@jskit-ai/agent-docs 0.1.282 → 0.1.284

package/skills/jskit/references/multi-homing.md

@@ -110,14 +110,25 @@ The package migrations create and own these tables:
 | `workspace_invites` | `workspace_id`, `email`, `role_sid`, `status`, `token_hash`, `invited_by_user_id`, `expires_at`, `accepted_at`, `revoked_at` |
 
 Application records that belong to a workspace use a non-null `workspace_id`
-foreign key to `workspaces.id`. Read and change these tables through the
-`workspaces.core` repositories and services, not directly.
+foreign key to `workspaces.id`. Read and change these tables through their
+owners' capabilities (`workspaces`, `workspaces.memberships` and
+`workspaces.core`, below), not directly.
 
 ## Server composition
 
 Use `workspaces/workspace-server` for role vocabulary, creation policy,
 invitations, settings, and app-owned invitation email rendering.
 
+Two server settings are required, and the server refuses to start without
+them: whether new workspaces accept invitations, and how long an invitation
+lasts.
+
+```js
+// config/server.js
+config.workspaceSettings = { defaults: { invitesEnabled: true } };
+config.workspaceMembers = { defaults: { inviteExpiresInMs: 7 * 24 * 60 * 60 * 1000 } };
+```
+
 Workspace scope must reach repository queries. Parsing a workspace slug or
 hiding an admin link is not authorization. Membership and role checks happen
 before an operation discloses records or record existence.
@@ -125,14 +136,12 @@ before an operation discloses records or record existence.
 ### Workspace-scoped features and routes
 
 For a standard CRUD resource owned by a workspace, give its table the
-`workspace_id` column, set the resource's `autofilter: "workspace"`, and bind
-`defineCrudJsonApiFeature()` with `ownershipFilter: "workspace"` and `scope:
-WORKSPACE_CRUD_SCOPE` (from `@jskit-ai/workspaces-core/server/support/workspaceCrud`)
-on a workspace surface. JSKIT then filters `workspaceId` by the workspace in the
-route. A repository method you add reads the workspace id with
-`resolveWorkspaceScopeValue(options.context)`
-(`@jskit-ai/json-rest-api-core/server/jsonRestApiHost`), which throws when the
-context names two workspaces.
+`workspace_id` column, set its table resource's `ownership: "workspace"`, and bind
+`defineCrudFeature()` with `scope: WORKSPACE_CRUD_SCOPE` (from
+`@jskit-ai/workspaces-core/server/support/workspaceCrud`) on a workspace
+surface. JSKIT then filters `workspaceId` by the workspace in the route. A
+repository method you add passes the call's `options` on to the table's handle,
+which scopes every read and write to the context's workspace.
 `workspace_user` also filters by the signed-in user. See the CRUD operations
 guide.
 
@@ -175,9 +184,29 @@ capability provides:
 | `workspaces.services.members` | Members, roles and invitations |
 | `workspaces.services.pendingInvitations` | Invitation resolution, redemption and acceptance participants |
 | `workspaces.services.settings` | Workspace settings |
-| `workspaces.repositories.workspaces`, `.workspaceMemberships`, `.workspaceSettings`, `.workspaceInvites` | Repository access inside the application's own transactions |
+| `workspaces.repositories.workspaceSettings`, `.workspaceInvites` | Settings and invitation records inside the application's own transactions |
 | `workspaces.tenancyProfile` | The resolved tenancy mode and workspace policy |
 
+The workspaces and their memberships are their own capabilities, for code that
+reads or changes them inside its own transactions, typed `Workspaces` and
+`WorkspacesMemberships` in `@jskit-ai/workspaces-core/server/types`. Every
+method takes the call's `options` last and joins the transaction of the
+`txOptions` it is given.
