@fui-org/fui-cli 2.2.1 → 2.2.3

package/dist/fui.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{enableCompileCache as a}from"node:module";a?.();var{run:e}=await import("./fui-xg17j3f9.js");await e();
+import{enableCompileCache as a}from"node:module";a?.();var{run:e}=await import("./fui-8tyckpke.js");await e();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fui-org/fui-cli",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "description": "Token-lean CLI for the FUI low-code platform (Node.js)",
   "keywords": [
     "ai",

package/skills/fui/SKILL.md

@@ -72,13 +72,13 @@ A request to create, design, fix or update a module authorizes the agent to publ
 
 **Imports**
 
-- `f-echart`, `f-sheet`, `f-editor`, `f-pdfmake`, `f-file-upload`, `f-image-update`, `f-qrcode`, `f-qrcode-reader`, `f-editor-dialog` need external libs → **check imports on every add OR remove**. → [component-quickref.md](references/component-quickref.md)
+- Before using an existing control, check `defaultControlAttr[control].import` in `scripts/component.js` (V2) or `scripts/component-3.0.js` (V3). Treat that array and its order as the source of truth for required JS/CSS; then check imports on every add or remove. → [component-quickref.md](references/component-quickref.md)
 - **NEVER** add CDN for bundled libs (jQuery, lodash, moment, numeral, Vuetify, toast, jquery-confirm...); list: [script-map.md](references/script-map.md) §0.
 - That ban is `HTMLOnly=false` only. `HTMLOnly: true` bundles **nothing** (no Vue, Vuetify, jQuery, lodash, MDI, `projectdefaultstyle.css`, `#fastProjectAPP`): CDNs are **required**, **per HTMLOnly module** (project level has no effect). → [module-structure.md](references/module-structure.md) §HTMLOnly=true
 
 **Database** (enforced in code; details under "Writes need the user")
 
-- **NEVER** `DROP TABLE` or `DROP DATABASE`, anywhere, incl. SP scripts.
+- **NEVER** `DROP DATABASE` or drop a persistent table, anywhere, incl. SP scripts. `DROP TABLE #name` (one local temporary table) is allowed; `##name`, schema-qualified names and a mixed drop list remain blocked.
 - `ALTER TABLE` (structure OK, data loss not): **free** `ADD` (column/constraint), `DROP CONSTRAINT` · **needs `--confirm-write`** `ALTER COLUMN` · **hard-blocked** `DROP COLUMN`, `SWITCH`, all else (fail-closed). Checked **per statement**: an `ADD` doesn't cover a later `DROP COLUMN` in the batch; hard-block wins.
 - **NEVER** `DELETE`/`UPDATE` without `WHERE`; show the SQL for the user to run.
 - **Never test on the live system**; the line is **writes**, not network. Verify = read definition + reason + cross-check; **never run an SP that writes**, and never call a real API/SP/DML "to test". Levels:
@@ -225,7 +225,7 @@ Before writing `apiMocks` for an SP that exists, run `fui sp verify <name>`. It
 - Writes to real data exit `3` until you add `--confirm-write`. That covers `INSERT`, `UPDATE`, `DELETE`, `MERGE` and `TRUNCATE` in `query` or `exec` (also inside `EXEC('...')` or `sp_executesql`), `SELECT ... INTO` a real table, `DROP PROCEDURE`/`FUNCTION`/`VIEW`, and `ALTER TABLE ... ALTER COLUMN`.
 - Add `--confirm-write` **only after the user approved that exact write in chat**, never just to make it run. → [db-workflow.md](references/db-workflow.md)
 - Always blocked, with no flag to unlock them. Show the SQL to the user to run by hand:
-  - `DROP TABLE` and `DROP DATABASE`
+  - `DROP TABLE` for a persistent/global table and `DROP DATABASE` (a single local `#name` temporary table is allowed)
   - `ALTER TABLE ... DROP COLUMN` or `SWITCH`
   - `xp_cmdshell`
   - `DELETE`/`UPDATE` without `WHERE`, in `query` and `exec`
@@ -257,6 +257,12 @@ fui query "SELECT TOP 5 ID, Name FROM tblX" --json | jq -r '.[].Name'
 
