@jskit-ai/connectors-catalog 0.1.1

package/src/shared/twilio.js

@@ -0,0 +1,41 @@
+import { createSchema } from "json-rest-schema";
+import { secretReference } from "@jskit-ai/connectors-core/shared/configuration";
+
+const twilioDefinition = Object.freeze({
+  id: "twilio", name: "Twilio", description: "Send SMS, initiate calls and read delivery/call status for the selected account and region.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  apiKeyReferenceLabel: "API key secret reference",
+  settingsSchema: createSchema({
+    authTokenRef: { ...secretReference, required: false },
+    region: { type: "string", enum: ["us1", "ie1", "au1"], defaultTo: "us1" },
+    accountSid: { type: "string", required: true, minLength: 34, maxLength: 34,
+      validator: (value) => /^AC[0-9a-fA-F]{32}$/u.test(value) || "Enter an Account SID starting with AC followed by 32 hexadecimal characters." },
+    apiKeySid: { type: "string", required: true, minLength: 34, maxLength: 34,
+      validator: (value) => /^SK[0-9a-fA-F]{32}$/u.test(value) || "Enter an API Key SID starting with SK followed by 32 hexadecimal characters." }
+  }),
+  settingsFields: [
+    { name: "authTokenRef", label: "Callback Auth Token reference (optional)", placeholder: "env:TWILIO_AUTH_TOKEN", hint: "For inbound messages, voice and delivery callbacks. Copy the account Auth Token from Twilio Console into private Env; this is NOT the API key secret." },
+    { name: "region", label: "Region", hint: "Choose the region where this API key was created.", items: [
+      { value: "us1", title: "United States (US1)" }, { value: "ie1", title: "Ireland (IE1)" }, { value: "au1", title: "Australia (AU1)" }
+    ] },
+    { name: "accountSid", label: "Account SID", placeholder: "AC followed by 32 hexadecimal characters", hint: "Copy the SID of the account or subaccount whose calls this app may read." },
+    { name: "apiKeySid", label: "Standard API Key SID", placeholder: "SK followed by 32 hexadecimal characters", hint: "Copy the API Key SID for this account and region. Store its secret separately." }
+  ],
+  setup: {
+    url: "https://www.twilio.com/docs/iam/api-keys/keys-in-console",
+    steps: [
+      "Select the intended account or subaccount in Twilio Console and copy its Account SID from the account dashboard.",
+      "Open Settings, Account settings, API keys & auth tokens. Choose the region, then Create API key.",
+      "Name the key, select Standard, and click Next. Copy its API Key SID into this form and store its secret in Env.",
+      "Enter the secret's reference, select Got it! in Twilio, and finish key creation. Regional keys must match the region selected here.",
+      "Save the configuration. The application runtime verifies access by reading call records without placing calls or sending messages.",
+      "For sending, open Phone Numbers, Manage, Active numbers and select a number with SMS or Voice capability for your account. Alternatively, under Messaging, Services select your Messaging Service and configure its Sender Pool. The application chooses the authorized sender when sending.",
+      "Trial accounts can contact only permitted verified recipients. Complete the sender registration and geographic permissions required for your destination, and check the product is available in your chosen region. Separate regional keys are not interchangeable.",
+      "For incoming messages or calls, open the selected phone number's configuration. Set A message comes in or A call comes in to Webhook, enter the application's public HTTPS handler URL, choose HTTP POST, then save. For a Messaging Service, configure incoming-message handling in its Integration section.",
+      "For callbacks, reveal the account Auth Token on the Console account dashboard and put it in private Env as TWILIO_AUTH_TOKEN. Enter env:TWILIO_AUTH_TOKEN above. It is different from the Standard API key secret. Your app must verify X-Twilio-Signature using the exact public callback URL before processing any incoming data.",
+      "The generated app supplies StatusCallback for delivery or call completion and serves TwiML XML for inbound messages and call control. Changing your app's public domain requires updating these Twilio URLs. Callback signatures do not expire: the app must deduplicate events and prevent stale status updates.",
+      "Disconnect removes only local connection state. To revoke the sending credential, delete the API key in Twilio. Remove or change webhook URLs separately; they remain configured at Twilio."
+    ]
+  }
+});
+export { twilioDefinition };

package/src/shared/twitch.js

@@ -0,0 +1,49 @@
+const twitchDefinition = Object.freeze({
+  id: "twitch", name: "Twitch", description: "Connect Twitch accounts for stream discovery, chat, channel management, rewards, schedules and analytics.",
+  accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  scopes: [
+    { value: "user:read:email", label: "Read your email address", recommended: true },
+    { value: "channel:read:subscriptions", label: "Read your channel subscriptions" },
+    { value: "moderator:read:followers", label: "Read followers for your channels" },
+    { value: "user:write:chat", label: "Send chat messages" },
+    { value: "user:read:follows", label: "Read the channels you follow", recommended: true },
+    { value: "user:read:subscriptions", label: "Check your subscription status" },
+    { value: "channel:read:vips", label: "Read VIPs for your channels" },
+    { value: "channel:read:editors", label: "Read channel editors" },
+    { value: "channel:read:polls", label: "Read channel polls" },
+    { value: "channel:read:predictions", label: "Read channel predictions" },
+    { value: "channel:read:redemptions", label: "Read channel point rewards and redemptions" },
+    { value: "channel:read:hype_train", label: "Read current hype train status" },
+    { value: "analytics:read:extensions", label: "Read extension analytics" },
+    { value: "analytics:read:games", label: "Read game analytics" },
+    { value: "bits:read", label: "Read Bits information" },
+    { value: "moderator:read:chatters", label: "Read chatters in a channel" },
+    { value: "moderation:read", label: "Read moderation data" },
+    { value: "clips:edit", label: "Create clips" },
+    { value: "channel:manage:broadcast", label: "Manage channel broadcast settings" },
+    { value: "channel:manage:schedule", label: "Manage channel schedule" },
+    { value: "channel:manage:polls", label: "Create and manage channel polls" },
+    { value: "channel:manage:predictions", label: "Create and manage channel predictions" },
+    { value: "channel:manage:redemptions", label: "Manage channel point rewards and redemptions" }
+  ],
+  setup: {
+    url: "https://dev.twitch.tv/docs/authentication/register-app/",
+    steps: [
+      "Sign in to dev.twitch.tv/console with the account that will own the registration. Verify its email and enable two-factor authentication in Twitch Settings → Security and Privacy, then open Applications.",
+      "Choose Register Your Application. Enter a unique name, add the exact callback URL shown for this project under OAuth Redirect URLs, choose the category and Confidential client type, complete any human verification, then choose Create.",
+      "Use a separate Twitch registration for each independent application. An editor's client ID cannot automatically serve every app it creates.",
+      "Open Manage for that application. Copy Client ID into this registration. Choose New Secret and save its value in the private Env variable referenced by Client Secret. A new secret invalidates the previous one; coordinate rotation before reconnecting.",
+      "Keep the full callback URL in project Env and register the identical URL with Twitch. The generated app must serve that callback. After a domain change, update both places before connecting again.",
+      "Select only the permissions your app needs. Profile email requires Read your email address; followed-channel reads require Read the channels you follow.",
+      "Enable Send chat messages for outgoing chat; select the relevant Manage permission for broadcast settings, schedules, polls, predictions or rewards. Read permissions alone do not permit changes. Reconnect the account after adding permissions so the person can approve them.",
+      "Twitch controls eligibility: some subscriptions, polls, predictions, rewards and non-recurring schedules require an eligible broadcaster. Analytics report only on games or extensions owned by the consenting account; an empty result can be valid.",
+      "Rewards and redemptions remain tied to the Twitch application that created them. Replacing the Client ID does not transfer their management rights. Review recurring schedule changes carefully: updates or deletion can affect the whole series.",
+      "Choose a shared connection for this project's common broadcaster, or individual connections so each app user consents to their own account. Saving the registration does not connect an account or sign users into your app.",
+      "For live notifications, the generated app must maintain a Twitch EventSub WebSocket and subscribe using its welcome session ID. The app handles reconnection and duplicate events. This connector does not provide an editor-hosted event service or webhook transport.",
+      "Wire token validation at application startup and at least hourly for maintained connections, including idle ones. The runtime also validates before every data call. Saving configuration does not start this task.",
+      "Disconnect removes this app's stored connection. To revoke provider access, open Twitch Settings → Connections and disconnect the application there. A revoked grant needs consent again; keep Client Secrets and report download links out of public source and logs."
+    ]
+  }
+});
+
+export { twitchDefinition };

