@jskit-ai/connectors-catalog 0.1.63 → 0.1.65

package/docs/google-ads.md

@@ -64,7 +64,7 @@ reader. The editor no longer asks for a token or pilot selection.
 ```
 
 Replace the placeholders with project-owned resources. Secrets and grants stay
-with the application. CLI, public Vibe64 and Online use the same configuration;
+with the application. A CLI and every editor use the same configuration;
 Laravel implements it with its own framework. Host/domain changes require the
 provider registration and callback Env value to match the application's new
 callback. Keep persistent grants and application identity when moving hosts.
@@ -115,16 +115,6 @@ provider error bodies and query echoes are not exposed. Requests respect abort
 signals/timeouts and are not replayed automatically. Disconnect removes local
 access; Google account revocation is a separate owner action.
 
-## Verification boundary
-
-Focused tests use controlled OAuth and Ads HTTP responses with the real shared
-validator and encrypted file store. They cover Cloud-project configuration, OAuth/header
-separation, query/page bounds, int64 preservation, empty/malformed results,
-restart, concurrent refresh/rotation, ownership, policy, denied consent, errors
-and interruption. No live accounts, Cloud-project approvals, reports,
-campaign actions or generated applications are used. Provider approval and live
-consent remain separate acceptance work.
-
 ## Existing-account Search campaign service
 
 `@jskit-ai/connectors-catalog/server/google-ads-search` exports
@@ -154,3 +144,55 @@ live coding-assistant tool attachment. For example, asking chat to create a new
 Ads account and autonomously optimize a PMax campaign remains unsupported. The
 current editor command uses development Env and may affect a real Ads account.
 Fixtures prove composition and request/approval behavior, not Google live approval.
+
+## OAuth pattern composition: Google Ads
+
+Use `googleAdsProvider` from `@jskit-ai/connectors-catalog/server/google-ads`
+with the same file service and owner policy. Start from the actual portable JSON
+in this guide. Setup needs a Web OAuth client in a Cloud project
+with the required Google Ads API access level. Developer tokens were retired
+on September 9, 2026; do not add a developer-token reference or pilot selector.
+The app owns its registration and grants. This does not establish app login
+or make arbitrary reports public.
+
+`customers.listAccessible` verifies the grant and returns directly accessible
+customer resource names. It does not list every manager descendant. Use
+`customers.listClients` for an authorized manager's hierarchy metadata, keeping
+the operation customer ID separate from optional `settings.loginCustomerId`.
+For a useful campaign report, the existing server action can call:
+
+```js
+const report = await connections.invoke({
+  context: authenticatedContext,
+  integrationId: "ads",
+  operation: "reports.search",
+  input: {
+    customerId: authorizedCustomerId,
+    query: "SELECT campaign.id, campaign.name, metrics.impressions, metrics.clicks, metrics.cost_micros FROM campaign WHERE segments.date DURING LAST_7_DAYS LIMIT 100"
+  },
+  signal
+});
+```
+
+Derive `authorizedCustomerId` from the app's existing account-access policy.
+Authorize fields, date ranges and filters too; do not send arbitrary browser/AI
+GAQL to a public server route. The library passes the operation and input
+snapshot to the host policy before credentials or API requests. Google's
+`adwords` permission may allow writes, despite this operation set's reads.
+
+Render `report.results ?? []`; retain integer strings and cost micros without
+rounding. Keep `nextPageToken` with the exact query/customer/owner for an explicit
+next call. No automatic page loop or SearchStream endpoint is installed. API
+errors can reflect developer approval, account relationships or quotas even
+after valid OAuth consent. Map `connector_api_access_invalid` to API setup,
+`connector_scope_missing` and `connector_reconnect_required` to consent recovery,
+and `connector_rate_limited` to the app's bounded usage policy. Never solve API
+approval by repeatedly asking the user to reconnect.
+
+The provider guide includes console clicks, API/CLI automation feasibility,
+application-owned callback configuration and account quota boundaries.
+Different client IDs do not automatically separate developer-token capacity;
+approved pilot projects can have usage caps while organization/account limits
+still apply. The CLI uses exactly this library and file configuration without
+Vibe64. No generated app or live provider operation is required to validate the
+configuration, run the focused provider tests or read the [OAuth pattern](../patterns/oauth-connection/PATTERN.md).

package/docs/google-analytics.md

@@ -55,8 +55,8 @@ The shared field component and CLI validator use this same format. The public ID
 framework can expose it through its normal public build configuration. No
 secret-resolution service is needed.
