@jskit-ai/agent-docs 0.1.291 → 0.1.293

package/skills/jskit/references/data-access.md

@@ -29,7 +29,7 @@ through its handle's calls, and every call takes the call's `options` last:
 | Call | Does |
 | --- | --- |
 | `query({ filters, sort, page, include }, options)` | one page: `{ records, page }` |
-| `queryAll({ filters, sort, include }, options)` | every matching row, for jobs, id lists and one parent's rows |
+| `queryAll({ filters, sort, include, take }, options)` | every matching row, or the first `take`, for jobs, id lists and one parent's rows |
 | `queryPages({ filters, sort, include }, options)` | every matching row, a page at a time, for work over many rows |
 | `get(id, params, options)` | one record |
 | `aggregate({ measures, groupBy, filters, sort, page }, options)` | totals, grouped by fields or date buckets |
@@ -256,6 +256,63 @@ the other table hides, which would tell a caller which rows hold a value it
 may not read. For either, the other table's owner answers the ids it matches
 through its owner API, and the filter takes the list: `filters: { supplierIds }`.
 
+A filter that asks whether a row has, or lacks, another owner's rows
+(projects with an open task, projects with no task) reads that owner's join
+source. The `owns` entry's `searchSchema` names each join source by an alias,
+with a function answering its owner from the feature's `requires` or its own
+handles (`owned`), and `applyFilter` gets `joinSource(alias)`: that owner's
+`{ query, column }` for the caller's scope, as a report's join source
+([Layer 5](#layer-5-reports-the-resource-cannot-express)), which it ties to
+the row with `whereColumn` inside `whereExists` or `whereNotExists`:
+
+```js
+// the projects feature's owns entry; the feature requires the tasks owner as `tasks`
+{
+  resource: projectResource,
+  searchSchema: {
+    hasOpenTask: {
+      type: "boolean",
+      joinSources: { k: ({ requires }) => requires.tasks },
+      applyFilter(query, wanted, { column, joinSource }) {
+        const task = joinSource("k");
+        const openTasks = task.query
+          .select(task.column("id"))
+          .whereColumn(task.column("projectId"), column("id"))
+          .where(task.column("status"), "open");
+        if (wanted) {
+          query.whereExists(openTasks);
+        } else {
+          query.whereNotExists(openTasks);
+        }
+      }
+    }
+  }
+}
+```
+
+The handle builds the join sources a read's filters use just before the read,
+in the call's own context and transaction, so `query`, `queryAll`,
+`queryPages`, `aggregate` and `joinSource` take the filter in their one
+statement, and the other owner's ownership, row policy and hidden fields
+decide which of its rows count (`column()` refuses a hidden field). A filter
+that prefers one match and falls back on another when no row of the table has
+the first (the projects named like the term, or, when none is, those with a
+task in that status) names the feature's own handle for its own table,
+`({ owned }) => owned.projects`. Only a read through a handle builds join
+sources. `own()` refuses, at startup, `joinSources` that is not a record of
+functions under aliases, such a filter with `oneOf` or without `applyFilter`,
+and `joinSources` in the table resource's own `searchSchema`, which names no
+feature to answer it.
+
+An app switches to such a filter where a search resolves another owner's
+matches first: a repository that reads the other owner's ids (an id report on
+its `scopedQuery()`, or that owner's `queryAll` matched in memory) and then
+filters `id` by the list, or a filter that was a `whereRaw` with `EXISTS
+(SELECT ... FROM ...)`, which `jskit/sql-literal` refuses. The filter moves
+into the `owns` entry with the other owner as a join source, the code that
+resolved ids goes, and the read is one statement however many rows match,
+where the id list grew with the matches.
+
 A table keyed by a `uuid` or `string` primary key takes its ids as text; an
 `owns` entry's `normalizeId` is only for an id written some other way.
 
@@ -564,8 +621,9 @@ waiter with errno 1020 ("Record has changed since last read"), which a write
 that owns its transaction runs again. For one row,
 `patch(id, changes, { ...options, onlyIf: { status: "open" } })` does the same.
