@jskit-ai/agent-docs 0.1.277 → 0.1.279

package/guide/agent/app-setup/authentication.md

@@ -154,8 +154,9 @@ like the recovery sender below; with it, `APP_PUBLIC_URL` is required and the
 link is never returned or logged. In development without one, the link is in
 the registration's answer (`confirmationUrl`) and the log, and the sign-in page
 shows it with a button that confirms it. In production (`NODE_ENV=production`)
-without one, the server refuses to start, naming both ways out: install a
-sender, or set `AUTH_LOCAL_EMAIL_CONFIRMATION=false`. For direct library
+without one, while anyone may register, the server refuses to start, naming
+the ways out: install a sender, set `AUTH_LOCAL_EMAIL_CONFIRMATION=false`, or
+set `AUTH_LOCAL_SELF_REGISTRATION=false`. For direct library
 composition, pass the sender as `confirmationSender` to
 `createLocalAuthService()`, with `emailConfirmationSender: true` in
 `resolveLocalAuthConfig()`; without one, pass
@@ -164,6 +165,16 @@ composition, pass the sender as `confirmationSender` to
 | Env | Default | Meaning |
 | --- | --- | --- |
 | `AUTH_LOCAL_EMAIL_CONFIRMATION` | on | `false` registers and signs in at once, without confirming the email. |
+| `AUTH_LOCAL_SELF_REGISTRATION` | on | `false`: only invited accounts and the first account register; anyone else is refused with 403 `auth.local.register.closed`. |
+
+Confirmation guards self-registration. An app whose accounts are only invited,
+or created through the first account, sets `AUTH_LOCAL_SELF_REGISTRATION=false`
+and needs no confirmation sender: an invitation counts when a feature's
+invitation context resolver (such as workspace invites) resolves it for that
+email, and the first account is admitted by its setup code. In production
+without a sender, those registrations sign in at once; with one, they confirm
+as usual. An app that refused the register routes itself, with a 404 hook,
+can drop the hook for this setting.
 
 Accounts that exist already are confirmed: only registrations made after the
 upgrade wait. Waiting registrations are kept in the file store

package/guide/agent/app-setup/material-3-migration.md

@@ -71,7 +71,11 @@ Delete, rather than port:
   page needs no frame at all;
 - `!important`, Sass variable overrides and component size or radius tweaks.
   `material.css` sets 40dp buttons with a 48dp touch target, 12dp cards, 28dp
-  dialogs and sheets, 8dp chips and 16dp FABs, and an app's own props still win.
+  dialogs and sheets, 8dp chips and 16dp FABs, and an app's own props still win;
+- every `height` and `min-height` on a button, as a prop, a style or CSS. A
+  button that should look smaller becomes `size="small"` or `size="x-small"`:
+  it keeps the 48dp touch target. A long label ends in an ellipsis instead of
+  spilling out; give a label that can run long its `title`.
 
 Use colour roles (`color="secondary-container"`, `bg-color="surface-container-high"`,
 the `on-surface-variant` class) instead of colours.
@@ -110,8 +114,13 @@ definePage({ meta: { jskit: { title: "Edit book", parent: "/books/:bookId" } } }
 ```
 
 `parent` is a path on the page's own surface, or `{ surface, path }` for
-another one. A main navigation destination declares no parent and shows no
-arrow. The shell's Up arrow returns to the page the person came from, or else
+another one; its `:param` segments take the current route's values. A main
+navigation destination declares no parent and shows no arrow. A page with a
+parent renders in its surface's shell layout (`ShellLayout` around
+`<RouterView />`), which draws the bar with its title, Up and actions:
+`jskit check` reports `nav/missing-shell-layout` until it does. The account
+settings page needs `src/pages/account.vue` from the users/account-settings
+pattern. The shell's Up arrow returns to the page the person came from, or else
 to the parent, so:
 
 - delete "Back to X" buttons, `router.back()` and `history.back()` calls;
@@ -203,6 +212,11 @@ opens the drawer over the page. A modal drawer opens over the app bar, as
 Material 3 draws it, so a browser test that clicked the menu control again to
 close it taps the scrim or presses Escape instead.
 
+Each main-navigation placement is literal data, one `addPlacement({ ... })`
+per destination with plain string `surface` and suffixes; one a helper builds is
+a `nav/placement-data` finding, and no page is judged for a missing parent until
+it is declared literally.
+
 ## 9. Check it
 
 Look at every screen at 390, 768 and 1280 pixels wide, in light and dark. A

package/guide/agent/framework/material-3.md

@@ -87,7 +87,10 @@ Exactly this, and nothing more:
 2. **Each top-level destination is a main-navigation item** (a `kind: "link"`
    placement with `target: "shell.primary-nav"` or `"shell.secondary-nav"`) and
    declares no parent; nor do its tabs. A shell page with no parent is
-   top-level: no arrow, a fresh trail.
+   top-level: no arrow, a fresh trail. Placements are literal declarative data,
+   one `addPlacement({ ... })` per destination with plain string `surface`,
+   `scopedSuffix` and `unscopedSuffix`, never built by a helper, a spread or a
+   template, so a reader and `jskit check` can map every destination.
 3. **Every in-app link and navigation goes through JSKIT navigation:**
    `:to="paths.page('/suppliers')"` and `router.push(paths.page(...))` with
    `usePaths()`, the CRUD runtime's `resolveViewUrl()`, `resolveEditUrl()` and
@@ -103,7 +106,10 @@ Exactly this, and nothing more:
 5. **A full page load goes through the shell too:** `reloadAppPage(path)`
    (after sign-in or a user switch, to rebuild client state) and
    `leaveApp(url)` (an external site in the same tab, such as a payment page),
-   from `@jskit-ai/shell-web/client/navigation/documentNavigation`.
+   from `@jskit-ai/shell-web/client/navigation/documentNavigation`. `leaveApp`
+   opens the site with a push, so Back returns to the page; a hand-off page
+   that only forwards (to an OAuth consent screen) uses
+   `leaveApp(url, { replace: true })`, so Back from the site doesn't rerun it.
