genesis-stack 1.1.0 → 1.1.2

package/README.md

@@ -48,3 +48,18 @@ New curated technologies should normally contribute a piece to this catalog.
 Do not add technology-specific knowledge or dependencies to
 `genesis-compiler`, and do not create one catalog package per framework unless
 the single-catalog model becomes genuinely unworkable.
+
+## Resource-estimate proposals
+
+JSKIT proposes Vibe64's optional `Resource estimates` section for its concrete
+`app` output and Workspace setup. The startup, running and preparation values
+are initial planning estimates, not measured minima, reservations or memory
+limits. Vibe64 owns the grammar and a host owns admission, learned consumption
+and owner settings; Genesis only materializes and transports the exact text.
+
+Node and Vue contribute adoption guidance without competing section proposals.
+Their estimates must not be added to JSKIT's for the same process tree. A
+project's complete reviewed section wins; a catalog upgrade never rewrites it.
+Projects with different output ids or commands must review the proposal during
+preparation. A project can omit estimates and use its host's generic starting
+policy. Neither the catalog nor the project stores host observations or limits.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genesis-stack",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "The optional curated technology Stack catalog for Genesis projects.",
   "type": "module",
   "repository": {

package/stacks/pieces/cpp.md

@@ -24,6 +24,21 @@ C and C++ translation-unit, header, callable, ownership, build, and test convent
   build systems, libraries, engines, or layouts unless a concrete failure
   requires one exact investigation.
 
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing C/C++ executable or server and selected JSON/configuration and HTTP/TLS libraries. Make request bounds, cancellation and buffer lifetime explicit; preserve raw webhook bytes and application transaction boundaries.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Adoption
 
 - Identify the actual build system and presets, compiler and language level,

package/stacks/pieces/csharp.md

@@ -12,6 +12,23 @@ C# namespace, public type, dependency, lifecycle, and test conventions.
 
 - `csharp`
 
+## Guidance
+
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing .NET command/server and JSON/configuration facilities with the selected HttpClient/provider SDK. Preserve authorization, cancellation tokens, disposal, raw webhook bytes and application transaction boundaries.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Deslop
 
 - Preserve established namespaces, public contracts, dependency injection,

package/stacks/pieces/go.md

@@ -12,6 +12,23 @@ Go package, exported callable, interface, concurrency, resource, and test conven
 
 - `go`
 
+## Guidance
+
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing Go command/server, encoding/json and environment configuration with its HTTP client or provider SDK. Propagate context cancellation and timeouts, retain raw webhook bytes and use the existing database transaction owner.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Deslop
 
 - Preserve package ownership, exported APIs, context propagation, error

package/stacks/pieces/java.md

@@ -12,6 +12,23 @@ Java package, public type, dependency, lifecycle, and test conventions.
 
 - `java`
 
+## Guidance
+
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing Java command/server and selected JSON/configuration facilities with native JVM HTTP/provider libraries. Preserve framework authorization, resource closure, raw webhook bytes and application transaction boundaries.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Deslop
 
 - Preserve established packages, public interfaces, dependency injection,

package/stacks/pieces/jskit-mysql.md

@@ -64,6 +64,12 @@ JSKIT MySQL runtime, live-schema CRUD generation, and persistence conventions.
   setup and Deployment contracts when database preparation is part of those
   operations; do not copy a command that the application does not provide.
 
+- Apply the inherited JSKIT integration guidance to `integrations.json`.
+  Keep connection/payment records in the app's selected database through its
+  existing migration and transaction owner. Test scoped uniqueness, duplicate
+  webhooks and concurrent credit debits on this driver before claiming database
+  correctness; provider calls and app authorization remain outside the database.
+
 ## Deslop
 
 - Use the installed JSKIT database runtime and generated resource/repository

package/stacks/pieces/jskit-postgresql.md

@@ -61,6 +61,12 @@ JSKIT PostgreSQL runtime, live-schema CRUD generation, and persistence conventio
   setup and Deployment contracts when database preparation is part of those
   operations; do not copy a command that the application does not provide.
 