 
-Vibe64 Public owns the editor experience. Online uses that same experience and
-the selected project's configuration. Saving must report **Configured**, with
+The editor owns the configuration experience for the selected project. Saving
+must report **Configured**, with
 an explanation that application wiring and event delivery are separate. It must
 not start OAuth, call a connection-status command, send a test tracking event,
 or show an account as verified. Changing or removing the setting is an ordinary

package/docs/google-maps-platform.md

@@ -132,16 +132,10 @@ editor VM URL does not substitute for either. These API keys are unrelated to
 Google login or OAuth callback registration.
 [Client/server restrictions](https://developers.google.com/maps/api-security-best-practices).
 
-## Focused evidence
-
-Six fixture tests cover explicit verification input, file restart, rotation,
-owner isolation, separate browser references, input bounds, empty responses,
-HTTP-200 errors and transport failures. Editor browser tests cover both
-reference fields, invalid values, reload and optional-field removal. The runtime
-does not automatically retain geocoding results; applications own display and
-retention behavior under the provider's requirements. No live provider use or
-sample-app generation is part of this evidence.
+## Result retention
 
+The runtime does not automatically retain geocoding results; applications own
+display and retention behavior under the provider's requirements.
 
 ## Places, routes and browser composition
 

package/docs/granola.md

@@ -108,7 +108,7 @@ state. Revoke access separately in the personal or workspace API-key page using
 **Revoke**, then its confirmation dialog. [Key management](https://docs.granola.ai/help-center/sharing/integrations/granola-api)
 
 There is no provider OAuth application or universal callback URL for this API-key
-mode. Online VPS and custom-domain changes do not change API authentication.
+mode. Hosting and custom-domain changes do not change API authentication.
 Keep stable application/owner identity and runtime reference bindings.
 
 The application owner supplies its own authorized key through private Env. Do

package/docs/hubspot.md

@@ -140,3 +140,28 @@ operations. Example: a booking app can create a linked deal and advance its stag
 but it must supply the trigger and cannot import an entire CRM automatically.
 Assistant tool attachment requires explicit host integration. Fixture success does not prove live CRM
 installation, property availability, subscription features or generated-app use.
+
+## OAuth pattern composition: HubSpot account connections
+
+Import `hubspotProvider` from `@jskit-ai/connectors-catalog/server/hubspot`.
+Use this guide registration instructions. Configure an own
+registration with `clientId`, `clientSecretRef: "env:HUBSPOT_CLIENT_SECRET"`,
+`callbackUrlRef: "env:HUBSPOT_CALLBACK_URL"` and
+`tokenEndpointAuthMethod: "client_secret_post"`. Select scopes `oauth` and
+`crm.objects.contacts.read`; the integration's authentication is
+`{ "method": "oauth2", "registrationRef": "hubspot" }` when that registration
+is named `hubspot`.
+
+Use `beginAuthorization`, the existing application's callback route and
+`completeAuthorization`, then `contacts.list` with optional `limit`, `after`
+and `archived`. Verification reads contacts. The provider implements confidential
+code exchange, scope-array normalization and refresh through HubSpot's current
+token endpoint; do not build another token exchange or gateway.
+
+For `per-user`, the application's authenticated identity owns each local grant.
+HubSpot installations normally expose account-level CRM access; this mode does
+not itself enforce HubSpot record ownership or implement application login.
+For `shared`, only authorized app administrators can connect the shared account.
+Use the [API-key pattern](../patterns/api-key-connection/PATTERN.md) instead for a static/private token, retaining the
+`crm.objects.contacts.read` configuration permission. Disconnect is local;
+provider installation removal is separate.

package/docs/klipy.md

@@ -111,19 +111,6 @@ Outbound reads need no OAuth callback, so VM subdomains and custom deployment
 domains do not alter authentication. Record the intended application URL in
 provider setup and satisfy its content/attribution agreement in the application.
 
-## Focused evidence
-
-Fixtures check trending verification, search encoding, pagination bounds,
-locale/filter errors, unsuccessful envelopes, key rotation, private file-store
-restart, owner isolation and provider failures. Core tests cover path encoding,
-invalid destinations, ambiguous prefixes and error redaction. The editor test
-checks the secret reference, setup link and reload persistence. No live key,
-production approval, media use or generated sample application is exercised.
-
-The official Partner Panel guide was rechecked on 2026-09-12. Expanded screen
-steps cover Env handoff, connection verification, production approval and local
-disconnect. Updated rendered review passed using simulated connection responses.
