@jskit-ai/connectors-catalog 0.1.1

package/src/shared/definitions.js

@@ -0,0 +1,140 @@
+import { aiDefinition } from "./ai.js";
+export { aiDefinition } from "./ai.js";
+import { wizDefinition } from "./wiz.js";
+export { wizDefinition } from "./wiz.js";
+import { shopifyDefinition } from "./shopify.js";
+export { shopifyDefinition } from "./shopify.js";
+import { workdayDefinition } from "./workday.js";
+export { workdayDefinition } from "./workday.js";
+import { geminiEnterpriseDefinition } from "./gemini-enterprise.js";
+export { geminiEnterpriseDefinition } from "./gemini-enterprise.js";
+import { snowflakeDefinition } from "./snowflake.js";
+export { snowflakeDefinition } from "./snowflake.js";
+import { wixDefinition } from "./wix.js";
+export { wixDefinition } from "./wix.js";
+import { tiktokDefinition } from "./tiktok.js";
+export { tiktokDefinition } from "./tiktok.js";
+import { xTwitterDefinition } from "./x-twitter.js";
+export { xTwitterDefinition } from "./x-twitter.js";
+import { linkedinDefinition } from "./linkedin.js";
+export { linkedinDefinition } from "./linkedin.js";
+import { googleAdsDefinition } from "./google-ads.js";
+export { googleAdsDefinition } from "./google-ads.js";
+import { salesforceDefinition } from "./salesforce.js";
+export { salesforceDefinition } from "./salesforce.js";
+import { firebaseCloudMessagingDefinition } from "./firebase-cloud-messaging.js";
+export { firebaseCloudMessagingDefinition } from "./firebase-cloud-messaging.js";
+import { dbtSemanticLayerDefinition } from "./dbt-semantic-layer.js";
+export { dbtSemanticLayerDefinition } from "./dbt-semantic-layer.js";
+import { microsoftFabricDefinition } from "./microsoft-fabric.js";
+import { databricksDefinition } from "./databricks.js";
+export { databricksDefinition } from "./databricks.js";
+import { lightspeedDefinition } from "./lightspeed.js";
+export { lightspeedDefinition } from "./lightspeed.js";
+import { confidenceFlagsDefinition, confidenceExpDefinition } from "./confidence.js";
+export { confidenceFlagsDefinition, confidenceExpDefinition } from "./confidence.js";
+import { hexDefinition } from "./hex.js";
+export { hexDefinition } from "./hex.js";
+import { granolaDefinition } from "./granola.js";
+export { granolaDefinition } from "./granola.js";
+import { zohoBooksDefinition } from "./zoho-books.js";
+export { zohoBooksDefinition } from "./zoho-books.js";
+import { zohoCrmDefinition } from "./zoho-crm.js";
+export { zohoCrmDefinition } from "./zoho-crm.js";
+import { waveDefinition } from "./wave.js";
+export { waveDefinition } from "./wave.js";
+import { semrushDefinition } from "./semrush.js";
+export * from "./semrush.js";
+import { xeroDefinition } from "./xero.js";
+export { xeroDefinition } from "./xero.js";
+import { amazonRedshiftDefinition } from "./amazon-redshift.js";
+export { amazonRedshiftDefinition } from "./amazon-redshift.js";
+import { awsS3Definition, awsAthenaDefinition } from "./aws.js";
+export { awsS3Definition, awsAthenaDefinition } from "./aws.js";
+import { slackDefinition } from "./slack.js";
+export { slackDefinition } from "./slack.js";
+import { figmaDefinition } from "./figma.js";
+import { prestashopDefinition } from "./prestashop.js";
+import { clickhouseDefinition } from "./clickhouse.js";
+import { twitchDefinition } from "./twitch.js";
+export * from "./twitch.js";
+export * from "./clickhouse.js";
+export * from "./prestashop.js";
+import { miroDefinition } from "./miro.js";
+export * from "./figma.js";
+export * from "./miro.js";
+import { canvaDefinition } from "./canva.js";
+export * from "./canva.js";
+import { atlassianDefinition } from "./atlassian.js";
+export * from "./atlassian.js";
+import { amplitudeDefinition } from "./amplitude.js";
+import { wordpressComDefinition } from "./wordpress-com.js";
+import { n8nDefinition, sanityDefinition } from "./mcp.js";
+import { inngestDefinition } from "./inngest.js";
+export * from "./inngest.js";
+export * from "./mcp.js";
+import { googleDefinitions } from "./google.js";
+import { tokenDefinitions } from "./tokens.js";
+import { microsoftDefinitions } from "./microsoft.js";
+import { ouraDefinition } from "./oura.js";
+import { algoliaDefinition } from "./algolia.js";
+import { twilioDefinition } from "./twilio.js";
+import { gongDefinition } from "./gong.js";
+import { posthogDefinition } from "./posthog.js";
+import { chargebeeDefinition } from "./chargebee.js";
+import { mapboxDefinition } from "./mapbox.js";
+import { logoDevDefinition } from "./logo-dev.js";
+import { googleMapsPlatformDefinition } from "./google-maps-platform.js";
+import { woocommerceDefinition, wordpressSelfHostedDefinition } from "./wordpress.js";
+export * from "./wordpress-com.js";
+export * from "./google.js";
+export * from "./tokens.js";
+export * from "./microsoft.js";
+export * from "./oura.js";
+export * from "./algolia.js";
+export * from "./twilio.js";
+export * from "./gong.js";
+export * from "./posthog.js";
+export * from "./chargebee.js";
+export * from "./mapbox.js";
+export * from "./logo-dev.js";
+export * from "./google-maps-platform.js";
+export * from "./wordpress.js";
+const resendDefinition = Object.freeze({
+  id: "resend", name: "Resend", description: "Send transactional email and manage contact segments and draft broadcasts.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  setup: {
+    url: "https://resend.com/docs/create-an-api-key",
+    steps: [
+      "Open API Keys in your Resend dashboard and choose Create API key.",
+      "Name the key and select Full access: this connector checks access by listing domains. Sending access cannot perform that check. Full access also permits changes to Resend resources, so keep this key on your application's backend.",
+      "Create the key and copy its value before closing; Resend shows the value only once. If you lose it, create a replacement.",
+      "Enter env:RESEND_API_KEY in API key reference and save the configuration. Choose Set credential in Env, paste the copied key as the RESEND_API_KEY value, and save it there. Return here and choose Connect / Verify when the application setup is ready.",
+      "Open Domains in Resend, choose Add domain, enter the sender domain and copy the displayed SPF/DKIM DNS records into your DNS host. Return to Resend and verify until the domain is verified; use a From address on that domain. Connecting only lists domains and cannot prove inbox delivery.",
+      "For marketing, open Contacts and create a Segment (older guides call these Audiences). Add only opted-in contacts; contacts.create requires an explicit unsubscribed value, and contacts.update can unsubscribe them. segments.list/create and contacts.list/get/addSegment/removeSegment support the same workflow in your app.",
+      "Prepare your HTML in the app or Resend Broadcasts editor; include {{{RESEND_UNSUBSCRIBE_URL}}} as the unsubscribe link. broadcasts.create always creates a draft. Use broadcasts.get/update to review its segment, sender and content; test with a segment containing only your own addresses before an explicitly authorized broadcasts.send. Sending affects the whole selected segment.",
+      "LIMITATIONS: no embedded visual campaign builder, hosted-template catalogue, automation engine, inbound mail, attachment handling, delivery webhook processor or automatic editor-tool attachment. For example, an app can save a newsletter draft and send it to a reviewed segment; the app or Resend dashboard supplies preview, scheduling and analytics. Transactional emails.send remains plain text with an app-owned idempotency key.",
+      "No OAuth app registration or callback URL is needed. Connection verification lists domains without sending email. Sending from your own domain additionally requires adding and verifying it in Resend."
+    ]
+  }
+});
+
+const firecrawlDefinition = Object.freeze({
+  id: "firecrawl", name: "Firecrawl", description: "Search, map, scrape and extract web content; run bounded site crawls.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  setup: {
+    url: "https://docs.firecrawl.dev/introduction",
+    steps: [
+      "Open https://www.firecrawl.dev/app/api-keys and sign in. Select the team that will pay for this application and check its available credits.",
+      "Open API Keys and create or copy a key for that team.",
+      "Enter env:FIRECRAWL_API_KEY as the API key reference and Save configuration. Follow Set credential in Env, save the real key as FIRECRAWL_API_KEY, then return here and choose Connect account or Verify again. Check connection reads saved status. Keep the key out of source and browser code.",
+      "Verification reads remaining team credits without scraping. A valid key with zero credits can connect, but does not promise a successful scrape. Scraping is a separate, authorized operation that consumes credits. Correct invalid keys or team access before retrying a failed connection.",
+      "Search, mapping, extraction and crawling use your team credits. Crawls require an explicit page limit. Save the returned job ID, check its status, follow returned result pages and inspect crawl errors; starting a crawl is not a completed import. Your app owns scheduling and saved content.",
+      "To rotate a key, use the team API Keys page, update Env and verify again before revoking the previous key. Disconnect only removes this application connection; revoke the key in Firecrawl separately. No OAuth app ID, secret or callback is required. This setup uses your team credits; Vibe64 does not supply a managed subscription."
+    ]
+  }
+});
+
+const connectorDefinitions = Object.freeze([aiDefinition, wizDefinition, shopifyDefinition, workdayDefinition, geminiEnterpriseDefinition, snowflakeDefinition, wixDefinition, tiktokDefinition, xTwitterDefinition, linkedinDefinition, googleAdsDefinition,
+  salesforceDefinition, firebaseCloudMessagingDefinition, resendDefinition, firecrawlDefinition, ...googleDefinitions, ...tokenDefinitions, ...microsoftDefinitions, ouraDefinition, algoliaDefinition, twilioDefinition, gongDefinition, posthogDefinition, chargebeeDefinition, mapboxDefinition, logoDevDefinition, googleMapsPlatformDefinition, woocommerceDefinition, wordpressSelfHostedDefinition, wordpressComDefinition, n8nDefinition, sanityDefinition, inngestDefinition, amplitudeDefinition, atlassianDefinition, canvaDefinition, figmaDefinition, miroDefinition, prestashopDefinition, clickhouseDefinition, twitchDefinition, slackDefinition, awsS3Definition, awsAthenaDefinition, amazonRedshiftDefinition, xeroDefinition, semrushDefinition, waveDefinition, zohoCrmDefinition, zohoBooksDefinition, granolaDefinition, hexDefinition, confidenceFlagsDefinition, confidenceExpDefinition, lightspeedDefinition, databricksDefinition, microsoftFabricDefinition, dbtSemanticLayerDefinition]);
+export { connectorDefinitions, resendDefinition, firecrawlDefinition };

