@jskit-ai/agent-docs 0.1.295 → 0.1.297

package/guide/agent/app-setup/multi-homing.md

@@ -291,6 +291,40 @@ stored colours; change them with `PATCH /api/w/:workspaceSlug/settings` or
 membership semantics exactly; do not synthesize memberships to compensate for
 a policy/runtime mismatch.
 
+## Role permissions
+
+Each `roleCatalog.roles.<id>.permissions` lists the permissions the role
+grants, and `inherits` adds another role's. A grant names a permission that
+something in the application requires:
+
+| Grant | Covers |
+| --- | --- |
+| `crud.<namespace>.list`, `.view`, `.create`, `.update`, `.delete` | An operation of a workspace CRUD feature; an HTTP `PATCH` is `update` |
+| `crud.<namespace>.<action name>` | A custom action of that feature |
+| `workspace.settings.view`, `.update`, `workspace.roles.view`, `workspace.members.view`, `.invite`, `.manage`, `workspace.invites.revoke` | The workspace actions (settings, roles, members, invitations) |
+| `<prefix>.*` | Every required permission under the prefix, such as `crud.labels.*` |
+| `*` | Every permission, as the owner holds |
+
+When the server starts, JSKIT compares each role's own grants with the
+permissions the registered actions, the routes' `permission` and the surface
+access policies require. A grant that covers none of them stops the server
+outside production, for example `Role "member" grants "crud.labels.patch",
+which no action requires; did you mean "crud.labels.update"?`; in production
+the server starts and logs it as a warning. List a permission the application
+checks itself, in a service, a row policy or the browser (`access.can()`), in
+`roleCatalog.customPermissions`:
+
+```js
+export const roleCatalog = {
+  customPermissions: ["bookings.view-all"],
+  workspace: { defaultInviteRole: "member" },
+  roles: {
+    owner: { assignable: false, permissions: ["*"] },
+    member: { assignable: true, permissions: ["crud.bookings.list", "crud.bookings.update", "bookings.view-all"] }
+  }
+};
+```
+
 ## Role display labels
 
 Set optional `label` strings in the existing `roleCatalog.roles` definitions,

package/guide/agent/framework/data-access.md

@@ -467,7 +467,9 @@ A rule that depends on the caller's role reads `context.permissions` with
 `hasPermission(context.permissions, "bookings.view-all")` from
 `@jskit-ai/kernel/shared/support`, never with `includes()`. A role may hold
 `*` (an owner does) or `bookings.*`, and `includes()` misses both, so the
-owner would see only the rows a narrower rule leaves.
+owner would see only the rows a narrower rule leaves. No action requires such a
+permission, so list it in `roleCatalog.customPermissions`, or the server refuses
+to start outside production (see Workspace tenancy → Role permissions).
 
 ```js
 import { hasPermission } from "@jskit-ai/kernel/shared/support";
@@ -561,6 +563,12 @@ list when the include reaches it. A belongs-to field named by its key
 (`"locationId"`) or its relationship (`"location"`) is a relationship in the
 document, never an attribute, so it would never show; the app refuses it at
 boot, naming the link form.
+A read narrows an included record with `fields[<its JSON:API type>]`, at any
+depth, and never widens what the include shows:
+`?include=pet,pet.breed&fields[breeds]=name`. A type the includes reach below
+their first level takes only the fields and links they list of it there; any
+other field, and a type no include reaches, answer 400 naming what the read
+takes.
 A `decorateService` that also needs the record it wrote (for an audit or a
 history row) reads it from its own answer, `simplifyJsonApiResult(answer)`
 from `@jskit-ai/http-runtime/shared`, never with a second read; a relationship

package/guide/agent/framework/typed-features.md

@@ -483,6 +483,13 @@ record declares `mode: "patch"`; a command never does.**
 - An input field lists its allowed values with `enum`; the kernel refuses
   `oneOf` on an input field at startup, because json-rest-schema checks no
   `oneOf` and the field would accept any value.