 
 ### Forbidden in app code
 
@@ -112,9 +118,11 @@ Exactly this, and nothing more:
 | `nav/history` | `history.back()`, `history.go()`, `history.pushState()`/`replaceState()`, `router.back()`, `router.go()` |
 | `nav/window-location` | `window.location` assignments, `.href =`, `location.assign()`, `location.replace()` |
 | `nav/raw-link` | a hand-built in-app path in `to`, `href`, `router.push()`, `router.replace()` or a `to:`/`href:` object key outside a placement |
-| `nav/back-control` | any back control but the shell's Up navigating the app: "Back to X", "← Suppliers", back arrows and navigating chevrons, breadcrumbs, a custom app-bar back button, a back component, a `goBack()`-style handler |
+| `nav/back-control` | any back control but the shell's Up that navigates the app: "Back to X", "← Suppliers", back arrows and navigating chevrons, breadcrumbs, a custom app-bar back button, a back component, a `goBack()`-style handler |
 | `nav/missing-parent` | an inner page of a shell surface without a declared parent |
 | `nav/top-level-parent` | a main-navigation destination that declares a parent |
+| `nav/placement-data` | a main-navigation placement that isn't literal data (no page is judged for a missing parent until it is) |
+| `nav/missing-shell-layout` | a page that declares a parent with no shell layout rendering it, so its title, Up and actions never show |
 | `nav/allow` | any `m3-check: allow nav/...` comment: nothing excuses a navigation rule |
 
 ### Each rule, right and wrong
@@ -145,9 +153,15 @@ Exactly this, and nothing more:
   `finish(recordUrl)`; the record shows, and Up goes where the record's Up went
   before. Wrong: `router.push(recordUrl)` after Save, so Up or Back reopens the
   form.
-- **Steps inside a page are named actions:** "Previous step" or the
-  destination's name, not "Back" or a back arrow. A frame's own Back
-  (`contentWindow.history`) is fine.
+- **Steps and drill-downs inside a page are named actions.** A wizard step or
+  a panel the page opens in place is not a page, so it has no Up. Right:
+  "Previous step", or the destination's name ("Dashboard"), with no back
+  arrow. Wrong: "Back" or a back arrow. `nav/back-control` flags only controls
+  that navigate the app: a link into it, or a handler that reaches the router,
+  JSKIT paths, `up()`, `finish()` or the browser's history or location. Prose
+  ("back from version 2"), a variable named `back` and an embedded frame's own
+  Back and Forward (`frame.contentWindow.history.back()`, as in a preview
+  browser) are not back controls.
 
 ## Foundation
 
@@ -181,10 +195,16 @@ JSKIT ships these exact sizes; an app never re-implements or overrides them,
 and needs no Sass and no `!important` (Vuetify 4 keeps its CSS in cascade
 layers):
 
-- 40dp buttons with a 48dp touch target, icon buttons included;
-- 12dp cards;
+- 40dp buttons with a 48dp touch target, icon buttons included; a smaller
+  button is `size="small"` or `size="x-small"`, which keeps its smaller look
+  and the 48dp target;
+- one-line button labels: a label longer than its button ends in an ellipsis.
+  Keep labels short, and give a button whose label can run long, such as a
+  name, the full label as its `title`;
+- 12dp cards: elevated (the default) at level 1, flat and tonal at level 0;
 - 28dp dialogs and bottom-sheet top corners, square full-screen dialogs;
-- 8dp chips and 16dp FABs;
+- 8dp chips, and FABs of 56dp (small 40dp, large 96dp; extended 56dp tall)
+  with 16dp corners;
 - emphasized easing, with reduced motion honoured.
 
 So never set `height` or `min-height` on a button, or a radius on a card,
@@ -196,12 +216,22 @@ dialog, chip or FAB. A missing size is a JSKIT defect.
   `useShellPageTitle(title)` (`@jskit-ai/shell-web/client/composables/useShellPageTitle`)
   for a runtime title such as the record's name. The shell renders it as the
   app bar's only `h1`; pages add no `h1`, page header, title block or
-  standalone heading. A section inside a page uses a title role.
+  standalone heading. A section inside a page uses a title role. A page with
+  no top app bar (a hero front page, an intro, an invite or hand-off page)
+  has its own one `h1`.
 - **Up** sits in the bar on every inner page (see Navigation and Up). On phones
   it replaces the menu icon.
-- **A layout with its own top app bar** calls `useShellAppBar()` and renders
-  `ShellUpButton`, `ShellPageTitle` and `ShellPageActionsTarget` in it;
-  `jskit check` treats it as a shell layout.
+- **A layout that draws its own top app bar** (a workspace bar with the
+  app's own controls, instead of `ShellLayout`) builds it from `ShellLayout`'s
+  own pieces, from `@jskit-ai/shell-web/client`. It calls `useShellAppBar()`
+  once, so its pages enter the trail and their `ShellPageActions` show in its
+  bar, and renders `ShellUpButton` first, then `ShellPageTitle` (the page's one
+  `h1`: `useShellPageTitle()`, else the route's `jskit.title`, else its `title`
+  prop) and `ShellPageActionsTarget`. A title that is also a switcher, such as a
+  project menu, goes in `ShellPageTitle`'s default slot (given `{ title }`) as
+  the menu's activator, so it stays the one `h1`. `jskit check` counts it as a shell
+  layout, so its inner pages need parents; an Up the app draws itself is a
+  `nav/back-control` finding.
 - **Actions:** a screen's actions go in the bar inside `ShellPageActions`
   (`@jskit-ai/shell-web/client/components/ShellPageActions`), each a
   `ShellPageAction` with `icon`, `label` (also its accessible name and compact
@@ -209,7 +239,9 @@ dialog, chip or FAB. A missing size is a JSKIT defect.
   On compact widths every action shows only its icon except the single
   `primary` one.