-
 ## Embedding and limits
 
 The application supplies its own picker and native HTTP/runtime wiring in any

package/docs/lexware.md

@@ -95,14 +95,6 @@ provides an independent allowance. Apply usage limits in the application and
 confirm provider capacity before claiming quota isolation.
 [API rate limits](https://developers.lexware.io/docs/).
 
-## Focused evidence
-
-Simulated replies and real temporary file state verify authentication, restart,
-rotation, ownership, disconnect, empty/full contact pages, role filters,
-fractional/oversized input rejection and malformed/provider failures. The
-editor check verifies reference-only storage and persistence after reload.
-Live provider accounts, billing changes and sample-app generation are excluded.
-
 ## Accounting operations
 
 `contacts.get`, `articles.get`, `invoices.get`, `vouchers.get` take a resource UUID.

package/docs/lightspeed.md

@@ -118,9 +118,10 @@ do not repeatedly retry the spent refresh token.
 ## Application ownership, callbacks and capacity
 
 The application owner creates the provider registration and stores its secret
-in the application's private Env. Public Vibe64, Vibe64 Online and CLI users use
-this same ownership model. The configuration file holds the client ID and Env
-references; the editor does not own the application's grants.
+in the application's private Env. Every editor and CLI uses this same
+[ownership model](../../connectors-core/docs/online-setup.md): the configuration
+file holds the client ID and Env references; the editor does not own the
+application's grants.
 
 Register the exact callback implemented by the application. For a hosted project,
 start with its assigned application URL and append the implemented callback path.
@@ -191,3 +192,31 @@ gift-card/store-credit workflows, webhook receiver or automatic editor tool
 attachment. Example: an app can report low stock and sales totals, but cannot
 replenish a shelf or charge a customer through this adapter. Adding a write scope
 does not implement a write operation. No live retailer or generated app was used.
+
+## OAuth pattern composition: Lightspeed X-Series
+
+Import `lightspeedProvider` from `@jskit-ai/connectors-catalog/server/lightspeed`
+and give it to the existing connection service. Use the JSON and provider setup
+in this guide. The store prefix is required and fixed before consent;
+never route credentials using a callback-supplied domain. Keep `products:read`
+for verification and pass `verificationInput: { page_size: 1 }` when starting it.
+
+```js
+const products = await connections.invoke({
+  context: authenticatedOwner, integrationId: "retail", operation: "products.list",
+  input: { page_size: 50, deleted: false }
+});
+```
+
+`customers.list` and `outlets.list` use the same paging inputs with their own read
+scopes. Request subsequent pages explicitly with version bounds. Preserve null
+customer values and avoid assuming a full page means more records certainly exist.
+The library pins the current API version, validates store-bound token responses,
+and persists each rotated refresh token before reading data. It sends PKCE;
+provider enforcement has not been proven with a live client. Do not add retries
+around authorization codes, refresh or interrupted requests.
+
+The host owns authenticated subjects, shared-store access, callback routes and
+rendering. CLI and UI use the same configuration; no database is required for
+editor configuration. Each application supplies its own registration and callback; app sign-in is a separate concern. Extra
+scope selections do not create write operations or independent provider quotas.

package/docs/linear.md

@@ -99,13 +99,6 @@ permit writes at Linear. Discovery does not execute tools. Use `tools.list` to
 obtain available schemas rather than maintaining a second catalogue here.
 [Linear MCP authentication](https://linear.app/docs/mcp).
 
-## Review evidence
-
-The focused fixture tests cover OAuth authorization, cancellation/denial, replay,
-refresh rotation after restart, app/user isolation, lost scopes, raw API-key
-GraphQL authorization and Bearer MCP discovery. No real Linear account, issue,
-consent or tool execution was used. Both credential modes passed a controlled public-editor browser review: configuration survives reload, Env links and provider guides resolve to the intended destinations, and simulated connection controls work. The 496px instruction captures were visually inspected; no live provider consent or fresh phone review is claimed.
-
 ## Approved project and issue workflows
 
 The existing MCP transport can discover and invoke the provider's project/issue
@@ -134,3 +127,27 @@ assistant tool attachment. Example: an app can explicitly run an approved
 issue update, but saving a Linear connection alone does not authorize assistant chat to update that issue. Provider permissions and available tools determine what
 can run. Fixture workflows prove argument/result transport and local denial, not
 actual Linear tool schemas or live execution.
+
+## OAuth pattern composition: Linear account connections
+
+Import `linearProvider` from `@jskit-ai/connectors-catalog/server/linear` and
+follow this guide to create the project's own registration. Store its
+Client ID in configuration, Client Secret in `env:LINEAR_CLIENT_SECRET`, and
+callback in `env:LINEAR_CALLBACK_URL`; select `client_secret_post`.
