@jskit-ai/agent-docs 0.1.238 → 0.1.240

package/guide/agent/app-extras/assistant-conversation.md

@@ -485,10 +485,14 @@ and the existing queuing behavior for a runtime that advertises steering.
 Applications may opt into `deferWhileWorking: true` with
 `queueWhileSending: true` for a conversation that cannot steer its active turn.
 Typed and retained voice submissions become pending in the original serial
-queue with their exact message ID, text, attachments and captured data. The
-existing subscription must report ready before each ordinary request reaches
-the API; normal server permissions still apply at dispatch. Show **Send** and
-the existing pending status, not **Steer**, when the runtime cannot steer.
+queue with their exact message ID, text, attachments and captured data. Each
+waits only while the existing subscription reports a working turn that cannot
+take steering, and its pending status says so ("Pending: Waiting for the
+assistant to finish this step"). When that working turn becomes steerable the
+message is sent as steering, keeping the finished-turn fallback to one ordinary
+Send; when the subscription reports ready it is sent as an ordinary request.
+Normal server permissions still apply at dispatch. Show **Send** and the
+pending status, not **Steer**, when the runtime cannot steer.
 Native steering and explicit retries keep their captured intent. Stop aborts
 these local pre-dispatch followers before stopping the original turn; actor
 retirement and lost access cannot dispatch them later. This option defaults to
@@ -2850,8 +2854,9 @@ Real account, environment, socket and provider recovery still runs normally.
 Native compaction remains the engine's job.
 JSKIT owns the local history adapter used for model-provider changes. It keeps
 native history intact and translates only outgoing requests. For qualified
-DeepSeek and GLM models, an OpenAI encrypted compaction is supplemented with the
-exact readable records from its saved native boundary. Recovery is bounded and
+models (`codexHistoryRouting`: DeepSeek V4.1 Flash, DeepSeek V4 Pro and GLM 5.3),
+an OpenAI encrypted compaction is supplemented with the exact readable records
+from its saved native boundary. Recovery is bounded and
 excludes only exact user-message copies retained by that same native boundary
 and still present before it in the outgoing request, counting each occurrence.
 Unmatched messages, tool results and images retain their original archive order.

package/guide/agent/app-setup/authentication.md

@@ -17,6 +17,13 @@ For Supabase authentication:
 npm install @jskit-ai/auth-provider-supabase-core @jskit-ai/auth-web
 ```
 
+To sign in through an accounts hub or another OpenID Connect issuer (see
+[Sign in through an OIDC issuer](/guide/app-setup/sign-in-through-oidc-issuer)):
+
+```bash
+npm install @jskit-ai/auth-provider-oidc-core @jskit-ai/auth-web
+```
+
 The dependency graph supplies `@jskit-ai/auth-core`. Do not install two
 providers for the same `auth.service` capability.
 
@@ -27,8 +34,27 @@ owns permitted login methods, visible OAuth providers, public routes,
 post-login destinations, surface access policy, and secret injection.
 
 Use the `auth/auth-surface` pattern for login, sign-out, reset, guards, profile
-placements, and HTTP integration. Use `auth/supabase-auth` for the Supabase
-environment and configuration shape.
+placements, HTTP integration, and the managed-preview login. Use
+`auth/supabase-auth` for the Supabase environment and configuration shape, and
+`auth/oidc-sign-in` for an OpenID Connect issuer.
+
+## Managed-preview login is standard
+
+An application with accounts always includes the managed-preview login, whether
+or not anyone asked for it. Adding authentication adds both parts from the
+`auth/auth-surface` pattern:
+
+- the committed, executable `tools/preview-identity` from its example;
+- the `#### Preview identity` block in the web-presented Vibe64 `Outputs`
+  target (Command `tools/preview-identity`, Protocol
+  `vibe64.preview-identity.command.v1`, Identity types `email` `user-id`,
+  Enabled environment `AUTH_DEV_BYPASS_ENABLED`, Secret environment
+  `AUTH_DEV_BYPASS_SECRET`, Runtimes `nodejs`), copied exactly from the pattern.
