@harperfast/template-react-ts-studio 1.11.6 → 1.12.0

package/.agents/skills/harper-best-practices/AGENTS.md

@@ -359,7 +359,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    }
    ```
 
-2. **Query nearest neighbors** using the `sort` parameter with `attribute` and `target`:
+2. **Query nearest neighbors** using `Document.search()` with the `sort` parameter. Set `attribute` to the indexed field and `target` to the query vector:
 
    ```javascript
    let results = Document.search({
@@ -368,7 +368,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-3. **Combine with filter conditions** to narrow results before or during traversal:
+3. **Combine with filter conditions** to narrow results before or during graph traversal. Selective conditions are automatically diverted to an exact-scan strategy:
 
    ```javascript
    let results = Document.search({
@@ -378,9 +378,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   Conditions are evaluated _during_ graph traversal (predicate-aware search), not after. Very selective conditions are automatically diverted to an exact-scan strategy.
-
-4. **Use a `vectorFilter` function** for predicates not expressible as conditions (JavaScript API only):
+4. **Apply a function predicate during traversal** using `vectorFilter` (JavaScript API only). The function receives each candidate record and must return a synchronous boolean. It must be side-effect free and fast:
 
    ```javascript
    let results = Document.search(
@@ -394,9 +392,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    );
    ```
 
-   The function receives a frozen candidate record and must return a boolean synchronously. It must be side-effect free and fast — it can run once per candidate visited during traversal (verdicts are memoized per query).
-
-5. **Filter by distance threshold** using `target` on a condition instead of `sort`:
+5. **Filter by distance threshold** using `target` directly on a condition alongside `comparator` and `value`. This returns matches within the threshold without using `sort`:
 
    ```javascript
    let results = Document.search({
@@ -409,7 +405,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-6. **Include computed distance in results** using the `$distance` field in `select`:
+6. **Include computed distance in results** by adding `$distance` to `select`. Works with both `sort`-based and threshold queries:
 
    ```javascript
    let results = Document.search({
@@ -419,9 +415,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   `$distance` works in both `sort`-based and threshold-based queries.
-
-7. **Override the distance function or exploration budget per query** via options on the `sort` descriptor:
+7. **Tune per-query search options** on the `sort` descriptor using `distance` and `ef`:
 
    ```javascript
    let results = Document.search({
@@ -430,10 +424,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   - `distance` — `"cosine"`, `"euclidean"`, or `"dotProduct"`.
-   - `ef` — overrides the search exploration budget for this query. Higher values improve recall at the cost of latency.
-
-8. **Tune filtered traversal** when a `vectorFilter` is very selective by raising `ef` or `filterExpansion`:
+8. **Tune filtered traversal** with `ef` and `filterExpansion` when a `vectorFilter` is very selective. The visit budget is `ef * filterExpansion` nodes (`filterExpansion` defaults to `24`):
 
    ```javascript
    let results = Document.search(
@@ -446,60 +437,48 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    );
    ```
 
-   Filtered traversal visits at most `ef * filterExpansion` nodes (`filterExpansion` defaults to `24`). If the budget is exhausted before results fill, the search returns what was found rather than erroring.
+9. **Enforce row-level access control** using `rowFilter` on search and subscription targets (JavaScript API only). Attach it in an operation override. For vector queries, `rowFilter` participates in HNSW traversal so callers receive the k nearest _matching_ records:
 
-9. **Configure HNSW index parameters** directly on the directive:
+   ```javascript
+   function canReadReport(record, context) {
+   	const user = context.user;
+   	if (user?.role?.permission?.super_user) return true;
+   	return user?.username != null && record.ownerId != null && record.ownerId === user.username;
+   }
 
-   ```graphql
-   type Document @table {
-   	id: Long @primaryKey
-   	textEmbeddings: [Float]
-   		@indexed(type: "HNSW", distance: "euclidean", optimizeRouting: 0, efConstructionSearch: 100)
+   export class Reports extends tables.Reports {
+   	search(target) {
+   		target.rowFilter = canReadReport;
+   		return super.search(target);
+   	}
    }
    ```
 
-   | Parameter              | Default           | Description                                                                                      |
-   | ---------------------- | ----------------- | ------------------------------------------------------------------------------------------------ |
-   | `distance`             | `"cosine"`        | Distance function: `"cosine"`, `"euclidean"`, or `"dotProduct"`                                  |
-   | `efConstruction`       | `100`             | Max nodes explored during index construction. Higher = better recall, lower = better performance |
-   | `M`                    | `16`              | Preferred connections per graph layer                                                            |
-   | `optimizeRouting`      | `0.5`             | Heuristic aggressiveness for omitting redundant connections (0 = off, 1 = most aggressive)       |
-   | `mL`                   | computed from `M` | Normalization factor for level generation                                                        |
-   | `efConstructionSearch` | auto-scaled       | Max nodes explored during search. When unset, auto-scales with index size                        |
-   | `quantization`         | —                 | `"int8"` stores vectors quantized to int8                                                        |
-   | `filterExpansion`      | `24`              | Visit-budget multiplier for filtered search                                                      |
+##### HNSW Index Parameters
 
-   Changing `efConstructionSearch` on an existing index does not trigger a rebuild. Changing structural parameters (`distance`, `M`, `efConstruction`, `quantization`) does rebuild the index.
+Configure parameters directly on `@indexed(type: "HNSW", ...)`:
 
-10. **Enable int8 quantization** to reduce index size and memory usage:
-
-    ```graphql
-    type Document @table {
-    	id: Long @primaryKey
-    	textEmbeddings: [Float] @indexed(type: "HNSW", quantization: "int8")
-    }
-    ```
+| Parameter              | Default           | Description                                                                                      |
+| ---------------------- | ----------------- | ------------------------------------------------------------------------------------------------ |
+| `distance`             | `"cosine"`        | Distance function: `"cosine"`, `"euclidean"`, or `"dotProduct"`                                  |
+| `efConstruction`       | `100`             | Max nodes explored during index construction. Higher = better recall, lower = better performance |
+| `M`                    | `16`              | Preferred connections per graph layer                                                            |
+| `optimizeRouting`      | `0.5`             | Heuristic aggressiveness for omitting redundant connections (0 = off, 1 = most aggressive)       |
+| `mL`                   | computed from `M` | Normalization factor for level generation                                                        |
+| `efConstructionSearch` | auto-scaled       | Max nodes explored during search. When unset, auto-scales with index size                        |
+| `quantization`         | —                 | `"int8"` stores vectors quantized to int8                                                        |
+| `filterExpansion`      | `24`              | Visit-budget multiplier for filtered search: visits at most `ef * filterExpansion` nodes         |
 