package/src/shared/wave.js

@@ -0,0 +1,52 @@
+const waveDefinition = Object.freeze({
+  id: "wave", name: "Wave", description: "Connect project-owned Wave accounts for customers, products, invoices, estimates and accounting workflows.",
+  accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  oauthClientAuthenticationMethods: ["client_secret_post"],
+  scopes: [
+    { value: "user:read", label: "Read the connected user's profile", recommended: true },
+    { value: "business:read", label: "Read businesses", recommended: true },
+    { value: "customer:read", label: "Read customers", recommended: true },
+    { value: "invoice:read", label: "Read invoices", recommended: true },
+    { value: "user:*", label: "Full user access" },
+    { value: "business:write", label: "Edit businesses" },
+    { value: "business:*", label: "Full business access" },
+    { value: "account:read", label: "Read accounting accounts" },
+    { value: "account:write", label: "Edit accounting accounts" },
+    { value: "account:*", label: "Full accounting account access" },
+    { value: "customer:write", label: "Edit customers" },
+    { value: "customer:*", label: "Full customer access" },
+    { value: "estimate:read", label: "Read estimates" },
+    { value: "estimate:write", label: "Edit estimates" },
+    { value: "estimate:send", label: "Send estimates" },
+    { value: "estimate:*", label: "Full estimate access" },
+    { value: "invoice:write", label: "Edit invoices" },
+    { value: "invoice:send", label: "Send invoices" },
+    { value: "invoice:*", label: "Full invoice access" },
+    { value: "product:read", label: "Read products and services" },
+    { value: "product:write", label: "Edit products and services" },
+    { value: "product:*", label: "Full product and service access" },
+    { value: "sales_tax:read", label: "Read sales taxes" },
+    { value: "sales_tax:write", label: "Edit sales taxes" },
+    { value: "sales_tax:*", label: "Full sales tax access" },
+    { value: "transaction:write", label: "Create money transactions" },
+    { value: "transaction:*", label: "Full transaction access" },
+    { value: "vendor:read", label: "Read vendors" },
+    { value: "vendor:write", label: "Edit vendors" },
+    { value: "vendor:*", label: "Full vendor access" },
+    { value: "checkout:read", label: "Read checkouts" },
+    { value: "checkout:*", label: "Full checkout access" }
+  ],
+  setup: { url: "https://developer.waveapps.com/hc/en-us/articles/50682251860884-2-Create-an-application", steps: [
+    "Sign in to Wave, open Manage applications in the developer portal, and choose Create New Application. Enter your application name and its backend Redirect URI, then save the application.",
+    "Use this project's deployed application URL as the callback origin, followed by the callback route implemented by its backend. Register that exact URL in Wave; do not use the Vibe64 editor address.",
+    "Copy the issued Client ID into Client ID. Put the issued Client Secret in the project's Env, then enter its env:VARIABLE reference in Client secret reference. A personal access token is not a Client Secret.",
+    "Put the same registered callback URL in the project's Env and enter its env:VARIABLE reference in Callback URL reference. The backend must serve that route and use the same callback during token refresh.",
+    "Wave OAuth access requires an active Pro or Wave Advisor business subscription. Integrations for other Wave users require Wave approval.",
+    "Keep profile and business read access for connection verification and business selection. Enable read permissions for records you use; add write permissions only for editing, and invoice/estimate send only when the app sends those documents. Write does not imply read.",
+    "Product writes that reference accounts or taxes need those read permissions too. Transaction creation needs transaction write and read access to its referenced accounts, customers and taxes. Wildcard permissions include the corresponding reads and writes.",
+    "Save the configuration, then use the project's Connect action to authorize the intended Wave account. Select and authorize a business from the returned list inside your app; connecting a profile does not sign someone into your app or select the first business automatically.",
+    "Reconnect after changing permissions, the Client ID or callback URL. When moving to a custom domain, update Wave's registered redirect and the project's callback Env value together. Keep the project's private token store when moving hosting.",
+    "Disconnect currently deletes the local connection. Remove the grant separately in Wave if you also want provider-side revocation. Vendor access is read-only in this runtime: the reviewed public API exposes no vendor create/update mutations. Extra scope choices do not add missing operations."
+  ] }
+});
+export { waveDefinition };