+- A check of the input that the schema cannot make until the application
+  runs (a value only boot resolves, such as the types a CRUD read's includes
+  reach) is the definition's `checkInput(input)`, never a check inside
+  `execute`. The kernel runs it on the validated input before the action and
+  answers the field errors it throws (`createValidationError`) as an
+  `ACTION_VALIDATION_FAILED`, exactly as a schema refusal, so HTTP clients and
+  assistant tools are told the field to correct.
 
 Why: a command whose required field is never enforced reaches the service
 without it.
@@ -1010,6 +1017,10 @@ and Vitest's `maxWorkers` come from `testConcurrency()`.**
   `node --test` and sets `--test-concurrency` to the budget.
   `testConcurrency()` from `@jskit-ai/jskit-catalog/test-budget` returns the
   same number for a config.
+- A Node test file is named `<name>.test.js`, and a database test
+  `<name>.integration.test.js`: given no files, `jskit test` runs node's
+  default pattern and fails on a `tests/` file it would leave out, such as
+  `<name>.integration.js` or `<name>.spec.js`.
 - No script passes a fixed concurrency or worker count. `jskit check` fails a
   package script that runs `node --test` directly or passes one, and a
   Playwright or Vitest config those scripts use whose workers do not come from

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/agent-docs",
-  "version": "0.1.295",
+  "version": "0.1.297",
   "description": "Distributed JSKIT agent references, prompts, guides, and generated reference maps.",
   "type": "module",
   "files": [

package/patterns/feature-package/example/booking-engine/package.json

@@ -5,7 +5,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/kernel": "0.2.18",
+    "@jskit-ai/kernel": "0.2.19",
     "json-rest-schema": "^1.0.20"
   },
   "exports": {

package/patterns/minimal-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.2.18",
+    "@jskit-ai/kernel": "0.2.19",
     "@jskit-ai/material-web": "0.1.5",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.12.7",
@@ -44,13 +44,13 @@
     "vue": "^3.5.44",
     "vue-router": "^5.3.1",
     "vuetify": "^4.3.0",
-    "@jskit-ai/http-runtime": "0.2.18",
+    "@jskit-ai/http-runtime": "0.2.19",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.250",
-    "@jskit-ai/jskit-catalog": "0.2.47",
+    "@jskit-ai/jskit-catalog": "0.2.49",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.2.18",
+    "@jskit-ai/kernel": "0.2.19",
     "@jskit-ai/material-web": "0.1.5",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.12.7",
@@ -44,14 +44,14 @@
     "vue": "^3.5.44",
     "vue-router": "^5.3.1",
     "vuetify": "^4.3.0",
-    "@jskit-ai/http-runtime": "0.2.18",
-    "@jskit-ai/shell-web": "0.2.23",
+    "@jskit-ai/http-runtime": "0.2.19",
+    "@jskit-ai/shell-web": "0.2.25",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.250",
-    "@jskit-ai/jskit-catalog": "0.2.47",
+    "@jskit-ai/jskit-catalog": "0.2.49",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/packages/main/package.json

@@ -9,7 +9,7 @@
   },
   "description": "App-local runtime composition and lightweight glue.",
   "dependencies": {
-    "@jskit-ai/kernel": "0.2.18"
+    "@jskit-ai/kernel": "0.2.19"
   },
   "jskit": {
     "kind": "runtime",

package/reference/autogen/PATTERN_INDEX.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.295`
+- Owner: `@jskit-ai/agent-docs@0.1.297`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.295`
+- Owner: `@jskit-ai/agent-docs@0.1.297`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.2.41`
+- Owner: `@jskit-ai/assistant-runtime@0.2.43`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -48,7 +48,7 @@ Run one OpenID Connect sign-in for all of an owner's apps as its own JSKIT proje
 
 - Id: `auth/accounts-hub`
 - Keywords: `accounts hub`, `auth`, `authentication`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/oidc-issuer-core@0.1.27`
+- Owner: `@jskit-ai/oidc-issuer-core@0.1.28`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/accounts-hub/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/accounts-hub/example/)