+Use authentication `{ "method": "oauth2", "registrationRef": "linear" }`
+when the registration is named `linear`, and keep `scopes: ["read"]`.
+
+The application calls `beginAuthorization`, handles its registered callback with
+`completeAuthorization`, then invokes `profile.read` or `issues.list` (optional
+`first` and `after`). The provider owns S256, scope delimiter normalization and
+rotating refresh. The caller owns authorization and subject identity. Shared
+connections belong to the application's authorized administrator; per-user
+connections belong to the signed-in application user. Connecting Linear does not
+implement application login. This flow acts as the consenting Linear user.
+
+The same grant supports `tools.list` and `tools.call` against Linear's fixed MCP
+endpoint. Authorize each tool and its arguments before invocation; tools can
+write if the provider permissions allow it. No second MCP registration or Vibe64
+gateway is needed. For personal keys use the [API-key pattern](../patterns/api-key-connection/PATTERN.md), keep the `read`
+configuration scope and restrict the actual key in Linear. Disconnect deletes
+the local grant; provider revocation remains a separate account action.

package/docs/linkedin.md

@@ -155,20 +155,7 @@ Separate client IDs do not establish independent quotas or permission to serve
 unrelated applications. Register and obtain product approval for the actual app.
 Managed assignments are invalid configuration in this runtime.
 
-
-## Credential guidance review (2026-09-12)
-
-The inline setup steps now name the developer portal, product approval, exact
-callback registration and project Env handoff before connection. Current OIDC,
-authorization-code and refresh documentation were checked. The existing adapter
-was retained; no provider-login or publishing implementation was added. Ten
-focused runtime fixtures pass, including expiry without refresh, approved
-refresh, cancellation/replay, encryption, missing permissions and host isolation.
-The cancellation test now expects the callback URL exposed by connection status,
-while retaining the complete assertion that declined replacement consent keeps
-the previous grant. Rendered guidance passed the controlled public-editor journey: saved Client ID/callback, Env links, reload, simulated consent/cancellation/reconnect and disconnect. All six steps were visually reviewed at 496px width. No live provider consent or fresh phone review is claimed.
-
-## Text publishing acceptance — 2026-09-13
+## Text publishing
 
 Use `posts.create` with `{ text, visibility: "PUBLIC" }` or `"CONNECTIONS"` after
 app authorization of the exact message and audience. Text is locally limited to
@@ -192,5 +179,18 @@ request; a timeout does not prove the post was never created.
 
 **LIMITATIONS:** Text only. No images/video, organization posts, scheduling, post
 editing/deletion, analytics or editor-assistant attachment. Example: publish an
-approved announcement, but not a photo campaign. Prior September12 review above
-is historical. Current tests use simulated provider responses, not live publishing.
+approved announcement, but not a photo campaign.
+
+## OAuth pattern composition: LinkedIn
+
+Use `linkedinProvider` from `@jskit-ai/connectors-catalog/server/linkedin` and
+this guide. Both `openid` and `profile` are required; request `email`
+only when needed. `profile.read` accepts no input and reads the connected
+member's userinfo. Optional email fields may be absent. The fragment discards
+ID tokens and does not implement app login or member posting; preserving
+`w_member_social` in configuration does not provide a publishing operation.
+Ordinary expiry requires reconnect unless LinkedIn approved programmatic
+refresh. Keep the confidential client secret on the backend, including when
+composing a CLI; the separately enabled native flow is not implemented.
+Implement and register the application's callback using its assigned app URL
+or explicit host override. Operator setup belongs to the application developer.

package/docs/logo-dev.md

@@ -110,32 +110,14 @@ domain matters only if it itself loads the images. That differs from an OAuth
 redirect allowlist. Changing application domains can require provider-side
 restriction updates even though the portable reference is unchanged.
 
-## Focused evidence
+## Configuration-only contract
 
-Node tests cover options, encoding boundaries, private-key rejection, portable
-configuration and the absence of false server verification. The ordinary
-source pattern is checked with a supplied resolver. Editor/browser tests cover
-save/reload, reference validation, actual image loading from a simulated CDN
-and a simulated missing-image failure. No live provider use or generated sample
-application is needed.
+Logo.dev sets `configurationOnly`: an editor shows no account-connect controls,
+and setup commands are refused before Env preparation or application execution.
+Constructing an image URL never records Connected; image delivery is observed in
+the browser.
