@jskit-ai/agent-docs 0.1.191 → 0.1.193

package/skills/jskit/references/multi-homing.md

@@ -0,0 +1,274 @@
+<!-- Generated from `packages/agent-docs/site/guide/app-setup/multi-homing.md` by `npm run agent-docs:build`. -->
+
+# Workspace tenancy
+
+Use JSKIT workspaces when routes, records, or permissions belong to a selected
+workspace and membership or role changes access.
+
+```bash
+npm install @jskit-ai/workspaces-web
+npm run db:migrate
+```
+
+The dependency graph supplies `workspaces-core` and the required users runtime.
+Package migrations run from their installed locations through the application's
+normal Knex command.
+
+## Decide the tenancy model first
+
+Choose whether the product is:
+
+- global, with no workspace concept;
+- personal, with one automatically provisioned personal workspace; or
+- multi-workspace, with named workspaces, membership, invitations, and
+  switching.
+
+Do not add workspace machinery to a product that only needs an owner id on one
+domain record.
+
+## Server composition
+
+Use `workspaces/workspace-server` for role vocabulary, creation policy,
+invitations, settings, and app-owned invitation email rendering.
+
+Workspace scope must reach repository queries. Parsing a workspace slug or
+hiding an admin link is not authorization. Membership and role checks happen
+before an operation discloses records or record existence.
+
+`workspace_authenticated` and similar policies must implement their documented
+membership semantics exactly; do not synthesize memberships to compensate for
+a policy/runtime mismatch.
+
+## Transactional invitation participation
+
+Use the existing `workspaces.core` capability when accepting an invitation must
+also connect an application-owned identity, training history, access scopes or
+required audit records. JSKIT owns tokens, invitation state and membership; the
+application owns its reviewed association and domain policy. The built-in
+`workspace.invite.redeem` action runs the participant. No replacement route,
+client follow-up save or after-action event is needed.
+
+Saving intended access without sending remains an application draft. Do not call
+preparation until an administrator deliberately issues an invitation: preparation
+creates a real token and pending invitation, but does not activate membership.
+
+### Public server methods
+
+These methods are trusted server composition APIs, not new public actions. The
+caller must authorize creation, delivery and revocation in the requested workspace.
+The ordinary invitation routes retain their existing authorization and role
+validation. Do not forward arbitrary HTTP input as server composition options.
+
+| Capability method | Contract |
+| --- | --- |
+| `workspaces.repositories.workspaceInvites.withTransaction(work)` | Delegates to the same JSON REST API's managed `transaction(work)`; awaits commit and completion hooks before resolving. |
+| `workspaces.repositories.workspaceInvites.lockWorkspaceForInvitations(workspaceId, { trx })` | Locks the workspace before application receipt/draft rows when composing preparation. Requires an active transaction. |
+| `workspaces.services.members.prepareInvite(workspace, actor, payload, options)` | Requires a managed `options.trx`. Validates the invitation role, replaces pending invitations for that workspace/email, and returns `{ createdInviteId, inviteTokenPreview }`. Never sends. |
+| `workspaces.services.members.sendInvite(workspace, actor, prepared, options)` | Requires no `options.trx`. Reloads the committed pending invitation and workspace display data, validates expiry and token correspondence, and sends that invitation without replacement. |
+| `workspaces.services.members.createInvite(workspace, actor, payload, options)` | Owns preparation and commit, then calls `sendInvite`; retains the ordinary response shape. Rejects `options.trx`. |
