@jskit-ai/agent-docs 0.1.257 → 0.1.258

package/skills/jskit/references/patterns/auth/auth-surface/PATTERN.md

@@ -34,14 +34,26 @@ Every application with accounts includes the managed-preview login. It is
 standard, not optional: adding this pattern adds it, so a managed host's
 preview can sign its browser in as an existing account without anyone asking
 for it. Copy the app-owned `tools/preview-identity` executable (keep it
-executable) and declare it under `#### Preview identity` in the project's
-web-presented Vibe64 `Outputs` target, exactly:
+executable). It passes `runManagedPreviewIdentityCommand` the two facts only
+the preview host knows, as that host documents them:
+
+- `protocol`: the protocol id the host's requests carry and the responses
+  echo (JSKIT's default is `jskit.preview-identity.command.v1`);
+- `localHostnames`: the hostname patterns, besides loopback, that the host
+  serves the preview application on (none by default).
+
+It also passes the process environment as `env`, where the host supplies the
+two exchange values per run.
+
+Declare the executable to the host in the form the host reads. A host that
+reads the project's web `Outputs` target takes this block, with the same
+protocol id the executable passes:
 
 ```markdown
 #### Preview identity
 
 - Command: `tools/preview-identity`
-- Protocol: `vibe64.preview-identity.command.v1`
+- Protocol: `<the host's protocol id>`
 - Identity types: `email` `user-id`
 - Enabled environment: `AUTH_DEV_BYPASS_ENABLED`
 - Secret environment: `AUTH_DEV_BYPASS_SECRET`
@@ -52,11 +64,11 @@ The preview host supplies fresh output-run-scoped values for both environment
 names; users do not set them by hand, and the exchange stays disabled without
 them. The person using the host chooses which existing accounts the preview may
 sign in as; the application never creates users for it. JSKIT owns this
-executable/library pattern, Vibe64 owns the `Outputs` grammar and runtime
-behavior, and Genesis only composes that consumer-owned section as opaque text.
-The executable calls the exported managed-preview identity library directly; it
-does not require a JSKIT CLI. A project without Genesis or a managed host keeps
-the executable; it is inert unless both environment values are present.
+executable/library pattern; the host owns its declaration grammar, its
+protocol id and its runtime behavior. The executable calls the exported
+managed-preview identity library directly; it does not require a JSKIT CLI. A
+project without a managed host keeps the executable; it is inert unless both
+environment values are present.
 
 Choose local-auth storage through the installed capability provider. A
 database-backed application installs `@jskit-ai/auth-provider-local-db-core`,
@@ -69,8 +81,9 @@ a user as a side effect.
 ## Invariants
 
 - Credentials and provider secrets come from environment values.
-- An application with accounts ships the executable `tools/preview-identity`
-  and declares it under `#### Preview identity` in its web `Outputs` target.
+- An application with accounts ships the executable `tools/preview-identity`,
+  passes it its preview host's protocol id and hostnames, and declares it to
+  that host.
 - Auth backend selection comes from the installed provider graph, not an
   `AUTH_LOCAL_BACKEND` environment value.
 - The selected auth backend and the storage containing the application's users
@@ -107,8 +120,8 @@ Exercise failed and successful login, sign-out, reset, protected navigation,
 keyboard interaction, warm-cache return navigation, and browser refresh.
 Open the login route with an existing authenticated session and confirm it
 returns to the requested screen; repeat signed out and confirm the form remains.
-Confirm `tools/preview-identity` is committed as executable and the web
-`Outputs` target declares the `#### Preview identity` block above.
+Confirm `tools/preview-identity` is committed as executable, passes the protocol
+id the host's declaration names, and is declared to the host as above.
 
 ## Avoid
 

package/skills/jskit/references/patterns/auth/auth-surface/example/tools/preview-identity

@@ -2,4 +2,10 @@
 
 import { runManagedPreviewIdentityCommand } from "@jskit-ai/auth-web/server/managedPreviewIdentity";
 
-process.exitCode = await runManagedPreviewIdentityCommand();
+// The preview host's protocol id, and the hostnames besides loopback that it