 - Requires: `@jskit-ai/oidc-issuer-core`
@@ -59,7 +59,7 @@ Compose JSKIT authentication routes, views, profile controls, and public surface
 
 - Id: `auth/auth-surface`
 - Keywords: `account`, `auth`, `login`, `logout`, `password`, `placement`, `profile`, `reset`, `surface`
-- Owner: `@jskit-ai/auth-web@0.2.25`
+- Owner: `@jskit-ai/auth-web@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/auth-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/auth-surface/example/)
 - Requires: `@jskit-ai/auth-core`, `@jskit-ai/auth-web`, `@jskit-ai/shell-web`
@@ -70,7 +70,7 @@ Let people sign in with the accounts they already have in an accounts hub or ano
 
 - Id: `auth/oidc-sign-in`
 - Keywords: `accounts hub`, `auth`, `authentication`, `back-channel logout`, `dynamic client registration`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.27`
+- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/oidc-sign-in/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/oidc-sign-in/example/)
 - Requires: `@jskit-ai/auth-provider-oidc-core`, `@jskit-ai/auth-web`
@@ -81,7 +81,7 @@ Add Supabase authentication through normal npm composition, explicit environment
 
 - Id: `auth/supabase-auth`
 - Keywords: `auth`, `authentication`, `oauth`, `sessions`, `supabase`
-- Owner: `@jskit-ai/auth-provider-supabase-core@0.2.21`
+- Owner: `@jskit-ai/auth-provider-supabase-core@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/supabase-auth/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/supabase-auth/example/)
 - Requires: `@jskit-ai/auth-provider-supabase-core`
@@ -92,7 +92,7 @@ Resolve an administrator environment key or an individual user's grant, then use
 
 - Id: `connectors/ai-connections`
 - Keywords: `ai`, `api-key`, `cli`, `environment`, `free`, `models`, `ownership`, `zai`, `zen`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/ai-connections/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/ai-connections/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -103,7 +103,7 @@ Compose provider operations, authorization and encrypted file storage from a CLI
 
 - Id: `connectors/api-key-connection`
 - Keywords: `api-key`, `clay`, `cli`, `clickhouse`, `connectors`, `dbt`, `files`, `firecrawl`, `granola`, `integrations`, `metrics`, `prestashop`, `resend`, `semantic-layer`, `semrush`, `x-twitter`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/api-key-connection/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/api-key-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -114,7 +114,7 @@ Compose token-based MCP discovery and explicitly authorized tool calls using the
 
 - Id: `connectors/assistant-mcp`
 - Keywords: `assistant`, `cli`, `connectors`, `files`, `integrations`, `mcp`, `n8n`, `sanity`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/assistant-mcp/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/assistant-mcp/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -125,7 +125,7 @@ Configure assistant OAuth clients, then compose existing state, encrypted file g
 
 - Id: `connectors/assistant-mcp-oauth`
 - Keywords: `amplitude`, `assistant`, `atlassian`, `canva`, `cli`, `client metadata`, `confidence`, `connectors`, `figma`, `files`, `granola`, `hex`, `mcp`, `miro`, `oauth`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/assistant-mcp-oauth/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/assistant-mcp-oauth/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -136,7 +136,7 @@ Compose signed AWS operations, file configuration and application authorization
 
 - Id: `connectors/aws-storage-queries`
 - Keywords: `athena`, `aws`, `cli`, `connectors`, `files`, `iam`, `queries`, `s3`, `storage`, `sts`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/aws-storage-queries/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/aws-storage-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -147,7 +147,7 @@ Compose reusable connection libraries with portable configuration, application o
 
 - Id: `connectors/calendar-cli`
 - Keywords: `calendar`, `cli`, `connectors`, `google`, `integrations`, `oauth`, `permissions`
-- Owner: `@jskit-ai/connector-google-calendar@0.2.25`