 A filter on another table (a search field whose `actualField` reaches a
-related table) is refused on MySQL and MariaDB (`RestApiValidationError`, rule
-`selection_cross_table`), even when it matches no row. A search entry's own
+related table, or one that reads a join source) is refused on MySQL and
+MariaDB (`RestApiValidationError`, rule `selection_cross_table`), even when it
+matches no row; `lockWhere` and `claim` refuse it the same way. A search entry's own
 `applyFilter` that reads another table through a subquery is not detected, and
 is no compare-and-set there either. Filter on the row's own columns instead, for example
 on the link after locking its targets with `lockMany` in the same transaction
@@ -622,17 +680,31 @@ or a counter row taken with `lock(id)`. Every lock needs a transaction; SQLite
 runs one transaction at a time, so there is no row lock to take. Take locks in
 one order on every path, a parent before its children.
 
-A lock answers only the rows it locks, with the fields `fields` names, and
-refuses `include` before any statement. Read the locked rows' related records
-after the lock, in the same transaction: `queryAll({ filters: { id: ids },
-include }, txOptions)`, or the related table's read by id list. On PostgreSQL
-every statement sees what had committed when it began, so that read is current.
-On MySQL and MariaDB a plain read inside a transaction sees the snapshot of the
+A lock answers the rows it locks, with the fields `fields` names. Its
+`include` names belongs-to relationships (`include: ["customer"]`, or
+`"batch.yard"` a level further): after its own rows, the lock locks the
+records they name through each related table's own handle (its scope, its row
+policy, its hidden fields), in id order, each related table once however many
+rows name it, and nests them as a read's include does; a link to a record the
+caller may not see reads as in a read, its belongs-to field null. Those are locks too, so on MySQL and MariaDB
+they find a record committed after the transaction's first plain read, which a
+plain read misses. They come after the rows, a child before the parent it
+names, so a path that locks the parent first and then its children (to add one)
+takes the other order: the database ends a deadlock between the two by failing
+one transaction, which `withTransaction` runs again, and a path that runs
+often keeps one order on both sides. A collection (`include: ["lines"]`) is
+refused before any statement: lock a parent's children with their own
+table's `lockWhere` in the same transaction.
+
+Every other read after the lock is a plain read. On PostgreSQL every statement
+sees what had committed when it began, so that read is current. On MySQL and
+MariaDB a plain read inside a transaction sees the snapshot of the
 transaction's first plain read, and a lock that waited does not move it. So
 take the lock before any plain read in the transaction: the reads after it then
 see what the lock's previous holder committed. A related row the work decides
-on (is this seat already booked?) is locked itself, or read after a lock
-that every writer of it takes first.
+on (is this seat already booked?) is locked itself, through the lock's
+`include` or a lock of its own, or read after a lock that every writer of it
+takes first.
 
 ```js
 // good: the lock is the transaction's first read, so the bookings read after it are current
@@ -797,7 +869,10 @@ async function activeDays(memberIds, options) {
   its own row with `whereColumn`; one that counts them joins the source grouped,
   as `projectSummary` does. Rows matched by a related row's value ("items
   whose supplier is named Acme") need no report: a cross-table search filter
-  answers them in a plain read ([Layer 1](#layer-1-the-table-resource)).
+  answers them in a plain read ([Layer 1](#layer-1-the-table-resource)). Nor
+  does a question that only narrows a plain read's rows (has an open task, has
+  no task): a search filter that reads the other owner's join source answers
+  it in that read, with its page, sort and includes as usual (Layer 1).
 
   ```js
   // Knex: report - the caller's projects with no task the caller sees
@@ -811,6 +886,32 @@ async function activeDays(memberIds, options) {
   }
   ```
 
+- A report in a feature that owns none of its tables (a console's, over
+  several owners) roots at the main owner's `joinSource()` instead of a
+  `scopedQuery()`, and ties the other owners' join sources to it the same way,
+  in one statement, every owner's scope and row policy applied.
+
+  ```js
+  // Knex: report - the caller's projects with no task the caller sees, for a console that owns neither table
+  async function idleProjects(options) {
+    const project = await projects.joinSource({ alias: "p" }, options);
+    const task = await tasks.joinSource({ alias: "k" }, options);
+    return project.query
+      .whereNotExists(task.query.select(task.column("id")).whereColumn(task.column("projectId"), project.column("id")))
+      .select({ name: project.column("name") });
+  }
+  ```
+
+- An app switches a report it kept as a raw-SQL exception (another owner's
+  table joined by name, or a subquery in `raw()`, in a file under an
+  infrastructure exception, see [Exceptions](#exceptions)) to these: the
+  report's feature requires each owner whose rows it reads, puts each owner's
+  join source where the table stood (`whereExists`, `whereNotExists`, or
+  joined grouped for counts and sums), roots at its own table's
+  `scopedQuery()` or at the main owner's `joinSource()`, and the file drops
+  its `readable-check: allow` lines and its `jskit-data-access.json` entry.