+
+The preview host supplies both environment values per run, so a managed
+preview can sign its browser in as an existing account. Which accounts it may
+use stays the person's choice; the application never creates users for it, and
+the exchange is inert without both values.
 
 ## Server boundary
 

package/guide/agent/app-setup/existing-application-migration.md

@@ -316,9 +316,11 @@ Do not conflate these identities:
   application profile and required workspace membership already exist. It does
   not synthesize any of them as a side effect.
 
-For a managed preview, retain the app-owned `tools/preview-identity`
-executable and declare it under `#### Preview identity` in the web-presented
-Vibe64 `Outputs` target. JSKIT owns the executable/library pattern, Vibe64 owns
+An application with accounts has the standard managed-preview login: retain
+the app-owned `tools/preview-identity` executable, or add it from
+`auth/auth-surface` when it is missing, and declare it under
+`#### Preview identity` in the web-presented Vibe64 `Outputs` target exactly as
+that pattern shows. JSKIT owns the executable/library pattern, Vibe64 owns
 the declaration's grammar and runtime behavior, and Genesis transports the
 consumer-owned section without interpreting it. The executable calls the
 `@jskit-ai/auth-web` server-side managed-preview library; it does not need a

package/guide/agent/app-setup/initial-scaffolding.md

@@ -22,7 +22,10 @@ browser-product baseline. It includes:
 - responsive JSKIT shell
 - surfaces, placements, topology, and settings
 - lint, unit, client, build, and browser configuration
-- managed-preview identity support when the host uses it
+
+It has no accounts. Adding authentication through `auth/auth-surface` also adds
+the standard managed-preview login (`tools/preview-identity` and its
+`#### Preview identity` Outputs block).
 
 Use it when navigation and settings are real product requirements. Replace its
 home content and vocabulary; do not preserve the concrete `reading-room` name

package/guide/agent/app-setup/run-an-accounts-hub.md

@@ -0,0 +1,152 @@
+<!-- Generated by `npm run agent-docs:build` from `packages/agent-docs/site/guide/app-setup/run-an-accounts-hub.md`. Do not edit manually. -->
+
+# Run an accounts hub
+
+An accounts hub gives one person or company a single sign-in for all of their
+apps. It is an OpenID Connect issuer that runs as its **own** JSKIT project, on a
+domain of its own. Apps sign in through it like they would through Google: the
+hub shows its sign-in page, the app receives an ID token, and the app keeps its
+own session.
+
+```bash
+npm install @jskit-ai/oidc-issuer-core @jskit-ai/database-runtime-mysql
+```
+
+Start from the "JSKIT · Accounts hub" template (seed-jskit branch
+`accounts-hub`) when you can: it already has the pages, the Stack and the tests.
+Use the `auth/accounts-hub` pattern for the composition rules. Apps connect with
+`@jskit-ai/auth-provider-oidc-core`; see
+[Sign in through an OIDC issuer](/guide/app-setup/sign-in-through-oidc-issuer).
+
+## In order
+
+1. Create the hub from the template, with its own database.
+2. Development: set `OIDC_HUB_OWNER_EMAIL` (ask the person), a random
+   `OIDC_HUB_REGISTRATION_TOKEN` and, if the database is shared or kept,
+   `OIDC_HUB_SECRET`. Start it, create the owner account and confirm it (the
+   link is in the server log without a sender). Run the tests.
+3. Production: choose the hub's own domain and set `APP_PUBLIC_URL`, a new
+   `OIDC_HUB_SECRET`, the same registration token the apps will use, the owner
+   email, an email sender and `OIDC_HUB_DEV_ORIGIN_PATTERNS` for the apps'
+   development previews.
+4. Deploy, then sign in as the owner and follow **Setup** until every item is
+   ready. Only then connect apps (see [Connecting an app](#connecting-an-app)).
+
+Report Setup honestly: do not say email or Google works until its Setup item is
+ready.
+
+## What the hub does
+
+- **Sign-in for apps.** `/.well-known/openid-configuration` and `/oidc/*` serve a
+  hardened `oidc-provider`: authorization code with PKCE only, exact redirect
+  URIs, ES256 ID tokens that include `email`, `email_verified` and `name`, no
+  refresh tokens for apps, `iss` in every authorization response, RP-initiated
+  and back-channel logout.
