@lanes-sh/link 0.6.11 → 0.7.0

package/src/providers/microsoft/specs/vendor.ts

@@ -0,0 +1,232 @@
+/**
+ * Vendor trimmed OpenAPI specs for Microsoft Graph.
+ *
+ * One API behind five providers. Graph is a single enormous surface — 7,419
+ * paths and 2,599 schemas in the published document — and mail, calendars,
+ * contacts, files, and to-do are all reached through it under one OAuth client.
+ * That is the opposite of Google, where each product has its own spec, and it is
+ * why the selection below is keyed by *provider* rather than by API: what
+ * separates `outlook_mail` from `outlook_calendar` is the operations each is
+ * allowed to name, nothing else.
+ *
+ *   bun run vendor:microsoft
+ *
+ * The pipeline is `src/providers/shared/vendor-spec.ts`. What stays here is what
+ * only Graph knows: which operations are worth exposing, and which of its OData
+ * parameters have to go.
+ */
+
+import { vendorSpec } from '../../shared/vendor-spec.ts';
+
+/** APIs.guru's generated OpenAPI for Graph v1.0 — the same source Google's uses. */
+const SOURCE = 'https://api.apis.guru/v2/specs/microsoft.com/graph/1.0.1/openapi.json';
+
+/**
+ * Bodies narrowed to what the call actually writes.
+ *
+ * `PATCH /me/messages/{id}` takes a whole `microsoft.graph.message` — every
+ * field of a mail item, including the ones the service computes — which inlines
+ * to 346 KB against a 64 KB budget. What a caller changes on an existing message
+ * is whether it has been read, how it is filed, and how urgent it is.
+ *
+ * Projected rather than hand-written, so a field Microsoft renames or makes
+ * read-only fails `bun run vendor:microsoft` instead of becoming an argument
+ * Graph silently ignores.
+ */
+const PROJECTED: Record<string, readonly string[]> = {
+  'me.UpdateMessages': ['isRead', 'categories', 'flag', 'importance'],
+  'me.CreateEvents': [
+    'subject',
+    'body',
+    'start',
+    'end',
+    'location',
+    'attendees',
+    'isAllDay',
+    'isOnlineMeeting',
+    'reminderMinutesBeforeStart',
+    'showAs',
+    'recurrence',
+  ],
+  'me.UpdateEvents': [
+    'subject',
+    'body',
+    'start',
+    'end',
+    'location',
+    'attendees',
+    'isAllDay',
+    'isOnlineMeeting',
+    'reminderMinutesBeforeStart',
+    'showAs',
+  ],
+  'me.todo.CreateLists': ['displayName'],
+  'me.todo.lists.CreateTasks': [
+    'title',
+    'body',
+    'dueDateTime',
+    'reminderDateTime',
+    'importance',
+    'status',
+    'categories',
+  ],
+  'me.todo.lists.UpdateTasks': [
+    'title',
+    'body',
+    'dueDateTime',
+    'reminderDateTime',
+    'importance',
+    'status',
+    'categories',
+  ],
+  'drives.items.CreateChildren': ['name', 'folder', 'file'],
+};
+
+/**
+ * `sendMail`'s body, written out rather than projected.
+ *
+ * The only one that cannot be projected: Graph declares it as a shared
+ * `requestBodies` component rather than a schema reference, so there is no
+ * entity to narrow — and the wide form is the same 346 KB `message` again.
+ *
+ * Deliberately without `attachments`. Graph takes those as base64 inside the
+ * message, which is precisely what ADR-017 exists to avoid; attaching a file
+ * here would mean the model emitting the file. Sending an attachment from
+ * Outlook needs the same treatment `gmail.send_message` has, and until it has
+ * one, offering the field would be advertising a route that costs a context
+ * window.
+ */
+const SEND_MAIL_BODY = {
+  type: 'object',
+  required: ['message'],
+  properties: {
+    message: {
+      type: 'object',
+      required: ['subject', 'body', 'toRecipients'],
+      properties: {
+        subject: { type: 'string' },
+        body: {
+          type: 'object',
+          required: ['contentType', 'content'],
+          properties: {
+            contentType: { type: 'string', enum: ['text', 'html'] },
+            content: { type: 'string' },
+          },
+        },
+        toRecipients: { type: 'array', items: { $ref: '#/components/schemas/microsoft.graph.recipient' } },
+        ccRecipients: { type: 'array', items: { $ref: '#/components/schemas/microsoft.graph.recipient' } },