+// serves the application on, as that host documents them.
+process.exitCode = await runManagedPreviewIdentityCommand({
+  protocol: "jskit.preview-identity.command.v1",
+  localHostnames: [],
+  env: process.env
+});

package/skills/jskit/references/patterns/auth/oidc-sign-in/example/package.json

@@ -2,7 +2,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/auth-provider-oidc-core": "0.2.6",
-    "@jskit-ai/auth-web": "0.2.4"
+    "@jskit-ai/auth-provider-oidc-core": "0.2.7",
+    "@jskit-ai/auth-web": "0.2.5"
   }
 }

package/skills/jskit/references/patterns/auth/supabase-auth/example/package.json

@@ -2,6 +2,6 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/auth-provider-supabase-core": "0.2.5"
+    "@jskit-ai/auth-provider-supabase-core": "0.2.6"
   }
 }

package/skills/jskit/references/patterns/connectors/ai-connections/PATTERN.md

@@ -38,6 +38,18 @@ to authorized application, user, provider and integration. The application owns
 key-entry and disconnect screens. Never return connection parameters to a
 browser or share coding-agent subscription credentials.
 
+Each collaborator the composition receives (`authorize`, `createModel`,
+`createClient` and `resolveReference`) is a required parameter typed in a JSDoc
+`@param` and called directly, without a `typeof` probe at the call or a no-op
+default. `createPerplexityAnswers()` checks `authorize` and `createClient` once,
+as input validation when it is composed, so a missing one fails there instead of
+on the first answer. `authorize` and `resolveReference` are typed with
+`ConnectorAuthorize` and `ResolveReference` from
+`@jskit-ai/connectors-core/server/types`. Only the production
+`resolveReference = createEnvironmentReferenceResolver(process.env)` stays as a default, in
+both compositions. A server feature that uses it follows
+[typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
+
 ## Do not use when
 
 Frameworks outside Node follow their own configuration and AI client patterns.
@@ -65,6 +77,9 @@ Do not add a runtime catalogue fetch, token billing, an inference proxy, a
 cross-language runtime or a silent paid fallback. Never infer that a model
 marked free can be used without the authentication its provider requires.
 
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.
+
 ## Existing Perplexity connector slots
 
 Use `example/perplexity-answer.js` when configuration already has provider
@@ -80,6 +95,6 @@ search_results. For stream=true consume the async iterator, rendering deltas
 and retaining final citations/search_results; cancel with AbortSignal.
 Allow only safe HTTP(S) links in rendered citations. Never send the API key/client
 to a browser. A public route must sanitize SDK failures and enforce app budgets.
-This is direct app-to-provider traffic, with no Vibe64 token sales or proxy.
+This is direct app-to-provider traffic, with no hosted token sales or proxy.
 A trusted CLI operator can use the same JSON/Env and factory. Other frameworks
 use their own native Perplexity/OpenAI-compatible clients and the same slot.

package/skills/jskit/references/patterns/connectors/ai-connections/example/ai-model.js

@@ -1,8 +1,17 @@
+import { createEnvironmentReferenceResolver } from "@jskit-ai/connectors-core/server";
 import { createAiConnectionResolver } from "@jskit-ai/connectors-catalog/server/ai";
 
-// App-owned composition. Supply the authenticated authorization policy and the
-// SDK model factory used by this application. Omit resolveReference for Env.
-export function createConfiguredAiModel({ configuration, authorize, resolveReference, createModel }) {
+/**
+ * App-owned composition. Supply the authenticated authorization policy and the
+ * SDK model factory used by this application. Omit resolveReference for Env.
+ * @param {object} dependencies
+ * @param {object} dependencies.configuration The integration configuration.
+ * @param {import("@jskit-ai/connectors-core/server/types").ConnectorAuthorize} dependencies.authorize The application's access policy: the owner, or null.
+ * @param {import("@jskit-ai/connectors-core/server/types").ResolveReference} [dependencies.resolveReference]
+ * @param {(parameters: object) => unknown} dependencies.createModel The application's SDK model factory.
+ */
+export function createConfiguredAiModel({ configuration, authorize,
+  resolveReference = createEnvironmentReferenceResolver(process.env), createModel }) {
