@jskit-ai/connectors-catalog 0.1.1

package/src/shared/inngest.js

@@ -0,0 +1,35 @@
+import { createSchema } from "json-rest-schema";
+import { secretReference } from "@jskit-ai/connectors-core/shared/configuration";
+
+const inngestDefinition = Object.freeze({
+  id: "inngest", name: "Inngest", description: "Send events to background workflows and inspect registered apps.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  apiKeyReferenceLabel: "Signing Key reference",
+  apiKeyReferenceHint: "Reference the Signing Key for the intended Inngest environment. Verification reads app metadata; it does not verify the Event Key or run a workflow.",
+  settingsSchema: createSchema({
+    eventKeyRef: { ...secretReference, required: true },
+    branchEnvironment: { type: "string", minLength: 1, maxLength: 255,
+      validator: (value) => /^[\x21-\x7e]+$/u.test(value) || "Use an ASCII branch environment without spaces or control characters." }
+  }),
+  settingsFields: [
+    { name: "eventKeyRef", label: "Event Key reference", placeholder: "env:INNGEST_EVENT_KEY",
+      environmentCredential: { label: "Inngest Event Key", public: false },
+      hint: "The Event Key sends events. Keep it separate from the Signing Key, and use keys from the same intended environment." },
+    { name: "branchEnvironment", label: "Branch environment (optional)", placeholder: "feature/my-branch",
+      hint: "Routes event delivery to this branch. App metadata reads follow the Signing Key's environment." }
+  ],
+  setup: {
+    url: "https://www.inngest.com/docs/events/creating-an-event-key",
+    steps: [
+      "Open Inngest Cloud and choose the intended environment. Next to the environment selector, click the key icon > Event keys > + Create Event Key. Give it a descriptive name, choose Save changes, then Copy. Configure event-name or IP restrictions for your application if needed.",
+      "Enter env:INNGEST_EVENT_KEY in Event Key reference. In the same environment's Signing Key tab, copy the Signing Key separately and enter env:INNGEST_SIGNING_KEY in Signing Key reference. The Event Key sends events; the Signing Key verifies metadata access.",
+      "Save configuration. Choose Set credential in Env to save INNGEST_SIGNING_KEY. Under Inngest Event Key, choose Set credential in Env to save INNGEST_EVENT_KEY with the copied Event Key value. Save both values in backend Env and return here; the configuration file stores only references, never the keys.",
+      "Leave Branch environment empty for ordinary delivery. For branch delivery, enter its exact identifier. It only changes event routing; metadata reads still use the Signing Key's environment. Save changes before connecting.",
+      "Choose Connect account. Verification reads registered app metadata without sending an event. It does not check the Event Key, prove that both keys match, or prove that a workflow exists. An empty app list can still verify successfully. No OAuth app registration or callback is needed.",
+      "Implement the application's functions with the native Inngest SDK: event triggers receive submitted events, cron triggers schedule work, and step.run provides durable steps. Serve them at the deployed app's /api/inngest route with the same environment Signing Key. In Inngest Cloud select the environment > Apps > Sync App or Sync New App, paste the full deployed serve URL and choose Sync App. After changing functions or domains, open that app > Resync; use Override for a changed URL and retain the same app ID. An event receipt only confirms acceptance, not workflow success. Disconnect removes the local connection; it does not revoke keys or cancel accepted runs. Coordinate signing-key rotation with the application's SDK and update Env before verifying again."