 - **Window size classes:** compact under 600 (navigation bar), medium 600–839
-  (navigation rail), expanded 840–1199 and large from 1200 (drawer). Read them
+  (navigation rail), expanded 840–1199 and large from 1200 (drawer). A surface
+  with no navigation destinations, such as an account surface, draws no
+  navigation bar, rail or drawer; its pages keep the app bar. Read them
   from `useShellWindowSizeClass()`
   (`@jskit-ai/shell-web/client/composables/useShellWindowSizeClass`), never from
   copied breakpoint numbers.
@@ -309,8 +341,8 @@ and so every app's verify, fail on them too:
 
 | Rule | Finds |
 |---|---|
-| `m3/duplicate-h1` | a second `h1`, or an in-page `h1` in an app that uses the JSKIT shell |
-| `m3/raw-hex` | a hex colour outside `src/theme/` |
+| `m3/duplicate-h1` | a second `h1`, or an in-page `h1` under the shell's page title |
+| `m3/raw-hex` | a hex colour outside `src/theme/` (`palettes.js` holds content colours) |
 | `m3/dark-scheme` | no dark scheme, or the theme pinned to light |
 | `m3/outlined-card` | `variant="outlined"` or `border` on a card or sheet |
 | `m3/mdi-icon` | `mdi-*` icon strings and `@mdi/js` imports |
@@ -328,16 +360,39 @@ Take the approved route first; none needs an exception:
 
 - **Brand or partner colours** are theme custom colours, used by name:
   `colors: { partner: "#0A7D3E" }` in `src/theme/index.js`, then
-  `<v-chip color="partner">`. `{ value: "#F5C518", blend: false }` keeps
-  its hue.
-- **Chart and data colours** come from the theme: `const theme = useTheme()`,
-  then `["primary", "tertiary"].map((role) => theme.current.value.colors[role])`.
+  `<v-chip color="partner">`. A hex string is harmonized toward the seed; a
+  colour that must keep its hue is `{ value: "#F5C518", blend: false }`
+  (Material Theme Builder's Blend switched off), with the same four roles.
+- **Content colours**, colours that are content rather than UI, keep one
+  value in both schemes: an identity palette a person picks and the server
+  stores, avatar and illustration artwork, brand marks (a language's
+  file-type tint), fixed chart series, QR codes, colours written into
+  exported files. They are named exports of plain hex values in
+  `src/theme/palettes.js`, used as they are, never for UI chrome (a theme
+  colour is toned per scheme, so it can't keep an identity the same).
+  Components read them through bindings:
+
+  ```vue
+  <script setup>
+  // src/theme/palettes.js: export const botColours = ["#6750A4", "#B3261E"];
+  import { botColours } from "@/theme/palettes.js";
+  const props = defineProps({ bot: Object });
+  const ring = botColours[props.bot.colour];
+  </script>
+  <template>
+    <v-avatar :style="{ backgroundColor: ring }"><svg><path :fill="ring" /></svg></v-avatar>
+  </template>
+  <style scoped>.v-avatar { outline: 2px solid v-bind(ring); }</style>
+  ```
+- **Chart and data colours** that follow the scheme come from the theme:
+  `const theme = useTheme()`, then
+  `["primary", "tertiary"].map((role) => theme.current.value.colors[role])`.
 - **A third-party widget** lives in one wrapper component, such as
   `src/components/RouteMap.vue`, that hands it theme colours; pages use only
   the wrapper.
 
-What is left may be excused one line at a time, on its line or the line
-before: `<!-- m3-check: allow m3/raw-hex - the partner's contractual logo colour -->`
+What is left, such as a colour inside static SVG markup that can't import,
+may be excused one line at a time, on its line or the line before: `<!-- m3-check: allow m3/raw-hex - the partner's contractual logo colour -->`
 (`// m3-check: ...` in scripts, `/* ... */` in CSS). **Never add one on your
 own:** ask the person first, naming the rule and the reason. A comment with no
 reason (`m3/allow-reason`) or an unknown rule (`m3/allow-rule`), and any

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/agent-docs",
-  "version": "0.1.277",
+  "version": "0.1.279",
   "description": "Distributed JSKIT agent references, prompts, guides, and generated reference maps.",
   "type": "module",
   "files": [

package/patterns/minimal-foundation/example/package.json

@@ -35,7 +35,7 @@
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
     "@jskit-ai/kernel": "0.2.10",
-    "@jskit-ai/material-web": "0.1.1",
+    "@jskit-ai/material-web": "0.1.2",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.12.7",
     "pino": "^10.3.1",
@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.245",
-    "@jskit-ai/jskit-catalog": "0.2.29",
+    "@jskit-ai/jskit-catalog": "0.2.31",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/package.json

@@ -35,7 +35,7 @@
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
     "@jskit-ai/kernel": "0.2.10",
-    "@jskit-ai/material-web": "0.1.1",
+    "@jskit-ai/material-web": "0.1.2",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.12.7",
     "pino": "^10.3.1",
@@ -45,13 +45,13 @@
     "vue-router": "^5.3.1",
     "vuetify": "^4.3.0",
     "@jskit-ai/http-runtime": "0.2.10",
-    "@jskit-ai/shell-web": "0.2.12",
+    "@jskit-ai/shell-web": "0.2.13",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.245",
-    "@jskit-ai/jskit-catalog": "0.2.29",
+    "@jskit-ai/jskit-catalog": "0.2.31",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/reference/autogen/PATTERN_INDEX.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.277`
+- Owner: `@jskit-ai/agent-docs@0.1.279`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.277`
+- Owner: `@jskit-ai/agent-docs@0.1.279`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.2.25`
+- Owner: `@jskit-ai/assistant-runtime@0.2.26`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -48,7 +48,7 @@ Run one OpenID Connect sign-in for all of an owner's apps as its own JSKIT proje
 
 - Id: `auth/accounts-hub`
 - Keywords: `accounts hub`, `auth`, `authentication`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/oidc-issuer-core@0.1.17`