   const connections = createAiConnectionResolver({ configuration, authorize, resolveReference });
   return async ({ context, integrationId }) => {
     const parameters = await connections.resolve({ context, integrationId });

package/skills/jskit/references/patterns/connectors/ai-connections/example/perplexity-answer.js

@@ -2,11 +2,22 @@ import { ConnectorError, createEnvironmentReferenceResolver } from "@jskit-ai/co
 import { validateIntegrationConfiguration } from "@jskit-ai/connectors-core/shared/configuration";
 import { perplexityProvider } from "@jskit-ai/connectors-catalog/server/perplexity";
 
-// App-owned composition, not an inference service. Supply the application's native
-// OpenAI-compatible client factory. Credentials and the returned client stay server-side.
+/**
+ * App-owned composition, not an inference service. Supply the application's native
+ * OpenAI-compatible client factory. Credentials and the returned client stay server-side.
+ * @param {object} dependencies
+ * @param {object} dependencies.configuration The integration configuration.
+ * @param {import("@jskit-ai/connectors-core/server/types").ConnectorAuthorize} dependencies.authorize The application's access policy: the owner, or null.
+ * @param {(options: object) => { chat: { completions: { create: (body: object, request: object) => Promise<any> } } }} dependencies.createClient
+ *   The application's native SDK client factory, such as `options => new OpenAI(options)`.
+ * @param {import("@jskit-ai/connectors-core/server/types").ResolveReference} [dependencies.resolveReference]
+ */
 export function createPerplexityAnswers({ configuration, authorize, createClient,
-  resolveReference = createEnvironmentReferenceResolver() }) {
-  if (typeof authorize !== "function" || typeof createClient !== "function") throw new TypeError("Supply application authorization and its native client factory.");
+  resolveReference = createEnvironmentReferenceResolver(process.env) }) {
+  // readable-check: allow method-probe - input validation: the application passes its access policy and its SDK client factory
+  if (typeof authorize !== "function" || typeof createClient !== "function") {
+    throw new TypeError("Supply application authorization and its native client factory.");
+  }
   const config = validateIntegrationConfiguration(configuration, { providers: [perplexityProvider], allowUnknownProviders: true });
   return async ({ context, integrationId, question, model, stream = false, signal }) => {
     const slot = Object.hasOwn(config.integrations, integrationId) ? config.integrations[integrationId] : null;

package/skills/jskit/references/patterns/connectors/api-key-connection/PATTERN.md

@@ -112,6 +112,12 @@ not require putting credentials into source.
 - An optional frontend key reference is distinct from the primary backend key.
   Only the application may deliberately expose a suitable search-only key;
   successful backend verification does not verify that frontend key's restrictions.
+- Each collaborator the composition receives (`authorize`) is a required
+  parameter typed in a JSDoc `@param` and called directly, without a `typeof`
+  probe, a "requires x" guard or a no-op default. `authorize` is typed with
+  `ConnectorAuthorize` from `@jskit-ai/connectors-core/server/types`. Only the
+  production `env = process.env` stays as a default. A server feature that uses
+  it follows [typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
 
 ## Framework APIs
 
@@ -168,7 +174,7 @@ const protection = createCredentialProtection({
 const store = createFileConnectionStore({ directory: process.env.CONNECTOR_STATE_DIRECTORY, protection });
 const connections = createConnectionService({
   configuration, providers, store,
-  resolveReference: createEnvironmentReferenceResolver(),
+  resolveReference: createEnvironmentReferenceResolver(process.env),
   authorize: applicationConnectionPolicy
 });
 
@@ -243,6 +249,8 @@ Do not turn provider metadata into arbitrary authenticated URL forwarding.
 Do not retry a paid or mutating request automatically. Do not mark an untested
 managed mode or an unimplemented provider operation available.
 
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.
 
 ## Granola meeting data
 

package/skills/jskit/references/patterns/connectors/api-key-connection/example/connections.js

@@ -5,8 +5,11 @@ import { createFileConnectionStore, createCredentialProtection } from "@jskit-ai
