@jskit-ai/agent-docs 0.1.125 → 0.1.127

package/guide/agent/app-setup/a-more-interesting-shell.md

@@ -577,6 +577,8 @@ Request connectivity failures use a separate shell recovery path. Generated apps
 
 That recovery path is intentionally a safe `GET`/`HEAD` read refetch system, not a general HTTP replay system. User-visible reads should go through Query-backed JSKIT primitives such as `useEndpointResource()`, `useList()`, `useView()`, `useAddEdit()`, or generated CRUD screen composables. Those primitives mark Query entries with `jskit.requestRecoveryMethod`, so the shell only offers Retry for safe reads. Do not catch raw `fetch(...)` failures in each panel just to call the shell recovery runtime manually.
 
+These neutral request and CRUD client APIs are exported by `@jskit-ai/http-web`. They do not require the users, authentication, uploads, storage, or database products.
+
 For a custom endpoint read, attach the recovery label to the Query-backed resource:
 
 ```js
@@ -611,9 +613,9 @@ Writes are different. JSKIT does not automatically replay `POST`, `PATCH`, `PUT`
 Some apps need API URLs to be scoped by the active route before the browser request is sent. Configure that once at app startup instead of replacing `fetchImpl` in a local transport wrapper:
 
 ```js
-import { configureUsersWebHttpClient } from "@jskit-ai/users-web/client/lib/httpClient";
+import { configureHttpWebClient } from "@jskit-ai/http-web/client/lib/httpClient";
 