package/src/shared/wix.js

@@ -0,0 +1,40 @@
+import { createSchema } from "json-rest-schema";
+
+const wixDefinition = Object.freeze({
+  id: "wix", name: "Wix", description: "Use project-owned Wix account and site API access.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  settingsSchema: createSchema({ accountId: { type: "string", required: true, minLength: 36, maxLength: 36,
+    validator: (value) => /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/iu.test(value) || "Enter the Account ID from Wix's API Keys Manager." },
+    selectableSiteIds: { type: "string", maxLength: 4000, validator: value => {
+      const ids = value.split(",").map(id => id.trim());
+      return ids.length <= 100 && ids.every(id => /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/iu.test(id)) && new Set(ids.map(id => id.toLowerCase())).size === ids.length || "Enter up to 100 distinct Site IDs separated by commas.";
+    } },
+    siteId: { type: "string", minLength: 36, maxLength: 36, validator: value => /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/iu.test(value) || "Copy the Site ID from the Wix site dashboard URL." } }),
+  settingsFields: [{ name: "accountId", label: "Account ID", placeholder: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+    hint: "Copy your account's ID from the API Keys Manager. A site ID is a different setting." },
+    { name: "selectableSiteIds", label: "Selectable Site IDs", placeholder: "Site ID, Site ID", hint: "Optional. Comma-separated sites the app may explicitly select. The app must still authorize each user's site access. Leave empty for a fixed-site connection." },
+    { name: "siteId", label: "Site ID", placeholder: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", hint: "Required for site operations. Copy the ID after /dashboard/ in the intended Wix site dashboard URL." }],
+  setup: {
+    url: "https://dev.wix.com/docs/go-headless/authentication/admin/generate-an-api-key",
+    steps: [
+      "Sign into the intended Wix account as an owner or co-owner and open its API Keys Manager in account settings.",
+      "Generate an API key, give it a name and grant Read Site Data. Complete the requested account verification and copy the token into your backend Env.",
+      "Copy the Account ID from the same manager. Enter it here with the API key reference; never paste the token into source.",
+      "Save the configuration, supply the referenced key in the project backend Env, then choose Check connection and Connect account. Account verification queries sites; an empty list is valid and does not prove permissions for site operations. No OAuth app or callback URL is needed.",
+      "To rotate a key, create a replacement in Wix with the required permissions, update the referenced backend Env value, then Check connection and Reconnect. Verify the intended site operation before retiring the old key in Wix. Disconnect removes local application access; it does not revoke the Wix key.",
+      "For a multi-site app, list the account sites, then enter only approved IDs in Selectable Site IDs. The app may pass one of these as siteId on a site operation. Your backend must authorize the user's site choice before invoking it. Omitted siteId uses the fixed Site ID; requests cannot select an unlisted site. Changing the allowed sites requires verification again.",
+      "For CRM access, enter the intended Site ID from its dashboard URL (after /dashboard/) and grant Read Contacts, plus Manage Contacts for contact creation and updates. Restrict the key to the sites the project needs. Changing the site requires verification again.",
+      "For Wix-hosted checkout, edit the project’s API key in Wix Account Settings > API Keys: grant Write Carts V2 (PII) to create carts and Read Carts V2 (PII) to retrieve checkout URLs. Publish the Wix site and configure its payment methods. Your app owns customer/cart authorization and redirects to Wix; a checkout URL does not prove payment.",
+      "For booking services, enable Wix Bookings on the selected site and grant Read Bookings - Public Data; edits also need Manage Bookings. Fetch the current service revision before changing it. Service creation also needs explicit online-booking, capacity and payment settings. Your app can query categories and staff with Read Bookings - Public Data. Retrieve service variants before presenting price or duration choices; keep the option IDs and participant selections in your app. Retrieve add-on groups too, show their prompts and enforce their selection limits. Pass the selected duration/add-ons when checking appointment availability and the selected participant choices/add-ons when creating the booking. For appointments, select the returned staff resourceId (not staff id) and duration; select a service category to make it visible on the Wix site. Create class/course sessions separately.",
+      "For appointment and class availability, grant the Time Slots read permission (BOOKINGS.AVAILABILITY_READ_TIME_SLOTS). Your app must pass the intended time zone, let the customer choose a slot and recheck it before creating a booking; viewing a slot does not reserve it. For classes, filter by party size and recheck the selected eventInfo.eventId before booking. For appointments, recheck the selected resource and location; availability uses BUSINESS/CUSTOM where booking creation uses OWNER_BUSINESS/OWNER_CUSTOM.",
+      "For booking creation, grant Manage Bookings. Grant Get Form Summary (forms:v4:form:get_form_summary) for form discovery. Your app reads the service form ID, retrieves its fields, uses their exact targets, recheck capacity and handle the returned booking status. Creation is not payment or confirmation. Participant notifications and SMS reminders are opt-in in this connector.",
+      "Read bookings with the corresponding Read Bookings permission, or Manage Bookings for the administrative workflow. Query the exact booking to get its current revision and allowed actions before canceling. Cancellation requires Manage Bookings. Your app must authorize the action; choose participant notification explicitly. Waiving charges can cancel an eligible unpaid Wix order and is not a refund. For rescheduling, check the booking’s allowed actions and current revision, then select and recheck a new appointment slot or class event. Courses cannot be rescheduled. Booking policy overrides are not enabled. For a custom checkout, your app can explicitly confirm or decline with Manage Bookings; direct confirmation skips availability checks. With Wix eCommerce checkout, let Wix manage confirmation. Your app must verify payment status on its backend.",
+      "For CMS collection browsing, grant Manage Data Collections on the intended site. Your app lists collections and reads their field metadata; grant Read Data Items to browse collection content too. These browse operations do not change the schema or content. For content editing, add the permission identified as WIX_DATA.PATCH in Wix’s Patch Data Item documentation to the API key permissions. The app reads the item then explicitly patches selected fields; use a condition for conflicting edits and check the outcome before retrying. Collection IDs can include an app prefix such as AppName/CollectionName. Keep administrative collection metadata behind app authorization.",
+      "For business-location selection, grant Read Locations. Query locations for the configured Site ID to obtain booking location IDs, addresses and time zones. The app queries only authorized locations and excludes archived locations by default; selecting a location does not reserve a booking. To create or update locations, add Manage Locations to the key permissions. Updates replace the full writable location: read it first, retain every field you need and send its exact revision. Location business hours are not a Wix Bookings schedule.",
+      "For products, install Wix Stores on the intended site and grant Read v3 catalog (PII) for version discovery. The app must check whether the site uses V1_CATALOG or V3_CATALOG before selecting product APIs; these catalogues are not interchangeable. Grant Read Products for V1 or Read products in v3 catalog for V3. V1 name, visibility and base-price edits also require Manage Products; prices use the site currency, and this endpoint has no revision guard. V3 product lists omit variants; fetch the individual product for those details. To rename or change visibility in V3, also grant Product write in v3 catalog and pass the current product revision. A revision conflict requires re-reading and reviewing the change; do not automatically retry. Hiding a product without options also hides its default variant.",
+      "For commerce order reads, grant Read Orders on the selected site. Your app must authorize each customer's order access. Order search omits PENDING and REJECTED unless requested explicitly, and never lists INITIALIZED orders; retrieve those by known order ID. Use orderFulfillments.list with the authorized order ID to read shipped quantities and tracking details; an empty list means no recorded fulfillments. To create shipments or update tracking, grant Manage Orders. Select explicit order line-item quantities; creation requires an APPROVED order. Wix may send shipping emails according to site settings. Inspect existing fulfillments before repeating any uncertain write. Fulfillment handling status is distinct from order payment status. Reading an order does not collect payment.",
+      "This account credential is for backend administrative operations. It does not connect each app user's Wix account or implement application login."
+    ]
+  }
+});
+export { wixDefinition };

