@jskit-ai/connectors-catalog 0.1.64 → 0.1.66

package/README.md

@@ -50,7 +50,7 @@ Provider request validation remains authoritative.
 
 | Provider | Export | Initial operations | Authentication |
 |---|---|---|---|
-| [AI](docs/ai.md) | `createAiConnectionResolver` | Static catalogue and authorized SDK parameters; app-owned inference | Free public Zen default, administrator Env key or private individual grant |
+| [AI](docs/ai.md) | `createAiConnectionResolver` | Static catalogue and authorized SDK parameters; app-owned inference | Explicit model choice; free no-setup models, administrator Env key or private individual grant |
 | [Wiz](docs/wiz.md) | `createWizScanner` | Authorised source-directory scan, policy verdict and report; separate CLI runtime | Own Cognito service account; installed Wiz v1 CLI |
 | [Shopify](docs/shopify.md) | `shopifyProvider` | `products.list`, `products.create`, `products.update`, `products.delete`; assistant policies | Organization client credentials or existing Admin API token |
 | [Confidence Flags](docs/confidence-flags.md) | `confidenceFlagsProvider`, `registerConfidenceClient` | `tools.list`, `tools.call`; explicit client setup | Assistant OAuth for flag management |
@@ -88,13 +88,13 @@ Provider request validation remains authoritative.
 | [Notion](docs/notion.md) | `notionProvider` | Search, page/block reads and writes, data-source queries; separate MCP tools | Own internal token, REST OAuth or separate MCP client |
 | [Brevo](docs/brevo.md) | `brevoProvider` | `contacts.list` | Own API key |
 | [ElevenLabs](docs/elevenlabs.md) | `elevenlabsProvider` | `account.read`, `voices.list` | Own API key |
-| [GitHub API](docs/github-api.md) | `githubApiProvider` | `account.read`, `repositories.list` | Own personal access token |
+| [GitHub API](docs/github-api.md) | `githubApiProvider` | `account.read`, `repositories.list` | Own personal access token or OAuth registration |
 | [Apify](docs/apify.md) | `apifyProvider` | `actors.list` | Own API token |
-| [Calendly](docs/calendly.md) | `calendlyProvider` | `profile.read`, `eventTypes.list` | Own personal access token |
+| [Calendly](docs/calendly.md) | `calendlyProvider` | `profile.read`, `eventTypes.list` | Own personal access token or OAuth registration |
 | [HubSpot](docs/hubspot.md) | `hubspotProvider` | Contact/deal list/get/create/update, relationships and pipeline reads | Own private/static token or project OAuth |
-| [Linear](docs/linear.md) | `linearProvider` | `profile.read`, `issues.list` | Own personal API key |
+| [Linear](docs/linear.md) | `linearProvider` | `profile.read`, `issues.list` | Own personal API key or OAuth registration |
 | [Pipedrive](docs/pipedrive.md) | `pipedriveProvider` | Profile; deals, people, organizations, activities, leads and pipeline reads; basic record create/update | Own user/company API token |
-| [GitLab API](docs/gitlab-api.md) | `gitlabApiProvider` | `profile.read`, `projects.list` | Own GitLab.com personal access token |
+| [GitLab API](docs/gitlab-api.md) | `gitlabApiProvider` | `profile.read`, `projects.list` | Own personal access token or OAuth registration; GitLab.com or own instance URL |
 | [Tally](docs/tally.md) | `tallyProvider` | `forms.list` | Own API key |
 | [Contentful](docs/contentful.md) | `contentfulProvider` | `entries.list` | Own Content Delivery key, space and environment |
 | [Asana](docs/asana.md) | `asanaProvider` | `workspaces.list` | Own personal access token |
@@ -106,14 +106,12 @@ Provider request validation remains authoritative.
 | [Microsoft Word](docs/microsoft-word.md) | `microsoftWordProvider` | `items.list`, `items.get` | Own delegated OAuth registration |
 | [Microsoft PowerPoint](docs/microsoft-powerpoint.md) | `microsoftPowerPointProvider` | `items.list`, `items.get` | Own delegated OAuth registration |
 | [Microsoft SharePoint](docs/microsoft-sharepoint.md) | `microsoftSharePointProvider` | `sites.search` | Own organizational OAuth registration |
-
 | [Stripe](docs/stripe.md) | `stripeProvider` | `balance.read` | Own restricted/secret API key |
 | [Replicate](docs/replicate.md) | `replicateProvider` | Account/hardware, model schema, prediction submit/poll/cancel | Own API token |
-| [Sentry](docs/sentry.md) | `sentryProvider` | `organizations.list` | Own Sentry.io personal token |
+| [Sentry](docs/sentry.md) | `sentryProvider`, `registerSentryClient` | `tools.list`, `tools.call`; explicit client setup | Assistant OAuth to Sentry's hosted MCP |
 | [incident.io](docs/incident-io.md) | `incidentIoProvider` | Incidents/follow-ups, alert resolution, schedule reads, catalogue entries | Own API key |
 | [Fireflies](docs/fireflies.md) | `firefliesProvider` | `profile.read`, `transcripts.list` | Own API key |
-
-| [HeyGen](docs/heygen.md) | `heygenProvider` | `profile.read`, `voices.list` | Own API key |
+| [HeyGen](docs/heygen.md) | `heygenProvider` | `profile.read`, `voices.list` | Own API key or OAuth registration |
 | [Perplexity](docs/perplexity.md) | `perplexityProvider` | `requests.list`, `models.list` | Own project API key |
 | [Supabase](docs/supabase.md) | `supabaseProvider` | `projects.list` | Own Management API personal token |
 | [Google Analytics](docs/google-analytics.md) | `googleAnalyticsDefinition` (shared configuration) | Framework-owned Google tag | Public Measurement ID |
@@ -180,15 +178,12 @@ The [OAuth file-connection pattern](patterns/oauth-connection/PATTERN.md) covers
 consent and callbacks with the same text-based runtime storage.
 The [Microsoft guide](docs/microsoft-oauth.md) adds delegated OAuth wiring,
 registration automation and provider-specific account/permission requirements.
-Focused runtime tests cover the providers' requests, result validation,
-credential changes, isolation, errors and disconnect. Provider calls in those
-tests are simulated; live service use and sample-app generation are outside
-this delivery's test scope. Managed service credentials and sharing grants
-remain host-owned capabilities; an own key is not a managed subscription.
+Managed service credentials and sharing grants remain host-owned
+capabilities; an own key is not a managed subscription.
 
