@jskit-ai/agent-docs 0.1.291 → 0.1.292

package/guide/agent/framework/data-access.md

@@ -34,7 +34,7 @@ through its handle's calls, and every call takes the call's `options` last:
 | Call | Does |
 | --- | --- |
 | `query({ filters, sort, page, include }, options)` | one page: `{ records, page }` |
-| `queryAll({ filters, sort, include }, options)` | every matching row, for jobs, id lists and one parent's rows |
+| `queryAll({ filters, sort, include, take }, options)` | every matching row, or the first `take`, for jobs, id lists and one parent's rows |
 | `queryPages({ filters, sort, include }, options)` | every matching row, a page at a time, for work over many rows |
 | `get(id, params, options)` | one record |
 | `aggregate({ measures, groupBy, filters, sort, page }, options)` | totals, grouped by fields or date buckets |
@@ -261,6 +261,63 @@ the other table hides, which would tell a caller which rows hold a value it
 may not read. For either, the other table's owner answers the ids it matches
 through its owner API, and the filter takes the list: `filters: { supplierIds }`.
 
+A filter that asks whether a row has, or lacks, another owner's rows
+(projects with an open task, projects with no task) reads that owner's join
+source. The `owns` entry's `searchSchema` names each join source by an alias,
+with a function answering its owner from the feature's `requires` or its own
+handles (`owned`), and `applyFilter` gets `joinSource(alias)`: that owner's
+`{ query, column }` for the caller's scope, as a report's join source
+([Layer 5](#layer-5-reports-the-resource-cannot-express)), which it ties to
+the row with `whereColumn` inside `whereExists` or `whereNotExists`:
+
+```js
+// the projects feature's owns entry; the feature requires the tasks owner as `tasks`
+{
+  resource: projectResource,
+  searchSchema: {
+    hasOpenTask: {
+      type: "boolean",
+      joinSources: { k: ({ requires }) => requires.tasks },
+      applyFilter(query, wanted, { column, joinSource }) {
+        const task = joinSource("k");
+        const openTasks = task.query
+          .select(task.column("id"))
+          .whereColumn(task.column("projectId"), column("id"))
+          .where(task.column("status"), "open");
+        if (wanted) {
+          query.whereExists(openTasks);
+        } else {
+          query.whereNotExists(openTasks);
+        }
+      }
+    }
+  }
+}
+```
+
+The handle builds the join sources a read's filters use just before the read,
+in the call's own context and transaction, so `query`, `queryAll`,
+`queryPages`, `aggregate` and `joinSource` take the filter in their one
+statement, and the other owner's ownership, row policy and hidden fields
+decide which of its rows count (`column()` refuses a hidden field). A filter
+that prefers one match and falls back on another when no row of the table has
+the first (the projects named like the term, or, when none is, those with a
+task in that status) names the feature's own handle for its own table,
+`({ owned }) => owned.projects`. Only a read through a handle builds join
+sources. `own()` refuses, at startup, `joinSources` that is not a record of
+functions under aliases, such a filter with `oneOf` or without `applyFilter`,
+and `joinSources` in the table resource's own `searchSchema`, which names no
+feature to answer it.
+
+An app switches to such a filter where a search resolves another owner's
+matches first: a repository that reads the other owner's ids (an id report on
+its `scopedQuery()`, or that owner's `queryAll` matched in memory) and then
+filters `id` by the list, or a filter that was a `whereRaw` with `EXISTS
+(SELECT ... FROM ...)`, which `jskit/sql-literal` refuses. The filter moves
+into the `owns` entry with the other owner as a join source, the code that
+resolved ids goes, and the read is one statement however many rows match,
+where the id list grew with the matches.
+
 A table keyed by a `uuid` or `string` primary key takes its ids as text; an
 `owns` entry's `normalizeId` is only for an id written some other way.
 
@@ -569,8 +626,9 @@ waiter with errno 1020 ("Record has changed since last read"), which a write
 that owns its transaction runs again. For one row,
 `patch(id, changes, { ...options, onlyIf: { status: "open" } })` does the same.
 A filter on another table (a search field whose `actualField` reaches a
-related table) is refused on MySQL and MariaDB (`RestApiValidationError`, rule
-`selection_cross_table`), even when it matches no row. A search entry's own
+related table, or one that reads a join source) is refused on MySQL and
+MariaDB (`RestApiValidationError`, rule `selection_cross_table`), even when it
+matches no row; `lockWhere` and `claim` refuse it the same way. A search entry's own
 `applyFilter` that reads another table through a subquery is not detected, and
 is no compare-and-set there either. Filter on the row's own columns instead, for example
 on the link after locking its targets with `lockMany` in the same transaction
@@ -627,17 +685,31 @@ or a counter row taken with `lock(id)`. Every lock needs a transaction; SQLite
 runs one transaction at a time, so there is no row lock to take. Take locks in
 one order on every path, a parent before its children.
 
