genesis-stack 1.4.4 → 1.4.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genesis-stack",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "The optional curated technology Stack catalog for Genesis projects.",
   "type": "module",
   "repository": {

package/stacks/pieces/jskit.md

@@ -43,7 +43,8 @@ https://mobily-enterprises.github.io/jskit-ai/
   surfaces are public or login-required and expose
   `AUTH_LOCAL_SESSION_SECRET` as a required environment name in the project's
   established environment contract and committed environment example. Never
-  commit or invent its value.
+  commit or invent its value; the proposed Deployment lists it as a generated
+  secret, so the deployment consumer supplies its production value.
 - An application with accounts always has the host's browser-preview login,
   without waiting to be asked: when adding authentication, add the
   `auth/auth-surface` pattern's executable `tools/preview-identity` and copy its
@@ -81,7 +82,12 @@ https://mobily-enterprises.github.io/jskit-ai/
   Routine browser-test startup reuses the isolated test schema, applies only
   pending migrations and resets fixtures deterministically; it does not drop or
   rebuild the database or run a production frontend build per check. Keep
-  fresh-schema migration checks separate.
+  fresh-schema migration checks separate. Integration tests restore
+  `TEST_DB_NAME` from a stored schema snapshot keyed by a digest of the
+  migration sources, as
+  `https://mobily-enterprises.github.io/jskit-ai/guide/app-setup/database-layer#integration-test-databases`
+  describes; list, batch and write paths keep the query budgets of
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/typed-features#budgets-at-realistic-counts`.
 
 - When application integrations are requested or `integrations.json` exists,
   treat that file as the application-owned configuration used by both editor
@@ -144,9 +150,13 @@ https://mobily-enterprises.github.io/jskit-ai/
   application has been running in development mode. Add it only when the
   production environment already holds every value the application's source
   requires in production mode (for example real email, payment or storage
-  providers instead of simulated ones, and `AUTH_LOCAL_SESSION_SECRET`); the
-  next deployment then starts in production mode, and a missing value stops
-  it from starting.
+  providers instead of simulated ones, and `AUTH_LOCAL_SESSION_SECRET` unless
+  the Deployment generates it); the next deployment then starts in production
+  mode, and a missing value stops it from starting.
+- When an established Deployment lacks the proposal's
+  ``- Generated secrets: `AUTH_LOCAL_SESSION_SECRET` `` entry, add it (keeping
+  any names it already lists), so the deployment consumer supplies the
+  production session secret the application never commits.
 - Inspect existing setup and database preparation for both migration discovery
   and an app-owned idempotent seed. Never infer `db:prepare` from the selected
   component when the script or preparation file does not exist.
@@ -253,6 +263,7 @@ https://mobily-enterprises.github.io/jskit-ai/
 
 - Runtimes: `nodejs`
 - Recreate on restore: `node_modules`
+- Generated secrets: `AUTH_LOCAL_SESSION_SECRET`
 - Ready when: `GET` `/api/health` returns `200`
 - Prepare `Install dependencies`: `npm` `ci`
 - Build `Build`: `npm` `run` `build`
@@ -289,6 +300,22 @@ https://mobily-enterprises.github.io/jskit-ai/
 - Remove pass-through wrappers and abandoned scaffold code only when doing so
   preserves routes, placements, baseline tests, and observable behavior.
 
+## UI pass
+
+- Read JSKIT's Material 3 rules at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/material-3`
+  and its UI pass method at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/ui-pass`
+  completely, then follow the method for the resolved scope: the changes, a
+  section, or the whole app.
+- Navigation and Up are must-fix at every scope (#241): plain
+  `npx jskit check`, which `npm run verify` runs, fails on every `nav/*` rule.
+- Run `npx jskit check m3` on the scope (the changed UI files, the section's
+  directory, or no paths for the whole app) until it reports nothing, and
+  `npx jskit check` until it passes.
+- The checks cannot see layout, spacing or contrast; look at every screenshot
+  for those.
+
 ## Verification
 
 - Verify `application`: `npm` `run` `verify`

package/stacks/pieces/vue.md

@@ -44,6 +44,20 @@ conventions. Authoritative framework documentation: https://vuejs.org/
 - Persist user-selected filters and screen context in the URL when they must survive navigation.
 - Test stateful screens by navigating away and back with a warm query cache, including browser back/forward navigation.
 
+## UI pass
+
+- In a JSKIT application the `jskit` component's UI pass guidance governs.
+- For a Vue application on Vuetify, follow JSKIT's Material 3 rules at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/material-3`
+  and the scopes of its UI pass method at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/ui-pass`, as far
+  as they apply outside JSKIT: the Material 3 foundation, exact sizes, colour,
+  lists, records and forms, adaptive layout, and one Up arrow without
+  history-based back links. JSKIT's shell, navigation and `jskit check` apply
+  only to JSKIT applications.
+- With another component library, keep that library and the project's design
+  system, and apply the same scopes and evidence.
+
 ## Adoption
 
 - Identify the real client entrypoint, router, build tool, development command,