+- Owner: `@jskit-ai/oidc-issuer-core@0.1.18`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/accounts-hub/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/accounts-hub/example/)
 - Requires: `@jskit-ai/oidc-issuer-core`
@@ -59,7 +59,7 @@ Compose JSKIT authentication routes, views, profile controls, and public surface
 
 - Id: `auth/auth-surface`
 - Keywords: `account`, `auth`, `login`, `logout`, `password`, `placement`, `profile`, `reset`, `surface`
-- Owner: `@jskit-ai/auth-web@0.2.14`
+- Owner: `@jskit-ai/auth-web@0.2.15`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/auth-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/auth-surface/example/)
 - Requires: `@jskit-ai/auth-core`, `@jskit-ai/auth-web`, `@jskit-ai/shell-web`
@@ -70,7 +70,7 @@ Let people sign in with the accounts they already have in an accounts hub or ano
 
 - Id: `auth/oidc-sign-in`
 - Keywords: `accounts hub`, `auth`, `authentication`, `back-channel logout`, `dynamic client registration`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.16`
+- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.17`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/oidc-sign-in/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/oidc-sign-in/example/)
 - Requires: `@jskit-ai/auth-provider-oidc-core`, `@jskit-ai/auth-web`
@@ -246,7 +246,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.236`
+- Owner: `@jskit-ai/console-web@0.1.237`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -257,7 +257,7 @@ Build a routed CRUD user interface as thin application pages over JSKIT's shared
 
 - Id: `crud/crud-screen-set`
 - Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.2.17`
+- Owner: `@jskit-ai/http-web@0.2.18`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-screen-set/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-screen-set/example/)
 - Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-crud-core`
@@ -312,7 +312,7 @@ Wrap a JSKIT web application in a Capacitor Android shell using native Capacitor
 
 - Id: `mobile/android-application`
 - Keywords: `android`, `capacitor`, `device`, `mobile`, `native`, `shell`, `webview`
-- Owner: `@jskit-ai/mobile-capacitor@0.2.12`
+- Owner: `@jskit-ai/mobile-capacitor@0.2.13`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/mobile/android-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/mobile/android-application/example/)
 - Requires: `@capacitor/android`, `@capacitor/app`, `@capacitor/cli`, `@jskit-ai/mobile-capacitor`
@@ -323,7 +323,7 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.2.15`
+- Owner: `@jskit-ai/realtime@0.2.16`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
@@ -334,7 +334,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.2.14`
+- Owner: `@jskit-ai/rewarded-web@0.2.15`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -345,7 +345,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `feature`, `json-rest`, `knex`, `orchestration`, `package`, `provider`, `repository`, `routes`, `server`
-- Owner: `@jskit-ai/agent-docs@0.1.277`
+- Owner: `@jskit-ai/agent-docs@0.1.279`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -356,7 +356,7 @@ Compose the JSKIT responsive shell, semantic placements, settings navigation, an
 
 - Id: `shell/application-shell`
 - Keywords: `adaptive`, `app`, `layout`, `navigation`, `placement`, `responsive`, `settings`, `shell`
-- Owner: `@jskit-ai/shell-web@0.2.12`
+- Owner: `@jskit-ai/shell-web@0.2.13`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/shell/application-shell/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/shell/application-shell/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -367,7 +367,7 @@ Add product routes and shell extensions through file routing, semantic placement
 
 - Id: `ui/page-and-placement`
 - Keywords: `component`, `navigation`, `outlet`, `page`, `placement`, `routes`, `section`, `shell`, `subpages`, `vue`
-- Owner: `@jskit-ai/shell-web@0.2.12`
+- Owner: `@jskit-ai/shell-web@0.2.13`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/ui/page-and-placement/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/ui/page-and-placement/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -378,7 +378,7 @@ Compose an account settings route and profile, preference, notification, and sig
 
 - Id: `users/account-settings`
 - Keywords: `account`, `link provider`, `notifications`, `oauth`, `preferences`, `profile`, `settings`, `sign-in methods`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.2.19`
+- Owner: `@jskit-ai/users-web@0.2.20`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -411,7 +411,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.2.19`
+- Owner: `@jskit-ai/workspaces-web@0.2.20`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/reference/autogen/packages/auth-provider-local-core.md

@@ -52,7 +52,7 @@ Local functions
 - `resolveSetupCode(env, { isProduction })`
 - `resolveAppPublicUrl(env, { emailRecovery, emailedConfirmation, oauthEnabled })`
 - `resolveRecoveryDelivery(env, { emailRecovery, isProduction })`
-- `resolveConfirmationDelivery(env, { emailConfirmationSender, isProduction })`
+- `resolveConfirmationDelivery(env, { emailConfirmationSender, isProduction, selfRegistration })`
 - `resolvePasswordMinLength(env)`
 
 ### `src/server/lib/emailConfirmation.js`

package/reference/autogen/packages/http-web.md

@@ -724,8 +724,6 @@ Exports
 ### `fixtures/crud-screens/main.js`
 Exports
 - None
-Local functions
-- `destination(order, label, suffix, icon)`
 
 ### `fixtures/crud-screens/vite.config.mjs`
 Exports

package/reference/autogen/packages/shell-web.md

@@ -182,6 +182,10 @@ Exports
 - `shellNavigationLinkProps`
 - `useShellNavigationLink(props)`
 
+### `src/client/composables/useShellOutletPlacements.js`
+Exports
+- `useShellOutletPlacements(target, context = {})`
+
 ### `src/client/composables/useShellPageTitle.js`
 Exports
 - `useShellPageTitle(title)`
@@ -327,7 +331,7 @@ Local functions
 
 ### `src/client/navigation/documentNavigation.js`
 Exports
