@jskit-ai/connectors-catalog 0.1.63 → 0.1.65

package/docs/polar.md

@@ -54,10 +54,8 @@ billing owner. Tokens within one organization share its applicable limits;
 sandbox/production separates test and real commerce. The editor supplies no
 shared registration, token pool or merchant account.
 
-## Existing-scope closeout — 13 September 2026
+## Scope and limitations
 
-The existing app-owned Organization Access Token adapter lists a Polar.sh product catalogue in sandbox or production, with bounded page/name/archive/recurrence filters and environment-bound verification.
+The app-owned Organization Access Token adapter lists a Polar.sh product catalogue in sandbox or production, with bounded page/name/archive/recurrence filters and environment-bound verification.
 
-This is NOT the captured personal builder MCP/billing-context experience: coding-assistant attachment and MCP authentication/tools remain deferred. No managed payments, merchant onboarding, checkout, subscription/customer/order management, refunds, webhooks, credits/entitlements, catalogue writes/synchronization or customer login is shipped by this adapter. No merchant OAuth, customer-access-token mode, token provisioning, extra array/metadata/sort filters or automatic pagination. Changing environment requires verification; local disconnect does not revoke the token. The app supplies its own organization token, permissions, UI and access policy. To extend: implement the separately deferred editor tool bridge for the captured use case; require a separate scope decision before adding an app billing product. Do not infer Stripe/Paddle parity from this catalogue reader. No live provider account, provider registration, paid request or generated-application execution was tested. No new editor coding-assistant tool attachment is claimed. Other frameworks use the same project configuration and their own native tools; JSKIT is optional.
-
-2 Polar-specific plus 2 shared environment/pagination source checks passed, and the same 4 installed-package checks passed on September 13. Existing shared token/environment form evidence is retained; no fresh browser run.
+Coding-assistant attachment and MCP authentication/tools are not supplied. No managed payments, merchant onboarding, checkout, subscription/customer/order management, refunds, webhooks, credits/entitlements, catalogue writes/synchronization or customer login is shipped by this adapter. No merchant OAuth, customer-access-token mode, token provisioning, extra array/metadata/sort filters or automatic pagination. Changing environment requires verification; local disconnect does not revoke the token. The app supplies its own organization token, permissions, UI and access policy. Adding an app billing product requires a separate scope decision; do not infer Stripe/Paddle parity from this catalogue reader. Other frameworks use the same project configuration and their own native tools; JSKIT is optional.

package/docs/posthog.md

@@ -186,25 +186,11 @@ not enable OAuth in the implemented fragment. A separate OAuth implementation
 must register the application's actual callback, bind consent to its authenticated
 user and own its grants. That consent journey remains unfinished.
 
-## Focused evidence
-
-Nine tests exercise simulated PostHog responses with actual temporary encrypted
-JSON files: both regions, restart, rotation, ownership, disconnect, settings,
-explicit verification input, public-token validation, request boundaries,
-flag results, capture acceptance, quota and HTTP errors. No live provider
-account, consent, event submission or generated application is used.
-
-
-## Existing-scope closeout — 13 September 2026
+## Scope and limitations
 
 Supported: public Cloud project-token verification through explicit-subject flag
 evaluation, `flags.evaluate` and `events.capture`, EU/US region configuration,
 Env references, encrypted local connection state, token rotation and disconnect.
-Nine controlled source tests and nine installed-package tests pass. Existing
-phone/desktop configuration evidence is retained; no new browser run was made
-for this closeout and no runtime/form behavior changed.
-
-Limitations:
 
 - No private analytics querying, dashboards, project provisioning, personal API
   credentials, OAuth, MCP or self-hosted/custom ingestion domains.
@@ -220,8 +206,7 @@ Limitations:
 - Flag quota or partial-evaluation failures are errors, with no automatic
   fallback value. The backend supplies no visitor IP forwarding.
 - Disconnect removes local state only; rotate the token in PostHog when needed.
-  Assistant tool attachment requires explicit host integration. No live token, tracking,
-  ingestion, provider quota behavior or generated application was exercised.
+  Assistant tool attachment requires explicit host integration.
 
