@jskit-ai/agent-docs 0.1.155 → 0.1.157

package/guide/agent/app-extras/assistant.md

@@ -72,6 +72,52 @@ The assistant validates the transformed result against
 JSON:API CRUD actions supply these assistant contracts and transformations
 automatically; their native action and HTTP result shapes do not change.
 
+### Framework account and workspace actions
+
+Account and workspace action owners supply assistant-specific descriptions,
+output validators and result adapters. Their API routes keep their existing
+responses. The current tagged JSON:API action result stores its payload in
+`result.value`; profile update stores it in `result.response.value` beside a
+server-only session. Do not forward the wrapper or session to the assistant.
+
+`surfaces: ["*"]` matches every named surface. An empty surface list remains
+unrestricted; explicit names remain restrictive. Surface matching never grants
+permissions. Trusted `workspaceSlug` replaces model input only on actions whose
+input declares that field; account and directory-list actions receive no extra
+workspace parameter.
+
+There are 22 enabled framework contracts: eight account actions and fourteen
+workspace actions. Invitation creation returns invitation summaries, the created
+ID and delivery status, without token previews, invitation URLs, provider message
+IDs or provider delivery messages. Pending invitation lists omit raw tokens.
+Output validation rejects unexpected fields, including nested fields, instead
+of passing arbitrary server state into model results.
+
+Nine actions are explicitly excluded from assistant discovery and execution:
+
+| Actions | Reason / existing alternative |
+| --- | --- |
+| `settings.profile.avatar.upload` | Use the authenticated account file picker; no upload streams in tool arguments. |
+| `settings.security.password.change` | Use the authenticated account security form; no passwords in tool arguments. |
+| `settings.security.oauth.link.start` | Use the authenticated account security screen; authorization URLs contain transient state. |
+| `workspace.invitation.resolve`, `workspace.invite.redeem` | Use the invitation screen; no raw invitation tokens in tool arguments. |
+| `assistant.settings.read`, `assistant.settings.update` | Assistant self-configuration stays disabled. Use the existing assistant settings screen. |
+| `console.settings.read`, `console.settings.update` | Application-defined settings have no framework field allowlist. An application must define its own safe contract before exposing configuration. |
+
+An owner records an exclusion as `extensions.assistant.exclude`, containing a
+human-readable reason. An exclusion takes precedence even if the action later
+gains a structured HTTP output. It affects assistant tools only, not API or
+internal execution. The runtime also retains its `assistant.` prefix exclusion,
+so recursive chat/history operations remain unavailable. This release introduces
+no protected handoff subsystem. Do not ask a user to paste credentials into chat
+to work around an excluded operation.
+
+The framework inventory test checks all account, workspace and console action
+specification modules plus the assistant runtime automation actions. Every action
+must have a documented exclusion or a description, output contract, result adapter
+and execution fixture. Application-defined automation actions require the same
+review; automation capability alone does not mean model exposure is safe.
+
 Generated list and view actions use JSON:API query shapes directly. `include`
 is a comma-separated string, and `fields` is keyed by resource type:
 

package/guide/agent/app-setup/authentication.md

@@ -37,6 +37,74 @@ Protected server operations declare an auth policy; they do not trust a hidden
 button or a page-local session check. Other packages extend auth through the
 public extension capability rather than replacing the auth service.
 
