@jskit-ai/connectors-catalog 0.1.61 → 0.1.63

package/docs/ai.md

@@ -22,10 +22,15 @@ model and `env:NAME` reference and use its own environment/configuration and AI
 client. Framework-independent facts in this guide are usable by its coding AI;
 PHP code and a parallel PHP package are not part of JSKIT.
 
-## Default and catalogue
+## Model selection and catalogue
 
-Import `aiCatalogue`, `listAiModels`, `getAiModel`, `aiAccessLabels` and
-`DEFAULT_AI_MODEL` from `@jskit-ai/connectors-catalog/shared/ai`.
+Import `aiCatalogue`, `listAiModels`, `getAiModel` and `aiAccessLabels` from
+`@jskit-ai/connectors-catalog/shared/ai`.
+
+There is no default model. The connector's first authentication method is a
+provider API key, and an integration without a model is invalid. Free
+access without an account or key is used only for a model explicitly chosen
+from the `free-no-setup` list.
 
 The one-time 10 September 2026 extraction contains 213 provider records and
 7,614 model records from models.dev, the catalogue used by OpenCode. There is
@@ -41,7 +46,8 @@ accepts these names and serves their requests with V4.1 Flash. JSKIT sends the
 selected ID unchanged and does not rewrite configuration. All three Flash
 entries accept text and images. They and `deepseek/deepseek-v4-pro` declare
 the provider's exact 1,048,576-token context and 393,216-token output limits;
-Pro accepts text only. The bundled catalogue now has 7,615 model records.
+Pro accepts text only. The bundled catalogue now has 7,614 model records;
+OpenCode Zen's Big Pickle was removed from it.
 The source hashes identify the original 7,614-record extraction, before this
 reviewed update. Flash entries declare paid access without a fixed price because
 the provider has peak and off-peak rates. See the
@@ -49,9 +55,8 @@ the provider has peak and off-peak rates. See the
 [model details](https://api-docs.deepseek.com/quick_start/pricing/), including
 [exact model metadata](https://api-docs.deepseek.com/api/list-models/).
 
-`listAiModels()` hides deprecated entries and sorts free choices first, with
-`opencode/big-pickle` first. `includeDeprecated: true` exposes retained upstream
-history; `providerId`, `access` and `configurableOnly` filter the list.
+`listAiModels()` hides deprecated entries and sorts free choices first.
+`includeDeprecated: true` exposes retained upstream history; `providerId`, `access` and `configurableOnly` filter the list.
 Models retain limits, modality and cost metadata as dated information, not a
 promise of current availability or a billing calculator. An explicit unknown
 or deprecated model fails validation; it is never replaced automatically.
@@ -63,9 +68,9 @@ or deprecated model fails validation; it is never replaced automatically.
 | `paid` | Declared positive input or output charges |
 | `unknown` | Insufficient pricing information; check the provider |
 
-The snapshot's seven active public choices are Big Pickle, MiMo-V2.5 Free,
-Ling3.0 FlashFin Free, Nemotron 3 Ultra Free, Nemotron 3.5 Lightning Free,
-Muse Spark 1.2 Contributor Free and Muse Spark 1.3 Contributor Free.
+The snapshot's active public choices include MiMo-V2.5 Free, Ling3.0 FlashFin
+Free, Nemotron 3 Ultra Free, Nemotron 3.5 Lightning Free, Muse Spark 1.2
+Contributor Free and Muse Spark 1.3 Contributor Free.
 This is a source-derived eligibility list, **not live inference verification**.
 Provider capacity, free offers and data-use terms can change. A failure stays
 with the selected provider/model; the application decides how to explain it.
@@ -73,7 +78,7 @@ with the selected provider/model; the application decides how to explain it.
 Zen's no-account protocol uses the fixed string `public` in its API-key
 position. The resolver supplies it. Nobody needs to enter it, create an account
 or create an environment variable for this mode. The Muse models use the
-OpenAI Responses SDK route, whereas Big Pickle uses OpenAI-compatible chat;
+OpenAI Responses SDK route, whereas MiMo uses OpenAI-compatible chat;
 the model's `sdkPackage` preserves that distinction.
 
 The initial configuration form and resolver support regular direct API-key
@@ -86,7 +91,7 @@ claim that a URL and API key can configure them.
 
 ## Portable configuration and Env
 
-This is enough to select the no-setup default:
+An administrator-funded Z.AI model:
 
 ```json
 {
@@ -97,15 +102,14 @@ This is enough to select the no-setup default:
       "provider": "ai",
       "accountMode": "shared",
       "scopes": [],
-      "authentication": { "method": "none" },
-      "settings": { "model": "opencode/big-pickle" }
+      "authentication": { "method": "api-key", "secretRef": "env:APP_AI_API_KEY" },
+      "settings": { "model": "zai/glm-4.7-flash" }
     }
   }
 }
 ```
 
-For an administrator-funded model, select `authentication.method: "api-key"`
-and `authentication.secretRef: "env:APP_AI_API_KEY"`. Store the **value** in the
+Store the key's **value** in the
 existing Env screen or the application's normal private environment. The host's
 existing launch/deployment environment mechanism supplies it to the backend;
 this integration adds no token delivery service. Do not use `VITE_` or another
@@ -159,9 +163,10 @@ There are no `vibe64-online`/`vibe64-public` OAuth registrations or universal
 callbacks for this AI integration. Regular keys belong to the app administrator
 or individual app user and are billed directly by that provider.
 