+        bccRecipients: { type: 'array', items: { $ref: '#/components/schemas/microsoft.graph.recipient' } },
+      },
+    },
+    saveToSentItems: {
+      type: 'boolean',
+      description: 'Keep a copy in Sent Items. Defaults to true.',
+    },
+  },
+} as const;
+
+const SELECTION: Record<string, { out: string; operations: string[]; opaque?: string[] }> = {
+  outlook_mail: {
+    out: 'outlook-mail.v1.json',
+    operations: [
+      'me.ListMessages',
+      'me.GetMessages',
+      'me.UpdateMessages',
+      'me.ListMailFolders',
+      'me.sendMail',
+      'me.messages.ListAttachments',
+      'me.messages.GetAttachments',
+    ],
+  },
+  outlook_calendar: {
+    out: 'outlook-calendar.v1.json',
+    operations: [
+      'me.ListCalendars',
+      'me.ListEvents',
+      'me.GetEvents',
+      'me.CreateEvents',
+      'me.UpdateEvents',
+      'me.DeleteEvents',
+      'me.ListCalendarView',
+    ],
+  },
+  outlook_contacts: {
+    out: 'outlook-contacts.v1.json',
+    operations: [
+      // Read-only, matching Google's contacts provider rather than what Graph
+      // would allow. An address book is what makes "email Bob" resolve; nothing
+      // here needs to write one, and `Contacts.Read` is a materially smaller
+      // grant than `Contacts.ReadWrite`.
+      'me.ListContacts',
+      'me.GetContacts',
+      'me.ListContactFolders',
+    ],
+  },
+  onedrive: {
+    out: 'onedrive.v1.json',
+    operations: [
+      'me.GetDrive',
+      'drives.GetRoot',
+      'drives.GetItems',
+      'drives.items.ListChildren',
+      'drives.GetItemsContent',
+      'drives.items.CreateChildren',
+      'drives.drive.items.driveItem.search',
+    ],
+  },
+  microsoft_todo: {
+    out: 'microsoft-todo.v1.json',
+    operations: [
+      'me.todo.ListLists',
+      'me.todo.CreateLists',
+      'me.todo.lists.ListTasks',
+      'me.todo.lists.GetTasks',
+      'me.todo.lists.CreateTasks',
+      'me.todo.lists.UpdateTasks',
+      'me.todo.lists.DeleteTasks',
+    ],
+  },
+};
+
+/**
+ * OData parameters that are noise rather than capability.
+ *
+ * Not the same judgement as Google's list, and worth saying why. `$select`,
+ * `$filter`, `$top`, `$orderby` and `$search` are how a caller asks Graph for
+ * less, and dropping them would leave an agent pulling whole mailboxes — so they
+ * stay. What goes is the paging and shaping machinery an agent has no use for
+ * here: `$expand` pulls related entities and multiplies the response, `$count`
+ * and `$skip` belong to a pagination scheme `@odata.nextLink` already answers,
+ * and `ConsistencyLevel` is a header for advanced queries none of these make.
+ */
+const SYSTEM_PARAMETERS = new Set(['$expand', '$count', '$skip', 'ConsistencyLevel']);
+
+const VENDORED_NOTE =
+  'Trimmed by src/providers/microsoft/specs/vendor.ts. Committed deliberately: a spec decides which paths are called with the operator token, so it must be reviewable rather than fetched at connect time.';
+
+const OPAQUE_NOTE =
+  'Structure omitted: it expands to megabytes when inlined. ' +
+  'Pass the object as documented at https://learn.microsoft.com/graph/api/overview.';
+
+for (const [id, selection] of Object.entries(SELECTION)) {
+  await vendorSpec(id, {
+    source: SOURCE,
+    outputDirectory: import.meta.dir,
+    out: selection.out,
+    operations: selection.operations,
+    ...(selection.opaque ? { opaque: selection.opaque } : {}),
+    opaqueNote: OPAQUE_NOTE,
+    vendoredNote: VENDORED_NOTE,
+    systemParameters: SYSTEM_PARAMETERS,
+    // Graph declares a path's parameters on the path item rather than on each
+    // operation, so `{message-id}` is in the URL and in nothing the generator
+    // reads. Without this it refuses the whole document with MISSING_PATH_PARAMETER
+    // — the same shape Discord has, and the reason the flag is not Discord's.
+    hoistPathParameters: true,
+    projectRequestBody: PROJECTED,
+    projectionNote:
+      'The fields this call writes. A message carries far more, and the rest is computed by Graph ' +
+      'rather than set here.',
+    rewriteRequestBody: { 'me.sendMail': SEND_MAIL_BODY },
+  });
+}