 The application must compose the browser lifecycle and analytics features
 it needs; this connector does not supply a complete analytics product.

package/docs/prestashop.md

@@ -95,7 +95,7 @@ segments. It does not perform DNS filtering. The application controls who can
 edit this credential destination and what networks its backend can reach.
 Operation input cannot substitute a different URL.
 
-## Automation and Online ownership
+## Automation and hosted ownership
 
 An AI can prepare the JSON and runtime wiring. With authorized access to the
 store's PHP runtime, provider APIs can enable `PS_WEBSERVICE`, create a
@@ -129,16 +129,13 @@ writes, order processing, stock changes, additional filters, explicit multistore
 selection per request, webhooks and complete account-connection UI
 remain outside this fragment. The newer Admin API is a separate protocol.
 
-
-## Existing-scope closeout — 13 September 2026
+## Scope and limitations
 
 The supported surface is `products.list` and `orders.list` with explicit
 pagination/language, a merchant-owned Webservice key and the configured HTTPS
-store path. Source and offline installed-package tests each pass 7/7. Historical
-editor form checks are retained; no fresh browser run or runtime/form change was
-made for this closeout. This is not full commerce or Lovable parity.
+store path. This is not full commerce.
 
-Full deferred work: product/order writes and XML write composition, customer and
+Not implemented: product/order writes and XML write composition, customer and
 inventory resource operations, stock updates, checkout/payments, fulfilment,
 refunds, carts, additional search/filter/detail operations, automatic traversal
 of associations, webhooks, automatic pagination, retries and newer Admin API
@@ -147,5 +144,4 @@ per-request shop selector. No OAuth, shopper authentication or per-shopper grant
 The application owns business UI, routes, access policy and native framework
 composition. Verification reads products only and cannot establish order access.
 Disconnect removes local state; disable/revoke the key in the merchant back office.
-Editor coding-agent attachment remains deferred. Live store compatibility,
-actual permissions/data and generated-app execution have not been verified.
+Assistant tool attachment requires explicit host integration.

package/docs/salesforce.md

@@ -161,9 +161,10 @@ not exposed as user messages. Cancellation/deadlines do not replay a request.
 ## Application ownership, callbacks and capacity
 
 The application owner creates the provider registration and stores its secret
-in the application's private Env. Public Vibe64, Vibe64 Online and CLI users use
-this same ownership model. The configuration file holds the client ID and Env
-references; the editor does not own the application's grants.
+in the application's private Env. Every editor and CLI uses this same
+[ownership model](../../connectors-core/docs/online-setup.md): the configuration
+file holds the client ID and Env references; the editor does not own the
+application's grants.
 
 Register the exact callback implemented by the application. For a hosted project,
 start with its assigned application URL and append the implemented callback path.
@@ -207,17 +208,13 @@ customer data and application generation are outside this delivery's tests.
 Writes, Bulk API, SOAP, streaming, MCP, client-credentials/JWT grants, identity
 login and additional domains remain outside the initial runtime fragment.
 
-
-## Existing-scope closeout — 13 September 2026
+## Scope and limitations
 
 Supported operations are `limits.read`, `objects.list`, `objects.describe`,
 `query.read` and `query.next`, through project-owned confidential OAuth on the
-configured production/developer/sandbox My Domain. Source and offline installed
-public-export tests each pass 13/13, including the packaged configuration example.
-Historical editor form proof is retained; no new browser run or runtime/form
-change was needed for this closeout.
+configured production/developer/sandbox My Domain.
 