-For the no-setup default: choose AI, keep Big Pickle selected and save. No
-provider-side action is needed. For API-key routes, follow the provider's current
-dashboard documentation linked in `aiCatalogue.providers[].documentationUrl`:
+Choose AI, then choose a provider and model; nothing is preselected. For an
+explicitly chosen model labelled no account or key, no provider-side action is
+needed. For API-key routes, follow the provider's current dashboard
+documentation linked in `aiCatalogue.providers[].documentationUrl`:
 
 1. The account owner signs in to the provider and selects the organization or
    project that should own usage. This is a human account/terms/billing step.
@@ -190,7 +195,7 @@ authorization merely by editing this JSON.
 
 ## Evidence and limits
 
-Focused tests cover snapshot integrity, free/default classification, strict
+Focused tests cover snapshot integrity, free classification, no default model, strict
 selection, authorized environment and individual-key resolution, rotation,
 disconnect, redacted failures and SDK parameter handoff. Browser fixtures cover
 the editor's default, searchable model change, credential ownership, persistence
@@ -199,7 +204,7 @@ account creation or generated-application execution.
 
 ## Existing-scope closeout — 13 September 2026
 
-A static, attributed September 10 provider/model catalogue, searchable free/paid model configuration and a backend-only authorized credential/SDK-parameter resolver. The default is the snapshot's Zen Big Pickle no-account route; administrator keys resolve through Env, and individual keys through an app-supplied user/provider-scoped reference resolver.
+A static, attributed September 10 provider/model catalogue, searchable free/paid model configuration and a backend-only authorized credential/SDK-parameter resolver. No model is preselected and the first authentication method is a provider API key. Administrator keys resolve through Env, and individual keys through an app-supplied user/provider-scoped reference resolver.
 
 No inference engine, streaming, tools, conversation storage, provider OAuth/login screens, account/key provisioning, live credential verification, usage metering, billing, token resale or Vibe64 AI gateway. No automatic SDK installation, catalogue updates, model replacement or paid fallback. Only the 13 explicitly supported direct-key routes are configurable; other catalogue entries are framework metadata, not implemented cloud/coding-subscription authentication. Model availability, pricing/free classification and endpoint operation are dated source information, not live proof; even no-setup choices can be unavailable or capacity-limited. Detailed provider-specific personal-key entry, verification, encrypted storage, rotation/disconnect and authorization remain application work; the resolver only consumes those bindings. The app/framework owns SDK installation, protocol selection, requests, errors and UI. Generic key-creation guidance and linked provider documentation are supplied; bespoke audited login/key-creation screens for every catalogue provider are not. To extend: deliberately refresh the static snapshot, improve selected provider-specific instructions, and wire any desired app-native key-entry/inference features. This intentionally differs from Lovable managed AI; coding-agent credentials and runtimes remain separate from direct-provider API authentication.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/connectors-catalog",
-  "version": "0.1.61",
+  "version": "0.1.63",
   "description": "Provider definitions and focused API operations for JSKIT connectors.",
   "type": "module",
   "exports": {
@@ -123,14 +123,14 @@
     "@aws-sdk/client-redshift-data": "3.1128.0",
     "@aws-sdk/client-s3": "3.1128.0",
     "@aws-sdk/s3-request-presigner": "3.1128.0",
-    "@jskit-ai/connectors-core": "0.1.61",
+    "@jskit-ai/connectors-core": "0.1.62",
     "@modelcontextprotocol/sdk": "1.32.1",
     "@smithy/fetch-http-handler": "5.8.0",
     "jose": "^6.1.3",
     "json-rest-schema": "^1.0.17"
   },
   "peerDependencies": {
-    "@jskit-ai/kernel": "0.1.244"
+    "@jskit-ai/kernel": "0.1.245"
   },
   "jskit": {
     "kind": "runtime",

package/patterns/ai-connections/PATTERN.md

@@ -2,7 +2,7 @@
 id: connectors/ai-connections
 title: App-owned AI connections and static model selection
 summary: Resolve an administrator environment key or an individual user's grant, then use the application's chosen AI SDK directly.
-keywords: ai, models, free, big-pickle, zen, zai, environment, api-key, ownership, cli
+keywords: ai, models, free, zen, zai, environment, api-key, ownership, cli
 requires: @jskit-ai/connectors-core, @jskit-ai/connectors-catalog
 ---
 
@@ -12,8 +12,9 @@ requires: @jskit-ai/connectors-core, @jskit-ai/connectors-catalog
 
 Use the [AI guide](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/ai.md) to choose the model, account owner and
 framework SDK before wiring requests. The shared catalogue is a deliberate
-static extraction, not an OpenCode runtime integration. The default Big Pickle
-route needs no account, user key or environment setup.
+static extraction, not an OpenCode runtime integration. There is no default
+model: choose the provider, model and key. Only an explicitly chosen model
+labelled no account or key needs no account or environment setup.
 
