@owlmeans/client-planning 0.1.18-rc.36 → 0.1.18-rc.37

package/README.md

@@ -9,7 +9,7 @@ planning service runs in-process.
 ## Installation
 
 ```bash
-bun add @owlmeans/client-planning@^0.1.18-rc.36
+bun add @owlmeans/client-planning@^0.1.18-rc.37
 ```
 
 ## Concepts
@@ -202,7 +202,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.56
+npx @owlmeans/agent-skills@^0.1.18-rc.57
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
-  "schemaVersion": 2,
+  "schemaVersion": 3,
   "package": "@owlmeans/client-planning",
-  "version": "0.1.18-rc.36",
-  "generatedAt": "2026-10-20T10:14:53.871Z",
+  "version": "0.1.18-rc.37",
+  "generatedAt": "2026-10-20T23:19:58.628Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {
@@ -10,7 +10,65 @@
       "name": "client-planning",
       "category": "package-specific",
       "file": "skills/client-planning/SKILL.md",
-      "canonicalPath": ".agents/skills/client-planning/SKILL.md"
+      "canonicalPath": ".agents/skills/client-planning/SKILL.md",
+      "parts": [
+        {
+          "name": "aux-mirrors",
+          "file": "skills/client-planning/parts/aux-mirrors.md",
+          "description": "The assignee, team, comment and mention mirrors and resource feeds, and the authenticated scope lifecycle (scopeKey, close, lifecycle.run and lifecycle.mutate).",
+          "purposes": [
+            "state",
+            "auth"
+          ],
+          "mentions": [
+            "makePlanningResourceFeed",
+            "scopeKey",
+            "lifecycle.run",
+            "lifecycle.mutate",
+            "registerFeed",
+            "client:scope-changed",
+            "PlanningReply"
+          ]
+        },
+        {
+          "name": "mirror",
+          "file": "skills/client-planning/parts/mirror.md",
+          "description": "The state mirror's one id space and fold rules, makePlanningFeed, and optimistic writes with head over seq.",
+          "purposes": [
+            "state",
+            "list"
+          ],
+          "mentions": [
+            "appendPlanningStores",
+            "planningMirrorOf",
+            "applyCommitEvent",
+            "applyReceipt",
+            "applyCards",
+            "syncHelper",
+            "syncCards",
+            "syncLinks",
+            "makePlanningFeed",
+            "PlanningFeed",
+            "useStoreList"
+          ]
+        },
+        {
+          "name": "validation",
+          "file": "skills/client-planning/parts/validation.md",
+          "description": "CSP-safe browser validation of a served field schema with makePlanningFieldValidator — the supported keywords, refusals and limits, and the external references behind them.",
+          "purposes": [
+            "form"
+          ],
+          "mentions": [
+            "makePlanningFieldValidator",
+            "validateFields",
+            "@cfworker/json-schema",
+            "JSON_SCHEMA_DRAFT_07",
+            "unsafe-eval",
+            "SchemaInvalid"
+          ]
+        }
+      ]
     }
   ]
 }

package/agent-meta/skills/client-planning/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/client-planning
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-planning": "^0.1.18-rc.36"` in `dependencies`
+**Install:** `"@owlmeans/client-planning": "^0.1.18-rc.37"` in `dependencies`
 
 The client half of OwlMeans planning. It answers the `PlanningFacade` interface of
 `@owlmeans/planning` over the protocol tree a server mounted with `@owlmeans/server-planning`, keeps
@@ -88,42 +88,9 @@ whole cache — an organization-wide write reaches every project's layer — and
 `model(card)` of a card resolves its type in its project's layer (a project's own id, a card's
 nearest primary project ancestor); a specification's type is always code's. A tree without `definitions` has none of this.
 