-    Graph navigation uses quantized distances. For `sort` queries, Harper re-ranks results against full-precision vectors, restoring exact ordering and exact `$distance` values. Distance-threshold queries filter on the approximate distance.
-
-11. **Implement record-level access control** by overriding `allowRead(user, target, context)` on the table resource. During vector queries the check participates in graph traversal, so a restricted user receives the k nearest records they are allowed to see:
-
-    ```javascript
-    export class Reports extends tables.Reports {
-    	allowRead(user, target, context) {
-    		if (!super.allowRead(user, target, context)) return false;
-    		if (user.role.permission.super_user) return true;
-    		if (this.ownerId == null) return true;
-    		return this.ownerId === user.id;
-    	}
-    }
-    ```
+Per-query `sort` descriptor options:
 
-    The check must be synchronous, side-effect free, and fast. `this` is the frozen record during per-record evaluation. A thrown exception denies that record (fail closed).
+| Option     | Values                                    | Description                                            |
+| ---------- | ----------------------------------------- | ------------------------------------------------------ |
+| `distance` | `"cosine"`, `"euclidean"`, `"dotProduct"` | Overrides the index's distance function for this query |
+| `ef`       | integer                                   | Overrides the search exploration budget for this query |
 
 #### Examples
 
-**Full schema with custom HNSW parameters:**
+**Index with custom HNSW parameters:**
 
 ```graphql
 type Document @table {
@@ -509,7 +488,16 @@ type Document @table {
 }
 ```
 
-**Nearest-neighbor search with distance output:**
+**Index with int8 quantization:**
+
+```graphql
+type Document @table {
+	id: Long @primaryKey
+	textEmbeddings: [Float] @indexed(type: "HNSW", quantization: "int8")
+}
+```
+
+**Nearest-neighbor search with distance included:**
 
 ```javascript
 let results = Document.search({
@@ -519,7 +507,7 @@ let results = Document.search({
 });
 ```
 
-**Filtered vector search with tuned traversal budget:**
+**Filtered traversal with tuned budget:**
 
 ```javascript
 let results = Document.search(
@@ -532,28 +520,16 @@ let results = Document.search(
 );
 ```
 
-**Distance threshold query (no ranking, cutoff only):**
-
-```javascript
-let results = Document.search({
-	conditions: {
-		attribute: 'textEmbeddings',
-		comparator: 'lt',
-		value: 0.1,
-		target: searchVector,
-	},
-});
-```
-
 #### Notes
 
-- Use `@indexed(type: "HNSW")` on a `[Float]` field — not on scalar fields.
-- The default `distance` is `"cosine"`. Override it per-index via the directive or per-query via the `sort` descriptor.
-- `efConstruction` seeds the initial value of `efConstructionSearch`. When neither is set, the search budget auto-scales with index size.
-- `vectorFilter` is available from the JavaScript API only; it cannot be expressed in a REST query string.
-- The parameter name Harper reads is `efConstructionSearch` (not `efSearchConstruction`).
-- `$distance` must be listed explicitly in `select` to appear in results.
-- For record-level `allowRead` overrides: collection-scope calls (where `this.ownerId` is `null`) should return `true` to open the connection; per-record filtering happens during query execution and event delivery.
+- `vectorFilter` and `rowFilter` are available from the JavaScript API only; they cannot be set through REST or QUERY request data.
+- `vectorFilter` functions must be synchronous, side-effect free, and fast — they can run once per candidate record visited during traversal; verdicts are memoized per query. Records passed to them are frozen.
+- `rowFilter` does not apply to a direct primary-key `get`.
+- Changing `efConstructionSearch` on an existing index does not trigger a rebuild. Structural parameters (`distance`, `M`, `efConstruction`, `quantization`) do rebuild the index when changed.
+- With `quantization: "int8"`, nearest-neighbor `sort` queries re-rank results against full-precision vectors, restoring exact ordering and exact `$distance` values. Distance-threshold (`lt`/`le`) queries filter on the approximate distance.
+- The correct parameter name is `efConstruction` (seeds the construction budget) and `efConstructionSearch` (controls search budget). The name `efSearchConstruction` is a previous documentation error.
+- When no `ef` is passed and `efConstructionSearch` (or `efConstruction`) is not explicitly set, the search budget auto-scales with index size.
+- `cosine` is the default distance function when `distance` is not specified.
 
 ### 1.5 Using the Blob Data Type
 

package/.agents/skills/harper-best-practices/rules/vector-indexing.md

@@ -5,8 +5,8 @@ metadata:
   mode: generate
   sources:
     - reference/v5/database/schema.md#Vector Indexing
-  sourceCommit: 3749d0c54be457a2a65d9a63c738a5dc88989ecd
-  inputHash: 225b9bea420d9adc
+  sourceCommit: d4cbc1a7dd400462e4a3243f944b3a75d89b29ca
+  inputHash: 1dae788bc850ea90
 ---
 
 # Vector Indexing
@@ -28,7 +28,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    }
    ```
 
-2. **Query nearest neighbors** using the `sort` parameter with `attribute` and `target`:
+2. **Query nearest neighbors** using `Document.search()` with the `sort` parameter. Set `attribute` to the indexed field and `target` to the query vector:
 
    ```javascript
    let results = Document.search({
@@ -37,7 +37,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-3. **Combine with filter conditions** to narrow results before or during traversal:
+3. **Combine with filter conditions** to narrow results before or during graph traversal. Selective conditions are automatically diverted to an exact-scan strategy:
 