-- `leaveApp(url)`
+- `leaveApp(url, { replace = false } = {})`
 - `reloadAppPage(target)`
 
 ### `src/client/navigation/linkResolver.js`
@@ -335,7 +339,7 @@ Exports
 - `resolveShellLinkPath({ context = null, surface = "", explicitTo = "", relativePath = "/", surfaceRelativePath = "", params = {}, strictParams = true } = {})`
 - `useShellLinkResolver({ surface = "" } = {})`
 Local functions
-- `materializeSurfaceRouteBase(routeBaseTemplate = "/", { params = {}, strictParams = true, surface = "" } = {})`
+- `fillPathParams(pathTemplate = "/", { params = {}, strictParams = true, label = "route params" } = {})`
 - `resolveSurfaceBasePath(context = null, surface = "", { params = {}, strictParams = true } = {})`
 
 ### `src/client/navigation/shellNavigationRuntime.js`
@@ -547,6 +551,7 @@ Exports
 - `normalizeDesktopDrawerClosedMode(value = "rail")`
 - `resolveShellDrawerPresentation({ modal = false, open = false, desktopClosedMode = "rail" } = {})`
 - `resolveShellDrawerToggleLabel({ modal = false, open = false } = {})`
+- `shellLayoutHasDrawer({ menuSlot = false, menuCount = 0, identityCount = 0, bottomNavigationCount = 0 } = {})`
 
 ### `src/client/support/drawerWidth.js`
 Exports
@@ -653,12 +658,14 @@ Exports
 Exports
 - None
 
+### `fixtures/adaptive-shell/src/ButtonsPage.vue`
+Exports
+- None
+
 ### `fixtures/adaptive-shell/src/main.js`
 Exports
 - None
 Local functions
-- `createSurfacePlacement(surface, order, label, suffix)`
-- `createSurfacePlacements(surface)`
 - `refuseBlockedRecord(to)`
 
 ### `fixtures/adaptive-shell/src/OwnBarLayout.vue`

package/reference/autogen/packages/users-web.md

@@ -209,6 +209,10 @@ Exports
 Exports
 - None
 
+### `patterns/account-settings/example/src/pages/account.vue`
+Exports
+- None
+
 ### `patterns/account-settings/example/src/pages/account/index.vue`
 Exports
 - None

package/reference/autogen/tooling/jskit-catalog.md

@@ -131,6 +131,7 @@ Exports
 - `checkScriptBackNames(code, offset, report)`
 - `isInAppPath(value)`
 - `isPageFile(file)`
+- `readTitledFiles({ root, appFiles })`
 Local functions
 - `compact(text)`
 - `isPlacementLink(code, offset)`
@@ -146,6 +147,7 @@ Local functions
 - `enclosingObject(text, offset)`
 - `stringValue(text, key)`
 - `readMainNavigation(sources)`
+- `computedPlacementPart(placement)`
 - `normalisePath(value)`
 - `routeOf(file)`
 - `routePattern(route)`
@@ -153,7 +155,7 @@ Local functions
 - `surfaceOf(route, surfaces)`
 - `routeDeclarations(source)`
 - `readPage(file, source)`
-- `createShellBarReader(appFiles, read)`
+- `createShellBarReader(appFiles, read, tag = SHELL_UP_TAG)`
 - `localComponent(file, specifier, known)`
 - `pageKey(file)`
 

package/skills/jskit/references/material-3.md

@@ -82,7 +82,10 @@ Exactly this, and nothing more:
 2. **Each top-level destination is a main-navigation item** (a `kind: "link"`
    placement with `target: "shell.primary-nav"` or `"shell.secondary-nav"`) and
    declares no parent; nor do its tabs. A shell page with no parent is
-   top-level: no arrow, a fresh trail.
+   top-level: no arrow, a fresh trail. Placements are literal declarative data,
+   one `addPlacement({ ... })` per destination with plain string `surface`,
+   `scopedSuffix` and `unscopedSuffix`, never built by a helper, a spread or a
+   template, so a reader and `jskit check` can map every destination.
 3. **Every in-app link and navigation goes through JSKIT navigation:**
    `:to="paths.page('/suppliers')"` and `router.push(paths.page(...))` with
    `usePaths()`, the CRUD runtime's `resolveViewUrl()`, `resolveEditUrl()` and
@@ -98,7 +101,10 @@ Exactly this, and nothing more:
 5. **A full page load goes through the shell too:** `reloadAppPage(path)`
    (after sign-in or a user switch, to rebuild client state) and
    `leaveApp(url)` (an external site in the same tab, such as a payment page),
-   from `@jskit-ai/shell-web/client/navigation/documentNavigation`.
+   from `@jskit-ai/shell-web/client/navigation/documentNavigation`. `leaveApp`
+   opens the site with a push, so Back returns to the page; a hand-off page
+   that only forwards (to an OAuth consent screen) uses
+   `leaveApp(url, { replace: true })`, so Back from the site doesn't rerun it.
 
 ### Forbidden in app code
 
@@ -107,9 +113,11 @@ Exactly this, and nothing more:
 | `nav/history` | `history.back()`, `history.go()`, `history.pushState()`/`replaceState()`, `router.back()`, `router.go()` |
 | `nav/window-location` | `window.location` assignments, `.href =`, `location.assign()`, `location.replace()` |
 | `nav/raw-link` | a hand-built in-app path in `to`, `href`, `router.push()`, `router.replace()` or a `to:`/`href:` object key outside a placement |
-| `nav/back-control` | any back control but the shell's Up navigating the app: "Back to X", "← Suppliers", back arrows and navigating chevrons, breadcrumbs, a custom app-bar back button, a back component, a `goBack()`-style handler |
+| `nav/back-control` | any back control but the shell's Up that navigates the app: "Back to X", "← Suppliers", back arrows and navigating chevrons, breadcrumbs, a custom app-bar back button, a back component, a `goBack()`-style handler |
 | `nav/missing-parent` | an inner page of a shell surface without a declared parent |
 | `nav/top-level-parent` | a main-navigation destination that declares a parent |
+| `nav/placement-data` | a main-navigation placement that isn't literal data (no page is judged for a missing parent until it is) |
+| `nav/missing-shell-layout` | a page that declares a parent with no shell layout rendering it, so its title, Up and actions never show |
 | `nav/allow` | any `m3-check: allow nav/...` comment: nothing excuses a navigation rule |
 
 ### Each rule, right and wrong
@@ -140,9 +148,15 @@ Exactly this, and nothing more:
   `finish(recordUrl)`; the record shows, and Up goes where the record's Up went
   before. Wrong: `router.push(recordUrl)` after Save, so Up or Back reopens the
   form.