-A lock answers only the rows it locks, with the fields `fields` names, and
-refuses `include` before any statement. Read the locked rows' related records
-after the lock, in the same transaction: `queryAll({ filters: { id: ids },
-include }, txOptions)`, or the related table's read by id list. On PostgreSQL
-every statement sees what had committed when it began, so that read is current.
-On MySQL and MariaDB a plain read inside a transaction sees the snapshot of the
+A lock answers the rows it locks, with the fields `fields` names. Its
+`include` names belongs-to relationships (`include: ["customer"]`, or
+`"batch.yard"` a level further): after its own rows, the lock locks the
+records they name through each related table's own handle (its scope, its row
+policy, its hidden fields), in id order, each related table once however many
+rows name it, and nests them as a read's include does; a link to a record the
+caller may not see reads as in a read, its belongs-to field null. Those are locks too, so on MySQL and MariaDB
+they find a record committed after the transaction's first plain read, which a
+plain read misses. They come after the rows, a child before the parent it
+names, so a path that locks the parent first and then its children (to add one)
+takes the other order: the database ends a deadlock between the two by failing
+one transaction, which `withTransaction` runs again, and a path that runs
+often keeps one order on both sides. A collection (`include: ["lines"]`) is
+refused before any statement: lock a parent's children with their own
+table's `lockWhere` in the same transaction.
+
+Every other read after the lock is a plain read. On PostgreSQL every statement
+sees what had committed when it began, so that read is current. On MySQL and
+MariaDB a plain read inside a transaction sees the snapshot of the
 transaction's first plain read, and a lock that waited does not move it. So
 take the lock before any plain read in the transaction: the reads after it then
 see what the lock's previous holder committed. A related row the work decides
-on (is this seat already booked?) is locked itself, or read after a lock
-that every writer of it takes first.
+on (is this seat already booked?) is locked itself, through the lock's
+`include` or a lock of its own, or read after a lock that every writer of it
+takes first.
 
 ```js
 // good: the lock is the transaction's first read, so the bookings read after it are current
@@ -802,7 +874,10 @@ async function activeDays(memberIds, options) {
   its own row with `whereColumn`; one that counts them joins the source grouped,
   as `projectSummary` does. Rows matched by a related row's value ("items
   whose supplier is named Acme") need no report: a cross-table search filter
-  answers them in a plain read ([Layer 1](#layer-1-the-table-resource)).
+  answers them in a plain read ([Layer 1](#layer-1-the-table-resource)). Nor
+  does a question that only narrows a plain read's rows (has an open task, has
+  no task): a search filter that reads the other owner's join source answers
+  it in that read, with its page, sort and includes as usual (Layer 1).
 
   ```js
   // Knex: report - the caller's projects with no task the caller sees
@@ -816,6 +891,32 @@ async function activeDays(memberIds, options) {
   }
   ```
 
+- A report in a feature that owns none of its tables (a console's, over
+  several owners) roots at the main owner's `joinSource()` instead of a
+  `scopedQuery()`, and ties the other owners' join sources to it the same way,
+  in one statement, every owner's scope and row policy applied.
+
+  ```js
+  // Knex: report - the caller's projects with no task the caller sees, for a console that owns neither table
+  async function idleProjects(options) {
+    const project = await projects.joinSource({ alias: "p" }, options);
+    const task = await tasks.joinSource({ alias: "k" }, options);
+    return project.query
+      .whereNotExists(task.query.select(task.column("id")).whereColumn(task.column("projectId"), project.column("id")))
+      .select({ name: project.column("name") });
+  }
+  ```
+
+- An app switches a report it kept as a raw-SQL exception (another owner's
+  table joined by name, or a subquery in `raw()`, in a file under an
+  infrastructure exception, see [Exceptions](#exceptions)) to these: the
+  report's feature requires each owner whose rows it reads, puts each owner's
+  join source where the table stood (`whereExists`, `whereNotExists`, or
+  joined grouped for counts and sums), roots at its own table's
+  `scopedQuery()` or at the main owner's `joinSource()`, and the file drops
+  its `readable-check: allow` lines and its `jskit-data-access.json` entry.
+  When an owner is a JSKIT package, its owner API answers `joinSource`
+  ([Tables you don't own](#tables-you-dont-own)).
 - When each owner can answer on its own (keys in, grouped totals out), the
   report is a feature of its own that calls each owner's method and merges the
   answers in memory: one statement per owner, never a call per row.
@@ -843,6 +944,11 @@ async function activeDays(memberIds, options) {
   request it stops past the request row limit (`pageLimits().requestRows`,
   10,000 rows) with a 400 coded `RESOURCE_ROW_LIMIT`, and never answers part
   of the rows. A job reads without that limit and holds every row in memory.
+  `queryAll({ ..., take: 500 })` answers only the first 500 rows in its sort
+  order and reads no row past them, the last page no larger than the rows still
+  wanted. `take` is then the read's bound, so a request may name more than the
+  request row limit and never gets `RESOURCE_ROW_LIMIT`: name the bound the
+  work can hold, never one from the request unchecked.
 - Work over many rows reads `queryPages` and handles one page at a time:
   `for await (const records of handle.queryPages(params, options))`. Each
   page is one statement of up to `pageLimits().server` rows (fewer when its

package/guide/agent/framework/sanity-checks.md

@@ -116,6 +116,10 @@ expects the relationship id or an unselected field never gets it.
   once](/guide/framework/typed-features#test-databases-are-prepared-once),
   [integration test
   databases](/guide/app-setup/database-layer#integration-test-databases)).
+- A component's content and states are checked in a Vitest component test;
+  a browser check is an assertion in the Playwright spec that already reaches
+  that screen. Every Playwright run ends with its 10 slowest tests: compare a
+  new test's time, and the suite's, before and after.
 
 ### Inputs and access
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/agent-docs",
-  "version": "0.1.291",
+  "version": "0.1.292",
   "description": "Distributed JSKIT agent references, prompts, guides, and generated reference maps.",
   "type": "module",
   "files": [

package/patterns/minimal-foundation/example/package.json

@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.248",
-    "@jskit-ai/jskit-catalog": "0.2.43",
+    "@jskit-ai/jskit-catalog": "0.2.44",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/package.json

@@ -51,7 +51,7 @@
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.248",
-    "@jskit-ai/jskit-catalog": "0.2.43",
+    "@jskit-ai/jskit-catalog": "0.2.44",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/reference/autogen/PATTERN_INDEX.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.291`
+- Owner: `@jskit-ai/agent-docs@0.1.292`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.291`
+- Owner: `@jskit-ai/agent-docs@0.1.292`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.2.37`
+- Owner: `@jskit-ai/assistant-runtime@0.2.38`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -92,7 +92,7 @@ Resolve an administrator environment key or an individual user's grant, then use
 
 - Id: `connectors/ai-connections`
 - Keywords: `ai`, `api-key`, `cli`, `environment`, `free`, `models`, `ownership`, `zai`, `zen`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/ai-connections/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/ai-connections/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -103,7 +103,7 @@ Compose provider operations, authorization and encrypted file storage from a CLI
 
 - Id: `connectors/api-key-connection`
 - Keywords: `api-key`, `clay`, `cli`, `clickhouse`, `connectors`, `dbt`, `files`, `firecrawl`, `granola`, `integrations`, `metrics`, `prestashop`, `resend`, `semantic-layer`, `semrush`, `x-twitter`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/api-key-connection/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/api-key-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -114,7 +114,7 @@ Compose token-based MCP discovery and explicitly authorized tool calls using the
 
 - Id: `connectors/assistant-mcp`