    ```javascript
    let results = Document.search({
@@ -47,9 +47,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   Conditions are evaluated _during_ graph traversal (predicate-aware search), not after. Very selective conditions are automatically diverted to an exact-scan strategy.
-
-4. **Use a `vectorFilter` function** for predicates not expressible as conditions (JavaScript API only):
+4. **Apply a function predicate during traversal** using `vectorFilter` (JavaScript API only). The function receives each candidate record and must return a synchronous boolean. It must be side-effect free and fast:
 
    ```javascript
    let results = Document.search(
@@ -63,9 +61,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    );
    ```
 
-   The function receives a frozen candidate record and must return a boolean synchronously. It must be side-effect free and fast — it can run once per candidate visited during traversal (verdicts are memoized per query).
-
-5. **Filter by distance threshold** using `target` on a condition instead of `sort`:
+5. **Filter by distance threshold** using `target` directly on a condition alongside `comparator` and `value`. This returns matches within the threshold without using `sort`:
 
    ```javascript
    let results = Document.search({
@@ -78,7 +74,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-6. **Include computed distance in results** using the `$distance` field in `select`:
+6. **Include computed distance in results** by adding `$distance` to `select`. Works with both `sort`-based and threshold queries:
 
    ```javascript
    let results = Document.search({
@@ -88,9 +84,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   `$distance` works in both `sort`-based and threshold-based queries.
-
-7. **Override the distance function or exploration budget per query** via options on the `sort` descriptor:
+7. **Tune per-query search options** on the `sort` descriptor using `distance` and `ef`:
 
    ```javascript
    let results = Document.search({
@@ -99,10 +93,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   - `distance` — `"cosine"`, `"euclidean"`, or `"dotProduct"`.
-   - `ef` — overrides the search exploration budget for this query. Higher values improve recall at the cost of latency.
-
-8. **Tune filtered traversal** when a `vectorFilter` is very selective by raising `ef` or `filterExpansion`:
+8. **Tune filtered traversal** with `ef` and `filterExpansion` when a `vectorFilter` is very selective. The visit budget is `ef * filterExpansion` nodes (`filterExpansion` defaults to `24`):
 
    ```javascript
    let results = Document.search(
@@ -115,60 +106,48 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    );
    ```
 
-   Filtered traversal visits at most `ef * filterExpansion` nodes (`filterExpansion` defaults to `24`). If the budget is exhausted before results fill, the search returns what was found rather than erroring.
+9. **Enforce row-level access control** using `rowFilter` on search and subscription targets (JavaScript API only). Attach it in an operation override. For vector queries, `rowFilter` participates in HNSW traversal so callers receive the k nearest _matching_ records:
 
-9. **Configure HNSW index parameters** directly on the directive:
+   ```javascript
+   function canReadReport(record, context) {
+   	const user = context.user;
+   	if (user?.role?.permission?.super_user) return true;
+   	return user?.username != null && record.ownerId != null && record.ownerId === user.username;
+   }
 
-   ```graphql
-   type Document @table {
-   	id: Long @primaryKey
-   	textEmbeddings: [Float]
-   		@indexed(type: "HNSW", distance: "euclidean", optimizeRouting: 0, efConstructionSearch: 100)
+   export class Reports extends tables.Reports {
+   	search(target) {
+   		target.rowFilter = canReadReport;
+   		return super.search(target);
+   	}
    }
    ```
 
-   | Parameter              | Default           | Description                                                                                      |
-   | ---------------------- | ----------------- | ------------------------------------------------------------------------------------------------ |
-   | `distance`             | `"cosine"`        | Distance function: `"cosine"`, `"euclidean"`, or `"dotProduct"`                                  |
-   | `efConstruction`       | `100`             | Max nodes explored during index construction. Higher = better recall, lower = better performance |
-   | `M`                    | `16`              | Preferred connections per graph layer                                                            |
-   | `optimizeRouting`      | `0.5`             | Heuristic aggressiveness for omitting redundant connections (0 = off, 1 = most aggressive)       |
-   | `mL`                   | computed from `M` | Normalization factor for level generation                                                        |
-   | `efConstructionSearch` | auto-scaled       | Max nodes explored during search. When unset, auto-scales with index size                        |
-   | `quantization`         | —                 | `"int8"` stores vectors quantized to int8                                                        |
-   | `filterExpansion`      | `24`              | Visit-budget multiplier for filtered search                                                      |
-
-   Changing `efConstructionSearch` on an existing index does not trigger a rebuild. Changing structural parameters (`distance`, `M`, `efConstruction`, `quantization`) does rebuild the index.
-
-10. **Enable int8 quantization** to reduce index size and memory usage:
-
-    ```graphql
-    type Document @table {
-    	id: Long @primaryKey
-    	textEmbeddings: [Float] @indexed(type: "HNSW", quantization: "int8")
-    }
-    ```
-
-    Graph navigation uses quantized distances. For `sort` queries, Harper re-ranks results against full-precision vectors, restoring exact ordering and exact `$distance` values. Distance-threshold queries filter on the approximate distance.
-
-11. **Implement record-level access control** by overriding `allowRead(user, target, context)` on the table resource. During vector queries the check participates in graph traversal, so a restricted user receives the k nearest records they are allowed to see:
-
-    ```javascript
-    export class Reports extends tables.Reports {
-    	allowRead(user, target, context) {
-    		if (!super.allowRead(user, target, context)) return false;
-    		if (user.role.permission.super_user) return true;
-    		if (this.ownerId == null) return true;
-    		return this.ownerId === user.id;
-    	}
-    }
-    ```
-
-    The check must be synchronous, side-effect free, and fast. `this` is the frozen record during per-record evaluation. A thrown exception denies that record (fail closed).
+### HNSW Index Parameters
+
+Configure parameters directly on `@indexed(type: "HNSW", ...)`:
+
+| Parameter              | Default           | Description                                                                                      |
+| ---------------------- | ----------------- | ------------------------------------------------------------------------------------------------ |
+| `distance`             | `"cosine"`        | Distance function: `"cosine"`, `"euclidean"`, or `"dotProduct"`                                  |
+| `efConstruction`       | `100`             | Max nodes explored during index construction. Higher = better recall, lower = better performance |
+| `M`                    | `16`              | Preferred connections per graph layer                                                            |
+| `optimizeRouting`      | `0.5`             | Heuristic aggressiveness for omitting redundant connections (0 = off, 1 = most aggressive)       |
+| `mL`                   | computed from `M` | Normalization factor for level generation                                                        |
+| `efConstructionSearch` | auto-scaled       | Max nodes explored during search. When unset, auto-scales with index size                        |
+| `quantization`         | —                 | `"int8"` stores vectors quantized to int8                                                        |
+| `filterExpansion`      | `24`              | Visit-budget multiplier for filtered search: visits at most `ef * filterExpansion` nodes         |
+
+Per-query `sort` descriptor options:
+
+| Option     | Values                                    | Description                                            |
+| ---------- | ----------------------------------------- | ------------------------------------------------------ |
+| `distance` | `"cosine"`, `"euclidean"`, `"dotProduct"` | Overrides the index's distance function for this query |
+| `ef`       | integer                                   | Overrides the search exploration budget for this query |
 
