@jskit-ai/connectors-catalog 0.2.3 → 0.2.5

package/docs/wix.md

@@ -3,7 +3,7 @@
 Import `wixProvider` from `@jskit-ai/connectors-catalog/server/wix`. The
 runtime reads account sites and business locations, manages site contacts and
 booking-service settings, queries availability, creates/cancels bookings, reads orders
-and reads/edits products in both Wix catalogue versions. Vibe64 and CLI consumers
+and reads/edits products in both Wix catalogue versions. Hosted-editor and CLI consumers
 edit the same JSON and use shared validation, authorization and encrypted file
 storage. Provider acceptance is still in progress; see Verification status below.
 
@@ -103,16 +103,16 @@ fields and input values fail explicitly. Cancellation preserves a verified grant
 ## Editors, hosting and automation
 
 For this account-key flow, the universal OAuth callback is **not applicable**.
-Customer VPS and custom-domain URLs do not enter the provider authentication
+Customer server and custom-domain URLs do not enter the provider authentication
 request. Each connected customer account requires its own authorized account
-binding. A single Vibe64-owned account key cannot grant access to unrelated
+binding. A single editor-owned account key cannot grant access to unrelated
 customers' Wix accounts.
 
 The application owner supplies the authorized key and its matching Wix account
 binding through private Env and configuration. The backend enforces access to
 that account and keeps the key off browsers. Separate keys do not establish
 independent quota pools; provider limits and permitted use still apply. CLI and
-Vibe64 users configure the same application-owned key flow.
+hosted-editor users configure the same application-owned key flow.
 
 | Task | Automation assessment |
 |---|---|
@@ -276,7 +276,7 @@ administrative write workflow). This is a backend site-wide credential, not each
 customer's authorization. The generated app must check booking ownership before
 returning private details or invoking actions. Frameworks other than JSKIT use the
 same configured site and Env credential with their native HTTP client. No editor
-or Vibe64 server is required by the deployed app.
+or hosted server is required by the deployed app.
 
 
 ### Appointment availability
@@ -369,7 +369,7 @@ Check current bookability/capacity before submitting `bookings.create` with
 `kind: "CLASS"`. The generated app owns party-size selection and lost-capacity
 feedback. This does not reserve seats. A mismatched event/service/time-zone
 response is rejected. CLI/native framework users follow the same native flow and
-project-owned credentials; no Vibe64 service participates in the booking.
+project-owned credentials; no hosted service participates in the booking.
 
 
 ### Select a resource and location
@@ -414,7 +414,7 @@ Detailed transaction/refund history requires the native transactions API.
 CLI-created JSKIT apps invoke these operations through the same connection
 service; other frameworks use the same site-scoped endpoints and Env key with
 their own HTTP client. The generated app owns commerce screens, authorization,
-fulfilment and payment reconciliation. No Vibe64 gateway or managed key is used.
+fulfilment and payment reconciliation. No hosted gateway or managed key is used.
 
 
 
@@ -560,7 +560,7 @@ business object. Hide unauthorized sites in the app's picker as well.
 
 This is the same text configuration and operation interface for CLI projects.
 Other frameworks must enforce the configured allowed IDs and user authorization
-before choosing the site header. No new Vibe64 server or gateway is involved.
+before choosing the site header. No new hosted server or gateway is involved.
 
 
 ### Filtered CMS content and references
@@ -935,7 +935,7 @@ fixtures. Package/rendered proof still requires the next refresh.
 for the selected service through the project-owned site connection. The response
 field is `serviceVariants`, not `serviceOptionsAndVariants`. Preserve its option
 IDs, choices, revision and decimal price strings. The generated application's
-own form displays the choices and collects participants per choice; Vibe64 does
+own form displays the choices and collects participants per choice; the editor does
 not maintain a separate catalogue or expose the API key to that form.
 
 Use the selected service ID from `bookingServices.list` or `.get`. The API key
@@ -948,7 +948,7 @@ provider error and check service configuration before offering a booking.
 
 CLI callers use the same invocation and existing Env-backed connection as the
 other site operations. Other frameworks call Wix's native endpoint with their
-project-owned key and site header. No additional Vibe64 service is required.
+project-owned key and site header. No additional hosted service is required.
 