package/src/providers/microsoft/todo/index.ts

@@ -0,0 +1,54 @@
+import { defineProvider } from '#connectivity';
+import {
+  CALENDAR_SCOPES,
+  CONTACTS_SCOPES,
+  FILES_SCOPES,
+  GRAPH_BASE_URL,
+  MAIL_SCOPES,
+  MICROSOFT_APP,
+  MICROSOFT_AUTHORIZE_URL,
+  MICROSOFT_IDENTITY,
+  MICROSOFT_TOKEN_URL,
+  TODO_SCOPES,
+  specPath,
+} from '../shared/oauth.ts';
+import { microsoftSetup } from '../shared/setup.ts';
+
+/**
+ * Microsoft To Do.
+ *
+ * Named `microsoft_todo` rather than `todo` for the same reason Google's list is
+ * `google_tasks`: `tasks` is the owner layer's own store and is a reserved id,
+ * so a vendor's task list has to say whose it is. See ADR-051.
+ */
+export const microsoftTodo = defineProvider({
+  id: 'microsoft_todo',
+  name: 'Microsoft To Do',
+  description: 'Create, edit, complete, and organise tasks and lists in Microsoft To Do.',
+  connector: { kind: 'http', base_url: GRAPH_BASE_URL, openapi: specPath('microsoft-todo.v1.json') },
+  auth: {
+    kind: 'oauth',
+    registration: 'manual',
+    app: MICROSOFT_APP,
+    // Declared rather than discovered. An `http` connector has no metadata
+    // document to read — a REST API does not announce where its authorization
+    // server lives — so the two endpoints are part of the manifest.
+    authorize_url: MICROSOFT_AUTHORIZE_URL,
+    token_url: MICROSOFT_TOKEN_URL,
+    scopes: TODO_SCOPES,
+    revoke_url: 'https://account.live.com/consent/Manage',
+  },
+  identity: MICROSOFT_IDENTITY,
+  setup: microsoftSetup('Microsoft To Do', TODO_SCOPES),
+  redact: {
+    'me.todo.ListLists': ['top', 'orderby', 'select'],
+    // The list's name is what the owner called it, which is theirs.
+    'me.todo.CreateLists': [],
+    'me.todo.lists.ListTasks': ['todoTaskList-id', 'top', 'orderby', 'select'],
+    'me.todo.lists.GetTasks': ['todoTaskList-id', 'todoTask-id', 'select'],
+    // Which list, and afterwards which task — never the title or the note.
+    'me.todo.lists.CreateTasks': ['todoTaskList-id', 'importance', 'status'],
+    'me.todo.lists.UpdateTasks': ['todoTaskList-id', 'todoTask-id', 'importance', 'status'],
+    'me.todo.lists.DeleteTasks': ['todoTaskList-id', 'todoTask-id'],
+  },
+});