 ## Framework APIs
 

package/patterns/oauth-connection/PATTERN.md

@@ -181,6 +181,31 @@ comma-separated permissions. Oura handles reduced callback scopes and rotated
 refresh tokens. Some providers do not return a refresh token; expired access
 then needs consent again. Provider PKCE enforcement needs provider evidence.
 
+## Shared connection from an Env refresh token
+
+When the application's host already holds a long-lived grant for the shared
+account (the owner connected it once with the same OAuth client), skip consent
+in the app: add `refreshTokenRef` to a `shared` oauth2 integration whose
+registration uses the authorization-code flow.
+
+```json
+"authentication": {
+  "method": "oauth2",
+  "registrationRef": "google",
+  "refreshTokenRef": "env:GOOGLE_REFRESH_TOKEN"
+}
+```
+
+The Env value is a seed. On first use, and whenever the value or the OAuth
+client changes, the runtime replaces the shared connection with one built from
+that refresh token. From then on it refreshes and stores rotated tokens in the
+application's own store as usual. `status()` reports `source: "env"` (show it as
+"Connected from Env"). `beginAuthorization()` and `disconnect()` refuse with
+`connector_env_managed`: "This connection comes from an Env value; unlink or
+replace that value instead." A revoked token fails with "The refresh token in
+Env no longer works; replace that Env value." The refresh token must come from
+the same client as `registrationRef`; non-JSKIT apps read the variable directly.
+
 ## Twitch composition
 
 Use `twitchProvider` from `@jskit-ai/connectors-catalog/server/twitch` in the

package/src/shared/ai-models.json

@@ -5392,7 +5392,6 @@
       {"id":"text-embedding-ada-002","name":"text-embedding-ada-002","cost":{"input":0.1,"output":0},"limit":{"context":8192,"output":1536},"modalities":{"input":["text"],"output":["text"]},"sdkPackage":"@ai-sdk/openai","access":"paid"}
     ]},
     {"id": "opencode", "name": "OpenCode Zen", "documentationUrl": "https://opencode.ai/docs/zen", "baseURL": "https://opencode.ai/zen/v1", "environment": ["OPENCODE_API_KEY"], "sdkPackage": "@ai-sdk/openai-compatible", "models": [
-      {"id":"big-pickle","name":"Big Pickle","cost":{"input":0,"output":0,"cache_read":0,"cache_write":0},"limit":{"context":200000,"input":160000,"output":32000},"modalities":{"input":["text"],"output":["text"]},"sdkPackage":"@ai-sdk/openai-compatible","access":"free-no-setup"},
       {"id":"claude-3-5-haiku","name":"Claude Haiku 3.5","status":"deprecated","cost":{"input":0.8,"output":4,"cache_read":0.08,"cache_write":1},"limit":{"context":200000,"output":8192},"modalities":{"input":["text","image","pdf"],"output":["text"]},"sdkPackage":"@ai-sdk/anthropic","access":"paid"},
       {"id":"claude-fable-5","name":"Claude Fable 5","cost":{"input":10,"output":50,"cache_read":1,"cache_write":12.5},"limit":{"context":1000000,"output":128000},"modalities":{"input":["text","image","pdf"],"output":["text"]},"sdkPackage":"@ai-sdk/anthropic","access":"paid"},
       {"id":"claude-fable-5-1","name":"Claude Fable 5.1","cost":{"input":10,"output":50,"cache_read":0.25,"cache_write":12.5},"limit":{"context":1000000,"output":128000},"modalities":{"input":["text","image","pdf"],"output":["text"]},"sdkPackage":"@ai-sdk/anthropic","access":"paid"},

package/src/shared/ai.js

@@ -1,7 +1,6 @@
 import { createSchema } from "json-rest-schema";
 import snapshot from "./ai-models.json" with { type: "json" };
 
-const DEFAULT_AI_MODEL = "opencode/big-pickle";
 const aiAccessLabels = Object.freeze({
   "free-no-setup": "Free · no account or key",
   "free-with-connection": "Free · connection required",
@@ -26,38 +25,36 @@ function listAiModels({ providerId, access, includeDeprecated = false, configura
     (!configurableOnly || provider.connection === "api-key"))
     .flatMap((provider) => provider.models).filter((model) =>
       (includeDeprecated || model.status !== "deprecated") && (!access || model.access === access))
-    .sort((a, b) => a.key === DEFAULT_AI_MODEL ? -1 : b.key === DEFAULT_AI_MODEL ? 1 :
-      order.indexOf(a.access) - order.indexOf(b.access) || a.key.localeCompare(b.key));
+    .sort((a, b) => order.indexOf(a.access) - order.indexOf(b.access) || a.key.localeCompare(b.key));
 }
 