 Logo.dev uses the [public-image pattern](patterns/public-image/PATTERN.md) and
-its client library export. Its `runtimeKind: "public-resource"` metadata
-distinguishes URL construction from the server adapters above. Image delivery
-is observed in the browser; constructing a URL never records Connected.
+its client library export. It is `configurationOnly`: it has no server adapter
+or account connection. Image delivery is observed in the browser; constructing
+a URL never records Connected.
 
 The [AWS pattern](patterns/aws-storage-queries/PATTERN.md) composes the signed S3 and Athena libraries with the same file configuration and host authorization.

package/docs/ai.md

@@ -159,8 +159,8 @@ as general app-inference credentials.
 
 ## Provider setup and automation
 
-There are no `vibe64-online`/`vibe64-public` OAuth registrations or universal
-callbacks for this AI integration. Regular keys belong to the app administrator
+There are no shared OAuth registrations or universal callbacks for this AI
+integration. Regular keys belong to the app administrator
 or individual app user and are billed directly by that provider.
 
 Choose AI, then choose a provider and model; nothing is preselected. For an
@@ -193,23 +193,11 @@ automate them. AI can wire environment names, configuration and native SDKs;
 it cannot create somebody's account, accept terms or supply their billing
 authorization merely by editing this JSON.
 
-## Evidence and limits
+## Scope and limitations
 
-Focused tests cover snapshot integrity, free classification, no default model, strict
-selection, authorized environment and individual-key resolution, rotation,
-disconnect, redacted failures and SDK parameter handoff. Browser fixtures cover
-the editor's default, searchable model change, credential ownership, persistence
-and responsive layout. These tests perform no live inference, provider login,
-account creation or generated-application execution.
-
-## Existing-scope closeout — 13 September 2026
-
-A static, attributed September 10 provider/model catalogue, searchable free/paid model configuration and a backend-only authorized credential/SDK-parameter resolver. No model is preselected and the first authentication method is a provider API key. Administrator keys resolve through Env, and individual keys through an app-supplied user/provider-scoped reference resolver.
-
-No inference engine, streaming, tools, conversation storage, provider OAuth/login screens, account/key provisioning, live credential verification, usage metering, billing, token resale or Vibe64 AI gateway. No automatic SDK installation, catalogue updates, model replacement or paid fallback. Only the 13 explicitly supported direct-key routes are configurable; other catalogue entries are framework metadata, not implemented cloud/coding-subscription authentication. Model availability, pricing/free classification and endpoint operation are dated source information, not live proof; even no-setup choices can be unavailable or capacity-limited. Detailed provider-specific personal-key entry, verification, encrypted storage, rotation/disconnect and authorization remain application work; the resolver only consumes those bindings. The app/framework owns SDK installation, protocol selection, requests, errors and UI. Generic key-creation guidance and linked provider documentation are supplied; bespoke audited login/key-creation screens for every catalogue provider are not. To extend: deliberately refresh the static snapshot, improve selected provider-specific instructions, and wire any desired app-native key-entry/inference features. This intentionally differs from Lovable managed AI; coding-agent credentials and runtimes remain separate from direct-provider API authentication.
-
-10 source and 10 installed-package tests passed on September 13, proving snapshot/default selection, rejected unsupported modes, no-network public parameters, authorized Env and individual references, rotation/deletion, redaction and SDK handoff. Historical September 10 compact/medium/expanded UI evidence is retained; no fresh browser, live inference, provider account, generated-app execution or release was performed.
+A static, attributed provider/model catalogue, searchable free/paid model configuration and a backend-only authorized credential/SDK-parameter resolver. No model is preselected and the first authentication method is a provider API key. Administrator keys resolve through Env, and individual keys through an app-supplied user/provider-scoped reference resolver.
 