-- **Steps inside a page are named actions:** "Previous step" or the
-  destination's name, not "Back" or a back arrow. A frame's own Back
-  (`contentWindow.history`) is fine.
+- **Steps and drill-downs inside a page are named actions.** A wizard step or
+  a panel the page opens in place is not a page, so it has no Up. Right:
+  "Previous step", or the destination's name ("Dashboard"), with no back
+  arrow. Wrong: "Back" or a back arrow. `nav/back-control` flags only controls
+  that navigate the app: a link into it, or a handler that reaches the router,
+  JSKIT paths, `up()`, `finish()` or the browser's history or location. Prose
+  ("back from version 2"), a variable named `back` and an embedded frame's own
+  Back and Forward (`frame.contentWindow.history.back()`, as in a preview
+  browser) are not back controls.
 
 ## Foundation
 
@@ -176,10 +190,16 @@ JSKIT ships these exact sizes; an app never re-implements or overrides them,
 and needs no Sass and no `!important` (Vuetify 4 keeps its CSS in cascade
 layers):
 
-- 40dp buttons with a 48dp touch target, icon buttons included;
-- 12dp cards;
+- 40dp buttons with a 48dp touch target, icon buttons included; a smaller
+  button is `size="small"` or `size="x-small"`, which keeps its smaller look
+  and the 48dp target;
+- one-line button labels: a label longer than its button ends in an ellipsis.
+  Keep labels short, and give a button whose label can run long, such as a
+  name, the full label as its `title`;
+- 12dp cards: elevated (the default) at level 1, flat and tonal at level 0;
 - 28dp dialogs and bottom-sheet top corners, square full-screen dialogs;
-- 8dp chips and 16dp FABs;
+- 8dp chips, and FABs of 56dp (small 40dp, large 96dp; extended 56dp tall)
+  with 16dp corners;
 - emphasized easing, with reduced motion honoured.
 
 So never set `height` or `min-height` on a button, or a radius on a card,
@@ -191,12 +211,22 @@ dialog, chip or FAB. A missing size is a JSKIT defect.
   `useShellPageTitle(title)` (`@jskit-ai/shell-web/client/composables/useShellPageTitle`)
   for a runtime title such as the record's name. The shell renders it as the
   app bar's only `h1`; pages add no `h1`, page header, title block or
-  standalone heading. A section inside a page uses a title role.
+  standalone heading. A section inside a page uses a title role. A page with
+  no top app bar (a hero front page, an intro, an invite or hand-off page)
+  has its own one `h1`.
 - **Up** sits in the bar on every inner page (see Navigation and Up). On phones
   it replaces the menu icon.
-- **A layout with its own top app bar** calls `useShellAppBar()` and renders
-  `ShellUpButton`, `ShellPageTitle` and `ShellPageActionsTarget` in it;
-  `jskit check` treats it as a shell layout.
+- **A layout that draws its own top app bar** (a workspace bar with the
+  app's own controls, instead of `ShellLayout`) builds it from `ShellLayout`'s
+  own pieces, from `@jskit-ai/shell-web/client`. It calls `useShellAppBar()`
+  once, so its pages enter the trail and their `ShellPageActions` show in its
+  bar, and renders `ShellUpButton` first, then `ShellPageTitle` (the page's one
+  `h1`: `useShellPageTitle()`, else the route's `jskit.title`, else its `title`
+  prop) and `ShellPageActionsTarget`. A title that is also a switcher, such as a
+  project menu, goes in `ShellPageTitle`'s default slot (given `{ title }`) as
+  the menu's activator, so it stays the one `h1`. `jskit check` counts it as a shell
+  layout, so its inner pages need parents; an Up the app draws itself is a
+  `nav/back-control` finding.
 - **Actions:** a screen's actions go in the bar inside `ShellPageActions`
   (`@jskit-ai/shell-web/client/components/ShellPageActions`), each a
   `ShellPageAction` with `icon`, `label` (also its accessible name and compact
@@ -204,7 +234,9 @@ dialog, chip or FAB. A missing size is a JSKIT defect.
   On compact widths every action shows only its icon except the single
   `primary` one.
 - **Window size classes:** compact under 600 (navigation bar), medium 600–839
-  (navigation rail), expanded 840–1199 and large from 1200 (drawer). Read them
+  (navigation rail), expanded 840–1199 and large from 1200 (drawer). A surface
+  with no navigation destinations, such as an account surface, draws no
+  navigation bar, rail or drawer; its pages keep the app bar. Read them
   from `useShellWindowSizeClass()`
   (`@jskit-ai/shell-web/client/composables/useShellWindowSizeClass`), never from
   copied breakpoint numbers.
@@ -304,8 +336,8 @@ and so every app's verify, fail on them too:
 
 | Rule | Finds |
 |---|---|
-| `m3/duplicate-h1` | a second `h1`, or an in-page `h1` in an app that uses the JSKIT shell |
-| `m3/raw-hex` | a hex colour outside `src/theme/` |
+| `m3/duplicate-h1` | a second `h1`, or an in-page `h1` under the shell's page title |
+| `m3/raw-hex` | a hex colour outside `src/theme/` (`palettes.js` holds content colours) |
 | `m3/dark-scheme` | no dark scheme, or the theme pinned to light |
 | `m3/outlined-card` | `variant="outlined"` or `border` on a card or sheet |
 | `m3/mdi-icon` | `mdi-*` icon strings and `@mdi/js` imports |
@@ -323,16 +355,39 @@ Take the approved route first; none needs an exception:
 
 - **Brand or partner colours** are theme custom colours, used by name:
   `colors: { partner: "#0A7D3E" }` in `src/theme/index.js`, then
-  `<v-chip color="partner">`. `{ value: "#F5C518", blend: false }` keeps
-  its hue.
-- **Chart and data colours** come from the theme: `const theme = useTheme()`,
-  then `["primary", "tertiary"].map((role) => theme.current.value.colors[role])`.