+| `workspaces.services.pendingInvitations.registerAcceptanceParticipant(fn)` | Registers one application callback receiving `({ invite, user }, options)`. Invalid, duplicate and late registration reject. |
+
+`sendInvite` accepts `{ createdInviteId, inviteTokenPreview }` from preparation or
+only `{ createdInviteId }` for a later attempt. The latter uses JSKIT's existing
+opaque token-hash encoding without rotating the token. Supplying an empty or
+mismatched token rejects. Email, role, expiry and workspace display fields come
+from the stored invitation/workspace, not replacement input. Its response keeps
+`createdInviteId`, `inviteTokenPreview`, `inviteUrl` and `inviteDelivery` alongside
+the ordinary workspace/invitation-list payload. Treat tokens and URLs as secrets;
+do not log them or put them in diagnostic messages or administrative receipts.
+A receipt normally needs only the exact invitation ID.
+
+### Preparation, association, commit and controlled delivery
+
+Inside application feature setup, declare `workspaces: "workspaces.core"` in
+`requires`, then use that capability. The `reviewedPeople`, `people`, `scopes`
+and `audit` names below represent application-owned services, not JSKIT APIs.
+Their writes must forward the provided transaction to their repositories.
+
+```js
+// During application Feature.setup, before serving requests:
+const { members, pendingInvitations } = workspaces.services;
+const invites = workspaces.repositories.workspaceInvites;
+
+pendingInvitations.registerAcceptanceParticipant(async ({ invite, user }, options) => {
+  // Resolve from the exact validated invitation, never a client person ID.
+  const association = await reviewedPeople.resolveInvitation(invite.id, options);
+  if (association.kind === "ordinary") return;
+  await reviewedPeople.requireCurrentReview(association, {
+    workspaceId: invite.workspaceId,
+    user,
+    roleSid: invite.roleSid
+  }, options);
+  await people.linkAccountAndTraining(association.personId, user.id, options);
+  await scopes.applyReviewedAccess(association, user.id, options);
+  await audit.recordInvitationAcceptance(association, user.id, options);
+});
+
+// Inside an authorized application command:
+const prepared = await invites.withTransaction(async (trx) => {
+  const options = { trx, context };
+  // Match acceptance's order: workspace, then application draft/receipt rows.
+  await invites.lockWorkspaceForInvitations(workspace.id, options);
+  const reviewed = await reviewedPeople.lockAuthorizedDraft(draftId, workspace.id, actor, options);
+  const receipt = await reviewedPeople.findMatchingReceipt(reviewed, requestId, options);
+  if (receipt) return { createdInviteId: receipt.inviteId };
+  const created = await members.prepareInvite(workspace, actor, {
+    email: reviewed.email,
+    roleSid: reviewed.roleSid
+  }, options);
+  await reviewedPeople.associateInvitationAndSaveReceipt(reviewed, requestId, created.createdInviteId, options);
+  return { createdInviteId: created.createdInviteId };
+}); // Confirmed commit; a rejection here must not fall through to delivery.
+
+const result = await members.sendInvite(workspace, actor, prepared, { context });
+// Persist delivery feedback through the application owner. Avoid logging result:
+// it contains a secret token and URL as well as the nonsecret delivery outcome.
+await reviewedPeople.recordDeliveryOutcome(prepared.createdInviteId, result.inviteDelivery, { context });
+```
+
+The application must lock its reviewed draft/receipt, enforce request identity,
+and reject changed input on a reused request ID. A retry after losing the
+preparation response reads that receipt instead of preparing another invitation.
+Association failure rolls back the new invitation, replacement of an older
+invitation, receipt and application writes. This is not generic framework
+idempotency, and does not imply exactly-once email.
+
+Real SMTP is unnecessary for implementation and verification. With no