+No inference engine, streaming, tools, conversation storage, provider OAuth/login screens, account/key provisioning, live credential verification, usage metering, billing, token resale or AI gateway. No automatic SDK installation, catalogue updates, model replacement or paid fallback. Only the 13 explicitly supported direct-key routes are configurable; other catalogue entries are framework metadata, not implemented cloud/coding-subscription authentication. Model availability, pricing/free classification and endpoint operation are dated source information, not live proof; even no-setup choices can be unavailable or capacity-limited. Detailed provider-specific personal-key entry, verification, encrypted storage, rotation/disconnect and authorization remain application work; the resolver only consumes those bindings. The app/framework owns SDK installation, protocol selection, requests, errors and UI. Generic key-creation guidance and linked provider documentation are supplied; bespoke audited login/key-creation screens for every catalogue provider are not. To extend: deliberately refresh the static snapshot, improve selected provider-specific instructions, and wire any desired app-native key-entry/inference features. Coding-agent credentials and runtimes remain separate from direct-provider API authentication.
 
 ## Assistant integration
 

package/docs/amazon-redshift.md

@@ -178,12 +178,12 @@ IAM policies, resource creation, database grants, billing choices and credential
 renewal require the corresponding administrator authority. This connector runs
 Data API operations; it does not provision accounts or warehouses.
 
-There is **no OAuth callback URL** for the implemented credential mode. Online,
-desktop and independent CLI can all use the same JSON and runtime. A customer's
-VPS or custom domain does not change the AWS API endpoint or credential binding.
+There is **no OAuth callback URL** for the implemented credential mode. Hosted
+editors, desktop and independent CLI can all use the same JSON and runtime. A
+customer's server or custom domain does not change the AWS API endpoint or credential binding.
 The application owner supplies AWS credentials through private Env or its
 credential store. Resource names and editable `env:` references do not grant
-AWS permissions. Separate IAM keys alone do not promise isolated service quotas. See [AWS ownership](aws-credentials.md#online-public-editor-and-independent-cli).
+AWS permissions. Separate IAM keys alone do not promise isolated service quotas. See [AWS ownership](aws-credentials.md#editors-and-independent-cli).
 
 ## Per-user federation still to deliver
 
@@ -220,10 +220,8 @@ both target types, invalid-save rejection, inactive-field removal and reload.
 No live AWS registration, warehouse, SQL, generated app or federation flow has
 been exercised.
 
-## Existing-scope closeout — 13 September 2026
+## Scope and limitations
 
 Shared project-owned AWS credentials support serverless/provisioned targets, databases/schemas/tables discovery, table description, parameterized SQL submission, status, typed result pages and cancellation.
 
-No per-user Identity Center/OIDC federation or trusted identity propagation; no role-exchange/automatic credential renewal, default host credential chain, database password or Secrets Manager ARN mode, noncommercial partitions, custom endpoints, warehouse/IAM provisioning, batch SQL, automatic polling/retries or application job-ownership registry. SQL is not SELECT-only: database grants and application authorization enforce allowed work. The host stores request/statement ownership, handles uncertain submission and explicitly cancels remote jobs; local timeout/disconnect cannot do that. Unsafe JavaScript integer results are rejected; cast exact values to text. To extend: implement the already documented federation inputs/exchanges and tests, optional authentication modes and desired orchestration separately. No live provider account, provider registration, paid request or generated-application execution was tested. No new editor coding-assistant tool attachment is claimed. Other frameworks use the same project configuration and their own native tools; JSKIT is optional.
-
-16 source and 16 installed-package tests passed on September 13 using the actual AWS SDK with controlled HTTP and private files. September 12 compact/expanded form/lifecycle evidence is retained; no new UI run.
+No per-user Identity Center/OIDC federation or trusted identity propagation; no role-exchange/automatic credential renewal, default host credential chain, database password or Secrets Manager ARN mode, noncommercial partitions, custom endpoints, warehouse/IAM provisioning, batch SQL, automatic polling/retries or application job-ownership registry. SQL is not SELECT-only: database grants and application authorization enforce allowed work. The host stores request/statement ownership, handles uncertain submission and explicitly cancels remote jobs; local timeout/disconnect cannot do that. Unsafe JavaScript integer results are rejected; cast exact values to text. To extend: implement the already documented federation inputs/exchanges and tests, optional authentication modes and desired orchestration separately. Assistant tool attachment requires explicit host integration. Other frameworks use the same project configuration and their own native tools; JSKIT is optional.

package/docs/apollo-io.md

@@ -101,14 +101,6 @@ The application owner must arrange the capacity and usage limits it needs. The r
 automatically retry requests.
 [Rate limits](https://docs.apollo.io/reference/rate-limits).
 