package/src/shared/wiz.js

@@ -0,0 +1,41 @@
+import { createSchema } from "json-rest-schema";
+
+const wizDefinition = Object.freeze({
+  id: "wiz", name: "Wiz", description: "Scan project source with your Wiz security policies.",
+  accountModes: ["shared"], authenticationMethods: ["oauth2"], scopes: [],
+  oauthGrantTypes: ["client_credentials"], oauthClientAuthenticationMethods: ["client_secret_post"],
+  validateClientId: (value) => !/[\s\p{Cc}]/u.test(value) || "Use the Wiz service-account Client ID without whitespace or control characters.",
+  authenticationLabels: { oauth2: "Wiz service account" },
+  authenticationHint: "A source scanner uses your workspace's service account. It does not sign app users in. The installed Wiz CLI performs authentication when a scan runs.",
+  settingsSchema: createSchema({
+    tokenUrl: { type: "string", enum: ["https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token"],
+      defaultTo: "https://auth.app.wiz.io/oauth/token" },
+    policies: { type: "string", maxLength: 4096, noTrim: true,
+      validator: (value) => (value.split(",").length <= 50 && value.split(",").every((item) => item.trim().length > 0 && item.trim().length <= 200) && !/\p{Cc}/u.test(value)) ||
+        "Use up to 50 comma-separated policy names, without empty names or control characters." },
+    byPolicyHits: { type: "string", enum: ["BLOCK", "AUDIT", "DISABLED"], defaultTo: "BLOCK" }
+  }),
+  settingsFields: [
+    { name: "tokenUrl", label: "Token URL", items: [
+      { value: "https://auth.app.wiz.io/oauth/token", title: "Cognito (auth.app.wiz.io)" },
+      { value: "https://auth.wiz.io/oauth/token", title: "Auth0 (auth.wiz.io)" }
+    ], hint: "The current Wiz v1 runner supports Cognito. Auth0 configuration can be saved, but requires a verified compatible runner before scanning." },
+    { name: "policies", label: "CI/CD scan policies", placeholder: "Default vulnerabilities policy, Default IaC policy",
+      hint: "Optional comma-separated policy names. Leave blank to use your Wiz tenant's defaults." },
+    { name: "byPolicyHits", label: "Filter findings by policy hits", items: [
+      { value: "BLOCK", title: "Blocking policy hits (BLOCK)" },
+      { value: "AUDIT", title: "Blocking or audit policy hits (AUDIT)" },
+      { value: "DISABLED", title: "All findings (DISABLED)" }
+    ], hint: "Filtering reported findings does not disable Wiz's policy verdict." }
+  ],
+  setup: { url: "https://marketplace.visualstudio.com/items?itemName=WizCloud.wiz-task", steps: [
+    "Ask your Wiz administrator for a service account or deployment scoped to the projects you intend to scan, with create:security_scans permission.",
+    "Copy its Client ID and store its Client Secret in Env. Enter the secret reference, not the secret itself.",
+    "Confirm the tenant's authentication endpoint. The current runtime supports the Cognito endpoint; Auth0 execution is not implemented.",
+    "Optionally enter existing CI/CD scan policy names and choose which policy hits to report. Missing policies are scan failures.",
+    "Install an approved Wiz v1 CLI on the scan runner. A host-authorised source directory is scanned only when the source.scan operation is invoked.",
+    "Workspace access, scan scheduling and security-result presentation are host responsibilities. Saving this configuration does not automatically scan all projects."
+  ] }
+});
+
+export { wizDefinition };

package/src/shared/wordpress-com.js

@@ -0,0 +1,30 @@
+const wordpressComDefinition = Object.freeze({
+  id: "wordpress-com", name: "WordPress.com", description: "Connect a WordPress.com account to read its profile/sites and manage posts, pages and media.",
+  accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  scopes: [
+    { value: "users", label: "View user information (required for verification)", recommended: true },
+    { value: "sites", label: "View site information and options", recommended: true },
+    { value: "posts", label: "View and manage posts", recommended: true },
+    { value: "media", label: "Manage media assets" },
+    { value: "comments", label: "View and manage comments" },
+    { value: "stats", label: "View site statistics" },
+    { value: "taxonomy", label: "Manage taxonomy terms" },
+    { value: "batch", label: "Batch API requests" }
+  ],
+  setup: {
+    url: "https://developer.wordpress.com/docs/api/oauth2/",
+    steps: [
+      "Sign into WordPress.com Developer Resources, open My Apps and choose Create New Application.",
+      "Enter the application name, description and exact backend Redirect URL, then create it. Copy its Client ID here and store the Client Secret and callback URL in the referenced Env variables.",
+      "Keep users permission for authenticated verification. Sites enables site listing; posts enables reading, drafting and publishing posts or pages. Your application must authorize each write.",
+      "Save configuration, then start consent through the runtime. The provider's selected site and granted scopes control access; no global all-sites scope is requested.",
+      "Select media and grant consent to upload or manage library assets. The site still enforces file types, storage and account permissions. Uploads can return per-file errors; the app must inspect them. Media deletion is permanent.",
+      "Select comments for replies and moderation. Site rules may publish a new reply immediately. Editing requires an explicit moderation status; restoring a comment can make it public again. Your app must restrict moderator actions.",
+      "Select stats for site reports and taxonomy to manage categories/tags. Reconnect after adding permissions. Site roles still apply; deleting or renaming a term can affect existing content. Your application owns its report and taxonomy screens.",
+      "Batch combines selected reads from one site; select batch and each resource permission. A successful batch can contain individual permission errors. It does not group writes into a transaction.",
+      "New content defaults to draft with publicizing off. Publishing, deletion and restoration are explicit app actions; deleting an already-trashed post can permanently remove it, and restoring can publish it again.",
+      "This connects provider data. It does not create an application login or use self-hosted WordPress Application Passwords."
+    ]
+  }
+});
+export { wordpressComDefinition };

