@owlmeans/client-planning 0.1.18-rc.36 → 0.1.18-rc.38

package/README.md

@@ -9,7 +9,7 @@ planning service runs in-process.
 ## Installation
 
 ```bash
-bun add @owlmeans/client-planning@^0.1.18-rc.36
+bun add @owlmeans/client-planning@^0.1.18-rc.38
 ```
 
 ## Concepts
@@ -202,7 +202,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.56
+npx @owlmeans/agent-skills@^0.1.18-rc.57
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
-  "schemaVersion": 2,
+  "schemaVersion": 3,
   "package": "@owlmeans/client-planning",
-  "version": "0.1.18-rc.36",
-  "generatedAt": "2026-10-20T10:14:53.871Z",
+  "version": "0.1.18-rc.38",
+  "generatedAt": "2026-10-24T21:07:16.901Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {
@@ -10,7 +10,65 @@
       "name": "client-planning",
       "category": "package-specific",
       "file": "skills/client-planning/SKILL.md",
-      "canonicalPath": ".agents/skills/client-planning/SKILL.md"
+      "canonicalPath": ".agents/skills/client-planning/SKILL.md",
+      "parts": [
+        {
+          "name": "aux-mirrors",
+          "file": "skills/client-planning/parts/aux-mirrors.md",
+          "description": "The assignee, team, comment and mention mirrors and resource feeds, and the authenticated scope lifecycle (scopeKey, close, lifecycle.run and lifecycle.mutate).",
+          "purposes": [
+            "state",
+            "auth"
+          ],
+          "mentions": [
+            "makePlanningResourceFeed",
+            "scopeKey",
+            "lifecycle.run",
+            "lifecycle.mutate",
+            "registerFeed",
+            "client:scope-changed",
+            "PlanningReply"
+          ]
+        },
+        {
+          "name": "mirror",
+          "file": "skills/client-planning/parts/mirror.md",
+          "description": "The state mirror's one id space and fold rules, makePlanningFeed, and optimistic writes with head over seq.",
+          "purposes": [
+            "state",
+            "list"
+          ],
+          "mentions": [
+            "appendPlanningStores",
+            "planningMirrorOf",
+            "applyCommitEvent",
+            "applyReceipt",
+            "applyCards",
+            "syncHelper",
+            "syncCards",
+            "syncLinks",
+            "makePlanningFeed",
+            "PlanningFeed",
+            "useStoreList"
+          ]
+        },
+        {
+          "name": "validation",
+          "file": "skills/client-planning/parts/validation.md",
+          "description": "CSP-safe browser validation of a served field schema with makePlanningFieldValidator — the supported keywords, refusals and limits, and the external references behind them.",
+          "purposes": [
+            "form"
+          ],
+          "mentions": [
+            "makePlanningFieldValidator",
+            "validateFields",
+            "@cfworker/json-schema",
+            "JSON_SCHEMA_DRAFT_07",
+            "unsafe-eval",
+            "SchemaInvalid"
+          ]
+        }
+      ]
     }
   ]
 }

package/agent-meta/skills/client-planning/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/client-planning
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-planning": "^0.1.18-rc.36"` in `dependencies`
+**Install:** `"@owlmeans/client-planning": "^0.1.18-rc.38"` in `dependencies`
 
 The client half of OwlMeans planning. It answers the `PlanningFacade` interface of
 `@owlmeans/planning` over the protocol tree a server mounted with `@owlmeans/server-planning`, keeps
@@ -65,14 +65,18 @@ appendPlanningStores(context)        // a browser mirror; a Node client usually
   from the credential. The execution's own `actor` is never sent.
 - A client runs no middleware and folds nothing: `store()`, `committed()` and a plugin carrying
   `before`/`after`/`store`/`mintCode` answer `PlanningUnsupported`. `use()` accepts a schemas-only
-  plugin, layered over the server's bundle.
+  plugin, layered over the server's bundle; its `schemas.app` merges over the served declarations
+  (`bundle.app`) in plugin order, and a malformed one is refused (`SchemaInvalid`) before anything
+  changes.
 - `timeout` (ms) bounds every call that is not a long poll; a long poll's deadline is its own hold
   plus `LONG_POLL_GRACE`.
 
 ### The schema bundle
 
 `model()` needs the flows and types (`can()`, `available()`, `statusOf()` read the registry with no
-round trip). The bundle is fetched in the background once the context is **Ready** and a failure
+round trip). The bundle also carries the application's declarations (`registry.app()`), so
+`registry.fieldsSchema(type)` / `validator(type)` include its base card fields and a definition's
+`app` bag reads back as written. The bundle is fetched in the background once the context is **Ready** and a failure
 there is swallowed — a browser that is not signed in yet cannot read it, and a context must never
 fail or wait over it. `model()` and `service.loadSchemas()` load it on first use regardless, and a
 failed load is retried by the next caller. `schemas: false` skips the background load.
@@ -88,42 +92,9 @@ whole cache — an organization-wide write reaches every project's layer — and
 `model(card)` of a card resolves its type in its project's layer (a project's own id, a card's
 nearest primary project ancestor); a specification's type is always code's. A tree without `definitions` has none of this.
 
-## Browser field validation under CSP
-
-Bind `makePlanningFieldValidator(type.fields)` to the exact definition returned by the resolved
-organization or project bundle. Its `validateFields(fields)` returns `{ valid, errors }`; errors
-carry decoded `path`, `keyword`, `schemaPath` and a bounded value-free `message`. Construct one JSON
-fields object, validate it and send that same object. No coercion, defaults or property removal
-occurs, and the schema is left unchanged. Preserve nested money objects and calendar date strings.
-The native server validates every write again.
-
-The validator interprets schemas with `@cfworker/json-schema`, with no `eval`, `new Function` or
-network reference loading. Do not call `makeSchemaRegistry(...).validator()` or
-`.assigneeValidator()` in a browser with strict `script-src`: those remain native AJV compilers.
-The Draft 7 JSON import carries `with { type: 'json' }` so Node ESM consumers can load the validator.
-Static AJV standalone compilation is suitable only when the schema cannot change after building;
-organization and project definitions require the runtime interpreter.
-
-The supported contract is Draft 7's object/array/scalar, required, enum/const, ranges, string
-length/pattern, dependencies, boolean, composition and conditional keywords; `$defs`, local/nested
-`$id` references and AJV's `nullable` are also supported. `$ref` sibling constraints are enforced as
-by native planning AJV. String formats use the same `ajv-formats` full-mode predicates, including
-real calendar dates and timezone-aware times. `nullable` adds null to the declared type while
-leaving enum and const constraints intact. All references must resolve inside the supplied field
-schema; productive recursive schemas are supported, same-instance reference cycles are refused.
-Plain JSON values and field names without dot or dollar characters are required.
-
-Preparation throws `SchemaInvalid` for malformed schemas, unresolved references, unsupported
-drafts/keywords/formats, numeric formats, `formatMinimum`/`formatMaximum` extensions and
-`multipleOf`. The latter is refused because the interpreter's epsilon and native AJV's quotient
-semantics disagree for fractional and very large numbers. Standard annotation keywords and `x-`
-annotations do not add validation. Never discard a refused constraint, invent a substitute schema,
-enable `unsafe-eval` or proceed with a ready form after preparation fails. Show the error and retain
-disabled save controls. Validation reports at most 64 errors, with paths bounded to 512 characters.
-
 ## Mounting in a target
 