-## Focused evidence
-
-Tests use simulated provider replies and actual temporary encrypted JSON
-storage. They verify headers, POST bodies, empty accounts, page/name boundaries,
-malformed replies, provider failures, restart, rotation, ownership and
-disconnect. The editor case verifies secret references, setup links and reload.
-Live API calls, provider signup and sample-app generation are excluded.
-
 ## Operations and endpoint permissions
 
 API-key permissions are provider settings, not OAuth scopes in `integrations.json`.

package/docs/ashby.md

@@ -101,14 +101,6 @@ organization capacity or change licensed product access. Application owners
 must arrange the capacity needed for their usage. No callback is used, so editor VM and deployed app
 domains do not change this flow. A jobs result does not establish user login.
 
-## Focused evidence
-
-Simulated provider tests cover Basic headers, POST bodies, explicit paging,
-empty results, invalid envelopes, HTTP-200 failures, input boundaries, real
-temporary file-store restart, rotation, ownership and disconnect. Editor
-automation verifies reference-only configuration and save/reload. Live provider
-use, organization signup and sample-app generation are excluded.
-
 ## Recruiter workflow operations
 
 All calls use the fixed `https://api.ashbyhq.com` origin, Basic key authentication

package/docs/attention.md

@@ -100,14 +100,6 @@ provider capacity arrangements for its usage. Each
 customer organization supplies its own authorized key. No OAuth callback is
 used, so VM subdomains and deployed app domains do not change this flow.
 
-## Focused evidence
-
-Simulated protocol tests with real temporary JSON state cover the bearer header,
-current endpoint, title encoding, page bounds, detailed-transcript selection,
-partial metadata, empty results, failures, ownership, restart, rotation and
-disconnect. The editor check verifies reference-only saving and reload.
-Live provider requests, key provisioning and sample-app generation are excluded.
-
 ## Complete app workflows
 
 The provider's [OpenAPI contract](https://docs.attention.com/api-reference/openapi.json)

package/docs/aws-athena.md

@@ -67,8 +67,8 @@ and separately configure IAM, Glue/S3 resources and encryption. It cannot grant
 itself account access. Neither provisioning nor credential renewal is part of
 this fragment.
 
-For Online and public operation there is **no OAuth callback URL** in this
-mode. See [AWS ownership and quota isolation](aws-credentials.md#online-public-editor-and-independent-cli).
+For hosted and installed editors there is **no OAuth callback URL** in this
+mode. See [AWS ownership and quota isolation](aws-credentials.md#editors-and-independent-cli).
 Separate workgroups do not isolate account service quotas. The application
 operator supplies AWS credentials, chooses resources and controls their budget.
 The same application-owned setup works from CLI or editor without a Vibe64

package/docs/aws-credentials.md

@@ -36,7 +36,7 @@ Use an IAM identity restricted to the intended resources, not an account root ke
 Account enrollment, billing and administrator access are prerequisites; adding
 an integration does not create an AWS account or confer administrator rights.
 
-## Online, public editor and independent CLI
+## Editors and independent CLI
 
 There is **no OAuth registration, redirect URI or universal callback URL** for
 these credential modes. The app's VPS and custom domain do not change the AWS

package/docs/aws-s3.md

@@ -87,7 +87,7 @@ An authorized AI can use CreateBucket, IAM policies and
 [PutBucketCors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketCors.html)
 to perform these administrative steps. Provisioning is not an adapter operation.
 For application-owned credentials, quota boundaries and the absence of a callback URL,
-see [AWS ownership](aws-credentials.md#online-public-editor-and-independent-cli).
+see [AWS ownership](aws-credentials.md#editors-and-independent-cli).
 
 ## Runtime operations
 

package/docs/bigquery.md

@@ -137,10 +137,8 @@ limits. Query submission uses the configured billing/execution project.
 Automated tests cover consent, scopes, replay, private-file restart, isolation,
 pagination, empty pages and provider failures without live queries or projects.
 
-## Existing-scope closeout — 13 September 2026
+## Scope and limitations
 
 Project-owned delegated Google OAuth supports project/dataset/table discovery, table metadata, named scalar GoogleSQL parameters, query submission, job status, result pagination and cancellation in the configured execution project.
 
