@abeedoo/radish-schemas 1.10.0 → 1.12.0

package/index.js

@@ -31,7 +31,7 @@ export {
  * @property {string} minCliVersion - Minimum radish-cli version compatible with this package
  */
 export const VERSIONING = {
-  packageVersion: '1.10.0',
+  packageVersion: '1.12.0',
   currentSpecVersion: 1,
   supportedSpecVersions: [1],
   minCliVersion: '0.1.0'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abeedoo/radish-schemas",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "description": "Shared JSON schemas, validators, and prompts for Radish CLI ecosystem",
   "main": "index.js",
   "type": "module",

package/prompts/radish-types-generation.md

@@ -127,7 +127,32 @@ The following entities are already provided by the system. DO NOT recreate them
    ```
    `matchUserField` supports array match — if `user.orgIds` is an array, checks if `record.orgId` is in that array.
 
-9. **Enhanced Enums**: Use key-value pairs for better UX:
+9. **Tenancy** (optional): If the app is multi-tenant — every record belongs to an organization, workspace, clinic, or similar — mark that one entity with `"tenant": true`, then declare only the exceptions:
+   ```json
+   {
+     "Org": { "plural": "orgs", "tenant": true, "fields": { ... } },
+     "User": { "plural": "users", "fields": { "orgIds": { "type": "objectId[]", "ref": "Org" } } },
+     "Invoice": { "plural": "invoices", "fields": { "orgId": { "type": "objectId", "ref": "Org", "required": true } } },
+     "Setting": { "plural": "settings", "tenancy": "optional", "fields": { "orgId": { "type": "objectId", "ref": "Org" } } },
+     "AuditLog": { "plural": "auditLogs", "tenancy": "none", "fields": { "orgId": { "type": "objectId", "ref": "Org" } } }
+   }
+   ```
+   Two separate keys, because they answer questions about different entities:
+
+   - **`"tenant": true`** — on the boundary entity itself, and at most one entity per blueprint. `true` is the only valid value; omit the key everywhere else. Nothing is partitioned until some entity declares it. Once declared, every entity with a ref to it is confined automatically — no per-entity declaration needed. `User` must have exactly one field ref-ing it (`objectId[]` if a user can belong to several tenants, `objectId` for exactly one); that field is discovered as the membership field.
+   - **`"tenancy"`** — on a *member* entity, to record an exception:
+     - **absent** (the default): strictly partitioned if it refs the boundary entity. This is the safe state — a forgotten key confines rather than exposes.
+     - **`"optional"`**: partitioned, but rows with NO tenant are visible to everyone — a shared default with per-tenant overrides. Use for settings, templates, categories, feature flags.
+     - **`"none"`**: never confined despite ref-ing the boundary — a tenant id kept for provenance rather than ownership, such as an audit row naming the org an action occurred in.
+   - **Omit both** on ordinary entities, including reference data with no ref to the boundary — those are global by construction, since there is nothing to partition on.
+
+   Do not guess at any of this:
+   - A tenant and a group look identical in a blueprint (an entity, a membership field, an id on the records they cover), but a tenant **confines** results while a group **widens** them. Set `"tenant": true` only when the description actually describes tenant isolation; if it describes teams, clans, or groups that share access, leave these keys off and model it with `scope` instead.
+   - Never infer `"optional"` from the ref field being non-required. A nullable tenant ref means "shared with everyone" in one app and "not backfilled yet, keep hidden" in another — identical shape, opposite intent. Declare `"optional"` only when the description says the rows are genuinely shared.
+
+   Note that `ownership` is a different axis: it says who owns rows (`"user"` or `"system"`), not what partitions them.
+
+10. **Enhanced Enums**: Use key-value pairs for better UX:
    ```json
    {
      "type": "enum",
@@ -139,9 +164,9 @@ The following entities are already provided by the system. DO NOT recreate them
    }
    ```
 
-10. **Performance**: Add `filters` array for searchable fields and `indexes` for performance
+11. **Performance**: Add `filters` array for searchable fields and `indexes` for performance
 
-11. **Nested Objects**: Use `"type": "object"` with `"fields"` for nested structures:
+12. **Nested Objects**: Use `"type": "object"` with `"fields"` for nested structures:
    ```json
    {
      "type": "object",
@@ -153,7 +178,7 @@ The following entities are already provided by the system. DO NOT recreate them
    }
    ```
 