-configureUsersWebHttpClient({
+configureHttpWebClient({
   csrf: {
     enabled: false
   },
@@ -628,7 +630,7 @@ configureUsersWebHttpClient({
 });
 ```
 
-Call `configureUsersWebHttpClient()` before Vue mounts or before JSKIT composables are created. The resolver can close over the app router/store when it needs route data, and the `context` argument carries request details such as `originalUrl`, `method`, `requestOptions`, and whether the request is a stream. After configuration, normal `useEndpointResource()`, `useList()`, `useView()`, `useAddEdit()`, and `useCommand()` calls use the configured client. `resolveRequestUrl` runs after JSKIT adds query strings and before the underlying browser `fetch`, so request recovery metadata, JSON:API transport, credentials, CSRF, and command feedback stay on the standard path.
+Call `configureHttpWebClient()` before Vue mounts or before JSKIT composables are created. The resolver can close over the app router/store when it needs route data, and the `context` argument carries request details such as `originalUrl`, `method`, `requestOptions`, and whether the request is a stream. After configuration, normal `useEndpointResource()`, `useList()`, `useView()`, `useAddEdit()`, and `useCommand()` calls use the configured client. `resolveRequestUrl` runs after JSKIT adds query strings and before the underlying browser `fetch`, so request recovery metadata, JSON:API transport, credentials, CSRF, and command feedback stay on the standard path.
 
 For packages that create their own client, use the same lower-level hook directly:
 

package/guide/agent/app-setup/upgrade-beta-1-to-final.md

@@ -95,7 +95,99 @@ npm ls
 
 Resolve npm peer or capability errors as package-graph errors. Do not add overrides that mix Beta 1 and Final Release packages.
 
-## 7. Generate deterministic projections
+## 7. Move neutral web operations out of users-web
+
+Final Release owns browser request, command, list, view, add/edit, permission,
+paging, and generated CRUD UI APIs in `@jskit-ai/http-web`. There are no
+`users-web` compatibility exports.
+
+Add the coordinated `@jskit-ai/http-web` version to every application or
+workspace that uses these APIs. Keep `@jskit-ai/users-web` only where the code
+actually uses account, profile, or user-specific shell UI.
+
+Update imports as follows:
+
+| Beta 1 import or API | Final Release import or API |
+| --- | --- |
+| `@jskit-ai/users-web/client/composables/useCommand` | `@jskit-ai/http-web/client/composables/useCommand` |
+| `@jskit-ai/users-web/client/composables/useEndpointResource` | `@jskit-ai/http-web/client/composables/useEndpointResource` |
+| `@jskit-ai/users-web/client/composables/useList` | `@jskit-ai/http-web/client/composables/useList` |
+| `@jskit-ai/users-web/client/composables/useView` | `@jskit-ai/http-web/client/composables/useView` |
+| `@jskit-ai/users-web/client/composables/useAddEdit` | `@jskit-ai/http-web/client/composables/useAddEdit` |
+| `@jskit-ai/users-web/client/composables/useAccess` | `@jskit-ai/http-web/client/composables/useAccess` |
+| `@jskit-ai/users-web/client/composables/usePagedCollection` | `@jskit-ai/http-web/client/composables/usePagedCollection` |
+| `@jskit-ai/users-web/client/composables/useRealtimeQueryInvalidation` | `@jskit-ai/http-web/client/composables/useRealtimeQueryInvalidation` |
+| `@jskit-ai/users-web/client/composables/runtime/useUiFeedback` | `@jskit-ai/http-web/client/composables/useUiFeedback` |
+| `@jskit-ai/users-web/client/composables/useCrud*` | `@jskit-ai/http-web/client/composables/useCrud*` |
+| `@jskit-ai/users-web/client/components/Crud*` | `@jskit-ai/http-web/client/components/Crud*` |
+| `@jskit-ai/users-web/client/filters` | `@jskit-ai/http-web/client/filters` |
+| `@jskit-ai/users-web/client/bulkActions` | `@jskit-ai/http-web/client/bulkActions` |
+| `@jskit-ai/users-web/client/rowActions` | `@jskit-ai/http-web/client/rowActions` |
+| `@jskit-ai/users-web/client/lib/permissions` | `@jskit-ai/http-web/client/lib/permissions` |
+| `@jskit-ai/users-web/client/support/contractGuards` | `@jskit-ai/http-web/client/support/contractGuards` |
+| `configureUsersWebHttpClient(...)` | `configureHttpWebClient(...)` from `@jskit-ai/http-web/client/lib/httpClient` |
+| `usersWebHttpClient` | `httpWebClient` from `@jskit-ai/http-web/client/lib/httpClient` |
+
+Search every application workspace, generated route tree, test fixture, and
+app bootstrap. An application that leaves even one removed import will fail at
+module resolution; this is intentional because Final Release contains no
+forwarding bridge.
+
+`crud-ui-generator` now installs `@jskit-ai/http-web`. `ui-generator` installs
+no users product. Existing generated files are application-owned, so update
+their imports directly or deliberately regenerate them and review the diff.
+
+After all imports are updated, remove `@jskit-ai/users-web` from any workspace
+that used it only for neutral client APIs. This prevents those applications
+from activating users, authentication, uploads, storage, or database
+capabilities accidentally.
+
+## 8. Use the separated CRUD package boundaries
+
+Final Release separates shared resource contracts, browser CRUD, and
+database-backed CRUD:
+
+- `@jskit-ai/resource-crud-core` owns environment-neutral CRUD resource,
+  field, lookup, namespace, and list-filter contracts;
+- `@jskit-ai/http-web` owns browser request runtimes and generated CRUD UI;
+- `@jskit-ai/crud-core` owns database-backed server CRUD services and
+  repositories.
+
+Update shared-contract imports as follows:
+
+| Beta 1 import | Final Release import |
+| --- | --- |
+| `@jskit-ai/kernel/shared/support/crudFieldContract` | `@jskit-ai/resource-crud-core/shared/crudFieldContract` |
+| `@jskit-ai/kernel/shared/support/crudLookup` | `@jskit-ai/resource-crud-core/shared/crudLookup` |
+| `@jskit-ai/kernel/shared/support/crudListFilters` | `@jskit-ai/resource-crud-core/shared/crudListFilters` |
+| `@jskit-ai/crud-core/shared/crudResource` | `@jskit-ai/resource-crud-core/shared/crudResource` |
+| `@jskit-ai/crud-core/shared/crudNamespaceSupport` | `@jskit-ai/resource-crud-core/shared/crudNamespaceSupport` |
+| `checkCrudLookupFormControl` from `@jskit-ai/crud-core/shared/crudFieldSupport` | `checkCrudLookupFormControl` from `@jskit-ai/resource-crud-core/shared/crudFieldContract` |
+| `isCrudRuntimeOutputOnlyFieldKey` from `@jskit-ai/crud-core/shared/crudFieldSupport` | `isCrudRuntimeOutputOnlyFieldKey` from `@jskit-ai/resource-crud-core/shared/crudLookup` |
+
+There is no `@jskit-ai/crud-core/client` surface. Replace browser imports from
+that surface with the corresponding `@jskit-ai/http-web` API. Add
+`@jskit-ai/resource-crud-core` directly wherever application code imports its
+contracts. Remove `@jskit-ai/crud-core` from client-only and generator-only
+workspaces; retain it only where database-backed server CRUD is used.
+
+The current CRUD UI templates import `@jskit-ai/http-web`, and the CRUD UI
+generator no longer installs the server CRUD runtime. Existing generated files
+are application-owned, so update their imports directly or deliberately
+regenerate them and review the diff.
+
+If application tests or package tooling refer to workspaces-web mutation IDs,
+rename the `users-web-*` prefix on workspaces-web-owned mutations to
+`workspaces-web-*`. Package-internal `UsersWorkspace*` component paths are not
+public APIs; remove any direct imports and use the exported workspaces-web
+provider surface.
+
+If application code imported repository persistence helpers from
+`@jskit-ai/assistant-core/server`, keep those helpers with the repository that
+uses them or use the matching database-runtime primitive. Assistant core no
+longer owns database persistence utilities.
+
+## 9. Generate deterministic projections
 
 Synchronize package migration files without applying them:
 
@@ -118,7 +210,7 @@ npx jskit ci generate
 
 Move application-specific CI into separate workflow files. The generated JSKIT workflow is replaced in full whenever this command runs.
 
-## 8. Verify the application
+## 10. Verify the application
 
 ```bash
 npx jskit lint-packages
@@ -138,7 +230,7 @@ npm run db:migrate
 
 Commit package manifests, `package-lock.json`, synchronized migrations, generated CI, and required application changes together.
 