+## Application-owned recovery email
+
+Local auth owns recovery tokens, expiry and recovery-scoped sessions. The
+application supplies the optional `auth.local.recovery-sender` capability as an
+async function accepting `{ email, recoveryUrl }`. It owns message content,
+sender address, provider credentials and delivery. The function must reject on
+failure and must not log the recovery URL or raw provider credentials.
+
+Wire the application's selected email integration or transport into this
+capability using an ordinary application provider:
+
+```js
+import { defineProvider } from "@jskit-ai/kernel/shared/capabilities";
+
+export const RecoveryEmailProvider = defineProvider({
+  id: "app.recovery-email",
+  requires: { mail: "app.mail" },
+  provides: { recoverySender: "auth.local.recovery-sender" },
+  setup({ mail }) {
+    return {
+      recoverySender: async ({ email, recoveryUrl }) => {
+        await mail.send({
+          to: email,
+          subject: "Reset your password",
+          text: `Open this link to reset your password:\n\n${recoveryUrl}\n`
+        });
+      }
+    };
+  }
+});
+```
+
+`app.mail` is an application-owned capability in this example, not a built-in
+JSKIT email API. Its `send()` implementation owns the selected integration,
+credential resolution and safe error mapping. A connected account or a domain
+listing adapter alone does not implement email sending. Install this provider
+alongside the application's mail provider and `AuthLocalProvider`.
+For direct library composition, pass the same function as `recoverySender` to
+`createLocalAuthService()`.
+
+Set `APP_PUBLIC_URL` to the application's actual public URL. When a sender is
+configured, auth requires this value and does not return or log the recovery
+URL. Without a sender, production recovery is disabled; explicit development
+output remains available for local testing. A sender failure never falls back
+to development output. The generic recovery delivery capability is `email`.
+
+### Pre-release migration
+
+This is a V0 breaking change. There is one runtime path, with no old SMTP reader
+or compatibility adapter.
+
+1. Supply `auth.local.recovery-sender` (or the direct `recoverySender` argument)
+   using your application’s chosen delivery implementation.
+2. Move sender, reply-to and transport credentials into that implementation's
+   configuration and private Env. Remove `AUTH_LOCAL_SMTP_HOST`,
+   `AUTH_LOCAL_SMTP_PORT`, `AUTH_LOCAL_SMTP_SECURE`, `AUTH_LOCAL_SMTP_USER`,
+   `AUTH_LOCAL_SMTP_PASSWORD`, `AUTH_LOCAL_SMTP_FROM` and
+   `AUTH_LOCAL_SMTP_REPLY_TO`. These variables are no longer consumed by auth.
+3. If retaining SMTP, explicitly install Nodemailer in the application and own
+   its transport there. Local auth no longer installs or imports Nodemailer.
+4. Retain `APP_PUBLIC_URL`. Replace direct-service `config.smtp` and
+   `config.smtpConfigured` with the sender argument. Update consumers that
+   inspect `features.passwordRecovery.delivery` from `smtp` to `email`, including
+   Supabase-backed consumers: this describes delivery, not transport protocol.
+5. Verify recovery delivery, unknown-account responses, delivery failures and
+   the completed password-reset flow before releasing the updated application.
+   This change does not alter identity, session or recovery-token storage.
+
 ## Browser boundary
 
 `@jskit-ai/auth-web` owns the normal auth views, guard runtime, sign-out flow,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/agent-docs",
-  "version": "0.1.155",
+  "version": "0.1.157",
   "description": "Distributed JSKIT agent references, prompts, guides, and generated reference maps.",
   "type": "module",
   "files": [

package/patterns/feature-package/example/booking-engine/package.json

@@ -5,7 +5,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/kernel": "0.1.183",
+    "@jskit-ai/kernel": "0.1.185",
     "json-rest-schema": "^1.0.17"
   },
   "exports": {

package/patterns/minimal-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.1.183",
+    "@jskit-ai/kernel": "0.1.185",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.8.5",
     "json-rest-schema": "^1.0.17",
@@ -42,11 +42,11 @@
     "vue": "^3.5.38",
     "vue-router": "^5.1.0",
     "vuetify": "^4.1.2",
-    "@jskit-ai/http-runtime": "0.1.181"
+    "@jskit-ai/http-runtime": "0.1.183"
   },
   "devDependencies": {
-    "@jskit-ai/config-eslint": "0.1.180",
-    "@jskit-ai/jskit-catalog": "0.1.208",
+    "@jskit-ai/config-eslint": "0.1.182",
+    "@jskit-ai/jskit-catalog": "0.1.210",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.1.183",
+    "@jskit-ai/kernel": "0.1.185",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.8.5",
     "json-rest-schema": "^1.0.17",
@@ -42,13 +42,13 @@
     "vue": "^3.5.38",
     "vue-router": "^5.1.0",
     "vuetify": "^4.1.2",
-    "@jskit-ai/http-runtime": "0.1.181",
+    "@jskit-ai/http-runtime": "0.1.183",
     "@mdi/js": "^7.4.47",
-    "@jskit-ai/shell-web": "0.1.187"
+    "@jskit-ai/shell-web": "0.1.189"
   },
   "devDependencies": {
-    "@jskit-ai/config-eslint": "0.1.180",
-    "@jskit-ai/jskit-catalog": "0.1.208",
+    "@jskit-ai/config-eslint": "0.1.182",
+    "@jskit-ai/jskit-catalog": "0.1.210",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/packages/main/package.json