 ## Examples
 
-**Full schema with custom HNSW parameters:**
+**Index with custom HNSW parameters:**
 
 ```graphql
 type Document @table {
@@ -178,7 +157,16 @@ type Document @table {
 }
 ```
 
-**Nearest-neighbor search with distance output:**
+**Index with int8 quantization:**
+
+```graphql
+type Document @table {
+	id: Long @primaryKey
+	textEmbeddings: [Float] @indexed(type: "HNSW", quantization: "int8")
+}
+```
+
+**Nearest-neighbor search with distance included:**
 
 ```javascript
 let results = Document.search({
@@ -188,7 +176,7 @@ let results = Document.search({
 });
 ```
 
-**Filtered vector search with tuned traversal budget:**
+**Filtered traversal with tuned budget:**
 
 ```javascript
 let results = Document.search(
@@ -201,25 +189,13 @@ let results = Document.search(
 );
 ```
 
-**Distance threshold query (no ranking, cutoff only):**
-
-```javascript
-let results = Document.search({
-	conditions: {
-		attribute: 'textEmbeddings',
-		comparator: 'lt',
-		value: 0.1,
-		target: searchVector,
-	},
-});
-```
-
 ## Notes
 
-- Use `@indexed(type: "HNSW")` on a `[Float]` field — not on scalar fields.
-- The default `distance` is `"cosine"`. Override it per-index via the directive or per-query via the `sort` descriptor.
-- `efConstruction` seeds the initial value of `efConstructionSearch`. When neither is set, the search budget auto-scales with index size.
-- `vectorFilter` is available from the JavaScript API only; it cannot be expressed in a REST query string.
-- The parameter name Harper reads is `efConstructionSearch` (not `efSearchConstruction`).
-- `$distance` must be listed explicitly in `select` to appear in results.
-- For record-level `allowRead` overrides: collection-scope calls (where `this.ownerId` is `null`) should return `true` to open the connection; per-record filtering happens during query execution and event delivery.
+- `vectorFilter` and `rowFilter` are available from the JavaScript API only; they cannot be set through REST or QUERY request data.
+- `vectorFilter` functions must be synchronous, side-effect free, and fast — they can run once per candidate record visited during traversal; verdicts are memoized per query. Records passed to them are frozen.
+- `rowFilter` does not apply to a direct primary-key `get`.
+- Changing `efConstructionSearch` on an existing index does not trigger a rebuild. Structural parameters (`distance`, `M`, `efConstruction`, `quantization`) do rebuild the index when changed.
+- With `quantization: "int8"`, nearest-neighbor `sort` queries re-rank results against full-precision vectors, restoring exact ordering and exact `$distance` values. Distance-threshold (`lt`/`le`) queries filter on the approximate distance.
+- The correct parameter name is `efConstruction` (seeds the construction budget) and `efConstructionSearch` (controls search budget). The name `efSearchConstruction` is a previous documentation error.
+- When no `ef` is passed and `efConstructionSearch` (or `efConstruction`) is not explicitly set, the search budget auto-scales with index size.
+- `cosine` is the default distance function when `distance` is not specified.

package/README.md

@@ -96,6 +96,54 @@ You should see the following:
 
 Take a look at the [default configuration](./config.yaml), which specifies how files are handled in your application.
 
+### One-time setup (private repos)
+
+So the cluster can clone your private repository, give it a read-only token — sealed on your machine, stored encrypted:
+
+```sh
+npm run deploy:setup
+```
+
+This fetches your cluster's public key, has you provide a GitHub token (a fine-grained PAT with **Contents: Read-only**, or your `gh` CLI session), **encrypts it locally**, and stores only the ciphertext in the cluster's secret store. The plaintext never leaves your machine; the cluster decrypts it in memory only while cloning. Because the token is durable, rollbacks keep working for as long as it's valid.
+
+> Public repo? Skip this step and drop `credential=true` from the `deploy` script — no credential is needed.
+
+### Deploy
+
+```sh
+npm run deploy
+```
+
+This deploys the current commit over `git+https` — commit and push first, since the cluster clones from GitHub and only sees pushed commits. To roll back, check out an older commit and run it again.
+
+### Deploy automatically from CI
+
+The included [GitHub Actions workflow](./.github/workflows/deploy.yaml) deploys whenever you push a version tag:
+
+```sh
+git tag v1.0.0
+git push --tags
+```
+
+Add these repository secrets first, under **Settings → Secrets and variables → Actions**:
+
+- `HARPER_CLI_TARGET` — your cluster's operations URL (e.g. `https://your-cluster.harperdb.io:9925`)
+- `HARPER_CLI_REFRESH_TOKEN` — a long-lived token CI authenticates with, so no password is stored
+
+Set both in one command — this pipes the credentials straight from your cluster into GitHub, so the token never appears on screen or in your shell history:
+
+```sh
+harper login --for-ci | gh secret set --env-file -
+```
+
+(No [`gh` CLI](https://cli.github.com)? `harper login --for-ci | pbcopy` copies the two lines for you to paste in by hand.)
+
+The clone credential already lives in the cluster from `npm run deploy:setup`, so CI never handles a token itself.
+
+### Private npm dependencies
+
+If your app depends on private npm packages, run `npm run deploy:setup` again and choose the npm registry — the same sealed-token flow, stored as a separate credential.
+
 ## Keep Going!
 