-## 9. Update strict resource boundaries
+## 11. Update strict resource boundaries
 
 Applications that pass JavaScript `Date` objects into resource validation must convert them to strings. `date` uses `YYYY-MM-DD`; `time` uses offset-free `HH:MM[:SS[.fraction]]`; and `dateTime` uses RFC 3339 with seconds and a `Z` or numeric offset. Select `epochMilliseconds` or `epochSeconds` explicitly for numeric epochs and preserve `temporalPrecision`.
 

package/guide/agent/app-setup/users.md

@@ -25,7 +25,7 @@ npm run db:migrate
 
 The first command adds `users-web`, but the important part is what arrives with it through its dependency chain.
 
-- `users-web` adds the account-facing UI and client runtime pieces
+- `users-web` adds account, profile, and user-specific shell UI
 - `users-core` arrives as a dependency and adds the persistent users/account server layer and schema migrations
 
 `jskit add` installs those runtime packages and their dependencies. `npm run db:migrate` is the separate step that makes the new tables real in MySQL.

package/guide/agent/generators/advanced-cruds.md

@@ -49,7 +49,9 @@ After those two commands, the important thing to understand is ownership:
 
 - `crud-server-generator` creates a runtime package that your app owns locally
 - `crud-ui-generator` creates route files that your app owns locally
-- `crud-core`, `users-web`, and the other runtime packages provide the machinery underneath those files
+- `crud-core` provides the server CRUD runtime, `resource-crud-core` owns shared
+  CRUD contracts, and `http-web` provides browser operations and generated
+  screen components
 
 The generated pages are intentionally thin. Most of the heavy lifting lives uphill in shared runtime composables, action execution, validation, lookup hydration, and repository helpers.
 
@@ -480,7 +482,8 @@ Its job is usually to:
 - resolve list/view/edit/new URLs
 - pass route query state through when navigating deeper
 
-The actual list machinery lives in `users-web` shared screen composables and the shared resource contract.
+The actual list machinery lives in `http-web` screen composables and the shared
+resource contract lives in `resource-crud-core`.
 
 ### `[contactId]/index.vue`
 
@@ -703,17 +706,19 @@ Why this is the standard JSKIT shape:
 
 - `useCommand()` resolves the correct scoped API path for the current route and surface.
 - The higher-level list, view, add/edit, and command runtimes send requests through the standard HTTP runtime instead of ad hoc request code.
-- The default client runtime uses `usersWebHttpClient`, which already handles credentials and CSRF token behavior.
+- The default client runtime uses `httpWebClient`, which already handles credentials and CSRF token behavior.
 - `useEndpointResource()` gives the shared endpoint primitive for loading, saving, and standard load/save error handling. Higher-level runtimes like `useCommand()` and `useAddEdit()` layer UI feedback and field-error behavior on top of that primitive.
 - `shell-web` observes the shared TanStack Query client for recoverable transport failures. Generated CRUD reads and custom reads built with `useEndpointResource()`, `useList()`, `useView()`, or `useAddEdit()` get the shell recovery banner with a Retry action that refetches the failed query.
 - Automatic shell request recovery is only for safe `GET`/`HEAD` read refetches. JSKIT read composables mark Query entries with `jskit.requestRecoveryMethod`, and the shell ignores unmarked or unsafe methods. Do not rely on it to replay `POST`, `PATCH`, `PUT`, or `DELETE`; mutation screens own save state, field errors, and user feedback.
 
