva", description: "Discover and use Canva design tools through each assistant owner's account.",
+  accountModes: ["assistant"], authenticationMethods: ["oauth2"], oauthClientAuthenticationMethods: ["none"],
+  clientIdLabel: "Client metadata URL", clientIdHint: "Serve your client metadata JSON at this HTTPS URL. Canva must approve the callback; this setup uses no client secret.",
+  validateClientId: validateCanvaClientId,
+  scopes: [
+    { value: "profile:read", label: "Read your profile", recommended: true },
+    { value: "design:meta:read", label: "Read design information", recommended: true },
+    { value: "design:content:write", label: "Create and edit designs" },
+    { value: "design:content:read", label: "Read design content", recommended: true },
+    { value: "folder:read", label: "Read folders", recommended: true },
+    { value: "folder:write", label: "Create and edit folders" },
+    { value: "brandtemplate:content:read", label: "Read brand template content" },
+    { value: "brandtemplate:meta:read", label: "Read brand template information" },
+    { value: "brandtemplate:content:write", label: "Create and edit brand templates" },
+    { value: "comment:write", label: "Write comments" },
+    { value: "comment:read", label: "Read comments" },
+    { value: "asset:read", label: "Read assets" },
+    { value: "asset:write", label: "Upload and edit assets" },
+    { value: "brandkit:read", label: "Read brand kits" },
+    { value: "help:answers:read", label: "Read help answers" },
+    { value: "help:answers:write", label: "Write help answers" }
+  ],
+  setup: {
+    url: "https://www.canva.dev/docs/mcp/",
+    createClientMetadata: createCanvaClientMetadata,
+    steps: [
+      "Open the Canva MCP guide and follow Register your redirect URI to its Waitlist form. Apply with the exact callback URL and wait for Canva's approval.",
+      "Choose a public HTTPS document URL owned by your application, including a path such as /oauth/canva.json. Enter it in Client metadata URL and confirm the suggested callback above. Copy the client metadata JSON below and serve it at that exact document URL with Content-Type application/json and no login requirement. CLI users can use createCanvaClientMetadata.",
+      "Save configuration, then use Set callback in Env to save the exact approved callback under the displayed Callback URL reference. The metadata URL and callback are different addresses. This client has no secret.",
+      "Choose the design and content permissions the assistant needs, then save. Each assistant owner must sign in to Canva and approve access through the runtime's authorization flow.",
+      "Verification lists tools; the assistant host must authorize individual calls and content ownership. Saving does not publish metadata, grant approval or attach tools."
+    ]
+  }
+});
+
+const metadataSchema = createSchema({
+  clientId: { type: "string", required: true, maxLength: 2048, validator: validateCanvaClientId },
+  clientName: { type: "string", required: true, minLength: 1, maxLength: 200 },
+  callbackUrl: { type: "string", required: true, validator(value) {
+    try {
+      const url = new URL(value);
+      return (url.protocol === "https:" || url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) &&
+        !url.username && !url.password && !url.search && !url.hash || "Use an HTTPS or loopback callback without credentials, query or fragment.";
+    } catch { return "Enter the callback URL served by the assistant host."; }
+  } }
+});
+
+function createCanvaClientMetadata(input) {
+  const { clientId, clientName, callbackUrl } = validateSchemaPayload({ schema: metadataSchema, mode: "replace" }, input, { statusCode: 422 });
+  return { client_id: clientId, client_name: clientName, redirect_uris: [new URL(callbackUrl).href],
+    grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], token_endpoint_auth_method: "none" };
+}
+
+export { canvaDefinition, createCanvaClientMetadata };