+
+    ]
+  }
+});
+
+export { inngestDefinition };

package/src/shared/lightspeed.js

@@ -0,0 +1,75 @@
+import { createSchema } from "json-rest-schema";
+
+const lightspeedDefinition = Object.freeze({
+  id: "lightspeed", name: "Lightspeed", description: "Read products, inventory, sales, customers and outlets from a Lightspeed Retail X-Series store.",
+  accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  oauthClientAuthenticationMethods: ["client_secret_post"],
+  settingsSchema: createSchema({
+    domainPrefix: { type: "string", required: true, minLength: 1, maxLength: 63,
+      validator: (value) => /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(value) || "Enter the lowercase store prefix without a URL, dots or spaces." }
+  }),
+  settingsFields: [{ name: "domainPrefix", label: "Domain prefix", placeholder: "your-store",
+    hint: "The store prefix from https://your-store.retail.lightspeed.app. Use the store you intend to authorize." }],
+  scopes: [
+    { value: "retailer:read", label: "Read retailer settings", recommended: true },
+    { value: "outlets:read", label: "Read outlets", recommended: true },
+    { value: "registers:read", label: "Read registers", recommended: true },
+    { value: "payment_types:read", label: "Read payment types", recommended: true },
+    { value: "products:read", label: "Read products", recommended: true },
+    { value: "products:read:price_books", label: "Read price books", recommended: true },
+    { value: "inventory:read", label: "Read inventory", recommended: true },
+    { value: "customers:read", label: "Read customers", recommended: true },
+    { value: "sales:read", label: "Read sales", recommended: true },
+    { value: "fulfillments:read", label: "Read fulfillments", recommended: true },
+    { value: "promotions:read", label: "Read promotions", recommended: true },
+    { value: "gift_cards:read", label: "Read gift cards", recommended: true },
+    { value: "store_credits:read", label: "Read store credits", recommended: true },
+    { value: "suppliers:read", label: "Read suppliers", recommended: true },
+    { value: "taxes:read", label: "Read taxes", recommended: true },
+    { value: "users:read", label: "Read users", recommended: true },
+    { value: "audit:read", label: "Read audit events" },
+    { value: "business_rules:read", label: "Read business rules" },
+    { value: "business_rules:write", label: "Edit business rules" },
+    { value: "channels:read", label: "Read channels" },
+    { value: "consignments:read", label: "Read consignments" },
+    { value: "consignments:write:inventory_count", label: "Perform inventory counts" },
+    { value: "consignments:write:stock_order", label: "Process stock orders" },
+    { value: "consignments:write:stock_transfer", label: "Transfer stock" },
+    { value: "customers:write", label: "Edit customers" },
+    { value: "custom_fields:read", label: "Read custom fields" },
+    { value: "custom_fields:write", label: "Edit custom fields" },
+    { value: "fulfillments:write", label: "Edit fulfillments" },
+    { value: "gift_cards:write:issue", label: "Issue gift cards" },
+    { value: "gift_cards:write:redeem", label: "Redeem gift cards" },
+    { value: "inventory:write", label: "Edit inventory" },
+    { value: "payments:read", label: "Read payments" },
+    { value: "products:write", label: "Edit products" },
+    { value: "products:write:price_books", label: "Edit price books" },
+    { value: "promotions:write", label: "Edit promotions" },
+    { value: "register:close", label: "Close registers" },
+    { value: "register:open", label: "Open registers" },
+    { value: "remote_rules:read", label: "Read remote rules" },
+    { value: "remote_rules:write", label: "Edit remote rules" },
+    { value: "sales:write", label: "Edit sales" },
+    { value: "serial_numbers:read", label: "Read serial numbers" },
+    { value: "serial_numbers:write", label: "Edit serial numbers" },
+    { value: "services:read", label: "Read services" },
+    { value: "services:write", label: "Edit services" },
+    { value: "store_credits:write:issue", label: "Issue store credits" },
+    { value: "suppliers:write", label: "Edit suppliers" },
+    { value: "taxes:write", label: "Edit taxes" },
+    { value: "users:write", label: "Edit users" },
+    { value: "webhooks", label: "Manage application webhooks" }
+  ],
+  setup: { url: "https://x-series-api.lightspeedhq.com/docs/authorization", steps: [
+    "Open developers.retail.lightspeed.app and register a developer account; your retail-store login is separate. Open Applications > Create and register this application's exact Suggested callback URL as its redirect URI.",
+    "Copy Client ID here and Save configuration. Choose Set credential in Env to store Client Secret under the displayed reference. Choose Set callback in Env and save the exact registered URL. Your application backend must implement that callback.",
+    "From https://your-store.retail.lightspeed.app, enter only your-store in Domain prefix. This slot connects that store; a callback from another store cannot change the credential destination. Use a separate configuration slot for another store.",
+    "Keep products:read for verification and select only the other permissions your application needs. Extra permissions do not add runtime operations. Save configuration, then Connect account for shared access. Each-user access connects from the generated application's account screen after its own login.",
+    "Approve the intended retailer in Lightspeed. Verification reads a product page without changing stock or customer data. If declined consent leaves the screen waiting, choose Cancel connection before trying again. Disconnect removes the local grant, not provider authorization.",
+    "Select inventory:read to read stock and sales:read for sales pages, then reconnect if permissions changed. Inventory returns flat rows with current_inventory_level and quantity_to_procure; the app must interpret those separately rather than treating procure quantity as negative stock. Use explicit version pages; no automatic stock sync is installed.",
+    "The app can build a low-stock or sales dashboard from these reads. Customer/product edits, stock adjustments, sale/payment writes, gift-card/store-credit workflows, webhook processing and editor-assistant attachment are not implemented here. Selecting an advanced write scope alone does not add those operations.",
+    "Unapproved registrations can connect up to 30 stores; production-ready public applications require Lightspeed approval. This connector is Retail X-Series only. R-Series, K-Series and personal-token setup are not supported here. Changing the callback, client or store can require reconnection."