package/src/shared/wordpress.js

@@ -0,0 +1,69 @@
+import { createSchema } from "json-rest-schema";
+import { httpsSiteUrlField as siteUrl } from "./siteUrl.js";
+const siteHint = "Use the site address before /wp-json, keeping any installation subdirectory. The runtime sends credentials only to this configured origin.";
+
+const woocommerceDefinition = Object.freeze({
+  id: "woocommerce", name: "WooCommerce", description: "Manage your WooCommerce catalogue, orders, customers, discounts and refunds, and read store reports.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  apiKeyReferenceLabel: "Consumer secret reference",
+  apiKeyReferenceHint: "Store the consumer secret in Env. Use Read for lookups or Read/Write for changes; the key's WordPress user must also have permission for the requested operation.",
+  settingsSchema: createSchema({
+    siteUrl,
+    consumerKey: { type: "string", required: true, minLength: 4, maxLength: 256,
+      validator: (value) => /^ck_[a-z0-9]+$/iu.test(value) || "Enter the WooCommerce consumer key beginning ck_." }
+  }),
+  settingsFields: [
+    { name: "siteUrl", label: "Store URL", placeholder: "https://shop.example.com", hint: siteHint },
+    { name: "consumerKey", label: "Consumer key", placeholder: "ck_...", hint: "The key identifier from WooCommerce. Store its matching consumer secret separately." }
+  ],
+  setup: {
+    url: "https://developer.woocommerce.com/docs/apis/rest-api/authentication/",
+    steps: [
+      "Open WooCommerce, Settings, Advanced, REST API in the store dashboard. Choose Add key.",
+      "Enter a description, choose the intended WordPress user and select Read for lookup only or Read/Write for product, inventory, customer, coupon or order changes. Choose Generate API key.",
+      "Copy the consumer key here. Store its one-time consumer secret in Env and enter the secret reference.",
+      "Use the store's final HTTPS address, including a subdirectory if present. WooCommerce REST v3 requires pretty permalinks.",
+      "Product prices and stock edits affect the store immediately. Choose draft when creating a product for review. Stock quantities replace the current value; they are not increments. Review concurrent stock changes in your app.",
+      "Creating an order creates a store record, not a payment or checkout. Your app must supply the intended customer, items and addresses, then inspect the returned order. Uncertain creation must be reconciled before retrying.",
+      "Order status changes can trigger store emails and stock actions. Marking completed does not collect payment; marking refunded does not issue a gateway refund. Your app must authorize and review the change.",
+      "Refund creation requires an explicit choice: return money through the payment gateway, or record a manual refund only. Choose whether to restock and select original order-line IDs and quantities. Review remaining refundable amounts; after an uncertain result, inspect refunds and gateway history before retrying.",
+      "Category changes affect store navigation immediately; category deletion is permanent but does not delete products. Reports require reporting permission on the selected WordPress user, even with a Read key. A successful product check does not prove report access.",
+      "Coupon creation and edits affect live checkout discounts. Your app must review amounts and restrictions before submitting; free shipping also requires a compatible store shipping method. Failed writes are not automatically retried.",
+      "Deletion requires an explicit trash/permanent choice. Customers and variations support only permanent deletion. Review customer content reassignment first; deleting an order does not refund payment.",
+      "For event notifications, open WooCommerce, Settings, Advanced, Webhooks, Add webhook. Choose the topic and your app receiver URL; store a separate signing secret in app Env. Activate only after the receiver verifies signatures. Pause/delete the store webhook to stop deliveries.",
+      "Save configuration. The application runtime verifies access by reading products; orders, customers and coupons still depend on the selected user's permissions. Your app must authorize each visitor's access; this administrator key does not sign customers in."
+    ]
+  }
+});
+
+const wordpressSelfHostedDefinition = Object.freeze({
+  id: "wordpress-self-hosted", name: "WordPress (self-hosted)", description: "Manage WordPress posts, pages, media and users with a site-owned account.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  apiKeyReferenceLabel: "Application password reference",
+  apiKeyReferenceHint: "Use a WordPress Application Password for this user, stored in Env. The user's role controls access; this is separate from the user's login password.",
+  settingsSchema: createSchema({
+    siteUrl,
+    username: { type: "string", required: true, minLength: 1, maxLength: 60,
+      validator: (value) => !/[:\p{Cc}]/u.test(value) || "Enter a username without colons or control characters." }
+  }),
+  settingsFields: [
+    { name: "siteUrl", label: "Site URL", placeholder: "https://example.com", hint: siteHint },
+    { name: "username", label: "Username", placeholder: "editor", hint: "The WordPress login name that owns the Application Password." }
+  ],
+  setup: {
+    url: "https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/",
+    steps: [
+      "On the HTTPS WordPress site, open Users and edit the intended user's profile. Find Application Passwords.",
+      "Enter a distinct application name and choose Add New Application Password. Copy the password when it is shown.",
+      "Store the password in Env, then enter the site URL, username and password reference here.",
+      "Save configuration. The runtime verifies the authenticated user with users/me, then exposes post/page reads and explicit draft, publish, edit and trash operations. Public post access alone does not verify the account.",
+      "Choose a user whose site role permits the intended actions. Reading an account does not prove permission to edit pages, publish or delete content. Creation defaults to draft; publishing and editing already-published content are explicit app actions.",
+      "Media uploads need upload_files permission and follow the site's size/type limits. User creation, role changes and deletion require administrative capabilities; grant only what the application's intended features need. Shared app callers all act as this WordPress user.",
+      "Media and user deletion are permanent operations requiring explicit app-side authorization and confirmation. User deletion also requires a chosen replacement author. Saving this form performs none of those actions.",
+      "To rotate the password, create another named Application Password, replace its value in Env, then reconnect. Revoke the old password in the user's profile. Disconnecting here only removes this application's local connection.",
+      "If Application Passwords or REST routes are disabled by the host or a plugin, ask the site administrator to enable the intended access."
+    ]
+  }
+});
+
+export { woocommerceDefinition, wordpressSelfHostedDefinition };