 ## Connections and secrets
 
+For any DB exploration, schema, SQL, or API/SP design, start with `fui db list -p <project>` and use a saved connection with `--db`. These operations use its **dbToken**. A `userToken` is only for the `acc` management lookup and end-user API calls; it cannot authenticate SQL requests.
+
+One `userToken` is reusable across projects in the same SSO zone (the parent domain, e.g. `*.lhu.edu.vn`). When a project has no token, the CLI looks for one on the exact API host first, then on another host in that zone. Do not ask for a new login when there is one unique token in the zone. A different zone needs its own token; if several distinct tokens exist in the zone, use `--user-token-from <project/connectionName>` for `db alias list` or `db add-by-name` to select an already saved token without exposing it. → [db-workflow.md](references/db-workflow.md) §6a.
+
+If no connection exists, find the project's tAPI domain with `fui project sync -p <project>` when needed, then run `fui db alias list -p <project>` to see databases the account may manage. Connect the chosen alias with `fui db add-by-name <apiName> -p <project>`. This discovers SQLServer/DatabaseName through `acc`, reuses a SQL UID/PWD pair from a saved dbToken (same apiDomain preferred; another domain works when it is the only login), builds a new dbToken, tests it against the target DB, and fetches schema. With several source logins, select one with `--borrow-from <project/connectionName>`. If there is no saved SQL login, use `--uid <login> --pwd -` or `--pwd-env VAR` with `add-by-name`. A management userToken alone cannot reveal the SQL password; never treat the `Password` field from `acc` as one. Then use `--db <project/connectionName>` for DB work.
+
 ```bash
 printf %s "$TOKEN" | fui db add docs -p lhu-docs --token - --api-domain tapi.lhu.edu.vn --user-token-env UT
 fui db add local -p demo --conn-env SQLITE_URL    # sqlite:// connects directly (MSSQL goes through tAPI)
@@ -268,11 +274,12 @@ fui token decode --db lhu-docs/docs               # never shows the password
 Secrets are accepted only from stdin (`-`) or `--*-env VAR`. Never echo or paste token values.
 
 - Never `cat`, `jq` or otherwise print `_db/_connections.json` or `~/.config/fui/config.json`. Use `fui db list`, `fui token decode` or `fui config`; they never print secrets.
-- No token at hand? `fui db user-token` lists fingerprints of the tokens already in the workspace; copy one with `--from <project/alias>`. The value never appears.
-- Know the alias but not the connection string? `fui db alias list`, then `fui db add-by-name <apiName>`: it borrows the SQL login of a connection on the same apiDomain.
+- Need a management userToken for the `acc` lookup? `fui db user-token` lists fingerprints of tokens already in the workspace; copy one with `--from <project/alias>`. This does not create a dbToken. The value never appears.
+- Know the alias but not the connection string? `fui db alias list`, then `fui db add-by-name <apiName>`: it reuses a saved SQL UID/PWD pair and combines it with the target server/database returned by `acc`.
 - `db add` / `db add-by-name` take `--name <connectionName>`; omitted, it is suggested from apiName, then apiName_zone. The same server + database re-added keeps its name, and folders are never renamed.
+- `fui db remove <project>/<connectionName>` removes one local connection from `_connections.json`. It does not change the server; cached schema and SQL files under `_db/<connectionName>/` remain available.
 - `right *` and `db alias new` write to the shared acc system. Ask the user first, especially for `delete`.
-- `_db/_connections.json` is version 2. An old v1 file is upgraded the first time fui reads it (the old file goes to `_history/`); `fui db migrate` does it for every project at once.
+- `_db/_connections.json` has no `version` field. Existing files with `"version": 2` or connections missing `apiName` are normalized on first read (the old file goes to `_history/`); `fui db migrate` does this for every project at once.
 
 ## FUI conventions
 

package/skills/fui/references/INDEX.md

@@ -49,7 +49,7 @@ Load: `fui skill ref references/a.md references/b.md` (several at once OK).
 
 - SP naming, params, URL, response, errors, wiring → `tapi-reference.md`
 - 200 but empty/wrong data, or changing/removing params of an SP a module calls: lenient binding (missing → `NULL`, extra → ignored, never errors) → `tapi-reference.md` §2
-- HTTP headers in SP (`User-Agent`, `Cookie`, `X-Forwarded-For`, client IP, device/browser): `@sys_header_*`, each `-` → `_` → `tapi-reference.md` §2
+- Remote address in SP: `@sys_RemoteIP varchar(15)` from `REMOTE_ADDR`; HTTP headers (`User-Agent`, `Cookie`, `X-Forwarded-For`, device/browser): `@sys_header_*`, each `-` → `_`, except `Authorization` → `tapi-reference.md` §2
 - SP permission checks (5 patterns, `@sys_SystemRight`, `getSystemRight`) → `tapi-permission-patterns.md`
 - File upload/download/view (`spAPIFILE_`, `fileContent`, `tblFileData`) → `tapi-file-api.md`
 - SQL CLR: httpCall, sendMail, ImageResize, FileReader, RegexMatch… → `sql-clr-functions.md`

package/skills/fui/references/component-quickref.md

@@ -41,23 +41,25 @@ Prefer `f-*`; use `v-*` only when no FUI equivalent exists.
 
 ## Components needing JS/CSS imports
 
-**When adding or removing one of these, run `fui import list` and add/remove the matching imports.**
+**Before using any built-in control, inspect `defaultControlAttr[control].import` in `scripts/component.js` for V2 or `scripts/component-3.0.js` for V3.** That ordered array is the source of truth for JS/CSS URLs. The table below is a quick reference, not an exhaustive list. When adding or removing a control with imports, run `fui import list` and add/remove the matching imports. Do not substitute a similar CDN URL without checking the selected framework's source.
 
 | Component         | Required imports                                                                                         |
 | ----------------- | -------------------------------------------------------------------------------------------------------- |
 | `f-pdfmake`       | `/include/pdfmake/pdfmake.min.js` · `/include/pdfmake/print.min.js` · `/include/pdfmake/vfs_fonts.js`    |
 | `f-file-upload`   | `/include/plupload-2.3.7/plupload.full.min.js`                                                           |
-| `f-image-update`  | `/include/vue-advanced-cropper/index.umd.js` · `/include/vue-advanced-cropper/style.css`                 |
+| `f-image-update`  | V2: `/include/vue-advanced-cropper/index.umd.js` · `/include/vue-advanced-cropper/style.css`; V3: use the two `unpkg.com/vue-advanced-cropper` URLs in `component-3.0.js` |
 | `f-qrcode`        | `/include/qrcode/qrcode.min.js`                                                                          |
 | `f-qrcode-reader` | `/include/qrcode/qrcode-reader.min.js`                                                                   |
 | `f-echart`        | `/include/chart/echarts.min.js` · `/include/chart/fechart.js` (**in this order**) — Apache ECharts       |
 | `f-sheet`         | `/include/ag-grid/ag-grid-community.min.js` · `/include/ag-grid/fsheet.js` (**in this order**) — AG Grid |
 | `f-editor`        | `/include/ckeditor5/build/ckeditor.js`                                                                   |
 | `f-editor-dialog` | `/include/ckeditor5/build/ckeditor.js`                                                                   |
+| `f-audio`, `f-audio-recorder` | `/include/audio/vueaudio.js` |
+| `f-q-and-a`, `f-etest-review` | MathJax, Q&A CSS, context menu, audio and QandA.js; `f-q-and-a` also needs CKEditor and Plupload. V3 `f-q-and-a` additionally loads Sortable and vuedraggable. Read the complete ordered array in the matching `component*.js`. |
 
 > **Bundled, NO import needed:** `v-*` (Vuetify) · `f-table` · `f-dialog` · `f-button` ·
 > `f-date` · `f-time` · `f-search` · `f-menu` · `f-radiobox` · `f-box` · `f-label` · `f-header` ·
-> `f-title` · `f-slider` · `f-excel-reader` — and any component not in the table above.
+> `f-title` · `f-slider` · `f-excel-reader`. Other components may also declare `import` in `defaultControlAttr`; check the source before assuming none is needed.
 
 **Workflow when adding a component with imports** (see `fui import --help`):
 

package/skills/fui/references/db-table-design.md

@@ -2,7 +2,7 @@
 
 > Owns: **table design rules: naming, PK/FK, audit columns, data types**. Connection/SP workflow: [db-workflow.md](db-workflow.md). Load when designing a new schema.
 
-> **DDL — structure changes OK, data loss not:** `ALTER TABLE ... ADD` (column/constraint) and `DROP CONSTRAINT` run directly via fui. `ALTER COLUMN` (type change) runs but **needs `--confirm-write`** — narrowing numeric/time precision silently loses data. `CREATE TABLE`, `DROP COLUMN`, `DROP TABLE` are **hard-blocked**; the developer runs them. Conventions below are documentation — present DDL to the user for approval before running.
+> **DDL — structure changes OK, data loss not:** `ALTER TABLE ... ADD` (column/constraint), `DROP CONSTRAINT`, and `DROP TABLE #name` for one local temporary table run directly via fui. `ALTER COLUMN` (type change) runs but **needs `--confirm-write`** — narrowing numeric/time precision silently loses data. `CREATE TABLE`, `DROP COLUMN`, and dropping persistent or global (`##name`) tables are **hard-blocked**; the developer runs them. Conventions below are documentation — present DDL to the user for approval before running.
 >
 > DB connection, dbToken, schema, SP workflow: [db-workflow.md](db-workflow.md). Multi-table/multi-module app design: [system-design.md](system-design.md).
 

package/skills/fui/references/db-workflow.md

@@ -33,7 +33,6 @@ One `_db/` subfolder PER connection. The folder name is a short, readable `conne
 