+`workspaceInviteMailer`, delivery returns `status: "mailer_unconfigured"`, an
+explanatory `message` and an empty `providerMessageId`; the invitation remains
+committed. A test application can configure a controlled mailer:
+
+```js
+workspaceInviteMailer: {
+  async sendWorkspaceInvite(message) {
+    capturedInvites.push(message); // Test-local memory; contains the secret link.
+    return { status: "sent", message: "Captured by test mailer.", providerMessageId: "fixture-1" };
+  }
+}
+```
+
+A thrown renderer/mailer error returns `inviteDelivery.status: "failed"` and a
+fixed message, avoiding accidental token leakage through provider exceptions.
+It does not delete the invitation/association or activate membership. Mailer
+results retain their normalized status, message and provider message ID; a
+successful default is `sent`. A provider exception or interrupted response may
+occur after a provider accepted the message: `failed` is not proof of nondelivery.
+There is no exactly-once delivery guarantee. Applications own durable delivery
+attempts and safe retry policy. Validation checks committed invitation state
+before sending; revocation after sending starts cannot recall the message.
+
+### Acceptance and failure semantics
+
+Register one callback during feature setup. It composes any application domain
+owners explicitly. Non-functions throw `TypeError`; a second registration
+throws, and registration closes when acceptance/refusal first begins. The
+callback's invite, user and options envelope are shallow frozen. It receives the
+same managed `trx` and request `context`; transaction ownership stays with JSKIT.
+
+Acceptance authenticates the user, checks email, pending state and expiry, then
+revalidates the invitation under workspace/invitation locks. Membership is
+available as active inside that transaction before the callback runs. Existing
+role-upsert semantics remain: the stored invitation role becomes the membership
+role, including for an existing membership. The callback cannot authorize role
+or scope overrides from client input. It must recheck the reviewed version,
+workspace, current inviter authority, person eligibility, existing account link,
+and scope eligibility using application-owned data.
+
+An ordinary invitation with no application association may pass through. A
+stale, revoked, conflicting or expected-but-missing association must fail closed.
+The application needs enough durable association/review state to distinguish
+these cases; absence alone cannot identify a deleted reviewed association.
+
+Await every owner write and forward the same transaction. Do not commit,
+roll back, use savepoints, start a new transaction, or perform external side
+effects in the callback. Do not swallow failures. Participant exceptions and
+later invitation-status failures roll back membership (including its prior role
+and status), person/training links, scopes, required audit and accepted status.
+The callback is not invoked for an invalid invitation or on refusal. Acceptance
+and refusal reject borrowed `options.trx`; revocation can join a managed
+transaction or own one when none is supplied.
+
+A missing/already-handled invitation rejects with 404; mismatched authenticated
+email with 403; unauthenticated access with 401. An expired invitation for its
+matching recipient is revoked in a committed transaction and then rejects with
+409 and `transactionOutcome: "committed"`. It never activates membership or
+runs the participant. A failure to commit that revocation preserves the managed
+transaction error instead. Delivery rejects missing/foreign/handled invitations
+with 404, expired invitations with 409, and mismatched tokens with 400.
+
+Keep `error.transactionOutcome` and `error.cause` when translating failures.
+`rolledBack` confirms rollback; `committed` can indicate a completion-hook error
+after successful persistence; `unknown` leaves the outcome unresolved. A thrown