 import { resendProvider } from "@jskit-ai/connectors-catalog/server/resend";
 import { firecrawlProvider } from "@jskit-ai/connectors-catalog/server/firecrawl";
 
-// Both a manually written CLI and a server can compose this application-owned module.
-// The application supplies its existing identity and permission policy.
+/**
+ * Both a manually written CLI and a server can compose this application-owned module.
+ * The application supplies its existing identity and permission policy.
+ * @param {{ authorize: import("@jskit-ai/connectors-core/server/types").ConnectorAuthorize, env?: Record<string, string | undefined>, configFile?: string }} dependencies
+ */
 export async function applicationConnections({ authorize, env = process.env, configFile = "integrations.json" }) {
   const providers = [resendProvider, firecrawlProvider];
   const configuration = parseIntegrationConfiguration(await readFile(configFile, "utf8"), { providers });

package/skills/jskit/references/patterns/connectors/aws-storage-queries/PATTERN.md

@@ -19,7 +19,7 @@ composes those libraries with the application's identity and resource policy.
 ## Do not use when
 
 Do not use this as an application login, an AWS account creator, a general SDK
-proxy, or proof that a managed Vibe64 allocation exists. Do not use a machine's
+proxy, or proof that a managed host's allocation exists. Do not use a machine's
 default AWS credentials for arbitrary application users. Per-user federation,
 AWS IAM Identity Center, noncommercial AWS partitions and arbitrary endpoints
 are outside the fragment. Athena statements can write data and incur costs;
@@ -28,8 +28,8 @@ connecting does not approve arbitrary future SQL.
 ## Product decisions
 
 Use the exact [S3](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/aws-s3.md) or
-[Athena](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/aws-athena.md) JSON. The same file is usable by CLI and the
-Vibe64 form. Store the actual secret access key, access key ID and optional
+[Athena](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/aws-athena.md) JSON. The same file is usable by CLI and a
+hosted editor's form. Store the actual secret access key, access key ID and optional
 session token outside source. The access key ID uses `settings.accessKeyIdRef`,
 the secret uses `authentication.secretRef`, and temporary credentials add
 `settings.sessionTokenRef`. A missing explicit binding is an error.
@@ -43,6 +43,13 @@ account assignments, quotas and credential renewal are separate operations.
 There is no OAuth callback for these modes. See
 [AWS ownership](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/aws-credentials.md).
 
+Each collaborator the composition receives (the connection `service`) is a
+required parameter typed in a JSDoc `@param` and called directly, without a
+`typeof` probe, a "requires x" guard or a no-op default. Only the production
+`fetchImpl = globalThis.fetch` stays as a default. A server feature that uses it
+follows
+[typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
+
 ## Framework APIs
 
 Follow the [API-key connection pattern](../api-key-connection/PATTERN.md) to
@@ -154,6 +161,9 @@ Do not expose presigned URLs in logs, infer table permission from a workgroup
 read, treat workgroup membership as user isolation, or poll queries without an
 application-controlled limit.
 
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.
+
 ## Verification
 
 Missing credential references fail before HTTP. Expired/rejected AWS credentials

package/skills/jskit/references/patterns/connectors/aws-storage-queries/example/s3-transfer.js

@@ -1,6 +1,17 @@
-// Application-owned composition: service.authorize must approve this exact key
-// for context. The same function works in a Node CLI or application backend.
-// Pass a bounded signal for both signing and the complete response-body read.
+/**
+ * Application-owned composition: service.authorize must approve this exact key
+ * for context. The same function works in a Node CLI or application backend.
+ * Pass a bounded signal for both signing and the complete response-body read.
+ * @param {object} request
+ * @param {import("@jskit-ai/connectors-core/server/types").ConnectorsCore} request.service
+ * @param {object} request.context
+ * @param {string} request.integrationId
+ * @param {string} request.key
+ * @param {"download" | "upload"} request.direction