@@ -9,7 +9,7 @@
   },
   "description": "App-local runtime composition and lightweight glue.",
   "dependencies": {
-    "@jskit-ai/kernel": "0.1.183"
+    "@jskit-ai/kernel": "0.1.185"
   },
   "jskit": {
     "kind": "runtime",

package/reference/autogen/PATTERN_INDEX.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.155`
+- Owner: `@jskit-ai/agent-docs@0.1.157`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.155`
+- Owner: `@jskit-ai/agent-docs@0.1.157`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.1.154`
+- Owner: `@jskit-ai/assistant-runtime@0.1.156`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/shell-web`
@@ -48,7 +48,7 @@ Compose JSKIT authentication routes, views, profile controls, and public surface
 
 - Id: `auth/auth-surface`
 - Keywords: `account`, `auth`, `login`, `logout`, `password`, `placement`, `profile`, `reset`, `surface`
-- Owner: `@jskit-ai/auth-web@0.1.183`
+- Owner: `@jskit-ai/auth-web@0.1.185`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/auth-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/auth-surface/example/)
 - Requires: `@jskit-ai/auth-core`, `@jskit-ai/auth-web`, `@jskit-ai/shell-web`
@@ -59,18 +59,172 @@ Add Supabase authentication through normal npm composition, explicit environment
 
 - Id: `auth/supabase-auth`
 - Keywords: `auth`, `authentication`, `oauth`, `sessions`, `supabase`
-- Owner: `@jskit-ai/auth-provider-supabase-core@0.1.180`
+- Owner: `@jskit-ai/auth-provider-supabase-core@0.1.182`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/supabase-auth/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/supabase-auth/example/)
 - Requires: `@jskit-ai/auth-provider-supabase-core`
 