+error alone does not prove rollback. After-commit failures and external effects
+cannot be included in the atomic guarantee. See
+[managed transaction guidance](./existing-application-migration.md#json-rest-v2-integration).
+
+Invitation mutations lock workspace before invitation rows, and use current
+locking reads before terminal transitions. Accepted/revoked state cannot be
+overwritten by a losing acceptance, refusal, revocation or replacement. A
+replacement after acceptance may create a new pending invitation while retaining
+the older accepted invitation. Keep callbacks short: invitation changes in the
+same workspace serialize. Database deadlocks/serialization failures remain
+transaction errors; callbacks are not automatically replayed.
+
+### Compatibility and verification
+
+This server-composition contract starts with `@jskit-ai/workspaces-core@0.1.198`.
+Transactional callers of
+`createInvite` must migrate to preparation plus post-commit delivery. Related
+acceptance writes must move into the participant. `markAcceptedById` and
+`revokeById` now reject terminal/missing invitations rather than overwriting their
+state. No route/action ID, package export, table or migration is added.
+
+Verify ordinary invitations, rollback after each domain write, late framework
+failure, existing membership restoration, recipient checks, stale associations,
+controlled delivery failures and lost-response receipts. Run the normal redeem
+action in tests. Use independent connections to race acceptance against acceptance,
+refusal, revocation and replacement in both winning orders. The package fixture
+runs these races on native MySQL/MariaDB and PostgreSQL; SQLite skips those races
+and is not evidence of native locking correctness.
+
+Use only a verified empty disposable database named
+`jskit_repository_test_*` for native tests. The runner verifies the actual target,
+reports its engine version, applies package migrations and drops fixture tables.
+
+```sh
+node --test packages/workspaces-core/test/*.test.js
+# Set JSKIT_REPOSITORY_TEST_DATABASE_URL to the verified empty disposable target.
+node --test packages/workspaces-core/test/repositories.integration.test.js
+npm run verify
+```
+
+A passing framework fixture does not complete the application's People, training,
+permissions, privacy or browser integration. Publication remains a separate
+maintainer operation. After a coordinated release is published, run the
+application's `npm run jskit:update`, restart its backend and verify that
+`members.prepareInvite`, `members.sendInvite` and
+`pendingInvitations.registerAcceptanceParticipant` are functions on the installed
+`workspaces.core` capability. Check the installed package/catalogue versions
+against that release. The first coordinated release containing this contract pairs
+`@jskit-ai/workspaces-core@0.1.198`, `@jskit-ai/jskit-catalog@0.1.245` and
+`@jskit-ai/agent-docs@0.1.192`. Upgrade the coordinated dependency graph rather
+than pinning only `workspaces-core`. Do not patch installed `node_modules`.
+
+## Browser composition
+
+Use `workspaces/workspace-surfaces` for workspace selection, invitation landing,
+member administration, settings, not-found states, and semantic shell
+placements.
+
+The route slug, selected workspace, query keys, and server scope stay aligned.
+Invalid workspace URLs show a deliberate not-found/forbidden state instead of
+silently selecting another workspace.
+
+Loading uses skeletons; mutation errors use toasts. Warm-cache and browser
+back/forward navigation must restore the correct workspace context.
+
+## Verification
+
+Test create/list/select, each role boundary, invitations and expiry,
+cross-workspace isolation, invalid routes, direct URLs, switching, browser
+back/forward, and responsive navigation.
+
+Do not authorize from client state, add unscoped queries, or preserve old
+tenancy setup through compatibility shims.