+- **Accounts.** Email and password (scrypt v1, the same format as JSKIT local
+  accounts), email confirmation, password recovery, and optional "Continue with
+  Google" with the owner's own Google client. An account reaches apps only once
+  its email is confirmed, because apps trust that address. Apps sign in
+  silently only while the browser is signed in to the hub as the same person.
+- **Approval.** Apps register themselves at `/oidc/reg` with the registration
+  token. Loopback and development addresses are approved automatically; every
+  other address waits until the owner clicks Approve on the hub's Apps page.
+- **Admin pages.** Apps (approve, block, remove, rotate the signing key), People
+  (turn accounts off, which signs them out of every app through back-channel
+  logout) and Setup (a checklist of what is ready).
+
+## Environment
+
+| Name | Required | Meaning |
+|---|---|---|
+| `APP_PUBLIC_URL` | production | The hub's origin, which is its issuer. https outside this computer, no path. |
+| `OIDC_HUB_SECRET` | production | At least 32 random bytes. Protects cookies and the stored signing keys; never change it once set. Development generates one in `.jskit/oidc-hub/secret`, so set it explicitly whenever the database outlives that folder (a hosted editor, several checkouts sharing one database). |
+| `OIDC_HUB_REGISTRATION_TOKEN` | yes | At least 24 characters. Apps present it to register. Give the same value to each app as `AUTH_OIDC_REGISTRATION_TOKEN`. |
+| `OIDC_HUB_OWNER_EMAIL` | yes | The owner's email. That account, once its email is confirmed, opens the admin pages. |
+| `OIDC_HUB_DEV_ORIGIN_PATTERNS` | no | Comma-separated `https://` origin globs approved automatically, for example `https://preview-*.acme.example.dev`. `*` matches inside one DNS label. Loopback is always approved. |
+| `OIDC_HUB_EMAIL_FROM` with `RESEND_API_KEY` or `SMTP_URL` | production | The owner's own sender. In development, without a sender, emails are written to the server log. |
+| `OIDC_HUB_GOOGLE_CLIENT_ID` and `OIDC_HUB_GOOGLE_CLIENT_SECRET` | no | Turn on "Continue with Google". The Google redirect URI is `{APP_PUBLIC_URL}/hub/google/callback`. |
+
+Each problem stops the hub with one sentence that names the variable to fix.
+
+## Mounting
+
+The installed `OidcIssuerProvider` mounts everything on the app's Fastify
+server. A server that filters paths by surface must also serve the hub's
+paths:
+
+```js
+import { HUB_GLOBAL_PATHS } from "@jskit-ai/oidc-issuer-core/server";
+
+registerSurfaceRequestConstraint({
+  fastify: app,
+  surfaceRuntime,
+  serverSurface,
+  globalUiPaths: [...runtimeGlobalUiPaths, ...HUB_GLOBAL_PATHS]
+});
+```
+
+The hub's own pages are ordinary Vue pages. They call `/hub/api/*` with
+`x-hub-request: 1` on every state-changing request. An app's sign-in arrives at
+`/hub/interaction/:uid`, which sends the browser to `/auth/sign-in?interaction=…`.
+That page reads `/hub/interaction/:uid/details` (app name, full address and
+status) and finishes with `/hub/interaction/:uid/continue` once the person is
+signed in.
+
+## Registration and approval
+
+A registration carries only `client_name` (at most 80 characters),
+`redirect_uris`, `post_logout_redirect_uris`, `backchannel_logout_uri`,
+`token_endpoint_auth_method` (`client_secret_basic`), `grant_types`
+(`["authorization_code"]`) and `response_types` (`["code"]`). Every address must
+be on one origin, https unless it is loopback. Anything else is refused with
+`invalid_client_metadata`.