+- Owner: `@jskit-ai/connector-google-calendar@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/calendar-cli/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/calendar-cli/example/)
 - Requires: `@jskit-ai/connector-google-calendar`, `@jskit-ai/connectors-core`, `@jskit-ai/database-runtime-mysql`
@@ -158,7 +158,7 @@ Compose the shared connector runtime for event delivery while leaving workflow c
 
 - Id: `connectors/event-delivery`
 - Keywords: `cli`, `connectors`, `events`, `files`, `inngest`, `integrations`, `workflows`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/event-delivery/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/event-delivery/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -169,7 +169,7 @@ Wire service-account grants, file storage, explicit message actions and public b
 
 - Id: `connectors/firebase-messaging`
 - Keywords: `cli`, `connectors`, `fcm`, `files`, `firebase`, `integrations`, `jwt`, `notifications`, `push`, `service-account`, `vapid`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/firebase-messaging/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/firebase-messaging/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -180,7 +180,7 @@ Compose reviewed Search campaigns with project-owned Google OAuth and portable s
 
 - Id: `connectors/google-ads-search`
 - Keywords: `ads`, `campaigns`, `cli`, `connectors`, `conversion`, `google`, `search`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/google-ads-search/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/google-ads-search/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -191,7 +191,7 @@ Compose provider consent, verification and encrypted file persistence from an ap
 
 - Id: `connectors/oauth-connection`
 - Keywords: `accounting`, `assistant permissions`, `books`, `cli`, `client credentials`, `connectors`, `consent`, `crm`, `databricks`, `developer token`, `fabric`, `files`, `gaql`, `google ads`, `graphql`, `integrations`, `linkedin`, `microsoft`, `oauth`, `powerpoint`, `salesforce`, `service principal`, `shopify`, `soql`, `staffing`, `tiktok`, `twitch`, `wave`, `word`, `wordpress`, `workday`, `xero`, `zoho`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/oauth-connection/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/oauth-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -202,7 +202,7 @@ Compose a sequential catalogue batch and preserve partial success for applicatio
 
 - Id: `connectors/paddle-catalogue`
 - Keywords: `batch`, `paddle`, `payments`, `prices`, `products`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/paddle-catalogue/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/paddle-catalogue/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -213,7 +213,7 @@ Resolve a publishable image key deliberately and use the shared URL library in a
 
 - Id: `connectors/public-image`
 - Keywords: `cli`, `connectors`, `files`, `images`, `integrations`, `logo-dev`, `public-key`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/public-image/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/public-image/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -224,7 +224,7 @@ Compose file configuration, Redshift Data API operations and application query o
 
 - Id: `connectors/redshift-queries`
 - Keywords: `aws`, `cli`, `connectors`, `files`, `iam`, `provisioned`, `redshift`, `serverless`, `sql`, `warehouse`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/redshift-queries/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/redshift-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -235,7 +235,7 @@ Use the shared scanner runtime from a CLI or a host worker with portable configu
 
 - Id: `connectors/source-scanning`
 - Keywords: `cancellation`, `cli`, `connectors`, `integrations`, `scanning`, `security`, `source`, `wiz`, `worker`
-- Owner: `@jskit-ai/connectors-catalog@0.2.25`
+- Owner: `@jskit-ai/connectors-catalog@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/source-scanning/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/source-scanning/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -246,7 +246,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.252`