-When an app needs all JSKIT reads and commands to rewrite API URLs before fetch, configure the users-web HTTP client once instead of passing custom paths or replacing `fetchImpl` in each local helper:
+The request composables and generated CRUD client surfaces above come from `@jskit-ai/http-web`. That package is neutral: installing it does not install users, authentication, uploads, storage, or a database.
+
+When an app needs all JSKIT reads and commands to rewrite API URLs before fetch, configure the http-web client once instead of passing custom paths or replacing `fetchImpl` in each local helper:
 
 ```js
-import { configureUsersWebHttpClient } from "@jskit-ai/users-web/client/lib/httpClient";
+import { configureHttpWebClient } from "@jskit-ai/http-web/client/lib/httpClient";
 
-configureUsersWebHttpClient({
+configureHttpWebClient({
   csrf: {
     enabled: false
   },
@@ -787,7 +792,7 @@ The safe mental model is:
 - do not raw `fetch(...)` for normal app work
 - do not invent ad hoc local AJAX helpers
 - use the operation/runtime composable that matches the UI interaction
-- drop to `usersWebHttpClient.request(...)` only for exceptional low-level cases
+- drop to `httpWebClient.request(...)` only for exceptional low-level cases
 - use `usePaths().api(...)` when you need a custom scoped API path and the higher-level runtime does not already resolve it for you
 - keep `apiUrlTemplate` path-only and put endpoint query strings in `requestQueryParams`
 
@@ -800,7 +805,7 @@ It owns:
 - which set of generated form fields is rendered in `new` vs `edit`
 - lookup field prop forwarding into those fields
 
-It does **not** own persistence logic or the shared screen chrome. `CrudAddEditScreen` from `users-web` owns the common title, load state, retry action, save/cancel action row, and form surface.
+It does **not** own persistence logic or the shared screen chrome. `CrudAddEditScreen` from `@jskit-ai/http-web` owns the common title, load state, retry action, save/cancel action row, and form surface.
 
 ### `src/components/.../CrudAddEditFormFields.js`
 
@@ -824,7 +829,7 @@ That is navigation wiring, not CRUD logic.
 A generated CRUD works because several layers cooperate:
 
 1. the route page calls `useCrudListScreen()`, `useCrudViewScreen()`, or `useCrudAddEditScreen()`
-2. those screen composables configure the lower-level list/view/add-edit runtimes from `users-web`
+2. those screen composables configure the lower-level list/view/add-edit runtimes from `@jskit-ai/http-web`
 3. the request hits the HTTP route from `registerRoutes.js`
 4. the route executes an action from `actions.js`
 5. the action delegates to the service in `service.js`
@@ -847,7 +852,7 @@ Use this rule of thumb when deciding where to edit:
 | Change SQL, joins, parent filters, or advanced search | `repository.js` | This is the data-access layer |
 | Add mandatory SQL visibility that must run before count and pagination | server policy module plus the provider's `createJsonRestResourceScopeOptions(..., { rowPolicy })` call | The internal JSON REST host applies the policy to every storage query for that resource |
 | Add cross-record or domain rules on save/delete | `service.js` | This is business logic |
-| Change shared CRUD screen chrome, load states, or retry behavior | `users-web` shared screen components | Generated pages consume the shared screen contract |
+| Change shared CRUD screen chrome, load states, or retry behavior | `http-web` shared screen components | Generated pages consume the shared screen contract |
 | Add per-row commands to a generated list page | page-local `listRowActions.js`, usually calling `useCommand()`-backed composables | The shared list screen renders action chrome; the page owns explicit mutation behavior |
 | Add non-CRUD display rows to a generated list page | route page `syntheticRows` input | Synthetic rows are presentation rows, not repository records |
 | Change page-specific display behavior | the route pages, generated slots, and app-owned composables | This is presentation |
@@ -869,7 +874,7 @@ That is the right direction of growth:
 - server customizations stay in the CRUD package
 - presentation and page-specific UI state stay in app-owned client files
 - shared structured list filters live best in a CRUD-package shared module that both server and client can import
-- shared generated screen chrome stays in `users-web`; adapted pages feed it definitions, slots, and explicit command handlers
+- shared generated screen chrome stays in `http-web`; adapted pages feed it definitions, slots, and explicit command handlers
 
 ### Shared screen read options and detail slots
 
@@ -1191,7 +1196,7 @@ Instead:
 For example, a generated page-local filter-definition module can look like this:
 
 ```js
-import { defineCrudListFilters } from "@jskit-ai/users-web/client/filters";
+import { defineCrudListFilters } from "@jskit-ai/http-web/client/filters";
 
 const listFilters = defineCrudListFilters({
   onlyStaff: {
@@ -1222,7 +1227,7 @@ Use this first when adding selected-record actions. JSKIT does not invent server
 For example:
 
 ```js
-import { defineCrudListBulkActions } from "@jskit-ai/users-web/client/bulkActions";
+import { defineCrudListBulkActions } from "@jskit-ai/http-web/client/bulkActions";
 
 const listBulkActions = defineCrudListBulkActions([
   {
@@ -1259,7 +1264,7 @@ Use row actions for explicit commands on one record. JSKIT renders the action me
 For example:
 
 ```js
-import { defineCrudListRowActions } from "@jskit-ai/users-web/client/rowActions";
+import { defineCrudListRowActions } from "@jskit-ai/http-web/client/rowActions";
 
 const listRowActions = defineCrudListRowActions([
   {

package/guide/agent/generators/crud-generators.md

@@ -510,7 +510,7 @@ route after success. It supports custom `--id-param` names.
 
 The generator rejects this option when list or view is omitted, or when the
 shared resource has no `DELETE` operation. Without the flag, no delete control
-is generated. Do not substitute raw `fetch()` or import private `users-web`
+is generated. Do not substitute raw `fetch()` or import private `http-web`
 modules.
 
 Generated list, view, and lookup reads use the resource contract as their

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/agent-docs",
-  "version": "0.1.125",
+  "version": "0.1.127",
   "description": "Distributed JSKIT agent references, prompts, guides, and generated reference maps.",
   "type": "module",
   "files": [

package/patterns/INDEX.md

@@ -26,7 +26,7 @@ How to use it:
   - `page-redirects.md`
 - live actions, checkbox, toggle, patch button, delete confirmation, destructive action, inline action, `useCommand()`, `useCrudDeleteAction()`
   - `live-actions.md`
-- ajax, fetch, API call, request, endpoint, HTTP client, `useCrudListScreen()`, `useCrudViewScreen()`, `useCrudAddEditScreen()`, `useList()`, `useView()`, `useAddEdit()`, `useEndpointResource()`, `usersWebHttpClient`
+- ajax, fetch, API call, request, endpoint, HTTP client, `useCrudListScreen()`, `useCrudViewScreen()`, `useCrudAddEditScreen()`, `useList()`, `useView()`, `useAddEdit()`, `useEndpointResource()`, `httpWebClient`
   - `client-requests.md`
 - playwright, browser test, e2e, ui verification, baseline test, authenticated ui test, test auth, dev login as, dev auth bypass
   - `ui-testing.md`

package/patterns/client-requests.md

@@ -14,7 +14,7 @@ Rules:
 - Do not hand-roll local AJAX helpers when an existing JSKIT runtime already fits.
 - Do not use raw `fetch(...)` for normal app work.
 - Use `usePaths().api(...)` from `@jskit-ai/shell-web/client/navigation/usePaths` for custom scoped API paths instead of concatenating route params into URLs by hand.
-- Drop to `usersWebHttpClient.request(...)` only for exceptional low-level cases.
+- Drop to `httpWebClient.request(...)` only for exceptional low-level cases.
 
