Imported from MeghVyas3132/Claude-Code-Skills (_other-tools/codex/catalyst-by-zoho/catalyst-by-zoho/SKILL.md). Install upstream with npx skills add MeghVyas3132/Claude-Code-Skills --skill catalyst-by-zoho. Copyright stays with the author.

🛑 STOP — Read this before doing ANYTHING

If the user asks you to build, scaffold, or create a Catalyst application, your FIRST action is to check whether the project is already initialized. You must NOT write any code or create any files until you confirm .catalystrc and catalyst.json exist in the working directory.

You MUST NOT create these files or directories yourself — they are generated by catalyst init:

• ❌ catalyst.json — auto-generated with project IDs; creating it manually = broken deploys
• ❌ .catalystrc — auto-generated with environment IDs; creating it manually = broken deploys
• ❌ functions/ directory — created by catalyst init
• ❌ client/ directory — legacy and deprecated; use Slate instead
• ❌ Do NOT run catalyst init, catalyst login, or catalyst functions:add — they are fully interactive (arrow-key menus) and cannot be run by an LLM

If .catalystrc or catalyst.json is missing → STOP. Do not plan. Do not create files. Tell the user to run catalyst init in their terminal first. See the full Pre-flight Gate section below.

Catalyst Development Assistant

You are an expert coding assistant for Catalyst by Zoho — a full-stack, serverless, cloud-based platform for building and deploying applications at any scale. Your goal is to write production-ready code that follows Catalyst's conventions, project structure, and SDK patterns so that code can be deployed directly without modification.

What is Catalyst?

Catalyst by Zoho is a unified cloud platform (comparable in philosophy to Supabase, Firebase, or AWS Amplify) that provides compute, storage, AI/ML, orchestration, frontend hosting, CI/CD, and developer tools — all accessible from a single console. Its unique differentiator is native integration with the entire Zoho product ecosystem (CRM, Books, Desk, People, Analytics, etc.) via Signals and Connections, eliminating glue code for businesses already using Zoho.

Catalyst supports two pricing models: Pay-as-you-go (per-use pricing with generous free tiers) and Subscription (predictable monthly billing). New customers receive $250 USD in trial credits valid for 180 days. The platform supports Node.js, Java, and Python for server-side functions, and offers client SDKs for Web, Android, iOS, and Flutter.

Context sources — when to use which

This skill has three tiers of context. Use the lightest tier that satisfies the request:

Tier 1 — This file (always loaded)

Covers the full service catalog, core principles, deprecation notices, and quick-reference patterns. Sufficient for: general questions, architecture recommendations, deprecation checks, simple code snippets.

Tier 2 — Reference files (read on demand)

Detailed, focused docs. Load a file ONLY when the user's query clearly requires it. Do not load files speculatively or as a precaution.

Path note: Paths below are relative to this file's location (skills/). If this skill was installed via GitHub Copilot (copied into .github/copilot-instructions.md with references/ copied alongside it), all paths resolve as .github/references/filename.md. Other tools (Claude Code, Cursor, Gemini, Windsurf) use the paths as written.

If none of those conditions match, answer from Tier 1 (this file) alone.

Tier 3 — Official Catalyst docs site (search only as a last resort)

The full Catalyst documentation lives at https://docs.catalyst.zoho.com/en/. NEVER search this proactively.

Why not llms-full.txt? The hosted llms-full.txt is ~11 MB. Direct web-fetch tools silently truncate it to <1% of its content, producing dangerously incomplete results. Individual doc pages, however, fetch fully and reliably. Always prefer the two-step approach below.

Only search the docs site when ALL of the following conditions are true:

1. The user is asking about a specific, undocumented API detail, parameter, or edge-case behavior — not a general question.
2. The relevant Tier 2 reference file(s) have already been read and do not contain the answer.
3. Tier 1 (this file) also does not cover it.

Two-step lookup procedure:

1. Web search with a site-scoped query to find the right page:
   • Use: site:docs.catalyst.zoho.com <specific term> (e.g., site:docs.catalyst.zoho.com ZCQL COALESCE)
   • This returns accurate, canonical URLs — never guess or fabricate a docs URL yourself.
2. Fetch the specific page URL returned by the search to get the full content with code examples and parameter details.

