@jskit-ai/agent-docs 0.1.306 → 0.1.307

package/guide/agent/app-setup/multi-homing.md

@@ -228,9 +228,12 @@ To send invitation email, provide the optional `workspaces.invite-mailer`
 capability from one of the application's providers. Without one, invitations
 are still created and delivery reports `mailer_unconfigured`. The mailer, typed
 `WorkspaceInviteMailer` in `@jskit-ai/workspaces-core/server/types`, is an
-object whose `sendWorkspaceInvite(message, options)` receives `{ email,
-inviteUrl, workspace, inviter, roleSid, expiresAt, message }`, where the inner
-`message` is the rendered `{ subject, text, html }`:
+object whose `sendWorkspaceInvite(message, options)` receives `{ inviteId,
+email, inviteUrl, workspace, inviter, roleSid, expiresAt, locale, message }`,
+where the inner `message` is the rendered `{ subject, text, html }`. `inviteId`
+is the saved invitation's id and `workspace.id` its workspace's, so a mailer
+that holds email until delivery is set up can record which invitation each one
+belongs to without reading `workspace_invites`:
 
 ```js
 const InviteMailerProvider = defineProvider({

package/guide/agent/framework/data-access.md

@@ -463,6 +463,38 @@ async function noticeVisibilityPolicy({ query, caller, context, column, value })
 }
 ```
 
+A policy narrows with `where` calls only: `where`, `andWhere`, `orWhere` and
+their kin (`whereIn`, `whereExists`, `whereNot`, `orWhereNull`...). Its calls
+run inside one parenthesised `where` group, where Knex compiles predicates and
+drops a join without a word, which would leave the policy hiding nothing; any
+other call (`join`, `leftJoin`, `select`) throws a TypeError naming the
+feature, the policy and the table. To narrow through another table, tie a
+subquery to the row with `whereExists`: over `ownTable(name)`, which may join
+the owner's other tables, or over another owner's join source. A policy is told
+the call's `options`, `{ context, trx }` as the caller passed them, and passes
+them on unchanged to `joinSource({ alias }, options)`, so the join source reads
+in the caller's scope and transaction; never build them by hand.
+
+```js
+// good: a member of the document's team sees it, through the teams owner's join source
+async function teamDocumentsPolicy({ query, caller, column, options, requires }) {
+  if (caller.kind !== "user") {
+    return caller.kind !== "anonymous";
+  }
+  const member = await requires.teams.joinSource({ alias: "tm" }, options);
+  query.whereExists(
+    member.query.select(1).whereColumn(member.column("teamId"), column("teamId")).where(member.column("userId"), caller.userId)
+  );
+  return true;
+}
+
+// bad: a join inside the policy, which Knex would drop from the where group; it throws
+function teamDocumentsPolicy({ query, caller, column }) {
+  query.join("team_members as tm", "tm.team_id", column("teamId")).where("tm.user_id", caller.userId);
+  return true;
+}
+```
+
 A rule that depends on the caller's role reads `context.permissions` with
 `hasPermission(context.permissions, "bookings.view-all")` from
 `@jskit-ai/kernel/shared/support`, never with `includes()`. A role may hold
@@ -762,6 +794,47 @@ is `FOR NO KEY UPDATE`, which still keeps every other lock and write of the row
 out but lets those inserts through; MySQL, MariaDB and SQLite lock as for the
 default `"update"`. Any other value throws a `TypeError` before anything runs.
 