 Choose the function like this:
 
@@ -64,13 +64,13 @@ Use the CRUD wrappers when they fit:
 CRUD hook transport defaults:
 
 - CRUD hooks derive the standard JSON:API transport from the shared CRUD `resource` automatically.
-- Do not pass `transport` to CRUD hooks. If you need a non-standard wire contract, drop to `useList()`, `useView()`, `useAddEdit()`, or `usersWebHttpClient.request(...)` instead of the CRUD wrappers.
+- Do not pass `transport` to CRUD hooks. If you need a non-standard wire contract, drop to `useList()`, `useView()`, `useAddEdit()`, or `httpWebClient.request(...)` instead of the CRUD wrappers.
 
 Why this is the standard JSKIT shape:
 
 - `useCommand()` resolves the scoped API path for the current route and surface.
 - The higher-level list, view, add/edit, and command runtimes send requests through the shared HTTP runtime.
-- `usersWebHttpClient` already handles credentials and CSRF behavior.
+- `httpWebClient` already handles credentials and CSRF behavior.
 - `useEndpointResource()` is the shared endpoint primitive for loading, saving, and standard load/save error handling. Higher-level runtimes add UI feedback and field-error handling on top.
 - Use `requestQueryParams` for endpoint query strings on list, view, and add/edit runtimes.
 - Generated CRUD and lookup reads use all resource-defined output fields by default. Hydrated relationships use the target resource's output contract. Generated pages and lookup controls do not repeat those definitions as request fieldsets.
@@ -79,7 +79,9 @@ Why this is the standard JSKIT shape:
 - Sparse fieldsets are a serialization boundary, not an authorization mechanism. Server resources reject unknown fields, never serialize hidden fields, and preserve the fields needed internally for relationship linkage.
 - Fields that must never be exposed do not belong in the resource output schema.
 - Keep `apiUrlTemplate` path-only. Do not put `?include=...` or other query strings in URL templates.
-- If an app needs route-aware API URL rewriting, configure the users-web client once with `configureUsersWebHttpClient({ resolveRequestUrl })` before mounting the app. Do not replace `fetchImpl` just to rewrite paths.
+- Import neutral request and CRUD client APIs from `@jskit-ai/http-web`. `users-web` owns only account, profile, and user-specific shell UI.
+- Keep shared CRUD resource, field, lookup, namespace, and filter contracts in `@jskit-ai/resource-crud-core`; keep database-backed CRUD services and repositories in `@jskit-ai/crud-core`.
+- If an app needs route-aware API URL rewriting, configure the http-web client once with `configureHttpWebClient({ resolveRequestUrl })` before mounting the app. Do not replace `fetchImpl` just to rewrite paths.
 - `resolveRequestUrl` belongs at the HTTP client boundary. It runs after JSKIT encodes query params and before browser `fetch`, so reads, commands, request recovery metadata, JSON:API transport, credentials, and CSRF behavior stay on the standard path.
 
 Error presentation rules:

package/patterns/generated-ui-contract-tracking.md

@@ -38,7 +38,7 @@ Generated JSKIT apps should feel like real adaptive apps by default, not framewo
 - [x] `npm test --workspace @jskit-ai/ui-generator`
 - [x] `npm test --workspace @jskit-ai/crud-ui-generator`
 - [x] `npm test --workspace @jskit-ai/shell-web`
-- [x] `npm test --workspace @jskit-ai/users-web`
+- [x] `npm test --workspace @jskit-ai/http-web`
 - [x] `npm test --workspace @jskit-ai/workspaces-web`
 - [x] `npm test --workspace @jskit-ai/jskit-cli`
 - [x] `npm test --workspace @jskit-ai/create-app`
@@ -59,7 +59,7 @@ Generated JSKIT apps should feel like real adaptive apps by default, not framewo
 - CRUD bulk actions are client-side by default: generated list pages create a page-local `listBulkActions.js` and pass it into `useCrudListScreen(...)`; the shared list screen wires `useCrudListBulkActions(...)` and keeps selection controls hidden until actions are declared.
 - CRUD row actions are client-side by default: generated list pages can create a page-local `listRowActions.js` with `defineCrudListRowActions(...)` and pass it into `useCrudListScreen(...)`; the shared list screen renders per-row actions in card and table layouts while action handlers stay explicit and page-owned.
 - CRUD synthetic rows are display-only: pass `syntheticRows` into `useCrudListScreen(...)` for owner/master rows that are not repository records. Synthetic rows render through the shared list screen, skip standard Open/Edit links, and are excluded from bulk selection unless explicitly marked selectable.
-- Generated CRUD page templates delegate their screen chrome to shared `users-web` screen components (`CrudListScreen`, `CrudViewScreen`, and `CrudAddEditScreen`) so list/view/form load states, retry actions, responsive shell layout, filters, bulk actions, row actions, and detail slots do not drift across generated pages.
+- Generated CRUD page templates delegate their screen chrome to shared `http-web` screen components (`CrudListScreen`, `CrudViewScreen`, and `CrudAddEditScreen`) so list/view/form load states, retry actions, responsive shell layout, filters, bulk actions, row actions, and detail slots do not drift across generated pages.
 - Generated CRUD list pages should use `useCrudListScreen({ requestQueryParams, readEnabled })` for list read pass-throughs instead of replacing the shared list chrome for includes or permission-gated reads.
 - Generated CRUD detail pages should use `useCrudViewScreen({ requestQueryParams, readEnabled, queryKeyFactory })` for read pass-throughs and `CrudViewScreen` slots (`before-fields`, `fields`, `after-fields`, `supporting-content`) for domain sections instead of replacing the shared detail chrome.
 - Routine resource-load errors stay local to the generated screen and retry affordance. Action feedback uses the shell error policy through `action-feedback`.