package/src/shared/workday.js

@@ -0,0 +1,50 @@
+import { createSchema } from "json-rest-schema";
+
+const host = "(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.){1,3}myworkday\\.com";
+const restPattern = new RegExp(`^https://(?<host>${host})(?<prefix>/ccx)?/api/(?:v1|staffing/v7)/(?<tenant>[A-Za-z0-9_-]{1,128})/?$`, "u");
+const authorizationPattern = new RegExp(`^https://${host}/(?<tenant>[A-Za-z0-9_-]{1,128})/authorize$`, "u");
+const workdayRestEndpoint = (value) => typeof value === "string" ? restPattern.exec(value)?.groups : undefined;
+const endpointField = { type: "string", required: true, noTrim: true, maxLength: 512 };
+
+const workdayDefinition = Object.freeze({
+  id: "workday", name: "Workday", description: "Read workers, organizations, time off and custom reports with each connected Workday user's permissions.",
+  accountModes: ["per-user"], authenticationMethods: ["oauth2"],
+  oauthClientAuthenticationMethods: ["client_secret_post", "client_secret_basic"],
+  settingsSchema: createSchema({
+    restApiEndpoint: { ...endpointField, validator: (value) => Boolean(workdayRestEndpoint(value)) ||
+      "Copy the HTTPS Workday REST API endpoint ending /api/v1/tenant or /api/staffing/v7/tenant, with its /ccx prefix if present." },
+    tokenEndpoint: { ...endpointField, validator: (value, settings) => {
+      const rest = workdayRestEndpoint(settings.restApiEndpoint);
+      return Boolean(rest && value === `https://${rest.host}/ccx/oauth2/${rest.tenant}/token`) ||
+        "Copy the token endpoint for the same REST API host and tenant, ending /ccx/oauth2/tenant/token.";
+    } },
+    authorizationEndpoint: { ...endpointField, validator: (value, settings) => {
+      const rest = workdayRestEndpoint(settings.restApiEndpoint);
+      return Boolean(rest && authorizationPattern.exec(value)?.groups.tenant === rest.tenant) ||
+        "Copy the HTTPS Workday authorization endpoint for the same tenant, ending /tenant/authorize. Its host may differ.";
+    } }
+  }),
+  settingsFields: [
+    { name: "restApiEndpoint", label: "Workday REST API Endpoint", placeholder: "https://wd5-services1.myworkday.com/ccx/api/v1/acme_corp",
+      hint: "Copy from View API Clients. Worker reads use Staffing v7 on this host and tenant." },
+    { name: "tokenEndpoint", label: "Token Endpoint", placeholder: "https://wd5-services1.myworkday.com/ccx/oauth2/acme_corp/token",
+      hint: "Copy the Token Endpoint from the same Workday tenant." },
+    { name: "authorizationEndpoint", label: "Authorization Endpoint", placeholder: "https://acme.wd5.myworkday.com/acme_corp/authorize",
+      hint: "Copy from View API Clients. The sign-in host usually differs from the API host." }
+  ],
+  scopes: [],
+  permissionsHint: "Select the required functional areas in Workday: Staffing, Organizations and Roles, or Time Off and Leave. Each user's domain and report permissions still apply. Connecting Workday does not create your app's login.",
+  setup: { url: "https://docs.lovable.dev/integrations/workday", steps: [
+    "In your Workday tenant, an administrator opens Register API Client and chooses Authorization Code Grant and Bearer access tokens.",
+    "Register this confidential client without PKCE so Workday issues a Client Secret. Enter your application's exact backend callback URL.",
+    "Select Staffing in Scope (Functional Areas). Grant intended users View access through the Report/Task permissions of the worker REST domains.",
+    "For organization browsing, also select Organizations and Roles. Your tenant administrator must grant the intended users View: Supervisory Organization; member and org-chart reads need Reports: Organization. A successful worker check does not prove these permissions.",
+    "For time-off balances and entries, select Time Off and Leave and grant the appropriate Self-Service or Worker Data: Time Off Report/Task permissions. Your app selects the worker and displays the returned units and status; this connection does not submit or approve leave.",
+    "For custom reports, select Tenant Non-Configurable and Include Workday Owned Scope on the API client, plus the functional areas needed by the report's data. The report owner enables the report as a web service and shares it with the intended users. In the report's related actions, open Web Services, View URLs, fill required prompts and copy the JSON URL. Your app uses its owner/name and prompt aliases on the same configured tenant; verify report access separately.",
+    "Save the Client ID and put the Client Secret in Env. Open View API Clients and copy the REST API, Token and Authorization endpoints into this form.",
+    "Keep the tenant's approved refresh-token lifetime. An expired or revoked grant requires the user to reconnect.",
+    "Each user connects their own Workday account inside your app. Every customer tenant needs its own registration and your app's callback. Disconnecting removes the app's saved grant; provider-side revocation is managed in Workday."
+  ] }
+});
+
+export { workdayDefinition, workdayRestEndpoint };

package/src/shared/x-twitter.js

@@ -0,0 +1,19 @@
+const xTwitterDefinition = Object.freeze({
+  id: "x-twitter", name: "X (Twitter)", description: "Read public X profiles, posts and recent search with an application's bearer token.",
+  accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
+  apiKeyReferenceLabel: "App-only bearer token reference",
+  verificationFields: [{ name: "username", required: true, label: "Verification username",
+    hint: "Enter a public X username without @. Connecting looks up this profile and can consume provider credits." }],
+  apiKeyReferenceHint: "Reference the app-only Bearer Token from X Developer Console. This token does not sign in an app user.",
+  setup: { url: "https://docs.x.com/x-api/getting-started/getting-access", steps: [
+    "Sign into console.x.com, complete developer onboarding and choose New App. Enter the application's name, description and use case.",
+    "Open the app's credentials and copy its app-only Bearer Token into backend Env. Save only that Env reference here, without the Bearer prefix.",
+    "Check API access, available credits and spending limits in Developer Console. Verification and public-data reads can consume provider credits.",
+    "Save configuration, then call connectApiKey with verificationInput containing a real public username, without @. Verification looks up that profile.",
+    "Recent search covers the last seven days. Use provider query operators for filters and request more pages explicitly; each read can consume credits. Your app owns attribution, display and query access.",
+    "Disconnect removes the local connection only. Replace the token in backend Env and verify again to rotate it; invalidating the provider token affects every app using that token.",
+    "This flow has no OAuth callback or per-user consent. It cannot post, read direct messages or provide application login."
+  ] }
+});
+
+export { xTwitterDefinition };