 ```json
 {
-  "version": 2,
   "default": "docs",
   "connections": {
     "docs": {
@@ -59,20 +58,19 @@ One `_db/` subfolder PER connection. The folder name is a short, readable `conne
 
 | Field       | Req | Meaning                                                            |
 | ----------- | --- | ------------------------------------------------------------------ |
-| `version`   | ✅  | Always `2` for this layout                                         |
 | key         | ✅  | `connectionName`, also the folder name (`docs`, `docs_lhbs`)       |
 | `apiName`   | ✅  | tAPI alias in `"API": "/{apiName}/Ten"`; may repeat across zones   |
 | `apiDomain` | ✅  | Host only, NO alias, NO trailing `/` (`api.example3.vn`)           |
 | `sqlServer` | ✅  | SQL Server host; with `database`, identifies the physical database |
 | `database`  | ✅  | Database name; with `sqlServer`, prevents duplicate connections    |
 | `dbToken`   | ✅  | Base64 SQL Server connection string                                |
-| `userToken` | ❌  | Bearer to test `spAPI_*` after deploy                              |
+| `userToken` | ❌  | Bearer for `acc` management lookup and end-user `spAPI_*` calls; never a SQL credential |
 
 Without `--sql-server`/`--database`, `fui db add` reads both from the connection string in the token.
 
 **Naming:** pass `--name <connectionName>` for a specific name. Omitted, fui suggests `apiName` first; if taken, adds the zone from `apiDomain` (`docs` → `docs_lhbs`); still taken, adds the database and a number. Names take letters, digits, `.`, `_`, `-` and are lowercased. The same server + database added again keeps its existing name.
 
-**v1 compatibility, no folder moves:** an old record without `apiName` reads as `apiName = connectionName = key`, and the file is rewritten as version 2 the first time fui reads it (old file kept in `_history/`). fui never renames old SQL folders. A new connection can take its own name, so an alias repeated across zones can sit next to the old record.
+**Older files, no folder moves:** a record without `apiName` reads as `apiName = connectionName = key`. A legacy `"version": 2` marker is accepted. On first read, fui normalizes the file without a version field (old file kept in `_history/`). It never renames old SQL folders.
 
 > **CRITICAL — `apiDomain` has two meanings:** `_connections.json` → bare host (`api.example3.vn`); `project.json` `data.apiDomain` → full base URL with apiName + trailing `/` (`https://tapi.example.vn/acc/`). Top bug: bare host + apiName without `/` → `tapi.lhu.edu.vnts` instead of `tapi.lhu.edu.vn/ts`. See [tapi-reference.md](tapi-reference.md) §3. Don't build URLs; copy the `url (reference only, not called; copy verbatim)` line from `fui sp verify`/`fui sp help`.
 
@@ -107,11 +105,12 @@ Without `--sql-server`/`--database`, `fui db add` reads both from the connection
 Never extract UID/PWD by hand (PowerShell etc.) — exposes credentials.
 
 1. `fui db alias list` — no args: tAPI injects `@sys_UserID` from the Bearer token, so `SM_Modules_ManagerSelect` returns only DBs you're granted. Columns `APIName | SQLServer | DatabaseName | ModuleName | Enable`; `--search` filters client-side (APIName/DatabaseName/ModuleName, case-insensitive).
-2. `fui db add-by-name <apiName>` — looks up SQLServer/DatabaseName on acc → borrows the UID/PWD pair of an existing connection → builds dbToken → tests `SELECT 1` before saving anything → saves + fetches schema to `_db/{connectionName}/`. Never prints dbToken/UID/PWD.
+2. `fui db add-by-name <apiName>` — looks up SQLServer/DatabaseName on acc → borrows the UID/PWD pair of an existing connection, or takes `--uid <login> --pwd -` / `--pwd-env VAR` → builds dbToken → tests `SELECT 1` before saving anything → saves + fetches schema to `_db/{connectionName}/`. Never prints dbToken/UID/PWD.
 
-- Several different logins in workspace → menu; pass `--borrow-from <projectId>/<connectionName>`. Same login across one group's connections is not ambiguous.
+- Reuse the UID/PWD pair from a saved connection; target SQLServer and DatabaseName come from `acc` and may differ from the source. Prefer sources on the same apiDomain; if none exist, a unique login elsewhere in the workspace is tried against the target DB. Several different logins → menu; pass `--borrow-from <projectId>/<connectionName>`. Credentials are never printed.
 - "apiName not found" = alias doesn't exist OR you're not granted it. Don't assume a typo; run `fui db alias list`.
-- Project with no connections works: apiDomain from local `project.json`, userToken borrowed from another project on the same domain (auto only if exactly one candidate, else menu). Else pass `--api-domain` + `--user-token-env VAR`.
+- A project with no connection can use apiDomain from local `project.json`. A project whose connection lacks userToken can use that connection's apiDomain. In either case fui looks for a token on the exact API host first, then another host in the same SSO zone (auto only if one distinct token; otherwise use `--user-token-from <project/connectionName>`). Else pass `--api-domain` + `--user-token-env VAR`.
+- `userToken` authorizes only the `acc` lookup. It cannot become a `dbToken` or reveal a SQL password. If no saved dbToken contains a usable SQL login, supply the SQL login and password through `add-by-name`, or supply a dbToken through `fui db add`.
 