-Deferred work and limitations: record create/update/delete and relationship
+Not implemented: record create/update/delete and relationship
 mutations, bulk/partial-write handling, SOAP, streaming/events, MCP, automatic
 pagination, query building/parameter binding, client-credentials/JWT or other
 grants, identity login, Experience Cloud/sovereign/legacy instance hosts and API
@@ -229,5 +226,37 @@ does not establish access to a particular object or field. A missing token expir
 uses a five-minute local renewal policy, not a provider lifetime guarantee.
 Disconnect removes local grants only; provider revocation remains an org/admin
 action. Native framework routes, business UI, app sessions and access policy are
-application-owned. Assistant tool attachment requires explicit host integration. Live
-org/consent/data outcomes and generated-app execution remain unverified.
+application-owned. Assistant tool attachment requires explicit host integration.
+
+## OAuth pattern composition: Salesforce
+
+Use `salesforceProvider` from `@jskit-ai/connectors-catalog/server/salesforce`
+and the portable JSON in this guide. Read that guide before provisioning
+an External Client App. Production/Developer Edition and Sandbox have distinct
+My Domain formats. Client credentials remain in references; the runtime pins
+consent, token exchange and APIs to that org and handles undated/rotating grants.
+The ordinary file service, Env resolver and application owner policy of the [OAuth pattern](../patterns/oauth-connection/PATTERN.md) apply.
+
+After consent, `limits.read` verifies API access. A server action can expose an
+approved query through the same library:
+
+```js
+const result = await connections.invoke({
+  context: authenticatedContext, integrationId: "crm", operation: "query.read",
+  input: { q: "SELECT Id, Name FROM Account ORDER BY Id LIMIT 20" }, signal
+});
+```
+
+The application supplies the trusted context and abort signal. It authorizes
+objects, fields and any query parameters in its existing action/policy; avoid
+an unrestricted query endpoint. `api` can authorize writes even though these
+operations only read. Do not use provider connection identity as application
+login. For metadata, call `objects.list` and `objects.describe` with an object
+API name. Keep a returned `nextRecordsUrl` with its original owner/query and pass
+it only to `query.next`. No automatic paging is installed.
+
+Map `connector_cursor_expired` to restarting the authorized query and
+`connector_reconnect_required` to the existing connection UI. Do not retry a
+failed operation in a loop. Register the application's implemented callback and
+follow provider requirements for distributing an app across customer orgs.
+Separate registrations do not divide an org's API allocation.

package/docs/sentry.md

@@ -89,16 +89,7 @@ with explicit MCP discovery and authorized tool calls. No alias or automatic
 conversion retains the old connection; remove its local record through its
 owning application and review whether its old Env token is still used elsewhere.
 
-## Verification and limitations
-
-Two focused tests cover resource and registration validation. Seven OAuth/MCP
-tests cover consent, PKCE, encrypted persistence, refresh, owner/resource
-isolation, issue details, exact tool authorization, errors and cancellation;
-those seven also pass through installed public package exports. Public editor
-registration has a passing owner/Env test, and phone/desktop browser checks cover
-registration, consent cancellation, reconnect, reload and disconnect. All use
-controlled fixtures; live tool schemas, consent and account behavior are unverified.
-The previous REST organization probe is replaced without a compatibility alias.
+## Limitations and sources
 
 The official repository also documents a remote `Sentry-Bearer` token alternative,
 distinct from OAuth `Bearer`. That alternative is not implemented here yet.
@@ -108,5 +99,3 @@ Sources: [hosted MCP instructions](https://mcp.sentry.dev/),
 [resource binding](https://github.com/getsentry/sentry-mcp/blob/main/packages/mcp-cloudflare/src/server/protected-resource-metadata.ts),
 [OAuth metadata](https://github.com/getsentry/sentry-mcp/blob/main/packages/mcp-cloudflare/src/server/authorization-server-metadata.ts),
 [scope definitions](https://github.com/getsentry/sentry-mcp/blob/main/packages/mcp-core/src/scopes.ts).
-Public discovery requests returned HTTP 403 from the development environment;
-source evidence does not establish successful live consent.

package/docs/sevdesk.md

@@ -91,17 +91,6 @@ independent-capacity arrangement need confirmation. The application enforces
 its own usage limits. No callback URL is
 used, so editor VM and app hosting domains do not affect this flow.
 