+A check that only reads rows, and needs them unchanged until the transaction
+ends while other checks read them at once (is the membership still active
+while this document is filed under it?), takes a shared lock: `lockMode:
+"share"` on `lock`, `lockMany` or `lockWhere`, and so on an owner API that
+passes its options on, such as `workspaces.lock(workspaceId, { ...txOptions,
+lockMode: "share" })` or
+`workspaces.memberships.lockByWorkspaceIdAndUserId(workspaceId, userId, {
+...txOptions, lockMode: "share" })`. It is `FOR SHARE` on PostgreSQL and `LOCK
+IN SHARE MODE` on MySQL and MariaDB: other reads, shared locks and inserts of
+rows that reference the locked ones go on, and an update, a delete or an
+exclusive lock of them waits until the transaction ends; SQLite still runs one
+transaction at a time. Never write a row the transaction holds shared: two
+transactions that each hold it shared and then write it wait for each other,
+and the database fails one as a deadlock. Lock a row the work will write with
+the default `"update"` from the start. `claim`, `patchWhere` and
+`lockOrCreate` refuse `"share"` with a `TypeError`, since they take or write
+their rows.
+
+```js
+// good: concurrent filings check the membership at once; a change to it waits until this commits
+const file = (input, options) => documents.withTransaction(options, async (txOptions) => {
+  const membership = await memberships.lock(input.membershipId, { ...txOptions, lockMode: "share", fields: ["status"] });
+  if (membership.status !== "active") {
+    throw new ConflictError("documents.membershipInactive");
+  }
+  return documents.create(input, txOptions);
+});
+
+// bad: the transaction holds the membership shared, then writes it; two such filings deadlock
+await memberships.patch(input.membershipId, { lastFiledAt: new Date() }, txOptions);
+```
+
+Locks stay on the owner's handle and its owner API. A `scopedQuery()` or
+`joinSource()` builder takes no lock, and a row policy is not told a read's
+lock mode: it says which rows a caller may see, the same for every read. Rows
+of several owners are never locked in one statement over a join, which on
+MySQL and MariaDB locks every joined row the read examines: lock each owner's
+rows with its own `lock`, `lockMany` or `lockWhere`, the owners in one fixed
+order on every path (a parent's owner before its children's), so two
+transactions never take them in opposite orders.
+
 A record that a person edits from a form it read earlier carries a version
 number: the table resource names it with `lockVersionField`, an integer field
 over a non-null integer column with `defaultTo: 0`.
@@ -1217,10 +1290,30 @@ three more times, so the work must
 be safe to repeat: an HTTP call or an email goes after commit, or into an
 outbox row written inside it. Work that cannot be repeated passes `{ ...options, retry: false }`, and work that must
 commit before its caller goes on passes `{ ...options, outermost: true }`.
-Code never asks whether it runs in a transaction: `withTransaction` joins the
-caller's, `outermost` refuses one, and `lock`, `lockMany`, `lockWhere` and
-`claim` refuse to run outside one; `lockOrCreate` opens its own (and retries a
-lost insert race only then).
+Work that must commit or roll back with its caller's transaction, and so must
+never open one of its own, passes `{ ...options, joinOnly: true }`: called
+outside a transaction it throws a TypeError before the work runs. Code never
+asks whether it runs in a transaction: `withTransaction` joins the caller's,
+`outermost` refuses one, `joinOnly` requires one, and `lock`, `lockMany`,
+`lockWhere` and `claim` refuse to run outside one; `lockOrCreate` opens its own
+(and retries a lost insert race only then).
+
+```js
+// good: both moves land with the caller's transaction, or neither does
+async function moveStock(transfer, options) {
+  return stock.withTransaction({ ...options, joinOnly: true }, async (txOptions) => {
+    await stock.patch(transfer.fromId, { quantity: transfer.fromQuantity }, txOptions);
+    await stock.patch(transfer.toId, { quantity: transfer.toQuantity }, txOptions);
+  });
+}
+
+// bad: asks whether it runs in a transaction by reading it out of options
+async function moveStock(transfer, options) {
+  if (!options.trx) throw new Error("moveStock runs inside its caller's transaction");
+  await stock.patch(transfer.fromId, { quantity: transfer.fromQuantity }, options);
+  await stock.patch(transfer.toId, { quantity: transfer.toQuantity }, options);
+}
+```
 
 When the work throws, the transaction rolls back and the caller gets the
 work's own error, with its status and code, reporting `transactionOutcome:
@@ -1505,7 +1598,7 @@ server code is server code. Neither `eslint-disable`, an inline
 | Rule | Reports | Section |
 | --- | --- | --- |
 | `jskit/no-direct-knex` | a table reached by name with Knex, a `.knex` read or `knex` destructured, a transaction opened by hand | [The resource is the only door](#the-resource-is-the-only-door) |
-| `jskit/no-transaction-reader` | `options.trx`, `trx \|\| knex`, a `trx = knex` default, `trx` destructured from options, any key but `context` and `trx` read from the `txOptions` work receives | [Transactions](#transactions) |
+| `jskit/no-transaction-reader` | `options.trx`, `trx \|\| knex`, a `trx = knex` default, `trx` destructured from options, any key but `context` and `trx` read from the `txOptions` work receives; a read an `if` tests before throwing points to `joinOnly` or `outermost` | [Transactions](#transactions) |
 | `jskit/no-hand-scope` | a hand-written `where` on `workspace_id` or `workspaceId` | [Layer 1: the table resource](#layer-1-the-table-resource) |
 | `jskit/sql-literal` | raw SQL built from strings or templates instead of one literal with bindings | [Layer 5: reports the resource cannot express](#layer-5-reports-the-resource-cannot-express) |
 | `jskit/no-hand-context` | a system context made with `createSystemContext` or `declareSystemScope`, a context's `scopeValues` written by hand | [Background work](#background-work) |

