genesis-stack 1.4.1 → 1.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genesis-stack",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "The optional curated technology Stack catalog for Genesis projects.",
   "type": "module",
   "repository": {

package/stacks/pieces/jskit.md

@@ -27,6 +27,18 @@ https://mobily-enterprises.github.io/jskit-ai/
   foundation, clone the whole framework repository, inspect unrelated package
   internals, or delegate research unless a concrete failure requires one exact
   investigation.
+- Before writing or reviewing JSKIT server code (a feature, provider, action,
+  service, repository, route, error or test), read the typed features guide at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/typed-features`.
+  `npm run lint` checks its rules through `@jskit-ai/config-eslint`, and each
+  finding links the section that explains it. Fix a finding in the code; excuse
+  one only with the guide's `readable-check: allow` comment and reason prefix.
+  Do not add project rules that repeat or contradict the guide.
+- Before writing or reviewing JSKIT client code (a Vue component, composable or
+  client provider), read the client features guide at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/client-features`.
+  Client code listed in `clientFeaturesConfig` is held to its rules as lint
+  errors, the same way the typed features rules hold server code.
 - When local authentication is selected, ask whether the relevant application
   surfaces are public or login-required and expose
   `AUTH_LOCAL_SESSION_SECRET` as a required environment name in the project's
@@ -41,6 +53,15 @@ https://mobily-enterprises.github.io/jskit-ai/
   `AUTH_DEV_BYPASS_SECRET`, Runtimes `nodejs`) under the web `Outputs` target.
   Which existing accounts the preview uses stays the person's choice; never
   create users for it.
+- Production mode is `NODE_ENV=production`. JSKIT and application code read
+  it; JSKIT never sets it. The proposed Deployment sets it on the Serve step
+  only. Never make it a project-wide default or set
+  it for dependency installation: `npm ci` would then omit the
+  devDependencies the Build step needs, such as Vite. `vite build` sets it for
+  its own process only. In production JSKIT's local authentication requires
+  `AUTH_LOCAL_SESSION_SECRET`, refuses `AUTH_DEV_BYPASS_ENABLED`, and issues
+  `Secure` session and CSRF cookies with the `__Host-` prefix, so the first
+  production-mode start signs everyone out once.
 - Before creating or modifying JSKIT Vue/Vuetify UI, read the Material 3
   contract at
   `https://mobily-enterprises.github.io/jskit-ai/guide/framework/material-3`
@@ -119,6 +140,13 @@ https://mobily-enterprises.github.io/jskit-ai/
   that extra section opaque; the deployment consumer validates it. Older source
   needs a complete project-owned override until a separately approved port
   supplies the current commands.
+- When an established Deployment's Serve step lacks `NODE_ENV=production`, the
+  application has been running in development mode. Add it only when the
+  production environment already holds every value the application's source
+  requires in production mode (for example real email, payment or storage
+  providers instead of simulated ones, and `AUTH_LOCAL_SESSION_SECRET`); the
+  next deployment then starts in production mode, and a missing value stops
+  it from starting.
 - Inspect existing setup and database preparation for both migration discovery
   and an app-owned idempotent seed. Never infer `db:prepare` from the selected
   component when the script or preparation file does not exist.
@@ -133,6 +161,12 @@ https://mobily-enterprises.github.io/jskit-ai/
   locators, and retired tool manifests as migration evidence only. Translate
   live facts into current source/Stack and report remaining port work; do not
   add compatibility readers or claim adoption performed the port.
+- Compare the application's `eslint.config.mjs` with the foundation pattern's:
+  `typedFeaturesConfig` over the server and shared code of each converted
+  package, `sizeLimitsConfig` over all hand-written code and `formatterConfig`.
+  Report the packages not yet listed, and the findings that keep them out, as
+  remaining port work; never lower a rule to `warn` or excuse findings in bulk
+  to make lint pass.
 - Review the proposed `## Resource estimates` section (a host-owned opaque
   section whose grammar belongs to the consuming host) against the application's
   actual Outputs target ids and Workspace setup. Its initial Node development
@@ -163,6 +197,17 @@ https://mobily-enterprises.github.io/jskit-ai/
 - Component root: `src/components`
 - Component root: `packages`
 
+## Architecture inspection
+
+### Inspector `vue`: Application pages, routes and function calls
+- Runtime: `nodejs`
+- Directory: `.`
+- Command: `node` `node_modules/@jskit-ai/shell-web/src/architecture/cli.js` `--alias` `@=src` `--calls`
+- Required files: `node_modules/@jskit-ai/shell-web/src/architecture/cli.js`
+- Timeout seconds: `90`
+- Max output bytes: `67108864`
+- Preview locator: `node_modules/@jskit-ai/architecture-inspector/src/previewLocator.js`
+
 ## City regions
 
 - Ignore `**/test/**`
@@ -211,7 +256,7 @@ https://mobily-enterprises.github.io/jskit-ai/
 - Ready when: `GET` `/api/health` returns `200`
 - Prepare `Install dependencies`: `npm` `ci`
 - Build `Build`: `npm` `run` `build`
-- Serve `Start`: `npm` `start`
+- Serve `Start`: `env` `NODE_ENV=production` `npm` `start`
 
 ## Deslop
 
@@ -220,6 +265,11 @@ https://mobily-enterprises.github.io/jskit-ai/
   and execute its audit.
 - Use JSKIT patterns, packages, resources, composables, screens, and placement
   seams instead of parallel framework plumbing.
+- For affected JSKIT server code, apply the typed features guide at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/typed-features`
+  and leave `npm run lint` without findings: collaborators required and typed,
+  actions one line from `create<Name>Actions`, refusals with their own code,
+  the environment from the caller, files under 750 lines.
 - Treat copied pattern source as app-owned and customizable. Adapt routes,
   placements, and infrastructure tests coherently; when replacing a foundation
   route, update its baseline browser coverage instead of deleting it.