-The web half of the target mount (`planning` → Mounting in a target).
+The web half of the target mount (`planning` → Mounting in a target, in that skill's `mounting` part).
 
 - `appendPlanningClient(context, { protocols, bind: false, schemas: false })` — the target binds
   its whole api tree itself, and a signed-out visitor may read nothing, so the bundle loads on
@@ -157,55 +128,6 @@ drill.available().map(rule => rule.name)
   project-wide read answers `PlanningUnsupported` on a client.
 - `size: 0` is "no limit"; a paged server answers 100 rows when no size is asked for.
 
-## The mirror — one id space
-
-`appendPlanningStores` registers ONE card store for every kind. Projects, cards and specifications
-share an id space on the server, so they share one store here: a store per kind lets a card list
-that reloads drop the projects beside it.
-
-That is also why a list reaches the store through **`syncHelper.syncCards(store, items, where)`,
-never `replace()`**: every card given is written, every card matching `where` that the list does not
-name is dropped, and everything outside `where` is left alone. An unchanged card is not rewritten, so a
-periodic re-seed wakes no subscriber. `opts.keep` protects ids a commit wrote while the list was in
-flight.
-
-The fold rules, shared by `syncHelper.syncCards`, the mirror's `applyCards` and `applyCommitEvent`, and
-`commits.wait`:
-
-- an OLDER `seq` never overwrites a newer record — frames and list answers race;
-- a committed `delete` removes the row and every link touching it; a project's delete also drops
-  the rows whose `parents` hold it (the server purged them in the same fold);
-- a frame for an id the store never saw still writes a row;
-- a `failed` commit leaves the card alone and records the reason in the commit store;
-- a frame without `record` (a cross-process bus carries ids only) is re-read through the facade —
-  without one, only the commit row is written;
-- a committed `link`/`unlink` re-lists the card's outgoing links; links written together with a
-  `create` arrive with the next link seed.
-
-## The feed
-
-```typescript
-const feed = makePlanningFeed(context, {
-  query: { parent: shedId, type: 'shed:tool' },
-  filter: { project: shedId },
-  refresh: 15_000,
-  onChange: state => setState(state),
-})
-await feed.ready          // never rejects — read feed.error
-// …
-await feed.stop()         // stops folding; the shared socket stays open
-```
-
-1. Subscribes to commits FIRST (the socket, when an opener exists).
-2. Seeds: `cards.list` (unpaged unless the query pages) → `syncHelper.syncCards` over `where`
-   (`queryHelper.criteriaOf(query)` by default). A PAGED seed only writes — a page cannot say what
-   does not exist.
-3. Folds every frame with `planningMirrorOf(stores).applyCommitEvent`, and re-seeds every `refresh`
-   ms — the authoritative backstop to a socket that can drop frames.
-
-`connected` reports whether a socket was open when the feed subscribed; `seeded` tells "nothing
-there" from "not loaded yet". A React hook wraps the feed in an effect and stops it on unmount.
-
 ## Waiting for a commit
 
 `execute()` is asynchronous: the receipt names a PENDING transition until the store folds it.
@@ -241,14 +163,6 @@ service; releasing a subscription never closes it — `context.planning().close(
 
 A Node client passes no opener and relies on the long poll.
 
-## Optimistic writes and `head > seq`
-
-`seq` is the last transition folded into a card, `head` the highest allocated. The mirror's
-`applyReceipt` (run by `execute` whenever stores are registered) raises the stored card's `head` to
-the new transition's `seq`, so `model.pending()` is true before any frame arrives; the commit's fold
-brings `seq` up to it. The mirror only ever grows `head`, so a list fetched before the append does not
-clear the marker. A model's `expectSeq` default and its `WorkcardConflict` are `planning` → Models.
-
 ## Gotchas
 
 - Mount a feed once per screen; read the store everywhere else.
@@ -262,58 +176,6 @@ clear the marker. A model's `expectSeq` default and its `WorkcardConflict` are `
 - `@owlmeans/client-entrypoint` — `bindAll`, the typed `call()`
 - `@owlmeans/state` — the mirror; `@owlmeans/socket` — `Connection`
 