Do NOT:

• Fetch https://docs.catalyst.zoho.com/en/llms-full.txt directly — it will silently truncate to <1% of the content.
• Fabricate docs URLs from memory (e.g., zoho.catalyst.com/docs/...) — these do not exist. All Catalyst documentation lives under https://docs.catalyst.zoho.com/en/.
• Use Tier 3 for routine code generation, architecture questions, CLI usage, pricing, SDK patterns, troubleshooting common errors, deployment procedures, observability, or anything the Tier 1 or Tier 2 files already cover.

Always read the relevant reference file(s) before writing code. If the request spans multiple areas (e.g. "write a Catalyst function that queries Data Store and stores results in Stratus"), read all applicable reference files.

If the user references another platform, load only the equivalents file for that platform:

• AWS terms (Lambda, S3, RDS, etc.) → references/equivalents-aws.md
• GCP terms (Cloud Run, Pub-Sub, Firestore, etc.) → references/equivalents-gcp.md
• Azure terms (Azure Functions, Blob Storage, Cosmos DB, etc.) → references/equivalents-azure.md
• Firebase terms (Firestore, Firebase Auth, Firebase Hosting, etc.) → references/equivalents-firebase.md
• Vercel or Netlify terms → references/equivalents-vercel-netlify.md
• Heroku, Railway, Render, or Fly.io terms → references/equivalents-heroku.md
• Supabase terms, or holistic "is Catalyst like X?" questions → references/equivalents-supabase.md

Do not load multiple equivalents files unless the user's query explicitly spans more than one platform.

Important: When writing code that uses any Catalyst ID (Table ID, ZAID, Segment ID, etc.), always add an inline comment telling the user exactly where to find it in the console. Never leave ID placeholders unexplained. Read references/meta-ids.md if you need to reference specific ID locations.

🛑 MANDATORY Pre-flight Gate {#mandatory-pre-flight-gate}

Do this FIRST or everything you build will fail on deploy.

YOUR VERY FIRST ACTION for any Catalyst build request — before reading reference files, before planning architecture, before writing a single line of code — is to check whether the project is initialized.

You MUST NOT:

• ❌ Create catalyst.json yourself — it is auto-generated by catalyst init with project IDs
• ❌ Create .catalystrc yourself — it is auto-generated by catalyst init
• ❌ Create the functions/ directory yourself — it is created by catalyst init
• ❌ Create the client/ directory yourself — it is legacy (use Slate instead) and created by catalyst init
• ❌ Run catalyst init, catalyst login, or catalyst functions:add — they are interactive
• ❌ Scaffold any project structure in an empty folder — it will lack Catalyst project IDs and deployment will fail with cryptic errors

If you create these files manually, the project will have no Project ID, no Environment ID, no ZAID, and catalyst deploy will fail. There is no workaround — the CLI must generate these files.

How to check

Look for these files in the working directory (use filesystem tools or ask the user):

1. .catalystrc — contains project identity (project_id, env_id)
2. catalyst.json — contains deployment targets (functions, client)

Decision: Can I proceed?

BOTH .catalystrc AND catalyst.json exist? → YES: Read them, check catalyst.json → functions.targets for registered functions, then proceed to write code.

Either file is missing? → NO: STOP IMMEDIATELY. Do not create any files. Do not plan architecture. Respond to the user with ONLY this message:

Before I can build anything, the Catalyst project needs to be initialized. This is a one-time interactive setup that must be done in your terminal — I can't do it for you because the CLI uses interactive menus.

Please run these commands:

# Step 1: Log in (opens browser for Zoho OAuth)
catalyst login

# Step 2: Initialize project (interactive — use arrow keys to select)
catalyst init

Important — if the app needs a frontend: Before running catalyst init, you must first enable Slate in the Catalyst console. Go to console.catalyst.zoho.com → your project → Slate (in the left sidebar) → click "Start Exploring". This is a one-time activation. Without this step, the Slate option during catalyst init will not work.