package/guide/agent/framework/material-3.md

@@ -97,7 +97,13 @@ Exactly this, and nothing more:
    top-level: no arrow, a fresh trail. Placements are literal declarative data,
    one `addPlacement({ ... })` per destination with plain string `surface`,
    `scopedSuffix` and `unscopedSuffix`, never built by a helper, a spread or a
-   template, so a reader and `jskit check` can map every destination.
+   template, so a reader and `jskit check` can map every destination. One
+   dynamic page may serve several destinations: `modules/[moduleKey]/index.vue`
+   renders each module a placement names literally (`scopedSuffix:
+   "/modules/incidents"`, `"/modules/hazards"`), so it is top-level and declares
+   no parent. A literal destination is served by a page whose route matches it
+   segment by segment, each `:param` standing for exactly one segment; the
+   page's deeper pages (`modules/[moduleKey]/settings.vue`) are inner pages.
 3. **Every in-app link and navigation goes through JSKIT navigation:**
    `:to="paths.page('/suppliers')"` and `router.push(paths.page(...))` with
    `usePaths()`, the CRUD runtime's `resolveViewUrl()`, `resolveEditUrl()` and
@@ -133,7 +139,7 @@ Exactly this, and nothing more:
 | `nav/raw-link` | a hand-built in-app path in `to`, `href`, `router.push()`, `router.replace()` or a `to:`/`href:` object key outside a placement |
 | `nav/back-control` | any back control but the shell's Up that navigates the app: "Back to X", "← Suppliers", back arrows and navigating chevrons, breadcrumbs, a custom app-bar back button, a back component (`<ContextBackButton />` or `<page-back-link>`, and its import), a `goBack()`-style handler |
 | `nav/missing-parent` | an inner page of a shell surface without a declared parent, when it always renders under the shell's top app bar (a layout that also renders its pages without `ShellLayout`, such as a shop device's sign-in in a `v-if`, leaves its pages unjudged) |
-| `nav/top-level-parent` | a main-navigation destination that declares a parent |
+| `nav/top-level-parent` | a main-navigation destination that declares a parent, including a dynamic page whose route serves a literal destination (`/modules/:moduleKey` for `/modules/incidents`) |
 | `nav/placement-data` | a main-navigation placement that isn't literal data (no page is judged for a missing parent until it is) |
 | `nav/missing-shell-layout` | a page that declares a parent with no shell layout rendering it, so its title, Up and actions never show |
 | `nav/surface-parent` | a parent declared beside `jskit.surface`, which the shell never reads |

package/guide/agent/framework/typed-features.md

@@ -824,6 +824,14 @@ for anything that reads or writes the domain.**
   address and refuses with 429, `kernel.http.rateLimited` and `Retry-After`.
   A limit worth changing per application is read from its config, as
   `config.auth.rateLimits` is.
+- A route's `body` is validated by the kernel, on every method, DELETE
+  included. A request without a body is validated as an empty one: a body
+  validated in `create` or `replace` mode answers 400 `validation_failed`
+  naming its required fields, and one in the default `patch` mode, or with no
+  required fields, reaches the handler as `{}`. A body that is not a JSON
+  object answers 400 with the field error `request: "must be object"`. On the
+  client, a `useCommand()` DELETE sends its parsed input as the body when the
+  command declares `input` or `buildRawPayload`.
 