package/src/shared/chargebee.js

@@ -0,0 +1,26 @@
+import { createSchema } from "json-rest-schema";
+
+const chargebeeDefinition = Object.freeze({
+  id: "chargebee", name: "Chargebee", description: "Manage customers and subscriptions, read invoices and launch hosted checkout for a Chargebee site.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  settingsSchema: createSchema({
+    siteName: { type: "string", required: true, minLength: 1, maxLength: 63,
+      validator: (value) => /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/iu.test(value) || "Enter the site name without .chargebee.com, a URL or spaces." }
+  }),
+  settingsFields: [{ name: "siteName", label: "Site name", placeholder: "acme-test",
+    hint: "Your Chargebee site name, without .chargebee.com. Test and live sites use different keys." }],
+  setup: {
+    url: "https://www.chargebee.com/docs/billing/2.0/site-configuration/api_keys",
+    steps: [
+      "Sign into the intended test or live Chargebee site as an owner or administrator. Copy its site name without .chargebee.com.",
+      "Open Settings > Configure Chargebee > API Keys and Events (called API Keys and Webhooks in some views), then API keys.",
+      "Choose Add API Key. For reading only, select Read-Only Key with transactional-data and product-catalog reads, or Read-only: All. For customer changes, subscriptions, hosted checkout or portal sessions, choose Full-Access Key with Write access. Name it and click Create Key.",
+      "Copy the issued key. Enter the site name here and env:CHARGEBEE_API_KEY in API key reference, then save. Choose Set credential in Env, paste the key as CHARGEBEE_API_KEY and save it there. A publishable or product-catalog-only key cannot read customers.",
+      "Return here and choose Connect account or Verify again. Check connection only reads saved status. Verification lists customers without changing billing data. No OAuth registration or callback URL is needed.",
+      "This adapter uses Product Catalog 2.0 item prices. Prepare the product and recurring price in Chargebee first, then let the app choose that item_price_id; the first checkout item must be a plan. Test and live catalogue IDs are separate.",
+      "Creating a hosted checkout URL does not prove payment or an active subscription. The app must retrieve the hosted page and verify its customer, subscription and invoice state before granting access. Portal URLs grant access to a customer’s billing account and must be issued only after authenticating that customer.",
+      "If access fails, check that the site and key belong to the same test or live environment and that the key allows transactional-data reads. To rotate, create a replacement key and update Env before revoking the old key in Chargebee. Disconnect only removes the application connection; it does not revoke the provider key."
+    ]
+  }
+});
+export { chargebeeDefinition };

package/src/shared/clickhouse.js

@@ -0,0 +1,38 @@
+import { createSchema } from "json-rest-schema";
+import { httpsSiteUrlField } from "./siteUrl.js";
+
+const clickhouseDefinition = Object.freeze({
+  id: "clickhouse", name: "ClickHouse", description: "Explore tables and run bounded, parameterized analytical reads on your ClickHouse database.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key", "none"], scopes: [],
+  authenticationLabels: { "api-key": "Username and password", none: "No credentials" },
+  authenticationHint: "No credentials uses the server's default user. Choose it only for a server configured to allow that access.",
+  apiKeySecretOptional: true,
+  apiKeyReferenceLabel: "Password reference (optional)",
+  apiKeyReferenceHint: "Use a reference such as env:CLICKHOUSE_PASSWORD. Leave blank only if this database user has an empty password.",
+  settingsSchema: createSchema({
+    httpUrl: httpsSiteUrlField,
+    username: { type: "string", minLength: 1, maxLength: 256,
+      validator: (value) => !/[:\p{Cc}]/u.test(value) || "Enter a username without colons or control characters." }
+  }),
+  settingsFields: [
+    { name: "httpUrl", label: "HTTP Interface URL", placeholder: "https://service.example.clickhouse.cloud:8443",
+      hint: "Use the HTTPS query endpoint, including its port and any proxy path. Native TCP addresses do not work here." },
+    { name: "username", label: "Username (optional)", placeholder: "default", authenticationMethods: ["api-key"],
+      hint: "The database user, not your Cloud console login. Leave blank to use default." }
+  ],
+  setup: {
+    url: "https://clickhouse.com/docs/products/cloud/guides/sql-console/connection-details",
+    steps: [
+      "Select the ClickHouse Cloud service and open Connect. Copy its HTTPS interface address and port into HTTP Interface URL, or obtain your self-hosted HTTPS query endpoint from its administrator. Native TCP addresses do not work here.",
+      "Ask your database administrator for a dedicated application username and password with SELECT access to the intended tables. These are database credentials, not your Cloud console login or management API key.",
+      "Choose Username and password, enter the database username, and enter env:CLICKHOUSE_PASSWORD in Password reference (optional). Save configuration, choose Set credential in Env, paste the password as CLICKHOUSE_PASSWORD and save it there. Leave the reference blank only for a database user deliberately configured with an empty password; an omitted username uses default.",
+      "For a server deliberately allowing access without credentials, choose No credentials instead. This sends no authentication header and uses the server's default access. No password or Env reference is needed in this mode.",
+      "For ClickHouse Cloud, open the service's Settings > Security > IP access list > Add IPs. Allow the application backend's source IP or CIDR and save. The browser's domain is not that source address; update the allowlist if the backend moves.",
+      "Return here and choose Connect account or Verify again. Check connection only refreshes local status. Verification runs SELECT 1 and reads the database username; it does not prove permission to read every table. No OAuth registration or callback URL is needed.",
+      "Analytical reads support SELECT/WITH queries with typed parameters, capped at 100 returned rows and 10 seconds. Use a dedicated read-only user with table grants and enforced scan, memory and network restrictions. An application must authorize the query and its tenant filters; accepting SQL text is not a sandbox. HTTP URLs and query parameters may appear in proxy logs, so configure log redaction.",
+      "If verification fails, check the HTTPS endpoint, database credentials, network allowlist and the user's query-setting permissions described in the provider guide. To rotate access, update the database password and its Env value. Disconnect removes local connection state; it does not revoke the database user."
+    ]
+  }
+});
+
+export { clickhouseDefinition };