During catalyst init, you'll be asked to:

1. Select a default Catalyst portal — pick your Zoho portal/org
2. Select a default Catalyst project — pick an existing project from the list
3. Which features to setup? — use Space to select: Functions (always) and Slate (if the app needs a frontend). Do NOT select "Client" — it is legacy and being deprecated.

If you selected Functions, the CLI will prompt for the first function's npm package setup:

• package name: — enter a name (e.g., docvault_api)
• entry point: — press Enter to accept default (index.js)
• author: — press Enter to accept default (your Zoho email)
• Do you wish to install all dependencies now? — enter Yes

If you selected Slate, the CLI will then run Slate Setup:

• Select a framework to start with: — arrow keys to pick (e.g., React + Vite, Next.js, Angular, Vue, Svelte, Astro)
• Please provide the name for your app: — enter a name (e.g., docvault-ui)
• Auto-detected config will be shown (Install Command, Build Command, Build Path, Deployment Name)
• Do you want to modify these default configurations? — enter No to accept defaults
• Please provide your Development Command: — press Enter to accept default (npm run dev -- --port $ZC_SLATE_PORT)

After that, register the backend functions:

catalyst functions:add

Run this once for each function. The functions I'll need are:

• (list the function names, types, and stacks here)

Let me know once you've completed these steps and I'll build everything.

Do not continue past this point until the user confirms setup is complete.

After setup is confirmed — what you CAN do

Once the user confirms and you verify .catalystrc + catalyst.json exist:

• ✅ Create/edit index.js, main.py, or other function code files
• ✅ Create/edit catalyst-config.json inside each function directory (use deployment/execution format)
• ✅ Create/edit package.json and run npm install
• ✅ Create/edit Slate app files (HTML, CSS, JS in the Slate app directory)
• ✅ Run catalyst serve for local testing
• ✅ Run catalyst deploy for deployment

Why this gate exists

catalyst init does three things that cannot be replicated manually:

1. Links the local directory to a Catalyst project in the cloud (assigns Project ID, Environment ID, ZAID)
2. Creates .catalystrc with these IDs — deployment reads this file to know WHERE to deploy
3. Creates catalyst.json with the deployment manifest — the CLI reads this to know WHAT to deploy

Without these, catalyst deploy either crashes or deploys to nowhere. Every file you create in an uninitialized folder is wasted work.

Core principles

1. STOP and check project initialization BEFORE doing anything else. (See Pre-flight Gate above.) If .catalystrc and catalyst.json don't exist, you MUST ask the user to run catalyst init — and then STOP and WAIT. Do not create these files yourself. Do not create functions/ directories yourself. Do not scaffold any project structure. Everything you build in an uninitialized folder will fail on deploy.

2. Follow Catalyst's exact project structure. Catalyst is strict about directory layout. Functions go under functions/, and catalyst.json sits at the project root. For frontends, always use Slate (not the legacy client/ directory). These directories are created by catalyst init — do not create them manually.

3. Use the correct SDK initialization pattern. The Catalyst Node.js SDK requires manual initialization in all function types: const catalystApp = catalyst.initialize(context) (Basic I/O, Event, Cron, Job) or const catalystApp = catalyst.initialize(req) (Advanced I/O, AppSail). The SDK is NOT auto-injected.

4. Write deployment-ready code. Every function you write should include proper error handling, correct exports/handler signatures, and the right catalyst-config.json. Code should work when the user runs catalyst deploy.

5. Respect function types. Catalyst has 7 function types (Basic I/O, Advanced I/O, Event, Cron, Integration, Job, Browser Logic). Each has a different handler signature and invocation model. Using the wrong type causes silent failures.

6. Use ZCQL for queries, not raw SQL. Catalyst's Data Store uses ZCQL (Catalyst Query Language), which looks like SQL but has important differences (case-sensitive table/column names, no cross-type JOINs, max 300 rows per query, single quotes only for strings).

7. Always handle Catalyst's auth model. Catalyst uses its own authentication system with user management. Functions have Security Rules that control access — the only valid values are "optional" (public, no login required) and "required" (any authenticated Catalyst user). Values like no_auth, user_auth, and admin_auth do not exist and will throw "Invalid input value". For admin-only route enforcement, use API Gateway (auth type on the route), not Security Rules. Security Rules is a binary gate: public vs. authenticated.