+  When an owner is a JSKIT package, its owner API answers `joinSource`
+  ([Tables you don't own](#tables-you-dont-own)).
 - When each owner can answer on its own (keys in, grouped totals out), the
   report is a feature of its own that calls each owner's method and merges the
   answers in memory: one statement per owner, never a call per row.
@@ -838,6 +939,11 @@ async function activeDays(memberIds, options) {
   request it stops past the request row limit (`pageLimits().requestRows`,
   10,000 rows) with a 400 coded `RESOURCE_ROW_LIMIT`, and never answers part
   of the rows. A job reads without that limit and holds every row in memory.
+  `queryAll({ ..., take: 500 })` answers only the first 500 rows in its sort
+  order and reads no row past them, the last page no larger than the rows still
+  wanted. `take` is then the read's bound, so a request may name more than the
+  request row limit and never gets `RESOURCE_ROW_LIMIT`: name the bound the
+  work can hold, never one from the request unchecked.
 - Work over many rows reads `queryPages` and handles one page at a time:
   `for await (const records of handle.queryPages(params, options))`. Each
   page is one statement of up to `pageLimits().server` rows (fewer when its

package/skills/jskit/references/heuristics/ui-testing.md

@@ -11,7 +11,9 @@ Use when:
 
 Rules:
 
-- Any chunk that adds or changes user-facing UI must include a Playwright flow that exercises the changed behavior before the chunk is done.
+- Any chunk that adds or changes user-facing UI proves the changed behavior with an automated test before the chunk is done, at the cheapest level that can: a component's content, states and conditional display in a client component test (Vitest); only what needs a real browser (navigation, a flow across screens, layout at the standard widths, focus, the real sign-in) in Playwright.
+- Put a new browser check in the existing spec that already reaches that screen with the data it needs. Add a new spec only for a new flow, using the app's shared server, sign-in and fixture setup. A browser test that pays its own server start, sign-in or seeding to check one card, label or state is not acceptable: every run pays for it for as long as it exists. Move that check to a component test or an existing spec, and report the spec's time and the suite's time before and after.
+- Never wait out the app's own delays (request retries, debounce, polling) in real time, and never change the scenario to skip them: install Playwright's `page.clock` before the page loads and advance it with `page.clock.runFor(...)`, or use Vitest's fake timers in a component test. Change the scenario only when another test already proves the skipped path.
 - Pattern and framework UI changes must be checked at compact phone, tablet-ish medium, and expanded desktop widths.
 - Check horizontal overflow, clipped or invisible text, duplicate navigation, and broken route placement at every standard viewport. On compact screens, also check screen tap targets under 48 px; medium and expanded layouts may use their documented denser controls.
 - Apps with `shell-web` installed should start from `tests/e2e/adaptive-shell.spec.ts` and extend it with feature-specific assertions.
@@ -186,7 +188,8 @@ browser check with a full lint, build, or test sweep; follow its verification po
 
 Do not mark the chunk done if:
 
-- the feature changed user-facing UI but no Playwright flow ran
-- the Playwright flow skipped the changed behavior itself
+- the feature changed user-facing UI but no test at the right level proves it
+- the test skipped the changed behavior itself
+- a new browser test pays its own setup to check what a component test or an existing spec could
 - a managed environment was bypassed by installing another browser
 - an authenticated flow was left untested without clearly reporting the missing session-bootstrap seam

package/skills/jskit/references/multi-homing.md

@@ -336,6 +336,7 @@ authorization and role checks. Do not pass arbitrary HTTP input as options.