-## Auxiliary mirrors and authenticated scope lifecycle
-
-With `resources: true` in the shared protocol tree, every remote facade exposes the complete
-assignee/team/comment/mention API, including versioned writes, team membership and project
-attachment. `appendPlanningStores` registers separate stock typed mirrors for all four resources.
-`makePlanningResourceFeed` seeds and polls selected resource queries; use it with the stock stores
-and `useStoreList` / `useStoreModel`. Auxiliary writes update the mirror only after success.
-An active-assignee query (`retired: false`) includes an absent or null retirement flag. Local
-mirror queries and feed reconciliation use `{ retired: { $ne: true } }`, matching the native
-facade rather than strict equality to false. A filtered poll removes only its unchanged matching
-snapshot rows, preserving unrelated retired identities needed by existing references.
-Comments use trusted server authors; mentions are read-only derived cache commands.
-
-Supply `PlanningClientOptions.scopeKey` from authenticated organization entity slug, profile/user
-id, session id and authorization revision; return undefined when signed out. Before switching
-organization or signing out, **await** `service.close()` before adopting the credential. It cancels
-requests and commit waits, invalidates receipts (including already-settled receipts), stops every
-registered feed, removes socket subscriptions, closes the carrier and rejects late socket openers.
-A stale operation answers `client:scope-changed`; cancellation never rolls back an accepted server
-write. A new subscription opens a fresh carrier after close.
-
-Close drains admitted **local** mirror writes before clearing every stock store and schema cache.
-New calls during an explicit close are refused, including hosts without `scopeKey`. Concurrent
-closes share the boundary. If clearing fails, close rejects and fresh work stays blocked; retain
-the old credential and retry close explicitly. An observed identity change also cancels old work
-and queues clearing before the new identity's mirror writes. Reload schemas and create fresh feeds
-after credential adoption. Feed query scope alone is insufficient for this lifecycle.
-
-The service's `lifecycle` coordinates stock facades, receipts, feeds and schema writes. A custom
-mirror integration captures an operation with `lifecycle.run`, performs remote reads through
-`operation.wait` with `operation.signal`, then uses `lifecycle.mutate(operation, write)` for local
-writes; never hold or nest that queue over a request, socket opener or another queued mutation.
-`planningMirrorOf(stores)` accepts `{ lifecycle, operation }` as its optional last argument and
-fetches missing frame records/links before entering the queue. Direct mirror/sync helpers without
-that option are local primitives: their caller owns isolation and cleanup.
-
-Planning protocols return `PlanningReply<T>` without storage organization identifiers. Stock
-facades hydrate records, receipts, schema scopes and socket frames with `entityId: ''` only to
-preserve the shared facade shape. That value is an advisory placeholder, never an organization
-identity or a credential. Use `scopeKey` and the authenticated organization entity slug for
-identity changes and access isolation; native server records keep their verified stable scope.
-
-Resource feed reconciliation snapshots mirror versions before requesting a list. Only unchanged
-snapshot rows absent from that response are removed, so a new local write or a newer version
-survives an older in-flight poll. Stopped feeds cannot publish. Track custom feeds through
-`registerFeed` when their lifecycle must end with the planning service. Card feeds use the same
-identity fence and stop registration; component cleanup awaits `stop()` when it must observe a
-completed boundary. Stop cancels unresolved seeds and drains admitted local changes without waiting
-for the network; neither late callbacks nor authoritative deletion passes may publish afterward.
-A schema write from an old generation cannot invalidate a newer generation's cached registry.
-
-
 ## Related
 
 - `planning` — records, flows, the fold, the models
@@ -321,9 +183,12 @@ A schema write from an old generation cannot invalidate a newer generation's cac
 - `client-job` — the same seed-then-fold shape for safe application-job views
 - `state` — `syncHelper.syncCards` is built on its criteria engine and `purge`
 
-## External docs
+## Parts
+
+Load a part on top of this core when its job is in play.
 
-- https://ajv.js.org/security.html#content-security-policy — runtime AJV requires unsafe-eval; standalone build compilation preserves strict CSP for static schemas.
-- https://www.npmjs.com/package/@cfworker/json-schema/v/4.1.1 — the interpreter supports dynamic schemas without code generation; select an explicit vocabulary and check its known limitations (4.1.1).
-- https://github.com/ajv-validator/ajv-formats#full-and-fast-validation-modes — full-mode predicates validate formats completely and are reusable through the plugin's `get` API (3.0.1).
-- https://ajv.js.org/json-schema.html#nullable-openapi — nullable expands the declared type without adding null to enum or const.
+| Part | Load it when |
+|---|---|
+| [validation](parts/validation.md) | Validating planning `fields` in a browser form under a strict CSP (`makePlanningFieldValidator`) |
+| [mirror](parts/mirror.md) | Reading lists from the state mirror (`syncHelper`, `planningMirrorOf`), mounting `makePlanningFeed`, or relying on `head > seq` |
+| [aux-mirrors](parts/aux-mirrors.md) | Assignee, team, comment or mention mirrors and feeds, or switching organization / signing out (`scopeKey`, `close()`) |

package/agent-meta/skills/client-planning/parts/aux-mirrors.md

@@ -0,0 +1,61 @@
+---
+name: aux-mirrors
+description: The assignee, team, comment and mention mirrors and resource feeds, and the authenticated scope lifecycle (scopeKey, close, lifecycle.run and lifecycle.mutate).
+metadata:
+  purposes: state, auth
+  mentions: makePlanningResourceFeed, scopeKey, lifecycle.run, lifecycle.mutate, registerFeed, client:scope-changed, PlanningReply
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/client-planning — Auxiliary mirrors and the scope lifecycle
+
+## Auxiliary mirrors and authenticated scope lifecycle
+
+With `resources: true` in the shared protocol tree, every remote facade exposes the complete
+assignee/team/comment/mention API, including versioned writes, team membership and project
+attachment. `appendPlanningStores` registers separate stock typed mirrors for all four resources.
+`makePlanningResourceFeed` seeds and polls selected resource queries; use it with the stock stores
+and `useStoreList` / `useStoreModel`. Auxiliary writes update the mirror only after success.
+An active-assignee query (`retired: false`) includes an absent or null retirement flag. Local
+mirror queries and feed reconciliation use `{ retired: { $ne: true } }`, matching the native
+facade rather than strict equality to false. A filtered poll removes only its unchanged matching
+snapshot rows, preserving unrelated retired identities needed by existing references.
+Comments use trusted server authors; mentions are read-only derived cache commands.
+
+Supply `PlanningClientOptions.scopeKey` from authenticated organization entity slug, profile/user
+id, session id and authorization revision; return undefined when signed out. Before switching
+organization or signing out, **await** `service.close()` before adopting the credential. It cancels
+requests and commit waits, invalidates receipts (including already-settled receipts), stops every
+registered feed, removes socket subscriptions, closes the carrier and rejects late socket openers.
+A stale operation answers `client:scope-changed`; cancellation never rolls back an accepted server
+write. A new subscription opens a fresh carrier after close.
+
+Close drains admitted **local** mirror writes before clearing every stock store and schema cache.
+New calls during an explicit close are refused, including hosts without `scopeKey`. Concurrent
+closes share the boundary. If clearing fails, close rejects and fresh work stays blocked; retain
+the old credential and retry close explicitly. An observed identity change also cancels old work
+and queues clearing before the new identity's mirror writes. Reload schemas and create fresh feeds
+after credential adoption. Feed query scope alone is insufficient for this lifecycle.
+
+The service's `lifecycle` coordinates stock facades, receipts, feeds and schema writes. A custom
+mirror integration captures an operation with `lifecycle.run`, performs remote reads through
+`operation.wait` with `operation.signal`, then uses `lifecycle.mutate(operation, write)` for local
+writes; never hold or nest that queue over a request, socket opener or another queued mutation.
+`planningMirrorOf(stores)` accepts `{ lifecycle, operation }` as its optional last argument and
+fetches missing frame records/links before entering the queue. Direct mirror/sync helpers without
+that option are local primitives: their caller owns isolation and cleanup.
+
+Planning protocols return `PlanningReply<T>` without storage organization identifiers. Stock
+facades hydrate records, receipts, schema scopes and socket frames with `entityId: ''` only to
+preserve the shared facade shape. That value is an advisory placeholder, never an organization
+identity or a credential. Use `scopeKey` and the authenticated organization entity slug for
+identity changes and access isolation; native server records keep their verified stable scope.
+
+Resource feed reconciliation snapshots mirror versions before requesting a list. Only unchanged
+snapshot rows absent from that response are removed, so a new local write or a newer version
+survives an older in-flight poll. Stopped feeds cannot publish. Track custom feeds through
+`registerFeed` when their lifecycle must end with the planning service. Card feeds use the same
+identity fence and stop registration; component cleanup awaits `stop()` when it must observe a
+completed boundary. Stop cancels unresolved seeds and drains admitted local changes without waiting
+for the network; neither late callbacks nor authoritative deletion passes may publish afterward.
+A schema write from an old generation cannot invalidate a newer generation's cached registry.