package/src/shared/figma.js

@@ -0,0 +1,21 @@
+const figmaDefinition = Object.freeze({
+  id: "figma", name: "Figma", description: "Discover and call Figma's remote design tools through the assistant owner's account.",
+  accountModes: ["assistant"], authenticationMethods: ["oauth2"],
+  scopes: [{ value: "mcp:connect", label: "Use Figma MCP tools", recommended: true }],
+  setup: {
+    url: "https://developers.figma.com/docs/figma-mcp-server/",
+    clientRegistrationEndpoint: "https://api.figma.com/v1/oauth/mcp/register",
+    steps: [
+      "Open Figma's MCP guide and follow the new-client waitlist link. Figma currently requires approval for clients outside its catalogue.",
+      "After approval, confirm the suggested callback is the exact route your application will serve. Use the OAuth client registration section below to copy the endpoint and request body into your HTTP client. Send one POST with Content-Type application/json. CLI users can call registerFigmaClient; do not repeat registration for every connection.",
+      "Copy client_id from the successful response into Client ID and save configuration. Use Set credential in Env to store client_secret under the displayed Client secret reference. Use Set callback in Env to save the exact registered callback. Keep the registration response private.",
+      "Save, begin authorization, sign into Figma and review its consent screen. A personal access token cannot replace this MCP OAuth registration.",
+      "The host must authorize each tool and its arguments. The MCP permission can expose write tools; listing a tool does not authorize an edit.",
+      "Use a Figma file/frame link to identify the allowed file and node. The assistant host consumes returned design text/images and chooses its framework; connecting alone does not generate screens. Vibe64 coding-assistant attachment is deferred.",
+      "Remote MCP is the supported mode for both installed and hosted Vibe64. Desktop MCP must run beside the consuming desktop client; a VPS localhost address points to the VPS, not your laptop. Do not enter a desktop localhost URL as the hosted remote endpoint.",
+      "Disconnect removes the local grant; it does not undo design edits or revoke all provider access. This uses Figma's remote server. Desktop MCP, app-user login and automatic assistant attachment are separate capabilities."
+    ]
+  }
+});
+
+export { figmaDefinition };