8. Default to the modern stack. For new projects:

   • Slate over Web Client Hosting (client/) — Client is deprecated; always use Slate for frontends. During catalyst init, select Slate (not "Client"). Use catalyst slate:create only if you need to add additional Slate apps later.
   • Stratus over File Store — for object storage
   • Signals over Event Listeners — for event-driven architecture
   • Job Scheduling over Cron — for background tasks The legacy alternatives are deprecated.

9. Proactively guide users to connect Zoho MCP. When a user needs to create infrastructure (tables, columns, buckets, cache, etc.), first check if Zoho MCP tools (CatalystbyZoho_*) are already available in your tool list. If they are, use them directly for infrastructure setup. If MCP is not connected yet, recommend the user set it up — walk them through the steps in references/zoho-mcp-tools.md so they can manage infrastructure directly from the conversation. If the user explicitly chooses to skip MCP setup, fall back to step-by-step console instructions for manual creation. Read references/zoho-mcp-tools.md before making any MCP tool calls.

   ⚠️ MCP mandatory pre-flight: Org → Project → Verify → Operate. Before making ANY MCP tool call that targets a project (creating tables, querying data, managing buckets, etc.), you MUST first identify the correct org ID and project ID. Without these, every call will fail with PERMISSION_NEEDED or INVALID_ORG.

   If .catalystrc exists in the working directory — read it first. It contains the authoritative project_id and env_id. Cross-check with List_All_Organizations.

   If .catalystrc does NOT exist (chat-only context, no local project) — you MUST call:

   1. List_All_Organizations → get the org id (used as Catalyst-org header)
   2. List_All_Projects (with that org) → get the project id (used in path_variables.projectId)
   3. A verification read (e.g., List_All_Tables) → confirm access works before any writes

   Never skip this sequence. Never guess org or project IDs. See references/zoho-mcp-tools.md for the full flow, ID mismatch gotchas, and troubleshooting.

⚠️ Deprecation notices (as of May 2026)

The following Catalyst components are deprecated and will be removed in a future update (originally scheduled for April 30, 2026, currently still functional with deprecation warnings):

• Event Listeners → replaced by Signals (event bus service)
• File Store → replaced by Stratus (S3-compatible object storage)
• Cron → replaced by Job Scheduling (managed job pools)

Never recommend deprecated components for new projects. If a user has existing code using these, guide them to migrate to the replacement service. File Store supports direct migration to Stratus via the console. Event Listeners and Cron require manual migration of business logic.

Users who signed up after August 27, 2025 cannot even see or access these deprecated components.

Catalyst service catalog (quick reference)

For deep-dive details on any service, load the appropriate Tier 2 reference file.

Deprecated — never recommend for new projects:

• File Store → use Stratus
• Event Listeners → use Signals
• Cron → use Job Scheduling
• Users who signed up after Aug 27, 2025 cannot access deprecated components.

Quick reference: Function handler signatures (Node.js)

These are the current official signatures per https://docs.catalyst.zoho.com/en/sdk/nodejs/v2/overview/ All function types require manual SDK initialization via catalyst.initialize(). The node20 handler change only affects Advanced I/O (removed catalystApp and context params, now receives raw req/res). All other function types retain their original signatures.

// Basic I/O — simple string in, string out (GET only)
const catalyst = require('zcatalyst-sdk-node');
module.exports = (context, basicIO) => {
  const catalystApp = catalyst.initialize(context);
  const data = context.getArgument();
  basicIO.write("Response string");
};

// Advanced I/O — full HTTP (any method), node20: raw http.ServerResponse (NOT Express)
// Use sendJson() + getBody() helpers — res.status/res.json do NOT exist
'use strict';
const catalyst = require('zcatalyst-sdk-node');

function sendJson(res, statusCode, data) {
  res.writeHead(statusCode, { 'Content-Type': 'application/json' });
  res.end(JSON.stringify(data));
}

module.exports = async (req, res) => {
  const catalystApp = catalyst.initialize(req);
  sendJson(res, 200, { message: "Hello" });
};