package/src/shared/confidence.js

@@ -0,0 +1,28 @@
+const confidenceScopes = [
+  { value: "openid", label: "Identify the connected Confidence account", recommended: true },
+  { value: "profile", label: "Read account profile", recommended: true },
+  { value: "email", label: "Read account email", recommended: true },
+  { value: "offline_access", label: "Refresh access without repeating sign-in", recommended: true }
+];
+
+function definition(id, name, description) {
+  return Object.freeze({
+    id, name, description, accountModes: ["assistant"], authenticationMethods: ["oauth2"], scopes: confidenceScopes,
+    setup: { url: "https://confidence.spotify.com/docs/sdks/mcp-servers", clientRegistrationEndpoint: "https://mcp.confidence.dev/register", steps: [
+      "Use a Confidence account with access to the intended organisation. This assistant connection uses browser OAuth, not a flag client secret or management API token.",
+      "Confirm the suggested callback is the route your application will serve. Choose Register client and connect to create a project-owned client and save its ID, secret and callback through project Env. Existing Env values are preserved. Manual users can send the displayed registration JSON with Content-Type application/json; CLI users can call registerConfidenceClient.",
+      "If registering manually, copy client_id into Client ID and store client_secret with Set credential in Env; use Set callback in Env for the exact registered callback. Automatic registration starts connection; after manual registration, choose Connect account. Sign into Confidence and approve the intended organisation. Your app must implement its callback and setup command.",
+      "Verification only lists tools. The host must authorize each tool and its arguments; identity scopes do not limit calls to reads.",
+      id === "confidence-flags"
+        ? "Flag creation, variants, schema changes and targeting rules require explicit host approval of the exact change. Inspect the resulting flag and use testResolveFlag for the intended test entity. This configures management access, not production flag evaluation; wire the native Confidence/OpenFeature client separately."
+        : "Retrieve experiment details and results through the host's approved tools. Preserve confidence intervals, sample sizes, significance and status messages: a positive effect estimate alone is not a winning experiment. Confidence performs the statistical analysis.",
+      "Flags and experiments keep separate configured connections even though they share an OAuth service. Do not reuse a grant by changing its provider ID.",
+      "If client_secret_expires_at is returned, plan replacement before expiry. A failed or interrupted registration is not proof that no client was created; investigate before retrying. Saving alone does not register a client or attach tools. Automatic Vibe64 coding-assistant attachment is deferred; an explicitly wired host can use these tools. Disconnect removes the local grant; it does not undo flag changes or revoke all provider access."
+    ] }
+  });
+}
+
+const confidenceFlagsDefinition = definition("confidence-flags", "Confidence Flags", "Manage Confidence flags through the assistant owner's MCP connection.");
+const confidenceExpDefinition = definition("confidence-exp", "Confidence Exp", "Read Confidence experiments and results through the assistant owner's MCP connection.");
+
+export { confidenceFlagsDefinition, confidenceExpDefinition };