 const modelItems = Object.freeze(listAiModels({ configurableOnly: true }).map((model) => Object.freeze({
   value: model.key, title: `${model.name} (${model.providerId})`, props: { subtitle: aiAccessLabels[model.access] }
 })));
 const aiDefinition = Object.freeze({
-  id: "ai", name: "AI", description: "Choose an app AI model and whose account pays. Big Pickle starts without an account or key.",
-  accountModes: ["shared", "per-user"], authenticationMethods: ["none", "api-key"], scopes: [],
-  authenticationMethodsForSettings: (settings = {}) => getAiModel(settings.model ?? DEFAULT_AI_MODEL)?.access === "free-no-setup"
+  id: "ai", name: "AI", description: "Choose an app AI provider, model and whose account pays. No model is preselected.",
+  accountModes: ["shared", "per-user"], authenticationMethods: ["api-key", "none"], scopes: [],
+  authenticationMethodsForSettings: (settings = {}) => getAiModel(settings.model)?.access === "free-no-setup"
     ? ["none", "api-key"] : ["api-key"],
   authenticationLabels: { none: "Free access · no account or key", "api-key": "Use a provider API key" },
   authenticationHint: "Your app calls the provider directly. A shared account belongs to the app administrator; individual accounts belong to each signed-in app user.",
-  settingsSchema: createSchema({ model: { type: "string", defaultTo: DEFAULT_AI_MODEL,
+  settingsSchema: createSchema({ model: { type: "string", required: true,
     enum: modelItems.map((item) => item.value) } }),
   settingsFields: [{ name: "model", label: "AI model", searchable: true, items: modelItems,
     credentialScope: (key) => getAiModel(key)?.providerId,
     hint: (settings = {}) => {
-      const model = getAiModel(settings.model ?? DEFAULT_AI_MODEL);
-      return `${model ? `${model.name}: ${aiAccessLabels[model.access]}. ` : ""}Search by provider or model. Catalogue dated 10 September 2026; availability can change. No automatic paid fallback.`;
+      const model = getAiModel(settings.model);
+      return `${model ? `${model.name}: ${aiAccessLabels[model.access]}. ` : "Choose a provider and model. "}Search by provider or model. Catalogue dated 10 September 2026; availability can change. No automatic paid fallback.`;
     } }],
   apiKeyReferenceHint: "Use an environment reference for an administrator key. For individual accounts, use a private reference your app resolves for the authenticated user. Never put a key in this file.",
   setup: {
     url: "https://opencode.ai/docs/zen/",
     steps: [
-      "Big Pickle and other choices labelled no account or key need no registration. Save and use this model through your application's AI library.",
-      "For a connected model, create a regular API key in that provider's dashboard. Z.AI's GLM-4.7-Flash uses a regular Z.AI key; its Coding Plan is a different product.",
+      "Choose a provider and model; no model is preselected. Create a regular API key in that provider's dashboard. Z.AI's GLM-4.7-Flash uses a regular Z.AI key; its Coding Plan is a different product.",
       "For a shared account, store the administrator's key in Env. For individual accounts, your application must provide private key entry, storage and disconnect controls for each authenticated user.",
       "Saving selects configuration; it does not verify a provider account or install an AI library into your application. Follow the AI connection guide for the selected framework."
     ]
   }
 });
 
-export { aiCatalogue, aiAccessLabels, aiDefinition, DEFAULT_AI_MODEL, getAiModel, listAiModels };
+export { aiCatalogue, aiAccessLabels, aiDefinition, getAiModel, listAiModels };

package/src/shared/algolia.js

@@ -12,7 +12,7 @@ const algoliaDefinition = Object.freeze({
   settingsFields: [
     { name: "applicationId", label: "Application ID", hint: "Copy the ID from your Algolia application's API Keys page. This ID can be public." },
     { name: "publicApiKeyRef", environmentCredential: { label: "Public frontend API key", public: true }, label: "Public API key reference (optional)", placeholder: "env:ALGOLIA_SEARCH_KEY",
-      hint: "Optional search-only key for your frontend. Enter its reference; your app decides whether to publish its value." }
+      hint: "Optional search-only key for your frontend. Enter its reference; your app decides whether to expose its value." }
   ],
   setup: {
     url: "https://www.algolia.com/doc/guides/security/api-keys",
@@ -22,7 +22,7 @@ const algoliaDefinition = Object.freeze({
       "Copy the new backend key. Enter env:ALGOLIA_API_KEY in API key reference here and save. Choose Set credential in Env for ALGOLIA_API_KEY, paste its value and save it there.",
       "If the frontend will search Algolia directly, create a separate key with Search (search) access restricted to indices safe for those users to read. Enter env:ALGOLIA_SEARCH_KEY in Public API key reference (optional), save, then use its Set credential in Env link to store that key value.",
       "Return here and choose Connect account (or Verify again for an existing connection). Check connection only reads the application’s saved status. No OAuth registration or callback URL is needed. Verification lists indices with the backend key; it does not validate the optional frontend key.",
-      "If access fails, check the Application ID, selected indices, permissions and key expiry. Your framework owns publishing the optional frontend key; keep the backend key server-side."
+      "If access fails, check the Application ID, selected indices, permissions and key expiry. Your framework owns exposing the optional frontend key; keep the backend key server-side."
     ]
   }
 });