package/agent-meta/skills/client-planning/parts/mirror.md

@@ -0,0 +1,67 @@
+---
+name: mirror
+description: The state mirror's one id space and fold rules, makePlanningFeed, and optimistic writes with head over seq.
+metadata:
+  purposes: state, list
+  mentions: appendPlanningStores, planningMirrorOf, applyCommitEvent, applyReceipt, applyCards, syncHelper, syncCards, syncLinks, makePlanningFeed, PlanningFeed, useStoreList
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/client-planning — The mirror and the feed
+
+## The mirror — one id space
+
+`appendPlanningStores` registers ONE card store for every kind. Projects, cards and specifications
+share an id space on the server, so they share one store here: a store per kind lets a card list
+that reloads drop the projects beside it.
+
+That is also why a list reaches the store through **`syncHelper.syncCards(store, items, where)`,
+never `replace()`**: every card given is written, every card matching `where` that the list does not
+name is dropped, and everything outside `where` is left alone. An unchanged card is not rewritten, so a
+periodic re-seed wakes no subscriber. `opts.keep` protects ids a commit wrote while the list was in
+flight.
+
+The fold rules, shared by `syncHelper.syncCards`, the mirror's `applyCards` and `applyCommitEvent`, and
+`commits.wait`:
+
+- an OLDER `seq` never overwrites a newer record — frames and list answers race;
+- a committed `delete` removes the row and every link touching it; a project's delete also drops
+  the rows whose `parents` hold it (the server purged them in the same fold);
+- a frame for an id the store never saw still writes a row;
+- a `failed` commit leaves the card alone and records the reason in the commit store;
+- a frame without `record` (a cross-process bus carries ids only) is re-read through the facade —
+  without one, only the commit row is written;
+- a committed `link`/`unlink` re-lists the card's outgoing links; links written together with a
+  `create` arrive with the next link seed.
+
+## The feed
+
+```typescript
+const feed = makePlanningFeed(context, {
+  query: { parent: shedId, type: 'shed:tool' },
+  filter: { project: shedId },
+  refresh: 15_000,
+  onChange: state => setState(state),
+})
+await feed.ready          // never rejects — read feed.error
+// …
+await feed.stop()         // stops folding; the shared socket stays open
+```
+
+1. Subscribes to commits FIRST (the socket, when an opener exists).
+2. Seeds: `cards.list` (unpaged unless the query pages) → `syncHelper.syncCards` over `where`
+   (`queryHelper.criteriaOf(query)` by default). A PAGED seed only writes — a page cannot say what
+   does not exist.
+3. Folds every frame with `planningMirrorOf(stores).applyCommitEvent`, and re-seeds every `refresh`
+   ms — the authoritative backstop to a socket that can drop frames.
+
+`connected` reports whether a socket was open when the feed subscribed; `seeded` tells "nothing
+there" from "not loaded yet". A React hook wraps the feed in an effect and stops it on unmount.
+
+## Optimistic writes and `head > seq`
+
+`seq` is the last transition folded into a card, `head` the highest allocated. The mirror's
+`applyReceipt` (run by `execute` whenever stores are registered) raises the stored card's `head` to
+the new transition's `seq`, so `model.pending()` is true before any frame arrives; the commit's fold
+brings `seq` up to it. The mirror only ever grows `head`, so a list fetched before the append does not
+clear the marker. A model's `expectSeq` default and its `WorkcardConflict` are `planning` → Models.