 > ⚠️ `Password` in `SM_Modules_ManagerSelect` is a tAPI internal hash, not the SQL password — unusable for dbToken. fui never prints it.
 
@@ -127,7 +126,7 @@ Never extract UID/PWD by hand (PowerShell etc.) — exposes credentials.
 5. Module uses other aliases? Repeat 4 per alias. Added connections do NOT become default (use --default).
 ```
 
-Already have a dbToken → skip 3–4, use `fui db add`.
+Already have a dbToken → skip 3–4, use `fui db add`. Already connected → skip discovery and use `--db <project/connectionName>` for schema, SQL, SP and API design.
 
 ## 3. Building a dbToken
 
@@ -178,19 +177,19 @@ UID/PWD changed, Server/Database unchanged:
 
 ```
 dbToken   → SQL Server connection to run schema/SP
-userToken → call tAPI REST API as an end-user (test spAPI_*)
+userToken → discover managed aliases through acc, or call tAPI REST API as an end-user
 ```
 
-- Shareable across projects with the same `GroupName` in `_projectInfo.json` (`{ "GroupName": "GroupA" }`): `fui db user-token --db <connectionName> --from <project/connectionName>` — no re-login. `fui db user-token` with no source lists workspace tokens.
+- Shareable across projects in the same SSO zone: `fui db user-token --db <connectionName> --from <project/connectionName>` copies a specific token without exposing its value. `fui db user-token` with no source lists workspace tokens. `GroupName` alone does not prove that two projects share an SSO zone.
 - Stored PER CONNECTION in `_connections.json`. Multi-DB → one token per connection; pass `--db <connectionName>` (omitted → default).
-- `fui right …` calls `acc` with the userToken of the connection matching the current apiName (else default); missing there → rights commands fail even if other connections have tokens.
+- `fui right …` calls `acc` with the userToken of the connection matching the current apiName (else default); if absent, fui searches saved tokens in the same SSO zone.
 - Not set at `fui db add` → `fui db user-token --db <connectionName> --token -`.
 
 ## 6a. Domain SSO — same parent domain: token works, don't ask
 
 SSO is by parent domain: all APIs under e.g. `*.lhu.edu.vn` (`tapi.lhu.edu.vn`, `api.lhu.edu.vn`, `capnhatluong.lhu.edu.vn`…) accept the same `userToken`.
 
-- Have a token for that parent domain → use it for other projects/aliases there. Do NOT ask the user, do NOT test-call to "verify", do NOT make them log in.
+- Have a token for that parent domain → use it for other projects/aliases there. Fui prefers an exact API host match, then a unique token from the zone. If several distinct tokens qualify, use `--user-token-from <project/connectionName>` for the `acc` lookup. Do not ask the user to log in again when the right token is already saved.
 - Scanning the workspace for tokens (`fui db user-token` without a token) is valid and recommended.
 
 | Case                                              | Action                                       |
@@ -248,7 +247,7 @@ Prints `📋 Archived orphaned local SP file(s)...` when archiving. Name match i
 - `--db` omitted → inferred from SP name (schema + local `.sql` per connection). One match → silent; zero or several (same name in two DBs) → connection menu, pick and re-run, don't guess.
 - `fui sp save` for a brand-new SP can't infer: multi-connection projects must pass `--db` on first save.
 
-> `fui sp verify` reads the real body, not the name; hard error if unreadable. Write-API testing with `fui module simulate`: [tools-registry.md](tools-registry.md). Guards on `DROP TABLE`/`DROP DATABASE`/`ALTER TABLE`, `xp_cmdshell`, `DELETE`/`UPDATE` without `WHERE` are enforced in code, no bypass. `sp deploy` also refuses a file that is not exactly one definition of the named object. Writes via `fui query`/`fui exec` need `--confirm-write`.
+> `fui sp verify` reads the real body, not the name; hard error if unreadable. Write-API testing with `fui module simulate`: [tools-registry.md](tools-registry.md). Guards on persistent/global `DROP TABLE` (a single local `#name` temporary table is allowed), `DROP DATABASE`/`ALTER TABLE`, `xp_cmdshell`, `DELETE`/`UPDATE` without `WHERE` are enforced in code, no bypass. `sp deploy` also refuses a file that is not exactly one definition of the named object. Writes via `fui query`/`fui exec` need `--confirm-write`.
 
 **Rollback:** read `{workspace}/_history/{projectId}/_db/{connectionName}/{name}_{timestamp}.sql` → `fui sp save <name> -f <old file>` → `fui sp deploy <name>`.
 
@@ -285,6 +284,7 @@ EXEC XDATA23.Calendar2015.dbo.spIO_IN_DeleteMonHocInfo @MonHocID, @ErrorDKMH OUT
 | Alias only, no dbToken                            | `fui db alias list` → `fui db add-by-name`                                                                                 |
 | Which DBs am I granted                            | `fui db alias list`                                                                                                        |
 | Another DB (new alias)                            | `fui db add-by-name` again                                                                                                 |
+| Remove one local connection                        | `fui db remove <project>/<connectionName>`; server alias and cached schema/SQL files remain                               |
 | Connections + default                             | `fui db list`                                                                                                              |
 | UID/PWD changed                                   | `fui db token-rebuild` (`--db` if several)                                                                                 |
 | Set userToken                                     | `fui db user-token` (`--db` if several)                                                                                    |

package/skills/fui/references/new-session.md

@@ -26,19 +26,19 @@ Session for **one project** → `{workspaceRoot}/{projectId}`; general work →
 **Windows (PowerShell)** — most common:
 
 ```powershell
-powershell -Command "Start-Process powershell -ArgumentList '-NoExit', '-Command', 'cd ''<THƯ-MỤC>''; claude --rc'"
+powershell -Command "Start-Process powershell -ArgumentList '-NoExit', '-Command', 'Remove-Item Env:\CLAUDE_CODE_CHILD_SESSION -ErrorAction SilentlyContinue; cd ''<THƯ-MỤC>''; claude --rc'"
 ```
 
-**macOS:**
+**macOS** (by analogy, not yet verified on a Mac — see §4):
 
 ```bash
-osascript -e 'tell app "Terminal" to do script "cd \"<THƯ-MỤC>\" && claude --rc"'
+osascript -e 'tell app "Terminal" to do script "unset CLAUDE_CODE_CHILD_SESSION; cd \"<THƯ-MỤC>\" && claude --rc"'
 ```
 
-**Linux** (swap `gnome-terminal` for the terminal in use):
+**Linux** (swap `gnome-terminal` for the terminal in use; not yet verified):
 
