App: features

A slice of an App that can be switched on together: it restates the App’s own content keys. Preview keys work and may change in any release (status); the rest are stable. All parts.

A feature keeps one capability (its resources’ presentation, views, pages, menu fragment and grants) in one module, merged into the App at load.

app.ts

import { defineApp, defineFeature, listView, navGroup } from 'tablewalk/app';

const inventory = defineFeature({
  id: 'inventory',
  resources: { vehicle: { display: { price: { format: 'money' } } } },
  auth: { roles: { clerk: { read: ['vehicle'] } } },
  views: { vehicles: listView('Vehicles', 'vehicle', { show: ['name', 'price'] }) },
  nav: ['vehicles'],
});

export default defineApp({
  name: 'Dealership',
  resources: { lead: { access: 'write' }, vehicle: {} },
  auth: { roles: { clerk: { label: 'Clerk', read: ['lead'], write: ['lead'] } } },
  views: { leads: listView('Leads', 'lead') },
  features: [inventory],
  home: 'leads',
  nav: [navGroup('work', 'Work', ['leads', { feature: 'inventory' }])],
});

The App keeps name, connection, sources, ui, sign-in and which roles exist. Ids are global; identical facts merge and conflicting ones are refused naming both contributors; actions and validation rules concatenate; authority only adds. Put each feature in features/<id>.ts, which reload watches.

The authority lock

npx tablewalk check --config tablewalk.json --app . --write-authority

writes authority.lock beside the App: every grant, ceiling, deletion opt-in, public read, source binding and component origin, one line each, naming who contributes it (role clerk read vehicle — features "inventory"). From then on check fails with the difference whenever the App’s authority changes, the server refuses to start an App that differs from its lock, and a reload that changes authority waits for a restart. Review the diff, then rewrite the lock.

features

Key	Type	Status	What it does
features	array	Stable	Ordered slices of content merged at load, every merge checked: views, pages, a nav fragment the App places with { feature }, how resources present, home rules appended after the App’s, and grants to the App’s roles within its ceilings. Identical facts merge; conflicting ones are refused, naming both contributors.

features[].analytics

Key	Type	Status	What it does
features[].analytics		Preview	The same keys as analytics.

features[].api

Key	Type	Status	What it does
features[].api	object	Stable
features[].api.commands	array	Stable	Used in examples/apps/lintel/app.ts.
features[].api.commands[].command	string	Stable	A command, by its name in the App’s commands module (defineCommands). The server fills in its input, target and version from the registration; tablewalk-commands.d.ts types the names. Used in examples/apps/lintel/app.ts.
features[].api.commands[].description	string	Stable	Used in examples/apps/lintel/app.ts.
features[].api.commands[].label	string	Stable
features[].api.events	array	Stable	Command events the event feed serves, each its own token operation (event:<name>). Used in examples/apps/lintel/commands/ledger.ts.
features[].api.resources	object	Stable	Used in examples/apps/tick/app.ts.
features[].api.resources.*.create		Stable	One of true. Used in examples/apps/lintel/app.ts.
features[].api.resources.*.delete		Stable	One of true. Used in examples/apps/tick/app.ts.
features[].api.resources.*.description	string	Stable	Used in examples/apps/lintel/app.ts.
features[].api.resources.*.fields	array	Stable	Used in examples/apps/tick/app.ts.
features[].api.resources.*.filters	array	Stable	Used in examples/apps/lintel/views.ts.
features[].api.resources.*.sorts	array	Stable
features[].api.resources.*.update		Stable	One of true.
features[].api.views	array	Stable	Used in examples/apps/tick/app.ts.
features[].api.views[].description	string	Stable	Used in examples/apps/lintel/app.ts.
features[].api.views[].label	string	Stable
features[].api.views[].view	string	Stable	Used in examples/apps/lintel/app.ts.

features[].audiences

Key	Type	Status	What it does
features[].audiences		Preview	The same keys as audiences.

features[].auth

Key	Type	Status	What it does
features[].auth	object	Stable	Used in examples/apps/lintel/app.ts.
features[].auth.roles	object	Stable	Grants to roles the App declares in auth.roles; a feature never creates a role.
features[].auth.roles.*.actions	object	Stable	Fixed actions the role runs without write, by resource and action id: { pay_run: [‘submit’] }. Each resource is one the role reads, with access ‘write’, and does not write; each id is one of its fixed (set) actions. The server admits the update only as that action: its set, its reason column, its when on the stored row. Needs auth.rows ‘all’. Used in examples/apps/tick/app.ts.
features[].auth.roles.*.commands	array	Stable	Explicit server command identifiers only. No wildcard grants or implied CRUD access. Used in examples/apps/lintel/app.ts.
features[].auth.roles.*.experiments	array	Preview
features[].auth.roles.*.experiments[].actions	array	Preview	Used in examples/apps/tick/app.ts.
features[].auth.roles.*.experiments[].environments	array	Preview
features[].auth.roles.*.experiments[].ids	array	Preview
features[].auth.roles.*.experiments[].owners	array	Preview
features[].auth.roles.*.fields	object	Stable	Column narrowing per resource, within the resource’s own fields. Omit read to narrow only write. Used in examples/apps/tick/app.ts.
features[].auth.roles.*.fields.*.read	array	Stable	Used in examples/apps/lintel/app.ts.
features[].auth.roles.*.fields.*.write	array	Stable	Needs the resource’s access ‘write’. Used in examples/apps/lintel/app.ts.
features[].auth.roles.*.flags	array	Preview
features[].auth.roles.*.flags[].actions	array	Preview	Used in examples/apps/tick/app.ts.
features[].auth.roles.*.flags[].environments	array	Preview
features[].auth.roles.*.flags[].ids	array	Preview
features[].auth.roles.*.flags[].owners	array	Preview
features[].auth.roles.*.operations	array	Stable	Operator reads over the authenticated App host: readiness, bundle (the sanitized support bundle) and workflows (the durable workflows room, with Cancel and Retry). In a suite’s Console, for this App only: workflows, jobs (list and redrive), deliveries (event and webhook deliveries, list and redrive), stores (store layout status) and analytics (read-only). Independent of data and command grants. Used in examples/apps/lintel/app.ts.
features[].auth.roles.*.read	array	Stable	Used in examples/apps/lintel/app.ts.
features[].auth.roles.*.realm	"tenant" · "platform"	Stable	May only restate an identical, explicitly declared root role realm. Cross-contributor agreement is checked by the App checker; a feature cannot introduce a realm. One of platform, tenant.
features[].auth.roles.*.write	array	Stable	Within the role’s reads and the App’s write ceiling. Used in examples/apps/lintel/app.ts.

features[].experiments

Key	Type	Status	What it does
features[].experiments		Preview	The same keys as experiments.

features[].flags

Key	Type	Status	What it does
features[].flags		Preview	The same keys as flags.

features[].home

Key	Type	Status	What it does
features[].home		Stable	The same keys as home.

features[].id

Key	Type	Status	What it does
features[].id	string	Stable	Unique in the App. Names the feature in refusals, the authority report and a nav placement; never part of an address.

features[].nav

Key	Type	Status	What it does
features[].nav		Stable	The same keys as nav.

features[].pages

Key	Type	Status	What it does
features[].pages		Stable	The same keys as pages.

features[].resources

Key	Type	Status	What it does
features[].resources		Stable	The same keys as resources.

features[].views

Key	Type	Status	What it does
features[].views		Stable	The same keys as views.