 The lookup feeds the explicit availability and booking selections below.
 The generated app owns the form and authorization. Confirmation is an explicit operation described below; creation does not
@@ -1117,7 +1117,7 @@ Create Cart reference also lists **Manage eCommerce - Admin Permissions** as an
 alternative permission. Keep the selected site's ID in project configuration.
 Publish the Wix site and configure its checkout/payment methods before expecting
 a working payment page. SITE_NOT_PUBLISHED or CHECKOUT_PAGE_NOT_FOUND requires
-fixing the Wix site, not adding an OAuth app or a Vibe64 gateway.
+fixing the Wix site, not adding an OAuth app or a hosted gateway.
 
 The app backend calls `carts.create` with a nonempty `catalogItems` array and an
 optional `note`. Each item has `quantity` and `catalogReference`:
@@ -1159,7 +1159,7 @@ JSKIT CLI/runtime consumers use the same calls with text/Env configuration. Othe
 frameworks POST `{ cart: { source: { channelType: "WEB" }, note? }, catalogItems }`
 to `/ecom/v2/carts`, then POST `{}` to `/ecom/v2/carts/{cartId}/get-checkout-url`
 with the project-owned key and `wix-site-id` header. They can use their framework's
-normal redirect response. No card details, provider credentials or Vibe64 billing
+normal redirect response. No card details, provider credentials or hosted billing
 service are passed through the browser.
 
 References: [Create Cart](https://dev.wix.com/docs/api-reference/business-solutions/e-commerce/purchase-flow/cart-v2/create-cart),
@@ -1198,7 +1198,7 @@ This reader does not create shipments or send shipping notifications. Use the
 separate create/update operations documented below to record shipments or change
 tracking. Those writes can trigger Wix shipping notifications.
 CLI and other frameworks use the same project Env key, site header and native
-endpoint; there is no Vibe64 service dependency.
+endpoint; there is no hosted service dependency.
 
 Reference: [Wix List Fulfillments For Single Order](https://dev.wix.com/docs/api-reference/business-solutions/e-commerce/orders/order-fulfillments/list-fulfillments-for-single-order).
 

package/docs/wordpress-com.md

@@ -113,7 +113,7 @@ provider consent remain owner steps; do not invent a client-creation endpoint.
 
 The application owner creates the provider registration and stores its secret
 in the application's private Env. Every editor and CLI uses this same
-[ownership model](../../connectors-core/docs/online-setup.md): the configuration
+[ownership model](../../connectors-core/docs/application-setup.md): the configuration
 file holds the client ID and Env references; the editor does not own the
 application's grants.
 

package/docs/wordpress-self-hosted.md

@@ -149,7 +149,7 @@ inspect the site's content before deciding whether to repeat it.
 A non-Node framework uses its own HTTPS client, the same site URL/Env username
 and password binding, and these native `/wp-json/wp/v2/posts` or `/pages` routes.
 Use GET for reads, JSON POST for create/update, and DELETE with force=false for
-trash. There is no Vibe64 runtime or JSKIT service requirement for that framework.
+trash. There is no hosted runtime or JSKIT service requirement for that framework.
 
 ## Media and user operations
 

package/docs/workday.md

@@ -63,7 +63,7 @@ registration. Task availability depends on the administrator's permissions.
    Tenant Setup – Security**, enable **OAuth 2.0 Clients Enabled**, and apply the
    organization's normal security-change process.
 3. Search for **Register API Client**. Enter a recognizable client name such as
-   `DogAndGroom — production` or `DogAndGroom — sandbox`.
+   `Bookings — production` or `Bookings — sandbox`.
    Choose **Authorization Code Grant** and **Bearer** access tokens.
 4. Leave **Support Proof Key for Code Exchange (PKCE)** disabled for this
    confidential setup. The captured Workday connector expects the client secret
@@ -138,7 +138,7 @@ updates, employment changes, bulk sync or automatic pagination.
 
 The application owner creates the provider registration and stores its secret
 in the application's private Env. Every editor and CLI uses this same
-[ownership model](../../connectors-core/docs/online-setup.md): the configuration
+[ownership model](../../connectors-core/docs/application-setup.md): the configuration
 file holds the client ID and Env references; the editor does not own the
 application's grants.
 

package/docs/x-twitter.md

@@ -3,7 +3,7 @@
 Import `xTwitterProvider` from `@jskit-ai/connectors-catalog/server/x-twitter`.
 This adapter reads public profiles, post timelines and recent search using an app-only
 bearer token. The shared connection service and file store work from a CLI or
-application server. Vibe64 edits the same JSON; saving does not contact X.
+application server. A hosted editor edits the same JSON; saving does not contact X.
 