 ```bash
-gnome-terminal -- bash -c 'cd "<THƯ-MỤC>" && claude --rc; exec bash'
+gnome-terminal -- bash -c 'unset CLAUDE_CODE_CHILD_SESSION; cd "<THƯ-MỤC>" && claude --rc; exec bash'
 ```
 
 Team default is **`claude --rc`**. If the user gives other flags (`-c`, `-r`, `--resume <id>`…), substitute them.
@@ -46,7 +46,7 @@ Team default is **`claude --rc`**. If the user gives other flags (`-c`, `-r`, `-
 **With an opening prompt ("open a new session and do X") → the prompt goes BEFORE `--rc`, not after.** `--rc` consumes the token right after it as its own value (see the warning in §4), so placing it first opens an idle session instead of running the prompt. Correct order:
 
 ```powershell
-powershell -Command "Start-Process powershell -ArgumentList '-NoExit', '-Command', 'cd ''<THƯ-MỤC>''; claude ''X'' --rc'"
+powershell -Command "Start-Process powershell -ArgumentList '-NoExit', '-Command', 'Remove-Item Env:\CLAUDE_CODE_CHILD_SESSION -ErrorAction SilentlyContinue; cd ''<THƯ-MỤC>''; claude ''X'' --rc'"
 ```
 
 ---
@@ -80,6 +80,26 @@ Report **PID + folder**. No new process ⇒ say it failed; **never report succes
 
 **Windows: go through `powershell`.** `claude` is usually `claude.ps1` (not `.exe`), so `cmd` can't run it.
 
+**🔴 Clear `CLAUDE_CODE_CHILD_SESSION` first, before `cd` — otherwise the new session can never be resumed.** The session running this command carries `CLAUDE_CODE_CHILD_SESSION=1`, and `Start-Process` / `osascript` / `bash -c` inherit the parent environment. The new `claude` sees the marker, treats itself as a child session and **turns transcript saving off**: it works normally but never appears in `claude --resume` (not even with Ctrl+A / all folders), however it is closed. A window the user opens by hand has no such variable, which is the only difference — not the folder, not how the window was closed. Verified on Windows (2026-10-17): the status line "Transcript saving is off — inherited CLAUDE_CODE_CHILD_SESSION marker" disappears once `Remove-Item Env:\CLAUDE_CODE_CHILD_SESSION -ErrorAction SilentlyContinue;` runs first.
+
+> In auto mode, the classifier **blocks this command the first time** ("Auto-Mode Bypass"). It goes through once the user has this allow rule in `~/.claude/settings.json` (verified — not a hard deny):
+> ```json
+> "permissions": {
+>   "allow": [
+>     "PowerShell(Start-Process powershell -ArgumentList '-NoExit', '-Command', 'Remove-Item Env:\\CLAUDE_CODE_CHILD_SESSION*)"
+>   ]
+> }
+> ```
+> The rule is per machine (it does not ship with the skill). If it is missing and the command is blocked, tell the user to add it. **Do not route around the block, and do not drop the `Remove-Item` step to get past it** — that brings back the unresumable session.
+>
+> **Offer to add the rule yourself.** After the block, explain in one or two sentences why the rule is needed (so the new session can be resumed, not to bypass oversight), then ask the user whether you should add it. Only on an explicit yes:
+> 1. Read `~/.claude/settings.json` first; create it only if it does not exist.
+> 2. Append the rule to `permissions.allow`, keeping every existing entry (merge, never replace the array).
+> 3. The rule must end with `*)` — a missing `)` fails settings validation ("Malformed Tool(content) rule").
+> 4. Retry the open command once. If it is still blocked, stop and tell the user; do not try other variants.
+>
+> Never add the rule without the user's yes, and never add it pre-emptively before a block has actually happened.
+
 ---
 
 ## 5. The new session is an INDEPENDENT process

package/skills/fui/references/script-map.md

@@ -75,7 +75,7 @@ numeral(value).format("0,0.0"); // 1,234,567.8
 numeral(_.sumBy(items, key)).format("0,0"); // tổng cột trong bảng
 ```
 
-> `f-*` needing extra JS/CSS: [component-quickref.md](component-quickref.md) §Components needing JS/CSS imports.
+> Before using any `f-*` control, check `defaultControlAttr[control].import` in the matching V2/V3 `component*.js` file. Its ordered URLs determine required JS/CSS; [component-quickref.md](component-quickref.md) is a quick reference.
 
 ## 1) scripts/fastproject.js — V3: fastproject-3.0.js
 

package/skills/fui/references/system-design.md

@@ -36,7 +36,7 @@ Before any module.json:
 
 1. Tables + PK + FK for **all** entities. Per [db-table-design.md](db-table-design.md): `tbl` + PascalCase, PK `[Entity]ID`, audit `CreateUser/CreateTime/UpdateUser/UpdateTime`.
 2. n-n → junction table (e.g. `tblUserRole`).
-3. **`CREATE TABLE` is run by the developer** — fui has no guard for it, so do not run it yourself; present DDL for review. Existing tables, gated by data loss: `ALTER TABLE ... ADD` and `DROP CONSTRAINT` run directly; `ALTER COLUMN` needs `--confirm-write`; `DROP COLUMN`/`DROP TABLE`/`SWITCH` hard-blocked.
+3. **`CREATE TABLE` is run by the developer** — fui has no guard for it, so do not run it yourself; present DDL for review. Existing tables, gated by data loss: `ALTER TABLE ... ADD`, `DROP CONSTRAINT`, and `DROP TABLE #name` for a local temporary table run directly; `ALTER COLUMN` needs `--confirm-write`; `DROP COLUMN`/persistent or global `DROP TABLE`/`SWITCH` hard-blocked.
 4. Design lookup/catalog tables early (shared dropdowns).
 