-No service-account key, ADC, workload-identity federation or deployment identity issuance. No array/struct/null parameters, automatic retry/polling/pagination, dry-run operation, load/extract/copy/streaming jobs, dedicated dataset/table administration or cross-project input override. SQL may incur charges and perform IAM-permitted writes; maximumBytesBilled is optional, not an account budget. Connection checking lists projects and does not prove query/dataset permissions. The app owns SQL authorization, per-user job ownership, result rendering, billing choices and cancellation follow-up; DONE or a cancellation acknowledgement does not prove successful execution/stopping. To extend: implement deployment-owned federation and its renewal/tests, then only required job/parameter modes. No Vibe64 identity gateway. No live provider account, provider registration, paid request or generated-application execution was tested. No new editor coding-assistant tool attachment is claimed. Other frameworks use the same project configuration and their own native tools; JSKIT is optional.
-
-9 source and 9 installed-package BigQuery checks passed on September 13. September 12 compact/expanded configuration, IAM guidance and lifecycle browser evidence is retained; no new UI run.
+No service-account key, ADC, workload-identity federation or deployment identity issuance. No array/struct/null parameters, automatic retry/polling/pagination, dry-run operation, load/extract/copy/streaming jobs, dedicated dataset/table administration or cross-project input override. SQL may incur charges and perform IAM-permitted writes; maximumBytesBilled is optional, not an account budget. Connection checking lists projects and does not prove query/dataset permissions. The app owns SQL authorization, per-user job ownership, result rendering, billing choices and cancellation follow-up; DONE or a cancellation acknowledgement does not prove successful execution/stopping. To extend: implement deployment-owned federation and its renewal/tests, then only required job/parameter modes. No identity gateway is supplied. Assistant tool attachment requires explicit host integration. Other frameworks use the same project configuration and their own native tools; JSKIT is optional.

package/docs/calendly.md

@@ -55,13 +55,13 @@ do not share one person's token across unrelated applications.
 Automated fixtures cover headers, required inputs, pagination, storage restart,
 rotation, isolation and failure handling. No live scheduling data was accessed.
 
-## Web OAuth setup and delivery status
+## Web OAuth setup
 
 The captured connection experience uses OAuth scopes. Personal tokens above
 are a separate setup choice. OAuth uses the existing connection service and
-the project-owned registration; it needs no Vibe64 authentication gateway.
+the project-owned registration; it needs no authentication gateway.
 
-Provider setup, checked against the official guide on 12 September 2026:
+Provider setup:
 
 1. Open the [developer portal](https://developer.calendly.com/docs/authentication/creating-an-oauth-app)
    and sign in or create a developer account. This is separate from the normal
@@ -84,7 +84,7 @@ Provider setup, checked against the official guide on 12 September 2026:
    confused with the OAuth Client Secret.
 6. Configure the registration with `tokenEndpointAuthMethod: client_secret_basic`
    for a web client. Its secret belongs to the generated app's backend, never
-   the browser or Vibe64's platform account. The shared provider metadata selects Basic authentication for web OAuth.
+   the browser or an editor's platform account. The shared provider metadata selects Basic authentication for web OAuth.
 7. Register a changed custom-domain callback in the provider application before
    reconnecting. The provider application's menu offers **Edit**, including
    Redirect URI, followed by **Save**.
@@ -97,19 +97,9 @@ these web-application instructions. Persist each replacement refresh token
 under the existing grant lock rather than replaying a consumed refresh token.
 The profile and event-type operations retain their current fixed API origin.
 
-Required focused proof before marking this provider complete: OAuth configuration
-and captured scope choices, Basic authentication on code exchange and refresh,
-PKCE/state checks, rotated-token persistence, denial/cancel/reconnect/disconnect,
-and the existing personal-token flow. Live consent and scheduling remain outside
-the controlled-test scope.
-
 Sources: [OAuth app creation](https://developer.calendly.com/docs/authentication/creating-an-oauth-app),
 [token endpoint](https://developer.calendly.com/api-docs/calendly-o-auth/o-auth/post-oauth-refresh-token).
 
-The focused `test/calendly.test.js` fixture passes Basic code exchange, S256
-PKCE, concurrent refresh serialization, replacement refresh persistence across
-a new service instance, personal-token connection and local disconnect. This does not establish live Calendly consent or token issuance.
-
 ## Scheduling operations and application ownership
 
 Both authentication methods use these same operations through `service.invoke`.

package/docs/chargebee.md

@@ -118,15 +118,6 @@ The application owns its credential selection and usage policy. Separate
 provider capacity requires the appropriate site/account arrangement. A test
 site is not additional production capacity.
 
-## Focused evidence
-
-Six tests use simulated Chargebee replies and real temporary encrypted JSON
-files. They cover Basic authentication, file restart, rotation, ownership,
-disconnect, unsafe site/credential rejection, site changes, cursors, deleted
-records, page-size limits and failures. The editor check covers site validation,
-reference-only storage and persistence after reload. Provider signup, live API
-requests, billing changes and sample-app generation are excluded.
-
 ## Billing operations and recovery
 
 | Operations | Result / boundary |

package/docs/clickhouse.md

@@ -192,7 +192,7 @@ path segments. It does not resolve DNS or impose network policy. The host must
 restrict configuration editing and its backend's network access. Redirects are
 rejected; credentials never go in the URL or browser configuration.
 
-## Automation and Online ownership
+## Automation and hosted ownership
 
 An AI can prepare portable JSON and wire the library. With an authorized
 database administrator connection, it can provision users, grants, profiles and

package/docs/confidence-oauth.md

@@ -125,12 +125,6 @@ entitlements. Registration acceptance and commercial use need provider proof.
 The editor exposes explicit automatic or manual client registration and the
 application-owned connection lifecycle. Live provider registration and consent remain unverified.
 