+  `<v-chip color="partner">`. A hex string is harmonized toward the seed; a
+  colour that must keep its hue is `{ value: "#F5C518", blend: false }`
+  (Material Theme Builder's Blend switched off), with the same four roles.
+- **Content colours**, colours that are content rather than UI, keep one
+  value in both schemes: an identity palette a person picks and the server
+  stores, avatar and illustration artwork, brand marks (a language's
+  file-type tint), fixed chart series, QR codes, colours written into
+  exported files. They are named exports of plain hex values in
+  `src/theme/palettes.js`, used as they are, never for UI chrome (a theme
+  colour is toned per scheme, so it can't keep an identity the same).
+  Components read them through bindings:
+
+  ```vue
+  <script setup>
+  // src/theme/palettes.js: export const botColours = ["#6750A4", "#B3261E"];
+  import { botColours } from "@/theme/palettes.js";
+  const props = defineProps({ bot: Object });
+  const ring = botColours[props.bot.colour];
+  </script>
+  <template>
+    <v-avatar :style="{ backgroundColor: ring }"><svg><path :fill="ring" /></svg></v-avatar>
+  </template>
+  <style scoped>.v-avatar { outline: 2px solid v-bind(ring); }</style>
+  ```
+- **Chart and data colours** that follow the scheme come from the theme:
+  `const theme = useTheme()`, then
+  `["primary", "tertiary"].map((role) => theme.current.value.colors[role])`.
 - **A third-party widget** lives in one wrapper component, such as
   `src/components/RouteMap.vue`, that hands it theme colours; pages use only
   the wrapper.
 
-What is left may be excused one line at a time, on its line or the line
-before: `<!-- m3-check: allow m3/raw-hex - the partner's contractual logo colour -->`
+What is left, such as a colour inside static SVG markup that can't import,
+may be excused one line at a time, on its line or the line before: `<!-- m3-check: allow m3/raw-hex - the partner's contractual logo colour -->`
 (`// m3-check: ...` in scripts, `/* ... */` in CSS). **Never add one on your
 own:** ask the person first, naming the rule and the reason. A comment with no
 reason (`m3/allow-reason`) or an unknown rule (`m3/allow-rule`), and any

package/skills/jskit/references/pattern-index.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.277`
+- Owner: `@jskit-ai/agent-docs@0.1.279`
 - Read: [PATTERN.md](patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.277`
+- Owner: `@jskit-ai/agent-docs@0.1.279`
 - Read: [PATTERN.md](patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.2.25`
+- Owner: `@jskit-ai/assistant-runtime@0.2.26`
 - Read: [PATTERN.md](patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -48,7 +48,7 @@ Run one OpenID Connect sign-in for all of an owner's apps as its own JSKIT proje
 
 - Id: `auth/accounts-hub`
 - Keywords: `accounts hub`, `auth`, `authentication`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/oidc-issuer-core@0.1.17`
+- Owner: `@jskit-ai/oidc-issuer-core@0.1.18`
 - Read: [PATTERN.md](patterns/auth/accounts-hub/PATTERN.md)
 - Examples: [example/](patterns/auth/accounts-hub/example/)
 - Requires: `@jskit-ai/oidc-issuer-core`
@@ -59,7 +59,7 @@ Compose JSKIT authentication routes, views, profile controls, and public surface
 
 - Id: `auth/auth-surface`
 - Keywords: `account`, `auth`, `login`, `logout`, `password`, `placement`, `profile`, `reset`, `surface`
-- Owner: `@jskit-ai/auth-web@0.2.14`
+- Owner: `@jskit-ai/auth-web@0.2.15`
 - Read: [PATTERN.md](patterns/auth/auth-surface/PATTERN.md)
 - Examples: [example/](patterns/auth/auth-surface/example/)
 - Requires: `@jskit-ai/auth-core`, `@jskit-ai/auth-web`, `@jskit-ai/shell-web`
@@ -70,7 +70,7 @@ Let people sign in with the accounts they already have in an accounts hub or ano
 
 - Id: `auth/oidc-sign-in`
 - Keywords: `accounts hub`, `auth`, `authentication`, `back-channel logout`, `dynamic client registration`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.16`
+- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.17`
 - Read: [PATTERN.md](patterns/auth/oidc-sign-in/PATTERN.md)
 - Examples: [example/](patterns/auth/oidc-sign-in/example/)
 - Requires: `@jskit-ai/auth-provider-oidc-core`, `@jskit-ai/auth-web`
@@ -246,7 +246,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.236`
+- Owner: `@jskit-ai/console-web@0.1.237`
 - Read: [PATTERN.md](patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -257,7 +257,7 @@ Build a routed CRUD user interface as thin application pages over JSKIT's shared
 
 - Id: `crud/crud-screen-set`
 - Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.2.17`
+- Owner: `@jskit-ai/http-web@0.2.18`
 - Read: [PATTERN.md](patterns/crud/crud-screen-set/PATTERN.md)
 - Examples: [example/](patterns/crud/crud-screen-set/example/)
 - Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-crud-core`
@@ -312,7 +312,7 @@ Wrap a JSKIT web application in a Capacitor Android shell using native Capacitor
 
 - Id: `mobile/android-application`
 - Keywords: `android`, `capacitor`, `device`, `mobile`, `native`, `shell`, `webview`
-- Owner: `@jskit-ai/mobile-capacitor@0.2.12`
+- Owner: `@jskit-ai/mobile-capacitor@0.2.13`
 - Read: [PATTERN.md](patterns/mobile/android-application/PATTERN.md)
 - Examples: [example/](patterns/mobile/android-application/example/)
 - Requires: `@capacitor/android`, `@capacitor/app`, `@capacitor/cli`, `@jskit-ai/mobile-capacitor`
@@ -323,7 +323,7 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.2.15`
+- Owner: `@jskit-ai/realtime@0.2.16`
 - Read: [PATTERN.md](patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
@@ -334,7 +334,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.2.14`
+- Owner: `@jskit-ai/rewarded-web@0.2.15`