-## Browser field validation under CSP
-
-Bind `makePlanningFieldValidator(type.fields)` to the exact definition returned by the resolved
-organization or project bundle. Its `validateFields(fields)` returns `{ valid, errors }`; errors
-carry decoded `path`, `keyword`, `schemaPath` and a bounded value-free `message`. Construct one JSON
-fields object, validate it and send that same object. No coercion, defaults or property removal
-occurs, and the schema is left unchanged. Preserve nested money objects and calendar date strings.
-The native server validates every write again.
-
-The validator interprets schemas with `@cfworker/json-schema`, with no `eval`, `new Function` or
-network reference loading. Do not call `makeSchemaRegistry(...).validator()` or
-`.assigneeValidator()` in a browser with strict `script-src`: those remain native AJV compilers.
-The Draft 7 JSON import carries `with { type: 'json' }` so Node ESM consumers can load the validator.
-Static AJV standalone compilation is suitable only when the schema cannot change after building;
-organization and project definitions require the runtime interpreter.
-
-The supported contract is Draft 7's object/array/scalar, required, enum/const, ranges, string
-length/pattern, dependencies, boolean, composition and conditional keywords; `$defs`, local/nested
-`$id` references and AJV's `nullable` are also supported. `$ref` sibling constraints are enforced as
-by native planning AJV. String formats use the same `ajv-formats` full-mode predicates, including
-real calendar dates and timezone-aware times. `nullable` adds null to the declared type while
-leaving enum and const constraints intact. All references must resolve inside the supplied field
-schema; productive recursive schemas are supported, same-instance reference cycles are refused.
-Plain JSON values and field names without dot or dollar characters are required.
-
-Preparation throws `SchemaInvalid` for malformed schemas, unresolved references, unsupported
-drafts/keywords/formats, numeric formats, `formatMinimum`/`formatMaximum` extensions and
-`multipleOf`. The latter is refused because the interpreter's epsilon and native AJV's quotient
-semantics disagree for fractional and very large numbers. Standard annotation keywords and `x-`
-annotations do not add validation. Never discard a refused constraint, invent a substitute schema,
-enable `unsafe-eval` or proceed with a ready form after preparation fails. Show the error and retain
-disabled save controls. Validation reports at most 64 errors, with paths bounded to 512 characters.
-
 ## Mounting in a target
 
-The web half of the target mount (`planning` → Mounting in a target).
+The web half of the target mount (`planning` → Mounting in a target, in that skill's `mounting` part).
 
 - `appendPlanningClient(context, { protocols, bind: false, schemas: false })` — the target binds
   its whole api tree itself, and a signed-out visitor may read nothing, so the bundle loads on
@@ -157,55 +124,6 @@ drill.available().map(rule => rule.name)
   project-wide read answers `PlanningUnsupported` on a client.
 - `size: 0` is "no limit"; a paged server answers 100 rows when no size is asked for.
 
-## The mirror — one id space
-
-`appendPlanningStores` registers ONE card store for every kind. Projects, cards and specifications
-share an id space on the server, so they share one store here: a store per kind lets a card list
-that reloads drop the projects beside it.
-
-That is also why a list reaches the store through **`syncHelper.syncCards(store, items, where)`,
-never `replace()`**: every card given is written, every card matching `where` that the list does not
-name is dropped, and everything outside `where` is left alone. An unchanged card is not rewritten, so a
-periodic re-seed wakes no subscriber. `opts.keep` protects ids a commit wrote while the list was in
-flight.
-
-The fold rules, shared by `syncHelper.syncCards`, the mirror's `applyCards` and `applyCommitEvent`, and
-`commits.wait`:
-
-- an OLDER `seq` never overwrites a newer record — frames and list answers race;
-- a committed `delete` removes the row and every link touching it; a project's delete also drops
-  the rows whose `parents` hold it (the server purged them in the same fold);
-- a frame for an id the store never saw still writes a row;
-- a `failed` commit leaves the card alone and records the reason in the commit store;
-- a frame without `record` (a cross-process bus carries ids only) is re-read through the facade —
-  without one, only the commit row is written;
-- a committed `link`/`unlink` re-lists the card's outgoing links; links written together with a
-  `create` arrive with the next link seed.
-
-## The feed
-
-```typescript
-const feed = makePlanningFeed(context, {
-  query: { parent: shedId, type: 'shed:tool' },
-  filter: { project: shedId },
-  refresh: 15_000,
-  onChange: state => setState(state),
-})
-await feed.ready          // never rejects — read feed.error
-// …
-await feed.stop()         // stops folding; the shared socket stays open
-```
-
-1. Subscribes to commits FIRST (the socket, when an opener exists).
-2. Seeds: `cards.list` (unpaged unless the query pages) → `syncHelper.syncCards` over `where`
-   (`queryHelper.criteriaOf(query)` by default). A PAGED seed only writes — a page cannot say what
-   does not exist.
-3. Folds every frame with `planningMirrorOf(stores).applyCommitEvent`, and re-seeds every `refresh`
-   ms — the authoritative backstop to a socket that can drop frames.
-
-`connected` reports whether a socket was open when the feed subscribed; `seeded` tells "nothing
-there" from "not loaded yet". A React hook wraps the feed in an effect and stops it on unmount.
-
 ## Waiting for a commit
 