 ## Create the provider application
 
@@ -117,7 +117,7 @@ advertised as individual users connecting their X accounts.
 [Authentication boundary](https://docs.x.com/fundamentals/authentication/oauth-2-0/application-only).
 
 An OAuth callback is **not applicable to this bearer-token flow**. Neither a
-customer's VPS hostname nor a custom application domain changes authentication.
+customer's server hostname nor a custom application domain changes authentication.
 The application owner supplies its authorized token through private Env and
 retains that credential ownership when moving hosts.
 
@@ -171,7 +171,7 @@ rendering a purported complete result.
 
 A native framework uses the same Env token in its server-side HTTP client,
 `Authorization: Bearer <value>`, and these fixed API paths/query parameters.
-It does not require JSKIT or Vibe64 at runtime. The application owns query
+It does not require JSKIT or a hosted editor at runtime. The application owns query
 permissions, pagination controls, spend limits, escaping post text, joining
 expansions, attribution and links back to the original post. Do not turn returned
 media URLs into arbitrary backend downloads or render post text as trusted HTML.

package/docs/xero.md

@@ -4,7 +4,7 @@ The `xeroProvider` export from `@jskit-ai/connectors-catalog/server/xero`
 connects an own web registration through the shared OAuth runtime. It discovers
 authorised tenants and provides organisation settings, contacts, invoices,
 payments, reports, budgets, manual journals, bank transactions and attachments. Configuration, consent, refresh and encrypted file storage work from
-an ordinary backend or CLI; no database or Vibe64 service is required.
+an ordinary backend or CLI; no database or hosted service is required.
 
 ## Create the provider registration
 
@@ -120,7 +120,7 @@ describe the underlying read parameters and lightweight responses.
 
 Each application owns its provider registration, callback route, credentials
 and grants. Hosted and installed editors configure the same app-owned setup;
-neither supplies a shared Vibe64 registration or token gateway. Use the app's
+neither supplies a shared registration or token gateway. Use the app's
 assigned public URL as the initial callback origin, append the route the backend
 actually implements, and register the exact URL with the provider. Keep the
 client secret and callback binding in the application's Env.
@@ -337,7 +337,7 @@ Dates use `YYYY-MM-DD`. Choose the contact from `contacts.list`; aged reports ar
 
 Select **Read budgets** (`accounting.budgets.read`) and reconnect. Call `budgets.list` with `tenantId`; call `budgets.get` with that tenant and the returned budget UUID as `id`. Both accept optional `DateFrom` and `DateTo` in `YYYY-MM-DD` format (capitalization matches Xero). The adapter preserves account budget lines, balances, periods, notes and tracking data, and rejects a detail response for a different budget. It does not create or edit budgets.
 
-For a summary, separately select **Read budget summary reports** (`accounting.reports.budgetsummary.read`) and reconnect. `reports.budgetSummary` takes `tenantId`, required `date`, optional `periods` (1–12) and optional integer `timeframe`: 1=month, 3=quarter, 12=year. This differs from the string timeframe used by profit/loss reports. The application owns rendering; no Vibe64 runtime is required.
+For a summary, separately select **Read budget summary reports** (`accounting.reports.budgetsummary.read`) and reconnect. `reports.budgetSummary` takes `tenantId`, required `date`, optional `periods` (1–12) and optional integer `timeframe`: 1=month, 3=quarter, 12=year. This differs from the string timeframe used by profit/loss reports. The application owns rendering; no hosted runtime is required.
 
 ### Bank transaction and manual journal reads
 

package/docs/zoho-books.md

@@ -2,7 +2,7 @@
 
 Import `zohoBooksProvider` from `@jskit-ai/connectors-catalog/server/zoho-books`.
 This initial adapter discovers organisations and reads contact and invoice pages.
-CLI and Vibe64 use the same configuration, OAuth service and encrypted file store.
+The CLI and a hosted editor use the same configuration, OAuth service and encrypted file store.
 Saving configuration does not connect an account.
 