+
+| Capability | Methods |
+| --- | --- |
+| `workspaces` | `findById(id, options)`, `findBySlug(slug, options)` (a deleted workspace is not found, though its slug stays taken), `listSlugsIn`, `findPersonalByOwnerUserId`, `listForUserId(userId, options)`, `insert`, `updateById`, `lock(workspaceId, options)` |
+| `workspaces.memberships` | `findByWorkspaceIdAndUserId`, `ensureOwnerMembership`, `upsertMembership(workspaceId, userId, patch, options)`, `addMember({ workspaceId, userId, roleSid }, options)`, `activeMemberIds(workspaceId, options)`, `listActiveByWorkspaceId`, `findActiveByWorkspaceIdAndUserId`, `listActiveWorkspaceIdsByUserId`, `listActiveWorkspaceIdsByUserIds` |
+
+`addMember` makes the user an active member with the role (`member` when none
+is given), adding the membership or reactivating it. `activeMemberIds` answers
+the active members' user ids at the same cost however many members there
+are, without including their profiles. `lock` takes
+the workspace's row lock until the caller's transaction ends, so work that must
+not interleave for one workspace takes turns; it runs only inside a
+transaction, given its `txOptions`, and answers `{ id }`, or `null` when there
+is no such workspace.
+
 To check one person's membership, for example a notification recipient, call
 `workspaces.services.members.getMember(workspace, userId, options)`. It answers
 that member's `listMembers` entry, or `null` for a removed or unknown member,
@@ -225,8 +254,8 @@ workspace routes, `workspaces-web` switches Vuetify to the `workspace-light` or
 colours. Other routes use the application's themes.
 
 New workspaces start from JSKIT's blue palette unless `config/server.js` sets
-the application's own. Missing fields keep JSKIT's values; an invalid colour
-stops the server at startup:
+the application's own beside the required `invitesEnabled`. Missing colours
+keep JSKIT's values; an invalid colour stops the server at startup:
 
 ```js
 // config/server.js
@@ -301,11 +330,11 @@ authorization and role checks. Do not pass arbitrary HTTP input as options.
 
 | Capability method | Contract |
 | --- | --- |
-| `workspaces.repositories.workspaceInvites.withTransaction(work)` | Delegates to the same JSON REST API's managed `transaction(work)`; awaits commit and completion hooks before resolving. Runs `work` again when the database aborts it as a deadlock victim (see [Database layer](https://mobily-enterprises.github.io/jskit-ai/guide/app-setup/database-layer#deadlock-retries)). |
-| `workspaces.repositories.workspaceInvites.lockWorkspaceForInvitations(workspaceId, { trx })` | Locks the workspace before application receipt/draft rows when composing preparation. Requires an active transaction. |
-| `workspaces.services.members.prepareInvite(workspace, actor, payload, options)` | Requires a managed `options.trx`. Validates the invitation role, replaces pending invitations for that workspace/email, and returns `{ createdInviteId, inviteTokenPreview }`. Never sends. |
-| `workspaces.services.members.sendInvite(workspace, actor, prepared, options)` | Requires no `options.trx`. Reloads the committed pending invitation and workspace display data, validates expiry and token correspondence, and sends that invitation without replacement. |
-| `workspaces.services.members.createInvite(workspace, actor, payload, options)` | Owns preparation and commit, then calls `sendInvite`, and answers with `sendInvite`'s result as JSON:API data (`returnJsonApiData`, read it from `.value`), as the invite action sends it. Rejects `options.trx`. |
+| `workspaces.repositories.workspaceInvites.withTransaction(options, (txOptions) => …)` | The invitations handle's `withTransaction`: joins the caller's transaction or opens one and hands `work` the `txOptions` to pass on; awaits commit and completion hooks before resolving. Runs `work` again when the database aborts it as a deadlock victim (see [data access](https://mobily-enterprises.github.io/jskit-ai/guide/framework/data-access#transactions)). `{ ...options, outermost: true }` refuses a call that already runs inside one. |
+| `workspaces.lock(workspaceId, txOptions)` (capability `workspaces`) | Locks the workspace before application receipt/draft rows when composing preparation. Requires an active transaction. |
+| `workspaces.services.members.prepareInvite(workspace, actor, payload, txOptions)` | Runs only inside a transaction, given its `txOptions`. Validates the invitation role, replaces pending invitations for that workspace/email, and returns `{ createdInviteId, inviteTokenPreview }`. Never sends. |
+| `workspaces.services.members.sendInvite(workspace, actor, prepared, options)` | Refuses to run inside a transaction: it delivers after the preparation's transaction commits. Reloads the committed pending invitation and workspace display data, validates expiry and token correspondence, and sends that invitation without replacement. |
+| `workspaces.services.members.createInvite(workspace, actor, payload, options)` | Owns preparation and commit, then calls `sendInvite`, and answers with `sendInvite`'s result as JSON:API data (`returnJsonApiData`, read it from `.value`), as the invite action sends it. Refuses to run inside a transaction. |
 | `workspaces.invite-acceptance-participant` (optional capability) | One application function receiving `({ invite, user }, options)` inside the acceptance transaction. Without it, acceptance activates the membership only. |
 
 `sendInvite` accepts `{ createdInviteId, inviteTokenPreview }` from preparation or
@@ -344,21 +373,20 @@ setup: ({ reviewedPeople, people, scopes, audit }) => ({
 })
 
 // Inside an authorized application command, in a feature that requires
-// workspaces: "workspaces.core":
+// workspaces: "workspaces.core" and workspaceRecords: "workspaces":
 const { members } = workspaces.services;
 const invites = workspaces.repositories.workspaceInvites;
-const prepared = await invites.withTransaction(async (trx) => {
-  const options = { trx, context };
+const prepared = await invites.withTransaction({ context }, async (txOptions) => {
   // Match acceptance's order: workspace, then application draft/receipt rows.