 `execute()` is asynchronous: the receipt names a PENDING transition until the store folds it.
@@ -241,14 +159,6 @@ service; releasing a subscription never closes it — `context.planning().close(
 
 A Node client passes no opener and relies on the long poll.
 
-## Optimistic writes and `head > seq`
-
-`seq` is the last transition folded into a card, `head` the highest allocated. The mirror's
-`applyReceipt` (run by `execute` whenever stores are registered) raises the stored card's `head` to
-the new transition's `seq`, so `model.pending()` is true before any frame arrives; the commit's fold
-brings `seq` up to it. The mirror only ever grows `head`, so a list fetched before the append does not
-clear the marker. A model's `expectSeq` default and its `WorkcardConflict` are `planning` → Models.
-
 ## Gotchas
 
 - Mount a feed once per screen; read the store everywhere else.
@@ -262,58 +172,6 @@ clear the marker. A model's `expectSeq` default and its `WorkcardConflict` are `
 - `@owlmeans/client-entrypoint` — `bindAll`, the typed `call()`
 - `@owlmeans/state` — the mirror; `@owlmeans/socket` — `Connection`
 
-## Auxiliary mirrors and authenticated scope lifecycle
-
-With `resources: true` in the shared protocol tree, every remote facade exposes the complete
-assignee/team/comment/mention API, including versioned writes, team membership and project
-attachment. `appendPlanningStores` registers separate stock typed mirrors for all four resources.
-`makePlanningResourceFeed` seeds and polls selected resource queries; use it with the stock stores
-and `useStoreList` / `useStoreModel`. Auxiliary writes update the mirror only after success.
-An active-assignee query (`retired: false`) includes an absent or null retirement flag. Local
-mirror queries and feed reconciliation use `{ retired: { $ne: true } }`, matching the native
-facade rather than strict equality to false. A filtered poll removes only its unchanged matching
-snapshot rows, preserving unrelated retired identities needed by existing references.
-Comments use trusted server authors; mentions are read-only derived cache commands.
-
-Supply `PlanningClientOptions.scopeKey` from authenticated organization entity slug, profile/user
-id, session id and authorization revision; return undefined when signed out. Before switching
-organization or signing out, **await** `service.close()` before adopting the credential. It cancels
-requests and commit waits, invalidates receipts (including already-settled receipts), stops every
-registered feed, removes socket subscriptions, closes the carrier and rejects late socket openers.
-A stale operation answers `client:scope-changed`; cancellation never rolls back an accepted server
-write. A new subscription opens a fresh carrier after close.
-
-Close drains admitted **local** mirror writes before clearing every stock store and schema cache.
-New calls during an explicit close are refused, including hosts without `scopeKey`. Concurrent
-closes share the boundary. If clearing fails, close rejects and fresh work stays blocked; retain
-the old credential and retry close explicitly. An observed identity change also cancels old work
-and queues clearing before the new identity's mirror writes. Reload schemas and create fresh feeds
-after credential adoption. Feed query scope alone is insufficient for this lifecycle.
-
-The service's `lifecycle` coordinates stock facades, receipts, feeds and schema writes. A custom
-mirror integration captures an operation with `lifecycle.run`, performs remote reads through
-`operation.wait` with `operation.signal`, then uses `lifecycle.mutate(operation, write)` for local
-writes; never hold or nest that queue over a request, socket opener or another queued mutation.
-`planningMirrorOf(stores)` accepts `{ lifecycle, operation }` as its optional last argument and
-fetches missing frame records/links before entering the queue. Direct mirror/sync helpers without
-that option are local primitives: their caller owns isolation and cleanup.
-
-Planning protocols return `PlanningReply<T>` without storage organization identifiers. Stock
-facades hydrate records, receipts, schema scopes and socket frames with `entityId: ''` only to
-preserve the shared facade shape. That value is an advisory placeholder, never an organization
-identity or a credential. Use `scopeKey` and the authenticated organization entity slug for
-identity changes and access isolation; native server records keep their verified stable scope.
-
-Resource feed reconciliation snapshots mirror versions before requesting a list. Only unchanged
-snapshot rows absent from that response are removed, so a new local write or a newer version
-survives an older in-flight poll. Stopped feeds cannot publish. Track custom feeds through
-`registerFeed` when their lifecycle must end with the planning service. Card feeds use the same
-identity fence and stop registration; component cleanup awaits `stop()` when it must observe a
-completed boundary. Stop cancels unresolved seeds and drains admitted local changes without waiting
-for the network; neither late callbacks nor authoritative deletion passes may publish afterward.
-A schema write from an old generation cannot invalidate a newer generation's cached registry.
-
-
 ## Related
 