 - Keywords: `assistant`, `cli`, `connectors`, `files`, `integrations`, `mcp`, `n8n`, `sanity`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/assistant-mcp/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/assistant-mcp/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -125,7 +125,7 @@ Configure assistant OAuth clients, then compose existing state, encrypted file g
 
 - Id: `connectors/assistant-mcp-oauth`
 - Keywords: `amplitude`, `assistant`, `atlassian`, `canva`, `cli`, `client metadata`, `confidence`, `connectors`, `figma`, `files`, `granola`, `hex`, `mcp`, `miro`, `oauth`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/assistant-mcp-oauth/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/assistant-mcp-oauth/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -136,7 +136,7 @@ Compose signed AWS operations, file configuration and application authorization
 
 - Id: `connectors/aws-storage-queries`
 - Keywords: `athena`, `aws`, `cli`, `connectors`, `files`, `iam`, `queries`, `s3`, `storage`, `sts`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/aws-storage-queries/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/aws-storage-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -147,7 +147,7 @@ Compose reusable connection libraries with portable configuration, application o
 
 - Id: `connectors/calendar-cli`
 - Keywords: `calendar`, `cli`, `connectors`, `google`, `integrations`, `oauth`, `permissions`
-- Owner: `@jskit-ai/connector-google-calendar@0.2.21`
+- Owner: `@jskit-ai/connector-google-calendar@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/calendar-cli/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/calendar-cli/example/)
 - Requires: `@jskit-ai/connector-google-calendar`, `@jskit-ai/connectors-core`, `@jskit-ai/database-runtime-mysql`
@@ -158,7 +158,7 @@ Compose the shared connector runtime for event delivery while leaving workflow c
 
 - Id: `connectors/event-delivery`
 - Keywords: `cli`, `connectors`, `events`, `files`, `inngest`, `integrations`, `workflows`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/event-delivery/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/event-delivery/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -169,7 +169,7 @@ Wire service-account grants, file storage, explicit message actions and public b
 
 - Id: `connectors/firebase-messaging`
 - Keywords: `cli`, `connectors`, `fcm`, `files`, `firebase`, `integrations`, `jwt`, `notifications`, `push`, `service-account`, `vapid`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/firebase-messaging/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/firebase-messaging/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -180,7 +180,7 @@ Compose reviewed Search campaigns with project-owned Google OAuth and portable s
 
 - Id: `connectors/google-ads-search`
 - Keywords: `ads`, `campaigns`, `cli`, `connectors`, `conversion`, `google`, `search`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/google-ads-search/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/google-ads-search/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -191,7 +191,7 @@ Compose provider consent, verification and encrypted file persistence from an ap
 
 - Id: `connectors/oauth-connection`
 - Keywords: `accounting`, `assistant permissions`, `books`, `cli`, `client credentials`, `connectors`, `consent`, `crm`, `databricks`, `developer token`, `fabric`, `files`, `gaql`, `google ads`, `graphql`, `integrations`, `linkedin`, `microsoft`, `oauth`, `powerpoint`, `salesforce`, `service principal`, `shopify`, `soql`, `staffing`, `tiktok`, `twitch`, `wave`, `word`, `wordpress`, `workday`, `xero`, `zoho`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/oauth-connection/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/oauth-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -202,7 +202,7 @@ Compose a sequential catalogue batch and preserve partial success for applicatio
 
 - Id: `connectors/paddle-catalogue`
 - Keywords: `batch`, `paddle`, `payments`, `prices`, `products`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/paddle-catalogue/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/paddle-catalogue/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -213,7 +213,7 @@ Resolve a publishable image key deliberately and use the shared URL library in a
 
 - Id: `connectors/public-image`
 - Keywords: `cli`, `connectors`, `files`, `images`, `integrations`, `logo-dev`, `public-key`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/public-image/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/public-image/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -224,7 +224,7 @@ Compose file configuration, Redshift Data API operations and application query o
 
 - Id: `connectors/redshift-queries`
 - Keywords: `aws`, `cli`, `connectors`, `files`, `iam`, `provisioned`, `redshift`, `serverless`, `sql`, `warehouse`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/redshift-queries/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/redshift-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -235,7 +235,7 @@ Use the shared scanner runtime from a CLI or a host worker with portable configu
 
 - Id: `connectors/source-scanning`
 - Keywords: `cancellation`, `cli`, `connectors`, `integrations`, `scanning`, `security`, `source`, `wiz`, `worker`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/source-scanning/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/source-scanning/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -246,7 +246,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.248`
+- Owner: `@jskit-ai/console-web@0.1.249`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -268,7 +268,7 @@ Build a complete application-owned CRUD server package from a migration, a table
 
 - Id: `crud/crud-feature-package`
 - Keywords: `actions`, `crud`, `database`, `defineCrudFeature`, `json-api`, `migration`, `owns`, `permissions`, `repository`, `routes`, `service`, `table resource`
-- Owner: `@jskit-ai/crud-core@0.2.21`
+- Owner: `@jskit-ai/crud-core@0.2.22`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-feature-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-feature-package/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -345,7 +345,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.2.26`
+- Owner: `@jskit-ai/rewarded-web@0.2.27`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -356,7 +356,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `aggregate`, `feature`, `handle`, `orchestration`, `owns`, `package`, `provider`, `repository`, `routes`, `server`, `table resource`
-- Owner: `@jskit-ai/agent-docs@0.1.291`
+- Owner: `@jskit-ai/agent-docs@0.1.292`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -389,7 +389,7 @@ Compose an account settings route and profile, preference, notification, and sig
 
 - Id: `users/account-settings`
 - Keywords: `account`, `link provider`, `notifications`, `oauth`, `preferences`, `profile`, `settings`, `sign-in methods`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.2.31`
+- Owner: `@jskit-ai/users-web@0.2.32`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -400,7 +400,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.2.22`
+- Owner: `@jskit-ai/users-core@0.2.23`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -411,7 +411,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.2.22`
+- Owner: `@jskit-ai/workspaces-core@0.2.23`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -422,7 +422,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.2.31`
+- Owner: `@jskit-ai/workspaces-web@0.2.32`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/reference/autogen/packages/crud-core.md

@@ -100,7 +100,7 @@ Exports
 Local functions
 - `documentNotFound()`
 - `requireDocument(document)`
-- `isNotFound(error)`
+- `isNotFound(error, resourceName)`
 - `recordOutput(crud)`
 - `contractShape(crud)`
 - `includedShape({ attributes, relationships }, labelKey = "")`

package/reference/autogen/packages/resource-runtime.md

@@ -42,6 +42,14 @@ Exports
 - `UnpagedQueryError`
 - `UnsupportedDatabaseError`
 
+### `src/server/filterJoinSources.js`
+Exports
+- `filterJoinSources(featureId, resource, searchSchema)`
+- `joinSourceHooks({ resourceName, declared, ownerOf })`
+- `withCallOptions(jsonRestContext, options)`
+Local functions
+- `preparedFilter(resourceName, filter, applyFilter)`
+
 ### `src/server/foreignKeyCheck.js`
 Exports
 - `checkForeignKeys({ knex, resources, tables = [] })`
@@ -102,14 +110,16 @@ Local functions
 
 ### `src/server/handleLocks.js`
 Exports
-- `createLockReads({ name, resource, jsonRest, readFields, contextOf, hiddenFields })`