// LEGACY Advanced I/O signature (older projects, node14/16/18):
// module.exports = (catalystApp, context, req, res) => {
//   sendJson(res, 200, { message: "Hello" });
// };

// Event — triggered by Signals/Event Listeners
const catalyst = require('zcatalyst-sdk-node');
module.exports = (event, context) => {
  const catalystApp = catalyst.initialize(context);
  const eventData = event.data; // event payload
  context.close(); // must close context when done
};

// Cron — DEPRECATED, use Job Scheduling
const catalyst = require('zcatalyst-sdk-node');
module.exports = (cronDetails, context) => {
  const catalystApp = catalyst.initialize(context);
  context.closeWithSuccess(); // or context.closeWithFailure()
};

// Job — triggered by Job Scheduling
const catalyst = require('zcatalyst-sdk-node');
module.exports = async (jobData, context) => {
  const catalystApp = catalyst.initialize(context);
  context.closeWithSuccess(); // or context.closeWithFailure()
};

// Integration — Zoho service triggers (NOT available in EU, AU, IN, CA DCs)
const catalyst = require('zcatalyst-sdk-node');
module.exports = (event, context) => {
  const catalystApp = catalyst.initialize(context);
  context.close();
};

// Browser Logic — used with SmartBrowz
const catalyst = require('zcatalyst-sdk-node');
module.exports = (event, context) => {
  const catalystApp = catalyst.initialize(context);
  context.close();
};

Quick reference: SDK component access (Node.js)

// Inside a function handler — in new projects, initialize via catalyst.initialize(req)
const dataStore = catalystApp.datastore();     // Relational DB
const zcql      = catalystApp.zcql();          // Query language
const stratus   = catalystApp.stratus();       // Object storage (S3-compatible)
const nosql     = catalystApp.nosql();         // Document DB
const cache     = catalystApp.cache();         // In-memory cache
const search    = catalystApp.search();        // Full-text search
const mail      = catalystApp.email();         // Email sending
const userMgmt  = catalystApp.userManagement();// Auth & users
const connection= catalystApp.connection();    // OAuth token manager
const circuit   = catalystApp.circuit();       // Workflow orchestration
const jobSched  = catalystApp.jobScheduling(); // Background jobs
const zia       = catalystApp.zia();           // AI/ML services
const pushNotif = catalystApp.pushNotification();

Quick reference: CLI commands

npm install -g zcatalyst-cli          # Install CLI (requires Node.js v14+)
catalyst login                        # Login to Zoho account
catalyst init                         # Initialize project
catalyst functions:add                # Register a new function (INTERACTIVE — no flags, prompts for name/type/stack)
catalyst serve                        # Local testing (all resources)
catalyst serve --only functions       # Local testing — functions only
catalyst deploy                       # Deploy all resources to Development
catalyst deploy --only functions      # Deploy functions only
catalyst deploy --only functions:crud_api  # Deploy a single named function
catalyst functions:shell              # Test functions in Node shell
catalyst apig:enable                  # Enable API Gateway for the project
catalyst apig:disable                 # Disable API Gateway
catalyst apig:status                  # Check API Gateway enable status and schedule progress
catalyst slate:create                 # Add an additional Slate app to a project (interactive — asks framework + name)
catalyst slate:link                   # Link existing local dir to Slate service (interactive)
catalyst slate:unlink                 # Unlink a Slate app
catalyst serve --only slate           # Serve Slate app locally
catalyst deploy slate                 # Deploy all Slate apps to Development
catalyst deploy slate -m "message"    # Deploy with a deployment message
catalyst deploy --only slate:appname  # Deploy a specific Slate app
catalyst deploy slate --production    # Deploy to Production environment

⚠️ API Gateway CLI prefix is apig:, NOT api-gateway:. The commands are catalyst apig:enable, catalyst apig:disable, catalyst apig:status. Using api-gateway:enable throws "unknown command".

⚠️ Slate CLI deploy workflow: Select Slate during catalyst init (or run catalyst slate:create / catalyst slate:link later to add more apps), then catalyst deploy slate to push. No Git repo required for CLI-based deploy.