-## Focused evidence
+## Scope and limitations
 
-Tests use simulated HTTP replies and real temporary encrypted JSON storage.
-They cover raw authorization, page defaults, explicit organization-only reads,
-numeric-string totals, invalid inputs/envelopes, restart, rotation, ownership
-and disconnect. Editor automation verifies the token label, reference-only
-storage and save/reload. Live provider use, account creation and sample-app
-generation are excluded.
-
-## Existing-scope closeout — 13 September 2026
-
-Contact listing only, including people by default (`depth: 1`), explicit organization-only depth, bounded offset pagination and numeric-string totals. The project supplies its existing raw API token through Env. No contact detail/search/create/update/delete, related-object expansion, invoices, orders, vouchers or bookkeeping operations are implemented. There is no OAuth/app registration, application-user login, token-issuance automation, automatic pagination/retry or remote token revocation. Applications still own their UI, authorization and pagination; disconnect removes local connection state. Deferred work is the missing contact/accounting operations and their validation, permissions, setup guidance and tests. No live Sevdesk account, provider-console login or generated-app run was tested.
-
-Three selected source tests and the same three installed-package tests passed on September 13. They cover credential verification, encrypted file restart, rotation, isolation, disconnect, pagination/depth/totals and redacted invalid-input/provider failures. Existing shared business-token UI evidence is retained; no fresh browser run or form change is claimed.
+Contact listing only, including people by default (`depth: 1`), explicit organization-only depth, bounded offset pagination and numeric-string totals. The project supplies its existing raw API token through Env. No contact detail/search/create/update/delete, related-object expansion, invoices, orders, vouchers or bookkeeping operations are implemented. There is no OAuth/app registration, application-user login, token-issuance automation, automatic pagination/retry or remote token revocation. Applications still own their UI, authorization and pagination; disconnect removes local connection state.

package/docs/shopify.md

@@ -96,8 +96,7 @@ operations locally; Shopify remains the authority for the token's actual rights.
 
 ## Application registrations, callbacks and domains
 
-Shopify's word *online* describes a staff-user access token. It is unrelated to
-the Vibe64 Online product.
+Shopify's word *online* describes a staff-user access token.
 
 The application owner creates its Shopify app in the Dev Dashboard, configures
 its distribution, access scopes and application URL, and completes any required
@@ -204,3 +203,37 @@ Operation references: [products](https://shopify.dev/docs/api/admin-graphql/late
 [productCreate](https://shopify.dev/docs/api/admin-graphql/latest/mutations/productCreate),
 [productUpdate](https://shopify.dev/docs/api/admin-graphql/latest/mutations/productUpdate),
 [productDelete](https://shopify.dev/docs/api/admin-graphql/latest/mutations/productDelete).
+
+## OAuth pattern composition: Shopify product operations and assistant permissions
+
+Import `shopifyProvider` from `@jskit-ai/connectors-catalog/server/shopify` and read
+this guide. The supported new-app flow is an installed app in
+the **same Shopify organization** as its store, with `grantType: "client_credentials"`.
+There is no callback in this flow. Put the client secret in an environment
+reference and configure the permanent `shopDomain`, not a custom storefront URL.
+Call `connectClientCredentials` before the named product operations. Existing
+Admin API tokens use `connectApiKey` instead. Other merchants need the unfinished
+Shopify installation/consent flow; do not pretend client credentials cover them.
+
+The runtime sends Shopify's header and GraphQL Admin API 2026-07 requests. It
+supports bounded product listing, creation, update and deletion. Create defaults
+to draft. Use Product GIDs; price/SKU/variants and publication are separate work.
+Do not retry a mutation blindly after timeout. A store connection is not shopper
+login or an individual staff member's authorized session.
+
+Construct assistant-facing services with `executionMode: "assistant"`; the
+host's trusted authorization callback receives `{ assistantPermission, input }`.
+It must verify real human approval and return `approved: true` for `ask`, together
+with the checked owner identity. The shared runtime denies `never` and does not
+accept a browser-supplied approval flag. `always` still checks application access.
+The host must bind approval to the exact request and supply its existing decision
+UI/storage; the library does not create another approval system.
+
+The portable `assistantPolicy` holds enablement, a default and action overrides.
+It is independent of credentials, provider scopes and connection sharing. Host
+workspace policy may further restrict it. Use `authorizeAssistantAction` only
+before a host-owned lifecycle operation such as enabling or claiming a store;
+it authorizes but does not execute that action. The captured remaining action
+choices do not mean variant/discount/store lifecycle adapters are implemented.
+The application owns its registration and token storage. The editor's
+Connect/approval journey must invoke that application's setup operations.

package/docs/slack.md

@@ -133,7 +133,7 @@ it does not uninstall the Slack app or revoke every grant in that workspace.
 Socket mode, slash commands, organization-wide
 installs, GovSlack and Sign in with Slack are outside this initial fragment.
 