package/src/shared/firebase-cloud-messaging.js

@@ -26,7 +26,7 @@ const firebaseCloudMessagingDefinition = Object.freeze({
     { name: "projectId", label: "Firebase project ID", placeholder: "my-notifications-app", hint: "The project receiving messages. Usually project_id in your JSON; cross-project access requires an IAM grant on this target project." },
     { name: "clientMode", label: "Client setup", items: [{ value: "server", title: "Server or native only" }, { value: "web", title: "Include web push" }],
       hint: "Existing mobile/browser targets need server credentials. Include web push to configure browser registration too." },
-    { name: "apiKey", label: "Firebase API key", placeholder: "AIzaSyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", hint: "Public API key from the Firebase web app configuration. This value is visible in your published app." },
+    { name: "apiKey", label: "Firebase API key", placeholder: "AIzaSyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", hint: "Public API key from the Firebase web app configuration. This value is visible in your deployed app." },
     { name: "appId", label: "Firebase App ID", placeholder: "1:123456789012:web:abcdef1234567890", hint: "Public appId from the same Firebase project and web app." },
     { name: "vapidKey", label: "Web Push VAPID key", placeholder: "BEl62...", hint: "Public key from Project settings > Cloud Messaging > Web Push certificates. Never paste the private VAPID key." }
   ],

package/src/shared/google-maps-platform.js

@@ -18,7 +18,7 @@ const googleMapsPlatformDefinition = Object.freeze({
       "Restrict the server key to Geocoding API and the backend's outbound IPs. Enter env:GOOGLE_MAPS_SERVER_KEY in Server API key reference, Save configuration, then Set credential in Env. Save the real key as GOOGLE_MAPS_SERVER_KEY.",
       "For places and routes, also enable Places API (New) and Routes API in Library, then add them to the server key API restrictions. Place names/address/location use billable data fields; set quotas and review current pricing. Geocoding verification does not test these additional APIs.",
       "For browser maps, enable Maps JavaScript API. Open Google Maps Platform > Map management > Create map ID, select JavaScript and copy the ID into Map ID. The app loads Google's SDK with its separate browser key and gives the map container a height. Advanced markers require a map ID.",
-      "For browser maps, create a separate key restricted to the required browser APIs and Websites, including the actual preview and custom domains. Enter env:GOOGLE_MAPS_BROWSER_KEY in Browser API key reference and save that value separately in Env. The app publishes this browser key; never publish the server key.",
+      "For browser maps, create a separate key restricted to the required browser APIs and Websites, including the actual preview and custom domains. Enter env:GOOGLE_MAPS_BROWSER_KEY in Browser API key reference and save that value separately in Env. The app exposes this browser key; never expose the server key.",
       "Save configuration, enter Verification address, then Connect account. This performs one potentially billable geocoding request. It verifies only the server key, not browser maps. No OAuth registration or callback is needed.",
       "Update Env when replacing a key. Disconnect removes local connection state; delete or restrict the key in Google Cloud to revoke provider access. Check existing usage before deleting a key used by other applications."
     ]

package/src/shared/google.js

@@ -84,7 +84,7 @@ const googleSearchConsoleDefinition = definition("google-search-console", "Googl
   "The connecting Google account needs access to the intended Search Console property. A property owner can open that property, choose Settings > Users and permissions > Add user, enter the account email, choose the appropriate role and save.",
   "To add a property, open Search Console > property selector > Add property. Domain properties require your DNS provider's TXT record; URL-prefix properties offer verification methods such as an HTML file or tag. Follow Google's displayed instructions and Verify, or have an existing owner add this account. An OAuth grant does not verify domain ownership.",
   "Search performance uses finalized Pacific-time dates and top rows, not a complete traffic export. URL inspection reports Google's indexed snapshot, not a live page test or request for indexing. Use the exact property identifier returned by the connection.",
-  "To submit or remove sitemaps, select Manage Search Console properties (webmasters), add the scope in Data Access and reconnect. The app must publish a real sitemap URL first. Submission does not create the file, guarantee indexing or change DNS; deletion removes its Search Console entry, not the hosted file.",
+  "To submit or remove sitemaps, select Manage Search Console properties (webmasters), add the scope in Data Access and reconnect. The app must serve a real sitemap URL first. Submission does not create the file, guarantee indexing or change DNS; deletion removes its Search Console entry, not the hosted file.",
   "Keep Read Search Console properties for the initial check, which lists accessible properties. Site Verification permissions alone do not authorize that check or create property access. An empty result can mean this Google account has no properties."
 ]);
 const googleAnalyticsDefinition = Object.freeze({
@@ -98,7 +98,7 @@ const googleAnalyticsDefinition = Object.freeze({
     validator: (value) => /^G-[A-Z0-9]+$/u.test(value) || "Enter the GA4 web stream Measurement ID beginning G-."
   } }),
   settingsFields: [{ name: "measurementId", label: "Measurement ID", required: true,
-    hint: "Public: this value will be visible in your published application. Copy it from your GA4 web stream." }],
+    hint: "Public: this value will be visible in your deployed application. Copy it from your GA4 web stream." }],
   setup: {
     url: "https://support.google.com/analytics/answer/9304153",
     steps: [