 **Output:** tables + relations, user-confirmed.

package/skills/fui/references/tapi-reference.md

@@ -65,10 +65,11 @@ https://api.domain.vn/app/FunctionName/value1/value2
 | `@sys_SystemRight`         | int           | Tiered right (1=low, 9=high)                                                                                 |
 | `@sys_FunctionRight`       | varchar(2000) | Function rights as `[AD][RPT][MGR]`                                                                          |
 | `@sys_SessionID`           | varchar(50)   | Auth session ID                                                                                              |
+| `@sys_RemoteIP`            | varchar(15)   | `Request.ServerVariables("REMOTE_ADDR")`; the address seen by the server                                      |
 | `@sys_RawData`             | nvarchar(max) | Full client JSON body                                                                                        |
-| `@sys_header_{HeaderName}` | varchar(n)    | **A family, not one fixed name** — reads any HTTP header; `NULL` if client didn't send it. Naming rule below |
+| `@sys_header_{HeaderName}` | varchar(n)    | Request header except `Authorization`; missing header becomes `NULL`. Naming rule below                     |
 
-> **CRITICAL — never put `@sys_` in module.json `IN`.** tAPI fills all `@sys_*` from the session; client values are **ignored or overwritten**.
+> **CRITICAL — never put recognized `@sys_*` params in module.json `IN`.** tAPI assigns them from authenticated user data, the HTTP request, or the JSON body; a same-named client field is ignored.
 >
 > ```json
 > // ❌ SAI — không đưa sys_ vào IN
@@ -78,9 +79,21 @@ https://api.domain.vn/app/FunctionName/value1/value2
 > "IN": { "ModuleID": "sModuleID" }
 > ```
 
+To read the remote address in an API procedure, declare the parameter with this exact name and type. tAPI reads `REMOTE_ADDR`; do not send it in `IN`. `varchar(15)` fits IPv4 addresses, so check the deployment's IPv6 and proxy behavior before using it for a wider address range:
+
+```sql
+CREATE PROCEDURE spAPI_AuditVisit
+    @sys_UserID varchar(9),
+    @sys_RemoteIP varchar(15)
+AS
+BEGIN
+    SELECT @sys_UserID AS UserID, @sys_RemoteIP AS RemoteIP;
+END
+```
+
 #### `@sys_header_*` — read HTTP headers: replace each `-` with `_`
 
-Works for **any** header. `-` is invalid in SQL Server param names, so the literal name won't compile:
+Works for request headers **except `Authorization`**. The suffix after `@sys_header_` must be nonempty. tAPI lowercases the SQL parameter name, takes the suffix, replaces every `_` with `-`, then looks it up in `Request.Headers`. `-` is invalid in SQL Server param names, so the literal name won't compile:
 
 ```sql
 -- ❌ SAI — lỗi cú pháp ngay lúc CREATE PROCEDURE, không phải lỗi runtime
@@ -88,7 +101,7 @@ Works for **any** header. `-` is invalid in SQL Server param names, so the liter
 ```
 
 - **No quoting works**: `@[sys_header_User-Agent]` and `@"sys_header_User-Agent"` are both invalid. Renaming is the **only** way.
-- **Each `-` → one `_`.** 1-to-1: don't drop characters, change case, or merge segments.
+- **Each `-` → one `_` in the SP declaration.** tAPI reverses every `_` in the suffix to `-`; a header whose actual name contains `_` cannot be represented exactly by this convention.
 
 | HTTP header        | SP param                                 |
 | ------------------ | ---------------------------------------- |
@@ -99,26 +112,28 @@ Works for **any** header. `-` is invalid in SQL Server param names, so the liter
 | `Cookie`           | `@sys_header_Cookie` — no `-`, unchanged |
 
 - Reverse (reading an existing SP): drop `@sys_header_`, turn remaining `_` into `-` — `@sys_header_Accept_Language` → `Accept-Language`.
-- Matching is **case-insensitive** (prefix and name): `@sys_header_User_Agent`, `@sys_Header_User_Agent`, `@sys_header_USER_AGENT` are the same header (so `@sys_Header_RequestID` works). Still use standard casing (`User-Agent`, not `USER_AGENT`). Only `_` for `-` is mandatory.
+- Matching is **case-insensitive** (prefix and header lookup): `@sys_header_User_Agent`, `@sys_Header_User_Agent`, `@sys_header_USER_AGENT` request the same header. Use `_` for each `-`; tAPI does not insert separators, so `@sys_Header_RequestID` requests `RequestID`, not `Request-ID`.
+- `@sys_header_Authorization` is **not exposed**: the code skips assignment for that header. It does not explicitly set the SQL parameter to `NULL` in this branch; do not rely on its value.
+- A missing header is assigned `DBNull.Value`; exceptions during header lookup are caught without a reported error, so diagnose a missing value against the actual incoming request.
 
 ```sql
 CREATE PROCEDURE spAPI_AuditLog_Insert
     @Action                     nvarchar(100),
     @sys_UserID                 varchar(9),
+    @sys_RemoteIP               varchar(15),
     @sys_header_User_Agent      nvarchar(500),
     @sys_header_X_Forwarded_For varchar(200)
 AS
 BEGIN
-    -- ISNULL vì client không gửi header thì tham số là NULL, không phải chuỗi rỗng
-    INSERT INTO tblAuditLog (Action, UserID, UserAgent, ClientIP, CreateTime)
-    VALUES (@Action, @sys_UserID,
-            ISNULL(@sys_header_User_Agent, N'(không có)'),
-            ISNULL(@sys_header_X_Forwarded_For, ''),
-            GETDATE());
+    SELECT @Action AS ActionName,
+           @sys_UserID AS UserID,
+           @sys_RemoteIP AS RemoteIP,
+           @sys_header_User_Agent AS UserAgent,
+           @sys_header_X_Forwarded_For AS ForwardedFor;
 END
 ```
 
-- **Still `@sys_*`:** auto-filled, **not** in `IN`, **no default** (`= null` is a hard error; `fui sp deploy` blocks it, see below).
+- **Still recognized `@sys_*`:** auto-filled, **not** in `IN`, **no default** (`= null` is a hard error; `fui sp deploy` blocks it, see below).
 - **Missing header → `NULL`** (not `''`) — normal, e.g. script/server-to-server calls often lack `User-Agent`. Wrap in `ISNULL(...)` at use: comparisons give UNKNOWN (`WHERE @sys_header_User_Agent <> 'bot'` **drops** the row), and `+` concatenation gives `NULL` (blanks the whole log string).
 - **Untrusted (client-supplied, spoofable).** Log/stats only, never authorization; take rights from `@sys_UserID`/`@sys_SystemRight` (from the verified token).
 