 | `workspaces.services.members.sendInvite(workspace, actor, prepared, options)` | Refuses to run inside a transaction: it delivers after the preparation's transaction commits. Reloads the committed pending invitation and workspace display data, validates expiry and token correspondence, and sends that invitation without replacement. |
 | `workspaces.services.members.createInvite(workspace, actor, payload, options)` | Owns preparation and commit, then calls `sendInvite`, and answers with `sendInvite`'s result as JSON:API data (`returnJsonApiData`, read it from `.value`), as the invite action sends it. Refuses to run inside a transaction. |
 | `workspaces.invite-acceptance-participant` (optional capability) | One application function receiving `({ invite, user }, options)` inside the acceptance transaction. Without it, acceptance activates the membership only. |
+| `workspaces.workspace-created-participant` (optional capability) | One application function receiving `({ workspace, owner }, options)` inside a new workspace's creation transaction. Without it, creation writes the workspace, its owner's membership and its settings only. |
 
 `sendInvite` accepts `{ createdInviteId, inviteTokenPreview }` from preparation or
 only `{ createdInviteId }` for a later attempt. The latter uses JSKIT's existing
@@ -471,6 +472,24 @@ Replacement can create a new pending invitation after acceptance while retaining
 the accepted invitation. Keep callbacks short: invitation changes in one workspace
 serialize. Deadlocks/serialization failures propagate without replaying callbacks.
 
+### Workspace creation participation
+
+Provide the optional `workspaces.workspace-created-participant` capability the
+same way, from a small application feature, to write application records for
+every new workspace in the same transaction. Both creation paths call
+`fn({ workspace, owner }, txOptions)`: the `workspace.workspaces.create` action
+(`createWorkspaceForAuthenticatedUser`) and a personal workspace's provisioning
+(`ensurePersonalWorkspaceForUser`, which joins its caller's transaction, such as
+a first sign-in's profile sync). It runs after the workspace, its owner's
+membership and its settings are written, so it can read them with `txOptions`.
+`workspace` and `owner` are shallow frozen. Pass `txOptions` to every write and
+let failures propagate: a failure rolls back the whole creation, workspace,
+membership, settings and the participant's own writes, and the caller receives
+the failure itself (an `AppError` answers as that refusal). Keep external effects
+out of it. An existing personal workspace is not created again and does not call
+it, and a create that loses its slug to the same owner's identical create answers
+that workspace without calling it a second time.
+
 ### Compatibility and verification
 
 Since `@jskit-ai/workspaces-core@0.1.198`, transactional `createInvite` callers

package/skills/jskit/references/pattern-index.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.291`
+- Owner: `@jskit-ai/agent-docs@0.1.293`
 - Read: [PATTERN.md](patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.291`
+- Owner: `@jskit-ai/agent-docs@0.1.293`
 - Read: [PATTERN.md](patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.2.37`
+- Owner: `@jskit-ai/assistant-runtime@0.2.39`
 - Read: [PATTERN.md](patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -48,7 +48,7 @@ Run one OpenID Connect sign-in for all of an owner's apps as its own JSKIT proje
 
 - Id: `auth/accounts-hub`
 - Keywords: `accounts hub`, `auth`, `authentication`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/oidc-issuer-core@0.1.25`
+- Owner: `@jskit-ai/oidc-issuer-core@0.1.26`
 - Read: [PATTERN.md](patterns/auth/accounts-hub/PATTERN.md)
 - Examples: [example/](patterns/auth/accounts-hub/example/)
 - Requires: `@jskit-ai/oidc-issuer-core`
@@ -59,7 +59,7 @@ Compose JSKIT authentication routes, views, profile controls, and public surface
 
 - Id: `auth/auth-surface`
 - Keywords: `account`, `auth`, `login`, `logout`, `password`, `placement`, `profile`, `reset`, `surface`
-- Owner: `@jskit-ai/auth-web@0.2.23`
+- Owner: `@jskit-ai/auth-web@0.2.24`
 - Read: [PATTERN.md](patterns/auth/auth-surface/PATTERN.md)
 - Examples: [example/](patterns/auth/auth-surface/example/)