package/src/shared/logo-dev.js

@@ -3,11 +3,11 @@ const logoDevDefinition = Object.freeze({
   accountModes: ["shared", "assistant"], authenticationMethods: ["api-key"], scopes: [],
   runtimeKind: "public-resource", configurationOnly: true,
   apiKeyReferenceLabel: "Publishable key reference",
-  apiKeyReferenceHint: "Reference a pk_ key. Your application publishes its value in image URLs. A private sk_ key cannot be used for this image flow.",
+  apiKeyReferenceHint: "Reference a pk_ key. Your application exposes its value in image URLs. A private sk_ key cannot be used for this image flow.",
   setup: {
     url: "https://www.logo.dev/docs/platform/api-keys",
     steps: [
-      "Sign into https://www.logo.dev/dashboard/api-keys and copy the publishable key beginning pk_. Do not copy the private sk_ key: this integration displays images, and its pk_ value will be visible in the published application's image URLs.",
+      "Sign into https://www.logo.dev/dashboard/api-keys and copy the publishable key beginning pk_. Do not copy the private sk_ key: this integration displays images, and its pk_ value will be visible in the deployed application's image URLs.",
       "Enter env:LOGO_DEV_PUBLISHABLE_KEY in Publishable key reference, then Save configuration. Choose Set credential in Env and store the actual pk_ value as LOGO_DEV_PUBLISHABLE_KEY. Return after saving Env. Your application must resolve this reference and expose only this publishable value to its image code.",
       "In Logo.dev API Keys, enable Allowed Domains Only, enter allowed domains one per line, then Save Changes. Include the application's actual hosting/custom domain and intended preview domains. example.com matches that domain; *.example.com matches its subdomains. Add localhost explicitly if needed for local development.",
       "Before enabling restrictions, ensure image requests send an origin referrer. Use referrerpolicy=origin on the image or an equivalent application policy; no-referrer and same-origin policies block cross-site referrers. Unlisted domains or missing referrers cause image failures.",

package/src/shared/mapbox.js

@@ -14,7 +14,7 @@ const mapboxDefinition = Object.freeze({
   }),
   settingsFields: [{ name: "usage", label: "Mapbox usage", credentialScope: value => value,
     items: [{ title: "Backend geocoding and optional browser maps", value: "backend" }, { title: "Browser maps only", value: "browser" }] }, { name: "publicTokenRef", environmentCredential: { label: "Public browser token", public: true }, label: "Public browser token reference", placeholder: "env:MAPBOX_PUBLIC_TOKEN",
-    hint: "Required for browser-only mode; optional with backend geocoding. Separate pk. token for Mapbox in your browser. The application may publish this value; backend verification does not verify its restrictions." }],
+    hint: "Required for browser-only mode; optional with backend geocoding. Separate pk. token for Mapbox in your browser. The application may expose this value; backend verification does not verify its restrictions." }],
   setup: {
     url: "https://docs.mapbox.com/accounts/guides/tokens/",
     stepsForSettings(settings) { return settings?.usage === "browser" ? [
@@ -26,7 +26,7 @@ const mapboxDefinition = Object.freeze({
     ] : this.steps; },
     steps: [
       "Sign into Mapbox Developer Console → Access Tokens → Create a token. Name it for this application and environment. Select only the scopes your APIs need; geocoding can use a public pk. token. Copy a secret sk. token immediately: it is shown only once.",
-      "For backend geocoding, enter env:MAPBOX_BACKEND_TOKEN in Backend access token reference. Use a token without browser URL restrictions: backend requests have no browser referrer. Never publish a secret sk. token in browser code.",
+      "For backend geocoding, enter env:MAPBOX_BACKEND_TOKEN in Backend access token reference. Use a token without browser URL restrictions: backend requests have no browser referrer. Never expose a secret sk. token in browser code.",
       "For browser maps, create a separate public pk. token with the SDK’s map scopes, including styles:read and fonts:read. Enter env:MAPBOX_PUBLIC_TOKEN in Public browser token reference. The application must deliberately load this public value; this connector does not render a map.",
       "Restrict the browser token to the deployed application URLs, adding preview, custom domains and localhost when needed. Create a new token rather than using the default public token, which cannot be URL-restricted. Wildcards are unsupported; blocking the Referer header can cause 403 errors.",
       "Save configuration, then use Set credential in Env for MAPBOX_BACKEND_TOKEN and Open Env for MAPBOX_PUBLIC_TOKEN if supplied. Store token values there, not in reference fields. Connect account verifies only the backend token’s validity; it does not test geocoding entitlement or the optional browser token. No OAuth app or callback URL is needed.",