-  await invites.lockWorkspaceForInvitations(workspace.id, options);
-  const reviewed = await reviewedPeople.lockAuthorizedDraft(draftId, workspace.id, actor, options);
-  const receipt = await reviewedPeople.findMatchingReceipt(reviewed, requestId, options);
+  await workspaceRecords.lock(workspace.id, txOptions);
+  const reviewed = await reviewedPeople.lockAuthorizedDraft(draftId, workspace.id, actor, txOptions);
+  const receipt = await reviewedPeople.findMatchingReceipt(reviewed, requestId, txOptions);
   if (receipt) return { createdInviteId: receipt.inviteId };
   const created = await members.prepareInvite(workspace, actor, {
     email: reviewed.email,
     roleSid: reviewed.roleSid
-  }, options);
-  await reviewedPeople.associateInvitationAndSaveReceipt(reviewed, requestId, created.createdInviteId, options);
+  }, txOptions);
+  await reviewedPeople.associateInvitationAndSaveReceipt(reviewed, requestId, created.createdInviteId, txOptions);
   return { createdInviteId: created.createdInviteId };
 });
 
@@ -401,8 +429,8 @@ exactly once. Revocation after sending starts cannot recall a message.
 Register one callback during feature setup to call the required application
 services. Non-functions throw `TypeError`; duplicate registration throws, and
 registration closes when acceptance/refusal first begins. The callback's invite,
-user and options are shallow frozen. JSKIT owns the transaction and passes its
-`trx` and request `context` to the callback.
+user and options are shallow frozen. JSKIT owns the transaction and passes the
+callback the `txOptions` that carry it and the request's `context`.
 
 Acceptance checks authentication, recipient email, pending state and expiry under
 workspace/invitation locks. Before calling the participant, it activates membership
@@ -420,8 +448,8 @@ callback must not commit, roll back, create transactions/savepoints or perform
 external effects. Participant and later invitation-status failures roll back
 membership (including its previous role/status), person/training links, scopes,
 audit and accepted status. Invalid invitations and refusals do not call the
-participant. Acceptance/refusal reject borrowed `options.trx`; revocation can
-join a managed transaction or create one.
+participant. Acceptance and refusal refuse to run inside the caller's
+transaction; revocation can join one or open its own.
 
 Acceptance/refusal return 401 for unauthenticated access, 403 for a recipient
 email mismatch and 404 for a missing or handled invitation. A matching recipient's
@@ -435,7 +463,7 @@ Preserve `error.transactionOutcome` and `error.cause`: `rolledBack` confirms
 rollback, `committed` can accompany a failed completion hook, and `unknown`
 requires resolving the outcome before retrying. Errors after commit cannot undo
 persistence. See
-[managed transaction guidance](existing-application-migration.md#json-rest-v2-integration).
+[managed transaction guidance](existing-application-migration.md#data-access-on-table-resources-json-rest-api-3).
 
 Invitation mutations lock workspace before invitation rows. A losing acceptance,
 refusal, revocation or replacement cannot overwrite accepted/revoked state.
@@ -494,7 +522,41 @@ Workspace surfaces put the slug in their pages root, such as
 `w/[workspaceSlug]/admin` for administration. Keep the default surface
 (`surfaceDefaultId`, usually `home`) free of a workspace requirement: `/`,
 invitation links and other unscoped pages belong to it. With
-`webRootAllowed: "no"`, `/` opens that surface's root.