+ * @param {Blob | ArrayBuffer | ArrayBufferView} [request.body]
+ * @param {AbortSignal} request.signal
+ * @param {typeof globalThis.fetch} [request.fetchImpl]
+ */
 export async function transferS3Object({ service, context, integrationId, key,
   direction, body, signal, fetchImpl = globalThis.fetch }) {
   if (!["download", "upload"].includes(direction)) throw new TypeError("Choose download or upload.");

package/skills/jskit/references/patterns/connectors/calendar-cli/PATTERN.md

@@ -41,6 +41,11 @@ authenticated user and check membership/operation permissions there.
 - The application authorizes owners and executes package-owned migrations.
 - OAuth and persistence machinery is imported from the library.
 - Provider consent and a successful account check precede Connected.
+- Each collaborator the composition receives (the connection `service` that
+  `connectInBrowser()` uses) is a required parameter typed in a JSDoc `@param`
+  and called directly, without a `typeof` probe, a "requires x" guard or a no-op
+  default. A server feature that uses it follows
+  [typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
 
 ## Framework APIs
 
@@ -104,3 +109,6 @@ your credentials and account approval. The initial runtime implements own web
 client registrations. The editor configures the generated application's own registration. Its backend
 resolves the secret from the application environment; never ship a client secret
 inside a desktop binary or browser bundle.
+
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.

package/skills/jskit/references/patterns/connectors/calendar-cli/example/knexfile.js

@@ -2,4 +2,4 @@ import { existsSync } from "node:fs";
 import { createKnexMigrationConfigFromApp } from "@jskit-ai/database-runtime/server/knexMigrationConfig";
 
 if (existsSync(".env")) process.loadEnvFile(".env");
-export default await createKnexMigrationConfigFromApp({ client: "mysql2" });
+export default await createKnexMigrationConfigFromApp({ client: "mysql2", environment: process.env });

package/skills/jskit/references/patterns/connectors/calendar-cli/example/package.json

@@ -7,10 +7,10 @@
     "db:migrate:status": "knex --knexfile ./knexfile.js migrate:list"
   },
   "dependencies": {
-    "@jskit-ai/connectors-core": "0.2.3",
-    "@jskit-ai/connector-google-calendar": "0.2.3",
-    "@jskit-ai/database-runtime": "0.1.252",
-    "@jskit-ai/database-runtime-mysql": "0.1.250",
+    "@jskit-ai/connectors-core": "0.2.4",
+    "@jskit-ai/connector-google-calendar": "0.2.4",
+    "@jskit-ai/database-runtime": "0.1.253",
+    "@jskit-ai/database-runtime-mysql": "0.1.251",
     "knex": "^3.1.0"
   }
 }

package/skills/jskit/references/patterns/connectors/calendar-cli/example/scripts/calendar.js

@@ -7,7 +7,11 @@ import { createConnectionService, createEnvironmentReferenceResolver } from "@js
 import { createCredentialProtection, createKnexConnectionStore } from "@jskit-ai/connectors-core/server/storage";
 import { googleCalendarProvider } from "@jskit-ai/connector-google-calendar/server";
 
-// A local operator command owns this HTTP listener; web apps use authenticated routes.
+/**
+ * A local operator command owns this HTTP listener; web apps use authenticated routes.
+ * @param {import("@jskit-ai/connectors-core/server/types").ConnectorsCore} service
+ * @param {object} context
+ */
 async function connectInBrowser(service, context) {
   const callback = new URL(process.env.GOOGLE_CALLBACK_URL);
   if (callback.protocol !== "http:" || callback.hostname !== "127.0.0.1" || !callback.port) {
@@ -47,9 +51,9 @@ async function connectInBrowser(service, context) {
     const start = await service.beginAuthorization({ context, integrationId: "calendar", signal: controller.signal });
     state = new URL(start.authorizationUrl).searchParams.get("state");
     console.log(`Open this URL in your browser:\n${start.authorizationUrl}`);
-    const completed = await outcome;
-    if (completed.error) throw completed.error;
-    return completed.result;
+    const settled = await outcome;
+    if (settled.error) throw settled.error;
+    return settled.result;
   } finally {
     clearTimeout(timeout);
     process.off("SIGINT", cancel);

package/skills/jskit/references/patterns/connectors/event-delivery/PATTERN.md

@@ -145,7 +145,7 @@ schedules with awareness of daylight-saving behavior.