+- `createLockReads({ api, name, resource, jsonRest, readFields, contextOf, hiddenFields, handleNamed, resourceNamed })`
 - `lockModeOf(name, caller, lockMode)`
 Local functions
-- `refuseInclude(name, caller, include)`
+- `lockedIncludes(resource, caller, include)`
 
 ### `src/server/handleRecords.js`
 Exports
 - `aggregateMeasures(measures)`
+- `defaultFieldList({ outputFields, outputRelationships, idProperty })`
+- `includedRelationships(include)`
 - `MANY_RETURNING`
 - `SINGLE_RETURNING`
 - `handleRecords(resource, records, { include, fields } = {}, resourceNamed)`
@@ -131,7 +141,6 @@ Local functions
 - `setsOwnTimestamps(context)`
 - `atPrecision(field, value)`
 - `stampedAttributes(resource, attributes, stamp, context)`
-- `includedRelationships(include)`
 - `handleRecord(resource, record, included, named, resourceNamed)`
 
 ### `src/server/index.js`
@@ -181,7 +190,7 @@ Local functions
 ### `src/server/resourceHandle.js`
 Exports
 - `MANY_ROW_CHANNEL`
-- `createResourceHandle({ api, resource, hooks, settings, resourceNamed })`
+- `createResourceHandle({ api, resource, hooks, settings, resourceNamed, handleNamed })`
 Local functions
 - `reportManyRow(resource, operation, rows, chunkSize)`
 - `requireHandleTransaction(name, options)`

package/skills/jskit/references/data-access.md

@@ -29,7 +29,7 @@ through its handle's calls, and every call takes the call's `options` last:
 | Call | Does |
 | --- | --- |
 | `query({ filters, sort, page, include }, options)` | one page: `{ records, page }` |
-| `queryAll({ filters, sort, include }, options)` | every matching row, for jobs, id lists and one parent's rows |
+| `queryAll({ filters, sort, include, take }, options)` | every matching row, or the first `take`, for jobs, id lists and one parent's rows |
 | `queryPages({ filters, sort, include }, options)` | every matching row, a page at a time, for work over many rows |
 | `get(id, params, options)` | one record |
 | `aggregate({ measures, groupBy, filters, sort, page }, options)` | totals, grouped by fields or date buckets |
@@ -256,6 +256,63 @@ the other table hides, which would tell a caller which rows hold a value it
 may not read. For either, the other table's owner answers the ids it matches
 through its owner API, and the filter takes the list: `filters: { supplierIds }`.
 
+A filter that asks whether a row has, or lacks, another owner's rows
+(projects with an open task, projects with no task) reads that owner's join
+source. The `owns` entry's `searchSchema` names each join source by an alias,
+with a function answering its owner from the feature's `requires` or its own
+handles (`owned`), and `applyFilter` gets `joinSource(alias)`: that owner's
+`{ query, column }` for the caller's scope, as a report's join source
+([Layer 5](#layer-5-reports-the-resource-cannot-express)), which it ties to
+the row with `whereColumn` inside `whereExists` or `whereNotExists`:
+
+```js
+// the projects feature's owns entry; the feature requires the tasks owner as `tasks`
+{
+  resource: projectResource,
+  searchSchema: {
+    hasOpenTask: {
+      type: "boolean",
+      joinSources: { k: ({ requires }) => requires.tasks },
+      applyFilter(query, wanted, { column, joinSource }) {
+        const task = joinSource("k");
+        const openTasks = task.query
+          .select(task.column("id"))
+          .whereColumn(task.column("projectId"), column("id"))
+          .where(task.column("status"), "open");
+        if (wanted) {
+          query.whereExists(openTasks);
+        } else {
+          query.whereNotExists(openTasks);
+        }
+      }
+    }
+  }
+}
+```
+
+The handle builds the join sources a read's filters use just before the read,
+in the call's own context and transaction, so `query`, `queryAll`,
+`queryPages`, `aggregate` and `joinSource` take the filter in their one
+statement, and the other owner's ownership, row policy and hidden fields
+decide which of its rows count (`column()` refuses a hidden field). A filter
+that prefers one match and falls back on another when no row of the table has
+the first (the projects named like the term, or, when none is, those with a
+task in that status) names the feature's own handle for its own table,
+`({ owned }) => owned.projects`. Only a read through a handle builds join
+sources. `own()` refuses, at startup, `joinSources` that is not a record of
+functions under aliases, such a filter with `oneOf` or without `applyFilter`,
+and `joinSources` in the table resource's own `searchSchema`, which names no
+feature to answer it.
+
+An app switches to such a filter where a search resolves another owner's
+matches first: a repository that reads the other owner's ids (an id report on
+its `scopedQuery()`, or that owner's `queryAll` matched in memory) and then
+filters `id` by the list, or a filter that was a `whereRaw` with `EXISTS
+(SELECT ... FROM ...)`, which `jskit/sql-literal` refuses. The filter moves
+into the `owns` entry with the other owner as a join source, the code that
+resolved ids goes, and the read is one statement however many rows match,
+where the id list grew with the matches.
+
 A table keyed by a `uuid` or `string` primary key takes its ids as text; an
 `owns` entry's `normalizeId` is only for an id written some other way.
 
@@ -564,8 +621,9 @@ waiter with errno 1020 ("Record has changed since last read"), which a write
 that owns its transaction runs again. For one row,
 `patch(id, changes, { ...options, onlyIf: { status: "open" } })` does the same.
 A filter on another table (a search field whose `actualField` reaches a
-related table) is refused on MySQL and MariaDB (`RestApiValidationError`, rule
-`selection_cross_table`), even when it matches no row. A search entry's own
+related table, or one that reads a join source) is refused on MySQL and
+MariaDB (`RestApiValidationError`, rule `selection_cross_table`), even when it
+matches no row; `lockWhere` and `claim` refuse it the same way. A search entry's own
 `applyFilter` that reads another table through a subquery is not detected, and
 is no compare-and-set there either. Filter on the row's own columns instead, for example
 on the link after locking its targets with `lockMany` in the same transaction
@@ -622,17 +680,31 @@ or a counter row taken with `lock(id)`. Every lock needs a transaction; SQLite
 runs one transaction at a time, so there is no row lock to take. Take locks in
 one order on every path, a parent before its children.
 
-A lock answers only the rows it locks, with the fields `fields` names, and
-refuses `include` before any statement. Read the locked rows' related records
-after the lock, in the same transaction: `queryAll({ filters: { id: ids },
-include }, txOptions)`, or the related table's read by id list. On PostgreSQL
-every statement sees what had committed when it began, so that read is current.
-On MySQL and MariaDB a plain read inside a transaction sees the snapshot of the
+A lock answers the rows it locks, with the fields `fields` names. Its
+`include` names belongs-to relationships (`include: ["customer"]`, or
+`"batch.yard"` a level further): after its own rows, the lock locks the
+records they name through each related table's own handle (its scope, its row
+policy, its hidden fields), in id order, each related table once however many
+rows name it, and nests them as a read's include does; a link to a record the
+caller may not see reads as in a read, its belongs-to field null. Those are locks too, so on MySQL and MariaDB
+they find a record committed after the transaction's first plain read, which a
+plain read misses. They come after the rows, a child before the parent it
+names, so a path that locks the parent first and then its children (to add one)
+takes the other order: the database ends a deadlock between the two by failing
+one transaction, which `withTransaction` runs again, and a path that runs
+often keeps one order on both sides. A collection (`include: ["lines"]`) is
+refused before any statement: lock a parent's children with their own
+table's `lockWhere` in the same transaction.
+
+Every other read after the lock is a plain read. On PostgreSQL every statement
+sees what had committed when it began, so that read is current. On MySQL and
+MariaDB a plain read inside a transaction sees the snapshot of the
 transaction's first plain read, and a lock that waited does not move it. So
 take the lock before any plain read in the transaction: the reads after it then
 see what the lock's previous holder committed. A related row the work decides
-on (is this seat already booked?) is locked itself, or read after a lock
-that every writer of it takes first.
+on (is this seat already booked?) is locked itself, through the lock's
+`include` or a lock of its own, or read after a lock that every writer of it
+takes first.
 