 - `planning` — records, flows, the fold, the models
@@ -321,9 +179,12 @@ A schema write from an old generation cannot invalidate a newer generation's cac
 - `client-job` — the same seed-then-fold shape for safe application-job views
 - `state` — `syncHelper.syncCards` is built on its criteria engine and `purge`
 
-## External docs
+## Parts
+
+Load a part on top of this core when its job is in play.
 
-- https://ajv.js.org/security.html#content-security-policy — runtime AJV requires unsafe-eval; standalone build compilation preserves strict CSP for static schemas.
-- https://www.npmjs.com/package/@cfworker/json-schema/v/4.1.1 — the interpreter supports dynamic schemas without code generation; select an explicit vocabulary and check its known limitations (4.1.1).
-- https://github.com/ajv-validator/ajv-formats#full-and-fast-validation-modes — full-mode predicates validate formats completely and are reusable through the plugin's `get` API (3.0.1).
-- https://ajv.js.org/json-schema.html#nullable-openapi — nullable expands the declared type without adding null to enum or const.
+| Part | Load it when |
+|---|---|
+| [validation](parts/validation.md) | Validating planning `fields` in a browser form under a strict CSP (`makePlanningFieldValidator`) |
+| [mirror](parts/mirror.md) | Reading lists from the state mirror (`syncHelper`, `planningMirrorOf`), mounting `makePlanningFeed`, or relying on `head > seq` |
+| [aux-mirrors](parts/aux-mirrors.md) | Assignee, team, comment or mention mirrors and feeds, or switching organization / signing out (`scopeKey`, `close()`) |