package/patterns/live-actions.md

@@ -50,6 +50,6 @@ Examples:
 Avoid:
 
 - manually hand-rolling fetch logic for a standard live action when `useCommand()` fits
-- inspecting private `users-web` internals or creating a page-local transport
+- inspecting private `http-web` internals or creating a page-local transport
   for generated record deletion
 - pushing derived write rules into the client just because the action is small

package/reference/autogen/KERNEL_MAP.md

@@ -25,99 +25,6 @@ For the full repo inventory, read `reference/autogen/README.md` and the package
 Exports
 - `isContainerToken(value)`
 
-### `support/crudFieldContract.js`
-Exports
-- `CRUD_FIELD_STORAGE_COLUMN`
-- `CRUD_FIELD_STORAGE_VIRTUAL`
-- `CRUD_FIELD_WRITE_SERIALIZER_DATETIME_UTC`
-- `CRUD_LOOKUP_FORM_CONTROL_AUTOCOMPLETE`
-- `CRUD_LOOKUP_FORM_CONTROL_SELECT`
-- `checkCrudLookupFormControl(value, { context = "crud field ui.formControl", defaultValue = CRUD_LOOKUP_FORM_CONTROL_AUTOCOMPLETE } = {})`
-- `resolveCrudFieldSchemaProperties(value, { context = "crud resource field definitions" } = {})`
-- `normalizeCrudFieldStorageConfig(fieldDefinition = {}, { context = "crud field storage", fieldKey = "" } = {})`
-- `buildCrudOperationSchemaFields(fields = {}, operationName = "")`
-- `buildCrudFieldContractMap(resource = {}, { context = "crud resource field contract" } = {})`
-- `resolveCrudFieldContractEntry(resource = {}, fieldKey = "", options = {})`
-Local functions
-- `cloneStructuredFieldMetadata(value = {})`
-- `mergeFieldContractEntry(target, source, { context = "crud field contract", fieldKey = "" } = {})`
-
-### `support/crudListFilters.js`
-Exports
-- `CRUD_LIST_FILTER_TYPE_FLAG`
-- `CRUD_LIST_FILTER_TYPE_ENUM`
-- `CRUD_LIST_FILTER_TYPE_ENUM_MANY`
-- `CRUD_LIST_FILTER_TYPE_RECORD_ID`
-- `CRUD_LIST_FILTER_TYPE_RECORD_ID_MANY`
-- `CRUD_LIST_FILTER_TYPE_DATE`
-- `CRUD_LIST_FILTER_TYPE_DATE_RANGE`
-- `CRUD_LIST_FILTER_TYPE_NUMBER_RANGE`
-- `CRUD_LIST_FILTER_TYPE_PRESENCE`
-- `CRUD_LIST_FILTER_TYPES`
-- `CRUD_LIST_FILTER_PRESENCE_PRESENT`
-- `CRUD_LIST_FILTER_PRESENCE_MISSING`
-- `CRUD_LIST_FILTER_PRESENCE_OPTIONS`
-- `CRUD_LIST_FILTER_INVALID_VALUES_REJECT`
-- `CRUD_LIST_FILTER_INVALID_VALUES_DISCARD`
-- `INVALID_CRUD_LIST_FILTER_QUERY_VALUE`
-- `normalizeCrudListFilterInvalidValues(value = "")`
-- `parseCrudListRangeQueryExpression(value = null)`
-- `formatCrudListRangeQueryExpression(startValue = "", endValue = "", { collapseExact = false } = {})`
-- `defineCrudListFilters(definitions = {})`
-- `createCrudListFilterEmptyValue(filter = {})`
-- `createCrudListFilterInitialValue(filter = {})`
-- `isCrudListFilterMultiValue(filter = {})`
-- `isCrudListFilterStructuredValue(filter = {})`
-- `normalizeCrudListFilterUiValue(filter = {}, rawValue)`
-- `areCrudListFilterUiValuesEqual(filter = {}, currentValue, expectedValue)`
-- `hasCrudListFilterUiValue(filter = {}, rawValue)`
-- `listCrudListFilterChipValues(filter = {}, rawValue)`
-- `formatCrudListFilterDefaultChipLabel(filter = {}, rawValue, { resolveAtomicValue = null } = {})`
-- `formatCrudListFilterQueryValue(filter = {}, value)`
-- `parseCrudListFilterQueryValue(filter = {}, value, { invalidValues = CRUD_LIST_FILTER_INVALID_VALUES_REJECT } = {})`
-- `resolveCrudListFilterQueryKeys(definition = {})`
-- `resolveCrudListFilterOptionLabel(definition = {}, value = "", { fallback = "" } = {})`
-Local functions
-- `firstCrudListFilterValue(value)`