 ```js
 // good: the lock is the transaction's first read, so the bookings read after it are current
@@ -797,7 +869,10 @@ async function activeDays(memberIds, options) {
   its own row with `whereColumn`; one that counts them joins the source grouped,
   as `projectSummary` does. Rows matched by a related row's value ("items
   whose supplier is named Acme") need no report: a cross-table search filter
-  answers them in a plain read ([Layer 1](#layer-1-the-table-resource)).
+  answers them in a plain read ([Layer 1](#layer-1-the-table-resource)). Nor
+  does a question that only narrows a plain read's rows (has an open task, has
+  no task): a search filter that reads the other owner's join source answers
+  it in that read, with its page, sort and includes as usual (Layer 1).
 
   ```js
   // Knex: report - the caller's projects with no task the caller sees
@@ -811,6 +886,32 @@ async function activeDays(memberIds, options) {
   }
   ```
 
+- A report in a feature that owns none of its tables (a console's, over
+  several owners) roots at the main owner's `joinSource()` instead of a
+  `scopedQuery()`, and ties the other owners' join sources to it the same way,
+  in one statement, every owner's scope and row policy applied.
+
+  ```js
+  // Knex: report - the caller's projects with no task the caller sees, for a console that owns neither table
+  async function idleProjects(options) {
+    const project = await projects.joinSource({ alias: "p" }, options);
+    const task = await tasks.joinSource({ alias: "k" }, options);
+    return project.query
+      .whereNotExists(task.query.select(task.column("id")).whereColumn(task.column("projectId"), project.column("id")))
+      .select({ name: project.column("name") });
+  }
+  ```
+
+- An app switches a report it kept as a raw-SQL exception (another owner's
+  table joined by name, or a subquery in `raw()`, in a file under an
+  infrastructure exception, see [Exceptions](#exceptions)) to these: the
+  report's feature requires each owner whose rows it reads, puts each owner's
+  join source where the table stood (`whereExists`, `whereNotExists`, or
+  joined grouped for counts and sums), roots at its own table's
+  `scopedQuery()` or at the main owner's `joinSource()`, and the file drops
+  its `readable-check: allow` lines and its `jskit-data-access.json` entry.
+  When an owner is a JSKIT package, its owner API answers `joinSource`
+  ([Tables you don't own](#tables-you-dont-own)).
 - When each owner can answer on its own (keys in, grouped totals out), the
   report is a feature of its own that calls each owner's method and merges the
   answers in memory: one statement per owner, never a call per row.
@@ -838,6 +939,11 @@ async function activeDays(memberIds, options) {
   request it stops past the request row limit (`pageLimits().requestRows`,
   10,000 rows) with a 400 coded `RESOURCE_ROW_LIMIT`, and never answers part
   of the rows. A job reads without that limit and holds every row in memory.
+  `queryAll({ ..., take: 500 })` answers only the first 500 rows in its sort
+  order and reads no row past them, the last page no larger than the rows still
+  wanted. `take` is then the read's bound, so a request may name more than the
+  request row limit and never gets `RESOURCE_ROW_LIMIT`: name the bound the
+  work can hold, never one from the request unchecked.
 - Work over many rows reads `queryPages` and handles one page at a time:
   `for await (const records of handle.queryPages(params, options))`. Each
   page is one statement of up to `pageLimits().server` rows (fewer when its