+
+| Address | Status |
+|---|---|
+| Loopback, or matching `OIDC_HUB_DEV_ORIGIN_PATTERNS` | `active-dev`: works at once; removed after 30 idle days |
+| An origin the owner already approved | `active` |
+| Any other origin | `pending`: the person sees "This app is waiting for approval by the hub's owner." |
+| A blocked origin | refused with 403 "This address is blocked by the hub's owner." |
+
+The response header `x-hub-client-status` tells the registering app its status.
+
+## Commands
+
+Run them from the hub project's folder; they read its `.env` and database
+settings.
+
+```bash
+npx jskit-oidc-issuer keys rotate
+npx jskit-oidc-issuer import-accounts --in accounts.jsonl          # dry run
+npx jskit-oidc-issuer import-accounts --in accounts.jsonl --apply
+```
+
+- `keys rotate` makes a new ES256 key active. The previous key keeps verifying
+  for two hours, then leaves the JWKS. The Apps page has the same button.
+- `import-accounts` reads the JSON Lines written by
+  `jskit-oidc-sign-in export-local-accounts`. It keeps each `usr_` id as the
+  hub's `sub` and each scrypt password byte for byte, so people sign in with the
+  password they already had. Emails start unconfirmed: each person confirms
+  theirs once, at their first app sign-in. Rows that clash with a
+  different hub account are refused and listed. A dry run prints only counts.
+- `preview-identity` implements `vibe64.preview-identity.command.v1` for the
+  hub, so an editor's preview can sign in as an existing hub account. It works
+  only outside production, from loopback, with `AUTH_DEV_BYPASS_ENABLED` and
+  `AUTH_DEV_BYPASS_SECRET`.
+
+## Connecting an app
+
+1. Install `@jskit-ai/auth-provider-oidc-core` in the app.
+2. Give the app `AUTH_OIDC_ISSUER` (the hub's `APP_PUBLIC_URL`) and
+   `AUTH_OIDC_REGISTRATION_TOKEN` (the hub's `OIDC_HUB_REGISTRATION_TOKEN`).
+3. Sign in once from the app. A development address works straight away. After
+   the app is deployed, open the hub's Apps page and approve it at its full
+   address.
+
+## Verify
+
+- Start the hub with one variable missing and read the sentence it prints.
+- A loopback app registers as `active-dev` and signs in.
+- An https app on another domain waits until Approve, then signs in.
+- Setup shows every item ticked once the owner confirms the domain and sends a
+  test email.

package/guide/agent/app-setup/sign-in-through-oidc-issuer.md

@@ -0,0 +1,148 @@
+<!-- Generated by `npm run agent-docs:build` from `packages/agent-docs/site/guide/app-setup/sign-in-through-oidc-issuer.md`. Do not edit manually. -->
+
+# Sign in through an OIDC issuer
+
+Use this when an app should not keep its own passwords: people sign in with
+the account they already have in an accounts hub (see
+[Run an accounts hub](/guide/app-setup/run-an-accounts-hub)) or in any OpenID
+Connect issuer, such as Google Workspace or Okta. The app still keeps its own
+`users` rows and its own session; the issuer only proves who the person is.
+
+The pattern is `auth/oidc-sign-in`.
+
+## In order
+
+1. Have the issuer's address and either a registration token (an accounts hub)
+   or a client id and secret (any other issuer). Ask the person; never invent them.
+2. Install the provider and run the migration (below).
+3. Set or link the Env values (below) for development and production.
+4. Sign in once in development. Against a hub, a development address works at
+   once when it is on this computer or matches the hub's development patterns.
+5. Deploy, then ask the hub's owner to approve the app on the hub's Apps page at
+   the app's full address. Until then sign-in shows the hub's waiting page.
+
+## Install
+
+Replace the local provider; an app has exactly one `auth.service` provider.
+
+```bash
+npm uninstall @jskit-ai/auth-provider-local-core
+npm install @jskit-ai/auth-provider-oidc-core @jskit-ai/auth-web
+npm run db:migrate
+```
+
+The migration adds `auth_oidc_clients`, `auth_oidc_sessions` and
+`auth_oidc_logout_tokens`. Existing local tables are left alone; move the
+accounts first (below) if the app already has people.