package/src/shared/firebase-cloud-messaging.js

@@ -0,0 +1,45 @@
+import { createSchema } from "json-rest-schema";
+
+const firebaseMessagingScope = "https://www.googleapis.com/auth/firebase.messaging";
+const firebaseProjectId = { type: "string", required: true, noTrim: true, minLength: 6, maxLength: 30,
+  validator: (value) => /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/u.test(value) || "Enter the Firebase project ID, without a URL or project number." };
+const common = {
+  projectId: firebaseProjectId,
+  clientMode: { type: "string", enum: ["server", "web"], defaultTo: "server" }
+};
+const serverSettings = createSchema(common);
+const webSettings = createSchema({ ...common,
+  apiKey: { type: "string", required: true, noTrim: true, pattern: "^AIza[0-9A-Za-z_-]{35}$" },
+  appId: { type: "string", required: true, noTrim: true, pattern: "^1:[1-9][0-9]{0,19}:web:[a-f0-9]{16,64}$" },
+  vapidKey: { type: "string", required: true, noTrim: true,
+    validator: (value) => /^B[A-Za-z0-9_-]{85}[AEIMQUYcgkosw048]$/u.test(value) || "Enter the public Web Push certificate key from Firebase, not a private key." }
+});
+const firebaseCloudMessagingDefinition = Object.freeze({
+  id: "firebase-cloud-messaging", name: "Firebase Cloud Messaging", description: "Send notifications to mobile and browser installations, tokens or topics.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["service-account"],
+  serviceAccountReferenceLabel: "Service-account JSON reference",
+  serviceAccountReferenceHint: "Store the complete service-account JSON in Env, then enter its reference. It stays on the server and is never included in the browser configuration.",
+  scopes: [{ value: firebaseMessagingScope, label: "Validate and send Firebase messages", recommended: true }],
+  permissionsHint: "Firebase IAM controls which projects this service account can send to. Sending to an audience also requires your application's authorization.",
+  settingsSchema: (settings = {}) => settings.clientMode === "web" ? webSettings : serverSettings,
+  settingsFields: [
+    { name: "projectId", label: "Firebase project ID", placeholder: "my-notifications-app", hint: "The project receiving messages. Usually project_id in your JSON; cross-project access requires an IAM grant on this target project." },
+    { name: "clientMode", label: "Client setup", items: [{ value: "server", title: "Server or native only" }, { value: "web", title: "Include web push" }],
+      hint: "Existing mobile/browser targets need server credentials. Include web push to configure browser registration too." },
+    { name: "apiKey", label: "Firebase API key", placeholder: "AIzaSyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", hint: "Public API key from the Firebase web app configuration. This value is visible in your published app." },
+    { name: "appId", label: "Firebase App ID", placeholder: "1:123456789012:web:abcdef1234567890", hint: "Public appId from the same Firebase project and web app." },
+    { name: "vapidKey", label: "Web Push VAPID key", placeholder: "BEl62...", hint: "Public key from Project settings > Cloud Messaging > Web Push certificates. Never paste the private VAPID key." }
+  ],
+  setup: { url: "https://firebase.google.com/docs/cloud-messaging/send/v1-api", steps: [
+    "Open the target Firebase project. In Project settings > General, copy its project ID. Enable Firebase Cloud Messaging API (HTTP v1) if disabled.",
+    "In Project settings > Service accounts, click Generate new private key, then Generate key. Keep the complete downloaded JSON private. Alternatively use Google Cloud IAM & Admin > Service Accounts > your sender > Keys > Add key > Create new key > JSON; grant the sender Firebase Cloud Messaging API Admin on the target project. If your organization prohibits keys, ask its administrator; do not use an unrelated key.",
+    "Enter the Firebase project ID and env:FIREBASE_SERVICE_ACCOUNT in Service-account JSON reference, then Save configuration. Follow Set credential in Env and store the complete downloaded JSON as FIREBASE_SERVICE_ACCOUNT, not its filename or path. Return here and choose Connect account / Verify again. Check connection only reads saved status. Verification makes a validate-only request; it does not deliver a notification.",
+    "For web push, select Include web push. Under Project settings > General > Your apps, select your Web app, or click the Web icon and Register app with a nickname. Firebase Hosting is optional. From SDK setup and configuration, copy apiKey into Firebase API key and appId into Firebase App ID. These values are public.",
+    "Open Project settings > Cloud Messaging > Web configuration > Web Push certificates. Generate or select a key pair and copy only its public key.",
+    "The app must still register a service worker, request browser notification permission and associate installations with authorized app users. A new custom domain needs its own browser registration.",
+    "The app must upload each registration to its authenticated backend with a timestamp and associate it with that user/device. On connector_recipient_unregistered, remove only that recipient association; on connector_message_invalid, check the payload first and do not blindly delete tokens. A send receipt is acceptance, not proof the device displayed a notification. Editor coding-assistant attachment is deferred.",
+    "Save again after changing web settings and verify the connection. For permission failures, check the enabled API, target project ID and sender IAM access. Disconnect removes the local connection, not the Google private key: rotate or delete that key in Google Cloud IAM > Service Accounts > your sender > Keys, and update Env when rotating. No browser OAuth callback or login feature is involved. Separate Firebase projects provide separate project quotas; service accounts in one project do not."
+  ] }
+});
+
+export { firebaseCloudMessagingDefinition, firebaseMessagingScope, firebaseProjectId };

package/src/shared/gemini-enterprise.js

@@ -0,0 +1,33 @@
+import { createSchema } from "json-rest-schema";
+
+const geminiEnterpriseScope = "https://www.googleapis.com/auth/cloud-platform";
+const geminiEnterpriseDefinition = Object.freeze({
+  id: "gemini-enterprise", name: "Gemini Enterprise", categories: ["Google", "Productivity"],
+  description: "Search documents in a configured Gemini Enterprise engine.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["oauth2"],
+  oauthClientAuthenticationMethods: ["client_secret_post", "client_secret_basic"],
+  settingsSchema: createSchema({
+    projectId: { type: "string", required: true, noTrim: true, minLength: 6, maxLength: 30,
+      validator: (value) => /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/u.test(value) || "Enter the Google Cloud project ID, without a URL or project number." },
+    location: { type: "string", enum: ["global", "us", "eu"], defaultTo: "global" },
+    engineId: { type: "string", required: true, noTrim: true, minLength: 1, maxLength: 63,
+      validator: (value) => /^[a-z0-9][a-z0-9_-]*$/u.test(value) || "Enter the engine ID, starting with a lowercase letter or digit and using only lowercase letters, digits, hyphens or underscores." }
+  }),
+  settingsFields: [
+    { name: "projectId", label: "GCP project ID", placeholder: "my-gcp-project", hint: "The Google Cloud project where the Gemini Enterprise app lives." },
+    { name: "location", label: "Location", items: [{ value: "global", title: "Global" }, { value: "us", title: "United States" }, { value: "eu", title: "European Union" }],
+      hint: "Match the engine's location. The runtime uses the corresponding Google API endpoint." },
+    { name: "engineId", label: "Engine ID", placeholder: "my-search-engine", hint: "The existing search app identifier in default_collection, not its display name or full resource path." }
+  ],
+  scopes: [{ value: geminiEnterpriseScope, label: "Cloud Platform (full access)", recommended: true }],
+  permissionsHint: "Google IAM and source permissions apply to the connected Google account. Shared access uses that same account for every authorized caller; it does not provide each app user's own search identity.",
+  setup: { url: "https://docs.cloud.google.com/gemini/enterprise/docs/authentication", steps: [
+    "In Google Cloud, select the project, enable the Discovery Engine API and create or select a Gemini Enterprise search app. Copy its project ID, location and engine ID.",
+    "Grant the connecting Google account discoveryengine.engines.get and discoveryengine.servingConfigs.search on the target resources. Configure source access and any required Gemini Enterprise license separately.",
+    "Open Google Auth Platform. Configure Branding and Audience; in Data Access add https://www.googleapis.com/auth/cloud-platform. Under Clients > Create Client choose Web application. Copy the Suggested callback URL shown here into Authorized redirect URIs, then create the client. Use the application hosting address, not the editor address.",
+    "Enter the client ID here and keep the Client secret reference and Callback URL reference as Env references. Save configuration, then follow the Env links to store the secret and the same suggested callback under their referenced names. The application backend must implement this callback. Add the connecting account as a test user while the Google OAuth app is in testing.",
+    "Search can request document snippets and a Google-generated summary with citations. The app explicitly enables summaries and its Google project pays for them. Missing snippets or a skipped summary must be shown as unavailable, not an invented answer. Every authorized caller uses this shared account; the app must restrict who can see those sources.",
+    "Connect and choose the Google account granted access to the engine. Verification reads engine metadata; searching still requires search and source permissions. If access fails, check project ID, engine ID, location, API enablement and IAM. Disconnect removes the local grant; remove Google account consent separately to revoke provider access. If the application domain changes, update both Google redirect registration and callback Env."
+  ] }
+});
+export { geminiEnterpriseDefinition, geminiEnterpriseScope };