package/skills/jskit/references/heuristics/ui-testing.md

@@ -11,7 +11,9 @@ Use when:
 
 Rules:
 
-- Any chunk that adds or changes user-facing UI must include a Playwright flow that exercises the changed behavior before the chunk is done.
+- Any chunk that adds or changes user-facing UI proves the changed behavior with an automated test before the chunk is done, at the cheapest level that can: a component's content, states and conditional display in a client component test (Vitest); only what needs a real browser (navigation, a flow across screens, layout at the standard widths, focus, the real sign-in) in Playwright.
+- Put a new browser check in the existing spec that already reaches that screen with the data it needs. Add a new spec only for a new flow, using the app's shared server, sign-in and fixture setup. A browser test that pays its own server start, sign-in or seeding to check one card, label or state is not acceptable: every run pays for it for as long as it exists. Move that check to a component test or an existing spec, and report the spec's time and the suite's time before and after.
+- Never wait out the app's own delays (request retries, debounce, polling) in real time, and never change the scenario to skip them: install Playwright's `page.clock` before the page loads and advance it with `page.clock.runFor(...)`, or use Vitest's fake timers in a component test. Change the scenario only when another test already proves the skipped path.
 - Pattern and framework UI changes must be checked at compact phone, tablet-ish medium, and expanded desktop widths.
 - Check horizontal overflow, clipped or invisible text, duplicate navigation, and broken route placement at every standard viewport. On compact screens, also check screen tap targets under 48 px; medium and expanded layouts may use their documented denser controls.
 - Apps with `shell-web` installed should start from `tests/e2e/adaptive-shell.spec.ts` and extend it with feature-specific assertions.
@@ -186,7 +188,8 @@ browser check with a full lint, build, or test sweep; follow its verification po
 
 Do not mark the chunk done if:
 
-- the feature changed user-facing UI but no Playwright flow ran
-- the Playwright flow skipped the changed behavior itself
+- the feature changed user-facing UI but no test at the right level proves it
+- the test skipped the changed behavior itself
+- a new browser test pays its own setup to check what a component test or an existing spec could
 - a managed environment was bypassed by installing another browser
 - an authenticated flow was left untested without clearly reporting the missing session-bootstrap seam

package/skills/jskit/references/pattern-index.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.291`
+- Owner: `@jskit-ai/agent-docs@0.1.292`
 - Read: [PATTERN.md](patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.291`
+- Owner: `@jskit-ai/agent-docs@0.1.292`
 - Read: [PATTERN.md](patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.2.37`
+- Owner: `@jskit-ai/assistant-runtime@0.2.38`
 - Read: [PATTERN.md](patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -92,7 +92,7 @@ Resolve an administrator environment key or an individual user's grant, then use
 
 - Id: `connectors/ai-connections`
 - Keywords: `ai`, `api-key`, `cli`, `environment`, `free`, `models`, `ownership`, `zai`, `zen`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/ai-connections/PATTERN.md)
 - Examples: [example/](patterns/connectors/ai-connections/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -103,7 +103,7 @@ Compose provider operations, authorization and encrypted file storage from a CLI
 