-## Evidence
-
-Controlled tests exercise both MCP paths, common resource binding, confidential
-registration, file ownership and restart, refresh, exact tool policy, malformed
-responses, permission errors, cancellation and no request replay. Provider guide
-JSON and responsive editor persistence are checked separately. No live provider
-account, registration, consent, flag mutation, experiment run, database or
-generated application is used. Metadata discovery alone does not prove live
-registration or token acceptance.
+## Discovery limits
+
+Metadata discovery alone does not prove live registration or token acceptance.

package/docs/contentful.md

@@ -100,18 +100,10 @@ Different key names do not establish independent quota allocations.
 For Laravel, use native HTTP/configuration tools and the public application
 setup command contract; this package provides JavaScript code only.
 
-## Version-zero change and evidence
-
-The initial unpublished CMA `spaces.list` fragment has been replaced. Existing
-experimental configurations must supply `settings.spaceId`, a Delivery token,
-and use `entries.list`. There is no compatibility alias or automatic token
-conversion. Environment and region default to `master` and `us` respectively.
-
-Focused controlled tests cover delivery headers and paths, EU/environment
-selection, invalid settings before transport, published-entry validation,
-page limits, private file-store restart, token rotation, isolation, disconnect
-and provider failures. No live Contentful account or generated app was used.
+## Configuration and limitations
 
+Configurations supply `settings.spaceId`, a Delivery token, and use
+`entries.list`. Environment and region default to `master` and `us` respectively.
 
 **LIMITATIONS:** Assistant tool attachment requires explicit host integration: the app can display published
 articles and images, but saving this connection does not let the coding assistant
@@ -119,5 +111,4 @@ browse the space. This connector does not author/publish content or render a CMS
 interface. For example, publish the article and hero asset in Contentful first;
 the app then resolves their IDs and renders them with its native components.
 Cross-space authenticated links, Sync/cursor feeds and asset transformation are
-native extensions, not silently fetched. Controlled tests cover links, locale
-shapes, pagination, resource reads and errors; no live content was accessed.
+native extensions, not silently fetched.

package/docs/databricks.md

@@ -149,15 +149,15 @@ Tokens remain encrypted; source contains references. Disconnect removes the
 local connection and attempts without deleting the principal or revoking the
 provider application globally.
 
-## Public, Online and automation
+## Editors, hosting and automation
 
 Register the real callback implemented by the runtime that owns this connection.
 For an application integration, use the application's assigned hosting URL as
 the initial origin and its implemented callback path. Store the exact callback
 in its Env reference and provider registration. A domain change requires updating
 both values if the callback URL changes; retain the application identity and its
-persistent grants when moving hosts. Public Vibe64, Online and CLI users supply
-their own registrations through this same contract.
+persistent grants when moving hosts. Every editor and CLI supplies its own
+registrations through this same contract.
 See the [callback guide](../../connectors-core/docs/oauth-callbacks.md).
 
 Service principals have no callback. Databricks custom applications are created
@@ -178,3 +178,35 @@ privileges; this fragment does not implement provisioning endpoints.
 Live accounts, consent, private networking, account-level operations, SQL/data
 queries, jobs execution and app login are unverified or
 unfinished. Local proof uses controlled HTTP responses and encrypted files.
+
+## OAuth pattern composition: Databricks user consent and service accounts
+
+Import `databricksProvider` from `@jskit-ai/connectors-catalog/server/databricks`.
+Read this guide for the two portable configurations. A custom OAuth app
+uses `authorization_code`, `client_secret_post`, a callback reference and
+`all-apis offline_access`. A service principal uses `client_credentials`,
+`client_secret_basic` and its Databricks OAuth secret reference; it has no
+callback or user refresh token. Use `jobs` for a suitably scoped service secret.
+Service principals cannot use `per-user` ownership.
+
+Compose the ordinary connections service/Feature and file store. Call
+`connectClientCredentials` or the `connectors.verifyClientCredentials` action
+to verify a service principal. User access still uses `beginAuthorization` and
+`completeAuthorization`. The library owns token requests, renewal, secret
+resolution, state, grant checks and persistence; do not generate replacements
+in the application. The app owns routes, binding values and trusted identity.
+
+`jobs.list` reads one page with `limit`, `name`, `expand_tasks` and `page_token`.
+`jobs.get` reads one job with a safe numeric `job_id` and optional continuation
+token. Empty lists may omit `jobs`; nested job arrays may need further pages.
+No job execution, SQL query, compute startup or write operation is implemented.
+Source permission changes to a service account require reconnecting. The
+runtime renews only its prior grant and commits renewal even if a later API
+read fails. Never supply an arbitrary request URL or reuse a service grant as
+an app user's connection.
+
+Both flows pin requests to the configured per-workspace origin. The application
+implements and registers its own user-consent callback. Its registration belongs
+to its Databricks account; it is not automatically universal across customer
+accounts. Follow the guide for admin provisioning and direct CLI wiring.
+Application login remains separate.

package/docs/dbt-semantic-layer.md

@@ -116,7 +116,7 @@ Environment ID and backend Env token. They send the documented GraphQL requests
 and implement their own result parsing/access policy. No JSKIT dependency or
 Vibe64 service is required for those applications.
 