+`webRootAllowed: "no"`, `/` opens that surface's root. The foundation
+defines `home` and its `public` access policy, and the `auth/auth-surface`
+pattern the `auth` surface; the workspace surfaces add a policy and two
+definitions:
+
+```js
+// config/surfaceAccessPolicies.js
+surfaceAccessPolicies.workspace_member = { requireAuth: true, requireWorkspaceMembership: true };
+
+// config/public.js
+config.surfaceDefinitions.app = {
+  id: "app",
+  label: "App",
+  pagesRoot: "w/[workspaceSlug]",
+  requiresAuth: true,
+  requiresWorkspace: true,
+  accessPolicyId: "workspace_member"
+};
+config.surfaceDefinitions.admin = {
+  id: "admin",
+  label: "Admin",
+  pagesRoot: "w/[workspaceSlug]/admin",
+  requiresAuth: true,
+  requiresWorkspace: true,
+  accessPolicyId: "workspace_member"
+};
+```
+
+An access policy takes `requireAuth`, `requireWorkspaceMembership`,
+`requireAnyPermissions` and `requireAllPermissions` (permission lists), and
+`requireFlagsAny` and `requireFlagsAll` (flags the server's bootstrap sets in
+`surfaceAccess`). Without `requireAuth` or `requireWorkspaceMembership` it
+takes the surface's `requiresAuth` or `requiresWorkspace`. The browser applies
+the whole policy; the server reads only `requireWorkspaceMembership: false`
+from it, and a route's own `auth` and `permission` authorize it there.
 
 `workspaces-web` remembers the last workspace each person opened in this
 browser. The **Your workspaces** page, `WorkspacesClientElement` from

package/skills/jskit/references/pattern-index.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.282`
+- Owner: `@jskit-ai/agent-docs@0.1.284`
 - Read: [PATTERN.md](patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.282`
+- Owner: `@jskit-ai/agent-docs@0.1.284`
 - Read: [PATTERN.md](patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.2.29`
+- Owner: `@jskit-ai/assistant-runtime@0.2.30`
 - Read: [PATTERN.md](patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -48,7 +48,7 @@ Run one OpenID Connect sign-in for all of an owner's apps as its own JSKIT proje
 
 - Id: `auth/accounts-hub`
 - Keywords: `accounts hub`, `auth`, `authentication`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/oidc-issuer-core@0.1.21`
+- Owner: `@jskit-ai/oidc-issuer-core@0.1.22`
 - Read: [PATTERN.md](patterns/auth/accounts-hub/PATTERN.md)
 - Examples: [example/](patterns/auth/accounts-hub/example/)
 - Requires: `@jskit-ai/oidc-issuer-core`
@@ -59,7 +59,7 @@ Compose JSKIT authentication routes, views, profile controls, and public surface
 
 - Id: `auth/auth-surface`
 - Keywords: `account`, `auth`, `login`, `logout`, `password`, `placement`, `profile`, `reset`, `surface`
-- Owner: `@jskit-ai/auth-web@0.2.18`
+- Owner: `@jskit-ai/auth-web@0.2.19`
 - Read: [PATTERN.md](patterns/auth/auth-surface/PATTERN.md)
 - Examples: [example/](patterns/auth/auth-surface/example/)
 - Requires: `@jskit-ai/auth-core`, `@jskit-ai/auth-web`, `@jskit-ai/shell-web`
@@ -70,7 +70,7 @@ Let people sign in with the accounts they already have in an accounts hub or ano
 
 - Id: `auth/oidc-sign-in`
 - Keywords: `accounts hub`, `auth`, `authentication`, `back-channel logout`, `dynamic client registration`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.20`
+- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.21`
 - Read: [PATTERN.md](patterns/auth/oidc-sign-in/PATTERN.md)
 - Examples: [example/](patterns/auth/oidc-sign-in/example/)
 - Requires: `@jskit-ai/auth-provider-oidc-core`, `@jskit-ai/auth-web`
@@ -81,7 +81,7 @@ Add Supabase authentication through normal npm composition, explicit environment
 
 - Id: `auth/supabase-auth`
 - Keywords: `auth`, `authentication`, `oauth`, `sessions`, `supabase`
-- Owner: `@jskit-ai/auth-provider-supabase-core@0.2.15`
+- Owner: `@jskit-ai/auth-provider-supabase-core@0.2.16`
 - Read: [PATTERN.md](patterns/auth/supabase-auth/PATTERN.md)
 - Examples: [example/](patterns/auth/supabase-auth/example/)
 - Requires: `@jskit-ai/auth-provider-supabase-core`
@@ -92,7 +92,7 @@ Resolve an administrator environment key or an individual user's grant, then use
 