 ## Register and configure
@@ -156,7 +156,7 @@ refresh tokens. [Token lifecycle and revocation](https://www.zoho.com/books/api/
 
 The application owner creates the provider registration and stores its secret
 in the application's private Env. Every editor and CLI uses this same
-[ownership model](../../connectors-core/docs/online-setup.md): the configuration
+[ownership model](../../connectors-core/docs/application-setup.md): the configuration
 file holds the client ID and Env references; the editor does not own the
 application's grants.
 

package/docs/zoho-crm.md

@@ -3,7 +3,7 @@
 Import `zohoCrmProvider` from `@jskit-ai/connectors-catalog/server/zoho-crm`.
 The initial adapter reads the current CRM user and pages of leads, contacts,
 accounts and deals. It uses the existing OAuth connection service and encrypted
-file store. Vibe64 and CLI users edit the same `integrations.json`; saving that
+file store. Hosted-editor and CLI users edit the same `integrations.json`; saving that
 file does not perform consent or verify credentials.
 
 ## Register a client
@@ -134,7 +134,7 @@ Revocation is separate from deleting this integration's configuration.
 
 The application owner creates the provider registration and stores its secret
 in the application's private Env. Every editor and CLI uses this same
-[ownership model](../../connectors-core/docs/online-setup.md): the configuration
+[ownership model](../../connectors-core/docs/application-setup.md): the configuration
 file holds the client ID and Env references; the editor does not own the
 application's grants.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/connectors-catalog",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Provider definitions and focused API operations for JSKIT connectors.",
   "type": "module",
   "exports": {
@@ -117,6 +117,7 @@
     "./server/workday": "./src/server/workday.js",
     "./server/shopify": "./src/server/shopify.js",
     "./server/wiz": "./src/server/wiz.js",
+    "./server/types": "./src/server/types.js",
     "./locales/en.json": "./locales/en.json"
   },
   "dependencies": {
@@ -124,14 +125,14 @@
     "@aws-sdk/client-redshift-data": "3.1128.0",
     "@aws-sdk/client-s3": "3.1128.0",
     "@aws-sdk/s3-request-presigner": "3.1128.0",
-    "@jskit-ai/connectors-core": "0.2.3",
+    "@jskit-ai/connectors-core": "0.2.5",
     "@modelcontextprotocol/sdk": "1.32.1",
     "@smithy/fetch-http-handler": "5.8.0",
     "jose": "^6.1.3",
     "json-rest-schema": "^1.0.17"
   },
   "peerDependencies": {
-    "@jskit-ai/kernel": "0.2.3"
+    "@jskit-ai/kernel": "0.2.4"
   },
   "jskit": {
     "kind": "runtime",

package/patterns/ai-connections/PATTERN.md

@@ -38,6 +38,18 @@ to authorized application, user, provider and integration. The application owns
 key-entry and disconnect screens. Never return connection parameters to a
 browser or share coding-agent subscription credentials.
 
+Each collaborator the composition receives (`authorize`, `createModel`,
+`createClient` and `resolveReference`) is a required parameter typed in a JSDoc
+`@param` and called directly, without a `typeof` probe at the call or a no-op
+default. `createPerplexityAnswers()` checks `authorize` and `createClient` once,
+as input validation when it is composed, so a missing one fails there instead of
+on the first answer. `authorize` and `resolveReference` are typed with
+`ConnectorAuthorize` and `ResolveReference` from
+`@jskit-ai/connectors-core/server/types`. Only the production
+`resolveReference = createEnvironmentReferenceResolver(process.env)` stays as a default, in
+both compositions. A server feature that uses it follows
+[typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
+
 ## Do not use when
 
 Frameworks outside Node follow their own configuration and AI client patterns.
@@ -65,6 +77,9 @@ Do not add a runtime catalogue fetch, token billing, an inference proxy, a
 cross-language runtime or a silent paid fallback. Never infer that a model
 marked free can be used without the authentication its provider requires.
 
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.
+
 ## Existing Perplexity connector slots
 
 Use `example/perplexity-answer.js` when configuration already has provider
@@ -80,6 +95,6 @@ search_results. For stream=true consume the async iterator, rendering deltas
 and retaining final citations/search_results; cancel with AbortSignal.
 Allow only safe HTTP(S) links in rendered citations. Never send the API key/client
 to a browser. A public route must sanitize SDK failures and enforce app budgets.
-This is direct app-to-provider traffic, with no Vibe64 token sales or proxy.
+This is direct app-to-provider traffic, with no hosted token sales or proxy.
 A trusted CLI operator can use the same JSON/Env and factory. Other frameworks
 use their own native Perplexity/OpenAI-compatible clients and the same slot.