-- `isPrimitiveCrudListFilterInput(value)`
-- `isPrimitiveOrPrimitiveArrayCrudListFilterInput(value)`
-- `normalizeDateFilterText(value)`
-- `normalizeCanonicalRecordIdList(value)`
-- `normalizeFiniteFilterNumber(value)`
-- `normalizeAllowedFilterTextValue(value, allowedValues = new Set())`
-- `normalizeAllowedFilterTextValues(value, allowedValues = new Set())`
-- `resolveCrudListFilterAllowedValues(filter = {})`
-- `normalizeCrudListDateRangeUiValue(rawValue)`
-- `normalizeCrudListNumberRangeUiValue(rawValue)`
-- `matchCrudListFilterValues(currentValue, expectedValue)`
-- `rejectInvalidCrudListFilterValue({ invalidValues = CRUD_LIST_FILTER_INVALID_VALUES_REJECT } = {})`
-- `normalizeCrudListDateRangeQueryValue(value)`
-- `normalizeCrudListNumberRangeQueryValue(value)`
-- `normalizeCrudListFilterType(value = "")`
-- `normalizeCrudListFilterOption(rawOption = null, { context = "filter option" } = {})`
-- `normalizeCrudListFilterOptions(rawOptions = [], { context = "filter options" } = {})`
-- `normalizeCrudListFilterPresenceOptions(rawOptions = [])`
-- `normalizeCrudListFilterLookup(rawLookup = null)`
-- `resolveCrudListFilterOptionSet(rawDefinition = {}, type = "")`
-- `normalizeCrudListFilterDefinition(rawKey = "", rawDefinition = null)`
-
-### `support/crudLookup.js`
-Exports
-- `DEFAULT_CRUD_LOOKUP_CONTAINER_KEY`
-- `normalizeCrudLookupApiPath(value = "")`
-- `normalizeCrudLookupNamespace(value = "")`
-- `resolveCrudLookupApiPathFromNamespace(value = "")`
-- `resolveCrudResourceScopeName(value = "")`
-- `normalizeCrudLookupContainerKey(value, { defaultValue = DEFAULT_CRUD_LOOKUP_CONTAINER_KEY, context = "crud lookup container key" } = {})`
-- `resolveCrudLookupContainerKey(resource = {}, options = {})`
-- `resolveCrudLookupFieldKeys(resource = {}, { allowKeys = [] } = {})`
-- `resolveCrudParentFilterKeys(resource = {})`
-- `resolveCrudLookupFieldKeyFromRouteParam(resource = {}, routeParamKey = "", { allowKeys = [] } = {})`
-- `resolveCrudParentFilterFieldKeyFromRouteParam(resource = {}, routeParamKey = "")`
-Local functions
-- `resolveCrudLookupFieldEntries(resource = {}, { allowKeys = [] } = {})`
-- `resolveCrudLookupCreateSchemaKeys(resource = {})`
-
 ### `support/deepFreeze.js`
 Exports
 - `deepFreeze(value, seen = new WeakSet())`

package/reference/autogen/README.md

@@ -28,6 +28,7 @@ Startup navigation stays in `KERNEL_MAP.md`.
 - [google-rewarded-core](/packages/agent-docs/reference/autogen/packages/google-rewarded-core.md)
 - [google-rewarded-web](/packages/agent-docs/reference/autogen/packages/google-rewarded-web.md)
 - [http-runtime](/packages/agent-docs/reference/autogen/packages/http-runtime.md)
+- [http-web](/packages/agent-docs/reference/autogen/packages/http-web.md)
 - [json-rest-api-core](/packages/agent-docs/reference/autogen/packages/json-rest-api-core.md)
 - [kernel](/packages/agent-docs/reference/autogen/packages/kernel.md)
 - [mobile-capacitor](/packages/agent-docs/reference/autogen/packages/mobile-capacitor.md)

package/reference/autogen/packages/assistant-core.md

@@ -100,10 +100,6 @@ Exports
 - `writeNdjson`
 - `resolveWorkspaceSlug`
 - `createServiceToolCatalog`
-- `parseJsonObject`
-- `resolveInsertedId`
-- `stringifyJsonObject`
-- `toIso`
 
 ### `src/server/lib/aiClient.js`
 Exports
@@ -189,13 +185,6 @@ Local functions
 - `resolveActionBackedToolEntries(scope)`
 - `resolveActionToolEntries(scope, { barredActionIds = [], skipActionPrefixes = [] } = {})`
 