+- Owner: `@jskit-ai/console-web@0.1.254`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -257,7 +257,7 @@ Define an application table resource whose records belong to the current user, a
 
 - Id: `crud/crud-contract`
 - Keywords: `authenticated`, `crud`, `database`, `owner-scoped`, `resource`, `table`, `user`
-- Owner: `@jskit-ai/resource-crud-core@0.1.210`
+- Owner: `@jskit-ai/resource-crud-core@0.1.212`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-contract/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-contract/example/)
 - Requires: `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -268,7 +268,7 @@ Build a complete application-owned CRUD server package from a migration, a table
 
 - Id: `crud/crud-feature-package`
 - Keywords: `actions`, `crud`, `database`, `defineCrudFeature`, `json-api`, `migration`, `owns`, `permissions`, `repository`, `routes`, `service`, `table resource`
-- Owner: `@jskit-ai/crud-core@0.2.25`
+- Owner: `@jskit-ai/crud-core@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-feature-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-feature-package/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -279,7 +279,7 @@ Build a routed CRUD user interface as thin application pages over JSKIT's shared
 
 - Id: `crud/crud-screen-set`
 - Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.2.28`
+- Owner: `@jskit-ai/http-web@0.2.30`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-screen-set/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-screen-set/example/)
 - Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -290,7 +290,7 @@ Configure a JSKIT application for MySQL with a fixed driver, ordinary environmen
 
 - Id: `database/mysql-application`
 - Keywords: `database`, `knex`, `mariadb`, `migrations`, `mysql`, `mysql2`
-- Owner: `@jskit-ai/database-runtime-mysql@0.1.265`
+- Owner: `@jskit-ai/database-runtime-mysql@0.1.266`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/database/mysql-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/database/mysql-application/example/)
 - Requires: `@jskit-ai/database-runtime-mysql`
@@ -301,7 +301,7 @@ Configure a JSKIT application for PostgreSQL with a fixed driver, ordinary envir
 
 - Id: `database/postgres-application`
 - Keywords: `database`, `knex`, `migrations`, `pg`, `postgres`, `postgresql`
-- Owner: `@jskit-ai/database-runtime-postgres@0.1.264`
+- Owner: `@jskit-ai/database-runtime-postgres@0.1.265`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/database/postgres-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/database/postgres-application/example/)
 - Requires: `@jskit-ai/database-runtime-postgres`
@@ -312,7 +312,7 @@ Describe one database table once (its fields, columns, ownership, search and sor
 
 - Id: `database/table-resource`
 - Keywords: `database`, `defaultTo`, `defineTableResource`, `lockVersionField`, `lookup`, `ownership`, `owns`, `resource`, `system`, `table`, `workspace_or_shared`
-- Owner: `@jskit-ai/resource-core@0.1.209`
+- Owner: `@jskit-ai/resource-core@0.1.210`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/database/table-resource/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/database/table-resource/example/)
 - Requires: `@jskit-ai/resource-core`
@@ -323,7 +323,7 @@ Wrap a JSKIT web application in a Capacitor Android shell using native Capacitor
 
 - Id: `mobile/android-application`
 - Keywords: `android`, `capacitor`, `device`, `mobile`, `native`, `shell`, `webview`
-- Owner: `@jskit-ai/mobile-capacitor@0.2.23`
+- Owner: `@jskit-ai/mobile-capacitor@0.2.25`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/mobile/android-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/mobile/android-application/example/)
 - Requires: `@capacitor/android`, `@capacitor/app`, `@capacitor/cli`, `@jskit-ai/mobile-capacitor`
@@ -334,7 +334,7 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.2.26`
+- Owner: `@jskit-ai/realtime@0.2.28`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
@@ -345,7 +345,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.2.30`