+  ] }
+});
+export { lightspeedDefinition };

package/src/shared/linkedin.js

@@ -0,0 +1,27 @@
+const linkedinDefinition = Object.freeze({
+  id: "linkedin", name: "LinkedIn", description: "Connect a member's LinkedIn account to read their permitted profile information and publish approved text posts.",
+  accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  scopes: [
+    { value: "openid", label: "OpenID (required)", required: true, recommended: true },
+    { value: "profile", label: "Read basic profile (required)", required: true, recommended: true },
+    { value: "email", label: "Read primary email address" },
+    { value: "w_member_social", label: "Publish posts" }
+  ],
+  permissionsHint: "OpenID and profile are required for profile verification. Email is optional. Publish posts needs LinkedIn's Share on LinkedIn product; select it and reconnect before publishing text posts.",
+  setup: {
+    url: "https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2",
+    steps: [
+      "Open https://www.linkedin.com/developers/apps, choose My apps > Create app, and supply the application name, LinkedIn Page, privacy-policy URL and logo. Complete the requested Page-owner verification. This registration belongs to your application.",
+      "Open Products and request Sign In with LinkedIn using OpenID Connect. Wait until the product is available and Auth lists openid and profile. Email is optional. For text publishing, request Share on LinkedIn, wait until Auth lists w_member_social, select Publish posts here, save and reconnect.",
+      "In Auth > OAuth 2.0 settings > Authorized redirect URLs, add the exact Suggested callback URL shown here. Use an absolute HTTPS URL without query or fragment. Copy Client ID from Auth into this form. Your application backend must implement the callback route.",
+      "Save configuration, then choose Set credential in Env to store Client Secret as LINKEDIN_CLIENT_SECRET. Use Open Env to store the registered callback as LINKEDIN_CALLBACK_URL, or the alternate names you entered in the references. Return to this connection when both values are set.",
+      "For shared or assistant access, choose Connect account and authorize the intended LinkedIn member. For Each user, connection starts from the generated application's account screen after signing in. Verification reads the member's profile; it does not publish or create an application login. Email may be absent even when requested.",
+      "Your application must approve the exact post text and visibility (PUBLIC or CONNECTIONS) before posts.create. The adapter derives the author from the connected member; it cannot publish as an arbitrary person. A timeout may occur after a post was created: check LinkedIn before manually repeating it.",
+      "LIMITATIONS: text posts only, with no image/video upload, organization posts, scheduling, post editing/deletion or analytics. Example: publish an approved announcement, but not a photo campaign. Saving this connection does not attach LinkedIn tools to Vibe64 coding chat.",
+      "Reconnect repeats consent. Ordinary access expiry requires connecting again unless LinkedIn has enabled programmatic refresh for your registration and supplied a refresh token. Disconnect removes the local grant; remove provider access separately through LinkedIn's permitted-services settings. A new app registration or callback may require consent again."