-## Online, public editor and automation
+## Editors, hosting and automation
 
 Each application owns its provider registration, callback route, credentials
 and grants. Hosted and installed editors configure the same app-owned setup;
@@ -182,20 +182,10 @@ registration provisioner. For a manual manifest path, select **Create New App
 From a manifest**, select the workspace, paste JSON/YAML, review and create.
 [Manifest UI](https://docs.slack.dev/app-manifests/configuring-apps-with-app-manifests/).
 
-## Verification boundary
-
-Controlled local tests exercise both identities, encrypted file restart,
-rotating and non-rotating grants, scope restrictions, cancellation, actor changes,
-bounded paging, HTTP-200 failures, malformed responses and interruption. Shared
-form tests and Vibe64 browser tests cover conditional scopes and file round trips.
-No live Slack registration, provider consent, customer data or generated app is
-part of this proof. Current controlled source and installed-package suites each pass 17/17.
-Current-source compact and expanded editor cases pass separately, including
-actor/scope persistence, signing-secret reference, inline guidance, per-user
-connection instructions and shared connect/cancel/disconnect controls. Registration
-provisioning remains an operator action; assistant tool attachment requires
-explicit host integration.
+## Limitations
 
+Registration provisioning remains an operator action; assistant tool attachment
+requires explicit host integration.
 
 ## Message operations
 
@@ -255,3 +245,38 @@ CLI applications use this same code without the editor; other frameworks can use
 native Slack verification support with the same Env and route contract.
 
 [Slack signature contract](https://docs.slack.dev/authentication/verifying-requests-from-slack/).
+
+## OAuth pattern composition: Slack
+
+Import `slackProvider` from `@jskit-ai/connectors-catalog/server/slack` and include
+it in the provider array used for parsing and `createConnectionService`.
+Set `settings.actor` to `user` or `bot`, independently of application ownership.
+Use an own confidential registration and a real registered HTTPS callback;
+plain HTTP loopback is not supported by Slack. The [Slack guide](slack.md)
+contains a complete portable JSON file and manual/API registration instructions.
+
+For channel listing, request `channels:read` and call:
+
+```js
+const firstPage = await connections.invoke({
+  context: authenticatedContext,
+  integrationId: "slack",
+  operation: "channels.list",
+  input: { limit: 50, exclude_archived: true }
+});
+// Retain next_cursor even when filtering leaves this page empty.
+const nextCursor = firstPage.response_metadata?.next_cursor;
+```
+
+The host supplies `authenticatedContext`; user request parameters cannot select
+another owner. The library selects `user_scope` versus `scope`, extracts the
+requested token identity, checks Slack's HTTP-200 errors and refreshes rotating
+grants under the file lock. Do not duplicate that code in generated handlers.
+Add the corresponding read permission before using `groups.list`,
+`directMessages.list` or `groupMessages.list`. `auth.test` returns identity.
+
+An individually owned bot connection still acts as the installed workspace bot.
+It is not a personal account or an application login. Actor changes require
+reconnection and remove incompatible form scopes. Captured permission choices
+do not imply implemented operations: history, sends, events, organization-wide
+installs and Sign in with Slack remain outside this fragment. The application implements and registers its own callback.

package/docs/snowflake.md

@@ -124,8 +124,8 @@ For an application integration, use the application's assigned hosting URL as
 the initial origin and its implemented callback path. Store the exact callback
 in its Env reference and provider registration. A domain change requires updating
 both values if the callback URL changes; retain the application identity and its
-persistent grants when moving hosts. Public Vibe64, Online and CLI users supply
-their own registrations through this same contract.
+persistent grants when moving hosts. Every editor and CLI supplies its own
+registrations through this same contract.
 See the [callback guide](../../connectors-core/docs/oauth-callbacks.md).
 