 Why: an action is the one place a domain operation's policy, input and
 events are declared.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/agent-docs",
-  "version": "0.1.306",
+  "version": "0.1.307",
   "description": "Distributed JSKIT agent references, prompts, guides, and generated reference maps.",
   "type": "module",
   "files": [

package/patterns/feature-package/example/booking-engine/package.json

@@ -5,7 +5,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/kernel": "0.2.20",
+    "@jskit-ai/kernel": "0.2.21",
     "json-rest-schema": "^1.0.20"
   },
   "exports": {

package/patterns/minimal-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.2.20",
+    "@jskit-ai/kernel": "0.2.21",
     "@jskit-ai/material-web": "0.1.5",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.12.7",
@@ -44,13 +44,13 @@
     "vue": "^3.5.44",
     "vue-router": "^5.3.1",
     "vuetify": "^4.3.0",
-    "@jskit-ai/http-runtime": "0.2.20",
+    "@jskit-ai/http-runtime": "0.2.21",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
-    "@jskit-ai/config-eslint": "0.1.250",
-    "@jskit-ai/jskit-catalog": "0.2.58",
+    "@jskit-ai/config-eslint": "0.1.251",
+    "@jskit-ai/jskit-catalog": "0.2.59",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.2.20",
+    "@jskit-ai/kernel": "0.2.21",
     "@jskit-ai/material-web": "0.1.5",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.12.7",
@@ -44,14 +44,14 @@
     "vue": "^3.5.44",
     "vue-router": "^5.3.1",
     "vuetify": "^4.3.0",
-    "@jskit-ai/http-runtime": "0.2.20",
-    "@jskit-ai/shell-web": "0.2.27",
+    "@jskit-ai/http-runtime": "0.2.21",
+    "@jskit-ai/shell-web": "0.2.28",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
-    "@jskit-ai/config-eslint": "0.1.250",
-    "@jskit-ai/jskit-catalog": "0.2.58",
+    "@jskit-ai/config-eslint": "0.1.251",
+    "@jskit-ai/jskit-catalog": "0.2.59",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/packages/main/package.json

@@ -9,7 +9,7 @@
   },
   "description": "App-local runtime composition and lightweight glue.",
   "dependencies": {
-    "@jskit-ai/kernel": "0.2.20"
+    "@jskit-ai/kernel": "0.2.21"
   },
   "jskit": {
     "kind": "runtime",

package/reference/autogen/PATTERN_INDEX.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.306`
+- Owner: `@jskit-ai/agent-docs@0.1.307`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.306`
+- Owner: `@jskit-ai/agent-docs@0.1.307`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.2.48`
+- Owner: `@jskit-ai/assistant-runtime@0.2.49`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -48,7 +48,7 @@ Run one OpenID Connect sign-in for all of an owner's apps as its own JSKIT proje
 
 - Id: `auth/accounts-hub`
 - Keywords: `accounts hub`, `auth`, `authentication`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/oidc-issuer-core@0.1.29`
+- Owner: `@jskit-ai/oidc-issuer-core@0.1.30`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/accounts-hub/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/accounts-hub/example/)
 - Requires: `@jskit-ai/oidc-issuer-core`
@@ -59,7 +59,7 @@ Compose JSKIT authentication routes, views, profile controls, and public surface
 
 - Id: `auth/auth-surface`
 - Keywords: `account`, `auth`, `login`, `logout`, `password`, `placement`, `profile`, `reset`, `surface`
-- Owner: `@jskit-ai/auth-web@0.2.29`
+- Owner: `@jskit-ai/auth-web@0.2.30`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/auth-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/auth-surface/example/)
 - Requires: `@jskit-ai/auth-core`, `@jskit-ai/auth-web`, `@jskit-ai/shell-web`
@@ -70,7 +70,7 @@ Let people sign in with the accounts they already have in an accounts hub or ano
 
 - Id: `auth/oidc-sign-in`
 - Keywords: `accounts hub`, `auth`, `authentication`, `back-channel logout`, `dynamic client registration`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.31`
+- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.32`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/oidc-sign-in/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/oidc-sign-in/example/)
 - Requires: `@jskit-ai/auth-provider-oidc-core`, `@jskit-ai/auth-web`
@@ -81,7 +81,7 @@ Add Supabase authentication through normal npm composition, explicit environment
 