package/agent-meta/skills/client-planning/parts/validation.md

@@ -0,0 +1,56 @@
+---
+name: validation
+description: CSP-safe browser validation of a served field schema with makePlanningFieldValidator — the supported keywords, refusals and limits, and the external references behind them.
+metadata:
+  purposes: form
+  mentions: makePlanningFieldValidator, validateFields, @cfworker/json-schema, JSON_SCHEMA_DRAFT_07, unsafe-eval, SchemaInvalid
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/client-planning — Browser field validation
+
+## Browser field validation under CSP
+
+Bind `makePlanningFieldValidator(registry.fieldsSchema(type))` to the registry of the resolved
+organization or project bundle — the type's own `fields` plus the application's base card fields
+(`planning` → types part); with no base fields it IS `type.fields`. Passing `type.fields` alone
+skips the base fields the server still enforces. Its `validateFields(fields)` returns `{ valid, errors }`; errors
+carry decoded `path`, `keyword`, `schemaPath` and a bounded value-free `message`. Construct one JSON
+fields object, validate it and send that same object. No coercion, defaults or property removal
+occurs, and the schema is left unchanged. Preserve nested money objects and calendar date strings.
+The native server validates every write again.
+
+The validator interprets schemas with `@cfworker/json-schema`, with no `eval`, `new Function` or
+network reference loading. Do not call `makeSchemaRegistry(...).validator()` or
+`.assigneeValidator()` in a browser with strict `script-src`: those remain native AJV compilers.
+The Draft 7 meta-schema is DATA in `src/validation/consts.ts` (`JSON_SCHEMA_DRAFT_07`, pinned to ajv's
+`refs/json-schema-draft-07.json` by `tests/draft7.spec.ts`), never an import of that file: Node ESM needs
+`with { type: 'json' }` on it, and a bundler that also meets ajv's own attribute-less `require` of the
+same file refuses the pair (Rollup: "import attributes for the same module are always consistent"),
+which fails every target web build that mounts the planning client.
+Static AJV standalone compilation is suitable only when the schema cannot change after building;
+organization and project definitions require the runtime interpreter.
+
+The supported contract is Draft 7's object/array/scalar, required, enum/const, ranges, string
+length/pattern, dependencies, boolean, composition and conditional keywords; `$defs`, local/nested
+`$id` references and AJV's `nullable` are also supported. `$ref` sibling constraints are enforced as
+by native planning AJV. String formats use the same `ajv-formats` full-mode predicates, including
+real calendar dates and timezone-aware times. `nullable` adds null to the declared type while
+leaving enum and const constraints intact. All references must resolve inside the supplied field
+schema; productive recursive schemas are supported, same-instance reference cycles are refused.
+Plain JSON values and field names without dot or dollar characters are required.
+
+Preparation throws `SchemaInvalid` for malformed schemas, unresolved references, unsupported
+drafts/keywords/formats, numeric formats, `formatMinimum`/`formatMaximum` extensions and
+`multipleOf`. The latter is refused because the interpreter's epsilon and native AJV's quotient
+semantics disagree for fractional and very large numbers. Standard annotation keywords and `x-`
+annotations do not add validation. Never discard a refused constraint, invent a substitute schema,
+enable `unsafe-eval` or proceed with a ready form after preparation fails. Show the error and retain
+disabled save controls. Validation reports at most 64 errors, with paths bounded to 512 characters.
+
+## External docs
+
+- https://ajv.js.org/security.html#content-security-policy — runtime AJV requires unsafe-eval; standalone build compilation preserves strict CSP for static schemas.
+- https://www.npmjs.com/package/@cfworker/json-schema/v/4.1.1 — the interpreter supports dynamic schemas without code generation; select an explicit vocabulary and check its known limitations (4.1.1).
+- https://github.com/ajv-validator/ajv-formats#full-and-fast-validation-modes — full-mode predicates validate formats completely and are reusable through the plugin's `get` API (3.0.1).
+- https://ajv.js.org/json-schema.html#nullable-openapi — nullable expands the declared type without adding null to enum or const.

package/build/client.d.ts

@@ -6,7 +6,7 @@ import type { Config, Context, PlanningClientOptions, PlanningClientService, Wit
  * What only a server can do is refused rather than faked: a client runs no middleware and folds
  * nothing, so `store()`, `committed()` and a plugin carrying hooks or a store answer
  * `PlanningUnsupported`. A plugin carrying only schemas is accepted — it layers over the server's
- * bundle.
+ * bundle (its `schemas.app` merged over the served declarations, in plugin order).
  */
 export declare const makePlanningClientService: <C extends Config, T extends Context<C>>(context: T, options: PlanningClientOptions) => PlanningClientService;
 /**

package/build/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAClF,MAAM,YAAY,CAAA;AAEnB;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WACrE,CAAC,WAAW,qBAAqB,KACzC,qBAoHF,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAChE,CAAC,WAAW,qBAAqB,KACzC,CAAC,GAAG,kBA0BN,CAAA"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAClF,MAAM,YAAY,CAAA;AAEnB;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WACrE,CAAC,WAAW,qBAAqB,KACzC,qBA6HF,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAChE,CAAC,WAAW,qBAAqB,KACzC,CAAC,GAAG,kBA0BN,CAAA"}

package/build/client.js

@@ -1,6 +1,6 @@
 import { bindAll } from '@owlmeans/client-entrypoint';
 import { createLazyService, MiddlewareStage, MiddlewareType } from '@owlmeans/context';
-import { DEFAULT_PLUGIN_ORDER, makeSchemaRegistry, PLANNING_SERVICE, PlanningUnsupported, } from '@owlmeans/planning';
+import { appSchemaHelper, DEFAULT_PLUGIN_ORDER, makeSchemaRegistry, PLANNING_SERVICE, PlanningUnsupported, } from '@owlmeans/planning';
 import { makeRemoteCommitSource } from './commits.js';
 import { makeRemoteDefinitions } from './definitions.js';
 import { makeRemoteFacade } from './facade.js';
@@ -13,7 +13,7 @@ import { makePlanningClientLifecycle } from './lifecycle.js';
  * What only a server can do is refused rather than faked: a client runs no middleware and folds
  * nothing, so `store()`, `committed()` and a plugin carrying hooks or a store answer
  * `PlanningUnsupported`. A plugin carrying only schemas is accepted — it layers over the server's
- * bundle.
+ * bundle (its `schemas.app` merged over the served declarations, in plugin order).
  */
 export const makePlanningClientService = (context, options) => {
     const feeds = new Set();
@@ -33,11 +33,16 @@ export const makePlanningClientService = (context, options) => {
     const commits = makeRemoteCommitSource(context, options.protocols, {
         socket: options.socket, poll: options.poll, timeout: options.timeout, stores, lifecycle,
     });
-    const layerPlugins = () => plugins.forEach(plugin => {
-        plugin.schemas?.assigneeTypes?.forEach(registry.registerAssigneeType);
-        plugin.schemas?.flows?.forEach(registry.registerFlow);
-        plugin.schemas?.types?.forEach(registry.registerType);
-    });
+    // The application's declarations the server served — what every client plugin's `app` merges over.
+    let served;
+    const layerPlugins = () => {
+        registry.registerApp(appSchemaHelper.merge([served, ...plugins.map(plugin => plugin.schemas?.app)]));
+        plugins.forEach(plugin => {
+            plugin.schemas?.assigneeTypes?.forEach(registry.registerAssigneeType);
+            plugin.schemas?.flows?.forEach(registry.registerFlow);
+            plugin.schemas?.types?.forEach(registry.registerType);
+        });
+    };
     let loadedKey = scopeKey();
     let loaded = false;
     let loading = null;
@@ -57,6 +62,7 @@ export const makePlanningClientService = (context, options) => {
                 const bundle = await operation.wait(context.entrypoint(options.protocols.schema.list).call({ timeout: options.timeout, signal: operation.signal }));
                 operation.check();
                 registry.load(bundle);
+                served = registry.app();
                 layerPlugins();
                 loaded = true;
                 return registry;
@@ -87,6 +93,7 @@ export const makePlanningClientService = (context, options) => {
         loading = null;
         definitions?.invalidate();
         registry.load({ version: 1, types: [], flows: [] });
+        served = undefined;
         layerPlugins();
         await Promise.all(stopping.map(async (feed) => await feed.stop()));
     });
@@ -102,6 +109,9 @@ export const makePlanningClientService = (context, options) => {
             if (plugin.before != null || plugin.after != null || plugin.store != null || plugin.mintCode != null) {
                 throw new PlanningUnsupported(`client:plugin:${plugin.name}`);
             }
+            if (plugin.schemas?.app != null) {
+                appSchemaHelper.assertDeclarations(plugin.schemas.app);
+            }
             const existing = plugins.findIndex(candidate => candidate.name === plugin.name);
             if (existing >= 0) {
                 plugins.splice(existing, 1);