 - Id: `connectors/ai-connections`
 - Keywords: `ai`, `api-key`, `cli`, `environment`, `free`, `models`, `ownership`, `zai`, `zen`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/ai-connections/PATTERN.md)
 - Examples: [example/](patterns/connectors/ai-connections/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -103,7 +103,7 @@ Compose provider operations, authorization and encrypted file storage from a CLI
 
 - Id: `connectors/api-key-connection`
 - Keywords: `api-key`, `clay`, `cli`, `clickhouse`, `connectors`, `dbt`, `files`, `firecrawl`, `granola`, `integrations`, `metrics`, `prestashop`, `resend`, `semantic-layer`, `semrush`, `x-twitter`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/api-key-connection/PATTERN.md)
 - Examples: [example/](patterns/connectors/api-key-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -114,7 +114,7 @@ Compose token-based MCP discovery and explicitly authorized tool calls using the
 
 - Id: `connectors/assistant-mcp`
 - Keywords: `assistant`, `cli`, `connectors`, `files`, `integrations`, `mcp`, `n8n`, `sanity`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/assistant-mcp/PATTERN.md)
 - Examples: [example/](patterns/connectors/assistant-mcp/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -125,7 +125,7 @@ Configure assistant OAuth clients, then compose existing state, encrypted file g
 
 - Id: `connectors/assistant-mcp-oauth`
 - Keywords: `amplitude`, `assistant`, `atlassian`, `canva`, `cli`, `client metadata`, `confidence`, `connectors`, `figma`, `files`, `granola`, `hex`, `mcp`, `miro`, `oauth`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/assistant-mcp-oauth/PATTERN.md)
 - Examples: [example/](patterns/connectors/assistant-mcp-oauth/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -136,7 +136,7 @@ Compose signed AWS operations, file configuration and application authorization
 
 - Id: `connectors/aws-storage-queries`
 - Keywords: `athena`, `aws`, `cli`, `connectors`, `files`, `iam`, `queries`, `s3`, `storage`, `sts`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/aws-storage-queries/PATTERN.md)
 - Examples: [example/](patterns/connectors/aws-storage-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -147,7 +147,7 @@ Compose reusable connection libraries with portable configuration, application o
 
 - Id: `connectors/calendar-cli`
 - Keywords: `calendar`, `cli`, `connectors`, `google`, `integrations`, `oauth`, `permissions`
-- Owner: `@jskit-ai/connector-google-calendar@0.2.14`
+- Owner: `@jskit-ai/connector-google-calendar@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/calendar-cli/PATTERN.md)
 - Examples: [example/](patterns/connectors/calendar-cli/example/)
 - Requires: `@jskit-ai/connector-google-calendar`, `@jskit-ai/connectors-core`, `@jskit-ai/database-runtime-mysql`
@@ -158,7 +158,7 @@ Compose the shared connector runtime for event delivery while leaving workflow c
 
 - Id: `connectors/event-delivery`
 - Keywords: `cli`, `connectors`, `events`, `files`, `inngest`, `integrations`, `workflows`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/event-delivery/PATTERN.md)
 - Examples: [example/](patterns/connectors/event-delivery/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -169,7 +169,7 @@ Wire service-account grants, file storage, explicit message actions and public b
 
 - Id: `connectors/firebase-messaging`
 - Keywords: `cli`, `connectors`, `fcm`, `files`, `firebase`, `integrations`, `jwt`, `notifications`, `push`, `service-account`, `vapid`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/firebase-messaging/PATTERN.md)
 - Examples: [example/](patterns/connectors/firebase-messaging/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -180,7 +180,7 @@ Compose reviewed Search campaigns with project-owned Google OAuth and portable s
 
 - Id: `connectors/google-ads-search`
 - Keywords: `ads`, `campaigns`, `cli`, `connectors`, `conversion`, `google`, `search`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/google-ads-search/PATTERN.md)