 - Requires: `@jskit-ai/auth-core`, `@jskit-ai/auth-web`, `@jskit-ai/shell-web`
@@ -70,7 +70,7 @@ Let people sign in with the accounts they already have in an accounts hub or ano
 
 - Id: `auth/oidc-sign-in`
 - Keywords: `accounts hub`, `auth`, `authentication`, `back-channel logout`, `dynamic client registration`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.25`
+- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.26`
 - Read: [PATTERN.md](patterns/auth/oidc-sign-in/PATTERN.md)
 - Examples: [example/](patterns/auth/oidc-sign-in/example/)
 - Requires: `@jskit-ai/auth-provider-oidc-core`, `@jskit-ai/auth-web`
@@ -81,7 +81,7 @@ Add Supabase authentication through normal npm composition, explicit environment
 
 - Id: `auth/supabase-auth`
 - Keywords: `auth`, `authentication`, `oauth`, `sessions`, `supabase`
-- Owner: `@jskit-ai/auth-provider-supabase-core@0.2.19`
+- Owner: `@jskit-ai/auth-provider-supabase-core@0.2.20`
 - Read: [PATTERN.md](patterns/auth/supabase-auth/PATTERN.md)
 - Examples: [example/](patterns/auth/supabase-auth/example/)
 - Requires: `@jskit-ai/auth-provider-supabase-core`
@@ -92,7 +92,7 @@ Resolve an administrator environment key or an individual user's grant, then use
 
 - Id: `connectors/ai-connections`
 - Keywords: `ai`, `api-key`, `cli`, `environment`, `free`, `models`, `ownership`, `zai`, `zen`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/ai-connections/PATTERN.md)
 - Examples: [example/](patterns/connectors/ai-connections/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -103,7 +103,7 @@ Compose provider operations, authorization and encrypted file storage from a CLI
 
 - Id: `connectors/api-key-connection`
 - Keywords: `api-key`, `clay`, `cli`, `clickhouse`, `connectors`, `dbt`, `files`, `firecrawl`, `granola`, `integrations`, `metrics`, `prestashop`, `resend`, `semantic-layer`, `semrush`, `x-twitter`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/api-key-connection/PATTERN.md)
 - Examples: [example/](patterns/connectors/api-key-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -114,7 +114,7 @@ Compose token-based MCP discovery and explicitly authorized tool calls using the
 
 - Id: `connectors/assistant-mcp`
 - Keywords: `assistant`, `cli`, `connectors`, `files`, `integrations`, `mcp`, `n8n`, `sanity`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/assistant-mcp/PATTERN.md)
 - Examples: [example/](patterns/connectors/assistant-mcp/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -125,7 +125,7 @@ Configure assistant OAuth clients, then compose existing state, encrypted file g
 
 - Id: `connectors/assistant-mcp-oauth`
 - Keywords: `amplitude`, `assistant`, `atlassian`, `canva`, `cli`, `client metadata`, `confidence`, `connectors`, `figma`, `files`, `granola`, `hex`, `mcp`, `miro`, `oauth`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/assistant-mcp-oauth/PATTERN.md)
 - Examples: [example/](patterns/connectors/assistant-mcp-oauth/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -136,7 +136,7 @@ Compose signed AWS operations, file configuration and application authorization
 
 - Id: `connectors/aws-storage-queries`
 - Keywords: `athena`, `aws`, `cli`, `connectors`, `files`, `iam`, `queries`, `s3`, `storage`, `sts`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/aws-storage-queries/PATTERN.md)
 - Examples: [example/](patterns/connectors/aws-storage-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -147,7 +147,7 @@ Compose reusable connection libraries with portable configuration, application o
 
 - Id: `connectors/calendar-cli`
 - Keywords: `calendar`, `cli`, `connectors`, `google`, `integrations`, `oauth`, `permissions`
-- Owner: `@jskit-ai/connector-google-calendar@0.2.21`
+- Owner: `@jskit-ai/connector-google-calendar@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/calendar-cli/PATTERN.md)
 - Examples: [example/](patterns/connectors/calendar-cli/example/)
 - Requires: `@jskit-ai/connector-google-calendar`, `@jskit-ai/connectors-core`, `@jskit-ai/database-runtime-mysql`
@@ -158,7 +158,7 @@ Compose the shared connector runtime for event delivery while leaving workflow c
 
 - Id: `connectors/event-delivery`
 - Keywords: `cli`, `connectors`, `events`, `files`, `inngest`, `integrations`, `workflows`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/event-delivery/PATTERN.md)