+
+    ]
+  }
+});
+
+export { linkedinDefinition };

package/src/shared/logo-dev.js

@@ -0,0 +1,21 @@
+const logoDevDefinition = Object.freeze({
+  id: "logo-dev", name: "Logo.dev", description: "Display company logos using a publishable image-service key.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  runtimeKind: "public-resource", configurationOnly: true,
+  apiKeyReferenceLabel: "Publishable key reference",
+  apiKeyReferenceHint: "Reference a pk_ key. Your application publishes its value in image URLs. A private sk_ key cannot be used for this image flow.",
+  setup: {
+    url: "https://www.logo.dev/docs/platform/api-keys",
+    steps: [
+      "Sign into https://www.logo.dev/dashboard/api-keys and copy the publishable key beginning pk_. Do not copy the private sk_ key: this integration displays images, and its pk_ value will be visible in the published application's image URLs.",
+      "Enter env:LOGO_DEV_PUBLISHABLE_KEY in Publishable key reference, then Save configuration. Choose Set credential in Env and store the actual pk_ value as LOGO_DEV_PUBLISHABLE_KEY. Return after saving Env. Your application must resolve this reference and expose only this publishable value to its image code.",
+      "In Logo.dev API Keys, enable Allowed Domains Only, enter allowed domains one per line, then Save Changes. Include the application's actual hosting/custom domain and intended preview domains. example.com matches that domain; *.example.com matches its subdomains. Add localhost explicitly if needed for local development.",
+      "Before enabling restrictions, ensure image requests send an origin referrer. Use referrerpolicy=origin on the image or an equivalent application policy; no-referrer and same-origin policies block cross-site referrers. Unlisted domains or missing referrers cause image failures.",
+      "Application image code can look up a domain, stock ticker such as AAPL or SHEL.L, or an email domain. Email lookup strips the part before @ locally; it displays the company logo, not a personal avatar. Supply exactly one lookup value and use meaningful alternative text and a missing-image fallback.",
+      "LIMITATIONS: no brand search, private enrichment API, crypto or ISIN lookup in this helper. Example: a gmail.com address resolves the email provider logo, not the person's business. Your app must add any attribution required by your provider plan; saving does not add an attribution badge.",
+      "This setup creates image configuration, not an OAuth grant. The application's image load/error events report delivery; saving cannot verify the key. A missing logo may return a monogram unless the application selects the 404 fallback. To rotate keys, contact Logo.dev support, then replace the Env value."
+
+    ]
+  }
+});
+export { logoDevDefinition };

package/src/shared/mapbox.js

@@ -0,0 +1,38 @@
+import { createSchema } from "json-rest-schema";
+import { secretReference } from "@jskit-ai/connectors-core/shared/configuration";
+
+const mapboxDefinition = Object.freeze({
+  id: "mapbox", name: "Mapbox", description: "Validate a backend access token and look up places or coordinates.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key", "none"], scopes: [],
+  authenticationMethodsForSettings: settings => settings?.usage === "browser" ? ["none"] : ["api-key"],
+  configurationOnlyForSettings: settings => settings?.usage === "browser",
+  apiKeyReferenceLabel: "Backend access token reference",
+  apiKeyReferenceHint: "Use a reference to a token for backend requests. It may be a public (pk.) or secret (sk.) token; browser URL restrictions can block backend geocoding.",
+  settingsSchema: settings => createSchema({
+    usage: { type: "string", enum: ["backend", "browser"], defaultTo: "backend" },
+    publicTokenRef: { ...secretReference, required: settings?.usage === "browser" }
+  }),
+  settingsFields: [{ name: "usage", label: "Mapbox usage", credentialScope: value => value,
+    items: [{ title: "Backend geocoding and optional browser maps", value: "backend" }, { title: "Browser maps only", value: "browser" }] }, { name: "publicTokenRef", environmentCredential: { label: "Public browser token", public: true }, label: "Public browser token reference", placeholder: "env:MAPBOX_PUBLIC_TOKEN",
+    hint: "Required for browser-only mode; optional with backend geocoding. Separate pk. token for Mapbox in your browser. The application may publish this value; backend verification does not verify its restrictions." }],
+  setup: {
+    url: "https://docs.mapbox.com/accounts/guides/tokens/",
+    stepsForSettings(settings) { return settings?.usage === "browser" ? [
+      "In Mapbox Developer Console > Access Tokens > Create a token, create a public pk. token with styles:read and fonts:read for your map. Never use a secret sk. token in browser code.",
+      "Choose Browser maps only here, enter env:MAPBOX_PUBLIC_TOKEN in Public browser token reference and Save configuration. Store that pk. value in project Env. Your app deliberately exposes only this public token to its map SDK. No backend token, account verification or OAuth callback is needed.",
+      "Restrict the token to the actual app hosting/custom and preview URLs. Include localhost only for development. Default public tokens cannot be URL-restricted; create a new token. Wildcards and missing Referer headers do not work with these restrictions.",
+      "Use the framework's Mapbox GL JS integration, import its CSS, give the map container a height and preserve attribution. Set accessToken from this public Env binding; handle SDK errors and call map.remove when the view closes. Saving configuration does not install the SDK or test the token's domain restrictions.",
+      "LIMITATIONS: no map editor, turn-by-turn navigation UI, offline tiles or automatic SDK installation. Example: your app can display a map using its native SDK, but saving this form does not create a map page. Rotate the token in Mapbox and update/redeploy the public configuration."