+## App-owned AI connections and static model selection
+
+Resolve an administrator environment key or an individual user's grant, then use the application's chosen AI SDK directly.
+
+- Id: `connectors/ai-connections`
+- Keywords: `ai`, `api-key`, `big-pickle`, `cli`, `environment`, `free`, `models`, `ownership`, `zai`, `zen`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/ai-connections/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/ai-connections/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## API-key connections with portable JSON configuration
+
+Compose provider operations, authorization and encrypted file storage from a CLI or application server.
+
+- Id: `connectors/api-key-connection`
+- Keywords: `api-key`, `clay`, `cli`, `clickhouse`, `connectors`, `dbt`, `files`, `firecrawl`, `granola`, `integrations`, `metrics`, `prestashop`, `resend`, `semantic-layer`, `semrush`, `x-twitter`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/api-key-connection/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/api-key-connection/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## Assistant MCP connections with portable files
+
+Compose token-based MCP discovery and explicitly authorized tool calls using the shared connector runtime.
+
+- Id: `connectors/assistant-mcp`
+- Keywords: `assistant`, `cli`, `connectors`, `files`, `integrations`, `mcp`, `n8n`, `sanity`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/assistant-mcp/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/assistant-mcp/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## Assistant MCP OAuth with portable files
+
+Configure assistant OAuth clients, then compose existing state, encrypted file grants and authorized MCP calls.
+
+- Id: `connectors/assistant-mcp-oauth`
+- Keywords: `amplitude`, `assistant`, `atlassian`, `canva`, `cli`, `client metadata`, `confidence`, `connectors`, `figma`, `files`, `granola`, `hex`, `mcp`, `miro`, `oauth`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/assistant-mcp-oauth/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/assistant-mcp-oauth/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## AWS object storage and Athena queries with explicit credentials
+
+Compose signed AWS operations, file configuration and application authorization from CLI or server code.
+
+- Id: `connectors/aws-storage-queries`
+- Keywords: `athena`, `aws`, `cli`, `connectors`, `files`, `iam`, `queries`, `s3`, `storage`, `sts`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/aws-storage-queries/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/aws-storage-queries/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## Google Calendar from an application-owned CLI
+
+Compose reusable connection libraries with portable configuration, application ownership and durable storage.
+
+- Id: `connectors/calendar-cli`
+- Keywords: `calendar`, `cli`, `connectors`, `google`, `integrations`, `oauth`, `permissions`
+- Owner: `@jskit-ai/connector-google-calendar@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/calendar-cli/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/calendar-cli/example/)
+- Requires: `@jskit-ai/connector-google-calendar`, `@jskit-ai/connectors-core`, `@jskit-ai/database-runtime-mysql`
+
+## Authorized Inngest event delivery with portable files
+
+Compose the shared connector runtime for event delivery while leaving workflow code and event policy with the application.
+
+- Id: `connectors/event-delivery`
+- Keywords: `cli`, `connectors`, `events`, `files`, `inngest`, `integrations`, `workflows`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/event-delivery/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/event-delivery/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## Firebase messaging from a CLI or application backend
+
+Wire service-account grants, file storage, explicit message actions and public browser settings without generating an application.
+
+- Id: `connectors/firebase-messaging`
+- Keywords: `cli`, `connectors`, `fcm`, `files`, `firebase`, `integrations`, `jwt`, `notifications`, `push`, `service-account`, `vapid`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/firebase-messaging/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/firebase-messaging/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## Existing-account Google Ads Search
+
+Compose reviewed Search campaigns with project-owned Google OAuth and portable saved plans.
+
+- Id: `connectors/google-ads-search`
+- Keywords: `ads`, `campaigns`, `cli`, `connectors`, `conversion`, `google`, `search`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/google-ads-search/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/google-ads-search/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## OAuth connections with portable files
+
+Compose provider consent, verification and encrypted file persistence from an application server or CLI.
+
+- Id: `connectors/oauth-connection`
+- Keywords: `accounting`, `assistant permissions`, `books`, `cli`, `client credentials`, `connectors`, `consent`, `crm`, `databricks`, `developer token`, `fabric`, `files`, `gaql`, `google ads`, `graphql`, `integrations`, `linkedin`, `microsoft`, `oauth`, `powerpoint`, `salesforce`, `service principal`, `shopify`, `soql`, `staffing`, `tiktok`, `twitch`, `wave`, `word`, `wordpress`, `workday`, `xero`, `zoho`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/oauth-connection/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/oauth-connection/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## Create Paddle products with prices
+
+Compose a sequential catalogue batch and preserve partial success for application-owned recovery.
+
+- Id: `connectors/paddle-catalogue`
+- Keywords: `batch`, `paddle`, `payments`, `prices`, `products`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/paddle-catalogue/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/paddle-catalogue/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## Public logo images from portable integration configuration
+
+Resolve a publishable image key deliberately and use the shared URL library in a browser, backend or CLI.
+
+- Id: `connectors/public-image`
+- Keywords: `cli`, `connectors`, `files`, `images`, `integrations`, `logo-dev`, `public-key`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/public-image/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/public-image/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## Redshift queries with shared AWS credentials
+
+Compose file configuration, Redshift Data API operations and application query ownership.
+
+- Id: `connectors/redshift-queries`
+- Keywords: `aws`, `cli`, `connectors`, `files`, `iam`, `provisioned`, `redshift`, `serverless`, `sql`, `warehouse`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/redshift-queries/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/redshift-queries/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
+## Authorised project source scans with Wiz
+
+Use the shared scanner runtime from a CLI or a host worker with portable configuration and explicit source ownership.
+
+- Id: `connectors/source-scanning`
+- Keywords: `cancellation`, `cli`, `connectors`, `integrations`, `scanning`, `security`, `source`, `wiz`, `worker`
+- Owner: `@jskit-ai/connectors-catalog@0.1.2`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/source-scanning/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/connectors/source-scanning/example/)
+- Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
+
 ## Owner console surface
 
 Add a protected administration surface, settings shell, and semantic navigation through JSKIT console and shell APIs.
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.151`
+- Owner: `@jskit-ai/console-web@0.1.153`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -81,7 +235,7 @@ Build a routed CRUD user interface as thin application pages over JSKIT's shared
 
 - Id: `crud/crud-screen-set`
 - Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.1.28`
+- Owner: `@jskit-ai/http-web@0.1.30`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-screen-set/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-screen-set/example/)
 - Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-crud-core`
@@ -92,7 +246,7 @@ Build a complete application-owned CRUD server package from a migration, resourc
 
 - Id: `crud/json-api-resource-package`
 - Keywords: `actions`, `crud`, `database`, `json-api`, `migration`, `permissions`, `provider`, `repository`, `routes`, `service`
-- Owner: `@jskit-ai/crud-core@0.1.194`
+- Owner: `@jskit-ai/crud-core@0.1.196`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/json-api-resource-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/json-api-resource-package/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/resource-crud-core`
@@ -103,7 +257,7 @@ Define an authenticated application resource whose records belong to the current
 
 - Id: `crud/resource-contract`
 - Keywords: `authenticated`, `crud`, `database`, `owner-scoped`, `resource`, `user`
-- Owner: `@jskit-ai/resource-crud-core@0.1.125`
+- Owner: `@jskit-ai/resource-crud-core@0.1.127`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/resource-contract/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/resource-contract/example/)
 - Requires: `@jskit-ai/resource-crud-core`
@@ -114,7 +268,7 @@ Configure a JSKIT application for MySQL with a fixed driver, ordinary environmen
 