package/src/providers/miro/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Miro registers us at connect time — nothing for an operator to set up. */
+export const miro = defineProvider({
+  id: 'miro',
+  name: 'Miro',
+  description: 'Boards, frames, sticky notes, and shapes, via Miro\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.miro.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/mixpanel/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Mixpanel registers us at connect time — nothing for an operator to set up. */
+export const mixpanel = defineProvider({
+  id: 'mixpanel',
+  name: 'Mixpanel',
+  description: 'Events, funnels, retention, and cohorts, via Mixpanel\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.mixpanel.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/monday/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** monday.com registers us at connect time — nothing for an operator to set up. */
+export const monday = defineProvider({
+  id: 'monday',
+  name: 'monday.com',
+  description: 'Boards, items, groups, columns, and updates, via monday.com\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.monday.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/mux/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Mux registers us at connect time — nothing for an operator to set up. */
+export const mux = defineProvider({
+  id: 'mux',
+  name: 'Mux',
+  description: 'Video assets, live streams, and playback analytics, via Mux\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.mux.com' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/navan/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Navan registers us at connect time — nothing for an operator to set up. */
+export const navan = defineProvider({
+  id: 'navan',
+  name: 'Navan',
+  description: 'Trips, bookings, and travel expenses, via Navan\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.navan.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/neon/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Neon registers us at connect time — nothing for an operator to set up. */
+export const neon = defineProvider({
+  id: 'neon',
+  name: 'Neon',
+  description: 'Postgres projects, branches, SQL, and docs, via Neon\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.neon.tech/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/netlify/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Netlify registers us at connect time — nothing for an operator to set up. */
+export const netlify = defineProvider({
+  id: 'netlify',
+  name: 'Netlify',
+  description: 'Sites, deploys, functions, and environment variables, via Netlify\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://netlify-mcp.netlify.app/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/nextcloud/calendar/index.ts

@@ -0,0 +1,28 @@
+import { defineProvider } from '#connectivity';
+import { NEXTCLOUD_APP, NEXTCLOUD_HOST, nextcloudSetup } from '../shared/setup.ts';
+
+/**
+ * Nextcloud calendars, on whichever server the operator runs.
+ *
+ * The first built-in whose address is not a property of the provider. Until a
+ * connection could carry one, a self-hosted service could only be reached by
+ * hand-writing a YAML manifest per instance — which worked, and which nobody
+ * discovers. See ADR-055.
+ */
+export const nextcloudCalendar = defineProvider({
+  id: 'nextcloud_calendar',
+  name: 'Nextcloud Calendar',
+  description: 'Read and create events in Nextcloud calendars over CalDAV, on your own server.',
+  connector: { kind: 'dav', base_url: 'https://{host}', service: 'caldav' },
+  auth: { kind: 'basic', app: NEXTCLOUD_APP },
+  identity: { kind: 'connector' },
+  variables: [NEXTCLOUD_HOST],
+  setup: nextcloudSetup('Nextcloud Calendar'),
+  redact: {
+    list_events: ['calendar', 'start', 'end', 'limit'],
+    get_event: ['calendar', 'uid'],
+    update_event: ['calendar', 'uid'],
+    delete_event: ['calendar', 'uid'],
+    create_event: ['calendar'],
+  },
+});

package/src/providers/nextcloud/contacts/index.ts

@@ -0,0 +1,18 @@
+import { defineProvider } from '#connectivity';
+import { NEXTCLOUD_APP, NEXTCLOUD_HOST, nextcloudSetup } from '../shared/setup.ts';
+
+export const nextcloudContacts = defineProvider({
+  id: 'nextcloud_contacts',
+  name: 'Nextcloud Contacts',
+  description: 'Search and read contacts in a Nextcloud address book over CardDAV, on your own server.',
+  connector: { kind: 'dav', base_url: 'https://{host}', service: 'carddav' },
+  auth: { kind: 'basic', app: NEXTCLOUD_APP },
+  identity: { kind: 'connector' },
+  variables: [NEXTCLOUD_HOST],
+  setup: nextcloudSetup('Nextcloud Contacts'),
+  redact: {
+    // Not `query`: a name is content.
+    search_contacts: ['addressbook', 'limit'],
+    create_contact: ['addressbook'],
+  },
+});

package/src/providers/nextcloud/index.ts

@@ -0,0 +1,3 @@
+/** Nextcloud's two, sharing one app password and one server address. */
+export { nextcloudCalendar } from './calendar/index.ts';
+export { nextcloudContacts } from './contacts/index.ts';