package/patterns/ai-connections/example/ai-model.js

@@ -1,8 +1,17 @@
+import { createEnvironmentReferenceResolver } from "@jskit-ai/connectors-core/server";
 import { createAiConnectionResolver } from "@jskit-ai/connectors-catalog/server/ai";
 
-// App-owned composition. Supply the authenticated authorization policy and the
-// SDK model factory used by this application. Omit resolveReference for Env.
-export function createConfiguredAiModel({ configuration, authorize, resolveReference, createModel }) {
+/**
+ * App-owned composition. Supply the authenticated authorization policy and the
+ * SDK model factory used by this application. Omit resolveReference for Env.
+ * @param {object} dependencies
+ * @param {object} dependencies.configuration The integration configuration.
+ * @param {import("@jskit-ai/connectors-core/server/types").ConnectorAuthorize} dependencies.authorize The application's access policy: the owner, or null.
+ * @param {import("@jskit-ai/connectors-core/server/types").ResolveReference} [dependencies.resolveReference]
+ * @param {(parameters: object) => unknown} dependencies.createModel The application's SDK model factory.
+ */
+export function createConfiguredAiModel({ configuration, authorize,
+  resolveReference = createEnvironmentReferenceResolver(process.env), createModel }) {
   const connections = createAiConnectionResolver({ configuration, authorize, resolveReference });
   return async ({ context, integrationId }) => {
     const parameters = await connections.resolve({ context, integrationId });

package/patterns/ai-connections/example/perplexity-answer.js

@@ -2,11 +2,22 @@ import { ConnectorError, createEnvironmentReferenceResolver } from "@jskit-ai/co
 import { validateIntegrationConfiguration } from "@jskit-ai/connectors-core/shared/configuration";
 import { perplexityProvider } from "@jskit-ai/connectors-catalog/server/perplexity";
 
-// App-owned composition, not an inference service. Supply the application's native
-// OpenAI-compatible client factory. Credentials and the returned client stay server-side.
+/**
+ * App-owned composition, not an inference service. Supply the application's native
+ * OpenAI-compatible client factory. Credentials and the returned client stay server-side.
+ * @param {object} dependencies
+ * @param {object} dependencies.configuration The integration configuration.
+ * @param {import("@jskit-ai/connectors-core/server/types").ConnectorAuthorize} dependencies.authorize The application's access policy: the owner, or null.
+ * @param {(options: object) => { chat: { completions: { create: (body: object, request: object) => Promise<any> } } }} dependencies.createClient
+ *   The application's native SDK client factory, such as `options => new OpenAI(options)`.
+ * @param {import("@jskit-ai/connectors-core/server/types").ResolveReference} [dependencies.resolveReference]
+ */
 export function createPerplexityAnswers({ configuration, authorize, createClient,
-  resolveReference = createEnvironmentReferenceResolver() }) {
-  if (typeof authorize !== "function" || typeof createClient !== "function") throw new TypeError("Supply application authorization and its native client factory.");
+  resolveReference = createEnvironmentReferenceResolver(process.env) }) {
+  // readable-check: allow method-probe - input validation: the application passes its access policy and its SDK client factory
+  if (typeof authorize !== "function" || typeof createClient !== "function") {
+    throw new TypeError("Supply application authorization and its native client factory.");
+  }
   const config = validateIntegrationConfiguration(configuration, { providers: [perplexityProvider], allowUnknownProviders: true });
   return async ({ context, integrationId, question, model, stream = false, signal }) => {
     const slot = Object.hasOwn(config.integrations, integrationId) ? config.integrations[integrationId] : null;

package/patterns/api-key-connection/PATTERN.md

@@ -112,6 +112,12 @@ not require putting credentials into source.
 - An optional frontend key reference is distinct from the primary backend key.
   Only the application may deliberately expose a suitable search-only key;
   successful backend verification does not verify that frontend key's restrictions.
+- Each collaborator the composition receives (`authorize`) is a required
+  parameter typed in a JSDoc `@param` and called directly, without a `typeof`
+  probe, a "requires x" guard or a no-op default. `authorize` is typed with
+  `ConnectorAuthorize` from `@jskit-ai/connectors-core/server/types`. Only the
+  production `env = process.env` stays as a default. A server feature that uses
+  it follows [typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
 
 ## Framework APIs
 
@@ -168,7 +174,7 @@ const protection = createCredentialProtection({
 const store = createFileConnectionStore({ directory: process.env.CONNECTOR_STATE_DIRECTORY, protection });
 const connections = createConnectionService({
   configuration, providers, store,
-  resolveReference: createEnvironmentReferenceResolver(),
+  resolveReference: createEnvironmentReferenceResolver(process.env),
   authorize: applicationConnectionPolicy
 });
 
@@ -243,6 +249,8 @@ Do not turn provider metadata into arbitrary authenticated URL forwarding.
 Do not retry a paid or mutating request automatically. Do not mark an untested
 managed mode or an unimplemented provider operation available.
 