package/skills/jskit/references/pattern-index.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.191`
+- Owner: `@jskit-ai/agent-docs@0.1.193`
 - Read: [PATTERN.md](patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.191`
+- Owner: `@jskit-ai/agent-docs@0.1.193`
 - Read: [PATTERN.md](patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.1.190`
+- Owner: `@jskit-ai/assistant-runtime@0.1.192`
 - Read: [PATTERN.md](patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -48,7 +48,7 @@ Compose JSKIT authentication routes, views, profile controls, and public surface
 
 - Id: `auth/auth-surface`
 - Keywords: `account`, `auth`, `login`, `logout`, `password`, `placement`, `profile`, `reset`, `surface`
-- Owner: `@jskit-ai/auth-web@0.1.219`
+- Owner: `@jskit-ai/auth-web@0.1.221`
 - Read: [PATTERN.md](patterns/auth/auth-surface/PATTERN.md)
 - Examples: [example/](patterns/auth/auth-surface/example/)
 - Requires: `@jskit-ai/auth-core`, `@jskit-ai/auth-web`, `@jskit-ai/shell-web`
@@ -59,7 +59,7 @@ Add Supabase authentication through normal npm composition, explicit environment
 
 - Id: `auth/supabase-auth`
 - Keywords: `auth`, `authentication`, `oauth`, `sessions`, `supabase`
-- Owner: `@jskit-ai/auth-provider-supabase-core@0.1.216`
+- Owner: `@jskit-ai/auth-provider-supabase-core@0.1.218`
 - Read: [PATTERN.md](patterns/auth/supabase-auth/PATTERN.md)
 - Examples: [example/](patterns/auth/supabase-auth/example/)
 - Requires: `@jskit-ai/auth-provider-supabase-core`
@@ -70,7 +70,7 @@ Resolve an administrator environment key or an individual user's grant, then use
 
 - Id: `connectors/ai-connections`
 - Keywords: `ai`, `api-key`, `big-pickle`, `cli`, `environment`, `free`, `models`, `ownership`, `zai`, `zen`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/ai-connections/PATTERN.md)
 - Examples: [example/](patterns/connectors/ai-connections/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -81,7 +81,7 @@ Compose provider operations, authorization and encrypted file storage from a CLI
 
 - Id: `connectors/api-key-connection`
 - Keywords: `api-key`, `clay`, `cli`, `clickhouse`, `connectors`, `dbt`, `files`, `firecrawl`, `granola`, `integrations`, `metrics`, `prestashop`, `resend`, `semantic-layer`, `semrush`, `x-twitter`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/api-key-connection/PATTERN.md)
 - Examples: [example/](patterns/connectors/api-key-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -92,7 +92,7 @@ Compose token-based MCP discovery and explicitly authorized tool calls using the
 
 - Id: `connectors/assistant-mcp`
 - Keywords: `assistant`, `cli`, `connectors`, `files`, `integrations`, `mcp`, `n8n`, `sanity`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/assistant-mcp/PATTERN.md)
 - Examples: [example/](patterns/connectors/assistant-mcp/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -103,7 +103,7 @@ Configure assistant OAuth clients, then compose existing state, encrypted file g
 
 - Id: `connectors/assistant-mcp-oauth`
 - Keywords: `amplitude`, `assistant`, `atlassian`, `canva`, `cli`, `client metadata`, `confidence`, `connectors`, `figma`, `files`, `granola`, `hex`, `mcp`, `miro`, `oauth`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/assistant-mcp-oauth/PATTERN.md)
 - Examples: [example/](patterns/connectors/assistant-mcp-oauth/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -114,7 +114,7 @@ Compose signed AWS operations, file configuration and application authorization
 
 - Id: `connectors/aws-storage-queries`
 - Keywords: `athena`, `aws`, `cli`, `connectors`, `files`, `iam`, `queries`, `s3`, `storage`, `sts`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/aws-storage-queries/PATTERN.md)
 - Examples: [example/](patterns/connectors/aws-storage-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -125,7 +125,7 @@ Compose reusable connection libraries with portable configuration, application o
 
 - Id: `connectors/calendar-cli`
 - Keywords: `calendar`, `cli`, `connectors`, `google`, `integrations`, `oauth`, `permissions`
-- Owner: `@jskit-ai/connector-google-calendar@0.1.36`
+- Owner: `@jskit-ai/connector-google-calendar@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/calendar-cli/PATTERN.md)
 - Examples: [example/](patterns/connectors/calendar-cli/example/)
 - Requires: `@jskit-ai/connector-google-calendar`, `@jskit-ai/connectors-core`, `@jskit-ai/database-runtime-mysql`
@@ -136,7 +136,7 @@ Compose the shared connector runtime for event delivery while leaving workflow c
 
 - Id: `connectors/event-delivery`
 - Keywords: `cli`, `connectors`, `events`, `files`, `inngest`, `integrations`, `workflows`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/event-delivery/PATTERN.md)
 - Examples: [example/](patterns/connectors/event-delivery/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -147,7 +147,7 @@ Wire service-account grants, file storage, explicit message actions and public b
 