package/agent-meta/skills/client-planning/parts/aux-mirrors.md

@@ -0,0 +1,61 @@
+---
+name: aux-mirrors
+description: The assignee, team, comment and mention mirrors and resource feeds, and the authenticated scope lifecycle (scopeKey, close, lifecycle.run and lifecycle.mutate).
+metadata:
+  purposes: state, auth
+  mentions: makePlanningResourceFeed, scopeKey, lifecycle.run, lifecycle.mutate, registerFeed, client:scope-changed, PlanningReply
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/client-planning — Auxiliary mirrors and the scope lifecycle
+
+## Auxiliary mirrors and authenticated scope lifecycle
+
+With `resources: true` in the shared protocol tree, every remote facade exposes the complete
+assignee/team/comment/mention API, including versioned writes, team membership and project
+attachment. `appendPlanningStores` registers separate stock typed mirrors for all four resources.
+`makePlanningResourceFeed` seeds and polls selected resource queries; use it with the stock stores
+and `useStoreList` / `useStoreModel`. Auxiliary writes update the mirror only after success.
+An active-assignee query (`retired: false`) includes an absent or null retirement flag. Local
+mirror queries and feed reconciliation use `{ retired: { $ne: true } }`, matching the native
+facade rather than strict equality to false. A filtered poll removes only its unchanged matching
+snapshot rows, preserving unrelated retired identities needed by existing references.
+Comments use trusted server authors; mentions are read-only derived cache commands.
+
+Supply `PlanningClientOptions.scopeKey` from authenticated organization entity slug, profile/user
+id, session id and authorization revision; return undefined when signed out. Before switching
+organization or signing out, **await** `service.close()` before adopting the credential. It cancels
+requests and commit waits, invalidates receipts (including already-settled receipts), stops every
+registered feed, removes socket subscriptions, closes the carrier and rejects late socket openers.
+A stale operation answers `client:scope-changed`; cancellation never rolls back an accepted server
+write. A new subscription opens a fresh carrier after close.
+
+Close drains admitted **local** mirror writes before clearing every stock store and schema cache.
+New calls during an explicit close are refused, including hosts without `scopeKey`. Concurrent
+closes share the boundary. If clearing fails, close rejects and fresh work stays blocked; retain
+the old credential and retry close explicitly. An observed identity change also cancels old work
+and queues clearing before the new identity's mirror writes. Reload schemas and create fresh feeds
+after credential adoption. Feed query scope alone is insufficient for this lifecycle.
+
+The service's `lifecycle` coordinates stock facades, receipts, feeds and schema writes. A custom
+mirror integration captures an operation with `lifecycle.run`, performs remote reads through
+`operation.wait` with `operation.signal`, then uses `lifecycle.mutate(operation, write)` for local
+writes; never hold or nest that queue over a request, socket opener or another queued mutation.
+`planningMirrorOf(stores)` accepts `{ lifecycle, operation }` as its optional last argument and
+fetches missing frame records/links before entering the queue. Direct mirror/sync helpers without
+that option are local primitives: their caller owns isolation and cleanup.
+
+Planning protocols return `PlanningReply<T>` without storage organization identifiers. Stock
+facades hydrate records, receipts, schema scopes and socket frames with `entityId: ''` only to
+preserve the shared facade shape. That value is an advisory placeholder, never an organization
+identity or a credential. Use `scopeKey` and the authenticated organization entity slug for
+identity changes and access isolation; native server records keep their verified stable scope.
+
+Resource feed reconciliation snapshots mirror versions before requesting a list. Only unchanged
+snapshot rows absent from that response are removed, so a new local write or a newer version
+survives an older in-flight poll. Stopped feeds cannot publish. Track custom feeds through
+`registerFeed` when their lifecycle must end with the planning service. Card feeds use the same
+identity fence and stop registration; component cleanup awaits `stop()` when it must observe a
+completed boundary. Stop cancels unresolved seeds and drains admitted local changes without waiting
+for the network; neither late callbacks nor authoritative deletion passes may publish afterward.
+A schema write from an old generation cannot invalidate a newer generation's cached registry.