 Expose the SDK route through the app's normal server composition, then deploy
 and sync its HTTPS `/api/inngest` URL in the selected Inngest environment.
 Keep the Signing Key private and let the native adapter verify signatures.
-JSKIT CLI users follow the same steps without Vibe64. Other stacks use native
+JSKIT CLI users follow the same steps. Other stacks use native
 SDKs where available and the same event name/payload/Env contract; this example
 does not promise an SDK in every language. No function execution, cloud sync
 or generated application is performed by this reference pattern.

package/skills/jskit/references/patterns/connectors/firebase-messaging/PATTERN.md

@@ -39,6 +39,13 @@ reference, stable project identity and public settings. Verify before reporting
 Connected; authorize every audience before sending. Preserve the existing file
 store and token lock instead of copying the grant implementation.
 
+Each collaborator the composition receives (`authorizeConnectionOperation`) is a
+required parameter typed in a JSDoc `@param` and called directly, without a
+`typeof` probe, a "requires x" guard or a no-op default. It is typed with
+`ConnectorAuthorize` from `@jskit-ai/connectors-core/server/types`. A server
+feature that uses it follows
+[typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
+
 ## Framework APIs
 
 Use `parseIntegrationConfiguration`, `createConnectionService`,
@@ -154,3 +161,6 @@ Do not expose service-account JSON to the browser, confuse Firebase API keys
 with private service credentials, or choose the paid project from caller input.
 Do not treat an accepted message receipt as device delivery or automatically
 retry a send whose outcome is unknown.
+
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.

package/skills/jskit/references/patterns/connectors/firebase-messaging/example/server/notifications.js

@@ -4,6 +4,14 @@ import { createConnectionService, createEnvironmentReferenceResolver } from "@js
 import { createFileConnectionStore, createCredentialProtection } from "@jskit-ai/connectors-core/server/file-storage";
 import { firebaseCloudMessagingProvider } from "@jskit-ai/connectors-catalog/server/firebase-cloud-messaging";
 
+/**
+ * @param {object} options
+ * @param {string} options.configurationPath
+ * @param {string} options.runtimeDirectory
+ * @param {Buffer} options.credentialKey
+ * @param {Record<string, string | undefined>} options.environment
+ * @param {import("@jskit-ai/connectors-core/server/types").ConnectorAuthorize} options.authorizeConnectionOperation The application's access policy.
+ */
 export async function openNotificationConnections({
   configurationPath, runtimeDirectory, credentialKey, environment,
   authorizeConnectionOperation

package/skills/jskit/references/patterns/connectors/google-ads-search/PATTERN.md

@@ -27,18 +27,20 @@ const created = await ads.create(review.reviewId); // starts PAUSED
 `configuration.extensions.googleAdsSearch[integrationId]` holds the saved plan.
 Validate it with `validateGoogleAdsSearchPlan` from the package's shared
 `google-ads-search` export. Keep OAuth settings separate so campaign edits do not
-invalidate consent. The runtime has no Vibe64 protocol, frontend, Env injection or
+invalidate consent. The runtime has no command protocol, frontend, Env injection or
 storage owner. CLI apps can call it directly. Normal `connections.authorize` must
 authorize the trusted application's advertising administrator for each operation;
 never accept a subject identity from a request body.
 
-For Vibe64, compose `example/ads-setup.js` into the app's existing Integration setup
-command and return exactly one JSON result on stdout. Derive `context` and the
+When a host runs the app's integration setup command, compose `example/ads-setup.js`
+into that command and return exactly one JSON result on stdout. Pass the host's
+request protocol as the fragment's third argument: `protocol`, the id its requests
+carry and its response echoes, and `maxResponseBytes`, the largest response it
+accepts; the host's own command contract names both. Derive `context` and the
 allowed integration ID from trusted command composition before calling the
 fragment. Keep connection status/connect/reconnect/disconnect operations intact.
-Read the public Vibe64 `application-google-ads.md` command contract when targeting
-that editor. Other frameworks implement its JSON/Env and operation contract with