package/src/shared/databricks.js

@@ -0,0 +1,33 @@
+import { createSchema } from "json-rest-schema";
+
+function validWorkspaceUrl(value) {
+  // Use a per-workspace origin. Account consoles, regional URLs and proxy hosts are different contracts.
+  return /^https:\/\/(?:dbc-[a-z0-9]+(?:-[a-z0-9]+)*\.cloud\.databricks\.com|adb-[0-9]+\.[0-9]+\.azuredatabricks\.net|[0-9]+\.[0-9]+\.gcp\.databricks\.com)\/?$/u.test(value);
+}
+const scopes = [
+  { value: "all-apis", label: "APIs allowed by the connected account", recommended: true },
+  { value: "offline_access", label: "Keep user access between visits", recommended: true },
+  { value: "jobs", label: "Jobs API access for the service account" }
+];
+const databricksDefinition = Object.freeze({
+  id: "databricks", name: "Databricks", description: "Read workspace jobs through user consent or a service principal.",
+  accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  oauthGrantTypes: ["authorization_code", "client_credentials"],
+  oauthClientAuthenticationMethods: (grantType) => grantType === "client_credentials" ? ["client_secret_basic"] : ["client_secret_post"],
+  oauthGrantHint: "User consent needs a custom OAuth application. Service account needs a service principal's client ID and OAuth secret, without a callback.",
+  settingsSchema: createSchema({ workspaceUrl: { type: "string", required: true, maxLength: 253,
+    validator: (value) => validWorkspaceUrl(value) || "Enter the HTTPS per-workspace URL for Databricks on AWS, Azure or Google Cloud, without a path or query." } }),
+  settingsFields: [{ name: "workspaceUrl", label: "Workspace URL", placeholder: "https://dbc-abc123.cloud.databricks.com",
+    hint: "Use the workspace's own address. Omit browser paths, query strings and account-console URLs." }],
+  scopes, scopesForGrantType: (grantType) => scopes.filter((scope) => grantType === "client_credentials" ? scope.value !== "offline_access" : scope.value !== "jobs"),
+  permissionsHint: "Permissions also depend on workspace membership and resource access. The jobs fragment only reads metadata; these OAuth scopes can permit more in other clients.",
+  setup: { url: "https://docs.databricks.com/aws/en/integrations/enable-disable-oauth", steps: [
+    "Enter the intended workspace's HTTPS origin in Workspace URL. Choose User consent for a custom OAuth application, or Service account for a service principal; these require different credentials.",
+    "For User consent, an account admin opens account console > Settings > App connections > Add connection. Enter the app name and exact suggested callback, choose All APIs, generate a confidential client secret, set token lifetimes and add the connection. Copy the client ID and one-time secret. Activation can take 30 minutes.",
+    "For Service account, an admin opens workspace user menu > Settings > Identity and access > Service principals > Manage. Select an assigned principal, open Secrets > Generate secret, set lifetime and the jobs scope, then Generate. Copy the displayed client ID and secret. Grant the principal workspace access and visibility of the required jobs. No callback is needed.",
+    "Enter Client ID, save configuration, then use Set credential in Env to store the secret under the displayed Client secret reference. For User consent also use Set callback in Env to save the exact registered URL and keep offline access selected. For Service account choose permissions matching the secret; use jobs without all-apis for a jobs-scoped secret.",
+    "Return here and check the connection. User consent opens Databricks authorization; service credentials need no browser consent. Verification reads a jobs page without running jobs or SQL. Empty results do not prove visibility of a particular job.",
+    "A personal access token, login password or cloud-provider secret is not a Databricks OAuth secret. Check workspace assignment, job permissions, secret expiry and matching scopes if access fails. Rotate secrets in Env before retiring the old credential. Disconnect removes local state; it does not delete the principal or globally revoke the OAuth app."
+  ] }
+});
+export { databricksDefinition };