 - Read: [PATTERN.md](patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -345,7 +345,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `feature`, `json-rest`, `knex`, `orchestration`, `package`, `provider`, `repository`, `routes`, `server`
-- Owner: `@jskit-ai/agent-docs@0.1.277`
+- Owner: `@jskit-ai/agent-docs@0.1.279`
 - Read: [PATTERN.md](patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -356,7 +356,7 @@ Compose the JSKIT responsive shell, semantic placements, settings navigation, an
 
 - Id: `shell/application-shell`
 - Keywords: `adaptive`, `app`, `layout`, `navigation`, `placement`, `responsive`, `settings`, `shell`
-- Owner: `@jskit-ai/shell-web@0.2.12`
+- Owner: `@jskit-ai/shell-web@0.2.13`
 - Read: [PATTERN.md](patterns/shell/application-shell/PATTERN.md)
 - Examples: [example/](patterns/shell/application-shell/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -367,7 +367,7 @@ Add product routes and shell extensions through file routing, semantic placement
 
 - Id: `ui/page-and-placement`
 - Keywords: `component`, `navigation`, `outlet`, `page`, `placement`, `routes`, `section`, `shell`, `subpages`, `vue`
-- Owner: `@jskit-ai/shell-web@0.2.12`
+- Owner: `@jskit-ai/shell-web@0.2.13`
 - Read: [PATTERN.md](patterns/ui/page-and-placement/PATTERN.md)
 - Examples: [example/](patterns/ui/page-and-placement/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -378,7 +378,7 @@ Compose an account settings route and profile, preference, notification, and sig
 
 - Id: `users/account-settings`
 - Keywords: `account`, `link provider`, `notifications`, `oauth`, `preferences`, `profile`, `settings`, `sign-in methods`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.2.19`
+- Owner: `@jskit-ai/users-web@0.2.20`
 - Read: [PATTERN.md](patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -411,7 +411,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.2.19`
+- Owner: `@jskit-ai/workspaces-web@0.2.20`
 - Read: [PATTERN.md](patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/skills/jskit/references/patterns/app/minimal-foundation/example/package.json

@@ -35,7 +35,7 @@
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
     "@jskit-ai/kernel": "0.2.10",
-    "@jskit-ai/material-web": "0.1.1",
+    "@jskit-ai/material-web": "0.1.2",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.12.7",
     "pino": "^10.3.1",
@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.245",
-    "@jskit-ai/jskit-catalog": "0.2.29",
+    "@jskit-ai/jskit-catalog": "0.2.31",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/skills/jskit/references/patterns/app/shell-foundation/example/package.json

@@ -35,7 +35,7 @@
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
     "@jskit-ai/kernel": "0.2.10",
-    "@jskit-ai/material-web": "0.1.1",
+    "@jskit-ai/material-web": "0.1.2",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.12.7",
     "pino": "^10.3.1",
@@ -45,13 +45,13 @@
     "vue-router": "^5.3.1",
     "vuetify": "^4.3.0",
     "@jskit-ai/http-runtime": "0.2.10",
-    "@jskit-ai/shell-web": "0.2.12",
+    "@jskit-ai/shell-web": "0.2.13",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.245",
-    "@jskit-ai/jskit-catalog": "0.2.29",
+    "@jskit-ai/jskit-catalog": "0.2.31",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/skills/jskit/references/patterns/auth/accounts-hub/example/package.json

@@ -3,6 +3,6 @@
   "type": "module",
   "dependencies": {
     "@jskit-ai/database-runtime-mysql": "0.1.257",
-    "@jskit-ai/oidc-issuer-core": "0.1.17"
+    "@jskit-ai/oidc-issuer-core": "0.1.18"
   }
 }

package/skills/jskit/references/patterns/auth/oidc-sign-in/example/package.json

@@ -2,7 +2,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/auth-provider-oidc-core": "0.2.16",
-    "@jskit-ai/auth-web": "0.2.14"
+    "@jskit-ai/auth-provider-oidc-core": "0.2.17",
+    "@jskit-ai/auth-web": "0.2.15"
   }
 }

package/skills/jskit/references/patterns/realtime/realtime-application/example/package.json

@@ -2,7 +2,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/realtime": "0.2.15",
-    "@jskit-ai/shell-web": "0.2.12"
+    "@jskit-ai/realtime": "0.2.16",
+    "@jskit-ai/shell-web": "0.2.13"
   }
 }

package/skills/jskit/references/patterns/users/account-settings/PATTERN.md

@@ -57,10 +57,15 @@ provider offers provider linking (`providerLinking` in its capabilities).
 - Loading uses layout-stable skeletons, never an indeterminate spinner.
 - Pending controls keep stable labels and prevent duplicate submission.
 - The route and placement owner agree.
+- The account surface renders in its own layout, `src/pages/account.vue`
+  (`ShellLayout` around `<RouterView />`, `meta.jskit.surface: "account"`), so
+  the settings page's title, Up arrow and Done action are in the top app bar.
+  With no navigation items, the surface shows no navigation bar, rail or drawer.
 
 ## Example files
 
-`example/` contains an account route and four concrete settings sections.
+`example/` contains the account surface's layout, an account route and four
+concrete settings sections.
 Adapt their fields and copy while retaining the shared account runtime.
 
 ## Variation points

package/skills/jskit/references/patterns/users/account-settings/example/src/pages/account.vue

@@ -0,0 +1,22 @@
+<route lang="json">
+{
+  "meta": {
+    "jskit": {
+      "surface": "account"
+    }
+  }
+}
+</route>
+
+<script setup>
+// The account surface's layout: the shell's top app bar carries the settings page's title, its Up arrow back to home
+// and its Done action. The surface has no navigation items, so the shell draws no navigation bar, rail or drawer.
+import ShellLayout from "@/components/ShellLayout.vue";
+import { RouterView } from "vue-router";
+</script>
+
+<template>
+  <ShellLayout title="" subtitle="">
+    <RouterView />
+  </ShellLayout>
+</template>