+
+## Env
+
+| Name | Meaning |
+|---|---|
+| `AUTH_OIDC_ISSUER` | The issuer address. Its discovery document supplies everything else. |
+| `AUTH_OIDC_REGISTRATION_TOKEN` | Preferred. The app registers itself with the issuer, once per address. |
+| `AUTH_OIDC_CLIENT_ID` / `AUTH_OIDC_CLIENT_SECRET` | For issuers without self-registration. Use these **instead of** the token, never both. |
+| `AUTH_OIDC_LABEL` | Button label. Default "Continue with your account". |
+| `AUTH_OIDC_SESSION_SECRET` | Required in production, at least 32 characters. In development it is generated in `.jskit/auth/oidc-session.secret`. |
+| `APP_PUBLIC_URL` | The address people use. With it the app registers at start; without it, on the first sign-in from a new address. Required in production behind a proxy that is not on the same machine. |
+
+Addresses must be `https`, or `http` on `localhost`/loopback. Without
+`AUTH_OIDC_ISSUER` the app still starts; pressing the button brings the person
+back to the login page with "Sign-in is not set up yet: AUTH_OIDC_ISSUER is
+missing." Every sign-in that cannot start is explained there the same way.
+
+Never invent either value or copy it into source. If the host keeps saved
+values (an editor's saved keys, a deployment secret store), link these two
+variables to the hub's saved address and token instead of pasting them, in
+development and in production.
+
+The issuer must be reachable from the app's server and from the person's
+browser. A hub that runs only on another computer's `localhost` (for example in
+another project's development preview) is not; connect apps to the deployed hub.
+
+## What the issuer is told
+
+When registering, the app sends:
+
+| Field | Value |
+|---|---|
+| `redirect_uris` | `<address>/auth/login` (`AUTH_OIDC_REDIRECT_PATH`) |
+| `post_logout_redirect_uris` | `<address>/` |
+| `backchannel_logout_uri` | `<address>/api/auth/oidc/backchannel-logout` |
+| `token_endpoint_auth_method` | `client_secret_basic` |
+| `grant_types` / `response_types` | `authorization_code` / `code` |
+
+Scopes are `openid email profile`. A static client must be registered with the
+same redirect URI.
+
+An accounts hub decides what a new address may do. Development addresses work
+at once. A production address waits until the hub's owner approves it on the
+hub's Apps page; until then, signing in shows the hub's own waiting page. A
+blocked address cannot register, and the login page says "Your accounts hub has
+blocked this app's address."
+
+## Signing in
+
+The login page shows one button. Unframed, it goes to the issuer and comes back
+to `/auth/login`, then to the page the person started from. Inside a frame,
+such as an editor Preview, the issuer cannot be shown, so the button opens a
+pop-up window instead; when the pop-up finishes, it closes and the framed page
+reloads signed in. If the browser blocks the pop-up the page says so.
+
+Each attempt is bound to the browser that started it by a sealed ten-minute
+cookie and checked with PKCE, `state`, `nonce` and the issuer's `iss`; a stale
+or foreign attempt reads "This sign-in took too long or started in another
+browser. Start again."
+
+The first sign-in creates the `users` row (`auth_provider` `oidc`,
+`auth_provider_user_sid` the issuer's subject) with the email and name.
+Apps trust that email (invitations match it), so when the issuer says
+`email_verified: false` the sign-in stops with "Your account provider has not
+confirmed your email address yet." An accounts hub never sends an unconfirmed
+email; it asks the person to confirm first.
+
+## Signing out
+
+- Ordinary sign-out ends the app session only.
+- `/api/auth/oidc/logout?everywhere=1` (a same-site link) also ends the issuer
+  session and returns to `/`.
+- The issuer can end app sessions itself: disabling an account in the hub posts
+  a signed logout token to the back-channel URI, and the person's sessions in
+  this app end at once.
+
+## Preview identity
+
+Keep the standard managed-preview login (`tools/preview-identity`, see
+[Authentication](/guide/app-setup/authentication)). It signs the Preview in as
+an existing `users` row without visiting the issuer, so tests do not need a
+hub account. It cannot create users.