package/src/providers/nextcloud/shared/setup.ts

@@ -0,0 +1,59 @@
+export const NEXTCLOUD_APP = 'nextcloud';
+
+/**
+ * A hostname pattern, because the default forbids the dots a hostname is made of.
+ *
+ * The default exists to stop a value escaping the domain its manifest named —
+ * `{site}.zendesk.com` must stay at zendesk.com. Here there is no domain to
+ * escape: the manifest is `https://{host}` and the whole address is the
+ * operator's to choose, because the whole point is that it is their server.
+ *
+ * What it still refuses is everything that is not a hostname — no slash, no `@`,
+ * no colon, no port. Those are the characters that would turn a host into a URL
+ * with a different meaning, and none of them belongs in this value.
+ */
+export const HOSTNAME = '^[a-z0-9][a-z0-9.-]*[a-z0-9]$';
+
+export const nextcloudSetup = (product: string) => ({
+  summary:
+    `${product} is on a server you run, so it asks for the address as well as the login. ` +
+    `Nextcloud issues app passwords for exactly this — a per-app password that does not expire and ` +
+    `can be revoked on its own, without changing the one you sign in with.`,
+  docs_url: 'https://docs.nextcloud.com/server/latest/user_manual/en/session_management.html',
+  steps: [
+    'Sign in to your Nextcloud and open Settings → Personal → Security.',
+    'Under "Devices & sessions", enter "Lanes Link" as the app name and choose "Create new app password".',
+    'Copy the password it shows. It is shown once, and it is not your account password.',
+    'You are asked for the server address next — the hostname you sign in at, without https:// and without a path.',
+    'If your Nextcloud lives under a path — cloud.example.com/nextcloud — this provider cannot reach it: the address it builds ends at the host. Declare a manifest of your own in providers.d/ with the full base_url.',
+  ],
+  troubleshooting:
+    'A refused login is usually the account password used where an app password belongs, or a server address ' +
+    'typed with https:// or a trailing path — it wants the bare hostname. Create an app password under ' +
+    'Settings → Security and re-run: lanes link connect nextcloud --replace.',
+  prompts: [
+    {
+      key: 'username',
+      label: 'Nextcloud username',
+      secret: false,
+      scope: 'connection' as const,
+      field: 'username' as const,
+    },
+    {
+      key: 'password',
+      label: 'App password',
+      secret: true,
+      scope: 'connection' as const,
+      field: 'password' as const,
+    },
+  ],
+});
+
+/** The one thing that differs per person, and the reason this provider can exist at all. */
+export const NEXTCLOUD_HOST = {
+  key: 'host',
+  label: 'Nextcloud server address',
+  description: 'The hostname you sign in at, with no https:// and no path.',
+  example: 'cloud.example.com',
+  pattern: HOSTNAME,
+};

package/src/providers/owner.ts

@@ -1,7 +1,8 @@
 /**
- * The owner layer — memory, tasks, assets, skills, vault, setup, identity.
+ * The owner layer — memory, tasks, assets, skills, vault, setup, identity,
+ * entities.
  *
- * Seven providers that hold no third-party account: no OAuth, no vendor API, no
+ * Eight providers that hold no third-party account: no OAuth, no vendor API, no
  * rate limit anyone else imposes. They are ordinary `defineLocalProvider`
  * registrations, scoped by the same profiles and gated by the same policy
  * evaluation as everything else — which was the claim `docs/detailed/init.md`
@@ -33,7 +34,16 @@
  * naming the owner and describing what is connected are two policy decisions
  * instead of one.
  *
- * All seven ids are reserved (`RESERVED_PROVIDER_IDS`) and still refused by
+ * `entities` is its mirror: who and what *everyone else* is — the people,
+ * companies and projects the owner deals with, and their canonical addresses —
+ * so that a reference is looked up rather than inferred from whatever was in
+ * the conversation. It is writable where `identity` is not, and the two are
+ * consistent rather than in tension: identity is configuration, so an agent
+ * able to edit it could edit the one fact that stops it signing as the wrong
+ * person, while everyone else's details are ordinary owner material that
+ * accumulates on the same surface that reads it (ADR-056).
+ *
+ * All eight ids are reserved (`RESERVED_PROVIDER_IDS`) and still refused by
  * default — the registry has to be built with `allowReserved` to hold them, so a
  * third-party provider cannot claim a namespace whose policy rules would then
  * mean something else. `tasks` cost something to reserve: Google Tasks held that
@@ -57,6 +67,8 @@ export { createSkillsProvider, type SkillsProviderOptions } from './skills/provi
 export { createVaultProvider, type VaultProviderOptions } from './vault/provider.ts';
 export { createSetupProvider, type SetupProviderOptions } from './setup/provider.ts';
 export { createIdentityProvider, type IdentityProviderOptions } from './identity/provider.ts';
+export { entitiesProvider } from './entities/provider.ts';
+export { entityStorage, type Attribute, type Entity, type Relation } from './entities/store.ts';
 export { planAll, planFor, type PlanContext, type ProviderPlan } from './setup/plan.ts';
 // The vault's *store* is not here: it is `#secrets`, beside the system
 // credential store it must never become. What lives in `./vault/` is the