-their native libraries; they do not execute this JavaScript fragment.
+Other frameworks implement its JSON/Env and operation contract with their native
+libraries; they do not execute this JavaScript fragment.
 
 The Search recipe supports only non-political manual-CPC campaigns with one ad
 group, phrase keywords and a website conversion goal. Account creation, PMax,
@@ -66,9 +68,15 @@ persistent OAuth grants. Reviews include live account values and the saved plan.
 Creation is paused and atomic; launch rechecks the live review. Do not replay a
 write after an uncertain response. Disconnecting does not pause campaigns.
 
+Each collaborator the composition receives (the `createGoogleAdsSearchService()`
+service) is a required parameter typed in a JSDoc `@param` and called directly,
+without a `typeof` probe, a "requires x" guard or a no-op default. A server
+feature that uses it follows
+[typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
+
 ## Example files
 
-`example/ads-setup.js` maps the optional editor command to the shared service. It
+`example/ads-setup.js` maps a host's optional setup command to the shared service. It
 contains no HTTP endpoint, credential resolution or trusted-identity inference.
 
 ## Variation points
@@ -90,3 +98,6 @@ approval and conversion/billing readiness require operator verification.
 Do not put secrets in JSON, stdout or chat. Do not execute conversion snippets in
 the editor, confuse OAuth consent with advertiser approval, or claim live account
 acceptance from fixture tests. Keep larger campaign types outside this recipe.
+
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.

package/skills/jskit/references/patterns/connectors/google-ads-search/example/ads-setup.js

@@ -1,7 +1,15 @@
-// Compose the service in the application's existing authenticated command owner.
-// No stdin value establishes the trusted application/administrator identity.
-export async function dispatchAdsSetup(request, service) {
-  if (request?.protocol !== "vibe64.integration-setup.command.v1" || typeof request.requestId !== "string" ||
+/**
+ * Runs one advertising setup request against the Google Ads Search service. Compose
+ * the service in the application's existing authenticated command owner: no request
+ * value establishes the trusted application or administrator identity.
+ * @param {{ protocol: string, requestId: string, operation: string, ads: Record<string, any> }} request The parsed setup command.
+ * @param {import("@jskit-ai/connectors-catalog/server/types").GoogleAdsSearchService} service
+ * @param {object} host The command host's request protocol.
+ * @param {string} host.protocol The protocol id that requests carry and the response echoes.
+ * @param {number} host.maxResponseBytes The largest response the host accepts.
+ */
+export async function dispatchAdsSetup(request, service, { protocol, maxResponseBytes }) {
+  if (request?.protocol !== protocol || typeof request.requestId !== "string" ||
       !/^[A-Za-z0-9_-]{1,200}$/.test(request.requestId) || !request.ads || Array.isArray(request.ads) || typeof request.ads !== "object") {
     throw new Error("Invalid advertising setup request.");
   }
@@ -20,6 +28,6 @@ export async function dispatchAdsSetup(request, service) {
     default: throw new Error("Unsupported advertising setup operation.");
   }
   const response = { protocol: request.protocol, requestId: request.requestId, status: "ads", operation: request.operation, data };
-  if (Buffer.byteLength(JSON.stringify(response)) > 32768) throw new Error("Advertising result exceeds the editor's display limit. Inspect Google Ads before repeating any write.");
+  if (Buffer.byteLength(JSON.stringify(response)) > maxResponseBytes) throw new Error("Advertising result exceeds the host's response limit. Inspect Google Ads before repeating any write.");
   return response;
 }

package/skills/jskit/references/patterns/connectors/oauth-connection/PATTERN.md

@@ -69,7 +69,7 @@ const protection = createCredentialProtection({
 const connections = createConnectionService({
   configuration, providers,
   store: createFileConnectionStore({ directory: process.env.CONNECTOR_STATE_DIRECTORY, protection }),
-  resolveReference: createEnvironmentReferenceResolver(), authorize: applicationConnectionPolicy
+  resolveReference: createEnvironmentReferenceResolver(process.env), authorize: applicationConnectionPolicy
 });
 ```
 