package/src/shared/tokens.js

@@ -655,7 +655,7 @@ const lexwareDefinition = definition("lexware", "Lexware", "Read accounting cont
     "Draft invoices require an existing contact UUID, invoice and service/delivery dates with timezones, and custom lines with quantity, unit, net EUR amount and tax rate. Choose those accounting values in the app; the connector does not infer tax. Review and finalize drafts in Lexware. No email or payment is sent.",
     "An interrupted invoice creation may already have succeeded. Check the voucher list before repeating it. Respect the provider limit of two requests per second across endpoints. The app must authorize each contact/document and approve writes before calling the connector.",
     "This adapter does not create contacts/articles/vouchers, download PDFs, finalize invoices, upload receipts or receive accounting events. For example, it can prepare a draft booking invoice for an existing customer, but receipt intake and signed event processing need native app implementation.",
-    "No OAuth registration or callback URL is needed. Verification reads contacts. Keys expire after at most 24 months: create a replacement and update Env before expiry. Public API does not mean the key is safe to publish."
+    "No OAuth registration or callback URL is needed. Verification reads contacts. Keys expire after at most 24 months: create a replacement and update Env before expiry. Public API does not mean the key is safe to expose."
   ]);
 const sevdeskDefinition = Object.freeze({
   ...definition("sevdesk", "Sevdesk", "Read sevdesk contact organizations and people with offset pagination.",
@@ -683,7 +683,7 @@ const attentionDefinition = definition("attention", "Attention", "Read conversat
     "Sign into app.attention.tech as an organization administrator. Open your profile avatar at the top left, Settings, then Organization > API Keys.",
     "Choose + Create API Key at the top right and give it a name identifying this application. Copy the value in API Key Created before closing; it is shown once.",
     "Enter env:ATTENTION_API_KEY in API key reference here and save. Choose Set credential in Env, paste the key as the ATTENTION_API_KEY value and save it there. Return here and choose Connect account (or Verify again when already connected). Check connection only reloads status.",
-    "An organization key can expose broad read/write and user-management access. Your application must restrict each operation to authorized users; never publish this key in frontend code. New users require an explicit listener or recording seat choice; check your Attention plan before enabling provisioning.",
+    "An organization key can expose broad read/write and user-management access. Your application must restrict each operation to authorized users; never expose this key in frontend code. New users require an explicit listener or recording seat choice; check your Attention plan before enabling provisioning.",
     "No OAuth registration or callback URL is needed. Verification reads a conversation page without changing recordings or CRM data.",
     "To replace access, create a new key and update Env, then verify before opening the old key's three-dot menu and choosing Delete. Deletion immediately stops every application still using that old key. Disconnect here removes the local grant only; revoke the key in Attention to stop provider access."
   ]);

package/test/ai.test.js

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import { readFile } from "node:fs/promises";
-import { aiCatalogue, aiDefinition, DEFAULT_AI_MODEL, getAiModel, listAiModels } from "../src/shared/ai.js";
+import { aiCatalogue, aiDefinition, getAiModel, listAiModels } from "../src/shared/ai.js";
 import { createAiConnectionResolver } from "../src/server/ai.js";
 import { createEnvironmentReferenceResolver } from "../../connectors-core/src/server/environmentReferences.js";
 import { parseIntegrationConfiguration, validateIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
@@ -17,9 +17,10 @@ const validate = (config) => validateIntegrationConfiguration(config, { provider
 test("AI retains the attributed snapshot with reviewed current identities and explicit deprecations", () => {
   assert.equal(aiCatalogue.extractedAt, "2026-09-10");
   assert.equal(aiCatalogue.providers.length, 213);
-  assert.equal(listAiModels({ includeDeprecated: true }).length, 7615);
+  assert.equal(listAiModels({ includeDeprecated: true }).length, 7614);
   assert.match(aiCatalogue.sourceSha256, /^[a-f0-9]{64}$/u);
   assert.equal(getAiModel("opencode/grok-code").status, "deprecated");
+  assert.equal(getAiModel("opencode/big-pickle"), undefined);
   assert.equal(listAiModels().some((model) => model.key === "opencode/grok-code"), false);
   assert.equal(aiCatalogue.providers.find((provider) => provider.id === "amazon-bedrock").connection, "framework");
 });
@@ -49,10 +50,10 @@ test("DeepSeek retains provider-supported saved aliases and exact current model
   assert.deepEqual(pro.modalities.input, ["text"]);
 });
 
-test("AI lists every active Zen public model first and uses Big Pickle as the explicit default", () => {
-  assert.equal(listAiModels()[0].key, DEFAULT_AI_MODEL);
+test("AI lists every active Zen public model first", () => {
+  assert.equal(listAiModels()[0].access, "free-no-setup");
   assert.deepEqual(listAiModels({ access: "free-no-setup" }).map((model) => model.id).sort(), [
-    "big-pickle", "ling-3.0-flash-fin-free", "mimo-v2.5-free", "muse-spark-1.2-contributor-free",
+    "ling-3.0-flash-fin-free", "mimo-v2.5-free", "muse-spark-1.2-contributor-free",
     "muse-spark-1.3-contributor-free", "nemotron-3-ultra-free", "nemotron-3.5-lightning-free"
   ].sort());
   assert.equal(getAiModel("zai/glm-4.7-flash").access, "free-with-connection");
@@ -63,17 +64,23 @@ test("AI lists every active Zen public model first and uses Big Pickle as the ex
   }
 });
 