package/src/shared/gong.js

@@ -0,0 +1,33 @@
+import { createSchema } from "json-rest-schema";
+
+const gongDefinition = Object.freeze({
+  id: "gong", name: "Gong", description: "Read company calls, transcripts, conversation statistics and linked CRM context.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  apiKeyReferenceLabel: "Access key secret reference",
+  settingsSchema: createSchema({
+    accessKey: { type: "string", required: true, minLength: 1, maxLength: 512,
+      validator: (value) => !/[:\s\p{Cc}]/u.test(value) || "Enter the access key without spaces, control characters or colons." },
+    apiBaseUrl: { type: "string", defaultTo: "https://api.gong.io", maxLength: 2048,
+      validator: (value) => /^https:\/\/(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)?api\.gong\.io\/?$/u.test(value) ||
+        "Use https://api.gong.io or your company's https://<company>.api.gong.io address, without a path or query." }
+  }),
+  settingsFields: [
+    { name: "accessKey", label: "Access key", hint: "Copy the access key identifier from Gong's API settings. Store its secret separately." },
+    { name: "apiBaseUrl", label: "API base URL (optional)", placeholder: "https://api.gong.io",
+      hint: "Copy the API base URL from Gong's API settings. Leave empty to use https://api.gong.io." }
+  ],
+  setup: {
+    url: "https://help.gong.io/docs/receive-access-to-the-api",
+    steps: [
+      "Sign into Gong as a technical administrator. Open Admin center, Settings, then API under Ecosystem.",
+      "Click + Get API key. Enter Key name; TTL (days) and Trusted IPs are optional. For Trusted IPs, use the application backend’s outbound addresses. Click Get API key.",
+      "Copy the identifier into Access key here. Enter env:GONG_ACCESS_SECRET in Access key secret reference and Save configuration. Choose Set credential in Env, paste the one-time secret as GONG_ACCESS_SECRET, and save there before closing Gong’s dialog with Done.",
+      "If Gong provides a company API base URL, copy it here. Otherwise keep the default URL.",
+      "Save configuration and choose Connect account. Your application verifies the company user list; this is a shared company credential, not individual user login. No OAuth app or callback is required.",
+      "Call reads require existing recordings and appropriate company API access. Transcripts and analysis can be unavailable or still processing. Select call IDs or a date range in the app; its access policy must protect company recordings and CRM fields from unauthorized visitors.",
+      "Linked deal context comes from the CRM data already connected to Gong; this does not configure CRM synchronization. Media URLs are requested only explicitly and expire after eight hours. The app must keep these URLs private and must never send the Gong Basic credential to a media URL.",
+      "For a lost secret, create a replacement and update Env. Disconnect only removes local connection state. To revoke in Gong, open the key row’s actions, Edit, Delete, acknowledge I understand, then Delete API. Other systems using that key will lose access too."
+    ]
+  }
+});
+export { gongDefinition };

package/src/shared/google-ads-search.js

@@ -0,0 +1,31 @@
+import { createSchema } from "json-rest-schema";
+import { validateSchemaPayload } from "@jskit-ai/kernel/shared/validators";
+
+const id = { type: "string", required: true, validator: value => /^[0-9]{1,20}$/.test(value) || "Use a numeric Google ID." };
+const text = (max) => ({ type: "string", required: true, minLength: 1, maxLength: max,
+  validator: value => !/[\p{Cc}\p{Cf}]/u.test(value) || "Use plain text without control characters." });
+const list = (item, min, max) => ({ type: "array", required: true, items: item,
+  validator: values => values.length >= min && values.length <= max || `Provide ${min}–${max} values.` });
+const micros = { type: "string", required: true, validator: value => /^[1-9][0-9]{0,11}$/.test(value) || "Use a positive integer string of at most 12 digits." };
+const googleAdsSearchFields = {
+  customerId: { ...id, validator: value => /^[0-9]{10}$/.test(value) || "Use a ten-digit customer ID." },
+  nonPolitical: { type: "boolean", required: true, validator: value => value === true || "This Search recipe supports only non-political advertising." },
+  name: text(100), currency: { type: "string", required: true, validator: value => /^[A-Z]{3}$/.test(value) || "Use the uppercase account currency code." },
+  dailyBudgetMicros: micros, maxCpcMicros: micros,
+  finalUrl: { ...text(2048), validator: value => {
+    try { const url = new URL(value); return url.protocol === "https:" && !url.username && !url.password && !url.hash || "Use the public HTTPS landing page."; }
+    catch { return "Use the public HTTPS landing page."; }
+  } },
+  conversionActionId: id,
+  locationIds: list(id, 1, 10), languageId: id,
+  keywords: list(text(80), 1, 20),
+  headlines: list(text(30), 3, 15), descriptions: list(text(90), 2, 4)
+};
+const schema = createSchema(googleAdsSearchFields);
+function validateGoogleAdsSearchPlan(input) {
+  for (const key of ["customerId", "name", "currency", "dailyBudgetMicros", "maxCpcMicros", "finalUrl", "conversionActionId", "languageId"]) {
+    if (typeof input?.[key] !== "string") throw new Error(`Search plan ${key} must be a string.`);
+  }
+  return validateSchemaPayload({ schema, mode: "replace" }, input, { statusCode: 422 });
+}
+export { googleAdsSearchFields, validateGoogleAdsSearchPlan };