-## Public, Online and universal URLs
+## Editors and universal URLs
 
 This service-token variant has **no OAuth registration or callback URL**.
 There is no universal URL to enter in dbt for it. The customer's VM or custom
@@ -139,7 +139,7 @@ provision provider accounts or warehouse capacity.
 | Provision warehouse identities, dbt credentials and service tokens | Account-admin setup is required. The reviewed setup instructions do not establish a complete provisioning API; do not claim automated creation. An authorized operator can follow the portal steps above. |
 | Choose account capacity or grant access | Requires the owner's account and warehouse decisions. No change is made by saving a form. |
 
-## Current limits and evidence
+## Current limits
 
 Queries accept 1–100 metrics (`name`, optional `alias`), up to 100 dimensions
 (`name`, optional `grain`: DAY/WEEK/MONTH/QUARTER/YEAR), and up to 20 trusted
@@ -167,9 +167,3 @@ does not build the chart or a continuous warehouse dashboard. Assistant tool att
 requires explicit host integration. Personal access
 tokens are another documented provider option; the captured service-token setup
 is the supported initial onboarding journey.
-
-Controlled HTTP/file tests cover configuration, host restrictions, precise IDs,
-metadata, empty pages, ownership, restart, rotation, malformed responses,
-permission failures, cancellation and timeout. Live account setup, actual data
-access and generated applications are not exercised. Editor form proof is
-recorded separately when the installed package has passed browser checks.

package/docs/figma.md

@@ -84,8 +84,8 @@ For an application integration, use the application's assigned hosting URL as
 the initial origin and its implemented callback path. Store the exact callback
 in its Env reference and provider registration. A domain change requires updating
 both values if the callback URL changes; retain the application identity and its
-persistent grants when moving hosts. Public Vibe64, Online and CLI users supply
-their own registrations through this same contract.
+persistent grants when moving hosts. Every editor and CLI supplies its own
+registrations through this same contract.
 See the [callback guide](../../connectors-core/docs/oauth-callbacks.md).
 
 The registration and grants belong to the application or explicitly authorized
@@ -116,10 +116,10 @@ fixed JSKIT design schema; fixtures demonstrate consumption rather than assertin
 an immutable live tool signature. The host chooses the target framework and
 performs code generation itself.
 
-**LIMITATIONS:** This supplies remote MCP only. Installed Vibe64 and Online can
+**LIMITATIONS:** This supplies remote MCP only. Installed and hosted editors can
 both use the remote server with their own approved registration. Desktop MCP is
-local to the machine running Figma Desktop and the consuming client: on Online,
-127.0.0.1 means the VPS, not the user's laptop. Native desktop clients may configure
+local to the machine running Figma Desktop and the consuming client: on a hosted
+editor, 127.0.0.1 means the server, not the user's laptop. Native desktop clients may configure
 Figma Desktop independently; no tunnel/proxy is provided here. Government-only
 desktop deployments are outside this remote connector.
 

package/docs/firebase-cloud-messaging.md

@@ -156,7 +156,7 @@ The application's policy must authorize the audience and payload before a
 `messages.send` action. A shared service credential grants no user permission
 to send to arbitrary installations or topics. No login functionality is implied.
 
-## Public, Online and custom domains
+## Editors, hosting and custom domains
 
 **Universal OAuth callback URL: not applicable.** Service-account authorization
 is a server-to-server exchange, with no browser redirect to register. A VPS
@@ -167,8 +167,8 @@ installation association. Existing cookies or browser permissions do not move
 between unrelated domains.
 
 The application owner supplies the Firebase project and sender credentials.
-Online and installed-editor projects use the same configuration and runtime;
-Vibe64 supplies no shared Firebase project or platform sender key. Two service
+Hosted and installed-editor projects use the same configuration and runtime;
+no editor supplies a shared Firebase project or platform sender key. Two service
 accounts or Web apps inside one project do not split its project quota.
 [FCM quota ownership](https://firebase.google.com/docs/cloud-messaging/throttling-and-quotas)
 

package/docs/firecrawl.md

@@ -89,7 +89,7 @@ None of these partner operations is implemented or exercised by this fragment.
 An AI can prepare the JSON/environment reference, validate it, compose the
 library calls and check the key through the documented credit endpoint after
 an operator supplies it. Account/team selection, billing and key issuance are
-operator steps for own-key setup. Online can implement partner provisioning
+operator steps for own-key setup. A hosting platform can implement partner provisioning
 after approval; a standard API key cannot substitute for the partner key.
 
 The application owner supplies its Firecrawl key through private Env. Keys for

package/docs/fireflies.md

@@ -57,8 +57,7 @@ partial errors, HTTP failures, credential rotation, private persistence and
 application isolation. They do not access real meetings.
 