 - Id: `connectors/firebase-messaging`
 - Keywords: `cli`, `connectors`, `fcm`, `files`, `firebase`, `integrations`, `jwt`, `notifications`, `push`, `service-account`, `vapid`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/firebase-messaging/PATTERN.md)
 - Examples: [example/](patterns/connectors/firebase-messaging/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -158,7 +158,7 @@ Compose reviewed Search campaigns with project-owned Google OAuth and portable s
 
 - Id: `connectors/google-ads-search`
 - Keywords: `ads`, `campaigns`, `cli`, `connectors`, `conversion`, `google`, `search`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/google-ads-search/PATTERN.md)
 - Examples: [example/](patterns/connectors/google-ads-search/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -169,7 +169,7 @@ Compose provider consent, verification and encrypted file persistence from an ap
 
 - Id: `connectors/oauth-connection`
 - Keywords: `accounting`, `assistant permissions`, `books`, `cli`, `client credentials`, `connectors`, `consent`, `crm`, `databricks`, `developer token`, `fabric`, `files`, `gaql`, `google ads`, `graphql`, `integrations`, `linkedin`, `microsoft`, `oauth`, `powerpoint`, `salesforce`, `service principal`, `shopify`, `soql`, `staffing`, `tiktok`, `twitch`, `wave`, `word`, `wordpress`, `workday`, `xero`, `zoho`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/oauth-connection/PATTERN.md)
 - Examples: [example/](patterns/connectors/oauth-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -180,7 +180,7 @@ Compose a sequential catalogue batch and preserve partial success for applicatio
 
 - Id: `connectors/paddle-catalogue`
 - Keywords: `batch`, `paddle`, `payments`, `prices`, `products`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/paddle-catalogue/PATTERN.md)
 - Examples: [example/](patterns/connectors/paddle-catalogue/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -191,7 +191,7 @@ Resolve a publishable image key deliberately and use the shared URL library in a
 
 - Id: `connectors/public-image`
 - Keywords: `cli`, `connectors`, `files`, `images`, `integrations`, `logo-dev`, `public-key`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/public-image/PATTERN.md)
 - Examples: [example/](patterns/connectors/public-image/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -202,7 +202,7 @@ Compose file configuration, Redshift Data API operations and application query o
 
 - Id: `connectors/redshift-queries`
 - Keywords: `aws`, `cli`, `connectors`, `files`, `iam`, `provisioned`, `redshift`, `serverless`, `sql`, `warehouse`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/redshift-queries/PATTERN.md)
 - Examples: [example/](patterns/connectors/redshift-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -213,7 +213,7 @@ Use the shared scanner runtime from a CLI or a host worker with portable configu
 
 - Id: `connectors/source-scanning`
 - Keywords: `cancellation`, `cli`, `connectors`, `integrations`, `scanning`, `security`, `source`, `wiz`, `worker`
-- Owner: `@jskit-ai/connectors-catalog@0.1.36`
+- Owner: `@jskit-ai/connectors-catalog@0.1.38`
 - Read: [PATTERN.md](patterns/connectors/source-scanning/PATTERN.md)
 - Examples: [example/](patterns/connectors/source-scanning/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -224,7 +224,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.187`
+- Owner: `@jskit-ai/console-web@0.1.189`
 - Read: [PATTERN.md](patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -235,7 +235,7 @@ Build a routed CRUD user interface as thin application pages over JSKIT's shared
 
 - Id: `crud/crud-screen-set`
 - Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.1.64`
+- Owner: `@jskit-ai/http-web@0.1.66`
 - Read: [PATTERN.md](patterns/crud/crud-screen-set/PATTERN.md)
 - Examples: [example/](patterns/crud/crud-screen-set/example/)
 - Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-crud-core`
@@ -246,7 +246,7 @@ Build a complete application-owned CRUD server package from a migration, resourc
 