+- Apply the inherited JSKIT integration guidance to `integrations.json`.
+  Keep connection/payment records in the app's selected database through its
+  existing migration and transaction owner. Test scoped uniqueness, duplicate
+  webhooks and concurrent credit debits on this driver before claiming database
+  correctness; provider calls and app authorization remain outside the database.
+
 ## Deslop
 
 - Use the installed JSKIT database runtime and generated resource/repository

package/stacks/pieces/jskit.md

@@ -45,6 +45,31 @@ https://mobily-enterprises.github.io/jskit-ai/
   user-command failures through JSKIT's shared non-layout-shifting action
   feedback/snackbar path.
 
+- When application integrations are requested or `integrations.json` exists,
+  treat that file as the application-owned configuration used by both editor
+  forms and CLI work. Inspect the selected provider's installed package README
+  and setup instructions before changing its registration, scopes or callbacks.
+  For catalogue providers, start with `@jskit-ai/connectors-catalog/README.md`
+  and its `docs/<provider-id>.md`; separately packaged providers own their docs.
+  Do not configure every provider merely because the catalogue is installed.
+- Read credentials through the declared Env references on the server. Keep
+  registrations, callbacks, connection persistence and refresh/revocation with
+  the application. Use its durable identity rather than deriving identity from
+  a deployment URL. Shared administrator connections and each app user's
+  connections require distinct authorization and storage scopes.
+- For Stripe/Paddle subscription features, read the installed
+  `@jskit-ai/payments-core/docs/standalone.md` and `docs/contract.md` before
+  composing its ordinary libraries, package migrations and authenticated app
+  routes. `extensions.payments` in the same configuration declares plans and
+  environment bindings; an editor is not needed to author it. Missing package
+  availability or provider credentials must be stated, not silently invented.
+- If the project uses an editor integration-setup command, implement the exact
+  supplied static operation contract through the app's existing command entry
+  point. Keep local administrator authority separate from customer web routes;
+  input fields never grant administrator access. Verify the requested provider
+  outcomes and denied access with controlled fixtures. Genesis transports
+  guidance and opaque declarations; it does not execute integrations or payments.
+
 ## Adoption
 
 - Read the authoritative existing-application migration guide at
@@ -69,6 +94,14 @@ https://mobily-enterprises.github.io/jskit-ai/
   locators, and retired tool manifests as migration evidence only. Translate
   live facts into current source/Stack and report remaining port work; do not
   add compatibility readers or claim adoption performed the port.
+- Review the Vibe64-owned Resource estimates proposal against the application's
+  actual Outputs target ids and Workspace setup. Its initial Node development
+  estimates are planning hints, not measured requirements, hard memory limits,
+  or a promise of available capacity. Keep startup/build and ready runtime
+  separate, and give an isolated test target its own estimates. Do not add a
+  shared database's full footprint to every application target. Hosts own
+  measured history, admission and limits outside project source; they do not
+  rewrite this section as they learn. Preserve an existing project section.
 
 ## Workspace setup
 
@@ -105,6 +138,20 @@ https://mobily-enterprises.github.io/jskit-ai/
 - URL path: `/`
 - Ready when: `GET` `/api/health` returns `200`
 
+## Resource estimates
+
+### Output `app`
+
+- Startup typical MiB: `1024`
+- Startup high MiB: `1536`
+- Running typical MiB: `768`
+- Running high MiB: `1536`
+
+### Workspace setup
+
+- Typical MiB: `1024`
+- High MiB: `1536`
+
 ## Deployment
 
 - Runtimes: `nodejs`

package/stacks/pieces/kotlin.md

@@ -12,6 +12,23 @@ Kotlin package, public callable, coroutine, nullability, build, and test convent
 
 - `kotlin`
 
+## Guidance
+
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing Kotlin command/server and target-compatible serialization/configuration facilities with native HTTP/provider libraries. Keep coroutine cancellation and resource ownership explicit; preserve raw webhook bytes and app transaction boundaries.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Deslop
 
 - Preserve package visibility, nullability, coroutine ownership, public types,

package/stacks/pieces/laravel-mysql.md

@@ -56,6 +56,12 @@ Laravel MySQL connection, migration, Eloquent, and database environment conventi
 - Keep the project Resource contract aligned with `config/database.php` if the
   application deliberately changes Laravel's conventional environment names.
 