 A Snowflake security integration belongs to one Snowflake account. Separate
@@ -269,3 +269,28 @@ the confidential-client/PKCE consent and refresh lifecycle there; JSKIT is not a
 remote service. Preserve string-valued numeric results, one explicit statement
 request ID, partition polling and cancellation. Apply the same application
 policy to SQL text, handles and warehouse names before invoking the provider.
+
+## OAuth pattern composition: Snowflake account OAuth
+
+Use `snowflakeProvider` from `@jskit-ai/connectors-catalog/server/snowflake` and
+this guide. Its portable settings are `accountUrl` and optional `role`.
+The shared form and CLI parser derive compatible scope choices from the role.
+Omit the role for the connected user's default and retain `refresh_token`;
+otherwise include the exact required role scope returned by `getProviderScopes`.
+Do not hand-encode a space-containing role twice. Changing role/account requires
+new consent. The registration supports confidential client secret POST or Basic;
+PKCE remains enabled for both.
+
+The useful operation is `databases.list` with `showLimit`, `like`, `startsWith`,
+`fromName` and `history`. It reads one metadata page and pins the configured role
+in the request header. Do not turn user text into SQL or infer table access from
+successful metadata verification. HTTP 202 remains an explicit incomplete
+response, with no polling implementation in this fragment.
+
+An administrator creates the custom OAuth integration inside each customer's
+Snowflake account. AI can assist through authorized SQL/CLI provisioning, but
+reader credentials do not grant that authority. Keep secret results out of chat.
+Register the application's callback and update that registration and its
+environment binding when the callback domain changes. Compute billing belongs
+to the Snowflake account. Use application authorization, reference resolution
+and durable storage; the editor does not hold the grant.

package/docs/telegram.md

@@ -99,16 +99,6 @@ ownership. The application owner must confirm provider capacity for its usage. D
 outbound API calls; a separately implemented webhook consumer must own its explicit callback and
 delivery lifecycle.
 
-## Focused evidence
-
-Automated fixtures check token validation, fixed destinations, bot-only
-verification, empty webhook URLs, malformed results, unsuccessful HTTP-200
-envelopes, authorization failures, rate limits, file-store restart, isolation,
-rotation and disconnect. The editor test checks the bot-token label, rejection
-of raw credentials, setup link and saved-reference reload. No live bot,
-provider consent, message delivery or sample application is exercised.
-
-
 ## Interactive message workflow
 
 Before polling, call `webhook.read`. A nonempty webhook URL means another

package/docs/tiktok.md

@@ -168,7 +168,7 @@ read the same registration references and ownership/scopes, call GET
 response. It must retain the provider-specific `client_key`, comma scopes and
 refresh-token rules described above. JSKIT supplies no PHP implementation.
 
-## Online, public and custom domains
+## Editors, hosting and custom domains
 
 Each application owns its provider registration, callback route, credentials
 and grants. Hosted and installed editors configure the same app-owned setup;
@@ -199,3 +199,21 @@ The app developer must obtain approval for the actual integration and user flow.
 The initial fragment is tested with controlled token/API responses and the editor
 configuration UI. No live TikTok registration, production approval, provider
 consent or generated application has been exercised.
+
+## OAuth pattern composition: TikTok
+
+Use `tiktokProvider` from `@jskit-ai/connectors-catalog/server/tiktok` and the
+packaged this guide. The portable `clientId` field stores TikTok's Client
+key. The adapter sends `client_key` during authorize/token exchanges, comma
+separated scopes, and requires a static HTTPS Web callback under 512 characters.
+The CLI uses that same callback-owning backend and file runtime; do not embed
+its secret into distributed clients or assume HTTP loopback/native support.
+
+`profile.read` verifies basic access. `profile.extended`, `profile.stats` and
+`videos.list` require their respective optional permissions. Handle declined
+permissions as unavailable operations; never substitute the builder's account
+for an app user's connection. Video reads use explicit pages with string IDs;
+the runtime implements no posting or Research API. Refresh rotates credentials
+and may reduce permissions. Local disconnect does not revoke access at TikTok.
+The application owns its callback and allowed return destination. App login
+remains a separate concern from this data connection.

package/docs/twilio.md

@@ -257,7 +257,7 @@ same account do not establish separate billing or guaranteed quota isolation.
 The application operator selects its account, key and region and owns usage
 limits. This adapter does not provision capacity or enforce a budget. Use
 separate parent accounts where independent billing is required, subject to
-Twilio's account arrangements. Online, installed editor and CLI users configure
+Twilio's account arrangements. Hosted editor, installed editor and CLI users configure
 the same application-owned credentials.
 
 There is no OAuth callback in this API-key flow, so editor VM URLs and custom

package/docs/twitch.md

@@ -399,7 +399,7 @@ reconnection; a Helix 401 likewise requires reconnection without replay. This
 fragment does not implement Twitch's recommended reactive refresh on 401.
 [Refresh behavior](https://dev.twitch.tv/docs/authentication/refresh-tokens/).
 