package/build/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEtF,OAAO,EACL,oBAAoB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,GAChF,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAK5D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAU,EAAE,OAA8B,EACnB,EAAE;IACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqC,CAAA;IAC1D,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAA;IACrC,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;IACxD,MAAM,SAAS,GAAG,2BAA2B,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC5F,MAAM,OAAO,GAAG,MAAM,EAAE,CAAA;YACxB,IAAI,OAAO,IAAI,IAAI;gBAAE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;oBACjD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK;wBAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAG,CAAC,CAAA;gBAC9D,CAAC;QACH,CAAC,EAAE,CAAC,CAAA;IACJ,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAA;IAE9B,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QACjE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS;KACxF,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACxD,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;QACrE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACrD,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAA;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,OAAO,GAA2C,IAAI,CAAA;IAE1D,MAAM,WAAW,GAAyC,KAAK,EAAC,IAAI,EAAC,EAAE;QACrE,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAAC,MAAM,GAAG,KAAK,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,WAAW,EAAE,UAAU,EAAE,CAAC;YAAC,SAAS,GAAG,GAAG,CAAA;QAAC,CAAC;QACrG,IAAI,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,EAAC,SAAS,EAAC,EAAE;gBAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;gBACnJ,SAAS,CAAC,KAAK,EAAE,CAAA;gBACjB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACrB,YAAY,EAAE,CAAA;gBACd,MAAM,GAAG,IAAI,CAAA;gBAEb,OAAO,QAAQ,CAAA;YACjB,CAAC,CAAC,CAAA;YACF,OAAO,GAAG,OAAO,CAAA;YACjB,6FAA6F;YAC7F,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;oBACxB,OAAO,GAAG,IAAI,CAAA;gBAChB,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,MAAM,OAAO,CAAA;IACtB,CAAC,CAAA;IAED,sGAAsG;IACtG,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;QACzD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,GAAG,IAAI,CAAA,CAAC,CAAC,EAAE,CAAC,CAAA;IAEjJ,MAAM,SAAS,GAAG,CAAC,KAAkD,EAAkB,EAAE,CACvF,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE;QAC3E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM;QAC9F,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAA;IAEJ,IAAI,QAAQ,GAA0B,IAAI,CAAA;IAC1C,SAAS,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE;QAChC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;QAC3B,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,GAAG,KAAK,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,UAAU,EAAE,CAAA;QACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAAC,YAAY,EAAE,CAAA;QACnE,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,6FAA6F;IAC7F,OAAO,iBAAiB,CAAwB,gBAAgB,EAAE;QAChE,OAAO,EAAE,QAAQ;QACjB,SAAS;QACT,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAA,CAAC,CAAC;QAE9E,OAAO;QAEP,WAAW;QAEX,GAAG,EAAE,MAAM,CAAC,EAAE;YACZ,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrG,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YAC/D,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAA;YAC/E,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC7B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC,CAAA;YAC3G,YAAY,EAAE,CAAA;QAChB,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC;QAE3B,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAA;QAC/C,CAAC;QAED,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;QAE7E,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAA;QACnD,CAAC;QAED,KAAK,EAAE,SAAS,CAAC,KAAK;QAEtB,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,OAA8B,EAClB,EAAE;IAC1B,MAAM,GAAG,GAAG,OAAiC,CAAA;IAE7C,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,SAAsC,CAAC,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,CAAO,OAAO,EAAE,OAAO,CAAC,CAAA;IACjE,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAC5B,GAAG,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAwB,gBAAgB,CAAC,CAAA;IAEzE,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9B,GAAG,CAAC,kBAAkB,CAAC;YACrB,IAAI,EAAE,cAAc,CAAC,OAAO;YAC5B,KAAK,EAAE,eAAe,CAAC,KAAK;YAC5B,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,WAAW,EAAE,CAAA;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,qCAAqC;gBACvC,CAAC;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEtF,OAAO,EACL,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,GACjG,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAK5D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAU,EAAE,OAA8B,EACnB,EAAE;IACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqC,CAAA;IAC1D,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAA;IACrC,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;IACxD,MAAM,SAAS,GAAG,2BAA2B,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC5F,MAAM,OAAO,GAAG,MAAM,EAAE,CAAA;YACxB,IAAI,OAAO,IAAI,IAAI;gBAAE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;oBACjD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK;wBAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAG,CAAC,CAAA;gBAC9D,CAAC;QACH,CAAC,EAAE,CAAC,CAAA;IACJ,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAA;IAE9B,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QACjE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS;KACxF,CAAC,CAAA;IAEF,mGAAmG;IACnG,IAAI,MAA2C,CAAA;IAC/C,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACpG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YACvB,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;YACrE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;YACrD,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACvD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAA;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,OAAO,GAA2C,IAAI,CAAA;IAE1D,MAAM,WAAW,GAAyC,KAAK,EAAC,IAAI,EAAC,EAAE;QACrE,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAAC,MAAM,GAAG,KAAK,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,WAAW,EAAE,UAAU,EAAE,CAAC;YAAC,SAAS,GAAG,GAAG,CAAA;QAAC,CAAC;QACrG,IAAI,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,EAAC,SAAS,EAAC,EAAE;gBAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;gBACnJ,SAAS,CAAC,KAAK,EAAE,CAAA;gBACjB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACrB,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAA;gBACvB,YAAY,EAAE,CAAA;gBACd,MAAM,GAAG,IAAI,CAAA;gBAEb,OAAO,QAAQ,CAAA;YACjB,CAAC,CAAC,CAAA;YACF,OAAO,GAAG,OAAO,CAAA;YACjB,6FAA6F;YAC7F,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;oBACxB,OAAO,GAAG,IAAI,CAAA;gBAChB,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,MAAM,OAAO,CAAA;IACtB,CAAC,CAAA;IAED,sGAAsG;IACtG,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;QACzD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,GAAG,IAAI,CAAA,CAAC,CAAC,EAAE,CAAC,CAAA;IAEjJ,MAAM,SAAS,GAAG,CAAC,KAAkD,EAAkB,EAAE,CACvF,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE;QAC3E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM;QAC9F,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAA;IAEJ,IAAI,QAAQ,GAA0B,IAAI,CAAA;IAC1C,SAAS,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE;QAChC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;QAC3B,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,GAAG,KAAK,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,UAAU,EAAE,CAAA;QACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAAC,MAAM,GAAG,SAAS,CAAC;QAAC,YAAY,EAAE,CAAA;QACvF,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,6FAA6F;IAC7F,OAAO,iBAAiB,CAAwB,gBAAgB,EAAE;QAChE,OAAO,EAAE,QAAQ;QACjB,SAAS;QACT,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAA,CAAC,CAAC;QAE9E,OAAO;QAEP,WAAW;QAEX,GAAG,EAAE,MAAM,CAAC,EAAE;YACZ,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrG,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YAC/D,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;gBAChC,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACxD,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAA;YAC/E,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC7B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC,CAAA;YAC3G,YAAY,EAAE,CAAA;QAChB,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC;QAE3B,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAA;QAC/C,CAAC;QAED,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;QAE7E,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAA;QACnD,CAAC;QAED,KAAK,EAAE,SAAS,CAAC,KAAK;QAEtB,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,OAA8B,EAClB,EAAE;IAC1B,MAAM,GAAG,GAAG,OAAiC,CAAA;IAE7C,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,SAAsC,CAAC,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,CAAO,OAAO,EAAE,OAAO,CAAC,CAAA;IACjE,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAC5B,GAAG,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAwB,gBAAgB,CAAC,CAAA;IAEzE,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9B,GAAG,CAAC,kBAAkB,CAAC;YACrB,IAAI,EAAE,cAAc,CAAC,OAAO;YAC5B,KAAK,EAAE,eAAe,CAAC,KAAK;YAC5B,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,WAAW,EAAE,CAAA;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,qCAAqC;gBACvC,CAAC;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/client-planning",
-  "version": "0.1.18-rc.36",
+  "version": "0.1.18-rc.38",
   "license": "MIT",
   "description": "The client half of OwlMeans planning — the remote planning facade, the state mirror and its commit fold, and the subscribe-then-poll commit wait. React-free: it runs in a browser and in a Node client alike.",
   "type": "module",
@@ -24,18 +24,18 @@
   },
   "dependencies": {
     "@cfworker/json-schema": "^4.1.1",
-    "@owlmeans/auth": "^0.1.18-rc.41",
-    "@owlmeans/client-context": "^0.1.18-rc.52",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.51",
-    "@owlmeans/context": "^0.1.18-rc.34",
-    "@owlmeans/entrypoint": "^0.1.18-rc.41",
-    "@owlmeans/error": "^0.1.18-rc.38",
-    "@owlmeans/planning": "^0.1.18-rc.28",
-    "@owlmeans/resource": "^0.1.18-rc.40",
-    "@owlmeans/log": "^0.1.18-rc.3",
-    "@owlmeans/route": "^0.1.18-rc.35",
-    "@owlmeans/socket": "^0.1.18-rc.44",
-    "@owlmeans/state": "^0.1.18-rc.39"
+    "@owlmeans/auth": "^0.1.18-rc.42",
+    "@owlmeans/client-context": "^0.1.18-rc.53",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.52",
+    "@owlmeans/context": "^0.1.18-rc.35",
+    "@owlmeans/entrypoint": "^0.1.18-rc.42",
+    "@owlmeans/error": "^0.1.18-rc.39",
+    "@owlmeans/planning": "^0.1.18-rc.30",
+    "@owlmeans/resource": "^0.1.18-rc.41",
+    "@owlmeans/log": "^0.1.18-rc.4",
+    "@owlmeans/route": "^0.1.18-rc.36",
+    "@owlmeans/socket": "^0.1.18-rc.45",
+    "@owlmeans/state": "^0.1.18-rc.40"
   },
   "peerDependencies": {
     "ajv": "*",
@@ -43,8 +43,8 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/server-planning": "^0.1.18-rc.34",
-    "@owlmeans/test": "^0.1.18-rc.37",
+    "@owlmeans/server-planning": "^0.1.18-rc.36",
+    "@owlmeans/test": "^0.1.18-rc.38",
     "@types/bun": "^1.4.2",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/client.ts