 - Examples: [example/](patterns/connectors/event-delivery/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -169,7 +169,7 @@ Wire service-account grants, file storage, explicit message actions and public b
 
 - Id: `connectors/firebase-messaging`
 - Keywords: `cli`, `connectors`, `fcm`, `files`, `firebase`, `integrations`, `jwt`, `notifications`, `push`, `service-account`, `vapid`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/firebase-messaging/PATTERN.md)
 - Examples: [example/](patterns/connectors/firebase-messaging/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -180,7 +180,7 @@ Compose reviewed Search campaigns with project-owned Google OAuth and portable s
 
 - Id: `connectors/google-ads-search`
 - Keywords: `ads`, `campaigns`, `cli`, `connectors`, `conversion`, `google`, `search`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/google-ads-search/PATTERN.md)
 - Examples: [example/](patterns/connectors/google-ads-search/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -191,7 +191,7 @@ Compose provider consent, verification and encrypted file persistence from an ap
 
 - Id: `connectors/oauth-connection`
 - Keywords: `accounting`, `assistant permissions`, `books`, `cli`, `client credentials`, `connectors`, `consent`, `crm`, `databricks`, `developer token`, `fabric`, `files`, `gaql`, `google ads`, `graphql`, `integrations`, `linkedin`, `microsoft`, `oauth`, `powerpoint`, `salesforce`, `service principal`, `shopify`, `soql`, `staffing`, `tiktok`, `twitch`, `wave`, `word`, `wordpress`, `workday`, `xero`, `zoho`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/oauth-connection/PATTERN.md)
 - Examples: [example/](patterns/connectors/oauth-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -202,7 +202,7 @@ Compose a sequential catalogue batch and preserve partial success for applicatio
 
 - Id: `connectors/paddle-catalogue`
 - Keywords: `batch`, `paddle`, `payments`, `prices`, `products`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/paddle-catalogue/PATTERN.md)
 - Examples: [example/](patterns/connectors/paddle-catalogue/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -213,7 +213,7 @@ Resolve a publishable image key deliberately and use the shared URL library in a
 
 - Id: `connectors/public-image`
 - Keywords: `cli`, `connectors`, `files`, `images`, `integrations`, `logo-dev`, `public-key`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/public-image/PATTERN.md)
 - Examples: [example/](patterns/connectors/public-image/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -224,7 +224,7 @@ Compose file configuration, Redshift Data API operations and application query o
 
 - Id: `connectors/redshift-queries`
 - Keywords: `aws`, `cli`, `connectors`, `files`, `iam`, `provisioned`, `redshift`, `serverless`, `sql`, `warehouse`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/redshift-queries/PATTERN.md)
 - Examples: [example/](patterns/connectors/redshift-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -235,7 +235,7 @@ Use the shared scanner runtime from a CLI or a host worker with portable configu
 
 - Id: `connectors/source-scanning`
 - Keywords: `cancellation`, `cli`, `connectors`, `integrations`, `scanning`, `security`, `source`, `wiz`, `worker`
-- Owner: `@jskit-ai/connectors-catalog@0.2.21`
+- Owner: `@jskit-ai/connectors-catalog@0.2.23`
 - Read: [PATTERN.md](patterns/connectors/source-scanning/PATTERN.md)
 - Examples: [example/](patterns/connectors/source-scanning/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -246,7 +246,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.248`
+- Owner: `@jskit-ai/console-web@0.1.250`
 - Read: [PATTERN.md](patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -257,7 +257,7 @@ Define an application table resource whose records belong to the current user, a
 
 - Id: `crud/crud-contract`
 - Keywords: `authenticated`, `crud`, `database`, `owner-scoped`, `resource`, `table`, `user`
-- Owner: `@jskit-ai/resource-crud-core@0.1.208`
+- Owner: `@jskit-ai/resource-crud-core@0.1.209`
 - Read: [PATTERN.md](patterns/crud/crud-contract/PATTERN.md)
 - Examples: [example/](patterns/crud/crud-contract/example/)
 - Requires: `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -268,7 +268,7 @@ Build a complete application-owned CRUD server package from a migration, a table
 