 - Examples: [example/](patterns/connectors/google-ads-search/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -191,7 +191,7 @@ Compose provider consent, verification and encrypted file persistence from an ap
 
 - Id: `connectors/oauth-connection`
 - Keywords: `accounting`, `assistant permissions`, `books`, `cli`, `client credentials`, `connectors`, `consent`, `crm`, `databricks`, `developer token`, `fabric`, `files`, `gaql`, `google ads`, `graphql`, `integrations`, `linkedin`, `microsoft`, `oauth`, `powerpoint`, `salesforce`, `service principal`, `shopify`, `soql`, `staffing`, `tiktok`, `twitch`, `wave`, `word`, `wordpress`, `workday`, `xero`, `zoho`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/oauth-connection/PATTERN.md)
 - Examples: [example/](patterns/connectors/oauth-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -202,7 +202,7 @@ Compose a sequential catalogue batch and preserve partial success for applicatio
 
 - Id: `connectors/paddle-catalogue`
 - Keywords: `batch`, `paddle`, `payments`, `prices`, `products`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/paddle-catalogue/PATTERN.md)
 - Examples: [example/](patterns/connectors/paddle-catalogue/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -213,7 +213,7 @@ Resolve a publishable image key deliberately and use the shared URL library in a
 
 - Id: `connectors/public-image`
 - Keywords: `cli`, `connectors`, `files`, `images`, `integrations`, `logo-dev`, `public-key`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/public-image/PATTERN.md)
 - Examples: [example/](patterns/connectors/public-image/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -224,7 +224,7 @@ Compose file configuration, Redshift Data API operations and application query o
 
 - Id: `connectors/redshift-queries`
 - Keywords: `aws`, `cli`, `connectors`, `files`, `iam`, `provisioned`, `redshift`, `serverless`, `sql`, `warehouse`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/redshift-queries/PATTERN.md)
 - Examples: [example/](patterns/connectors/redshift-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -235,7 +235,7 @@ Use the shared scanner runtime from a CLI or a host worker with portable configu
 
 - Id: `connectors/source-scanning`
 - Keywords: `cancellation`, `cli`, `connectors`, `integrations`, `scanning`, `security`, `source`, `wiz`, `worker`
-- Owner: `@jskit-ai/connectors-catalog@0.2.14`
+- Owner: `@jskit-ai/connectors-catalog@0.2.15`
 - Read: [PATTERN.md](patterns/connectors/source-scanning/PATTERN.md)
 - Examples: [example/](patterns/connectors/source-scanning/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -246,43 +246,43 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.240`
+- Owner: `@jskit-ai/console-web@0.1.241`
 - Read: [PATTERN.md](patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
 
-## CRUD list, view, create, and edit screens
+## Owner-scoped CRUD contract
 
-Build a routed CRUD user interface as thin application pages over JSKIT's shared screen components and composables.
+Define an application table resource whose records belong to the current user, and the authenticated CRUD contract that serves it.
 
-- Id: `crud/crud-screen-set`
-- Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.2.21`
-- Read: [PATTERN.md](patterns/crud/crud-screen-set/PATTERN.md)
-- Examples: [example/](patterns/crud/crud-screen-set/example/)
-- Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-crud-core`
+- Id: `crud/crud-contract`
+- Keywords: `authenticated`, `crud`, `database`, `owner-scoped`, `resource`, `table`, `user`
+- Owner: `@jskit-ai/resource-crud-core@0.1.205`
+- Read: [PATTERN.md](patterns/crud/crud-contract/PATTERN.md)
+- Examples: [example/](patterns/crud/crud-contract/example/)
+- Requires: `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
 
-## JSON API CRUD resource package
+## CRUD feature package
 
-Build a complete application-owned CRUD server package from a migration, resource contract, and one framework module declaration.
+Build a complete application-owned CRUD server package from a migration, a table resource with its CRUD contract, and one framework module declaration.