package/agent-meta/skills/client-planning/parts/mirror.md

@@ -0,0 +1,67 @@
+---
+name: mirror
+description: The state mirror's one id space and fold rules, makePlanningFeed, and optimistic writes with head over seq.
+metadata:
+  purposes: state, list
+  mentions: appendPlanningStores, planningMirrorOf, applyCommitEvent, applyReceipt, applyCards, syncHelper, syncCards, syncLinks, makePlanningFeed, PlanningFeed, useStoreList
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/client-planning — The mirror and the feed
+
+## The mirror — one id space
+
+`appendPlanningStores` registers ONE card store for every kind. Projects, cards and specifications
+share an id space on the server, so they share one store here: a store per kind lets a card list
+that reloads drop the projects beside it.
+
+That is also why a list reaches the store through **`syncHelper.syncCards(store, items, where)`,
+never `replace()`**: every card given is written, every card matching `where` that the list does not
+name is dropped, and everything outside `where` is left alone. An unchanged card is not rewritten, so a
+periodic re-seed wakes no subscriber. `opts.keep` protects ids a commit wrote while the list was in
+flight.
+
+The fold rules, shared by `syncHelper.syncCards`, the mirror's `applyCards` and `applyCommitEvent`, and
+`commits.wait`:
+
+- an OLDER `seq` never overwrites a newer record — frames and list answers race;
+- a committed `delete` removes the row and every link touching it; a project's delete also drops
+  the rows whose `parents` hold it (the server purged them in the same fold);
+- a frame for an id the store never saw still writes a row;
+- a `failed` commit leaves the card alone and records the reason in the commit store;
+- a frame without `record` (a cross-process bus carries ids only) is re-read through the facade —
+  without one, only the commit row is written;
+- a committed `link`/`unlink` re-lists the card's outgoing links; links written together with a
+  `create` arrive with the next link seed.
+
+## The feed
+
+```typescript
+const feed = makePlanningFeed(context, {
+  query: { parent: shedId, type: 'shed:tool' },
+  filter: { project: shedId },
+  refresh: 15_000,
+  onChange: state => setState(state),
+})
+await feed.ready          // never rejects — read feed.error
+// …
+await feed.stop()         // stops folding; the shared socket stays open
+```
+
+1. Subscribes to commits FIRST (the socket, when an opener exists).
+2. Seeds: `cards.list` (unpaged unless the query pages) → `syncHelper.syncCards` over `where`
+   (`queryHelper.criteriaOf(query)` by default). A PAGED seed only writes — a page cannot say what
+   does not exist.
+3. Folds every frame with `planningMirrorOf(stores).applyCommitEvent`, and re-seeds every `refresh`
+   ms — the authoritative backstop to a socket that can drop frames.
+
+`connected` reports whether a socket was open when the feed subscribed; `seeded` tells "nothing
+there" from "not loaded yet". A React hook wraps the feed in an effect and stops it on unmount.
+
+## Optimistic writes and `head > seq`
+
+`seq` is the last transition folded into a card, `head` the highest allocated. The mirror's
+`applyReceipt` (run by `execute` whenever stores are registered) raises the stored card's `head` to
+the new transition's `seq`, so `model.pending()` is true before any frame arrives; the commit's fold
+brings `seq` up to it. The mirror only ever grows `head`, so a list fetched before the append does not
+clear the marker. A model's `expectSeq` default and its `WorkcardConflict` are `planning` → Models.