 - Id: `auth/supabase-auth`
 - Keywords: `auth`, `authentication`, `oauth`, `sessions`, `supabase`
-- Owner: `@jskit-ai/auth-provider-supabase-core@0.2.23`
+- Owner: `@jskit-ai/auth-provider-supabase-core@0.2.24`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/supabase-auth/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/supabase-auth/example/)
 - Requires: `@jskit-ai/auth-provider-supabase-core`
@@ -92,7 +92,7 @@ Resolve an administrator environment key or an individual user's grant, then use
 
 - Id: `connectors/ai-connections`
 - Keywords: `ai`, `api-key`, `cli`, `environment`, `free`, `models`, `ownership`, `zai`, `zen`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/ai-connections/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/ai-connections/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -103,7 +103,7 @@ Compose provider operations, authorization and encrypted file storage from a CLI
 
 - Id: `connectors/api-key-connection`
 - Keywords: `api-key`, `clay`, `cli`, `clickhouse`, `connectors`, `dbt`, `files`, `firecrawl`, `granola`, `integrations`, `metrics`, `prestashop`, `resend`, `semantic-layer`, `semrush`, `x-twitter`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/api-key-connection/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/api-key-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -114,7 +114,7 @@ Compose token-based MCP discovery and explicitly authorized tool calls using the
 
 - Id: `connectors/assistant-mcp`
 - Keywords: `assistant`, `cli`, `connectors`, `files`, `integrations`, `mcp`, `n8n`, `sanity`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/assistant-mcp/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/assistant-mcp/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -125,7 +125,7 @@ Configure assistant OAuth clients, then compose existing state, encrypted file g
 
 - Id: `connectors/assistant-mcp-oauth`
 - Keywords: `amplitude`, `assistant`, `atlassian`, `canva`, `cli`, `client metadata`, `confidence`, `connectors`, `figma`, `files`, `granola`, `hex`, `mcp`, `miro`, `oauth`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/assistant-mcp-oauth/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/assistant-mcp-oauth/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -136,7 +136,7 @@ Compose signed AWS operations, file configuration and application authorization
 
 - Id: `connectors/aws-storage-queries`
 - Keywords: `athena`, `aws`, `cli`, `connectors`, `files`, `iam`, `queries`, `s3`, `storage`, `sts`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/aws-storage-queries/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/aws-storage-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -147,7 +147,7 @@ Compose reusable connection libraries with portable configuration, application o
 
 - Id: `connectors/calendar-cli`
 - Keywords: `calendar`, `cli`, `connectors`, `google`, `integrations`, `oauth`, `permissions`
-- Owner: `@jskit-ai/connector-google-calendar@0.2.28`
+- Owner: `@jskit-ai/connector-google-calendar@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/calendar-cli/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/calendar-cli/example/)
 - Requires: `@jskit-ai/connector-google-calendar`, `@jskit-ai/connectors-core`, `@jskit-ai/database-runtime-mysql`
@@ -158,7 +158,7 @@ Compose the shared connector runtime for event delivery while leaving workflow c
 
 - Id: `connectors/event-delivery`
 - Keywords: `cli`, `connectors`, `events`, `files`, `inngest`, `integrations`, `workflows`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/event-delivery/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/event-delivery/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -169,7 +169,7 @@ Wire service-account grants, file storage, explicit message actions and public b
 
 - Id: `connectors/firebase-messaging`
 - Keywords: `cli`, `connectors`, `fcm`, `files`, `firebase`, `integrations`, `jwt`, `notifications`, `push`, `service-account`, `vapid`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/firebase-messaging/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/firebase-messaging/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -180,7 +180,7 @@ Compose reviewed Search campaigns with project-owned Google OAuth and portable s
 
 - Id: `connectors/google-ads-search`
 - Keywords: `ads`, `campaigns`, `cli`, `connectors`, `conversion`, `google`, `search`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/google-ads-search/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/google-ads-search/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -191,7 +191,7 @@ Compose provider consent, verification and encrypted file persistence from an ap
 
 - Id: `connectors/oauth-connection`
 - Keywords: `accounting`, `assistant permissions`, `books`, `cli`, `client credentials`, `connectors`, `consent`, `crm`, `databricks`, `developer token`, `fabric`, `files`, `gaql`, `google ads`, `graphql`, `integrations`, `linkedin`, `microsoft`, `oauth`, `powerpoint`, `salesforce`, `service principal`, `shopify`, `soql`, `staffing`, `tiktok`, `twitch`, `wave`, `word`, `wordpress`, `workday`, `xero`, `zoho`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/oauth-connection/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/oauth-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -202,7 +202,7 @@ Compose a sequential catalogue batch and preserve partial success for applicatio
 