 For more information about getting started with Harper and building applications, see our [getting started guide](https://docs.harperdb.io/docs).

package/agent/skills/harper-best-practices/AGENTS.md

@@ -359,7 +359,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    }
    ```
 
-2. **Query nearest neighbors** using the `sort` parameter with `attribute` and `target`:
+2. **Query nearest neighbors** using `Document.search()` with the `sort` parameter. Set `attribute` to the indexed field and `target` to the query vector:
 
    ```javascript
    let results = Document.search({
@@ -368,7 +368,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-3. **Combine with filter conditions** to narrow results before or during traversal:
+3. **Combine with filter conditions** to narrow results before or during graph traversal. Selective conditions are automatically diverted to an exact-scan strategy:
 
    ```javascript
    let results = Document.search({
@@ -378,9 +378,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   Conditions are evaluated _during_ graph traversal (predicate-aware search), not after. Very selective conditions are automatically diverted to an exact-scan strategy.
-
-4. **Use a `vectorFilter` function** for predicates not expressible as conditions (JavaScript API only):
+4. **Apply a function predicate during traversal** using `vectorFilter` (JavaScript API only). The function receives each candidate record and must return a synchronous boolean. It must be side-effect free and fast:
 
    ```javascript
    let results = Document.search(
@@ -394,9 +392,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    );
    ```
 
-   The function receives a frozen candidate record and must return a boolean synchronously. It must be side-effect free and fast — it can run once per candidate visited during traversal (verdicts are memoized per query).
-
-5. **Filter by distance threshold** using `target` on a condition instead of `sort`:
+5. **Filter by distance threshold** using `target` directly on a condition alongside `comparator` and `value`. This returns matches within the threshold without using `sort`:
 
    ```javascript
    let results = Document.search({
@@ -409,7 +405,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-6. **Include computed distance in results** using the `$distance` field in `select`:
+6. **Include computed distance in results** by adding `$distance` to `select`. Works with both `sort`-based and threshold queries:
 
    ```javascript
    let results = Document.search({
@@ -419,9 +415,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   `$distance` works in both `sort`-based and threshold-based queries.
-
-7. **Override the distance function or exploration budget per query** via options on the `sort` descriptor:
+7. **Tune per-query search options** on the `sort` descriptor using `distance` and `ef`:
 
    ```javascript
    let results = Document.search({
@@ -430,10 +424,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   - `distance` — `"cosine"`, `"euclidean"`, or `"dotProduct"`.
-   - `ef` — overrides the search exploration budget for this query. Higher values improve recall at the cost of latency.
-
-8. **Tune filtered traversal** when a `vectorFilter` is very selective by raising `ef` or `filterExpansion`:
+8. **Tune filtered traversal** with `ef` and `filterExpansion` when a `vectorFilter` is very selective. The visit budget is `ef * filterExpansion` nodes (`filterExpansion` defaults to `24`):
 
    ```javascript
    let results = Document.search(
@@ -446,60 +437,48 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    );
    ```
 
-   Filtered traversal visits at most `ef * filterExpansion` nodes (`filterExpansion` defaults to `24`). If the budget is exhausted before results fill, the search returns what was found rather than erroring.
+9. **Enforce row-level access control** using `rowFilter` on search and subscription targets (JavaScript API only). Attach it in an operation override. For vector queries, `rowFilter` participates in HNSW traversal so callers receive the k nearest _matching_ records:
 
-9. **Configure HNSW index parameters** directly on the directive:
+   ```javascript
+   function canReadReport(record, context) {
+   	const user = context.user;
+   	if (user?.role?.permission?.super_user) return true;
+   	return user?.username != null && record.ownerId != null && record.ownerId === user.username;
+   }
 
-   ```graphql
-   type Document @table {
-   	id: Long @primaryKey
-   	textEmbeddings: [Float]
-   		@indexed(type: "HNSW", distance: "euclidean", optimizeRouting: 0, efConstructionSearch: 100)
+   export class Reports extends tables.Reports {
+   	search(target) {
+   		target.rowFilter = canReadReport;
+   		return super.search(target);
+   	}
    }
    ```
 
-   | Parameter              | Default           | Description                                                                                      |
-   | ---------------------- | ----------------- | ------------------------------------------------------------------------------------------------ |
-   | `distance`             | `"cosine"`        | Distance function: `"cosine"`, `"euclidean"`, or `"dotProduct"`                                  |
-   | `efConstruction`       | `100`             | Max nodes explored during index construction. Higher = better recall, lower = better performance |
-   | `M`                    | `16`              | Preferred connections per graph layer                                                            |
-   | `optimizeRouting`      | `0.5`             | Heuristic aggressiveness for omitting redundant connections (0 = off, 1 = most aggressive)       |
-   | `mL`                   | computed from `M` | Normalization factor for level generation                                                        |
-   | `efConstructionSearch` | auto-scaled       | Max nodes explored during search. When unset, auto-scales with index size                        |
-   | `quantization`         | —                 | `"int8"` stores vectors quantized to int8                                                        |
-   | `filterExpansion`      | `24`              | Visit-budget multiplier for filtered search                                                      |
+##### HNSW Index Parameters
 
-   Changing `efConstructionSearch` on an existing index does not trigger a rebuild. Changing structural parameters (`distance`, `M`, `efConstruction`, `quantization`) does rebuild the index.
+Configure parameters directly on `@indexed(type: "HNSW", ...)`:
 