package/src/shared/google-ads.js

@@ -0,0 +1,28 @@
+import { createSchema } from "json-rest-schema";
+
+const common = {
+  loginCustomerId: { type: "string", noTrim: true, minLength: 10, maxLength: 10,
+    validator: (value) => /^[0-9]{10}$/u.test(value) || "Enter the manager's 10-digit customer ID without hyphens." }
+};
+const googleAdsDefinition = Object.freeze({
+  id: "google-ads", name: "Google Ads", description: "Discover advertising accounts, prepare reviewed Search campaigns and read Google Ads reports.",
+  categories: ["Google", "Marketing"], accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  settingsSchema: createSchema(common),
+  settingsFields: [
+    { name: "loginCustomerId", label: "Manager customer ID (optional)", placeholder: "1234567890",
+      hint: "Use the manager through which this app accesses client accounts, without hyphens. Direct account access can leave this blank." }
+  ],
+  scopes: [{ value: "https://www.googleapis.com/auth/adwords", label: "Access Google Ads accounts", recommended: true }],
+  permissionsHint: "This Google permission can authorize campaign changes. Search management uses separate reviewed operations; your application must authorize each account and spending decision. This is not application login.",
+  setup: { url: "https://developers.google.com/google-ads/api/docs/get-started/make-first-call", steps: [
+    "Select your Google Cloud project, open APIs & Services > Library and enable Google Ads API. Open its Overview page and review API access level. Test access only permits test accounts; use Upgrade access level to apply for production access.",
+    "In Google Auth Platform, configure Branding and Audience, adding test users while testing. In Data Access add https://www.googleapis.com/auth/adwords. Complete the applicable consent publishing and verification requirements.",
+    "Open Clients, create a Web application client and add this project's exact Suggested callback URL to Authorized redirect URIs. Your application backend must implement that callback.",
+    "Copy Client ID here and Save configuration. Use Set credential in Env to save the client secret under its referenced key, and save the same callback URL under the callback reference. Google Ads no longer requires a developer token.",
+    "If access goes through a manager, enter its 10-digit customer ID without hyphens. Leave it blank for direct access. The person consenting must already have access to the intended Ads accounts.",
+    "For Search campaigns, save and connect this shared account, then open Google Ads Search campaigns below. Load the client account and website goal, prepare and save the plan, validate it, and explicitly create it paused. Verify tags, billing and advertiser requirements before the separate launch approval. Disconnecting does not pause running ads.",
+    "Choose Connect account for a shared project account. Individual users connect inside the application's own account screen. Verification lists directly accessible accounts; it does not prove access to every child account. Disconnect removes local access; revoke Google consent separately when intended."
+  ] }
+});
+
+export { googleAdsDefinition };

package/src/shared/google-maps-platform.js

@@ -0,0 +1,28 @@
+import { createSchema } from "json-rest-schema";
+import { secretReference } from "@jskit-ai/connectors-core/shared/configuration";
+
+const googleMapsPlatformDefinition = Object.freeze({
+  id: "google-maps-platform", name: "Google Maps Platform", description: "Geocode addresses, find places, compute routes and configure browser maps.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  apiKeyReferenceLabel: "Server API key reference",
+  verificationFields: [{ name: "address", required: true, label: "Verification address",
+    hint: "Enter an address or plus code. Connecting performs one geocoding request and can incur provider usage charges." }],
+  apiKeyReferenceHint: "Reference a server key authorized for Geocoding API. Verification performs one geocoding request using an address you supply and can incur provider usage charges.",
+  settingsSchema: createSchema({ browserKeyRef: { ...secretReference, required: false }, mapId: { type: "string", maxLength: 100, validator: value => /^[A-Za-z0-9_-]+$/.test(value) || "Use the map ID from Google Cloud." } }),
+  settingsFields: [{ name: "mapId", label: "Map ID (optional)", hint: "Public JavaScript map ID for advanced markers. Create it in Google Maps Platform > Map management. DEMO_MAP_ID is only for development." }, { name: "browserKeyRef", label: "Browser API key reference (optional)", placeholder: "env:GOOGLE_MAPS_BROWSER_KEY",
+    hint: "A separate key for browser maps. Restrict it to the actual application websites and APIs. Backend verification does not verify this key." }],
+  setup: {
+    url: "https://developers.google.com/maps/documentation/geocoding/guides-v3/get-api-key",
+    steps: [
+      "Select a Google Cloud project with billing and enable Geocoding API. Open APIs & Services > Credentials > Create credentials > API key for server geocoding.",
+      "Restrict the server key to Geocoding API and the backend's outbound IPs. Enter env:GOOGLE_MAPS_SERVER_KEY in Server API key reference, Save configuration, then Set credential in Env. Save the real key as GOOGLE_MAPS_SERVER_KEY.",
+      "For places and routes, also enable Places API (New) and Routes API in Library, then add them to the server key API restrictions. Place names/address/location use billable data fields; set quotas and review current pricing. Geocoding verification does not test these additional APIs.",
+      "For browser maps, enable Maps JavaScript API. Open Google Maps Platform > Map management > Create map ID, select JavaScript and copy the ID into Map ID. The app loads Google's SDK with its separate browser key and gives the map container a height. Advanced markers require a map ID.",
+      "For browser maps, create a separate key restricted to the required browser APIs and Websites, including the actual preview and custom domains. Enter env:GOOGLE_MAPS_BROWSER_KEY in Browser API key reference and save that value separately in Env. The app publishes this browser key; never publish the server key.",
+      "Save configuration, enter Verification address, then Connect account. This performs one potentially billable geocoding request. It verifies only the server key, not browser maps. No OAuth registration or callback is needed.",
+      "Update Env when replacing a key. Disconnect removes local connection state; delete or restrict the key in Google Cloud to revoke provider access. Check existing usage before deleting a key used by other applications."
+    ]
+  }
+});
+
+export { googleMapsPlatformDefinition };