 - Id: `connectors/api-key-connection`
 - Keywords: `api-key`, `clay`, `cli`, `clickhouse`, `connectors`, `dbt`, `files`, `firecrawl`, `granola`, `integrations`, `metrics`, `prestashop`, `resend`, `semantic-layer`, `semrush`, `x-twitter`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/api-key-connection/PATTERN.md)
 - Examples: [example/](patterns/connectors/api-key-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -114,7 +114,7 @@ Compose token-based MCP discovery and explicitly authorized tool calls using the
 
 - Id: `connectors/assistant-mcp`
 - Keywords: `assistant`, `cli`, `connectors`, `files`, `integrations`, `mcp`, `n8n`, `sanity`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/assistant-mcp/PATTERN.md)
 - Examples: [example/](patterns/connectors/assistant-mcp/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -125,7 +125,7 @@ Configure assistant OAuth clients, then compose existing state, encrypted file g
 
 - Id: `connectors/assistant-mcp-oauth`
 - Keywords: `amplitude`, `assistant`, `atlassian`, `canva`, `cli`, `client metadata`, `confidence`, `connectors`, `figma`, `files`, `granola`, `hex`, `mcp`, `miro`, `oauth`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/assistant-mcp-oauth/PATTERN.md)
 - Examples: [example/](patterns/connectors/assistant-mcp-oauth/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -136,7 +136,7 @@ Compose signed AWS operations, file configuration and application authorization
 
 - Id: `connectors/aws-storage-queries`
 - Keywords: `athena`, `aws`, `cli`, `connectors`, `files`, `iam`, `queries`, `s3`, `storage`, `sts`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/aws-storage-queries/PATTERN.md)
 - Examples: [example/](patterns/connectors/aws-storage-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -147,7 +147,7 @@ Compose reusable connection libraries with portable configuration, application o
 
 - Id: `connectors/calendar-cli`
 - Keywords: `calendar`, `cli`, `connectors`, `google`, `integrations`, `oauth`, `permissions`
-- Owner: `@jskit-ai/connector-google-calendar@0.2.21`
+- Owner: `@jskit-ai/connector-google-calendar@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/calendar-cli/PATTERN.md)
 - Examples: [example/](patterns/connectors/calendar-cli/example/)
 - Requires: `@jskit-ai/connector-google-calendar`, `@jskit-ai/connectors-core`, `@jskit-ai/database-runtime-mysql`
@@ -158,7 +158,7 @@ Compose the shared connector runtime for event delivery while leaving workflow c
 
 - Id: `connectors/event-delivery`
 - Keywords: `cli`, `connectors`, `events`, `files`, `inngest`, `integrations`, `workflows`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/event-delivery/PATTERN.md)
 - Examples: [example/](patterns/connectors/event-delivery/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -169,7 +169,7 @@ Wire service-account grants, file storage, explicit message actions and public b
 
 - Id: `connectors/firebase-messaging`
 - Keywords: `cli`, `connectors`, `fcm`, `files`, `firebase`, `integrations`, `jwt`, `notifications`, `push`, `service-account`, `vapid`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/firebase-messaging/PATTERN.md)
 - Examples: [example/](patterns/connectors/firebase-messaging/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -180,7 +180,7 @@ Compose reviewed Search campaigns with project-owned Google OAuth and portable s
 
 - Id: `connectors/google-ads-search`
 - Keywords: `ads`, `campaigns`, `cli`, `connectors`, `conversion`, `google`, `search`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/google-ads-search/PATTERN.md)
 - Examples: [example/](patterns/connectors/google-ads-search/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -191,7 +191,7 @@ Compose provider consent, verification and encrypted file persistence from an ap
 
 - Id: `connectors/oauth-connection`
 - Keywords: `accounting`, `assistant permissions`, `books`, `cli`, `client credentials`, `connectors`, `consent`, `crm`, `databricks`, `developer token`, `fabric`, `files`, `gaql`, `google ads`, `graphql`, `integrations`, `linkedin`, `microsoft`, `oauth`, `powerpoint`, `salesforce`, `service principal`, `shopify`, `soql`, `staffing`, `tiktok`, `twitch`, `wave`, `word`, `wordpress`, `workday`, `xero`, `zoho`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/oauth-connection/PATTERN.md)
 - Examples: [example/](patterns/connectors/oauth-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -202,7 +202,7 @@ Compose a sequential catalogue batch and preserve partial success for applicatio
 
 - Id: `connectors/paddle-catalogue`
 - Keywords: `batch`, `paddle`, `payments`, `prices`, `products`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/paddle-catalogue/PATTERN.md)
 - Examples: [example/](patterns/connectors/paddle-catalogue/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -213,7 +213,7 @@ Resolve a publishable image key deliberately and use the shared URL library in a
 
 - Id: `connectors/public-image`
 - Keywords: `cli`, `connectors`, `files`, `images`, `integrations`, `logo-dev`, `public-key`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/public-image/PATTERN.md)
 - Examples: [example/](patterns/connectors/public-image/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -224,7 +224,7 @@ Compose file configuration, Redshift Data API operations and application query o
 
 - Id: `connectors/redshift-queries`
 - Keywords: `aws`, `cli`, `connectors`, `files`, `iam`, `provisioned`, `redshift`, `serverless`, `sql`, `warehouse`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/redshift-queries/PATTERN.md)
 - Examples: [example/](patterns/connectors/redshift-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -235,7 +235,7 @@ Use the shared scanner runtime from a CLI or a host worker with portable configu
 
 - Id: `connectors/source-scanning`
 - Keywords: `cancellation`, `cli`, `connectors`, `integrations`, `scanning`, `security`, `source`, `wiz`, `worker`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.22`
 - Read: [PATTERN.md](patterns/connectors/source-scanning/PATTERN.md)
 - Examples: [example/](patterns/connectors/source-scanning/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -246,7 +246,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.248`
+- Owner: `@jskit-ai/console-web@0.1.249`
 - Read: [PATTERN.md](patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -268,7 +268,7 @@ Build a complete application-owned CRUD server package from a migration, a table
 