package/agent-meta/skills/client-planning/parts/validation.md

@@ -0,0 +1,54 @@
+---
+name: validation
+description: CSP-safe browser validation of a served field schema with makePlanningFieldValidator — the supported keywords, refusals and limits, and the external references behind them.
+metadata:
+  purposes: form
+  mentions: makePlanningFieldValidator, validateFields, @cfworker/json-schema, JSON_SCHEMA_DRAFT_07, unsafe-eval, SchemaInvalid
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/client-planning — Browser field validation
+
+## Browser field validation under CSP
+
+Bind `makePlanningFieldValidator(type.fields)` to the exact definition returned by the resolved
+organization or project bundle. Its `validateFields(fields)` returns `{ valid, errors }`; errors
+carry decoded `path`, `keyword`, `schemaPath` and a bounded value-free `message`. Construct one JSON
+fields object, validate it and send that same object. No coercion, defaults or property removal
+occurs, and the schema is left unchanged. Preserve nested money objects and calendar date strings.
+The native server validates every write again.
+
+The validator interprets schemas with `@cfworker/json-schema`, with no `eval`, `new Function` or
+network reference loading. Do not call `makeSchemaRegistry(...).validator()` or
+`.assigneeValidator()` in a browser with strict `script-src`: those remain native AJV compilers.
+The Draft 7 meta-schema is DATA in `src/validation/consts.ts` (`JSON_SCHEMA_DRAFT_07`, pinned to ajv's
+`refs/json-schema-draft-07.json` by `tests/draft7.spec.ts`), never an import of that file: Node ESM needs
+`with { type: 'json' }` on it, and a bundler that also meets ajv's own attribute-less `require` of the
+same file refuses the pair (Rollup: "import attributes for the same module are always consistent"),
+which fails every target web build that mounts the planning client.
+Static AJV standalone compilation is suitable only when the schema cannot change after building;
+organization and project definitions require the runtime interpreter.
+
+The supported contract is Draft 7's object/array/scalar, required, enum/const, ranges, string
+length/pattern, dependencies, boolean, composition and conditional keywords; `$defs`, local/nested
+`$id` references and AJV's `nullable` are also supported. `$ref` sibling constraints are enforced as
+by native planning AJV. String formats use the same `ajv-formats` full-mode predicates, including
+real calendar dates and timezone-aware times. `nullable` adds null to the declared type while
+leaving enum and const constraints intact. All references must resolve inside the supplied field
+schema; productive recursive schemas are supported, same-instance reference cycles are refused.
+Plain JSON values and field names without dot or dollar characters are required.
+
+Preparation throws `SchemaInvalid` for malformed schemas, unresolved references, unsupported
+drafts/keywords/formats, numeric formats, `formatMinimum`/`formatMaximum` extensions and
+`multipleOf`. The latter is refused because the interpreter's epsilon and native AJV's quotient
+semantics disagree for fractional and very large numbers. Standard annotation keywords and `x-`
+annotations do not add validation. Never discard a refused constraint, invent a substitute schema,
+enable `unsafe-eval` or proceed with a ready form after preparation fails. Show the error and retain
+disabled save controls. Validation reports at most 64 errors, with paths bounded to 512 characters.
+
+## External docs
+
+- https://ajv.js.org/security.html#content-security-policy — runtime AJV requires unsafe-eval; standalone build compilation preserves strict CSP for static schemas.
+- https://www.npmjs.com/package/@cfworker/json-schema/v/4.1.1 — the interpreter supports dynamic schemas without code generation; select an explicit vocabulary and check its known limitations (4.1.1).
+- https://github.com/ajv-validator/ajv-formats#full-and-fast-validation-modes — full-mode predicates validate formats completely and are reusable through the plugin's `get` API (3.0.1).
+- https://ajv.js.org/json-schema.html#nullable-openapi — nullable expands the declared type without adding null to enum or const.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/client-planning",
-  "version": "0.1.18-rc.36",
+  "version": "0.1.18-rc.37",
   "license": "MIT",
   "description": "The client half of OwlMeans planning — the remote planning facade, the state mirror and its commit fold, and the subscribe-then-poll commit wait. React-free: it runs in a browser and in a Node client alike.",
   "type": "module",
@@ -24,18 +24,18 @@
   },
   "dependencies": {
     "@cfworker/json-schema": "^4.1.1",
-    "@owlmeans/auth": "^0.1.18-rc.41",
-    "@owlmeans/client-context": "^0.1.18-rc.52",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.51",
-    "@owlmeans/context": "^0.1.18-rc.34",
-    "@owlmeans/entrypoint": "^0.1.18-rc.41",
-    "@owlmeans/error": "^0.1.18-rc.38",
-    "@owlmeans/planning": "^0.1.18-rc.28",
-    "@owlmeans/resource": "^0.1.18-rc.40",
-    "@owlmeans/log": "^0.1.18-rc.3",
-    "@owlmeans/route": "^0.1.18-rc.35",
-    "@owlmeans/socket": "^0.1.18-rc.44",
-    "@owlmeans/state": "^0.1.18-rc.39"
+    "@owlmeans/auth": "^0.1.18-rc.42",
+    "@owlmeans/client-context": "^0.1.18-rc.53",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.52",
+    "@owlmeans/context": "^0.1.18-rc.35",
+    "@owlmeans/entrypoint": "^0.1.18-rc.42",
+    "@owlmeans/error": "^0.1.18-rc.39",
+    "@owlmeans/planning": "^0.1.18-rc.29",
+    "@owlmeans/resource": "^0.1.18-rc.41",
+    "@owlmeans/log": "^0.1.18-rc.4",
+    "@owlmeans/route": "^0.1.18-rc.36",
+    "@owlmeans/socket": "^0.1.18-rc.45",
+    "@owlmeans/state": "^0.1.18-rc.40"
   },
   "peerDependencies": {
     "ajv": "*",
@@ -43,8 +43,8 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/server-planning": "^0.1.18-rc.34",
-    "@owlmeans/test": "^0.1.18-rc.37",
+    "@owlmeans/server-planning": "^0.1.18-rc.35",
+    "@owlmeans/test": "^0.1.18-rc.38",
     "@types/bun": "^1.4.2",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",