@@ -2,9 +2,9 @@ import { bindAll } from '@owlmeans/client-entrypoint'
 import { createLazyService, MiddlewareStage, MiddlewareType } from '@owlmeans/context'
 import type { EntrypointTree } from '@owlmeans/entrypoint'
 import {
-  DEFAULT_PLUGIN_ORDER, makeSchemaRegistry, PLANNING_SERVICE, PlanningUnsupported,
+  appSchemaHelper, DEFAULT_PLUGIN_ORDER, makeSchemaRegistry, PLANNING_SERVICE, PlanningUnsupported,
 } from '@owlmeans/planning'
-import type { PlanningFacade, PlanningPlugin, PlanningSchemaRegistry } from '@owlmeans/planning'
+import type { PlanningAppDeclarations, PlanningFacade, PlanningPlugin, PlanningSchemaRegistry } from '@owlmeans/planning'
 import { makeRemoteCommitSource } from './commits.js'
 import { makeRemoteDefinitions } from './definitions.js'
 import { makeRemoteFacade } from './facade.js'
@@ -21,7 +21,7 @@ import type {
  * What only a server can do is refused rather than faked: a client runs no middleware and folds
  * nothing, so `store()`, `committed()` and a plugin carrying hooks or a store answer
  * `PlanningUnsupported`. A plugin carrying only schemas is accepted — it layers over the server's
- * bundle.
+ * bundle (its `schemas.app` merged over the served declarations, in plugin order).
  */
 export const makePlanningClientService = <C extends Config, T extends Context<C>>(
   context: T, options: PlanningClientOptions
@@ -43,11 +43,16 @@ export const makePlanningClientService = <C extends Config, T extends Context<C>
     socket: options.socket, poll: options.poll, timeout: options.timeout, stores, lifecycle,
   })
 