 - Id: `database/mysql-application`
 - Keywords: `database`, `knex`, `mariadb`, `migrations`, `mysql`, `mysql2`
-- Owner: `@jskit-ai/database-runtime-mysql@0.1.181`
+- Owner: `@jskit-ai/database-runtime-mysql@0.1.183`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/database/mysql-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/database/mysql-application/example/)
 - Requires: `@jskit-ai/database-runtime-mysql`
@@ -125,7 +279,7 @@ Configure a JSKIT application for PostgreSQL with a fixed driver, ordinary envir
 
 - Id: `database/postgres-application`
 - Keywords: `database`, `knex`, `migrations`, `pg`, `postgres`, `postgresql`
-- Owner: `@jskit-ai/database-runtime-postgres@0.1.180`
+- Owner: `@jskit-ai/database-runtime-postgres@0.1.182`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/database/postgres-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/database/postgres-application/example/)
 - Requires: `@jskit-ai/database-runtime-postgres`
@@ -136,7 +290,7 @@ Wrap a JSKIT web application in a Capacitor Android shell using native Capacitor
 
 - Id: `mobile/android-application`
 - Keywords: `android`, `capacitor`, `device`, `mobile`, `native`, `shell`, `webview`
-- Owner: `@jskit-ai/mobile-capacitor@0.1.118`
+- Owner: `@jskit-ai/mobile-capacitor@0.1.120`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/mobile/android-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/mobile/android-application/example/)
 - Requires: `@capacitor/android`, `@capacitor/app`, `@capacitor/cli`, `@jskit-ai/mobile-capacitor`
@@ -147,18 +301,29 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.1.180`
+- Owner: `@jskit-ai/realtime@0.1.182`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
 
+## Google rewarded delivery
+
+Compose application-owned Google Publisher Tag delivery with the generic rewarded workflow.
+
+- Id: `rewards/google-rewarded`
+- Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
+- Owner: `@jskit-ai/rewarded-web@0.1.121`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/rewards/google-rewarded/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/rewards/google-rewarded/example/)
+- Requires: `@jskit-ai/rewarded-web`
+
 ## App-local server feature package
 
 Define a server feature through explicit capabilities and first-class actions, adding services or repositories only when its domain earns them.
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `feature`, `json-rest`, `knex`, `orchestration`, `package`, `provider`, `repository`, `routes`, `server`
-- Owner: `@jskit-ai/agent-docs@0.1.155`
+- Owner: `@jskit-ai/agent-docs@0.1.157`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -169,7 +334,7 @@ Compose the JSKIT responsive shell, semantic placements, settings navigation, an
 
 - Id: `shell/application-shell`
 - Keywords: `adaptive`, `app`, `layout`, `navigation`, `placement`, `responsive`, `settings`, `shell`
-- Owner: `@jskit-ai/shell-web@0.1.187`
+- Owner: `@jskit-ai/shell-web@0.1.189`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/shell/application-shell/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/shell/application-shell/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -180,7 +345,7 @@ Add product routes and shell extensions through file routing, semantic placement
 
 - Id: `ui/page-and-placement`
 - Keywords: `component`, `navigation`, `outlet`, `page`, `placement`, `routes`, `section`, `shell`, `subpages`, `vue`
-- Owner: `@jskit-ai/shell-web@0.1.187`
+- Owner: `@jskit-ai/shell-web@0.1.189`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/ui/page-and-placement/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/ui/page-and-placement/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -191,7 +356,7 @@ Compose an account settings route and profile, preference, and notification sect
 
 - Id: `users/account-settings`
 - Keywords: `account`, `notifications`, `preferences`, `profile`, `settings`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.1.201`
+- Owner: `@jskit-ai/users-web@0.1.203`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -202,7 +367,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.1.196`
+- Owner: `@jskit-ai/users-core@0.1.198`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -213,7 +378,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.1.161`
+- Owner: `@jskit-ai/workspaces-core@0.1.163`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -224,7 +389,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.1.162`
+- Owner: `@jskit-ai/workspaces-web@0.1.164`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/reference/autogen/README.md