+
+## Move existing local accounts
+
+Only with the app owner's explicit yes. On the app (local provider still
+installed):
+
+```bash
+npx jskit-oidc-sign-in export-local-accounts --out accounts.jsonl
+```
+
+This writes one JSON line per account, readable only by you, and refuses to
+overwrite a file. Import that file into the hub (`jskit-oidc-issuer
+import-accounts`, see the hub guide). Then switch the provider as above and
+mark the same people as hub accounts:
+
+```bash
+npx jskit-oidc-sign-in adopt-oidc --issuer "$AUTH_OIDC_ISSUER" --in accounts.jsonl
+npx jskit-oidc-sign-in adopt-oidc --issuer "$AUTH_OIDC_ISSUER" --in accounts.jsonl --apply
+```
+
+The first run only counts what would change; `--apply` changes it. Ids stay the
+same, so existing data keeps its owners. Delete `accounts.jsonl` afterwards: it
+contains password hashes.
+
+## Verification
+
+- Sign in unframed and in the Preview; refresh stays signed in.
+- Sign out, then sign out everywhere.
+- Disable the account in the hub and confirm the app session ends.
+- Preview identity still signs in.

package/guide/agent/app-setup/upgrading-jskit.md

@@ -189,6 +189,19 @@ Commit `package.json`, every changed workspace manifest, and
 updater succeeds; select a different published cohort only through a catalog
 that advertises it.
 
+## Host-only production cookies
+
+In production (`NODE_ENV=production`, served over HTTPS) the session cookies of
+the local, Supabase and OIDC auth providers and the CSRF secret cookie use the
+`__Host-` prefix, for example `__Host-jskit_local_access_token` and
+`__Host-_csrf`. Browsers accept these only with `Secure`, `Path=/` and no
+`Domain`, so a sibling subdomain cannot plant or overwrite them. The first
+production deploy after updating signs everyone out once. Development and tests
+keep the unprefixed names.
+Setting `AUTH_CSRF_COOKIE_SECURE=false` keeps the unprefixed CSRF cookie for an
+application deliberately served over plain HTTP. CSRF protection is still the
+token check on every unsafe request; the prefix only hardens the cookie.
+
 ## Read cancellation and deadlines
 
 The standard endpoint, list, view, form-read, and CRUD read composables pass

package/guide/agent/framework/application-operations.md

@@ -90,6 +90,9 @@ the npm installation.
 
 Do not add auth, users, workspaces, console, sample data, databases, or AI
 capabilities unless the product choice requires them.
+When accounts are required, `auth/auth-surface` includes the managed-preview
+login as standard: add `tools/preview-identity` and its `#### Preview identity`
+Outputs block together with the rest of the surface.
 
 ## Author database-backed CRUD
 

package/guide/agent/framework/ui-operations.md

@@ -55,6 +55,17 @@ shared-screen controls; avoid duplicates, drawer-only access, or adding a page
 heading just to house it. Keep its meaning and accessible name clear at every
 supported width.
 
+### Scroll position
+
+`createShellRouter()` from `@jskit-ai/kernel/client` installs
+`shellScrollBehavior` by default: a new screen opens at the top (or at its
+hash target), Back/Forward restore the saved position, and query, hash, tab or
+sub-view changes within the same page keep the current position. A tab or
+sub-view counts as the same page when both locations share a parent page record
+below the surface root. Pass `scrollBehavior` to `createShellRouter()` to
+replace it with your own Vue Router function, or `scrollBehavior: false` to
+disable it. Do not wrap the router or reset scroll in page components.
+
 ## Application-owned files
 
 Pattern source is ordinary customizable application source. When replacing a
@@ -93,6 +104,19 @@ icon/label and label/end gaps. The normal 80px rail centres 48px targets;
 `railWidth` and `drawerWidth` are public density/width controls. Do not override
 the shell's private implementation CSS.