 
-
-## Credential guidance review (2026-09-12)
-
-Current provider key and image documentation were checked against the captured
-publishable-key field. The inline instructions now give the direct dashboard
-URL, exact reference and Env handoff, public/private distinction, domain patterns,
-referrer behavior and support-assisted rotation. The existing image library and
-public-image composition pattern remain the owners of URL generation and wiring.
-The first rendered review exposed an account-connect button because the editor
-consumes configurationOnly metadata rather than runtimeKind. Logo.dev now sets
-that existing flag: the editor omits account controls and the server refuses
-setup commands before Env preparation or application execution. Two targeted
-public-editor tests cover this rule for Logo.dev and Google Analytics.
-All four focused library tests passed, including private-key rejection, fixed-origin URL
-construction, portable configuration and selective reference resolution. Rendered guidance and simulated image delivery passed: the actual editor persists the reference through reload, links to Env and the provider guide, and offers no account-connect controls. Browser image load/error and origin-referrer behavior were checked with a simulated CDN. All five steps were visually reviewed at 496px width; no live provider or generated-app claim.
-
-## Lookup coverage — 2026-09-13
+## Lookup inputs
 
 Supply exactly one of `domain`, `ticker` or `email` to the same URL helper.
 `{ ticker: "SHEL.L" }` uses the provider's ticker endpoint with an exchange suffix;
@@ -143,7 +125,7 @@ Supply exactly one of `domain`, `ticker` or `email` to the same URL helper.
 lookup. The personal part of the email never enters the URL. These are ordinary
 per-image application inputs, not project credential settings. The same source
 pattern resolves the publishable key; other frameworks can construct equivalent
-URLs without a Node runtime or Vibe64 service.
+URLs without a Node runtime.
 [Ticker endpoint](https://www.logo.dev/docs/logo-images/ticker).
 
 **LIMITATIONS:** No private brand search/enrichment, crypto or ISIN lookup, avatar

package/docs/mailgun.md

@@ -41,8 +41,7 @@ the number of received items to retrieve another page.
 Use the [API-key pattern](../patterns/api-key-connection/PATTERN.md) with the file
 store. Application code can use the operations below with the same configured connection. Local disconnect does not revoke the account key. Replace
 the Env value when rotating credentials, and delete obsolete keys in Mailgun.
-Tests cover both regional origins, HTTP Basic headers, pagination, re-verification,
-file restart and rejected responses without accessing a real mailbox or account.
+Verification is a domain-list read; it sends no email and changes no DNS.
 
 ## Automation and application ownership
 
@@ -57,18 +56,6 @@ Each application supplies credentials for its intended Mailgun account. Keys
 within one account may share capacity and billing. The application operator
 owns account selection and budgets; key names alone do not isolate quotas.
 
-
-## Credential guidance review (2026-09-12)
-
-Current provider key-role, credential-type and domain-list documentation were
-checked against the captured private key and US/EU fields. Inline setup now
-explains the exact dashboard flow, admin requirement, Analyst where available,
-one-time secret display, account-key distinction, region and named Env handoff.
-Verification remains a domain-list read; it sends no email and changes no DNS.
-Three focused test cases passed (1.15s), including the shared regional-destination
-regression: changing region requires verification before credentials reach the
-new allowed origin. No runtime change was needed. The controlled browser review passed: the EU region and MAILGUN_API_KEY reference persist after reload, Env and provider guide links are present, and simulated connect/verify/disconnect work. All six steps were visually inspected at 496px width. No live account, email sending or generated application was exercised.
-
 ## Sending and domain setup
 
 1. In Mailgun, open **Send → Sending → Domains → Add new domain**. Enter a

package/docs/mapbox.md

@@ -123,14 +123,6 @@ that loads the map. Mapbox does not accept wildcard characters in these
 restrictions; consult its matching rules when adding subdomains or custom
 domains. No OAuth callback is involved in these token operations.
 
-## Focused evidence
-
-Six fixture tests cover file restart, rotation, ownership, optional references,
-HTTP-200 validity failures, coordinates, query bounds, attribution, permanent
-intent and permission/quota failures. The editor test covers both reference
-fields, invalid raw values, save/reload and removing the optional value.
-No live Mapbox account, geocoding use or generated application is exercised.
-
 ## Browser-only maps and native SDK composition
 
 Select **Browser maps only** for `settings.usage: "browser"`, authentication

package/docs/microsoft-fabric.md

@@ -199,9 +199,10 @@ the runtime does not perform them automatically or request admin rights.