+- Apply the inherited Laravel integration guidance to `integrations.json`.
+  Keep connection/payment records in the app's selected database through its
+  existing migration and transaction owner. Test scoped uniqueness, duplicate
+  webhooks and concurrent credit debits on this driver before claiming database
+  correctness; provider calls and app authorization remain outside the database.
+
 ## Adoption
 
 - Confirm the selected connection, URL alternative, individual `DB_*` names,

package/stacks/pieces/laravel-postgresql.md

@@ -56,6 +56,12 @@ Laravel PostgreSQL connection, migration, Eloquent, and database environment con
 - Keep the project Resource contract aligned with `config/database.php` if the
   application deliberately changes Laravel's conventional environment names.
 
+- Apply the inherited Laravel integration guidance to `integrations.json`.
+  Keep connection/payment records in the app's selected database through its
+  existing migration and transaction owner. Test scoped uniqueness, duplicate
+  webhooks and concurrent credit debits on this driver before claiming database
+  correctness; provider calls and app authorization remain outside the database.
+
 ## Adoption
 
 - Confirm the selected connection, URL alternative, individual `DB_*` names,

package/stacks/pieces/laravel.md

@@ -21,6 +21,32 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
 - Use Laravel's built-in `/up` health route unless the application deliberately
   changes it and updates its project Outputs contract.
 
+- When application integrations are requested or `integrations.json` exists,
+  read the application-owned file and the selected provider's supplied static
+  schema, credential instructions, callback requirements and operation contract.
+  Reuse those declarations rather than translating them into a second settings
+  authority. Request missing contract material; do not guess fields or install
+  JavaScript packages to interpret it. Configure only requested providers.
+- Read Env-backed credentials through Laravel's configuration facilities and
+  keep actual values outside source and browser responses. Implement provider
+  calls, OAuth callbacks, persisted connections, token refresh and revocation
+  using native PHP libraries and application services. Shared administrator
+  accounts and app-user accounts need separate policies and storage scopes.
+- For Stripe/Paddle payments, `extensions.payments` supplies the portable plan
+  and environment declaration. Follow the supplied payment semantics and
+  operation examples with native SDKs, migrations, transactions, signed raw-body
+  webhook verification and idempotent reconciliation. The application owns
+  billable subjects, entitlements, credits and provider mappings; neither
+  Genesis nor the editor is a payment runtime. Static guidance does not prove
+  a working payment implementation.
+- Implement any requested integration-setup command as an app-owned Artisan
+  command matching its supplied JSON input/output contract. A local administrator
+  command and customer HTTP routes have different authority: use policies for
+  the selected subject, derive customer actors from authenticated sessions and
+  never accept an administrator flag from JSON. Keep commands usable from an
+  ordinary CLI outside the editor. Verify with native tests and controlled
+  provider fixtures; no Node or JSKIT runtime is required for integrations.
+
 ## Adoption
 
 - Inspect `composer.lock`, `composer.json`, `artisan`, `bootstrap/app.php`,

package/stacks/pieces/mysql.md

@@ -8,6 +8,21 @@ MySQL persistence and migration conventions.
 
 - Nothing.
 