-## Online, public editor and automation
+## Editors, hosting and automation
 
 Twitch requires a distinct client ID for each application. Each generated app
 owns its registration, whether created with a hosted editor, installed editor or
@@ -417,12 +417,42 @@ The documented registration path is the console. No supported application
 creation API was established in this review. An AI can prepare the JSON,
 environment references, callback wiring and validation job. The owner handles
 account verification, human verification, registration and consent; automation
-must not invent a registration endpoint or bypass those steps. For Online,
-operator-managed credential storage can simplify wiring after the app-specific
-registration exists, but this fragment does not provision that service.
+must not invent a registration endpoint or bypass those steps. A hosting
+platform's operator-managed credential storage can simplify wiring after the
+app-specific registration exists, but this fragment does not provision that service.
 
 Twenty controlled runtime tests cover consent formats and replay, encrypted file
 restart, refresh rotation, owner/client isolation, validation, bounded paging,
 malformed responses, provider failures and interruption. Public-editor tests
 cover the configuration form. No live registration, user data, consent or
 sample application is part of this proof.
+
+## OAuth pattern composition: Twitch
+
+Use `twitchProvider` from `@jskit-ai/connectors-catalog/server/twitch` in the
+provider array of the [OAuth pattern](../patterns/oauth-connection/PATTERN.md) and the portable JSON in this guide. Start with
+`user:read:email` and `user:read:follows` for `profile.read` and
+`channels.followed`; remove any permission whose operation is not used.
+Its normal operations verify the token before data access. The provider also
+exposes `token.validate` for Twitch's required startup/hourly validation of
+maintained sessions, including idle connections:
+
+```js
+// Run from the host's startup and scheduled-job paths. Contexts are derived
+// by its existing authorization owner, never from caller-supplied user IDs.
+for (const context of maintainedTwitchContexts) {
+  try {
+    await connections.invoke({ context, integrationId: "twitch", operation: "token.validate" });
+  } catch (error) {
+    await reportConnectionFailure(context, error);
+  }
+}
+```
+
+The host supplies `maintainedTwitchContexts` and `reportConnectionFailure`;
+these are not JSKIT exports. Its scheduler must prevent overlapping runs and
+surface reconnect state. Merely saving configuration installs no scheduled
+job. Neither the provider nor this composition implements application login.
+Twitch requires an application-specific registration: do not reuse one editor
+client ID across independent generated apps. Register the application's own callback URL. The runtime handles array/string token
+scopes and Client-ID headers; do not duplicate those details in app scaffolding.

package/docs/wave.md

@@ -268,21 +268,10 @@ application must follow its approved usage and account limits.
   Changed client IDs or callbacks require reconnecting; changing the secret
   binding can support ordinary provider-side secret rotation.
 
-## Verification and remaining scope
-
-`test/wave.test.js` exercises the real shared service with temporary encrypted
-files and controlled HTTP responses. It covers code consent, restart, named
-queries, input boundaries, scopes, owner policy, callback changes, serialized
-refresh, permission/subscription failures, partial GraphQL errors, cancellation
-and malformed success responses. The guide's JSON is parsed by the same schema.
-The public editor cases passed at desktop and phone widths, checking all ten
-setup steps, configuration/Env references and file persistence, owner-mode
-changes, consent cancellation, reconnect and local disconnect.
-
-These tests use no live Wave account, consent, invoices or registration. They do
-not generate a sample application. Live success, provider PKCE enforcement,
-partner approval and actual quota allocation remain unproven. Full-access
-tokens, webhooks and provider-side revocation are not implemented. The implemented mutations are described below.
+## Limitations
+
+Full-access tokens, webhooks and provider-side revocation are not implemented.
+The implemented mutations are described below.
 