 ## Application ownership, callbacks and capacity
 
 The application owner creates the provider registration and stores its secret
-in the application's private Env. Public Vibe64, Vibe64 Online and CLI users use
-this same ownership model. The configuration file holds the client ID and Env
-references; the editor does not own the application's grants.
+in the application's private Env. Every editor and CLI uses this same
+[ownership model](../../connectors-core/docs/online-setup.md): the configuration
+file holds the client ID and Env references; the editor does not own the
+application's grants.
 
 Register the exact callback implemented by the application. For a hosted project,
 start with its assigned application URL and append the implemented callback path.
@@ -221,16 +222,6 @@ still requires the relevant approval and configuration.
 Separate registrations support different credentials and policies. They do not
 partition a customer's shared Fabric capacity or guarantee separate quotas.
 
-## Verification boundary
-
-Local automated tests use controlled HTTP responses and encrypted temporary files.
-They cover both grants, endpoint/tenant binding, variables, partial errors,
-renewal, authorization, malformed responses, cancellation and configuration.
-They create no Entra applications, service principals, Fabric resources or sample
-apps and execute no live documents. Real tenant policy, consent, capacity, API
-endpoint reachability, root-type verification and customer schemas remain live
-acceptance checks requiring the owner's credentials.
-
 ## Editor credential handoff
 
 Save the Application ID, tenant GUID, endpoint and reference fields first. The
@@ -247,3 +238,49 @@ connections inside the application. Saving alone grants neither API nor source
 access. Both methods use app-owned credentials and persistent grants.
 
 **LIMITATIONS (acceptance review):** No automatic table browser, schema-specific client, subscriptions, automatic pagination or automatic assistant tool attachment. Example: the app can execute an inventory query using its real schema; this does not provide an inventory dashboard. Both authentication modes and operation/error handling have fixture proof, not live Fabric resource proof.
+
+## OAuth pattern composition: Microsoft Fabric GraphQL
+
+Import `microsoftFabricProvider` from
+`@jskit-ai/connectors-catalog/server/microsoft-fabric`. Read the package's
+this guide before wiring it. Use its portable configuration with
+an exact directory GUID, Application (client) ID, secret reference and the
+existing GraphQL API endpoint. Do not reuse the ordinary Microsoft Graph
+providers or their permissions: Fabric uses a different resource.
+
+User consent uses `authorization_code`, the confidential `client_secret_post`
+method, a callback reference, delegated
+`https://analysis.windows.net/powerbi/api/GraphQLApi.Execute.All` and optional
+`offline_access`. Service accounts use `client_credentials`, the same client
+authentication method, and `https://api.fabric.microsoft.com/.default`. They
+have no callback, user refresh token or per-user ownership. Switching grants
+in the shared UI removes incompatible scopes; choose the new permission before
+saving. The CLI parser enforces the same contract.
+
+Reuse `createConnectionService` or `ConnectorsFeature`, the file connection store
+and existing authorization/reference resolver. Call `connectClientCredentials`
+or `connectors.verifyClientCredentials` for a service account; use the ordinary
+authorization start/callback methods for user consent. The library owns token
+exchange, renewal, locking, scope validation and encrypted storage. The app owns
+the authenticated owner mapping and its allowed GraphQL documents.
+
+Verification runs `connection.check`, a fixed root `__typename` query. It does
+not establish access to every table. `schema.types` uses explicit introspection,
+which a Fabric workspace administrator must enable; an exported SDL is an
+alternative for authoring. `graphql.execute` accepts a document, optional JSON
+variables and an operation name and returns one response. It can execute writes.
+Keep documents in app server code, validate the permitted variables, and use
+the shared authorization callback to restrict each operation. Do not present
+this as a read-only proxy or accept arbitrary documents from app users. Request
+pagination in the app's chosen document; no automatic traversal is implemented.
+
+GraphQL errors, including partial successes, fail without exposing provider
+messages. A failed mutation may have changed data; the runtime does not replay
+it. Cancellation is local interruption, not proof of remote rollback. Token
+renewal persists before the document executes, including when that execution
+fails. Changing tenant, API endpoint, client or grant requires reconnecting.
+
+User consent returns to the application's own implemented and registered callback.
+Service access has no callback. Entra registrations, tenant enablement, API
+permissions and source access remain administrator-owned provisioning. Distinct registration names do not isolate Fabric capacity. The application
+owns login separately and keeps its client secret in private Env.

package/docs/microsoft-oauth.md

@@ -141,3 +141,36 @@ Rotate expiring registration secrets in Env before removing old credentials.