+    ] : this.steps; },
+    steps: [
+      "Sign into Mapbox Developer Console → Access Tokens → Create a token. Name it for this application and environment. Select only the scopes your APIs need; geocoding can use a public pk. token. Copy a secret sk. token immediately: it is shown only once.",
+      "For backend geocoding, enter env:MAPBOX_BACKEND_TOKEN in Backend access token reference. Use a token without browser URL restrictions: backend requests have no browser referrer. Never publish a secret sk. token in browser code.",
+      "For browser maps, create a separate public pk. token with the SDK’s map scopes, including styles:read and fonts:read. Enter env:MAPBOX_PUBLIC_TOKEN in Public browser token reference. The application must deliberately load this public value; this connector does not render a map.",
+      "Restrict the browser token to the deployed application URLs, adding preview, custom domains and localhost when needed. Create a new token rather than using the default public token, which cannot be URL-restricted. Wildcards are unsupported; blocking the Referer header can cause 403 errors.",
+      "Save configuration, then use Set credential in Env for MAPBOX_BACKEND_TOKEN and Open Env for MAPBOX_PUBLIC_TOKEN if supplied. Store token values there, not in reference fields. Connect account verifies only the backend token’s validity; it does not test geocoding entitlement or the optional browser token. No OAuth app or callback URL is needed.",
+      "For routes, directions.get accepts driving, driving-traffic, walking or cycling with 2–25 longitude/latitude waypoints. It returns GeoJSON, metres and seconds. Handle NoRoute/NoSegment as unavailable routes and draw successful geometry using your app's native map SDK. No map editor, offline tiles, navigation UI or automatic SDK installation is included.",
+      "To rotate, create a replacement token, update its Env value and verify again before deleting the old token in Mapbox. Update and redeploy browser configuration when its public token changes. Disconnect removes the local connection; it does not delete either Mapbox token."
+    ]
+  }
+});
+export { mapboxDefinition };

package/src/shared/mcp.js

@@ -0,0 +1,92 @@
+import { createSchema } from "json-rest-schema";
+
+function validN8nServerUrl(value) {
+  if (!/^https:\/\//iu.test(value) || /[\s\\?#]/u.test(value) || /\/(?:\.|%2e){1,2}(?:\/|$)/iu.test(value)) return false;
+  try {
+    const url = new URL(value);
+    return !url.username && !url.password && url.pathname.endsWith("/mcp-server/http");
+  } catch { return false; }
+}
+
+function validN8nOAuthDiscovery(value) {
+  try {
+    if (!validN8nServerUrl(value.resource)) return false;
+    const metadata = value.oauth;
+    const issuer = new URL(metadata.issuer);
+    if (issuer.protocol !== "https:" || issuer.username || issuer.password || issuer.search || issuer.hash) return false;
+    const base = issuer.href.replace(/\/$/u, "");
+    const includes = (values, item) => Array.isArray(values) && values.includes(item);
+    return metadata.authorization_endpoint === `${base}/mcp-oauth/authorize` &&
+      metadata.token_endpoint === `${base}/mcp-oauth/token` && metadata.registration_endpoint === `${base}/mcp-oauth/register` &&
+      includes(metadata.response_types_supported, "code") && includes(metadata.grant_types_supported, "authorization_code") &&
+      includes(metadata.grant_types_supported, "refresh_token") && includes(metadata.token_endpoint_auth_methods_supported, "client_secret_post") &&
+      includes(metadata.code_challenge_methods_supported, "S256") && Array.isArray(value.scopes) && value.scopes.length > 0 &&
+      new Set(value.scopes).size === value.scopes.length && value.scopes.every((scope) =>
+        typeof scope === "string" && /^[\x21\x23-\x5B\x5D-\x7E]{1,200}$/u.test(scope) && includes(metadata.scopes_supported, scope));
+  } catch { return false; }
+}
+
+const n8nDefinition = Object.freeze({
+  id: "n8n", name: "n8n", description: "Discover and use your n8n instance's MCP tools from an assistant.",
+  accountModes: ["assistant"], authenticationMethods: ["api-key"], scopes: [],
+  authenticationMethodsForSettings: (settings) => settings.oauthDiscovery ? ["oauth2", "api-key"] : ["api-key"],
+  scopesForSettings: (settings) => (settings.oauthDiscovery?.scopes || []).map((value) => ({ value, label: value })),