+## Guidance
+
+- For application integrations and payments, `integrations.json` remains the
+  configuration authority; mysql stores app-owned connections, provider mappings,
+  event receipts, subscriptions and credit records only when the app needs them.
+  Keep provider secrets under the application's secret-storage policy.
+- Scope records and uniqueness constraints by application, merchant/environment
+  and billable subject. Use the existing migration ledger and explicit database
+  transactions for event deduplication, credit grants/debits and reconciliation.
+  Prove atomicity and concurrent access with this database before claiming it;
+  a SQLite fixture does not establish mysql locking behavior.
+- Provider calls, signature verification and authorization belong to the app's
+  runtime. Database configuration alone does not implement a provider, and the
+  editor does not acquire ownership of application billing records.
+
 ## Adoption
 
 - Identify the application's accepted connection alternatives, client/driver,

package/stacks/pieces/nodejs.md

@@ -12,6 +12,23 @@ Node.js package, command, module, dependency, and test conventions.
 
 - `javascript`
 
+## Guidance
+
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing Node module/command entry point, JSON parsing and server environment resolver with the selected HTTP client or provider SDK. Preserve promise cancellation and raw webhook bytes; use the application’s existing database transactions.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Adoption
 
 - Identify the package manager from the lockfile and preserve the existing
@@ -22,6 +39,17 @@ Node.js package, command, module, dependency, and test conventions.
   `npm test`, or `npm start` exists merely because a current foundation uses it.
 - Identify every long-running process, its workdir, host/port handling,
   readiness signal, and shutdown ownership before declaring Outputs.
+- For Vibe64's optional Resource estimates, distinguish dependency preparation,
+  startup/build, and the ready runtime of each real declared output. For an
+  unmeasured Node web development target, initial planning candidates are
+  startup 1024 MiB typical / 1536 MiB high and running 768 MiB typical / 1536 MiB
+  high; preparation can initially use 1024 MiB typical / 1536 MiB high. These
+  are not benchmarks, guaranteed minima, or hard limits, and are not defaults
+  for every small Node command. Prefer the selected framework's concrete
+  proposal or measured application evidence, preserving an existing project
+  declaration. Never infer a command or add Node's estimate to a framework
+  estimate for the same process tree. Host measurements and owner limits stay
+  in runtime-local state, not in this source contract.
 
 ## Deslop
 

package/stacks/pieces/php.md

@@ -12,6 +12,23 @@ PHP package, namespace, callable, dependency, and test conventions.
 
 - `php`
 
+## Guidance
+
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing PHP entry point, JSON decoding and server configuration with native Composer HTTP/provider packages. In a framework, use its configuration and authorization facilities; preserve raw webhook bytes and its database transaction owner.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Deslop
 
 - Preserve established namespaces, package boundaries, public interfaces,

package/stacks/pieces/postgresql.md

@@ -8,6 +8,21 @@ PostgreSQL persistence and migration conventions.
 
 - Nothing.
 
+## Guidance
+
+- For application integrations and payments, `integrations.json` remains the
+  configuration authority; postgresql stores app-owned connections, provider mappings,
+  event receipts, subscriptions and credit records only when the app needs them.
+  Keep provider secrets under the application's secret-storage policy.
+- Scope records and uniqueness constraints by application, merchant/environment
+  and billable subject. Use the existing migration ledger and explicit database
+  transactions for event deduplication, credit grants/debits and reconciliation.
+  Prove atomicity and concurrent access with this database before claiming it;
+  a SQLite fixture does not establish postgresql locking behavior.
+- Provider calls, signature verification and authorization belong to the app's
+  runtime. Database configuration alone does not implement a provider, and the
+  editor does not acquire ownership of application billing records.
+
 ## Adoption
 
 - Identify the application's accepted connection alternatives, client/driver,

package/stacks/pieces/python.md

@@ -12,6 +12,23 @@ Python package, module, callable, dependency, and test conventions.
 