 Do not log token exchange bodies. Tests cover code/state consumption, PKCE,
 permission failures, request boundaries, encrypted file restart and refresh
 rotation for all eight providers.
+
+## OAuth pattern composition: Microsoft document
+
+Import `microsoftWordProvider` or `microsoftPowerPointProvider` from the matching
+`@jskit-ai/connectors-catalog/server/microsoft-word` or
+`@jskit-ai/connectors-catalog/server/microsoft-powerpoint` export. Use that provider
+in the [OAuth pattern](../patterns/oauth-connection/PATTERN.md) composition and the [Word](microsoft-word.md) or [PowerPoint](microsoft-powerpoint.md) guide's JSON. A `files` slot requests
+`Files.Read` and, for refresh capability, `offline_access`. Set `settings.tenantId`
+to an allowed audience or directory GUID matching the registration. The shared
+library uses it for authorization, token exchange and refresh; changing the
+tenant requires reconnecting. Never build token URLs from unvalidated user input.
+
+After consent and verification, the host can call the same service:
+
+```js
+const page = await connections.invoke({
+  context, integrationId: "files", operation: "items.list",
+  input: { folderId, pageSize: 25, nextLink }
+});
+const file = await connections.invoke({
+  context, integrationId: "files", operation: "items.get", input: { itemId }
+});
+```
+
+The host supplies authenticated `context`, an optional `folderId`/`nextLink`
+and the chosen `itemId`. Pass the original folder ID with every continuation.
+Keep `page["@odata.nextLink"]` even if `page.value` is empty: the adapter filters
+an upstream page by file extension, so the next page can contain matching files.
+Display folder and file metadata through the app's existing UI. The returned
+`file` is metadata, not document contents; returned web URLs do not authorize
+additional downloads. These adapters implement no document editing, recursive
+crawl or app login. Leave paging and named-operation HTTP ownership in JSKIT;
+the app owns its file selection, presentation and access policy.

package/docs/microsoft-powerpoint.md

@@ -91,15 +91,6 @@ See the [callback guide](../../connectors-core/docs/oauth-callbacks.md) for doma
 changes and reconnect behavior. Keep the selected Microsoft tenant/audience
 consistent with the provider registration.
 
-## Evidence and limits
-
-Focused fixtures cover consent, cancellation, encrypted restart, refresh,
-reduced permissions, owner isolation, tenant changes, folder paging, empty
-filtered pages, metadata validation and controlled provider failures. Provider
-HTTP is simulated. No live account, provider registration or generated app is
-used. Provider-console administration and live account acceptance remain
-outside this fixture evidence.
-
 ## Editor credential handoff
 
 The inline guide supplies Entra registration, account audience, Web callback,
@@ -110,10 +101,8 @@ delegated permissions, secret Value and expiry steps. Save
 the prepared application runtime. Per-user connections belong to individual
 users inside that application. No Vibe64 gateway or shared registration is used.
 
-## Existing-scope closeout — 13 September 2026
+## Scope and limitations
 
 Delegated project-owned OAuth browses default-drive folders and PowerPoint candidate filenames and fetches selected file metadata, with bounded paging, tenant/audience configuration and refreshed private grants.
 
-No slide/presentation content reading, creation/editing, upload/download, conversion, macros, sharing, recursive search, arbitrary drive/site selection or file format validation. Filename extension filtering is not content inspection; filtered empty pages can still have a continuation. No app-only/client-credentials or device-code grant, application login or automatic remote consent revocation. The app owns callback routes, account connection UI, authorization and file-picker/pagination behavior. Exact Lovable shared-form fields/scopes remain unverified because the saved shared-form reference is a loading placeholder. To extend: use supported native presentation tooling and file transfer, proving actual slide changes, conflict handling and format preservation; no invented Graph slide-editing endpoint. No live provider account, provider registration, paid request or generated-application execution was tested. No new editor coding-assistant tool attachment is claimed. Other frameworks use the same project configuration and their own native tools; JSKIT is optional.
-
-7 provider-specific source and 7 installed-package cases passed, plus 2 shared Microsoft tenant checks in each 16-test Word/PowerPoint run on September 13. September 12 rendered guidance/form/lifecycle evidence at 496px is retained; no new phone or browser run.
+No slide/presentation content reading, creation/editing, upload/download, conversion, macros, sharing, recursive search, arbitrary drive/site selection or file format validation. Filename extension filtering is not content inspection; filtered empty pages can still have a continuation. No app-only/client-credentials or device-code grant, application login or automatic remote consent revocation. The app owns callback routes, account connection UI, authorization and file-picker/pagination behavior. To extend: use supported native presentation tooling and file transfer, proving actual slide changes, conflict handling and format preservation; no invented Graph slide-editing endpoint. Assistant tool attachment requires explicit host integration. Other frameworks use the same project configuration and their own native tools; JSKIT is optional.