package/skills/fui/references/tools-registry.md

@@ -53,7 +53,7 @@ Users name commands loosely, often in Vietnamese.
 | "let someone edit this project" / "cấp quyền admin project", "thêm người vào project"                  | `fui user search` → `fui user add`                                      |
 | "who can edit this project" / "ai được sửa project này"                                                | `fui user list`                                                         |
 | "update project.json", "edit the project menu" / "sửa menu project"                                    | edit `{projectId}/project.json`, then `fui project publish-config`      |
-| "connect the DB but I only know the alias" / "không có dbToken"                                        | `fui db alias list` → `fui db add-by-name`                              |
+| "connect the DB but I only know the alias" / "không có dbToken"                                        | `fui db list` → `fui db alias list` → `fui db add-by-name`; if no saved SQL login, supply `--uid` and `--pwd -` / `--pwd-env` |
 | "sync / refresh the project" / "đồng bộ project", "lấy project.json"                                   | `fui project sync`                                                      |
 | "get / pull / clone / refresh the module" / "lấy module về", "pull mới nhất"                           | `fui module get`                                                        |
 | "new module" / "tạo module mới"                                                                        | `fui module new`                                                        |
@@ -79,7 +79,7 @@ Users name commands loosely, often in Vietnamese.
 | "DB password changed" / "đổi password DB", "rebuild dbToken"                                           | `fui db token-rebuild`                                                  |
 | "which DBs does this project use" / "project này đang nối những DB nào"                                | `fui db list`                                                           |
 | "connect one more database" / "nối thêm một database nữa"                                              | `fui db add` again with the new apiName                                 |
-| **"sync the db", "refresh schema"** / **"đồng bộ db", "cập nhật schema", "làm mới schema"**            | `fui schema pull`, **never `fui project sync`**. No connection yet → ask for the connection details; do not run something else instead |
+| **"sync the db", "refresh schema"** / **"đồng bộ db", "cập nhật schema", "làm mới schema"**            | `fui db list` → existing `--db`: `fui schema pull`. No connection: `fui db alias list` → `fui db add-by-name` (automatically fetches schema) |
 | "list designs" / "có style nào" · "use style X" / "dùng style X"                                       | `fui design list` · `fui design read <brand>`                           |
 
 ## Commands
@@ -152,6 +152,7 @@ Scope, for every component command:
 | `db list`, `db test`, `token decode`       | R   | ✅   | never print secrets |
 | `db alias list`                            | R   | ✅   | databases your token may manage on `acc`; run it when an alias is unknown or `db add-by-name` finds nothing |
 | `db add`, `db add-by-name`                 | M   | ✅   | test, save, fetch the schema. `add-by-name` borrows a SQL login from a connection on the same `apiDomain`; "not found" means the alias does not exist **or** you may not manage it |
+| `db remove <project>/<connectionName>`    | M   | ⚠️   | removes only the named local connection and updates the default; server alias and cached `_db/<connectionName>/` files remain |
 | `db user-token`, `db default`, `db migrate` | M  | ✅   | local only |
 | `db token-rebuild`                         | M   | ⚠️   | overwrites the stored token; `--db` is required when the project has several connections |
 | `db alias new`                             | M   | ⚠️   | registers an existing database as a tAPI alias on `acc`; the login must be the **application** account (execute-only), never a `db_owner` dev login. Ask the user first |
@@ -199,7 +200,7 @@ Guarding with a right code that is not defined fails silently: `rightTest()` is
 ## Database rules (enforced in code)
 
 - `query` / `exec`: say what the SQL does and what data it touches, and wait for the user. Writes (INSERT, UPDATE…SET, DELETE, MERGE, TRUNCATE, `SELECT … INTO` a real table, a write inside `EXEC('…')` or `sp_executesql`, `DROP PROCEDURE`/`FUNCTION`/`VIEW`, ALTER COLUMN) exit 3 until `--confirm-write`, added only after the user approved that exact write. It is a confirmation gate, not an obstacle to work around.
-- Table DDL is judged by data loss, **per statement**: free `ALTER TABLE … ADD` and `DROP CONSTRAINT` · `--confirm-write` for `ALTER COLUMN` (narrowing numeric or date precision loses data silently) · always blocked `DROP TABLE`, `DROP DATABASE`, `DROP COLUMN`, `SWITCH`, `xp_cmdshell` and any action fui cannot parse. A blocked statement wins over a confirmable one. `DELETE`/`UPDATE` without `WHERE` is blocked too, in `query` and `exec` (a `MERGE` is scoped by its `ON`). A `--` or a quote inside a `[name]` or `"name"` does not hide the statements after it. Show blocked SQL for the user to run by hand; no flag unlocks it.
+- Table DDL is judged by data loss, **per statement**: free `ALTER TABLE … ADD`, `DROP CONSTRAINT`, and `DROP TABLE #name` for one local temporary table · `--confirm-write` for `ALTER COLUMN` (narrowing numeric or date precision loses data silently) · always blocked `DROP TABLE` on persistent or global (`##name`) tables, mixed drop lists, `DROP DATABASE`, `DROP COLUMN`, `SWITCH`, `xp_cmdshell` and any action fui cannot parse. A blocked statement wins over a confirmable one. `DELETE`/`UPDATE` without `WHERE` is blocked too, in `query` and `exec` (a `MERGE` is scoped by its `ON`). A `--` or a quote inside a `[name]` or `"name"` does not hide the statements after it. Show blocked SQL for the user to run by hand; no flag unlocks it.
 - Never call a live API SP or run sub-queries "to test" it: read its body (`fui sp get`) and reason, or `fui sp verify <name|Fn>`. `sp verify` calls no endpoint; its only network reads are metadata (`OBJECT_DEFINITION` when no local `.sql`, permissions with `--check-grant`). An unreadable body is a hard error: it never guesses from the name.
 - `--mocks` for an SP that **exists** must be the snippet `fui sp verify` prints, never a guessed shape. On `🚨 UNVERIFIED MOCK SHAPE` stop, run `fui sp verify`, copy the snippet. Invented data is right only for an SP that does not exist yet.
 - `fui sp deploy` asks the server whether the object exists, so `CREATE PROCEDURE` for an existing SP is fine: do not edit the file to `ALTER` and redeploy. tAPI parameters with a default value are hard-blocked.