package/src/shared/google.js

@@ -0,0 +1,133 @@
+import { createSchema } from "json-rest-schema";
+const scope = (name) => name.startsWith("https:") ? name : `https://www.googleapis.com/auth/${name}`;
+function definition(id, name, api, description, recommended, permissions, verificationFields = [], setupNotes = []) {
+  return Object.freeze({
+    id, name, description, verificationFields, categories: ["Google", "Productivity"],
+    accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+    scopes: permissions.map(([value, label, required = false]) => ({ value: scope(value), label,
+      recommended: Array.isArray(recommended) ? recommended.includes(value) : value === recommended, ...(required ? { required: true } : {}) })),
+    setup: {
+      url: "https://developers.google.com/identity/protocols/oauth2/web-server",
+      steps: [
+        `In Google Cloud, select the project for this application. Open APIs & Services > Library, search for ${api}, open it and choose Enable.`,
+        "Open Google Auth Platform > Branding. If setup has not started, choose Get Started; enter the app name, support email and contact email, choose the audience, review the policy and finish with Create.",
+        "Choose External if people outside your Google Workspace organization will connect. During testing, open Audience > Test users > Add users, enter the allowed Google accounts and Save. Internal is only for your organization. External Testing refresh tokens for these API permissions expire after seven days; reconnect during testing. Public release also requires completing the applicable Google review.",
+        "For an external app, open Data Access > Add or Remove Scopes. Add the permissions selected in this integration and Save. Sensitive or restricted scopes can require Google verification before public use; creating a client does not complete that review.",
+        ...setupNotes,
+        "Open Clients > Create Client. Choose Web application and name it. Under Authorized redirect URIs, choose Add URI and paste the application callback shown here, then Create. The editor dashboard URL is not the callback.",
+        "Copy the Client ID into this form and copy or download the full client secret immediately; Google only shows it at creation. Save configuration, then use Set credential in Env to put the secret value in the variable named by Client secret reference. If lost, open Clients, select this client and Add Secret; save the new value before disabling the old secret.",
+        "Use Set callback in Env to save the same application callback URL. If a Configured callback URL is shown, preserve it unless intentionally changing both Env and Google. Scheme, path, case and trailing slash must match exactly.",
+        "For a shared account, return here and check or connect the account once the application runtime is ready. For per-user connections, each person authorizes inside your application. Saving this registration neither connects every user nor installs the callback route."
+      ]
+    }
+  });
+}
+
+const gmailDefinition = definition("gmail", "Gmail", "Gmail API", "Read and search mail, manage drafts and labels, and explicitly send messages.", ["gmail.readonly", "gmail.send", "gmail.compose", "gmail.modify"], [
+  ["gmail.readonly", "Read messages", true], ["gmail.send", "Send messages"], ["gmail.compose", "Manage drafts and send messages"],
+  ["gmail.modify", "Read and modify messages"], ["gmail.labels", "Manage labels"], ["gmail.metadata", "Read message headers and labels"],
+  ["gmail.insert", "Insert messages"], ["gmail.settings.basic", "Manage basic mail settings"], ["gmail.settings.sharing", "Manage sharing settings"],
+  ["https://mail.google.com/", "Full mailbox access including permanent deletion"],
+  ["gmail.addons.current.message.readonly", "Read the current add-on message"], ["gmail.addons.current.message.action", "Act on the current add-on message"],
+  ["gmail.addons.current.message.metadata", "Read the current add-on message headers"], ["gmail.addons.current.action.compose", "Compose from an add-on"]
+], [], [
+  "For inbox reading, retain Read messages (gmail.readonly) and deselect optional sending or editing permissions your application does not use. Gmail read access is restricted: check Google's restricted-scope review and server-data security assessment requirements before public release.",
+  "Read messages gives full bodies, search and attachments. Send messages permits sending; Manage drafts and send messages permits drafts; Read and modify messages permits marking read, archiving and moving mail to trash. Adding permission requires reconnecting. Connect only reads the mailbox profile and never sends or edits mail.",
+  "The app builds MIME messages with its framework, renders mail safely and authorizes each mailbox user. A send receipt is not proof of delivery. No automatic retry occurs after an uncertain send; check Sent before retrying. No background sync or permanent-delete operation is supplied.",
+  "Leave Manage sharing settings unselected: its operations require a Workspace service account with domain-wide delegation, which this Web application connection does not configure. Add-on permissions apply only to an actual Gmail add-on; they do not replace mailbox permissions."
+]);
+const googleDriveDefinition = definition("google-drive", "Google Drive", "Google Drive API", "Find files, upload and download content, and manage basic file metadata.", ["drive.file", "drive.appdata", "drive.appfolder", "drive.readonly"], [
+  ["drive.metadata.readonly", "Read file metadata"], ["drive.file", "Manage files selected for this application", true], ["drive.readonly", "Read and download files"],
+  ["drive", "Manage all Drive files"], ["drive.metadata", "Manage file metadata"], ["drive.appdata", "Manage application data"],
+  ["drive.appfolder", "Manage this application’s Drive folder data"],
+  ["drive.apps.readonly", "Read installed Drive apps"], ["drive.meet.readonly", "Read Meet-created files"],
+  ["drive.photos.readonly", "Read photos"], ["drive.scripts", "Manage Apps Script files"],
+  ["drive.activity", "Read and add file activity"], ["drive.activity.readonly", "Read file activity"]
+], [], [
+  "Select only the file access your application needs. With drive.file, users must select or open files through your application's file-picker flow, or the application must create them. Pasting an existing file ID alone does not grant access. App-data permissions do not grant access to ordinary Drive files.",
+  "The app can upload files up to 5 MB and download/export up to 8 MiB with this adapter. Google Docs/Sheets/Slides require export to a supported MIME type; ordinary stored files use download. Larger or resumable transfers need the framework's native client.",
+  "Use file capabilities and sharing access before offering writes. Uploading with an existing file ID replaces its content and name; moving a file to trash is an explicit metadata update. The app owns file selection, safe rendering and ambiguous-transfer reconciliation. No sync service or embedded Google Picker is installed.",
+  "Broad Drive read or management permissions are restricted scopes. Review Google's verification and server-data security assessment requirements before public release. An empty file list with drive.file can mean no files have yet been shared with this application."
+]);
+const drivePermissions = [["drive.file", "Access files selected for this application"], ["drive.readonly", "Read Drive files"], ["drive", "Manage Drive files"]];
+const googleSheetsDefinition = definition("google-sheets", "Google Sheets", "Google Sheets API", "Create spreadsheets, read and write ranges, and apply native batch updates.", "drive.file", [
+  ["spreadsheets.readonly", "Read spreadsheets"], ["spreadsheets", "Manage spreadsheets"],
+  ["drive.metadata.readonly", "Read Drive file metadata (does not grant spreadsheet content access)"], ...drivePermissions
+], [{ name: "spreadsheetId", required: false, label: "Spreadsheet ID (optional)", hint: "Leave blank for create-first access with drive.file and Drive API enabled. Otherwise copy the ID between /spreadsheets/d/ and /edit, not the gid tab number; the account and app must have access." }], [
+  "For create-first access, retain Access files selected for this application (drive.file) and also enable Google Drive API in APIs & Services > Library. Leave Spreadsheet ID blank: verification reads accessible Drive metadata and accepts an empty list. It does not create a spreadsheet or prove Sheets API is enabled.",
+  "With drive.file, the app can create and edit its own spreadsheets. An existing file needs Google Picker or an app-open grant; pasting an ID alone does not grant access. For spreadsheets.readonly-only or spreadsheets-only access, supply an accessible Spreadsheet ID. Adding write permissions requires reconnecting.",
+  "Value writes default to RAW so untrusted strings are not interpreted as formulas. Choose USER_ENTERED explicitly for formulas and locale-dependent parsing. Ranges use A1 notation; quote sheet titles with spaces. Appending finds the next row in the table, not necessarily the requested start cell; uncertain writes are never automatically retried.",
+  "The app can create spreadsheets, update or append rows, clear values, and send bounded native batch requests for sheets and formatting. Clear preserves formatting. The app owns conflict handling, file selection and its data UI; this form installs neither a spreadsheet editor nor editor-assistant tools."
+]);
+const googleDocsDefinition = definition("google-docs", "Google Docs", "Google Docs API", "Create documents, read tabs and edit content with native batch requests.", "drive.file", [
+  ["documents.readonly", "Read documents"], ["documents", "Manage documents"], ...drivePermissions
+], [{ name: "documentId", required: false, label: "Document ID (optional)", hint: "Leave blank for create-first access with drive.file and Drive API enabled. To verify an existing document, copy its ID between /document/d/ and /edit; the account and this app must have access." }], [