package/docs/microsoft-word.md

@@ -91,15 +91,6 @@ See the [callback guide](../../connectors-core/docs/oauth-callbacks.md) for doma
 changes and reconnect behavior. Keep the selected Microsoft tenant/audience
 consistent with the provider registration.
 
-## Evidence and limits
-
-Focused fixtures cover consent, cancellation, encrypted restart, refresh,
-reduced permissions, owner isolation, tenant changes, folder paging, empty
-filtered pages, metadata validation and controlled provider failures. Provider
-HTTP is simulated. No live account, provider registration or generated app is
-used. Provider-console administration and live account acceptance remain outside
-this fixture evidence.
-
 ## Editor credential handoff
 
 The inline guide supplies Entra registration, account audience, Web callback,
@@ -110,10 +101,8 @@ Shared/assistant **Connect account** invokes the prepared application runtime.
 Per-user connections belong to individual users inside that application.
 No Vibe64 gateway or shared registration is used.
 
-## Existing-scope closeout — 13 September 2026
+## Scope and limitations
 
 Delegated project-owned OAuth browses default-drive folders and Word candidate filenames and fetches selected file metadata, with bounded paging, tenant/audience configuration and refreshed private grants.
 
-No document content reading, creation/editing, upload/download, conversion, macros, sharing, recursive search, arbitrary drive/site selection or document format validation. Filename extension filtering is not content inspection; filtered empty pages can still have a continuation. No app-only/client-credentials or device-code grant, application login or automatic remote consent revocation. The app owns callback routes, account connection UI, authorization and file-picker/pagination behavior. Exact Lovable shared-form fields/scopes remain unverified because the saved shared-form reference is a loading placeholder. To extend: choose supported native document tooling, implement content/file transfers with conflict and format preservation tests; do not invent Graph document-editing endpoints. No live provider account, provider registration, paid request or generated-application execution was tested. No new editor coding-assistant tool attachment is claimed. Other frameworks use the same project configuration and their own native tools; JSKIT is optional.
-
-7 provider-specific source and 7 installed-package cases passed, plus 2 shared Microsoft tenant checks in each 16-test Word/PowerPoint run on September 13. September 12 rendered guidance/form/lifecycle evidence at 496px is retained; no new phone or browser run.
+No document content reading, creation/editing, upload/download, conversion, macros, sharing, recursive search, arbitrary drive/site selection or document format validation. Filename extension filtering is not content inspection; filtered empty pages can still have a continuation. No app-only/client-credentials or device-code grant, application login or automatic remote consent revocation. The app owns callback routes, account connection UI, authorization and file-picker/pagination behavior. To extend: choose supported native document tooling, implement content/file transfers with conflict and format preservation tests; do not invent Graph document-editing endpoints. Assistant tool attachment requires explicit host integration. Other frameworks use the same project configuration and their own native tools; JSKIT is optional.

package/docs/miro.md

@@ -90,8 +90,8 @@ For an application integration, use the application's assigned hosting URL as
 the initial origin and its implemented callback path. Store the exact callback
 in its Env reference and provider registration. A domain change requires updating
 both values if the callback URL changes; retain the application identity and its
-persistent grants when moving hosts. Public Vibe64, Online and CLI users supply
-their own registrations through this same contract.
+persistent grants when moving hosts. Every editor and CLI supplies its own
+registrations through this same contract.
 See the [callback guide](../../connectors-core/docs/oauth-callbacks.md).
 
 The application or explicitly authorized assistant host owns the client secret

package/docs/oura.md

@@ -124,9 +124,10 @@ An AI can prepare JSON, callback handlers and runtime composition after an owner
 creates and authorizes the registration; approval remains a provider process.
 
 The application owner creates the provider registration and stores its secret
-in the application's private Env. Public Vibe64, Vibe64 Online and CLI users use
-this same ownership model. The configuration file holds the client ID and Env
-references; the editor does not own the application's grants.
+in the application's private Env. Every editor and CLI uses this same
+[ownership model](../../connectors-core/docs/online-setup.md): the configuration
+file holds the client ID and Env references; the editor does not own the
+application's grants.
 
 Register the exact callback implemented by the application. For a hosted project,
 start with its assigned application URL and append the implemented callback path.