+  apiKeyReferenceLabel: "MCP access token reference",
+  apiKeyReferenceHint: "Use the personal token from Instance-level MCP, not an n8n REST API key. The assistant host must authorize individual tool calls.",
+  settingsSchema: createSchema({ serverUrl: { type: "string", required: true, minLength: 1, maxLength: 2048,
+    validator: (value) => validN8nServerUrl(value) || "Use the HTTPS MCP server URL ending /mcp-server/http, without credentials, query or fragment." },
+    oauthDiscovery: { type: "object", additionalProperties: true,
+      validator: (value) => validN8nOAuthDiscovery(value) || "Discover a supported n8n OAuth authority and permissions before connecting." }
+  }),
+  settingsFields: [{ name: "serverUrl", label: "Server URL", placeholder: "https://automation.example.com/mcp-server/http",
+    hint: "Copy the full Server URL from n8n's MCP connection details. Keep any reverse-proxy subdirectory." }],
+  setup: {
+    url: "https://docs.n8n.io/connect/connect-to-n8n-mcp-server",
+    clientRegistrationEndpoint: (settings) => settings.oauthDiscovery?.resource === settings.serverUrl
+      ? settings.oauthDiscovery.oauth.registration_endpoint : undefined,
+    stepsByAuthentication: { oauth2: [
+      "LIMITATIONS: Automatic Vibe64 coding-chat attachment is deferred. A separately wired CLI or assistant host can discover and invoke exposed workflows through MCP after approving the exact tool and arguments; connecting alone does not attach chat tools. This connector is not the n8n REST API or a workflow designer.",
+      "In n8n, open Settings → Instance-level MCP and enable access as an instance owner or admin. Copy its full Server URL. In this editor, Discover OAuth settings reads the instance's public authority and permissions. CLI users can call discoverN8nOAuth. A server without advertised OAuth permissions is not supported by this path; use its personal API key method instead.",
+      "Select OAuth and the smallest set of advertised permissions your application needs. Keep Assistant access. Enter the Suggested callback URL your application will actually serve; use the application address, not the editor dashboard. If n8n restricts Allowed callback URLs, ask its owner/admin to allow that exact URL before registration.",
+      "In this editor, choose Register client and connect. This saves the client ID in configuration and the secret, callback and recovery client ID in development Env, then starts your application’s consent flow. It requires unused Env keys and an application-owned callback/setup command. Alternatively, use OAuth client registration below to send the displayed JSON in one POST with Content-Type: application/json, or call registerN8nClient from the CLI. A timeout may still have created a client; investigate before repeating registration.",
+      "For manual registration only, copy client_id from the successful response into Client ID. Keep client_secret private and note any expiry. Keep env:N8N_CLIENT_SECRET and env:N8N_CALLBACK_URL (or this slot's displayed names) as references. Save configuration, use Set credential in Env for the secret, and Set callback in Env for the exact registered callback. Do not paste the complete registration response into configuration or chat.",
+      "Return and click Connect account. Sign into the intended n8n account, review the requested permissions and approve access. Your application's callback completes consent. Verification initializes MCP and lists tools; it does not run a workflow. A successful client registration alone does not connect an account.",
+      "In Instance-level MCP → Workflows exposed, choose Enable workflows, select the intended workflow and Enable. The account must have access. Search can reveal previews of other workflows visible to that account; exposure is not isolated per client. The assistant host must authorize each tool and its exact arguments.",
+      "Use Reconnect for fresh consent. Disconnect here removes the local grant. Review and remove provider access separately in n8n's Instance-level MCP → Connected clients. Changing the Server URL requires discovery again; a new callback or client registration may also require fresh consent. Your application owns tokens and refresh outside the editor."