 - Id: `connectors/paddle-catalogue`
 - Keywords: `batch`, `paddle`, `payments`, `prices`, `products`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/paddle-catalogue/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/paddle-catalogue/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -213,7 +213,7 @@ Resolve a publishable image key deliberately and use the shared URL library in a
 
 - Id: `connectors/public-image`
 - Keywords: `cli`, `connectors`, `files`, `images`, `integrations`, `logo-dev`, `public-key`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/public-image/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/public-image/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -224,7 +224,7 @@ Compose file configuration, Redshift Data API operations and application query o
 
 - Id: `connectors/redshift-queries`
 - Keywords: `aws`, `cli`, `connectors`, `files`, `iam`, `provisioned`, `redshift`, `serverless`, `sql`, `warehouse`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/redshift-queries/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/redshift-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -235,7 +235,7 @@ Use the shared scanner runtime from a CLI or a host worker with portable configu
 
 - Id: `connectors/source-scanning`
 - Keywords: `cancellation`, `cli`, `connectors`, `integrations`, `scanning`, `security`, `source`, `wiz`, `worker`
-- Owner: `@jskit-ai/connectors-catalog@0.2.28`
+- Owner: `@jskit-ai/connectors-catalog@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/source-scanning/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/source-scanning/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -246,7 +246,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.258`
+- Owner: `@jskit-ai/console-web@0.1.259`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -257,7 +257,7 @@ Define an application table resource whose records belong to the current user, a
 
 - Id: `crud/crud-contract`
 - Keywords: `authenticated`, `crud`, `database`, `owner-scoped`, `resource`, `table`, `user`
-- Owner: `@jskit-ai/resource-crud-core@0.1.213`
+- Owner: `@jskit-ai/resource-crud-core@0.1.214`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-contract/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-contract/example/)
 - Requires: `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -268,7 +268,7 @@ Build a complete application-owned CRUD server package from a migration, a table
 
 - Id: `crud/crud-feature-package`
 - Keywords: `actions`, `crud`, `database`, `defineCrudFeature`, `json-api`, `migration`, `owns`, `permissions`, `repository`, `routes`, `service`, `table resource`
-- Owner: `@jskit-ai/crud-core@0.2.28`
+- Owner: `@jskit-ai/crud-core@0.2.29`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-feature-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-feature-package/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -279,7 +279,7 @@ Build a routed CRUD user interface as thin application pages over JSKIT's shared
 
 - Id: `crud/crud-screen-set`
 - Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.2.32`
+- Owner: `@jskit-ai/http-web@0.2.33`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-screen-set/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-screen-set/example/)
 - Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -290,7 +290,7 @@ Configure a JSKIT application for MySQL with a fixed driver, ordinary environmen
 
 - Id: `database/mysql-application`
 - Keywords: `database`, `knex`, `mariadb`, `migrations`, `mysql`, `mysql2`
-- Owner: `@jskit-ai/database-runtime-mysql@0.1.267`
+- Owner: `@jskit-ai/database-runtime-mysql@0.1.268`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/database/mysql-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/database/mysql-application/example/)
 - Requires: `@jskit-ai/database-runtime-mysql`
@@ -301,7 +301,7 @@ Configure a JSKIT application for PostgreSQL with a fixed driver, ordinary envir
 
 - Id: `database/postgres-application`
 - Keywords: `database`, `knex`, `migrations`, `pg`, `postgres`, `postgresql`
-- Owner: `@jskit-ai/database-runtime-postgres@0.1.266`
+- Owner: `@jskit-ai/database-runtime-postgres@0.1.267`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/database/postgres-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/database/postgres-application/example/)
 - Requires: `@jskit-ai/database-runtime-postgres`
@@ -312,7 +312,7 @@ Describe one database table once (its fields, columns, ownership, search and sor
 