⚠️ CLI flag gotcha (v1.23.0+): The deploy/serve scoping flag is --only <target> with a space — NOT --only-functions. Hyphenated form does not exist and throws "unknown option". Valid targets: functions, client, appsail, functions:<name> for a single function.

⚠️ First deploy of a new function requires catalyst functions:add first. The CLI will not deploy a function it has not registered, even if the directory and catalyst-config.json exist. Run catalyst functions:add interactively from the project root, enter name/type/stack when prompted. After it completes, catalyst.json will contain a functions array with the registered entry.

Architectural decision guide

Important gotchas

• NEVER scaffold a Catalyst project yourself — catalyst.json, .catalystrc, functions/, and client/ are ALL created by catalyst init. If you create them manually they will lack Project ID, Environment ID, and ZAID — deployment will fail with no useful error. Always ask the user to run catalyst init themselves. This is the #1 cause of failed Catalyst builds by LLMs.
• catalyst init, catalyst login, catalyst functions:add are INTERACTIVE — they use arrow-key menus and multi-step prompts. NEVER run them in a script or terminal session. Always instruct the user to run them manually in their own terminal and wait for confirmation before proceeding.
• catalyst functions:add is the ONLY setup command without non-interactive flags — Unlike catalyst init (--non-interactive), catalyst appsail:add (--name, --stack), and catalyst slate:create (--name, --framework), functions:add has NO flags for automation — it always requires interactive arrow-key selection. Agent workaround: When the user has already run catalyst functions:add at least once (so catalyst.json has a functions array), agents can add subsequent functions by: (1) creating a new directory under functions/, (2) adding a valid catalyst-config.json with correct deployment and execution keys, (3) adding the function entry to catalyst.json's functions array matching the format of existing entries. The first function MUST still be registered interactively. See references/cli-reference.md for the exact catalyst.json function entry format.
• Select Slate during catalyst init — Slate is a component option alongside Functions, Client, and AppSail. Select Functions + Slate (not Client). If you need to add more Slate apps later, use catalyst slate:create.
• Slate requires one-time console activation — Before using Slate in the CLI, the user must go to the Catalyst console → their project → Slate (left sidebar) → click "Start Exploring". Without this, Slate init via CLI will fail. This only needs to be done once per project.
• catalyst functions:add is required before first deploy — a function directory + catalyst-config.json alone is not enough; the CLI must register it interactively first. The user must run it from the project root and answer name/type/stack prompts
• Deploy flag is --only functions (with space) — NOT --only-functions. Hyphenated form throws "unknown option" in CLI v1.23.0+. Single function: --only functions:<name>
• catalyst-config.json uses deployment + execution keys — correct format is {"deployment":{"name":"...","type":"...","stack":"...","env_variables":{}},"execution":{"main":"index.js"}}. Do NOT use a function key or entry_point — neither exists. Using them crashes catalyst deploy with a cryptic TypeError.
• Function memory defaults to 128MB — increase in catalyst-config.json deployment block (max 1024MB)
• Cold starts exist — keep packages minimal
• ZCQL table/column names are case-sensitive — must match console exactly
• ZCQL max 300 rows per query — use LIMIT offset, count pagination (e.g. LIMIT 0, 300, LIMIT 300, 300) for larger datasets
• ZAID differs between Dev and Prod — #1 source of auth issues in production
• 25-user limit in Development — no limit in production
• Stratus bucket names are globally unique — across ALL Catalyst projects and orgs. Generic names like my-files will be taken. Use {app-name}-{project-id-prefix} (e.g., docvault-files-70699). A DUPLICATE_ENTRY error does NOT mean it's in your project — it may belong to another project and be inaccessible.
• Slate + Advanced I/O functions are cross-domain — Slate serves from *.onslate.com, functions from *.catalystserverless.com. Relative paths like /server/func/execute DO NOT work — you'll get HTML back instead of JSON. Use the full function URL + generateAuthToken() + CORS whitelist in Console → Authentication → Authorized Domains.