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.
 
 ## Granola meeting data
 

package/patterns/api-key-connection/example/connections.js

@@ -5,8 +5,11 @@ import { createFileConnectionStore, createCredentialProtection } from "@jskit-ai
 import { resendProvider } from "@jskit-ai/connectors-catalog/server/resend";
 import { firecrawlProvider } from "@jskit-ai/connectors-catalog/server/firecrawl";
 
-// Both a manually written CLI and a server can compose this application-owned module.
-// The application supplies its existing identity and permission policy.
+/**
+ * Both a manually written CLI and a server can compose this application-owned module.
+ * The application supplies its existing identity and permission policy.
+ * @param {{ authorize: import("@jskit-ai/connectors-core/server/types").ConnectorAuthorize, env?: Record<string, string | undefined>, configFile?: string }} dependencies
+ */
 export async function applicationConnections({ authorize, env = process.env, configFile = "integrations.json" }) {
   const providers = [resendProvider, firecrawlProvider];
   const configuration = parseIntegrationConfiguration(await readFile(configFile, "utf8"), { providers });

package/patterns/aws-storage-queries/PATTERN.md

@@ -19,7 +19,7 @@ composes those libraries with the application's identity and resource policy.
 ## Do not use when
 
 Do not use this as an application login, an AWS account creator, a general SDK
-proxy, or proof that a managed Vibe64 allocation exists. Do not use a machine's
+proxy, or proof that a managed host's allocation exists. Do not use a machine's
 default AWS credentials for arbitrary application users. Per-user federation,
 AWS IAM Identity Center, noncommercial AWS partitions and arbitrary endpoints
 are outside the fragment. Athena statements can write data and incur costs;
@@ -28,8 +28,8 @@ connecting does not approve arbitrary future SQL.
 ## Product decisions
 
 Use the exact [S3](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/aws-s3.md) or
-[Athena](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/aws-athena.md) JSON. The same file is usable by CLI and the
-Vibe64 form. Store the actual secret access key, access key ID and optional
+[Athena](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/aws-athena.md) JSON. The same file is usable by CLI and a
+hosted editor's form. Store the actual secret access key, access key ID and optional
 session token outside source. The access key ID uses `settings.accessKeyIdRef`,
 the secret uses `authentication.secretRef`, and temporary credentials add
 `settings.sessionTokenRef`. A missing explicit binding is an error.
@@ -43,6 +43,13 @@ account assignments, quotas and credential renewal are separate operations.
 There is no OAuth callback for these modes. See
 [AWS ownership](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/aws-credentials.md).
 
+Each collaborator the composition receives (the connection `service`) is a
+required parameter typed in a JSDoc `@param` and called directly, without a
+`typeof` probe, a "requires x" guard or a no-op default. Only the production
+`fetchImpl = globalThis.fetch` stays as a default. A server feature that uses it
+follows
+[typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
+
 ## Framework APIs
 
 Follow the [API-key connection pattern](../api-key-connection/PATTERN.md) to
@@ -154,6 +161,9 @@ Do not expose presigned URLs in logs, infer table permission from a workgroup
 read, treat workgroup membership as user isolation, or poll queries without an
 application-controlled limit.
 
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.
+
 ## Verification
 
 Missing credential references fail before HTTP. Expired/rejected AWS credentials

package/patterns/aws-storage-queries/example/s3-transfer.js

@@ -1,6 +1,17 @@
-// Application-owned composition: service.authorize must approve this exact key
-// for context. The same function works in a Node CLI or application backend.
-// Pass a bounded signal for both signing and the complete response-body read.
+/**
+ * Application-owned composition: service.authorize must approve this exact key
+ * for context. The same function works in a Node CLI or application backend.
+ * Pass a bounded signal for both signing and the complete response-body read.
+ * @param {object} request
+ * @param {import("@jskit-ai/connectors-core/server/types").ConnectorsCore} request.service
+ * @param {object} request.context
+ * @param {string} request.integrationId
+ * @param {string} request.key
+ * @param {"download" | "upload"} request.direction
+ * @param {Blob | ArrayBuffer | ArrayBufferView} [request.body]
+ * @param {AbortSignal} request.signal
+ * @param {typeof globalThis.fetch} [request.fetchImpl]
+ */
 export async function transferS3Object({ service, context, integrationId, key,
   direction, body, signal, fetchImpl = globalThis.fetch }) {
   if (!["download", "upload"].includes(direction)) throw new TypeError("Choose download or upload.");