-10. **Enable int8 quantization** to reduce index size and memory usage:
-
-    ```graphql
-    type Document @table {
-    	id: Long @primaryKey
-    	textEmbeddings: [Float] @indexed(type: "HNSW", quantization: "int8")
-    }
-    ```
+| Parameter              | Default           | Description                                                                                      |
+| ---------------------- | ----------------- | ------------------------------------------------------------------------------------------------ |
+| `distance`             | `"cosine"`        | Distance function: `"cosine"`, `"euclidean"`, or `"dotProduct"`                                  |
+| `efConstruction`       | `100`             | Max nodes explored during index construction. Higher = better recall, lower = better performance |
+| `M`                    | `16`              | Preferred connections per graph layer                                                            |
+| `optimizeRouting`      | `0.5`             | Heuristic aggressiveness for omitting redundant connections (0 = off, 1 = most aggressive)       |
+| `mL`                   | computed from `M` | Normalization factor for level generation                                                        |
+| `efConstructionSearch` | auto-scaled       | Max nodes explored during search. When unset, auto-scales with index size                        |
+| `quantization`         | —                 | `"int8"` stores vectors quantized to int8                                                        |
+| `filterExpansion`      | `24`              | Visit-budget multiplier for filtered search: visits at most `ef * filterExpansion` nodes         |
 
-    Graph navigation uses quantized distances. For `sort` queries, Harper re-ranks results against full-precision vectors, restoring exact ordering and exact `$distance` values. Distance-threshold queries filter on the approximate distance.
-
-11. **Implement record-level access control** by overriding `allowRead(user, target, context)` on the table resource. During vector queries the check participates in graph traversal, so a restricted user receives the k nearest records they are allowed to see:
-
-    ```javascript
-    export class Reports extends tables.Reports {
-    	allowRead(user, target, context) {
-    		if (!super.allowRead(user, target, context)) return false;
-    		if (user.role.permission.super_user) return true;
-    		if (this.ownerId == null) return true;
-    		return this.ownerId === user.id;
-    	}
-    }
-    ```
+Per-query `sort` descriptor options:
 
-    The check must be synchronous, side-effect free, and fast. `this` is the frozen record during per-record evaluation. A thrown exception denies that record (fail closed).
+| Option     | Values                                    | Description                                            |
+| ---------- | ----------------------------------------- | ------------------------------------------------------ |
+| `distance` | `"cosine"`, `"euclidean"`, `"dotProduct"` | Overrides the index's distance function for this query |
+| `ef`       | integer                                   | Overrides the search exploration budget for this query |
 
 #### Examples
 
-**Full schema with custom HNSW parameters:**
+**Index with custom HNSW parameters:**
 
 ```graphql
 type Document @table {
@@ -509,7 +488,16 @@ type Document @table {
 }
 ```
 
-**Nearest-neighbor search with distance output:**
+**Index with int8 quantization:**
+
+```graphql
+type Document @table {
+	id: Long @primaryKey
+	textEmbeddings: [Float] @indexed(type: "HNSW", quantization: "int8")
+}
+```
+
+**Nearest-neighbor search with distance included:**
 
 ```javascript
 let results = Document.search({
@@ -519,7 +507,7 @@ let results = Document.search({
 });
 ```
 
-**Filtered vector search with tuned traversal budget:**
+**Filtered traversal with tuned budget:**
 
 ```javascript
 let results = Document.search(
@@ -532,28 +520,16 @@ let results = Document.search(
 );
 ```
 
-**Distance threshold query (no ranking, cutoff only):**
-
-```javascript
-let results = Document.search({
-	conditions: {
-		attribute: 'textEmbeddings',
-		comparator: 'lt',
-		value: 0.1,
-		target: searchVector,
-	},
-});
-```
-
 #### Notes
 
-- Use `@indexed(type: "HNSW")` on a `[Float]` field — not on scalar fields.
-- The default `distance` is `"cosine"`. Override it per-index via the directive or per-query via the `sort` descriptor.
-- `efConstruction` seeds the initial value of `efConstructionSearch`. When neither is set, the search budget auto-scales with index size.
-- `vectorFilter` is available from the JavaScript API only; it cannot be expressed in a REST query string.
-- The parameter name Harper reads is `efConstructionSearch` (not `efSearchConstruction`).
-- `$distance` must be listed explicitly in `select` to appear in results.
-- For record-level `allowRead` overrides: collection-scope calls (where `this.ownerId` is `null`) should return `true` to open the connection; per-record filtering happens during query execution and event delivery.
+- `vectorFilter` and `rowFilter` are available from the JavaScript API only; they cannot be set through REST or QUERY request data.
+- `vectorFilter` functions must be synchronous, side-effect free, and fast — they can run once per candidate record visited during traversal; verdicts are memoized per query. Records passed to them are frozen.
+- `rowFilter` does not apply to a direct primary-key `get`.
+- Changing `efConstructionSearch` on an existing index does not trigger a rebuild. Structural parameters (`distance`, `M`, `efConstruction`, `quantization`) do rebuild the index when changed.
+- With `quantization: "int8"`, nearest-neighbor `sort` queries re-rank results against full-precision vectors, restoring exact ordering and exact `$distance` values. Distance-threshold (`lt`/`le`) queries filter on the approximate distance.
+- The correct parameter name is `efConstruction` (seeds the construction budget) and `efConstructionSearch` (controls search budget). The name `efSearchConstruction` is a previous documentation error.
+- When no `ef` is passed and `efConstructionSearch` (or `efConstruction`) is not explicitly set, the search budget auto-scales with index size.
+- `cosine` is the default distance function when `distance` is not specified.
 