+    ] },
+    steps: [
+      "LIMITATIONS: Automatic Vibe64 coding-chat attachment is deferred. A separately wired CLI or assistant host can discover and invoke exposed workflows through MCP after approving the exact tool and arguments; connecting alone does not attach chat tools. This connector is not the n8n REST API or a workflow designer.",
+      "In n8n, open Settings → Instance-level MCP. An instance owner or admin selects Enable MCP access. This setup uses the personal-token method; n8n's OAuth tab is a different connection path.",
+      "Under Connection details, select Connect → API key. On first opening, n8n generates a personal token for your account. Copy the Server URL and token now: after leaving, the token is redacted. Older versions call this tab Access Token. Do not use a REST API key or a workflow's MCP Server Trigger URL.",
+      "Paste the full HTTPS Server URL ending /mcp-server/http here, keeping any installation subdirectory or port. Keep env:N8N_API_KEY as the token reference. Save configuration, then select Set credential in Env to store the token value. No OAuth app ID or callback is needed for this token method.",
+      "Under Instance-level MCP → Workflows exposed, select Enable workflows, find the intended workflow and Enable. Alternatively open the workflow's top-right menu → Settings → Available in MCP. Check that the workflow is eligible and that the token owner has access. Search tools may reveal previews of other workflows this user can view; exposure is not isolated per client.",
+      "Click Connect account after Env is configured. Verification initializes MCP and lists tools without running a workflow. The assistant host must approve each tool and its exact arguments; discovery alone does not establish permission to execute every workflow or attach tools to chat.",
+      "To replace a lost token, return to Connection details → Connect → API key and generate a new token beside the redacted value. This revokes the old token: update Env for every client using it, then reconnect. Disconnect here removes local grants and does not revoke the n8n token."
+
+    ]
+  }
+});
+
+const sanityDefinition = Object.freeze({
+  id: "sanity", name: "Sanity", description: "Discover and use Sanity's hosted MCP tools from an assistant.",
+  accountModes: ["assistant"], authenticationMethods: ["oauth2", "api-key"],
+  scopes: [{ value: "global", label: "Sanity MCP account access", recommended: true }],
+  apiKeyReferenceLabel: "MCP API token reference",
+  apiKeyReferenceHint: "Store a Sanity token in Env. Its role controls tool access at https://mcp.sanity.io; the assistant host must authorize individual calls.",
+  setup: {
+    url: "https://www.sanity.io/docs/ai/mcp-server",
+    clientRegistrationEndpoint: "https://mcp.sanity.io/register",
+    steps: [
+      "Choose OAuth for Sanity account consent, or API key for a project-scoped token. This is builder/assistant context, not generated-app login. The editor coding-assistant attachment is deferred; saving alone does not make those tools available in chat.",
+      "For OAuth, use the exact Suggested callback URL served by your backend. Click Register client and connect to create your client and save its credentials in development Env. For manual setup, POST the shown OAuth client registration JSON once to https://mcp.sanity.io/register, or use registerSanityClient from a CLI, then save client_id and the secret reference. Register only callbacks your backend serves.",
+      "Save the client and callback references, set their values in Env, then connect and approve Sanity account access. The global scope is the provider's MCP scope, not a per-dataset permission selector. Authorize specific project, dataset and tool arguments in your assistant host.",
+      "For API key authentication instead, select API key in Authentication. Open sanity.io/manage, select the intended project, then Settings, API, Tokens and Add new token.",
+      "Give the token a distinct name, choose the smallest role the intended tools need and set an expiry if appropriate. Copy the token once shown.",
+      "Store the token in Env and enter its reference here. The runtime uses Sanity's fixed HTTPS MCP endpoint.",
+      "A project token cannot grant account-wide administration. Choose token ownership for the actual tools; successful discovery does not prove every tool is allowed.",
+      "Save configuration. Connecting will check tool discovery; each tool call still needs the assistant's permission."
+    ]
+  }
+});
+
+export { n8nDefinition, sanityDefinition, validN8nOAuthDiscovery };

package/src/shared/microsoft-fabric.js

@@ -0,0 +1,47 @@
+import { createSchema } from "json-rest-schema";
+
+const delegatedScope = "https://analysis.windows.net/powerbi/api/GraphQLApi.Execute.All";
+const serviceScope = "https://api.fabric.microsoft.com/.default";
+const guid = "[a-fA-F0-9]{8}-(?:[a-fA-F0-9]{4}-){3}[a-fA-F0-9]{12}";
+const guidPattern = new RegExp(`^${guid}$`, "u");
+const endpointPattern = new RegExp(`^https://api\\.fabric\\.microsoft\\.com/v1/workspaces/${guid}/(?:graphqlapis|graphQLApis|GraphQLApis)/${guid}/graphql$`, "u");
+const scopes = [
+  { value: delegatedScope, label: "Execute GraphQL queries and mutations as the user", recommended: true },
+  { value: "offline_access", label: "Keep user access between visits", recommended: true },