 - Id: `crud/crud-feature-package`
 - Keywords: `actions`, `crud`, `database`, `defineCrudFeature`, `json-api`, `migration`, `owns`, `permissions`, `repository`, `routes`, `service`, `table resource`
-- Owner: `@jskit-ai/crud-core@0.2.21`
+- Owner: `@jskit-ai/crud-core@0.2.22`
 - Read: [PATTERN.md](patterns/crud/crud-feature-package/PATTERN.md)
 - Examples: [example/](patterns/crud/crud-feature-package/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -345,7 +345,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.2.26`
+- Owner: `@jskit-ai/rewarded-web@0.2.27`
 - Read: [PATTERN.md](patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -356,7 +356,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `aggregate`, `feature`, `handle`, `orchestration`, `owns`, `package`, `provider`, `repository`, `routes`, `server`, `table resource`
-- Owner: `@jskit-ai/agent-docs@0.1.291`
+- Owner: `@jskit-ai/agent-docs@0.1.292`
 - Read: [PATTERN.md](patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -389,7 +389,7 @@ Compose an account settings route and profile, preference, notification, and sig
 
 - Id: `users/account-settings`
 - Keywords: `account`, `link provider`, `notifications`, `oauth`, `preferences`, `profile`, `settings`, `sign-in methods`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.2.31`
+- Owner: `@jskit-ai/users-web@0.2.32`
 - Read: [PATTERN.md](patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -400,7 +400,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.2.22`
+- Owner: `@jskit-ai/users-core@0.2.23`
 - Read: [PATTERN.md](patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -411,7 +411,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.2.22`
+- Owner: `@jskit-ai/workspaces-core@0.2.23`
 - Read: [PATTERN.md](patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -422,7 +422,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.2.31`
+- Owner: `@jskit-ai/workspaces-web@0.2.32`
 - Read: [PATTERN.md](patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/skills/jskit/references/patterns/app/minimal-foundation/example/package.json

@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.248",
-    "@jskit-ai/jskit-catalog": "0.2.43",
+    "@jskit-ai/jskit-catalog": "0.2.44",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/skills/jskit/references/patterns/app/shell-foundation/example/package.json

@@ -51,7 +51,7 @@
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.248",
-    "@jskit-ai/jskit-catalog": "0.2.43",
+    "@jskit-ai/jskit-catalog": "0.2.44",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/skills/jskit/references/patterns/connectors/calendar-cli/example/package.json

@@ -7,8 +7,8 @@
     "db:migrate:status": "knex --knexfile ./knexfile.js migrate:list"
   },
   "dependencies": {
-    "@jskit-ai/connectors-core": "0.2.21",
-    "@jskit-ai/connector-google-calendar": "0.2.21",
+    "@jskit-ai/connectors-core": "0.2.22",
+    "@jskit-ai/connector-google-calendar": "0.2.22",
     "@jskit-ai/database-runtime": "0.1.266",
     "@jskit-ai/database-runtime-mysql": "0.1.264",
     "knex": "^3.1.0"

package/skills/jskit/references/patterns/crud/crud-feature-package/example/packages/books/package.json

@@ -9,7 +9,7 @@
     "./shared": "./src/shared/index.js"
   },
   "dependencies": {
-    "@jskit-ai/crud-core": "0.2.21",
+    "@jskit-ai/crud-core": "0.2.22",
     "@jskit-ai/resource-core": "0.1.208",
     "@jskit-ai/resource-crud-core": "0.1.208"
   },

package/skills/jskit/references/patterns/users/user-administration-server/example/packages/users/package.json

@@ -10,9 +10,9 @@
     "./shared": "./src/shared/index.js"
   },
   "dependencies": {
-    "@jskit-ai/crud-core": "0.2.21",
+    "@jskit-ai/crud-core": "0.2.22",
     "@jskit-ai/resource-crud-core": "0.1.208",
-    "@jskit-ai/users-core": "0.2.22"
+    "@jskit-ai/users-core": "0.2.23"
   },
   "jskit": {
     "kind": "runtime",

package/skills/jskit/references/patterns/users/user-administration-server/example/packages/users-workspace/package.json

@@ -10,14 +10,14 @@
     "./shared": "./src/shared/index.js"
   },
   "dependencies": {
-    "@jskit-ai/crud-core": "0.2.21",
+    "@jskit-ai/crud-core": "0.2.22",
     "@jskit-ai/resource-crud-core": "0.1.208",
-    "@jskit-ai/users-core": "0.2.22",
-    "@jskit-ai/workspaces-core": "0.2.22"
+    "@jskit-ai/users-core": "0.2.23",
+    "@jskit-ai/workspaces-core": "0.2.23"
   },
   "peerDependencies": {
     "@jskit-ai/kernel": "0.2.17",
-    "@jskit-ai/resource-runtime": "0.2.18"
+    "@jskit-ai/resource-runtime": "0.2.19"
   },
   "jskit": {
     "kind": "runtime",

package/skills/jskit/references/sanity-checks.md

@@ -116,6 +116,10 @@ expects the relationship id or an unselected field never gets it.
   once](typed-features.md#test-databases-are-prepared-once),
   [integration test
   databases](database-layer.md#integration-test-databases)).
+- A component's content and states are checked in a Vitest component test;
+  a browser check is an assertion in the Playwright spec that already reaches
+  that screen. Every Playwright run ends with its 10 slowest tests: compare a
+  new test's time, and the suite's, before and after.
 
 ### Inputs and access