 - Id: `crud/json-api-resource-package`
 - Keywords: `actions`, `crud`, `database`, `json-api`, `migration`, `permissions`, `provider`, `repository`, `routes`, `service`
-- Owner: `@jskit-ai/crud-core@0.1.230`
+- Owner: `@jskit-ai/crud-core@0.1.232`
 - Read: [PATTERN.md](patterns/crud/json-api-resource-package/PATTERN.md)
 - Examples: [example/](patterns/crud/json-api-resource-package/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/resource-crud-core`
@@ -257,7 +257,7 @@ Define an authenticated application resource whose records belong to the current
 
 - Id: `crud/resource-contract`
 - Keywords: `authenticated`, `crud`, `database`, `owner-scoped`, `resource`, `user`
-- Owner: `@jskit-ai/resource-crud-core@0.1.161`
+- Owner: `@jskit-ai/resource-crud-core@0.1.163`
 - Read: [PATTERN.md](patterns/crud/resource-contract/PATTERN.md)
 - Examples: [example/](patterns/crud/resource-contract/example/)
 - Requires: `@jskit-ai/resource-crud-core`
@@ -268,7 +268,7 @@ Configure a JSKIT application for MySQL with a fixed driver, ordinary environmen
 
 - Id: `database/mysql-application`
 - Keywords: `database`, `knex`, `mariadb`, `migrations`, `mysql`, `mysql2`
-- Owner: `@jskit-ai/database-runtime-mysql@0.1.217`
+- Owner: `@jskit-ai/database-runtime-mysql@0.1.219`
 - Read: [PATTERN.md](patterns/database/mysql-application/PATTERN.md)
 - Examples: [example/](patterns/database/mysql-application/example/)
 - Requires: `@jskit-ai/database-runtime-mysql`
@@ -279,7 +279,7 @@ Configure a JSKIT application for PostgreSQL with a fixed driver, ordinary envir
 
 - Id: `database/postgres-application`
 - Keywords: `database`, `knex`, `migrations`, `pg`, `postgres`, `postgresql`
-- Owner: `@jskit-ai/database-runtime-postgres@0.1.216`
+- Owner: `@jskit-ai/database-runtime-postgres@0.1.218`
 - Read: [PATTERN.md](patterns/database/postgres-application/PATTERN.md)
 - Examples: [example/](patterns/database/postgres-application/example/)
 - Requires: `@jskit-ai/database-runtime-postgres`
@@ -290,7 +290,7 @@ Wrap a JSKIT web application in a Capacitor Android shell using native Capacitor
 
 - Id: `mobile/android-application`
 - Keywords: `android`, `capacitor`, `device`, `mobile`, `native`, `shell`, `webview`
-- Owner: `@jskit-ai/mobile-capacitor@0.1.154`
+- Owner: `@jskit-ai/mobile-capacitor@0.1.156`
 - Read: [PATTERN.md](patterns/mobile/android-application/PATTERN.md)
 - Examples: [example/](patterns/mobile/android-application/example/)
 - Requires: `@capacitor/android`, `@capacitor/app`, `@capacitor/cli`, `@jskit-ai/mobile-capacitor`
@@ -301,7 +301,7 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.1.216`
+- Owner: `@jskit-ai/realtime@0.1.218`
 - Read: [PATTERN.md](patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
@@ -312,7 +312,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.1.155`
+- Owner: `@jskit-ai/rewarded-web@0.1.157`
 - Read: [PATTERN.md](patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -323,7 +323,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `feature`, `json-rest`, `knex`, `orchestration`, `package`, `provider`, `repository`, `routes`, `server`
-- Owner: `@jskit-ai/agent-docs@0.1.191`
+- Owner: `@jskit-ai/agent-docs@0.1.193`
 - Read: [PATTERN.md](patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -334,7 +334,7 @@ Compose the JSKIT responsive shell, semantic placements, settings navigation, an
 