 Setup rechecked against the official authorization and quickstart guides on
-12 September 2026. The captured Lovable form was an empty shell; exact input
-parity remains unproven. No signed-in Fireflies console was inspected.
+12 September 2026. No signed-in Fireflies console was inspected.
 
 ## Transcript content and search
 
@@ -82,14 +81,12 @@ cache, task tracking and CRM writes through their respective APIs.
 **LIMITATIONS:** assistant tool attachment requires explicit host integration. Example: a
 published app can show a sales call's action items; an assistant
 does not gain meeting access from this configuration. Recording, transcript
-mutation, incoming webhooks and per-user OAuth are not supplied (the Lovable
-reference also describes these as excluded). Exact signed-in screen placement
-was not captured; current official instructions establish API-key setup.
+mutation, incoming webhooks and per-user OAuth are not supplied.
+Exact signed-in screen placement was not captured; current official instructions establish API-key setup.
 
 Rechecked 13 September 2026 against [transcript detail](https://docs.fireflies.ai/graphql-api/query/transcript),
-[search](https://docs.fireflies.ai/graphql-api/query/transcripts),
-[authorization](https://docs.fireflies.ai/fundamentals/authorization) and
-[Lovable's current fields/capabilities](https://docs.lovable.dev/integrations/fireflies).
-The latter resolves the empty original form: display name and an API key are
-required inputs for its shared connection. The host stores a private Env reference
+[search](https://docs.fireflies.ai/graphql-api/query/transcripts) and
+[authorization](https://docs.fireflies.ai/fundamentals/authorization).
+The authorization guide establishes the API key as the only provider credential.
+The host stores a private Env reference
 instead of putting the key in the source file. No live meetings were read.

package/docs/gemini-enterprise.md

@@ -100,9 +100,10 @@ caller-selected source identity, impersonation header or Workforce Identity toke
 ## Application ownership, callbacks and capacity
 
 The application owner creates the provider registration and stores its secret
-in the application's private Env. Public Vibe64, Vibe64 Online and CLI users use
-this same ownership model. The configuration file holds the client ID and Env
-references; the editor does not own the application's grants.
+in the application's private Env. Every editor and CLI uses this same
+[ownership model](../../connectors-core/docs/online-setup.md): the configuration
+file holds the client ID and Env references; the editor does not own the
+application's grants.
 
 Register the exact callback implemented by the application. For a hosted project,
 start with its assigned application URL and append the implemented callback path.
@@ -222,3 +223,32 @@ internal app can answer leave-policy questions with Google citations, but
 configuring it does not import company files or grant every employee access.
 Controlled fixtures prove request/response handling; real ACLs, licensing,
 relevance and summary quality remain untested.
+
+## OAuth pattern composition: Gemini Enterprise search
+
+Use `geminiEnterpriseProvider` from
+`@jskit-ai/connectors-catalog/server/gemini-enterprise` with the existing core
+connection service. this guide contains the portable file and
+provider setup worksheet. Store `projectId`, `location` (`global`, `us`, `eu`)
+and `engineId` as settings, with a confidential Google OAuth registration and
+the `https://www.googleapis.com/auth/cloud-platform` scope. The settings choose
+the API origin and the engine under `default_collection`; callers cannot change
+the target or supply a source identity in an operation request.
+
+`engine.get` checks metadata access. `search` accepts `query`, `pageSize` (1–25,
+default 10) and optional `pageToken`. Reuse the same query/page size while
+paginating. The result is Google's JSON envelope, not a generated answer. Treat
+document snippets and `redirectUri` as untrusted data; do not follow returned URLs
+automatically. Search permission and source access are separate from engine
+metadata permission. Shared and assistant modes act as one connected Google
+account, so authorize every caller before exposing that account's search results.
+This fragment implements no per-user Google identity, Workforce Identity, widget,
+resource ingestion, app login or chat sessions.
+
+The application implements and registers its own callback. A callback domain
+change requires updating its provider registration and environment binding.
+Independent Google Cloud registration projects can separate some quotas, but
+engine billing and limits also depend on the project hosting the engine. Don't
+claim two OAuth client IDs isolate all paid/free consumption. An authorized AI
+can help prepare resource/IAM configuration; Google Auth Platform client setup,
+verification, consent and licensing remain explicit operator/provider tasks.

package/docs/gong.md

@@ -143,15 +143,6 @@ This implemented key flow has no callback registration. A separate OAuth
 implementation must use the application's actual registered callback and own
 its grants. It is not implemented by this key adapter.
 
-## Focused evidence
-
-Seven tests use simulated Gong responses and real temporary encrypted JSON state.
-They cover default/customer origins, Basic credentials, file restart, rotation,
-ownership, disconnect, host/key changes, unsafe URL rejection, cursor encoding,
-avatar selection and failures. The public editor check verifies required keys,
-secret references, company URL validation, reload and default restoration.
-No live Gong access, account creation or example application execution is used.
-
 ## Call analysis and linked deal context
 
 `calls.extensive` returns metadata, participants, available call summaries/topics,