+- Owner: `@jskit-ai/rewarded-web@0.2.32`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -356,7 +356,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `aggregate`, `feature`, `handle`, `orchestration`, `owns`, `package`, `provider`, `repository`, `routes`, `server`, `table resource`
-- Owner: `@jskit-ai/agent-docs@0.1.295`
+- Owner: `@jskit-ai/agent-docs@0.1.297`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -367,7 +367,7 @@ Compose the JSKIT responsive shell, semantic placements, settings navigation, an
 
 - Id: `shell/application-shell`
 - Keywords: `adaptive`, `app`, `layout`, `navigation`, `placement`, `responsive`, `settings`, `shell`
-- Owner: `@jskit-ai/shell-web@0.2.23`
+- Owner: `@jskit-ai/shell-web@0.2.25`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/shell/application-shell/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/shell/application-shell/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -378,7 +378,7 @@ Add product routes and shell extensions through file routing, semantic placement
 
 - Id: `ui/page-and-placement`
 - Keywords: `component`, `navigation`, `outlet`, `page`, `placement`, `routes`, `section`, `shell`, `subpages`, `vue`
-- Owner: `@jskit-ai/shell-web@0.2.23`
+- Owner: `@jskit-ai/shell-web@0.2.25`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/ui/page-and-placement/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/ui/page-and-placement/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -389,7 +389,7 @@ Compose an account settings route and profile, preference, notification, and sig
 
 - Id: `users/account-settings`
 - Keywords: `account`, `link provider`, `notifications`, `oauth`, `preferences`, `profile`, `settings`, `sign-in methods`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.2.35`
+- Owner: `@jskit-ai/users-web@0.2.37`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -400,7 +400,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.2.26`
+- Owner: `@jskit-ai/users-core@0.2.28`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -411,7 +411,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.2.26`
+- Owner: `@jskit-ai/workspaces-core@0.2.28`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -422,7 +422,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.2.35`
+- Owner: `@jskit-ai/workspaces-web@0.2.37`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/reference/autogen/packages/assistant-core.md

@@ -2105,6 +2105,7 @@ Exports
 - `MAX_MESSAGE_PAGE_SIZE`
 - `attachmentIdsField`
 - `assistantContract`
+- `assistantConversationListItemOutputValidator`
 - `assistantConversationOutputValidator`
 
 ### `src/shared/assistantResponseText.js`
@@ -2258,6 +2259,7 @@ Exports
 - `MAX_MESSAGE_PAGE_SIZE`
 - `attachmentIdsField`
 - `assistantContract`
+- `assistantConversationListItemOutputValidator`
 - `assistantConversationOutputValidator`
 - `MAX_SYSTEM_PROMPT_CHARS`
 - `assistantConfigContract`

package/reference/autogen/packages/crud-core.md

@@ -54,7 +54,7 @@ Local functions
 Exports
 - `assertCrudOperationName(operation = "")`
 - `createCrudJsonApiActionDefinitions({ namespace, resource, surface, permissionForOperation, operations, scopeInputValidator, listFilterQueryValidator, operationInputs, actions, servedOverHttp })`
-- `createCrudJsonApiActions({ namespace, resource, repository, service, scopeInputKeys, operationLifecycle, dependencies: actionDependencies, realtimeAudience, definitions: builtDefinitions, ...definitionOptions })`
+- `createCrudJsonApiActions({ namespace, resource, repository, service, scopeInputKeys, operationLifecycle, dependencies: actionDependencies, realtimeAudience, definitions: builtDefinitions, includedTypes = () => new Map(), ...definitionOptions })`
 - `normalizeCrudOperationLifecycle(value)`
 Local functions
 - `resolveCrudActionChannels(permission, servedOverHttp)`
@@ -96,8 +96,8 @@ Local functions
 
 ### `src/server/jsonApiModule/service.js`
 Exports
-- `checkIncludedFields(crud, tableResource)`
 - `createCrudService({ repository, crud })`
+- `resolveIncludedTypes(crud, tableResource)`
 Local functions
 - `documentNotFound()`
 - `requireDocument(document)`