package/src/shared/dbt-semantic-layer.js

@@ -0,0 +1,32 @@
+import { createSchema } from "json-rest-schema";
+
+const label = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+const hostPattern = new RegExp(`^(?:semantic-layer\\.${label}\\.(?:getdbt|dbt)\\.com|${label}\\.semantic-layer\\.${label}\\.dbt\\.com)$`, "u");
+const dbtSemanticLayerDefinition = Object.freeze({
+  id: "dbt-semantic-layer", name: "dbt Semantic Layer", description: "Discover metrics and query their values in a dbt Semantic Layer environment.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  apiKeyReferenceLabel: "Service token reference",
+  apiKeyReferenceHint: "Store the dbt service token in Env. It needs Semantic Layer Only and Metadata Only permissions and a linked warehouse credential.",
+  settingsSchema: createSchema({
+    host: { type: "string", required: true, maxLength: 253, validator: (value) => hostPattern.test(value) || "Enter the lowercase dbt Semantic Layer hostname without a URL, path or port." },
+    environmentId: { type: "string", required: true, noTrim: true, maxLength: 38,
+      validator: (value, object, context) => (typeof context.valueBeforeCast === "string" && /^[1-9][0-9]*$/u.test(value)) || "Enter a positive decimal Environment ID as text, without spaces or leading zeros." }
+  }),
+  settingsFields: [
+    { name: "host", label: "Semantic Layer host", placeholder: "semantic-layer.cloud.getdbt.com",
+      hint: "Copy the GraphQL hostname from dbt's Semantic Layer settings. Regional, single-tenant and multi-cell dbt hosts are supported." },
+    { name: "environmentId", label: "Environment ID", placeholder: "70506183142324",
+      hint: "The deployment environment containing your metrics. Keep the full ID as text to avoid rounding." }
+  ],
+  setup: { url: "https://docs.getdbt.com/docs/use-dbt-semantic-layer/setup-sl", steps: [
+    "Open Account settings > Settings > Projects and select the project. In Project details, choose Semantic Layer > Configure Semantic Layer, select the deployment environment and Save. Metrics, a successful deployment run and a supported data platform must already exist.",
+    "Under Credentials & service tokens, add a Semantic Layer credential with the required warehouse access.",
+    "Choose Map new service token, name it for this application, select Semantic Layer Only and Metadata Only permissions, then Save. Copy the one-time token. If token creation is unavailable, ask your dbt administrator to create and link it.",
+    "Return to Project details and copy the GraphQL hostname and Environment ID from the Semantic Layer connection details. Enter them here, preserving every ID digit. Enter env:DBT_SERVICE_TOKEN in Service token reference and save configuration. Choose Set credential in Env, paste the token as DBT_SERVICE_TOKEN and save it there.",
+    "Return here and choose Connect account / Verify again. Check connection only reads saved status. Verification reads environment metadata; an explicitly wired application can then create metric queries and request their status and JSON result pages. If denied, check the host, environment, linked warehouse credential and token permissions. Replace the token through Env when rotating it; local Disconnect does not revoke it in dbt.",
+    "Query execution uses your warehouse capacity. The app owns permitted metrics, trusted dimension/time filters and bounded polling. JSON results suit small tables; use dbt’s native Arrow tooling for large production workloads. Do not retry an uncertain query submission automatically. Configuring this connection does not attach dbt to Vibe64’s coding assistant.",
+    "This token flow has no OAuth callback or app-user login. Public and Online need the customer's own account, permissions and capacity."
+  ] }
+});
+
+export { dbtSemanticLayerDefinition };