+  "For create-first access, retain Access files selected for this application (drive.file) and also enable Google Drive API in APIs & Services > Library. Leave Document ID blank: connection checks accessible Drive metadata and accepts an empty list; it does not create a document or prove Docs API is enabled.",
+  "With drive.file the app can create and edit its own documents. For existing files, use Google Picker or an app-open flow to grant this application access; pasting an ID alone does not grant access. Picker wiring belongs to the app.",
+  "For documents.readonly-only or documents-only access, supply an accessible Document ID for verification. Manage documents enables writing documents accessible to the account; adding permissions requires reconnecting. Broad Drive permissions can require restricted-scope review.",
+  "Create a blank document, then insert content with documents.batchUpdate. The app owns tab IDs, UTF-16 text indices, formatting requests and revision conflict handling. No editor-assistant attachment or visual document editor is installed by this form."
+]);
+const googleSlidesDefinition = definition("google-slides", "Google Slides", "Google Slides API", "Create and edit presentations, read pages and obtain preview thumbnails.", "drive.file", [
+  ["presentations.readonly", "Read presentations"], ["presentations", "Manage presentations"],
+  ["spreadsheets.readonly", "Read linked spreadsheets"], ["spreadsheets", "Manage linked spreadsheets"], ...drivePermissions
+], [{ name: "presentationId", required: false, label: "Presentation ID (optional)", hint: "Leave blank for create-first access with drive.file and Drive API enabled. Otherwise copy the ID between /presentation/d/ and /edit; this is not a slide object ID. The account and app must have access." }], [
+  "For create-first access, retain Access files selected for this application (drive.file) and enable Google Drive API as well as Google Slides API in APIs & Services > Library. Leave Presentation ID blank: verification reads Drive metadata and accepts an empty list; it neither creates a deck nor proves Slides API is enabled.",
+  "The app can create and edit its own decks with drive.file. Existing decks need an app-open or Google Picker grant; a pasted ID alone is insufficient. For presentations.readonly-only or presentations-only access, supply an accessible Presentation ID. Additional permissions require reconnecting; spreadsheet permissions alone do not grant deck access.",
+  "Create a blank presentation, then use native batch requests to add slides, text, images or formatting. The app owns object IDs, positions, linked-chart access and revision conflict handling. Images must be reachable by Google; thumbnails return temporary URLs that should not be logged or stored as permanent public assets.",
+  "No slide designer, template catalogue, embedded Picker or editor-assistant attachment is installed. Copying, sharing, exporting or deleting the whole deck uses the separate Drive API. An uncertain create or edit is not automatically retried."
+]);
+const googleSearchConsoleDefinition = definition("google-search-console", "Google Search Console", "Google Search Console API", "Query search performance, inspect indexed URLs and manage sitemaps.", "webmasters.readonly", [
+  ["webmasters.readonly", "Read Search Console properties"], ["webmasters", "Manage Search Console properties"],
+  ["siteverification", "Manage website ownership through Site Verification"],
+  ["siteverification.verify_only", "Verify new website ownership through Site Verification"]
+], [], [
+  "The connecting Google account needs access to the intended Search Console property. A property owner can open that property, choose Settings > Users and permissions > Add user, enter the account email, choose the appropriate role and save.",
+  "To add a property, open Search Console > property selector > Add property. Domain properties require your DNS provider's TXT record; URL-prefix properties offer verification methods such as an HTML file or tag. Follow Google's displayed instructions and Verify, or have an existing owner add this account. An OAuth grant does not verify domain ownership.",
+  "Search performance uses finalized Pacific-time dates and top rows, not a complete traffic export. URL inspection reports Google's indexed snapshot, not a live page test or request for indexing. Use the exact property identifier returned by the connection.",
+  "To submit or remove sitemaps, select Manage Search Console properties (webmasters), add the scope in Data Access and reconnect. The app must publish a real sitemap URL first. Submission does not create the file, guarantee indexing or change DNS; deletion removes its Search Console entry, not the hosted file.",
+  "Keep Read Search Console properties for the initial check, which lists accessible properties. Site Verification permissions alone do not authorize that check or create property access. An empty result can mean this Google account has no properties."
+]);
+const googleAnalyticsDefinition = Object.freeze({
+  id: "google-analytics", name: "Google Analytics", description: "Configure website tracking with your public GA4 Measurement ID.",
+  categories: ["Google", "Marketing"], configurationOnly: true,
+  accountModes: ["shared"], authenticationMethods: ["none"], scopes: [],
+  authenticationLabels: { none: "Public configuration · no credentials" },
+  authenticationHint: "Your application loads the Google tag. This does not grant access to Analytics reports.",
+  settingsSchema: createSchema({ measurementId: {
+    type: "string", required: true, minLength: 3, maxLength: 64,
+    validator: (value) => /^G-[A-Z0-9]+$/u.test(value) || "Enter the GA4 web stream Measurement ID beginning G-."
+  } }),
+  settingsFields: [{ name: "measurementId", label: "Measurement ID", required: true,
+    hint: "Public: this value will be visible in your published application. Copy it from your GA4 web stream." }],
+  setup: {
+    url: "https://support.google.com/analytics/answer/9304153",
+    steps: [
+      "Sign into Google Analytics and select this application's GA4 property. You need Editor or higher access at property level. If you need a new account or property, follow the Provider setup guide first.",
+      "Open Admin > Data collection and modification > Data streams, then the Web tab and the application's stream. If none exists, choose Add stream > Web, enter the application website URL and stream name, review enhanced measurement and choose Create stream.",
+      "Copy the Measurement ID beginning G- from Stream details into Measurement ID here and save. Use the web stream's measurement identifier, not its numeric property ID or a Google Ads identifier.",
+      "No OAuth client, API key, Env secret or callback URL is needed. This identifier is public and does not grant access to Analytics reports.",
+      "Ask your application's framework to install the Google tag using this setting, respecting existing tracking and consent behavior. Saving this configuration does not install tracking or verify event delivery.",
+      "Choose one tracking owner: an existing Google tag/Tag Manager, or the optional JSKIT browser helper. Do not install both. For manual SPA page views, turn off Page changes based on browser history events in the web stream’s Enhanced measurement settings as well as automatic page-view sending in code.",
+      "The app decides consent before loading tracking and calls page views on completed navigation. For conversions, emit an event such as generate_lead and mark it as a key event in Analytics Admin > Data display > Events. Never send email addresses, message text or sensitive URL parameters.",
+      "Removing this configuration disables tracking after the app’s next configuration reload or deployment; already-loaded pages need cleanup or reload. It does not erase historical Analytics data."
+    ]
+  }
+});
+const bigqueryDefinition = Object.freeze({ ...definition("bigquery", "BigQuery", "BigQuery API", "Configure the query project, run queries and retrieve results.", "bigquery", [
+  ["bigquery.readonly", "Read BigQuery data and metadata"], ["bigquery", "Manage BigQuery data"],
+  ["cloud-platform.read-only", "Read Google Cloud resources"], ["cloud-platform", "Manage Google Cloud resources"]
+], [], [
+  "In the project that will run queries, open IAM & Admin > IAM > Grant access. Add the connecting Google account and grant BigQuery Job User when it must create query jobs. OAuth consent alone does not grant project or dataset access.",
+  "In BigQuery Studio, select the intended dataset in Explorer, choose Sharing > Permissions > Add principal, and grant only the needed dataset role, such as BigQuery Data Viewer for reading data and metadata. A dataset administrator must make this grant. Repeat for any source dataset the authorized queries use.",
+  "Enter the execution and billing project ID below. Dataset/table discovery uses that configured project; use a separate integration slot to browse another project. Your app must set the query location and a maximum bytes billed limit when needed, and authorize each job before inspecting or cancelling it.",
+  "Connect only lists accessible projects; it does not run a billable query or prove table access. Cancellation is a request, not a guarantee that execution or charges stopped; inspect job status afterwards."
+]),
+  settingsSchema: createSchema({ projectId: {
+    type: "string", required: true, minLength: 6, maxLength: 30,
+    validator: (value) => /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/u.test(value) || "Enter the Google Cloud project ID, not its number or URL."
+  } }),
+  settingsFields: [{ name: "projectId", label: "Google Cloud project ID", required: true,
+    hint: "The project that runs and is billed for queries. It can differ from the project containing your datasets. The initial connection check only lists accessible projects." }]
+});
+const googleDefinitions = Object.freeze([gmailDefinition, googleDriveDefinition, googleSheetsDefinition, googleDocsDefinition, googleSlidesDefinition, googleSearchConsoleDefinition, googleAnalyticsDefinition, bigqueryDefinition]);
+export { gmailDefinition, googleDriveDefinition, googleSheetsDefinition, googleDocsDefinition, googleSlidesDefinition, googleSearchConsoleDefinition, googleAnalyticsDefinition, bigqueryDefinition, googleDefinitions };