package/patterns/event-delivery/PATTERN.md

@@ -145,7 +145,7 @@ schedules with awareness of daylight-saving behavior.
 Expose the SDK route through the app's normal server composition, then deploy
 and sync its HTTPS `/api/inngest` URL in the selected Inngest environment.
 Keep the Signing Key private and let the native adapter verify signatures.
-JSKIT CLI users follow the same steps without Vibe64. Other stacks use native
+JSKIT CLI users follow the same steps. Other stacks use native
 SDKs where available and the same event name/payload/Env contract; this example
 does not promise an SDK in every language. No function execution, cloud sync
 or generated application is performed by this reference pattern.

package/patterns/firebase-messaging/PATTERN.md

@@ -39,6 +39,13 @@ reference, stable project identity and public settings. Verify before reporting
 Connected; authorize every audience before sending. Preserve the existing file
 store and token lock instead of copying the grant implementation.
 
+Each collaborator the composition receives (`authorizeConnectionOperation`) is a
+required parameter typed in a JSDoc `@param` and called directly, without a
+`typeof` probe, a "requires x" guard or a no-op default. It is typed with
+`ConnectorAuthorize` from `@jskit-ai/connectors-core/server/types`. A server
+feature that uses it follows
+[typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
+
 ## Framework APIs
 
 Use `parseIntegrationConfiguration`, `createConnectionService`,
@@ -154,3 +161,6 @@ Do not expose service-account JSON to the browser, confuse Firebase API keys
 with private service credentials, or choose the paid project from caller input.
 Do not treat an accepted message receipt as device delivery or automatically
 retry a send whose outcome is unknown.
+
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.

package/patterns/firebase-messaging/example/server/notifications.js

@@ -4,6 +4,14 @@ import { createConnectionService, createEnvironmentReferenceResolver } from "@js
 import { createFileConnectionStore, createCredentialProtection } from "@jskit-ai/connectors-core/server/file-storage";
 import { firebaseCloudMessagingProvider } from "@jskit-ai/connectors-catalog/server/firebase-cloud-messaging";
 
+/**
+ * @param {object} options
+ * @param {string} options.configurationPath
+ * @param {string} options.runtimeDirectory
+ * @param {Buffer} options.credentialKey
+ * @param {Record<string, string | undefined>} options.environment
+ * @param {import("@jskit-ai/connectors-core/server/types").ConnectorAuthorize} options.authorizeConnectionOperation The application's access policy.
+ */
 export async function openNotificationConnections({
   configurationPath, runtimeDirectory, credentialKey, environment,
   authorizeConnectionOperation

package/patterns/google-ads-search/PATTERN.md

@@ -27,18 +27,20 @@ const created = await ads.create(review.reviewId); // starts PAUSED
 `configuration.extensions.googleAdsSearch[integrationId]` holds the saved plan.
 Validate it with `validateGoogleAdsSearchPlan` from the package's shared
 `google-ads-search` export. Keep OAuth settings separate so campaign edits do not
-invalidate consent. The runtime has no Vibe64 protocol, frontend, Env injection or
+invalidate consent. The runtime has no command protocol, frontend, Env injection or
 storage owner. CLI apps can call it directly. Normal `connections.authorize` must
 authorize the trusted application's advertising administrator for each operation;
 never accept a subject identity from a request body.
 
-For Vibe64, compose `example/ads-setup.js` into the app's existing Integration setup
-command and return exactly one JSON result on stdout. Derive `context` and the
+When a host runs the app's integration setup command, compose `example/ads-setup.js`
+into that command and return exactly one JSON result on stdout. Pass the host's
+request protocol as the fragment's third argument: `protocol`, the id its requests
+carry and its response echoes, and `maxResponseBytes`, the largest response it
+accepts; the host's own command contract names both. Derive `context` and the
 allowed integration ID from trusted command composition before calling the
 fragment. Keep connection status/connect/reconnect/disconnect operations intact.
-Read the public Vibe64 `application-google-ads.md` command contract when targeting
-that editor. Other frameworks implement its JSON/Env and operation contract with
-their native libraries; they do not execute this JavaScript fragment.
+Other frameworks implement its JSON/Env and operation contract with their native
+libraries; they do not execute this JavaScript fragment.
 