 - Id: `shell/application-shell`
 - Keywords: `adaptive`, `app`, `layout`, `navigation`, `placement`, `responsive`, `settings`, `shell`
-- Owner: `@jskit-ai/shell-web@0.1.223`
+- Owner: `@jskit-ai/shell-web@0.1.225`
 - Read: [PATTERN.md](patterns/shell/application-shell/PATTERN.md)
 - Examples: [example/](patterns/shell/application-shell/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -345,7 +345,7 @@ Add product routes and shell extensions through file routing, semantic placement
 
 - Id: `ui/page-and-placement`
 - Keywords: `component`, `navigation`, `outlet`, `page`, `placement`, `routes`, `section`, `shell`, `subpages`, `vue`
-- Owner: `@jskit-ai/shell-web@0.1.223`
+- Owner: `@jskit-ai/shell-web@0.1.225`
 - Read: [PATTERN.md](patterns/ui/page-and-placement/PATTERN.md)
 - Examples: [example/](patterns/ui/page-and-placement/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -356,7 +356,7 @@ Compose an account settings route and profile, preference, and notification sect
 
 - Id: `users/account-settings`
 - Keywords: `account`, `notifications`, `preferences`, `profile`, `settings`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.1.237`
+- Owner: `@jskit-ai/users-web@0.1.239`
 - Read: [PATTERN.md](patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -367,7 +367,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.1.232`
+- Owner: `@jskit-ai/users-core@0.1.234`
 - Read: [PATTERN.md](patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -378,7 +378,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.1.197`
+- Owner: `@jskit-ai/workspaces-core@0.1.199`
 - Read: [PATTERN.md](patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -389,7 +389,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.1.198`
+- Owner: `@jskit-ai/workspaces-web@0.1.200`
 - Read: [PATTERN.md](patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/skills/jskit/references/patterns/app/minimal-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.1.219",
+    "@jskit-ai/kernel": "0.1.221",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.8.5",
     "json-rest-schema": "^1.0.17",
@@ -42,13 +42,13 @@
     "vue": "^3.5.43",
     "vue-router": "^5.3.1",
     "vuetify": "^4.1.2",
-    "@jskit-ai/http-runtime": "0.1.217",
+    "@jskit-ai/http-runtime": "0.1.219",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
-    "@jskit-ai/config-eslint": "0.1.216",
-    "@jskit-ai/jskit-catalog": "0.1.244",
+    "@jskit-ai/config-eslint": "0.1.218",
+    "@jskit-ai/jskit-catalog": "0.1.246",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/skills/jskit/references/patterns/app/shell-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.1.219",
+    "@jskit-ai/kernel": "0.1.221",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.8.5",
     "json-rest-schema": "^1.0.17",
@@ -42,15 +42,15 @@
     "vue": "^3.5.43",
     "vue-router": "^5.3.1",
     "vuetify": "^4.1.2",
-    "@jskit-ai/http-runtime": "0.1.217",
+    "@jskit-ai/http-runtime": "0.1.219",
     "@mdi/js": "^7.4.47",
-    "@jskit-ai/shell-web": "0.1.223",
+    "@jskit-ai/shell-web": "0.1.225",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
-    "@jskit-ai/config-eslint": "0.1.216",
-    "@jskit-ai/jskit-catalog": "0.1.244",
+    "@jskit-ai/config-eslint": "0.1.218",
+    "@jskit-ai/jskit-catalog": "0.1.246",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/skills/jskit/references/patterns/app/shell-foundation/example/packages/main/package.json

@@ -9,7 +9,7 @@
   },
   "description": "App-local runtime composition and lightweight glue.",
   "dependencies": {
-    "@jskit-ai/kernel": "0.1.219"
+    "@jskit-ai/kernel": "0.1.221"
   },
   "jskit": {
     "kind": "runtime",

package/skills/jskit/references/patterns/auth/supabase-auth/example/package.json

@@ -2,6 +2,6 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/auth-provider-supabase-core": "0.1.216"
+    "@jskit-ai/auth-provider-supabase-core": "0.1.218"
   }
 }