genesis-stack 1.4.8 → 1.4.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genesis-stack",
-  "version": "1.4.8",
+  "version": "1.4.9",
   "description": "The optional curated technology Stack catalog for Genesis projects.",
   "type": "module",
   "repository": {

package/stacks/pieces/jskit.md

@@ -362,6 +362,46 @@ https://mobily-enterprises.github.io/jskit-ai/
 - Leave `npm run lint` (which reports narrowing in code) and `npx jskit check`
   without findings.
 
+## Security pass
+
+- Read JSKIT's security pass page at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/security-pass`
+  completely: each route's `auth` and `permission`, a table resource's
+  `ownership` and row policy scoping every handle call, `expectScoped()` for
+  another workspace's rows, `rateLimit` and `config.auth.rateLimits`, the
+  first account's setup code, and what `NODE_ENV=production` requires, such as
+  `AUTH_LOCAL_SESSION_SECRET`.
+- Try each refusal through `app.inject` on the test server, then run
+  `npm run verify`.
+
+## User experience pass
+
+- Read JSKIT's user experience pass page at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/ux-pass`
+  completely: main tasks as `shell.primary-nav` placements and each inner
+  page's `jskit.parent`, `ShellPrimaryAction` for a list's New and a record's
+  one filled next step, a new form's `initialValue` or `createModel`,
+  `saveSuccess` for where Save lands, `CrudDeleteAction`'s confirmation, Undo
+  in the snackbar, and the app's words through `useJskitText()`.
+- Walk each main task in the host's managed Preview or a Playwright spec, then
+  run `npm run verify`.
+
+## Speed pass
+
+- Read JSKIT's speed pass page at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/speed-pass`
+  completely: `jskit test` runs test files in parallel within the machine's
+  test budget (`V64_TEST_CONCURRENCY`, else half the CPUs) and ends with its
+  slowest files, `jskit test --databases` restores a stored snapshot for each
+  file, a fixture every file only reads is made once in a
+  `--test-global-setup` module, a client provider exported by its own subpath
+  keeps screens out of every page's first load, and a list reads its related
+  records with `include` and its selected values by `filter[id]` in one
+  request.
+- Compare the whole `npm test` wall time, its slowest files and the build's
+  chunk sizes before and after, then leave `npx jskit check` and
+  `npm run verify` passing.
+
 ## Verification
 
 - Verify `application`: `npm` `run` `verify`