@@ -122,7 +122,7 @@ Local functions
 Exports
 - `normalizeColumnsMap(columns = {})`
 - `createCrudListFilterJsonRestSearchSchema(runtime = {}, { columns = {}, apply = {} } = {})`
-- `normalizeCrudListFilterJsonRestQuery(runtime = {}, query = {})`
+- `createCrudListFilterJsonRest(runtime, { columns = {}, apply = {} } = {})`
 Local functions
 - `resolveJsonRestFilterActualField(filter = {}, columns = {})`
 - `renderInternalJsonRestFilterKey(filter = {}, suffix = "")`
@@ -133,8 +133,11 @@ Local functions
 - `buildJsonRestPresenceFilterSearchSchemaEntry(filter = {}, { actualField = "" } = {})`
 - `buildJsonRestCustomFilterSearchSchemaEntry(filter, customApply)`
 - `resolveCrudListFilterEntries(value = {})`
-- `addJsonRestDateFilterValues(target = {}, filter = {}, value = "")`
-- `addJsonRestFilterValue(target = {}, filter = {}, value)`
+- `dateFilterDayStart(date)`
+- `buildJsonRestRangeFilterValues(filter = {}, value)`
+- `resolveJsonRestFilterProjection(filter, { columns, apply })`
+- `resolveJsonRestFilterProjections(runtime = {}, { columns = {}, apply = {} } = {})`
+- `mergeJsonRestSearchSchema(projections = [])`
 
 ### `src/server/listFilters.js`
 Exports
@@ -150,15 +153,15 @@ Local functions
 
 ### `src/server/listFilterTypes.js`
 Exports
-- `recordIdTransportSchema`
-- `cloneTransportSchema(value)`
 - `addDaysToDateFilterValue(value = "", days = 0)`
 - `buildCrudListFilterQueryField(filterDefinition, { invalidValues = CRUD_LIST_FILTER_INVALID_VALUES_REJECT } = {})`
 - `createCrudListFilterQuerySchema(structure = {})`
 - `buildFilterQuerySchemaDefinition(filterEntries = [], { invalidValues = CRUD_LIST_FILTER_INVALID_VALUES_REJECT } = {})`
 - `applyDefaultFilterQuery(queryBuilder, filter = {}, value, column = "")`
 Local functions
-- `buildSingleOrMultiTransportSchema(itemSchema)`
+- `cloneTransportSchema(value)`
+- `buildSingleOrMultiTransportSchema(itemSchema, itemPattern = "")`
+- `allowedValuesPattern(allowedValues)`
 - `buildAllowedValuesTransportSchema({ discardInvalidValues, allowedValues })`
 - `applyEqualsFilterQuery(queryBuilder, value, column = "")`
 - `applyInFilterQuery(queryBuilder, value, column = "")`
@@ -169,7 +172,8 @@ Local functions
 ### `src/server/listQueryValidators.js`
 Exports
 - `createCrudCursorPaginationQueryValidator(list = {})`
-- `createJsonApiFieldsetsQueryValidator({ resource = {} } = {})`
+- `createIncludedFieldsetsCheck(resource)`
+- `createJsonApiFieldsetsQueryValidator({ resource = {}, deferIncludedTypes = false } = {})`
 - `listSearchQueryValidator`
 - `listRecordIdsQueryValidator`
 - `lookupIncludeQueryValidator`
@@ -179,6 +183,7 @@ Exports
 - `createStandardCrudViewQueryValidators({ includeQueryValidator = lookupIncludeQueryValidator, fieldsetsQueryValidator = jsonApiFieldsetsQueryValidator } = {})`
 Local functions
 - `buildJsonApiFieldsetValueDefinition({ allowedFields = [] } = {})`
+- `fieldsetKeysRefusal(contract, resourceTypes)`
 - `resolveCrudListUsesOrderedCursor(list = {})`
 
 ### `src/server/normalizeOptionalText.js`

package/reference/autogen/packages/kernel.md

@@ -723,6 +723,7 @@ Exports
 Local functions
 - `schemaFieldErrorDetails(error)`
 - `buildActionValidationError({ details, cause })`
+- `hasFieldErrors(error)`
 
 ### `server/actions/registry.js`
 Exports
@@ -870,7 +871,7 @@ Local functions
 - `routeRequiresJsonApiContentTypeParser(route)`
 - `enforceRequestContentType({ request, route, transport })`
 - `buildRequestInput(request, { inputTransforms, transportInputTransforms })`
-- `executeMiddlewareStack(middleware, request, reply)`
+- `executeMiddlewareStack(middleware, request, reply, sending)`
 - `wrapReplySend({ reply, request, route, outputTransform, transport })`
 
 ### `server/http/lib/routeSupport.js`
@@ -907,7 +908,10 @@ Local functions
 - `assertValidSchema(schema, name)`
 - `filedSchemaId(schema, fallback)`
 - `everyRefResolves(schema, externalSchemas)`
-- `compiledOnFirstUse(compile, options, key)`
+- `namesNothingOutside(value)`
+- `selfContainedBranch(ajv, ref)`
+- `branchValidator(validator, compiledBranches)`
+- `compiledOnFirstUse(build, options, key)`
 
 ### `server/http/securityHeaders.js`
 Exports