-  const layerPlugins = (): void => plugins.forEach(plugin => {
-    plugin.schemas?.assigneeTypes?.forEach(registry.registerAssigneeType)
-    plugin.schemas?.flows?.forEach(registry.registerFlow)
-    plugin.schemas?.types?.forEach(registry.registerType)
-  })
+  // The application's declarations the server served — what every client plugin's `app` merges over.
+  let served: PlanningAppDeclarations | undefined
+  const layerPlugins = (): void => {
+    registry.registerApp(appSchemaHelper.merge([served, ...plugins.map(plugin => plugin.schemas?.app)]))
+    plugins.forEach(plugin => {
+      plugin.schemas?.assigneeTypes?.forEach(registry.registerAssigneeType)
+      plugin.schemas?.flows?.forEach(registry.registerFlow)
+      plugin.schemas?.types?.forEach(registry.registerType)
+    })
+  }
 
   let loadedKey = scopeKey()
   let loaded = false
@@ -64,6 +69,7 @@ export const makePlanningClientService = <C extends Config, T extends Context<C>
         const bundle = await operation.wait(context.entrypoint(options.protocols.schema.list).call({ timeout: options.timeout, signal: operation.signal }))
         operation.check()
         registry.load(bundle)
+        served = registry.app()
         layerPlugins()
         loaded = true
 
@@ -97,7 +103,7 @@ export const makePlanningClientService = <C extends Config, T extends Context<C>
     const stopping = [...feeds]
     feeds.clear()
     loaded = false; loading = null; definitions?.invalidate()
-    registry.load({ version: 1, types: [], flows: [] }); layerPlugins()
+    registry.load({ version: 1, types: [], flows: [] }); served = undefined; layerPlugins()
     await Promise.all(stopping.map(async feed => await feed.stop()))
   })
 
@@ -116,6 +122,9 @@ export const makePlanningClientService = <C extends Config, T extends Context<C>
       if (plugin.before != null || plugin.after != null || plugin.store != null || plugin.mintCode != null) {
         throw new PlanningUnsupported(`client:plugin:${plugin.name}`)
       }
+      if (plugin.schemas?.app != null) {
+        appSchemaHelper.assertDeclarations(plugin.schemas.app)
+      }
       const existing = plugins.findIndex(candidate => candidate.name === plugin.name)
       if (existing >= 0) {
         plugins.splice(existing, 1)

package/tests/app.spec.ts

@@ -0,0 +1,72 @@
+import { describe, expect, test } from 'bun:test'
+import { appSchemaHelper, FieldsInvalid, SchemaInvalid, TransitionAction, WorkcardKind } from '@owlmeans/planning'
+import type { PlanningAppDeclarations, PlanningService, WorkcardTypeSchema } from '@owlmeans/planning'
+import { makePlanningFieldValidator } from '../src/index.js'
+import { makeSuite, STORY, STORY_FLOW } from './context.js'
+import type { Suite } from './context.js'
+
+/** A choir: every type says what it is for, every card may carry a part. */
+const APP: PlanningAppDeclarations = {
+  type: { properties: { description: { type: 'string' } } },
+  card: { properties: { part: { type: 'string', enum: ['soprano', 'alto', 'tenor', 'bass'] } } },
+}
+/** What a service serves: the declarations merged (normalized with `type: 'object'`). */
+const SERVED = appSchemaHelper.merge([APP])
+
+const SECTIONAL: WorkcardTypeSchema = {
+  type: 'test:sectional', kind: WorkcardKind.Card, version: 1, flows: [STORY_FLOW], specifications: [],
+  fields: { type: 'object', additionalProperties: false },
+}
+
+const declared = async (opts: Parameters<typeof makeSuite>[0] = {}): Promise<Suite> => {
+  const suite = await makeSuite(opts)
+  ;(suite.server as unknown as { planning: () => PlanningService }).planning().use({ name: 'choir', schemas: { app: APP } })
+
+  return suite
+}
+
+describe('@owlmeans/client-planning — application declarations', () => {
+  test('the served bundle carries them: the registry validates base fields, a form validator takes the same schema', async () => {
+    const suite = await declared()
+    const registry = await suite.client.planning().loadSchemas()
+
+    expect(registry.app()).toEqual(SERVED!)
+    expect(registry.validator(STORY)({ area: 'stage', part: 'alto' })).toBe(true)
+    expect(registry.validator(STORY)({ area: 'stage', part: 'drums' })).toBe(false)
+    const form = makePlanningFieldValidator(registry.fieldsSchema(STORY))
+    expect(form.validateFields({ area: 'stage', part: 'alto' }).valid).toBe(true)
+    expect(form.validateFields({ area: 'stage', part: 'drums' }).valid).toBe(false)
+    expect(form.validateFields({ area: 'stage', colour: 'red' }).valid).toBe(false)
+
+    const project = await suite.project('Spring concert')
+    await expect(suite.planning.execute({
+      card: { kind: WorkcardKind.Card, type: STORY, parent: project.id!, title: 'Warm-up', fields: { part: 'drums' } },
+      action: TransitionAction.Create,
+    }, { wait: true })).rejects.toBeInstanceOf(FieldsInvalid)
+  })
+
+  test('a schemas-only client plugin merges over the served declarations; a malformed one is refused', async () => {
+    const suite = await declared()
+    const service = suite.client.planning()
+    await service.loadSchemas()
+
+    service.use({ name: 'stage', schemas: { app: { card: { properties: { row: { type: 'number' } } } } } })
+    expect(Object.keys(service.schemas.app()?.card?.properties ?? {})).toEqual(['part', 'row'])
+    expect(() => service.use({ name: 'broken', schemas: { app: { card: { properties: { 'a.b': {} } } } } })).toThrow(SchemaInvalid)
+    expect(service.plugins().map(plugin => plugin.name)).toEqual(['stage'])
+    service.use({ name: 'stage' })
+    expect(Object.keys(service.schemas.app()?.card?.properties ?? {})).toEqual(['part'])
+  })
+
+  test('definitions carry a type\'s app bag over the wire; a refused bag crosses as SchemaInvalid', async () => {
+    const suite = await declared({ definitions: true })
+    const definitions = suite.planning.definitions!
+
+    await definitions.define({ types: [{ ...SECTIONAL, app: { description: 'Small groups' } }] })
+    const layer = await definitions.registry()
+    expect((layer.type(SECTIONAL.type) as WorkcardTypeSchema).app).toEqual({ description: 'Small groups' })
+    expect(layer.app()).toEqual(SERVED!)
+    expect(layer.validator(SECTIONAL.type)({ part: 'tenor' })).toBe(true)
+    await expect(definitions.putType({ ...SECTIONAL, version: 2, app: { conductor: 'me' } })).rejects.toBeInstanceOf(SchemaInvalid)
+  })
+})