 
+The app bar, drawer/rail and compact bottom navigation follow the Vuetify theme
+and expose restyling tokens instead of hard-coded chrome: `--shell-chrome-border-width`
+and `--shell-chrome-border-color` for the shared dividers,
+`--shell-app-bar-border-width`, `--shell-navigation-border-width` and
+`--shell-bottom-navigation-border-width` per edge, and
+`--shell-app-bar-background`, `--shell-navigation-background` and
+`--shell-bottom-navigation-background` for the surfaces. The defaults keep one
+thin divider on each separating edge, because Vuetify's default themes define
+no Material 3 surface-container roles to separate surfaces tonally. A Material 3
+restyle sets the border widths to `0` and gives navigation a tonal surface, for
+example `--shell-navigation-background: rgb(var(--v-theme-surface-container-low))`
+when the theme defines that role.
+
 ## Browser verification
 
 Exercise user-facing changes with Playwright at compact, medium, and expanded

package/guide/agent/index.md

@@ -14,6 +14,8 @@ apply or adapt. It does not prescribe an agent host or project orchestrator.
 - [Migrate an existing application](/guide/app-setup/existing-application-migration)
 - [A more interesting shell](/guide/app-setup/a-more-interesting-shell)
 - [Authentication](/guide/app-setup/authentication)
+- [Sign in through an OIDC issuer](/guide/app-setup/sign-in-through-oidc-issuer)
+- [Run an accounts hub](/guide/app-setup/run-an-accounts-hub)
 - [Database layer](/guide/app-setup/database-layer)
 - [Users](/guide/app-setup/users)
 - [Multi-homing](/guide/app-setup/multi-homing)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/agent-docs",
-  "version": "0.1.238",
+  "version": "0.1.240",
   "description": "Distributed JSKIT agent references, prompts, guides, and generated reference maps.",
   "type": "module",
   "files": [

package/patterns/feature-package/example/booking-engine/package.json

@@ -5,7 +5,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/kernel": "0.1.244",
+    "@jskit-ai/kernel": "0.1.245",
     "json-rest-schema": "^1.0.17"
   },
   "exports": {

package/patterns/minimal-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.1.244",
+    "@jskit-ai/kernel": "0.1.245",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.8.5",
     "json-rest-schema": "^1.0.17",
@@ -42,13 +42,13 @@
     "vue": "^3.5.44",
     "vue-router": "^5.3.1",
     "vuetify": "^4.1.2",
-    "@jskit-ai/http-runtime": "0.1.242",
+    "@jskit-ai/http-runtime": "0.1.243",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.241",
-    "@jskit-ai/jskit-catalog": "0.1.291",
+    "@jskit-ai/jskit-catalog": "0.1.293",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.1.244",
+    "@jskit-ai/kernel": "0.1.245",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.8.5",
     "json-rest-schema": "^1.0.17",
@@ -42,15 +42,15 @@
     "vue": "^3.5.44",
     "vue-router": "^5.3.1",
     "vuetify": "^4.1.2",
-    "@jskit-ai/http-runtime": "0.1.242",
+    "@jskit-ai/http-runtime": "0.1.243",
     "@mdi/js": "^7.4.47",
-    "@jskit-ai/shell-web": "0.1.249",
+    "@jskit-ai/shell-web": "0.1.250",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.241",
-    "@jskit-ai/jskit-catalog": "0.1.291",
+    "@jskit-ai/jskit-catalog": "0.1.293",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/packages/main/package.json

@@ -9,7 +9,7 @@
   },
   "description": "App-local runtime composition and lightweight glue.",
   "dependencies": {
-    "@jskit-ai/kernel": "0.1.244"
+    "@jskit-ai/kernel": "0.1.245"
   },
   "jskit": {
     "kind": "runtime",

package/reference/autogen/KERNEL_MAP.md

@@ -141,6 +141,7 @@ Exports
 - `resolveAllowedOriginsFromSurfaceDefinitions(surfaceDefinitions = {}, { seedOrigins = [] } = {})`
 - `resolveAllowedOriginsFromPlacementContext(contextValue = null, { includeWindowOrigin = true } = {})`
 Local functions
+- `staysOnSameOrigin(path)`
 - `appendNormalizedOrigin(origins, value)`
 - `normalizeBlockedPathnames(blockedPathnames = [])`