 
-- Id: `crud/json-api-resource-package`
-- Keywords: `actions`, `crud`, `database`, `json-api`, `migration`, `permissions`, `provider`, `repository`, `routes`, `service`
-- Owner: `@jskit-ai/crud-core@0.2.14`
-- Read: [PATTERN.md](patterns/crud/json-api-resource-package/PATTERN.md)
-- Examples: [example/](patterns/crud/json-api-resource-package/example/)
-- Requires: `@jskit-ai/crud-core`, `@jskit-ai/resource-crud-core`
+- Id: `crud/crud-feature-package`
+- Keywords: `actions`, `crud`, `database`, `defineCrudFeature`, `json-api`, `migration`, `owns`, `permissions`, `repository`, `routes`, `service`, `table resource`
+- Owner: `@jskit-ai/crud-core@0.2.15`
+- Read: [PATTERN.md](patterns/crud/crud-feature-package/PATTERN.md)
+- Examples: [example/](patterns/crud/crud-feature-package/example/)
+- Requires: `@jskit-ai/crud-core`, `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
 
-## Owner-scoped CRUD resource contract
+## CRUD list, view, create, and edit screens
 
-Define an authenticated application resource whose records belong to the current user.
+Build a routed CRUD user interface as thin application pages over JSKIT's shared screen components and composables.
 
-- Id: `crud/resource-contract`
-- Keywords: `authenticated`, `crud`, `database`, `owner-scoped`, `resource`, `user`
-- Owner: `@jskit-ai/resource-crud-core@0.1.204`
-- Read: [PATTERN.md](patterns/crud/resource-contract/PATTERN.md)
-- Examples: [example/](patterns/crud/resource-contract/example/)
-- Requires: `@jskit-ai/resource-crud-core`
+- Id: `crud/crud-screen-set`
+- Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
+- Owner: `@jskit-ai/http-web@0.2.22`
+- Read: [PATTERN.md](patterns/crud/crud-screen-set/PATTERN.md)
+- Examples: [example/](patterns/crud/crud-screen-set/example/)
+- Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
 
 ## MySQL application database
 
@@ -290,7 +290,7 @@ Configure a JSKIT application for MySQL with a fixed driver, ordinary environmen
 
 - Id: `database/mysql-application`
 - Keywords: `database`, `knex`, `mariadb`, `migrations`, `mysql`, `mysql2`
-- Owner: `@jskit-ai/database-runtime-mysql@0.1.260`
+- Owner: `@jskit-ai/database-runtime-mysql@0.1.261`
 - Read: [PATTERN.md](patterns/database/mysql-application/PATTERN.md)
 - Examples: [example/](patterns/database/mysql-application/example/)
 - Requires: `@jskit-ai/database-runtime-mysql`
@@ -301,18 +301,29 @@ Configure a JSKIT application for PostgreSQL with a fixed driver, ordinary envir
 
 - Id: `database/postgres-application`
 - Keywords: `database`, `knex`, `migrations`, `pg`, `postgres`, `postgresql`
-- Owner: `@jskit-ai/database-runtime-postgres@0.1.259`
+- Owner: `@jskit-ai/database-runtime-postgres@0.1.260`
 - Read: [PATTERN.md](patterns/database/postgres-application/PATTERN.md)
 - Examples: [example/](patterns/database/postgres-application/example/)
 - Requires: `@jskit-ai/database-runtime-postgres`
 
+## Table resource
+
+Describe one database table once (its fields, columns, ownership, search and sort) so its owner feature reads and writes it through a scoped handle.
+
+- Id: `database/table-resource`
+- Keywords: `database`, `defaultTo`, `defineTableResource`, `lockVersionField`, `lookup`, `ownership`, `owns`, `resource`, `table`, `workspace_or_shared`
+- Owner: `@jskit-ai/resource-core@0.1.205`
+- Read: [PATTERN.md](patterns/database/table-resource/PATTERN.md)
+- Examples: [example/](patterns/database/table-resource/example/)
+- Requires: `@jskit-ai/resource-core`
+
 ## Capacitor Android application
 
 Wrap a JSKIT web application in a Capacitor Android shell using native Capacitor and Android commands.
 
 - Id: `mobile/android-application`
 - Keywords: `android`, `capacitor`, `device`, `mobile`, `native`, `shell`, `webview`
-- Owner: `@jskit-ai/mobile-capacitor@0.2.16`
+- Owner: `@jskit-ai/mobile-capacitor@0.2.17`
 - Read: [PATTERN.md](patterns/mobile/android-application/PATTERN.md)
 - Examples: [example/](patterns/mobile/android-application/example/)
 - Requires: `@capacitor/android`, `@capacitor/app`, `@capacitor/cli`, `@jskit-ai/mobile-capacitor`
@@ -323,7 +334,7 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.2.19`
+- Owner: `@jskit-ai/realtime@0.2.20`
 - Read: [PATTERN.md](patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
@@ -334,7 +345,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.2.18`
+- Owner: `@jskit-ai/rewarded-web@0.2.19`
 - Read: [PATTERN.md](patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -344,8 +355,8 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 Define a server feature through explicit capabilities and first-class actions, adding services or repositories only when its domain earns them.