package/skills/jskit/references/patterns/connectors/paddle-catalogue/PATTERN.md

@@ -38,6 +38,12 @@ the ordinary runtime for each request, preserving authorization and the
 connection's configured sandbox/live environment. The sandbox setting used for
 local schema validation sends no request and does not override runtime routing.
 
+Each collaborator the composition receives (the connection `runtime`) is a
+required parameter typed in a JSDoc `@param` and called directly, without a
+`typeof` probe, a "requires x" guard or a no-op default. A server feature that
+uses it follows
+[typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
+
 ## Product decisions
 
 For assistant use, authorize the complete cloned request with
@@ -58,12 +64,15 @@ termination can prevent the returned report from being saved, so an application
 needing crash recovery must record each completed step durably. This small
 recipe does not promise crash recovery, rollback or exactly-once execution.
 
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.
+
 ## Variation points
 
-CLI users can call this same JavaScript recipe with their own runtime. Vibe64
+CLI users can call this same JavaScript recipe with their own runtime. An editor
 configures the project; it does not execute catalogue writes on configuration
 save. Laravel applications implement this composition with their own framework
-and Paddle client, without importing JavaScript or depending on Vibe64.
+and Paddle client, without importing JavaScript or depending on an editor.
 
 ## Example files
 

package/skills/jskit/references/patterns/connectors/paddle-catalogue/example/create-products.js

@@ -1,7 +1,10 @@
 import { paddleProvider } from "@jskit-ai/connectors-catalog/server/paddle";
 
-// Application-owned composition: pass an application-mode connection runtime.
-// An assistant host must approve the complete batch before calling this recipe.
+/**
+ * Application-owned composition: pass an application-mode connection runtime.
+ * An assistant host must approve the complete batch before calling this recipe.
+ * @param {{ runtime: import("@jskit-ai/connectors-core/server/types").ConnectorsCore, context: object, integrationId: string, items: object[], signal?: AbortSignal }} request
+ */
 async function createProductsWithPrices({ runtime, context, integrationId, items, signal }) {
   if (!Array.isArray(items) || !items.length || items.length > 100) {
     throw new TypeError("Supply between 1 and 100 products with prices.");

package/skills/jskit/references/patterns/connectors/public-image/PATTERN.md

@@ -29,12 +29,18 @@ existing access policy applies before exposing its configured resources.
 
 ## Invariants
 
-- CLI and Vibe64 edit the same reference-only `integrations.json`.
+- The CLI and a hosted editor edit the same reference-only `integrations.json`.
 - Only a `pk_` key enters an image URL; a private key fails validation.
 - URL creation is local and does not establish a verified account connection.
 - Browser load/error events report delivery. A monogram is not proof of a brand logo.
 - Domain restrictions concern the app that loads the image, including previews
   and custom domains. The editor VM may have a different origin.
+- Each collaborator the composition receives (`resolveReference`) is a required
+  parameter typed in a JSDoc `@param` and called directly, without a `typeof`
+  probe, a "requires x" guard or a no-op default. It is typed with
+  `ResolveReference` from `@jskit-ai/connectors-core/server/types`. A server
+  feature that uses it follows
+  [typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
 
 ## Framework APIs
 
@@ -82,3 +88,6 @@ These checks need neither live credentials nor generated sample applications.
 Do not call server `connectApiKey` to manufacture a Connected receipt for this
 image flow. Do not send a secret key, an environment dump or a caller-selected
 service origin to the browser. Do not treat key naming as provider quota isolation.
+
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.

package/skills/jskit/references/patterns/connectors/public-image/example/logo-url.js

@@ -2,7 +2,10 @@ import { parseIntegrationConfiguration } from "@jskit-ai/connectors-core/shared/
 import { logoDevDefinition } from "@jskit-ai/connectors-catalog/shared";
 import { createLogoDevImageUrl } from "@jskit-ai/connectors-catalog/client/logo-dev";
 
-// The application authorizes access before passing its configuration and resolver.
+/**
+ * The application authorizes access before passing its configuration and resolver.
+ * @param {{ configurationText: string, integrationId: string, resolveReference: import("@jskit-ai/connectors-core/server/types").ResolveReference, image: object }} request
+ */
 async function logoUrlFromConfiguration({ configurationText, integrationId, resolveReference, image }) {
   const configuration = parseIntegrationConfiguration(configurationText, { providers: [logoDevDefinition], allowUnknownProviders: true });
   const integration = configuration.integrations[integrationId];

package/skills/jskit/references/patterns/connectors/redshift-queries/PATTERN.md

@@ -24,7 +24,7 @@ SQL can modify data; read-only behavior requires appropriate database grants.
 
 ## Product decisions
 
-Select serverless or provisioned in the same JSON edited by Vibe64. Serverless
+Select serverless or provisioned in the same JSON the editor edits. Serverless
 requires a workgroup name; provisioned requires a cluster identifier and may use
 an explicit database user. Both require a database and region. Store AWS secrets
 outside the file. Temporary credentials additionally need `sessionTokenRef` and