 ### 1.5 Using the Blob Data Type
 

package/agent/skills/harper-best-practices/rules/vector-indexing.md

@@ -5,8 +5,8 @@ metadata:
   mode: generate
   sources:
     - reference/v5/database/schema.md#Vector Indexing
-  sourceCommit: 3749d0c54be457a2a65d9a63c738a5dc88989ecd
-  inputHash: 225b9bea420d9adc
+  sourceCommit: d4cbc1a7dd400462e4a3243f944b3a75d89b29ca
+  inputHash: 1dae788bc850ea90
 ---
 
 # Vector Indexing
@@ -28,7 +28,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    }
    ```
 
-2. **Query nearest neighbors** using the `sort` parameter with `attribute` and `target`:
+2. **Query nearest neighbors** using `Document.search()` with the `sort` parameter. Set `attribute` to the indexed field and `target` to the query vector:
 
    ```javascript
    let results = Document.search({
@@ -37,7 +37,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-3. **Combine with filter conditions** to narrow results before or during traversal:
+3. **Combine with filter conditions** to narrow results before or during graph traversal. Selective conditions are automatically diverted to an exact-scan strategy:
 
    ```javascript
    let results = Document.search({
@@ -47,9 +47,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   Conditions are evaluated _during_ graph traversal (predicate-aware search), not after. Very selective conditions are automatically diverted to an exact-scan strategy.
-
-4. **Use a `vectorFilter` function** for predicates not expressible as conditions (JavaScript API only):
+4. **Apply a function predicate during traversal** using `vectorFilter` (JavaScript API only). The function receives each candidate record and must return a synchronous boolean. It must be side-effect free and fast:
 
    ```javascript
    let results = Document.search(
@@ -63,9 +61,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    );
    ```
 
-   The function receives a frozen candidate record and must return a boolean synchronously. It must be side-effect free and fast — it can run once per candidate visited during traversal (verdicts are memoized per query).
-
-5. **Filter by distance threshold** using `target` on a condition instead of `sort`:
+5. **Filter by distance threshold** using `target` directly on a condition alongside `comparator` and `value`. This returns matches within the threshold without using `sort`:
 
    ```javascript
    let results = Document.search({
@@ -78,7 +74,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-6. **Include computed distance in results** using the `$distance` field in `select`:
+6. **Include computed distance in results** by adding `$distance` to `select`. Works with both `sort`-based and threshold queries:
 
    ```javascript
    let results = Document.search({
@@ -88,9 +84,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   `$distance` works in both `sort`-based and threshold-based queries.
-
-7. **Override the distance function or exploration budget per query** via options on the `sort` descriptor:
+7. **Tune per-query search options** on the `sort` descriptor using `distance` and `ef`:
 
    ```javascript
    let results = Document.search({
@@ -99,10 +93,7 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    });
    ```
 
-   - `distance` — `"cosine"`, `"euclidean"`, or `"dotProduct"`.
-   - `ef` — overrides the search exploration budget for this query. Higher values improve recall at the cost of latency.
-
-8. **Tune filtered traversal** when a `vectorFilter` is very selective by raising `ef` or `filterExpansion`:
+8. **Tune filtered traversal** with `ef` and `filterExpansion` when a `vectorFilter` is very selective. The visit budget is `ef * filterExpansion` nodes (`filterExpansion` defaults to `24`):
 
    ```javascript
    let results = Document.search(
@@ -115,60 +106,48 @@ Apply this rule when adding a vector similarity search capability to a Harper ta
    );
    ```
 
-   Filtered traversal visits at most `ef * filterExpansion` nodes (`filterExpansion` defaults to `24`). If the budget is exhausted before results fill, the search returns what was found rather than erroring.
+9. **Enforce row-level access control** using `rowFilter` on search and subscription targets (JavaScript API only). Attach it in an operation override. For vector queries, `rowFilter` participates in HNSW traversal so callers receive the k nearest _matching_ records:
 
-9. **Configure HNSW index parameters** directly on the directive:
+   ```javascript
+   function canReadReport(record, context) {
+   	const user = context.user;
+   	if (user?.role?.permission?.super_user) return true;
+   	return user?.username != null && record.ownerId != null && record.ownerId === user.username;
+   }
 
-   ```graphql
-   type Document @table {
-   	id: Long @primaryKey
-   	textEmbeddings: [Float]
-   		@indexed(type: "HNSW", distance: "euclidean", optimizeRouting: 0, efConstructionSearch: 100)
+   export class Reports extends tables.Reports {
+   	search(target) {
+   		target.rowFilter = canReadReport;
+   		return super.search(target);
+   	}
    }
    ```
 
-   | Parameter              | Default           | Description                                                                                      |
-   | ---------------------- | ----------------- | ------------------------------------------------------------------------------------------------ |
-   | `distance`             | `"cosine"`        | Distance function: `"cosine"`, `"euclidean"`, or `"dotProduct"`                                  |
-   | `efConstruction`       | `100`             | Max nodes explored during index construction. Higher = better recall, lower = better performance |
-   | `M`                    | `16`              | Preferred connections per graph layer                                                            |
-   | `optimizeRouting`      | `0.5`             | Heuristic aggressiveness for omitting redundant connections (0 = off, 1 = most aggressive)       |
-   | `mL`                   | computed from `M` | Normalization factor for level generation                                                        |
-   | `efConstructionSearch` | auto-scaled       | Max nodes explored during search. When unset, auto-scales with index size                        |
-   | `quantization`         | —                 | `"int8"` stores vectors quantized to int8                                                        |
-   | `filterExpansion`      | `24`              | Visit-budget multiplier for filtered search                                                      |
-
-   Changing `efConstructionSearch` on an existing index does not trigger a rebuild. Changing structural parameters (`distance`, `M`, `efConstruction`, `quantization`) does rebuild the index.
-
-10. **Enable int8 quantization** to reduce index size and memory usage:
-
-    ```graphql
-    type Document @table {
-    	id: Long @primaryKey
-    	textEmbeddings: [Float] @indexed(type: "HNSW", quantization: "int8")
-    }
-    ```
-
-    Graph navigation uses quantized distances. For `sort` queries, Harper re-ranks results against full-precision vectors, restoring exact ordering and exact `$distance` values. Distance-threshold queries filter on the approximate distance.
-
-11. **Implement record-level access control** by overriding `allowRead(user, target, context)` on the table resource. During vector queries the check participates in graph traversal, so a restricted user receives the k nearest records they are allowed to see:
-
-    ```javascript
-    export class Reports extends tables.Reports {
-    	allowRead(user, target, context) {
-    		if (!super.allowRead(user, target, context)) return false;
-    		if (user.role.permission.super_user) return true;
-    		if (this.ownerId == null) return true;
-    		return this.ownerId === user.id;
-    	}
-    }
-    ```
-
-    The check must be synchronous, side-effect free, and fast. `this` is the frozen record during per-record evaluation. A thrown exception denies that record (fail closed).
+### HNSW Index Parameters
+
+Configure parameters directly on `@indexed(type: "HNSW", ...)`:
+
+| Parameter              | Default           | Description                                                                                      |
+| ---------------------- | ----------------- | ------------------------------------------------------------------------------------------------ |
+| `distance`             | `"cosine"`        | Distance function: `"cosine"`, `"euclidean"`, or `"dotProduct"`                                  |
+| `efConstruction`       | `100`             | Max nodes explored during index construction. Higher = better recall, lower = better performance |
+| `M`                    | `16`              | Preferred connections per graph layer                                                            |
+| `optimizeRouting`      | `0.5`             | Heuristic aggressiveness for omitting redundant connections (0 = off, 1 = most aggressive)       |
+| `mL`                   | computed from `M` | Normalization factor for level generation                                                        |
+| `efConstructionSearch` | auto-scaled       | Max nodes explored during search. When unset, auto-scales with index size                        |
+| `quantization`         | —                 | `"int8"` stores vectors quantized to int8                                                        |
+| `filterExpansion`      | `24`              | Visit-budget multiplier for filtered search: visits at most `ef * filterExpansion` nodes         |
+
+Per-query `sort` descriptor options:
+
+| Option     | Values                                    | Description                                            |
+| ---------- | ----------------------------------------- | ------------------------------------------------------ |
+| `distance` | `"cosine"`, `"euclidean"`, `"dotProduct"` | Overrides the index's distance function for this query |
+| `ef`       | integer                                   | Overrides the search exploration budget for this query |
 