 
 - Id: `server/feature-package`
-- Keywords: `actions`, `feature`, `json-rest`, `knex`, `orchestration`, `package`, `provider`, `repository`, `routes`, `server`
-- Owner: `@jskit-ai/agent-docs@0.1.282`
+- Keywords: `actions`, `aggregate`, `feature`, `handle`, `orchestration`, `owns`, `package`, `provider`, `repository`, `routes`, `server`, `table resource`
+- Owner: `@jskit-ai/agent-docs@0.1.284`
 - Read: [PATTERN.md](patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -356,7 +367,7 @@ Compose the JSKIT responsive shell, semantic placements, settings navigation, an
 
 - Id: `shell/application-shell`
 - Keywords: `adaptive`, `app`, `layout`, `navigation`, `placement`, `responsive`, `settings`, `shell`
-- Owner: `@jskit-ai/shell-web@0.2.16`
+- Owner: `@jskit-ai/shell-web@0.2.17`
 - Read: [PATTERN.md](patterns/shell/application-shell/PATTERN.md)
 - Examples: [example/](patterns/shell/application-shell/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -367,7 +378,7 @@ Add product routes and shell extensions through file routing, semantic placement
 
 - Id: `ui/page-and-placement`
 - Keywords: `component`, `navigation`, `outlet`, `page`, `placement`, `routes`, `section`, `shell`, `subpages`, `vue`
-- Owner: `@jskit-ai/shell-web@0.2.16`
+- Owner: `@jskit-ai/shell-web@0.2.17`
 - Read: [PATTERN.md](patterns/ui/page-and-placement/PATTERN.md)
 - Examples: [example/](patterns/ui/page-and-placement/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -378,7 +389,7 @@ Compose an account settings route and profile, preference, notification, and sig
 
 - Id: `users/account-settings`
 - Keywords: `account`, `link provider`, `notifications`, `oauth`, `preferences`, `profile`, `settings`, `sign-in methods`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.2.23`
+- Owner: `@jskit-ai/users-web@0.2.24`
 - Read: [PATTERN.md](patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -389,7 +400,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.2.15`
+- Owner: `@jskit-ai/users-core@0.2.16`
 - Read: [PATTERN.md](patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -400,7 +411,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.2.15`
+- Owner: `@jskit-ai/workspaces-core@0.2.16`
 - Read: [PATTERN.md](patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -411,7 +422,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.2.23`
+- Owner: `@jskit-ai/workspaces-web@0.2.24`
 - Read: [PATTERN.md](patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/skills/jskit/references/patterns/app/minimal-foundation/example/AGENTS.md

@@ -8,6 +8,10 @@ Framework references:
 - `https://mobily-enterprises.github.io/jskit-ai/guide/`
 - `https://mobily-enterprises.github.io/jskit-ai/patterns/`
 
+Before writing or reviewing code that reads or writes a database table, read
+the data access guide at
+`https://mobily-enterprises.github.io/jskit-ai/guide/framework/data-access`.
+
 Before writing or reviewing server code (a feature, provider, action, service,
 repository, route, error or test), read the typed features guide at
 `https://mobily-enterprises.github.io/jskit-ai/guide/framework/typed-features`.

package/skills/jskit/references/patterns/app/minimal-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.2.13",
+    "@jskit-ai/kernel": "0.2.14",
     "@jskit-ai/material-web": "0.1.3",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.12.7",
@@ -44,13 +44,13 @@
     "vue": "^3.5.44",
     "vue-router": "^5.3.1",
     "vuetify": "^4.3.0",
-    "@jskit-ai/http-runtime": "0.2.13",
+    "@jskit-ai/http-runtime": "0.2.14",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
-    "@jskit-ai/config-eslint": "0.1.246",
-    "@jskit-ai/jskit-catalog": "0.2.34",
+    "@jskit-ai/config-eslint": "0.1.247",
+    "@jskit-ai/jskit-catalog": "0.2.36",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",