 - Id: `database/table-resource`
 - Keywords: `database`, `defaultTo`, `defineTableResource`, `lockVersionField`, `lookup`, `ownership`, `owns`, `resource`, `system`, `table`, `workspace_or_shared`
-- Owner: `@jskit-ai/resource-core@0.1.211`
+- Owner: `@jskit-ai/resource-core@0.1.212`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/database/table-resource/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/database/table-resource/example/)
 - Requires: `@jskit-ai/resource-core`
@@ -323,7 +323,7 @@ Wrap a JSKIT web application in a Capacitor Android shell using native Capacitor
 
 - Id: `mobile/android-application`
 - Keywords: `android`, `capacitor`, `device`, `mobile`, `native`, `shell`, `webview`
-- Owner: `@jskit-ai/mobile-capacitor@0.2.27`
+- Owner: `@jskit-ai/mobile-capacitor@0.2.28`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/mobile/android-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/mobile/android-application/example/)
 - Requires: `@capacitor/android`, `@capacitor/app`, `@capacitor/cli`, `@jskit-ai/mobile-capacitor`
@@ -334,7 +334,7 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.2.30`
+- Owner: `@jskit-ai/realtime@0.2.31`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
@@ -345,7 +345,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.2.36`
+- Owner: `@jskit-ai/rewarded-web@0.2.37`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -356,7 +356,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `aggregate`, `feature`, `handle`, `orchestration`, `owns`, `package`, `provider`, `repository`, `routes`, `server`, `table resource`
-- Owner: `@jskit-ai/agent-docs@0.1.306`
+- Owner: `@jskit-ai/agent-docs@0.1.307`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -367,7 +367,7 @@ Compose the JSKIT responsive shell, semantic placements, settings navigation, an
 
 - Id: `shell/application-shell`
 - Keywords: `adaptive`, `app`, `layout`, `navigation`, `placement`, `responsive`, `settings`, `shell`
-- Owner: `@jskit-ai/shell-web@0.2.27`
+- Owner: `@jskit-ai/shell-web@0.2.28`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/shell/application-shell/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/shell/application-shell/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -378,7 +378,7 @@ Add product routes and shell extensions through file routing, semantic placement
 
 - Id: `ui/page-and-placement`
 - Keywords: `component`, `navigation`, `outlet`, `page`, `placement`, `routes`, `section`, `shell`, `subpages`, `vue`
-- Owner: `@jskit-ai/shell-web@0.2.27`
+- Owner: `@jskit-ai/shell-web@0.2.28`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/ui/page-and-placement/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/ui/page-and-placement/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -389,7 +389,7 @@ Compose an account settings route and profile, preference, notification, and sig
 
 - Id: `users/account-settings`
 - Keywords: `account`, `link provider`, `notifications`, `oauth`, `preferences`, `profile`, `settings`, `sign-in methods`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.2.41`
+- Owner: `@jskit-ai/users-web@0.2.42`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -400,7 +400,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.2.31`
+- Owner: `@jskit-ai/users-core@0.2.32`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -411,7 +411,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.2.31`
+- Owner: `@jskit-ai/workspaces-core@0.2.32`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -422,7 +422,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.2.41`
+- Owner: `@jskit-ai/workspaces-web@0.2.42`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/reference/autogen/packages/http-web.md

@@ -286,7 +286,7 @@ Local functions
 
 ### `src/client/composables/runtime/useCommandCore.js`
 Exports
-- `useCommandCore({ model, resource, writeMethod = "POST", canRun, fieldBag, feedback, input, buildRawPayload = emptyRecord, buildCommandPayload, buildCommandOptions = emptyRecord, onRunSuccess, onRunError, suppressSuccessMessage = false, messages = {} })`
+- `useCommandCore({ model, resource, writeMethod = "POST", canRun, fieldBag, feedback, input, buildRawPayload, buildCommandPayload, buildCommandOptions = emptyRecord, onRunSuccess, onRunError, suppressSuccessMessage = false, messages = {} })`
 
 ### `src/client/composables/runtime/useEndpointResource.js`
 Exports

package/reference/autogen/packages/kernel.md

@@ -908,6 +908,7 @@ Local functions
 - `normalizeAdvancedFastifySchema(value, { context = "route validator" } = {})`
 - `normalizeRouteValidatorMeta(value, { context = "route validator" } = {})`
 - `normalizeRouteValidatorDefinition(sourceDefinition, { context = "route validator" } = {})`
+- `createRequestBodyInputTransform(validateBody)`
 
 ### `server/http/responseSerializerFactory.js`
 Exports