 ## Examples
 
-**Full schema with custom HNSW parameters:**
+**Index with custom HNSW parameters:**
 
 ```graphql
 type Document @table {
@@ -178,7 +157,16 @@ type Document @table {
 }
 ```
 
-**Nearest-neighbor search with distance output:**
+**Index with int8 quantization:**
+
+```graphql
+type Document @table {
+	id: Long @primaryKey
+	textEmbeddings: [Float] @indexed(type: "HNSW", quantization: "int8")
+}
+```
+
+**Nearest-neighbor search with distance included:**
 
 ```javascript
 let results = Document.search({
@@ -188,7 +176,7 @@ let results = Document.search({
 });
 ```
 
-**Filtered vector search with tuned traversal budget:**
+**Filtered traversal with tuned budget:**
 
 ```javascript
 let results = Document.search(
@@ -201,25 +189,13 @@ let results = Document.search(
 );
 ```
 
-**Distance threshold query (no ranking, cutoff only):**
-
-```javascript
-let results = Document.search({
-	conditions: {
-		attribute: 'textEmbeddings',
-		comparator: 'lt',
-		value: 0.1,
-		target: searchVector,
-	},
-});
-```
-
 ## Notes
 
-- Use `@indexed(type: "HNSW")` on a `[Float]` field — not on scalar fields.
-- The default `distance` is `"cosine"`. Override it per-index via the directive or per-query via the `sort` descriptor.
-- `efConstruction` seeds the initial value of `efConstructionSearch`. When neither is set, the search budget auto-scales with index size.
-- `vectorFilter` is available from the JavaScript API only; it cannot be expressed in a REST query string.
-- The parameter name Harper reads is `efConstructionSearch` (not `efSearchConstruction`).
-- `$distance` must be listed explicitly in `select` to appear in results.
-- For record-level `allowRead` overrides: collection-scope calls (where `this.ownerId` is `null`) should return `true` to open the connection; per-record filtering happens during query execution and event delivery.
+- `vectorFilter` and `rowFilter` are available from the JavaScript API only; they cannot be set through REST or QUERY request data.
+- `vectorFilter` functions must be synchronous, side-effect free, and fast — they can run once per candidate record visited during traversal; verdicts are memoized per query. Records passed to them are frozen.
+- `rowFilter` does not apply to a direct primary-key `get`.
+- Changing `efConstructionSearch` on an existing index does not trigger a rebuild. Structural parameters (`distance`, `M`, `efConstruction`, `quantization`) do rebuild the index when changed.
+- With `quantization: "int8"`, nearest-neighbor `sort` queries re-rank results against full-precision vectors, restoring exact ordering and exact `$distance` values. Distance-threshold (`lt`/`le`) queries filter on the approximate distance.
+- The correct parameter name is `efConstruction` (seeds the construction budget) and `efConstructionSearch` (controls search budget). The name `efSearchConstruction` is a previous documentation error.
+- When no `ef` is passed and `efConstructionSearch` (or `efConstruction`) is not explicitly set, the search budget auto-scales with index size.
+- `cosine` is the default distance function when `distance` is not specified.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@harperfast/template-react-ts-studio",
-	"version": "1.11.6",
+	"version": "1.12.0",
 	"type": "module",
 	"repository": "github:HarperFast/create-harper",
 	"scripts": {},

package/skills-lock.json

@@ -5,7 +5,7 @@
       "source": "harperfast/skills",
       "sourceType": "github",
       "skillPath": "harper-best-practices/SKILL.md",
-      "computedHash": "5a9eb10253b0c77d182917e2526ec0261c55d7eff1a55578a5cd53840f03e128"
+      "computedHash": "deb69ad99581b5cc422d76d01fd0554bcd40373f81e10c4ec1f4e0c707d963b7"
     },
     "harper-mcp": {
       "source": "harperfast/skills",

package/.github/workflow/deploy.yaml

@@ -1,33 +0,0 @@
-name: Deploy to Harper Fabric
-on:
-  workflow_dispatch:
-#  push:
-#    branches:
-#      - main
-
-concurrency:
-  group: main
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-      - name: Set up Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
-        with:
-          cache: 'npm'
-          node-version-file: '.nvmrc'
-      - name: Install dependencies
-        run: npm ci
-      - name: Run unit tests
-        run: npm test
-      - name: Run lint
-        run: npm run lint
-      - name: Build & deploy
-        run: npm run deploy