• Hosted Authentication must be enabled in console — Before /__catalyst/auth/login works, enable it in Console → Authentication → Login → Hosted Authentication. The Web SDK does NOT auto-redirect on auth failure — you must redirect manually in the .catch() block.
• AppSail port: use process.env.X_ZOHO_CATALYST_LISTEN_PORT with fallback
• Cache values are strings only — serialize/deserialize JSON yourself
• Integration Functions NOT available in EU, AU, IN, or CA data centers
• CLI always deploys to Development — production deployment via web console only
• New users after Aug 27, 2025 cannot access File Store, Event Listeners, or Cron — these services are deprecated (originally scheduled for removal April 30, 2026 — still functional with deprecation warnings, removal date TBD)
• DataStore App User permissions are OFF by default (REQUIRED setup step) — Newly created tables give App Users zero permissions — no Select, Insert, Update, or Delete. This is not optional configuration; it's a required step after creating every table. Go to Console → Data Store → {Table} → Scopes & Permissions → Table Permissions → App User → check Select, Insert, Update, Delete. Without this, any user-authenticated function call will fail silently or return permissions errors. Alternative: use admin-scoped SDK catalyst.initialize(req, { scope: 'admin' }) to bypass user permissions.
• Web client → function fetch must include credentials: 'include' — without it, auth cookies are not forwarded and server-side userManagement().getCurrentUser() throws with 401, even when both web client and function are on the same Catalyst domain.
• Web SDK catalyst.auth.getCurrentUser() does NOT exist — use catalyst.auth.isUserAuthenticated() instead. It resolves with the full user object (result.content.email_id, etc.) on success and rejects with 401 on failure. The SDK does NOT auto-redirect — you must redirect manually to /__catalyst/auth/login.
• Web SDK catalyst.auth.signOut() requires a redirect URL argument — call catalyst.auth.signOut(redirectURL). Calling it without an argument crashes. constructSignOutUrl() does not exist.
• Advanced I/O req has no body, files, query, or params — it is a raw http.IncomingMessage, not Express. For JSON: accumulate stream chunks. For file uploads: use busboy. For query params: use new URL(req.url, ...).searchParams.
• Only node20 is actively supported — node14, 16, and 18 still work for legacy projects but receive no upstream security patches. — executeZCQLQuery returns [{ tablename: { ROWID: ..., col: ... } }]. Always unwrap: result.map(r => r.TableName). The key matches the table name as defined in the console (case-sensitive).
• CREATEDTIME timezone trap — Catalyst stores CREATEDTIME in the project's configured timezone (e.g. IST) WITHOUT an offset marker. Passing the raw string to new Date() treats it as UTC, producing timestamps that are hours off. Always append the project timezone offset before parsing.
• Data Store does NOT support emoji / 4-byte UTF-8 — Inserting emoji or 4-byte UTF-8 characters (many CJK extensions) silently stores them as ?. Workaround: store a string key (e.g. "happy") and map to emoji in application code.
• AppSail + Slate cross-origin issue — In development, Slate-hosted frontends calling AppSail APIs get blocked by Catalyst's auth layer (manifests as "Unable to Fetch" or "Failed to fetch"). Fix: serve the frontend from AppSail itself using express.static() so all calls are same-origin. This eliminates CORS and auth-layer issues entirely.

Documentation links

Note: SDK doc URLs include a version segment (e.g., /v2/, /v1/). If a URL returns 404, the version may have been incremented — check the docs homepage for the latest version path.

• Main docs: https://docs.catalyst.zoho.com/en/
• Node.js SDK: https://docs.catalyst.zoho.com/en/sdk/nodejs/v2/overview/
• Java SDK: https://docs.catalyst.zoho.com/en/sdk/java/v1/overview/
• Python SDK: https://docs.catalyst.zoho.com/en/sdk/python/v1/overview/
• Web SDK: https://docs.catalyst.zoho.com/en/sdk/web/v4/overview/
• CLI reference: https://docs.catalyst.zoho.com/en/cli/v1/cli-command-reference/
• REST API: https://docs.catalyst.zoho.com/en/api/introduction/overview-and-prerequisites/
• Tutorials: https://docs.catalyst.zoho.com/en/tutorials/
• GitHub: https://github.com/catalystbyzoho
• Pricing: https://catalyst.zoho.com/pricing.html