package/src/shared/xero.js

@@ -0,0 +1,46 @@
+const xeroDefinition = Object.freeze({
+  id: "xero", name: "Xero", description: "Manage contacts and invoices, record payments and read financial reports in connected organisations.",
+  accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  oauthClientAuthenticationMethods: ["client_secret_basic"],
+  scopes: [
+    { value: "offline_access", label: "Keep access when the user is away", recommended: true },
+    { value: "accounting.settings.read", label: "Read organisation settings", recommended: true },
+    { value: "accounting.contacts.read", label: "Read contacts", recommended: true },
+    { value: "accounting.invoices.read", label: "Read invoices and bills", recommended: true },
+    { value: "accounting.settings", label: "Read and manage organisation settings" },
+    { value: "accounting.contacts", label: "Read and manage contacts" },
+    { value: "accounting.invoices", label: "Read and manage invoices and bills" },
+    { value: "accounting.payments", label: "Read and manage payments" },
+    { value: "accounting.payments.read", label: "Read payments" },
+    { value: "accounting.banktransactions", label: "Read and manage bank transactions" },
+    { value: "accounting.banktransactions.read", label: "Read bank transactions" },
+    { value: "accounting.manualjournals", label: "Read and manage manual journals" },
+    { value: "accounting.manualjournals.read", label: "Read manual journals" },
+    { value: "accounting.attachments", label: "Read and manage attachments" },
+    { value: "accounting.attachments.read", label: "Read attachments" },
+    { value: "accounting.reports.profitandloss.read", label: "Read profit and loss reports" },
+    { value: "accounting.reports.balancesheet.read", label: "Read balance sheet reports" },
+    { value: "accounting.reports.aged.read", label: "Read aged receivables and payables reports" },
+    { value: "accounting.reports.executivesummary.read", label: "Read executive summary reports" },
+    { value: "accounting.reports.banksummary.read", label: "Read bank summary reports" },
+    { value: "accounting.reports.trialbalance.read", label: "Read trial balance reports" },
+    { value: "accounting.reports.budgetsummary.read", label: "Read budget summary reports" },
+    { value: "accounting.reports.taxreports.read", label: "Read GST and BAS reports" },
+    { value: "accounting.budgets.read", label: "Read budgets" }
+  ],
+  setup: { url: "https://developer.xero.com/documentation/guides/oauth2/auth-flow/", steps: [
+    "Open My Apps in the Xero developer portal and create an app using the Auth Code grant type. Copy its Client ID and generate a Client Secret.",
+    "Register the exact backend callback URL. Xero requires HTTPS except http://localhost for local testing; http://127.0.0.1 is not accepted.",
+    "Store the secret and callback in Env. This provider uses HTTP Basic client authentication; the saved registration selects it automatically.",
+    "After consent, list connected organisations and let the application choose an authorised organisation. A connection is not application login.",
+    "Default permissions allow organisation, contact and invoice reads. Select Read and manage contacts for deliberate contact creation or changes. Select Read payments for payment pages. For financial reports, select the matching Read profit and loss, balance sheet, aged receivables and payables, executive summary, bank summary or trial balance permission, then reconnect to approve the added permissions. Aged reports require a contact ID; your app must supply reporting dates. Read settings supplies the organisation’s currencies, tax rates and tracking categories as well as accounts. Your Xero user also needs access to those reports. Other permission choices do not add operations.",
+    "To inspect bank transactions or manual journals, select Read bank transactions or Read manual journals and reconnect. Your app selects the connected organisation and requests numbered pages, then retrieves an individual record for its full lines. These read permissions do not authorize changes or bank reconciliation.",
+    "To create or change manual journals, select Read and manage manual journals and reconnect. Choose account codes from Accounts, supply balanced debit (positive) and credit (negative) lines, narration, date and tax basis. New journals default to DRAFT; posting must be an explicit app action. Xero validates balance, tax and allowed status changes. Keep a stable request key and inspect the journal after an uncertain result before retrying.",
+    "To create or edit ordinary SPEND/RECEIVE bank transactions, select Read and manage bank transactions and reconnect. Choose a bank account from Accounts and a contact, then supply date, tax basis and complete lines. Currency comes from the bank account. Keep the exact request and stable request key. Transfers, prepayments, overpayments and automatic reconciliation are not supported by these write operations.",
+    "For record attachments, select Read attachments to list/download, or Read and manage attachments to upload/replace, then reconnect. Choose a contact, invoice, bank transaction or manual journal in the connected organisation. Files are limited to 3 MiB by this adapter; replacement uses the existing filename. Keep the request key and inspect the attachment list after an uncertain upload before retrying. Saving configuration never uploads files.",
+    "For budget lists and account budget lines, select Read budgets. For the budget summary report, separately select Read budget summary reports. Reconnect after adding either permission. Choose a budget returned by the connected organisation; summary periods use 1 for months, 3 for quarters or 12 for years. These operations read existing budgets and do not create or edit them.",
+    "To record an invoice payment, select Read and manage payments and reconnect. Your app must choose the invoice, a suitable bank or payment-enabled account, date and amount, and retain the exact request with its idempotency key. This records a payment in Xero; it does not charge a customer. Inspect payment history after an uncertain result before retrying.",
+    "To create or update sales invoices and supplier bills, select Read and manage invoices and bills and reconnect. Your app supplies contact, dates, currency, tax basis and line items; creation defaults to Draft. Review authorisation, voiding or deletion explicitly. Keep the exact request and idempotency key, inspect uncertain results before retrying, and preserve existing line IDs when replacing lines. Saving this form writes no accounting records."
+  ] }
+});
+export { xeroDefinition };