-### `src/server/repositories/repositoryPersistenceUtils.js`
-Exports
-- `parseJsonObject`
-- `stringifyJsonObject(value)`
-- `toIso(value)`
-- `resolveInsertedId(insertResult)`
-
 ### `src/shared/assistantPaths.js`
 Exports
 - `ASSISTANT_API_RELATIVE_PATH`

package/reference/autogen/packages/assistant-runtime.md

@@ -141,6 +141,13 @@ Local functions
 - `normalizePagination(pagination = {}, { defaultPage = 1, defaultPageSize = 200, maxPageSize = 500 } = {})`
 - `resolveNextSequence(client, conversationId)`
 
+### `src/server/repositories/repositoryPersistenceUtils.js`
+Exports
+- `parseJsonObject`
+- `stringifyJsonObject(value)`
+- `toIso(value)`
+- `resolveInsertedId(insertResult)`
+
 ### `src/server/services/assistantConfigService.js`
 Exports
 - `createService({ assistantConfigRepository, consoleService = null, appConfig = {}, resolveAppConfig = null, workspaceScopeSupport = null } = {})`

package/reference/autogen/packages/crud-core.md

@@ -14,60 +14,6 @@ Use this on demand; do not load the full index at startup.
 
 ### src
 
-### `src/client/composables/createCrudClientSupport.js`
-Exports
-- `useCrudClientContext(source = {})`
-- `useCrudListRuntime(source = {})`
-- `useCrudCreateRuntime(source = {})`
-- `useCrudRecordRuntime(source = {}, { recordIdParam = "recordId" } = {})`
-- `createCrudClientSupport(source = {})`
-Local functions
-- `normalizeText(value = "")`
-- `normalizeRouteParams(params = {})`
-- `normalizePathTemplate(value = "")`
-- `resolvePathTemplate(pathTemplate = "", { routeParams = {}, params = {}, context = "resolvePathTemplate" } = {})`
-
-### `src/client/composables/crudClientSupportHelpers.js`
-Exports
-- `DEFAULT_CRUD_OWNERSHIP_FILTER`
-- `requireCrudNamespace`
-- `resolveCrudClientConfig(source = {})`
-- `formatDateTime`
-- `resolveCrudRecordChangedEvent`
-- `crudScopeQueryKey(namespace = "")`
-- `invalidateCrudQueries(queryClient, namespace = "")`
-- `crudListQueryKey(surfaceId = "", workspaceSlug = "", namespace = "")`
-- `crudViewQueryKey(surfaceId = "", workspaceSlug = "", recordId = "", namespace = "")`
-- `toRouteRecordId(value)`
-- `normalizeCrudRouteParamName(value, { context = "normalizeCrudRouteParamName" } = {})`
-- `resolveCrudRecordPathTemplates(relativePath = "", recordIdParam = "recordId")`
-- `resolveCrudRecordPathParams(recordIdLike = "", recordIdParam = "recordId")`
-Local functions
-- `normalizeRelativePath(value, { context = "resolveCrudClientConfig" } = {})`
-
-### `src/client/composables/useCrudRealtimeInvalidation.js`
-Exports
-- `useCrudRealtimeInvalidation(namespace = "", { event = "", enabled = true, matches = null, queryKey = null } = {})`
-
-### `src/client/index.js`
-Exports
-- `DEFAULT_CRUD_OWNERSHIP_FILTER`
-- `resolveCrudClientConfig`
-- `crudListQueryKey`
-- `crudViewQueryKey`
-- `crudScopeQueryKey`
-- `invalidateCrudQueries`
-- `formatDateTime`
-- `resolveCrudRecordChangedEvent`
-- `toRouteRecordId`
-- `requireCrudNamespace`
-- `useCrudClientContext`
-- `useCrudListRuntime`
-- `useCrudCreateRuntime`
-- `useCrudRecordRuntime`
-- `createCrudClientSupport`
-- `useCrudRealtimeInvalidation`
-
 ### `src/server/createCrudServiceFromResource.js`
 Exports
 - `createCrudServiceFromResource(resource = {}, { context = "crudService" } = {})`
@@ -353,21 +299,3 @@ Exports
 Local functions
 - `requireCrudServiceRepository(runtime = {}, repository = null)`
 - `splitCrudListRepositoryCall(query = {}, options = {})`
-
-### `src/shared/crudFieldSupport.js`
-Exports
-- `CRUD_LOOKUP_FORM_CONTROL_AUTOCOMPLETE`
-- `CRUD_LOOKUP_FORM_CONTROL_SELECT`
-- `CRUD_RUNTIME_LOOKUPS_FIELD_KEY`
-- `checkCrudLookupFormControl(value, { context = "crud field ui.formControl", defaultValue = CRUD_LOOKUP_FORM_CONTROL_AUTOCOMPLETE } = {})`
-- `isCrudRuntimeOutputOnlyFieldKey(value = "", { lookupContainerKey = CRUD_RUNTIME_LOOKUPS_FIELD_KEY } = {})`
-
-### `src/shared/crudNamespaceSupport.js`
-Exports
-- `normalizeCrudNamespace`
-- `requireCrudNamespace`
-- `resolveCrudRecordChangedEvent`
-
-### `src/shared/crudResource.js`
-Exports
-- `defineCrudResource`