 - `python`
 
+## Guidance
+
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing Python package/CLI, JSON parsing and environment configuration with native HTTP/provider libraries. Preserve the project’s synchronous or asynchronous lifecycle, request timeouts, raw webhook bytes and database transaction owner.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Deslop
 
 - Preserve established package boundaries, public imports, typing style,

package/stacks/pieces/ruby.md

@@ -12,6 +12,23 @@ Ruby module, class, callable, dependency, lifecycle, and test conventions.
 
 - `ruby`
 
+## Guidance
+
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing Ruby command/service, JSON parsing and environment configuration with native Bundler HTTP/provider libraries. Preserve framework request authorization, raw webhook bytes and its transaction/job lifecycle.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Deslop
 
 - Preserve established modules, public entry points, dependency boundaries,

package/stacks/pieces/rust.md

@@ -12,6 +12,23 @@ Rust module, public item, ownership, error, async, Cargo, and test conventions.
 
 - `rust`
 
+## Guidance
+
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing Rust command/server and selected JSON/configuration crates with native HTTP/provider libraries. Preserve error handling, ownership and async cancellation; retain raw webhook bytes and application transaction boundaries.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Deslop
 
 - Preserve module visibility, ownership and borrowing, error types, feature

package/stacks/pieces/shell.md

@@ -12,6 +12,23 @@ Shell script function, process, environment, portability, and test conventions.
 
 - `shell`
 
+## Guidance
+
+- For requested application integrations, read `integrations.json` and the
+  supplied static provider schema, credential/callback instructions and operation
+  contract. Configure only selected providers. Keep this file authoritative and
+  credentials behind Env references; request missing contract material instead
+  of guessing fields. Provider registrations, connections and billing state
+  belong to the application, not Genesis or its editor.
+- Use the existing shell command with a real JSON parser and the application’s native integration command or supported provider CLI. Preserve quoting, exit status and bounded execution; never eval configuration or parse JSON with text substitution. Delegate OAuth/webhook servers and transactional billing to the application runtime rather than inventing them in shell.
+- Keep local administrator commands separate from authenticated app-user
+  routes and scope access to the app, environment and billable user/workspace.
+  Distributed clients must not embed shared secret credentials: use an app-owned
+  backend or a provider-supported public-client flow. For payments, consume the
+  supplied `extensions.payments` semantics and verify signatures, deduplication,
+  entitlement transitions and transactional credits using controlled fixtures.
+  Native implementation remains required; guidance is not a working connector.
+
 ## Deslop
 
 - Preserve the script's supported shell, command-line contract, environment

package/stacks/pieces/vue.md

@@ -19,6 +19,17 @@ conventions. Authoritative framework documentation: https://vuejs.org/
   project's established Options API or Composition API style and do not turn a
   focused change into a framework migration or broad ecosystem survey.
 
+- For application integrations, render the selected configuration and safe
+  status supplied by the app backend; `integrations.json` is not a browser secret
+  store. Never bundle provider API keys, client secrets or refresh tokens in
+  Vue or public build-time environment values. Provider-designated public tokens
+  may be exposed only for their documented purpose.
+- Keep administrator setup and per-user connection flows distinct. Use native
+  app routes for consent, checkout and customer portals; the backend authorizes
+  the subject and verifies webhooks. A successful browser redirect is not proof
+  of payment. Preserve drafts, focus, pending/error states and selected accounts
+  across responsive changes; use the project's established resource composables.
+
 ### Reactive state hydration
 
 - Cached query/resource data and route state may already exist when a component is created. Never rely on a default lazy `watch()` to initialize writable UI state.
@@ -35,3 +46,7 @@ conventions. Authoritative framework documentation: https://vuejs.org/
 - Record existing unit and browser-test commands plus their base-URL, storage
   state, and managed-browser assumptions. Do not install a browser or replace a
   working host-managed browser contract during adoption.
+- Attribute a Vue build/dev server's memory to its actual Node output target.
+  Vue selection does not create a second service or another memory charge.
+  Review any Vibe64 Resource estimates in the project's existing complete
+  section; this piece does not propose a competing section alongside a framework.