 ## Estimates in the application
 
@@ -438,3 +427,35 @@ view. This hides an account from the default view, rather than deleting it.
 Native frameworks use the same ownership lookup and `AccountArchiveInput`, whose
 output provides `didSucceed` and `inputErrors`, without an account object. See
 [Wave API reference](https://developer.waveapps.com/hc/en-us/articles/360019968212-API-Reference).
+
+## OAuth pattern composition: Wave
+
+Import `waveProvider` from `@jskit-ai/connectors-catalog/server/wave` into the
+same provider array and use this guide for portable JSON and registration
+setup. Keep `client_secret_post` authentication. Grant `user:read` for verification,
+`business:read` for selection, and the matching customer/invoice read permission.
+
+```js
+const businesses = await connections.invoke({
+  context, integrationId: "wave", operation: "businesses.list",
+  input: { page: 1, pageSize: 20 }
+});
+const businessId = await choosePermittedBusiness(businesses.data.businesses, context);
+const customers = await connections.invoke({
+  context, integrationId: "wave", operation: "customers.list",
+  input: { businessId, page: 1, pageSize: 20 }
+});
+```
+
+`choosePermittedBusiness` is the host's selection and authorization function,
+not a JSKIT export. Do not default to the first business or trust an incoming
+business ID without policy checks. Preserve `pageInfo` and nullable edge nodes;
+advance only when the caller requests another page. `invoice:write` alone cannot
+authorize invoice reads. Results with GraphQL errors are rejected even if they
+contain partial data. The library sends fixed queries and owns token refresh,
+including Wave's original redirect URI, under encrypted file storage.
+
+Wave OAuth business access requires Pro or Advisor, and use for other customers
+requires provider approval. This is a data connection, not login. The application must implement and register an actual
+served callback. Do not replace OAuth with a personal full-access token for
+customer applications or copy protocol logic into generated routes.

package/docs/wix.md

@@ -100,7 +100,7 @@ provider key. API failures are sanitized; 401 requires reconnect, 403 indicates
 missing access, and 429 reports a rate limit without retrying. Malformed result
 fields and input values fail explicitly. Cancellation preserves a verified grant.
 
-## Public, Online and automation
+## Editors, hosting and automation
 
 For this account-key flow, the universal OAuth callback is **not applicable**.
 Customer VPS and custom-domain URLs do not enter the provider authentication
@@ -146,22 +146,9 @@ The runtime's trusted host policy must authorize the actual operation and its
 business object. A shared site key is not proof that an app user owns a booking,
 contact or order. Authorize that relationship before returning data or writing.
 The generated app owns its customer screens, checkout and domain-specific rules.
-Public Vibe64 owns editing this project configuration; Online adds no Wix gateway.
-
-## Verification status
-
-The controlled provider suite currently passes **40/40**, including identity
-headers, input validation, pagination, exact revisions, write bodies, ownership,
-key rotation and failure handling. These use fixtures, not a live Wix account.
-The expanded and compact editor cases each pass with the current Site ID,
-Selectable Site IDs and setup guidance: invalid input, text configuration save and
-reload, missing credentials, connect, reconnect and local disconnect. These browser
-cases use controlled connection responses. A freshly packed catalog installed
-offline in a standalone consumer passed the same 29 controlled cases through
-public package exports, including this guide’s configuration. This proves the
-implemented operations and configuration/lifecycle UI, not the missing workflows
-below or live provider behavior.
-No generated application, payment, real booking or release has been exercised.
+The editor owns editing this project configuration; no Wix gateway is added.
+
+## Not implemented
 
 The following remain outside the implemented operations and need explicit scope
 reconciliation before acceptance: scheduled session management,

package/docs/wiz.md

@@ -134,13 +134,13 @@ There are no automatic retries. A new scan is a separate explicit operation.
 ## Application ownership and custom domains
 
 **Provider callback: not applicable.** Service-account CLI authentication has no
-browser redirect. Do not register `https://connect.vibe64.dev/oauth/wiz/callback`
-or each customer's VPS/custom domain as a Wiz callback for this mode.
+browser redirect. Do not register a hosting platform's shared callback or each
+customer's own domain as a Wiz callback for this mode.
 
 The application or scanning workflow owner supplies an authorized Wiz service
 account scoped to the intended Wiz projects. Store its credentials in private
-worker Env and enforce permission to scan the selected source directory. Public
-Vibe64 and Online do not supply a universal scanning credential. The runtime
+worker Env and enforce permission to scan the selected source directory. No
+editor or hosting platform supplies a universal scanning credential. The runtime
 rejects managed registration assignments; there is no hosted universal scan
 endpoint.