package/src/shared/zoho-books.js

@@ -0,0 +1,39 @@
+import { createSchema } from "json-rest-schema";
+import { zohoRegions } from "./zoho-regions.js";
+
+const zohoBooksIdentifier = (value) => typeof value === "string" && /^[1-9][0-9]{0,29}$/u.test(value);
+const zohoBooksOrganizationField = { type: "string", noTrim: true,
+  validator: (value) => zohoBooksIdentifier(value) || "Use an organisation ID containing digits only." };
+
+const zohoBooksDefinition = Object.freeze({
+  id: "zoho-books", name: "Zoho Books", description: "Discover accessible organisations and read pages of contacts and invoices.",
+  accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  oauthClientAuthenticationMethods: ["client_secret_post"],
+  scopes: [
+    { value: "ZohoBooks.settings.READ", label: "Read organisations and settings", recommended: true },
+    { value: "ZohoBooks.contacts.READ", label: "Read contacts", recommended: true },
+    { value: "ZohoBooks.invoices.READ", label: "Read invoices", recommended: true },
+    ...[
+      ["contacts", "contacts"], ["invoices", "invoices"], ["customerpayments", "customer payments"],
+      ["creditnotes", "credit notes"], ["estimates", "estimates"], ["salesorders", "sales orders"],
+      ["purchaseorders", "purchase orders"], ["bills", "bills"], ["expenses", "expenses"], ["projects", "projects"]
+    ].map(([name, label]) => ({ value: `ZohoBooks.${name}.ALL`, label: `Full access to ${label}` }))
+  ],
+  settingsSchema: createSchema({
+    region: { type: "string", enum: zohoRegions.map(({ value }) => value), defaultTo: "eu" },
+    organizationId: zohoBooksOrganizationField
+  }),
+  settingsFields: [
+    { name: "region", label: "Data center", hint: "Choose the data center containing the Books account. Canada uses accounts.zohocloud.ca for OAuth.", items: zohoRegions.map(({ value, title }) => ({ value, title })) },
+    { name: "organizationId", label: "Organization ID (optional)", hint: "Set one organisation for this integration, or leave empty and let the app choose from the connected account's organisations." }
+  ],
+  setup: { url: "https://www.zoho.com/books/api/v3/oauth/", steps: [
+    "Open the Zoho API Console, add a Server-based Application, and enter its name, homepage and exact backend redirect URI.",
+    "Copy the Client ID. Store the selected data center's Client Secret and callback URL in the referenced Env variables. Enable additional regions in the client's Multi DC settings if needed.",
+    "Optionally copy an Organization ID from Zoho Books: open the organisation-name menu, then Manage Organizations. Leaving it empty allows discovery after consent; the runtime never chooses the first organisation automatically.",
+    "Save configuration and start consent through your application's runtime. Read organisations and settings is needed to verify the connection. Contacts and invoice reads are selected initially.",
+    "A shared connection shares its accounting access. Choose each app user's own account when every user must connect separately. Additional scope choices do not add write operations."
+  ] }
+});
+
+export { zohoBooksDefinition, zohoBooksIdentifier, zohoBooksOrganizationField };

package/src/shared/zoho-crm.js

@@ -0,0 +1,43 @@
+import { createSchema } from "json-rest-schema";
+import { zohoRegions } from "./zoho-regions.js";
+
+const zohoCrmRegions = Object.freeze(zohoRegions.filter(({ value }) => value !== "sa"));
+
+const zohoCrmDefinition = Object.freeze({
+  id: "zoho-crm", name: "Zoho CRM", description: "Read the connected CRM user and pages of leads, contacts, accounts and deals.",
+  accountModes: ["shared", "per-user", "assistant"], authenticationMethods: ["oauth2"],
+  oauthClientAuthenticationMethods: ["client_secret_post"],
+  scopes: [
+    { value: "ZohoCRM.users.READ", label: "Read the connected CRM user", recommended: true },
+    { value: "ZohoCRM.modules.leads.READ", label: "Read leads", recommended: true },
+    { value: "ZohoCRM.modules.contacts.READ", label: "Read contacts", recommended: true },
+    { value: "ZohoCRM.modules.accounts.READ", label: "Read accounts", recommended: true },
+    { value: "ZohoCRM.modules.deals.READ", label: "Read deals", recommended: true },
+    { value: "ZohoCRM.modules.READ", label: "Read all CRM modules" },
+    { value: "ZohoCRM.users.ALL", label: "Full CRM user access" },
+    { value: "ZohoCRM.modules.leads.ALL", label: "Full lead access" },
+    { value: "ZohoCRM.modules.contacts.ALL", label: "Full contact access" },
+    { value: "ZohoCRM.modules.accounts.ALL", label: "Full account access" },
+    { value: "ZohoCRM.modules.deals.ALL", label: "Full deal access" },
+    { value: "ZohoCRM.modules.ALL", label: "Full access to all CRM modules" }
+  ],
+  settingsSchema: createSchema({
+    region: { type: "string", enum: zohoCrmRegions.map(({ value }) => value), defaultTo: "us" },
+    environment: { type: "string", enum: ["production", "sandbox", "developer"], defaultTo: "production" }
+  }),
+  settingsFields: [
+    { name: "region", label: "Data center", hint: "Choose the data center containing your CRM account. Canada uses accounts.zohocloud.ca for OAuth.", items: zohoCrmRegions.map(({ value, title }) => ({ value, title })) },
+    { name: "environment", label: "CRM environment", hint: "Choose the same environment and organisation during Zoho consent. Tokens cannot be moved between environments.", items: [
+      { value: "production", title: "Production" }, { value: "sandbox", title: "Sandbox" }, { value: "developer", title: "Developer" }
+    ] }
+  ],
+  setup: { url: "https://www.zoho.com/crm/developer/docs/api/v8/register-client.html", steps: [
+    "Open the Zoho API Console, choose Server-based Applications, then Create Now. Enter a client name, homepage and the exact backend redirect URI.",
+    "Copy the Client ID. Store the Client Secret and callback URL in the referenced Env variables. Use the secret assigned to the selected data center.",
+    "For users in other data centers, enable Multi DC in the client's Settings and configure each required region before connecting.",
+    "Save configuration, then start consent through your application's runtime. Choose the intended CRM organisation and environment; verification reads the current CRM user.",
+    "This adapter only reads the current user, leads, contacts, accounts and deals. Full-access scope choices do not add create, update or delete operations. Read permissions are selected initially. Sharing one connection shares its CRM access; each app user's own account requires a separate authorised connection."
+  ] }
+});
+
+export { zohoCrmDefinition, zohoCrmRegions };

package/src/shared/zoho-regions.js

@@ -0,0 +1,12 @@
+const zohoRegions = Object.freeze([
+  { value: "us", title: "United States (.com)", accounts: "https://accounts.zoho.com", suffix: "com" },
+  { value: "eu", title: "Europe (.eu)", accounts: "https://accounts.zoho.eu", suffix: "eu" },
+  { value: "in", title: "India (.in)", accounts: "https://accounts.zoho.in", suffix: "in" },
+  { value: "au", title: "Australia (.com.au)", accounts: "https://accounts.zoho.com.au", suffix: "com.au" },
+  { value: "jp", title: "Japan (.jp)", accounts: "https://accounts.zoho.jp", suffix: "jp" },
+  { value: "ca", title: "Canada (.ca)", accounts: "https://accounts.zohocloud.ca", suffix: "ca" },
+  { value: "cn", title: "China (.com.cn)", accounts: "https://accounts.zoho.com.cn", suffix: "com.cn" },
+  { value: "sa", title: "Saudi Arabia (.sa)", accounts: "https://accounts.zoho.sa", suffix: "sa" }
+]);
+
+export { zohoRegions };