package/src/providers/paddle/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Paddle registers us at connect time — nothing for an operator to set up. */
+export const paddle = defineProvider({
+  id: 'paddle',
+  name: 'Paddle',
+  description: 'Products, prices, subscriptions, and transactions, via Paddle\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.paddle.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/paypal/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** PayPal registers us at connect time — nothing for an operator to set up. */
+export const paypal = defineProvider({
+  id: 'paypal',
+  name: 'PayPal',
+  description: 'Invoices, orders, payments, subscriptions, and disputes, via PayPal\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.paypal.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/posthog/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** PostHog registers us at connect time — nothing for an operator to set up. */
+export const posthog = defineProvider({
+  id: 'posthog',
+  name: 'PostHog',
+  description: 'Events, insights, feature flags, and session replays, via PostHog\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.posthog.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/prisma/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Prisma registers us at connect time — nothing for an operator to set up. */
+export const prisma = defineProvider({
+  id: 'prisma',
+  name: 'Prisma',
+  description: 'Postgres databases, schema, and migrations, via Prisma\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.prisma.io/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/ramp/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Ramp registers us at connect time — nothing for an operator to set up. */
+export const ramp = defineProvider({
+  id: 'ramp',
+  name: 'Ramp',
+  description: 'Cards, transactions, reimbursements, and spend limits, via Ramp\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.ramp.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/recurly/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Recurly registers us at connect time — nothing for an operator to set up. */
+export const recurly = defineProvider({
+  id: 'recurly',
+  name: 'Recurly',
+  description: 'Subscriptions, invoices, and accounts, via Recurly\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.recurly.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/reddit/index.ts

@@ -79,7 +79,7 @@ export const reddit = defineProvider({
       'Reddit needs an app of your own, which takes a couple of minutes in a browser. There is no shared ' +
       'client for this one on purpose: Reddit rate-limits per client id, so a client everyone shared would ' +
       'mean strangers using up your hundred requests a minute. Your own app gets its own budget.',
-    docs: 'docs/detailed/setup/reddit.md',
+    docs: 'https://lanes.sh/docs/link/reddit',
     docs_url: 'https://www.reddit.com/prefs/apps',
     steps: [
       'Open https://www.reddit.com/prefs/apps and choose "create another app...".',

package/src/providers/remote/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Remote registers us at connect time — nothing for an operator to set up. */
+export const remote = defineProvider({
+  id: 'remote',
+  name: 'Remote',
+  description: 'Employees, contracts, payroll, and time off, via Remote\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.remote.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/render/index.ts

@@ -0,0 +1,35 @@
+import { defineProvider } from '#connectivity';
+
+/**
+ * Render, with an API key you paste.
+ *
+ * Render's server offers OAuth but not dynamic client registration, and its
+ * authorization server accepts only public clients — so the browser route needs
+ * a client registered somewhere this program cannot reach. Render also accepts
+ * an ordinary API key, which is the route that works without one, and is the
+ * same trade `../github` makes for the same reason.
+ */
+export const render = defineProvider({
+  id: 'render',
+  name: 'Render',
+  description: 'Services, deploys, logs, and environment variables, via Render\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.render.com/mcp' },
+  auth: { kind: 'bearer' },
+  setup: {
+    summary:
+      'Render takes an API key rather than a browser sign-in here. It is created in your account ' +
+      'settings, it does not expire, and it reaches every workspace your account can.',
+    docs_url: 'https://render.com/docs/api',
+    steps: [
+      'Sign in at https://dashboard.render.com and open Account Settings → API Keys.',
+      'Create a key and name it "Lanes Link" — the name is how you revoke this one later without cutting off anything else.',
+      'Copy it. Render shows it once.',
+    ],
+    troubleshooting:
+      'A rejected key is usually one that was rotated, or one copied from a different account. Create a new one at ' +
+      'https://dashboard.render.com under Account Settings → API Keys and re-run: lanes link connect render --replace.',
+    prompts: [
+      { key: 'token', label: 'Render API key', secret: true, scope: 'connection' as const },
+    ],
+  },
+});