 - Id: `crud/crud-feature-package`
 - Keywords: `actions`, `crud`, `database`, `defineCrudFeature`, `json-api`, `migration`, `owns`, `permissions`, `repository`, `routes`, `service`, `table resource`
-- Owner: `@jskit-ai/crud-core@0.2.21`
+- Owner: `@jskit-ai/crud-core@0.2.23`
 - Read: [PATTERN.md](patterns/crud/crud-feature-package/PATTERN.md)
 - Examples: [example/](patterns/crud/crud-feature-package/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -279,7 +279,7 @@ Build a routed CRUD user interface as thin application pages over JSKIT's shared
 
 - Id: `crud/crud-screen-set`
 - Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.2.26`
+- Owner: `@jskit-ai/http-web@0.2.27`
 - Read: [PATTERN.md](patterns/crud/crud-screen-set/PATTERN.md)
 - Examples: [example/](patterns/crud/crud-screen-set/example/)
 - Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-core`, `@jskit-ai/resource-crud-core`
@@ -290,7 +290,7 @@ Configure a JSKIT application for MySQL with a fixed driver, ordinary environmen
 
 - Id: `database/mysql-application`
 - Keywords: `database`, `knex`, `mariadb`, `migrations`, `mysql`, `mysql2`
-- Owner: `@jskit-ai/database-runtime-mysql@0.1.264`
+- Owner: `@jskit-ai/database-runtime-mysql@0.1.265`
 - Read: [PATTERN.md](patterns/database/mysql-application/PATTERN.md)
 - Examples: [example/](patterns/database/mysql-application/example/)
 - Requires: `@jskit-ai/database-runtime-mysql`
@@ -301,7 +301,7 @@ Configure a JSKIT application for PostgreSQL with a fixed driver, ordinary envir
 
 - Id: `database/postgres-application`
 - Keywords: `database`, `knex`, `migrations`, `pg`, `postgres`, `postgresql`
-- Owner: `@jskit-ai/database-runtime-postgres@0.1.263`
+- Owner: `@jskit-ai/database-runtime-postgres@0.1.264`
 - Read: [PATTERN.md](patterns/database/postgres-application/PATTERN.md)
 - Examples: [example/](patterns/database/postgres-application/example/)
 - Requires: `@jskit-ai/database-runtime-postgres`
@@ -312,7 +312,7 @@ Describe one database table once (its fields, columns, ownership, search and sor
 
 - Id: `database/table-resource`
 - Keywords: `database`, `defaultTo`, `defineTableResource`, `lockVersionField`, `lookup`, `ownership`, `owns`, `resource`, `system`, `table`, `workspace_or_shared`
-- Owner: `@jskit-ai/resource-core@0.1.208`
+- Owner: `@jskit-ai/resource-core@0.1.209`
 - Read: [PATTERN.md](patterns/database/table-resource/PATTERN.md)
 - Examples: [example/](patterns/database/table-resource/example/)
 - Requires: `@jskit-ai/resource-core`
@@ -323,7 +323,7 @@ Wrap a JSKIT web application in a Capacitor Android shell using native Capacitor
 
 - Id: `mobile/android-application`
 - Keywords: `android`, `capacitor`, `device`, `mobile`, `native`, `shell`, `webview`
-- Owner: `@jskit-ai/mobile-capacitor@0.2.21`
+- Owner: `@jskit-ai/mobile-capacitor@0.2.22`
 - Read: [PATTERN.md](patterns/mobile/android-application/PATTERN.md)
 - Examples: [example/](patterns/mobile/android-application/example/)
 - Requires: `@capacitor/android`, `@capacitor/app`, `@capacitor/cli`, `@jskit-ai/mobile-capacitor`
@@ -334,7 +334,7 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.2.24`
+- Owner: `@jskit-ai/realtime@0.2.25`
 - Read: [PATTERN.md](patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
@@ -345,7 +345,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.2.26`
+- Owner: `@jskit-ai/rewarded-web@0.2.28`
 - Read: [PATTERN.md](patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -356,7 +356,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `aggregate`, `feature`, `handle`, `orchestration`, `owns`, `package`, `provider`, `repository`, `routes`, `server`, `table resource`
-- Owner: `@jskit-ai/agent-docs@0.1.291`
+- Owner: `@jskit-ai/agent-docs@0.1.293`
 - Read: [PATTERN.md](patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -367,7 +367,7 @@ Compose the JSKIT responsive shell, semantic placements, settings navigation, an
 
 - Id: `shell/application-shell`
 - Keywords: `adaptive`, `app`, `layout`, `navigation`, `placement`, `responsive`, `settings`, `shell`
-- Owner: `@jskit-ai/shell-web@0.2.21`
+- Owner: `@jskit-ai/shell-web@0.2.22`
 - Read: [PATTERN.md](patterns/shell/application-shell/PATTERN.md)
 - Examples: [example/](patterns/shell/application-shell/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -378,7 +378,7 @@ Add product routes and shell extensions through file routing, semantic placement
 