 The Search recipe supports only non-political manual-CPC campaigns with one ad
 group, phrase keywords and a website conversion goal. Account creation, PMax,
@@ -66,9 +68,15 @@ persistent OAuth grants. Reviews include live account values and the saved plan.
 Creation is paused and atomic; launch rechecks the live review. Do not replay a
 write after an uncertain response. Disconnecting does not pause campaigns.
 
+Each collaborator the composition receives (the `createGoogleAdsSearchService()`
+service) is a required parameter typed in a JSDoc `@param` and called directly,
+without a `typeof` probe, a "requires x" guard or a no-op default. A server
+feature that uses it follows
+[typed features](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/agent-docs/site/guide/framework/typed-features.md).
+
 ## Example files
 
-`example/ads-setup.js` maps the optional editor command to the shared service. It
+`example/ads-setup.js` maps a host's optional setup command to the shared service. It
 contains no HTTP endpoint, credential resolution or trusted-identity inference.
 
 ## Variation points
@@ -90,3 +98,6 @@ approval and conversion/billing readiness require operator verification.
 Do not put secrets in JSON, stdout or chat. Do not execute conversion snippets in
 the editor, confuse OAuth consent with advertiser approval, or claim live account
 acceptance from fixture tests. Keep larger campaign types outside this recipe.
+
+Do not probe a collaborator, default one to `null`, `{}` or a no-op, fill a slot
+with a setter after construction, or keep a module-level registry.

package/patterns/google-ads-search/example/ads-setup.js

@@ -1,7 +1,15 @@
-// Compose the service in the application's existing authenticated command owner.
-// No stdin value establishes the trusted application/administrator identity.
-export async function dispatchAdsSetup(request, service) {
-  if (request?.protocol !== "vibe64.integration-setup.command.v1" || typeof request.requestId !== "string" ||
+/**
+ * Runs one advertising setup request against the Google Ads Search service. Compose
+ * the service in the application's existing authenticated command owner: no request
+ * value establishes the trusted application or administrator identity.
+ * @param {{ protocol: string, requestId: string, operation: string, ads: Record<string, any> }} request The parsed setup command.
+ * @param {import("@jskit-ai/connectors-catalog/server/types").GoogleAdsSearchService} service
+ * @param {object} host The command host's request protocol.
+ * @param {string} host.protocol The protocol id that requests carry and the response echoes.
+ * @param {number} host.maxResponseBytes The largest response the host accepts.
+ */
+export async function dispatchAdsSetup(request, service, { protocol, maxResponseBytes }) {
+  if (request?.protocol !== protocol || typeof request.requestId !== "string" ||
       !/^[A-Za-z0-9_-]{1,200}$/.test(request.requestId) || !request.ads || Array.isArray(request.ads) || typeof request.ads !== "object") {
     throw new Error("Invalid advertising setup request.");
   }
@@ -20,6 +28,6 @@ export async function dispatchAdsSetup(request, service) {
     default: throw new Error("Unsupported advertising setup operation.");
   }
   const response = { protocol: request.protocol, requestId: request.requestId, status: "ads", operation: request.operation, data };
-  if (Buffer.byteLength(JSON.stringify(response)) > 32768) throw new Error("Advertising result exceeds the editor's display limit. Inspect Google Ads before repeating any write.");
+  if (Buffer.byteLength(JSON.stringify(response)) > maxResponseBytes) throw new Error("Advertising result exceeds the host's response limit. Inspect Google Ads before repeating any write.");
   return response;
 }

package/patterns/oauth-connection/PATTERN.md

@@ -69,7 +69,7 @@ const protection = createCredentialProtection({
 const connections = createConnectionService({
   configuration, providers,
   store: createFileConnectionStore({ directory: process.env.CONNECTOR_STATE_DIRECTORY, protection }),
-  resolveReference: createEnvironmentReferenceResolver(), authorize: applicationConnectionPolicy
+  resolveReference: createEnvironmentReferenceResolver(process.env), authorize: applicationConnectionPolicy
 });
 ```