package/skills/fui/scripts/fechart.js

@@ -119,7 +119,8 @@ const LAYOUT = {
   lineHeight:       1.4, // hệ số quy cỡ chữ → chiều cao dòng thực tế
   legendRowHeight:  24,  // một hàng legend (chữ + đệm của item); config.legendRows nếu nhiều hàng
   axisLabelBand:    26,  // nhãn trục hoành vẽ NGOÀI grid, phải chừa thêm ở dưới
-  axisTopBand:      10   // nửa chữ của nhãn trục tung cao nhất nhô lên trên mép grid
+  axisTopBand:      10,  // nửa chữ của nhãn trục tung cao nhất nhô lên trên mép grid
+  seriesLabelBand:  18   // label của bar/line có thể nhô lên trên grid (font 12px × line-height 1.4)
 };
 
 
@@ -656,10 +657,34 @@ Vue.component('f-echart', {
       return (hasText ? line(fs) : 0) + (hasSub ? gap + line(sfs) : 0);
     },
 
+    // Đổi inset dạng px / '%' về px để có thể kiểm tra khoảng hở tối thiểu.
+    // Các từ khoá ngữ nghĩa như 'middle' không thể quy đổi an toàn nên trả null.
+    insetPx(value) {
+      if (typeof value === 'number' && Number.isFinite(value)) return value;
+      if (typeof value === 'string') {
+        const s = value.trim();
+        if (/^-?\d+(\.\d+)?px$/.test(s)) return parseFloat(s);
+        if (/^-?\d+(\.\d+)?%$/.test(s)) {
+          const rawHeight = (this.$el && this.$el.clientHeight) || this.chartHeight || 0;
+          const h = typeof rawHeight === 'number' ? rawHeight : parseFloat(rawHeight);
+          return h ? h * parseFloat(s) / 100 : null;
+        }
+      }
+      return null;
+    },
+
+    // Đặt block không sớm hơn con trỏ hiện tại. Nhờ vậy top: 0 / '2%' của
+    // module không thể kéo legend hoặc vùng vẽ đè lên block đứng trước nó.
+    enforceInset(block, edge, minimum) {
+      const px = this.insetPx(block[edge]);
+      if (block[edge] == null || (px != null && px < minimum)) block[edge] = minimum;
+      return px == null ? minimum : Math.max(px, minimum);
+    },
+
     // Xếp chỗ theo chiều dọc: đi từ mép trên xuống và từ mép dưới lên, mỗi khối
     // hiện diện lấy đúng chiều cao của mình + một `gap`; phần chưa ai lấy là vùng vẽ.
-    // Giá trị do module tự khai luôn được tôn trọng — engine chỉ điền chỗ còn trống,
-    // và vẫn cộng dồn theo giá trị đó để khối sau không đè lên khối module đã đặt.
+    // Giá trị do module tự khai được giữ khi đủ rộng; nếu quá nhỏ thì được nâng lên
+    // mức tối thiểu để không block nào phá gap 12px với block đứng trước.
     applyLayout(opt, hints) {
       const P = LAYOUT.padding, G = LAYOUT.gap;
       const title  = Array.isArray(opt.title)  ? opt.title[0]  : opt.title;
@@ -668,9 +693,14 @@ Vue.component('f-echart', {
 
       const titleH = this.measureTitle(title);
       if (titleH) {
-        if (title.top == null) title.top = top;
-        // top dạng '%' / 'middle' / 'bottom': không quy ra px được → chỉ giữ mức tối thiểu
-        top = typeof title.top === 'number' ? title.top + titleH + G : Math.max(top, P + titleH + G);
+        const titleAnchor = title.bottom != null && title.top == null ? 'bottom' : 'top';
+        if (titleAnchor === 'bottom') {
+          const y = this.enforceInset(title, 'bottom', bottom);
+          bottom = y + titleH + G;
+        } else {
+          const y = this.enforceInset(title, 'top', top);
+          top = y + titleH + G;
+        }
       }
 
       if (legend && legend.show !== false) {
@@ -679,11 +709,11 @@ Vue.component('f-echart', {
                       : legend.bottom != null ? 'bottom'
                       : (hints.legendAnchor || 'top');
         if (anchor === 'top') {
-          if (legend.top == null) legend.top = top;
-          top = typeof legend.top === 'number' ? legend.top + legendH + G : Math.max(top, P + legendH + G);
+          const y = this.enforceInset(legend, 'top', top);
+          top = y + legendH + G;
         } else {
-          if (legend.bottom == null) legend.bottom = bottom;
-          bottom = typeof legend.bottom === 'number' ? legend.bottom + legendH + G : Math.max(bottom, P + legendH + G);
+          const y = this.enforceInset(legend, 'bottom', bottom);
+          bottom = y + legendH + G;
         }
       }
 
@@ -700,8 +730,22 @@ Vue.component('f-echart', {
         if (Array.isArray(opt.grid)) return; // multi-grid: module tự lo bố cục
         const dg = _.isPlainObject(declared.grid) ? declared.grid : {};
         const g  = _.isPlainObject(opt.grid) ? opt.grid : (opt.grid = {});
-        if (dg.top    == null) g.top    = Math.max(LAYOUT.gridTop, top + LAYOUT.axisTopBand);
-        if (dg.bottom == null) g.bottom = Math.max(LAYOUT.gridBottom, bottom + LAYOUT.axisLabelBand);
+        const series = Array.isArray(opt.series) ? opt.series : (opt.series ? [opt.series] : []);
+        const hasOuterTopLabel = series.some(s => {
+          if (!s || !s.label || s.label.show !== true) return false;
+          const pos = s.label.position;
+          return pos == null || pos === 'top' || pos === 'outside';
+        });
+        const topBand = Math.max(LAYOUT.axisTopBand, hasOuterTopLabel ? LAYOUT.seriesLabelBand : 0);
+        const minTop = Math.max(LAYOUT.gridTop, top + topBand);
+        const minBottom = Math.max(LAYOUT.gridBottom, bottom + LAYOUT.axisLabelBand);
+
+        // Custom grid vẫn được giữ nếu rộng hơn; nếu quá sát thì nâng lên mức tối thiểu.
+        // Đây là điểm trước kia làm chart có grid.top nhỏ phá vỡ gap 12px.
+        const declaredTop = this.insetPx(dg.top);
+        const declaredBottom = this.insetPx(dg.bottom);
+        g.top = declaredTop == null ? minTop : Math.max(declaredTop, minTop);
+        g.bottom = declaredBottom == null ? minBottom : Math.max(declaredBottom, minBottom);
         if (dg.left   == null) g.left   = LAYOUT.gridLeft;
         if (dg.right  == null) g.right  = LAYOUT.gridRight;
         return;