 - Id: `ui/page-and-placement`
 - Keywords: `component`, `navigation`, `outlet`, `page`, `placement`, `routes`, `section`, `shell`, `subpages`, `vue`
-- Owner: `@jskit-ai/shell-web@0.2.21`
+- Owner: `@jskit-ai/shell-web@0.2.22`
 - Read: [PATTERN.md](patterns/ui/page-and-placement/PATTERN.md)
 - Examples: [example/](patterns/ui/page-and-placement/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -389,7 +389,7 @@ Compose an account settings route and profile, preference, notification, and sig
 
 - Id: `users/account-settings`
 - Keywords: `account`, `link provider`, `notifications`, `oauth`, `preferences`, `profile`, `settings`, `sign-in methods`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.2.31`
+- Owner: `@jskit-ai/users-web@0.2.33`
 - Read: [PATTERN.md](patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -400,7 +400,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.2.22`
+- Owner: `@jskit-ai/users-core@0.2.24`
 - Read: [PATTERN.md](patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -411,7 +411,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.2.22`
+- Owner: `@jskit-ai/workspaces-core@0.2.24`
 - Read: [PATTERN.md](patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -422,7 +422,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.2.31`
+- Owner: `@jskit-ai/workspaces-web@0.2.33`
 - Read: [PATTERN.md](patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/skills/jskit/references/patterns/app/minimal-foundation/example/AGENTS.md

@@ -74,7 +74,11 @@ Selection fields never show a stored id as text. A select, autocomplete or
 combobox whose options load from the server, or whose value is a record id,
 uses `SelectField` from `@jskit-ai/http-web/client/components/SelectField` with
 `loading` while the options load, not a raw `v-select`, `v-autocomplete` or
-`v-combobox`.
+`v-combobox`. The lint rule `jskit/selection-field` reports a raw one whose
+items are not fixed (a list written out, a top-level `const` holding one, or an
+import from a `shared` module) and a `SelectField` over loaded items without
+`loading`; a justified case says why in
+`<!-- readable-check: allow selection-field - data: <reason> -->` above it.
 
 Copied pattern source is ordinary application source. Do not add generator
 provenance, receipts, completion ledgers, or tooling-operation history. Keep

package/skills/jskit/references/patterns/app/minimal-foundation/example/package.json

@@ -34,23 +34,23 @@
   "dependencies": {
     "@local/main": "0.1.0",
     "@fastify/static": "^10.1.3",
-    "@jskit-ai/kernel": "0.2.17",
+    "@jskit-ai/kernel": "0.2.18",
     "@jskit-ai/material-web": "0.1.5",
     "@tanstack/vue-query": "^5.101.0",
     "fastify": "^5.12.7",
     "pino": "^10.3.1",
-    "json-rest-schema": "^1.0.17",
+    "json-rest-schema": "^1.0.20",
     "pinia": "^4.0.3",
     "vue": "^3.5.44",
     "vue-router": "^5.3.1",
     "vuetify": "^4.3.0",
-    "@jskit-ai/http-runtime": "0.2.17",
+    "@jskit-ai/http-runtime": "0.2.18",
     "@fastify/fast-json-stringify-compiler": "^5.1.0",
     "@vue/devtools-api": "^8.2.1"
   },
   "devDependencies": {
-    "@jskit-ai/config-eslint": "0.1.248",
-    "@jskit-ai/jskit-catalog": "0.2.43",
+    "@jskit-ai/config-eslint": "0.1.249",
+    "@jskit-ai/jskit-catalog": "0.2.45",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/skills/jskit/references/patterns/app/shell-foundation/example/AGENTS.md

@@ -74,7 +74,11 @@ Selection fields never show a stored id as text. A select, autocomplete or
 combobox whose options load from the server, or whose value is a record id,
 uses `SelectField` from `@jskit-ai/http-web/client/components/SelectField` with
 `loading` while the options load, not a raw `v-select`, `v-autocomplete` or
-`v-combobox`.
+`v-combobox`. The lint rule `jskit/selection-field` reports a raw one whose
+items are not fixed (a list written out, a top-level `const` holding one, or an
+import from a `shared` module) and a `SelectField` over loaded items without
+`loading`; a justified case says why in
+`<!-- readable-check: allow selection-field - data: <reason> -->` above it.
 
 Copied pattern source is ordinary application source. Do not add generator
 provenance, receipts, completion ledgers, or tooling-operation history. Keep