-test("AI JSON defaults agree with the form and preserve explicit free model choices", () => {
-  const config = validate(configuration());
-  assert.deepEqual(config.integrations.suggestions.settings, { model: "opencode/big-pickle" });
-  assert.deepEqual(config.integrations.suggestions.authentication, { method: "none" });
-  config.integrations.suggestions.settings.model = "opencode/mimo-v2.5-free";
+test("AI has no default model or keyless default and preserves explicit free model choices", () => {
+  assert.equal(aiDefinition.authenticationMethods[0], "api-key");
+  assert.deepEqual(aiDefinition.authenticationMethodsForSettings({}), ["api-key"]);
+  assert.throws(() => validate(configuration()), (error) => {
+    assert.ok(error.fieldErrors["integrations.suggestions.settings.model"]);
+    assert.ok(error.fieldErrors["integrations.suggestions.authentication.method"]); return true;
+  });
+  assert.throws(() => validate(configuration({ authentication: { method: "api-key", secretRef: "env:KEY" } })), (error) => {
+    assert.deepEqual(Object.keys(error.fieldErrors), ["integrations.suggestions.settings.model"]); return true;
+  });
+  const config = validate(configuration({ settings: { model: "opencode/mimo-v2.5-free" } }));
   assert.deepEqual(parseIntegrationConfiguration(JSON.stringify(config), { providers: [aiDefinition] }), config);
   assert.equal(JSON.stringify(config).includes("public"), false);
 });
 
 test("AI refuses missing models, deprecated models, coding subscriptions and unsupported cloud setup", () => {
-  for (const model of ["opencode/removed", "opencode/grok-code", "zai-coding-plan/glm-4.7", "amazon-bedrock/anthropic.claude-v2", "constructor"]) {
+  for (const model of ["opencode/removed", "opencode/grok-code", "opencode/big-pickle", "zai-coding-plan/glm-4.7", "amazon-bedrock/anthropic.claude-v2", "constructor"]) {
     assert.throws(() => validate(configuration({ settings: { model } })), { code: "integration_configuration_invalid" });
   }
   for (const model of ["zai/glm-4.7-flash", "zai/glm-4.7", "openai/gpt-5.4"]) {
@@ -87,12 +94,12 @@ test("AI refuses missing models, deprecated models, coding subscriptions and uns
   }
 });
 
-test("AI resolves no-account SDK parameters without environment, network or an OpenCode runtime", async (t) => {
+test("AI resolves explicit no-account SDK parameters without environment, network or an OpenCode runtime", async (t) => {
   t.mock.method(globalThis, "fetch", () => { throw new Error("Network is forbidden in this resolver."); });
-  const resolver = createAiConnectionResolver({ configuration: configuration(), authorize,
+  const resolver = createAiConnectionResolver({ configuration: configuration({ settings: { model: "opencode/mimo-v2.5-free" } }), authorize,
     resolveReference: () => { throw new Error("Free mode must not resolve credentials."); } });
-  assert.deepEqual(await resolver.resolve(request), { providerId: "opencode", model: "big-pickle",
-    modelLimits: getAiModel(DEFAULT_AI_MODEL).limit,
+  assert.deepEqual(await resolver.resolve(request), { providerId: "opencode", model: "mimo-v2.5-free",
+    modelLimits: getAiModel("opencode/mimo-v2.5-free").limit,
     sdkPackage: "@ai-sdk/openai-compatible", baseURL: "https://opencode.ai/zen/v1", apiKey: "public", access: "free-no-setup" });
   assert.equal(globalThis.fetch.mock.callCount(), 0);
   assert.equal(Object.hasOwn(resolver, "invoke"), false);
@@ -153,10 +160,11 @@ test("AI denies unauthorized subjects before looking up credentials and redacts
 });
 
 test("AI can hand parameters to an app-owned SDK without making that SDK a dependency", async () => {
-  const result = await createAiConnectionResolver({ configuration: configuration(), authorize }).resolve(request);
+  const result = await createAiConnectionResolver({ configuration: configuration({ settings: { model: "zai/glm-4.7-flash" },
+    authentication: { method: "api-key", secretRef: "env:KEY" } }), authorize, resolveReference: () => "test-key" }).resolve(request);
   // A controlled SDK factory fixture; no generated application or inference call.
   const createProvider = (options) => ({ model: (id) => ({ endpoint: options.baseURL, id }) });
-  assert.deepEqual(createProvider(result).model(result.model), { endpoint: "https://opencode.ai/zen/v1", id: "big-pickle" });
+  assert.deepEqual(createProvider(result).model(result.model), { endpoint: "https://api.z.ai/api/paas/v4", id: "glm-4.7-flash" });
   const pkg = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));
   assert.equal(Object.keys(pkg.dependencies).some((name) => name.startsWith("@ai-sdk/") || name.includes("opencode")), false);
 });