-12. **Search Index** (optional): Enable full-text search with engine-specific adapters:
+13. **Search Index** (optional): Enable full-text search with engine-specific adapters:
     ```json
     {
       "Product": {
@@ -188,6 +213,7 @@ The following entities are already provided by the system. DO NOT recreate them
     - **sync**: `inline` (immediate) or `background` (via jobs)
     - **vector**: Enable vector/embedding search with `sourceFields` to generate embeddings from
     - **searchable**: Each entry is either a plain field name or `{ "field": "name", "stem": true }`. Stemming reduces terms to their word stems at index time (`computers` → `computer`), so a plural query matches singular text as an exact match rather than relying on typo correction. Set `stem: true` only on prose fields (name, description, summary, body). Never stem identifiers (`sku`, `slug`, `code`), brand or category values, anything listed under `filterable`/`facetable`, or non-string fields — stemming a facet value breaks the filter that reads it.
+    - **indexFilter**: A MongoDB-style query object controlling which documents belong in the index, e.g. `{ "status": { "$ne": "discontinued" } }`. Note the delete semantics: it is applied on every create/update sync, and a document that stops matching is **deleted** from the search engine, not merely skipped — a product flipped to `discontinued` disappears from search immediately. Use it for excluding archived, draft, or discontinued records; do not use it for anything a user should be able to filter on themselves (that is `filterable`).
     - **configureBy**: `"rows"` marks an entity whose *records* are vocabulary for other entities' search indexes — each row (or group of rows) becomes a candidate field in the consuming entity's search configuration. Use it for entities that define terminology rather than content: `Attribute`, `Term`, `Tag`, `Taxonomy`. The system discovers code/label fields and grouping refs from the entity's own field definitions, so no extra configuration is needed. A vocabulary entity that is not itself searchable needs only `"search": { "configureBy": "rows" }`; combine with `"enabled": true` when the entity should also have its own index:
       ```json
       "Term": {
@@ -204,7 +230,7 @@ The following entities are already provided by the system. DO NOT recreate them
       }
       ```
 
-13. **Expiration / TTL** (optional): For entities whose records should be purged automatically (sessions, tokens, logs, temporary uploads), use the entity-level `ttl` shorthand:
+14. **Expiration / TTL** (optional): For entities whose records should be purged automatically (sessions, tokens, logs, temporary uploads), use the entity-level `ttl` shorthand:
     ```json
     {
       "Session": {
@@ -224,7 +250,7 @@ The following entities are already provided by the system. DO NOT recreate them
     ]
     ```
 
-14. **Automatic Fields** (DO NOT add these manually):
+15. **Automatic Fields** (DO NOT add these manually):
     - When `"defaults": { "timestamps": true }` is set, `createdAt` and `updatedAt` are added automatically
     - When `"defaults": { "owned": true }` is set, `ownerId` is added automatically
     - Adding these fields manually causes duplication

package/schemas/types.schema.json

@@ -55,9 +55,18 @@
             },
             "ownership": {
               "type": "string",
-              "enum": ["user", "system", "tenant"],
+              "enum": ["user", "system"],
               "default": "user"
             },
+            "tenant": {
+              "const": true,
+              "description": "This entity is the tenancy boundary (Org, Workspace, Clinic). Nothing is partitioned until exactly one entity declares this. Every entity with a ref to it is then confined to the caller's tenants. Only true is valid — omit the key on every other entity. Unrelated to ownership, which says who owns rows rather than what partitions them."
+            },
+            "tenancy": {
+              "type": "string",
+              "enum": ["optional", "none"],
+              "description": "How tenancy applies to THIS entity. Absent (the default): strictly partitioned, if it refs the boundary entity. \"optional\": partitioned, but rows with NO tenant are visible to everyone — a shared default with per-tenant overrides. \"none\": never confined, even though it refs the boundary (a tenant id kept for provenance, not ownership)."
+            },
             "extends": {
               "type": "string",
               "description": "Base type to extend from. Can be EntityBase, SystemEntityBase, ContentBase, or another entity name.",
@@ -177,6 +186,10 @@
                   "type": "string",
                   "enum": ["rows"],
                   "description": "How this entity participates in search configuration. 'rows' means this entity's records are vocabulary for other entities' indexes — each row (or group of rows) becomes a candidate field in the consumer's search config UI. The system discovers code/label fields and grouping refs from the entity's own field definitions. Combinable with enabled: true for entities that are both searchable and vocabulary sources (e.g. Term)."
+                },
+                "indexFilter": {
+                  "type": "object",
+                  "description": "MongoDB-style query object controlling index membership. Documents matching are upserted to the search engine; documents NOT matching are DELETED from it. Applied on every create/update sync — a product flipped to discontinued is removed, not skipped. Example: { \"status\": { \"$ne\": \"discontinued\" } }"
                 }
               }
             },