+  { value: serviceScope, label: "Use the service account's Fabric permissions", recommended: true }
+];
+
+const microsoftFabricDefinition = Object.freeze({
+  id: "microsoft-fabric", name: "Microsoft Fabric", categories: ["Microsoft", "Productivity"],
+  description: "Access one Fabric GraphQL API using user consent or a service principal.",
+  accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  oauthGrantTypes: ["authorization_code", "client_credentials"], oauthClientAuthenticationMethods: ["client_secret_post"],
+  validateClientId: (value) => guidPattern.test(value) || "Enter the Application (client) ID as a GUID.",
+  oauthGrantHint: "User consent needs a Web callback and delegated GraphQL permission. Service account needs a service principal with Fabric access, without a callback.",
+  settingsSchema: createSchema({
+    tenantId: { type: "string", required: true, maxLength: 36,
+      validator: (value) => guidPattern.test(value) || "Enter the Directory (tenant) ID as a GUID, not common or a client ID." },
+    graphqlEndpoint: { type: "string", required: true, maxLength: 256,
+      validator: (value) => endpointPattern.test(value) || "Copy the Fabric GraphQL API endpoint with workspace and API IDs, without a query string or fragment." }
+  }),
+  settingsFields: [
+    { name: "tenantId", label: "Microsoft Entra Tenant ID", placeholder: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", hint: "The directory containing the Fabric resource and permitted users or service principal." },
+    { name: "graphqlEndpoint", label: "Fabric GraphQL Endpoint", placeholder: "https://api.fabric.microsoft.com/v1/workspaces/<workspace-id>/graphqlapis/<api-id>/graphql",
+      hint: "Open your API for GraphQL in Fabric and select Copy endpoint. Custom proxies and sovereign-cloud addresses are not supported by this fragment." }
+  ],
+  scopes, scopesForGrantType: (grantType) => scopes.filter((scope) => grantType === "client_credentials" ? scope.value === serviceScope : scope.value !== serviceScope),
+  permissionsHint: "Fabric Execute access permits queries and mutations. Your application must authorize the documents it executes. Data-source access is separate; this does not sign users into your application.",
+  setup: { url: "https://learn.microsoft.com/en-us/fabric/data-engineering/connect-apps-api-graphql", steps: [
+    "You need an existing Fabric API for GraphQL and permission to register an application in its Microsoft Entra directory. In Entra admin center → Entra ID → App registrations → New registration, name the app, choose the intended directory audience and Register. Copy Application (client) ID and Directory (tenant) ID from Overview into their separate fields; use the tenant GUID, not common.",
+    "Open Certificates & secrets → Client secrets → New client secret. Add a description and expiry, then Add. Copy Value immediately, not Secret ID. Keep env:MICROSOFT_FABRIC_CLIENT_SECRET as the secret reference; store the secret value in Env after saving.",
+    "For User consent, open Authentication → Redirect URI configuration → Add Redirect URI → Web, paste this project's exact Suggested callback URL and Configure. Under API permissions → Add a permission → Power BI Service → Delegated permissions, select GraphQLApi.Execute.All. Allow offline access for refresh and complete any administrator consent required by the directory.",
+    "For Service account, no callback or delegated permission is needed. A Fabric tenant administrator opens Admin portal → Tenant settings → Developer settings, enables Service principals can use Fabric APIs and selects Apply. In the API item's … → Manage permissions → Add user, find the app registration, select Run Queries and Mutations and Grant.",
+    "Open the existing API for GraphQL and select Copy endpoint. Paste the complete URL into Fabric GraphQL Endpoint. The signed-in user or service principal needs API Execute access; the caller or saved connection also needs underlying data-source permissions. These are separate grants.",
+    "Save configuration, then use Set credential in Env for the secret. User consent also needs Open Env to store the exact registered URL as MICROSOFT_FABRIC_CALLBACK_URL. Connect account uses the selected shared identity; per-user connections happen inside the generated app. Service account connects without a browser consent window.",
+    "Use graphql.execute with an app-approved query, JSON variables and optional operationName. It accepts mutations too: authorize the exact document and inputs on your backend. Partial GraphQL errors fail the call and may follow a successful change; inspect data before retrying.",
+    "LIMITATIONS: no automatic table browser, schema-specific client, pagination, subscriptions or Vibe64 assistant attachment. Example: query your inventory with its actual schema, but do not expect a generated inventory dashboard or an unrestricted query console.",
+    "Verification reads only the root type name; it does not test your business queries or mutate data. For optional schema discovery, a workspace administrator enables Introspection in the API settings. Rotate expiring secrets in Env before deleting old ones. Disconnect removes local access, not Fabric permissions or Microsoft consent."
+  ] }
+});
+
+export { microsoftFabricDefinition, delegatedScope, serviceScope };