package/src/shared/granola.js

@@ -0,0 +1,25 @@
+const granolaDefinition = Object.freeze({
+  id: "granola", name: "Granola", description: "Read meeting notes with an API key or connect the assistant owner through Granola MCP OAuth.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key", "oauth2"], scopes: [
+    { value: "openid", label: "Identify the connected Granola account", recommended: true, authenticationMethods: ["oauth2"] },
+    { value: "profile", label: "Read account profile", recommended: true, authenticationMethods: ["oauth2"] },
+    { value: "email", label: "Read account email", recommended: true, authenticationMethods: ["oauth2"] },
+    { value: "offline_access", label: "Refresh access without repeating sign-in", recommended: true, authenticationMethods: ["oauth2"] }
+  ],
+  setup: { urlByAuthentication: { oauth2: "https://docs.granola.ai/help-center/sharing/integrations/mcp" }, clientRegistrationEndpoint: "https://mcp-auth.granola.ai/oauth2/register", url: "https://docs.granola.ai/help-center/sharing/integrations/granola-api", steps: [
+"API key: In the Granola desktop app, open Settings, Connectors, API keys, then Create new key. Choose the note access scopes and Generate API Key.",
+    "For an admin-owned workspace key, use Settings, Connectors, Workspace API keys, then Create new key. Both key types require a Business or Enterprise plan.",
+    "Enter env:GRANOLA_API_KEY in API key reference and Save configuration. Choose Set credential in Env, paste the grn_ key as GRANOLA_API_KEY, and save there. Note permissions are chosen in Granola; editing this file grants no additional access.",
+    "Shared mode deliberately shares the key's accessible notes. Assistant mode uses its owner's connection. For MCP tools, select OAuth instead; an API key cannot authenticate MCP.",
+    "Return and choose Connect account. Your application verifies the key by listing accessible notes; an empty list is valid. Notes still being processed may be absent. No OAuth registration or callback is needed for API-key mode.",
+    "For replacement, create a new key and update Env before retiring the old key. Disconnect removes local state. To revoke provider access, return to the personal or Workspace API keys page, select Revoke on that key and confirm."
+  ], stepsByAuthentication: { oauth2: [
+    "OAuth / MCP: Use a Granola account with meeting notes and select Assistant access. Free accounts can access personal notes from the last 30 days; some tools require a paid plan. Select OAuth and keep the account identity and refresh permissions selected.",
+    "Confirm the Suggested callback URL is the exact route your application or assistant host will serve. Choose Register client and connect to create the client and save its credentials privately in development Env. CLI users can call registerGranolaClient; the manual endpoint/request remains available. Register once for this host, not once per connection.",
+    "If registering manually, copy client_id into Client ID and Save configuration. Choose Set credential in Env for client_secret and Set callback in Env for the exact registered callback. Automatic registration saves these values for you; inspect Env before retrying an uncertain registration. Keep the response private.",
+    "Return, save and choose Connect account. Sign into Granola in the browser and approve access. MCP verification lists tools without reading a meeting. Select the intended active workspace in Granola; MCP does not merge workspaces. The host must authorize tool calls before executing them.",
+    "Disconnect removes the local OAuth grant. This does not promise provider-wide revocation. For help removing provider access, contact Granola at hey@granola.so. Changing your API key does not revoke an MCP OAuth connection."
+  ] } }
+});
+
+export { granolaDefinition };

package/src/shared/hex.js

@@ -0,0 +1,28 @@
+import { createSchema } from "json-rest-schema";
+
+const hexHosts = Object.freeze({ standard: "app.hex.tech", eu: "eu.hex.tech", hipaa: "hc.hex.tech" });
+const hexEndpointField = { type: "string", enum: Object.keys(hexHosts), defaultTo: "standard" };
+const hexDefinition = Object.freeze({
+  id: "hex", name: "Hex", description: "Search projects and use Hex Threads through the assistant owner's MCP connection.",
+  accountModes: ["assistant"], authenticationMethods: ["oauth2"],
+  scopes: [
+    { value: "openid", label: "Identify the connected Hex account", recommended: true },
+    { value: "profile", label: "Read account profile", recommended: true },
+    { value: "email", label: "Read account email", recommended: true },
+    { value: "offline_access", label: "Refresh access without repeating sign-in", recommended: true }
+  ],
+  settingsSchema: createSchema({ endpoint: hexEndpointField }),
+  settingsFields: [{ name: "endpoint", label: "Hex workspace endpoint", hint: "Use the endpoint where your Hex workspace lives; register the OAuth client at that endpoint.",
+    items: [{ value: "standard", title: "Standard (app.hex.tech)" }, { value: "eu", title: "Europe (eu.hex.tech)" }, { value: "hipaa", title: "HIPAA (hc.hex.tech)" }] }],
+  setup: { clientRegistrationEndpoint: (settings) => `https://auth.${hexHosts[settings.endpoint || "standard"]}/oauth2/register`, url: "https://learn.hex.tech/docs/api-integrations/mcp-server", steps: [
+    "Confirm your Hex workspace has MCP access and your role is Explorer or higher. Hex currently requires a Team or Enterprise plan.",
+    "Choose Standard, Europe or HIPAA in Hex workspace endpoint to match where you sign into Hex. Confirm the Suggested callback URL is the exact route your assistant host will serve. Keep the identity, profile, email and refresh permissions selected.",
+    "Choose Register client and connect to create the client for this endpoint and save its credentials privately in development Env. Alternatively copy the endpoint/request from OAuth client registration into your HTTP client. CLI users can call registerHexClient. Register once per host and endpoint; inspect Env before retrying uncertain registration.",
+    "For manual registration, copy client_id from the registration response into Client ID and Save configuration. Choose Set credential in Env to store client_secret under the displayed Client secret reference. Choose Set callback in Env to save the exact registered callback. A personal or workspace API token cannot replace these OAuth credentials.",
+    "Return, save and choose Connect account. Sign into Hex, select the intended workspace when prompted and approve consent. Verification lists tools without starting a Thread or editing a project.",
+    "The host must authorize each tool and its arguments. Identity scopes are not read-only tool permissions; Thread tools can run analysis and consume credits; project editing tools require Editor or higher and the appropriate project permission.",
+    "Single-tenant custom Hex domains require separate endpoint verification and are not supported by this initial adapter. Changing endpoint requires a new matching registration and reconnection. Disconnect removes this local grant; the Hex workspace API-access switch and personal-token revocation do not disable MCP access. Saving does not register a client or attach tools."
+  ] }
+});
+
+export { hexDefinition, hexHosts, hexEndpointField };