@@ -19,22 +19,28 @@ AI-first source patterns are indexed in `PATTERN_INDEX.md`.
 - [auth-provider-local-db-core](/packages/agent-docs/reference/autogen/packages/auth-provider-local-db-core.md)
 - [auth-provider-supabase-core](/packages/agent-docs/reference/autogen/packages/auth-provider-supabase-core.md)
 - [auth-web](/packages/agent-docs/reference/autogen/packages/auth-web.md)
+- [connector-google-calendar](/packages/agent-docs/reference/autogen/packages/connector-google-calendar.md)
+- [connectors-catalog](/packages/agent-docs/reference/autogen/packages/connectors-catalog.md)
+- [connectors-core](/packages/agent-docs/reference/autogen/packages/connectors-core.md)
+- [connectors-web](/packages/agent-docs/reference/autogen/packages/connectors-web.md)
 - [console-core](/packages/agent-docs/reference/autogen/packages/console-core.md)
 - [console-web](/packages/agent-docs/reference/autogen/packages/console-web.md)
 - [crud-core](/packages/agent-docs/reference/autogen/packages/crud-core.md)
 - [database-runtime](/packages/agent-docs/reference/autogen/packages/database-runtime.md)
 - [database-runtime-mysql](/packages/agent-docs/reference/autogen/packages/database-runtime-mysql.md)
 - [database-runtime-postgres](/packages/agent-docs/reference/autogen/packages/database-runtime-postgres.md)
-- [google-rewarded-core](/packages/agent-docs/reference/autogen/packages/google-rewarded-core.md)
-- [google-rewarded-web](/packages/agent-docs/reference/autogen/packages/google-rewarded-web.md)
 - [http-runtime](/packages/agent-docs/reference/autogen/packages/http-runtime.md)
 - [http-web](/packages/agent-docs/reference/autogen/packages/http-web.md)
 - [json-rest-api-core](/packages/agent-docs/reference/autogen/packages/json-rest-api-core.md)
 - [kernel](/packages/agent-docs/reference/autogen/packages/kernel.md)
 - [mobile-capacitor](/packages/agent-docs/reference/autogen/packages/mobile-capacitor.md)
+- [payments-core](/packages/agent-docs/reference/autogen/packages/payments-core.md)
+- [payments-web](/packages/agent-docs/reference/autogen/packages/payments-web.md)
 - [realtime](/packages/agent-docs/reference/autogen/packages/realtime.md)
 - [resource-core](/packages/agent-docs/reference/autogen/packages/resource-core.md)
 - [resource-crud-core](/packages/agent-docs/reference/autogen/packages/resource-crud-core.md)
+- [rewarded-core](/packages/agent-docs/reference/autogen/packages/rewarded-core.md)
+- [rewarded-web](/packages/agent-docs/reference/autogen/packages/rewarded-web.md)
 - [shell-web](/packages/agent-docs/reference/autogen/packages/shell-web.md)
 - [storage-runtime](/packages/agent-docs/reference/autogen/packages/storage-runtime.md)
 - [uploads-image-web](/packages/agent-docs/reference/autogen/packages/uploads-image-web.md)

package/reference/autogen/packages/auth-provider-local-core.md

@@ -74,7 +74,7 @@ Local functions
 
 ### `src/server/lib/service.js`
 Exports
-- `createLocalAuthService({ backend, config, profileProjector = null, passwordStrategy = null, invitationContextResolver = null })`
+- `createLocalAuthService({ backend, config, profileProjector = null, passwordStrategy = null, invitationContextResolver = null, recoverySender = null })`
 Local functions
 - `nowSeconds()`
 - `isoFromNow(seconds)`
@@ -102,7 +102,6 @@ Local functions
 - `devLoginAsValidationError(fieldErrors = {})`
 - `devLoginAsUserNotFound({ email = "", userId = "" } = {})`
 - `normalizeInvitationInput(value = null)`
-- `maybeSendRecoveryEmail(config, recoveryUrl, email)`
 
 ### `src/server/lib/tokens.js`
 Exports
@@ -117,9 +116,8 @@ Local functions
 ### `src/server/providers/AuthLocalProvider.js`
 Exports
 - `AuthLocalProvider`
-- `resolveConfig({ appRoot, backend, env, logger })`
+- `resolveConfig({ appRoot, backend, env, logger, recoverySender = null })`
 Local functions
 - `resolveStoreDir(env, appRoot)`
 - `resolveSessionSecret(env, { storeDir, isProduction })`
-- `resolveSmtpConfig(env)`
-- `resolveAppPublicUrl(env, { smtpConfigured })`
+- `resolveAppPublicUrl(env, { recoverySender })`