@abeedoo/radish-schemas 1.11.0 → 1.12.0

package/index.js

@@ -31,7 +31,7 @@ export {
  * @property {string} minCliVersion - Minimum radish-cli version compatible with this package
  */
 export const VERSIONING = {
-  packageVersion: '1.11.0',
+  packageVersion: '1.12.0',
   currentSpecVersion: 1,
   supportedSpecVersions: [1],
   minCliVersion: '0.1.0'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abeedoo/radish-schemas",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "Shared JSON schemas, validators, and prompts for Radish CLI ecosystem",
   "main": "index.js",
   "type": "module",

package/prompts/radish-types-generation.md

@@ -127,19 +127,30 @@ The following entities are already provided by the system. DO NOT recreate them
    ```
    `matchUserField` supports array match — if `user.orgIds` is an array, checks if `record.orgId` is in that array.
 
-9. **Tenancy** (optional): If the app is multi-tenant — every record belongs to an organization, workspace, clinic, or similar — mark that one entity as the boundary:
+9. **Tenancy** (optional): If the app is multi-tenant — every record belongs to an organization, workspace, clinic, or similar — mark that one entity with `"tenant": true`, then declare only the exceptions:
    ```json
    {
-     "Org": { "plural": "orgs", "tenancy": "boundary", "fields": { ... } },
+     "Org": { "plural": "orgs", "tenant": true, "fields": { ... } },
      "User": { "plural": "users", "fields": { "orgIds": { "type": "objectId[]", "ref": "Org" } } },
-     "Invoice": { "plural": "invoices", "fields": { "orgId": { "type": "objectId", "ref": "Org", "required": true } } }
+     "Invoice": { "plural": "invoices", "fields": { "orgId": { "type": "objectId", "ref": "Org", "required": true } } },
+     "Setting": { "plural": "settings", "tenancy": "optional", "fields": { "orgId": { "type": "objectId", "ref": "Org" } } },
+     "AuditLog": { "plural": "auditLogs", "tenancy": "none", "fields": { "orgId": { "type": "objectId", "ref": "Org" } } }
    }
    ```
-   - **`"boundary"`**: at most one entity per blueprint. Every entity with a ref to it is automatically confined to the caller's active tenant — no per-entity declaration needed. `User` must have exactly one field ref-ing it (`objectId[]` if a user can belong to several tenants, `objectId` for exactly one); that field is discovered automatically as the membership field.
-   - **`"global"`**: for an entity that refs the boundary entity but must NOT be confined by it — a tenant id recorded for provenance rather than ownership, such as an audit row naming the org an action occurred in that admins read across orgs. Rare; only needed when the ref exists.
-   - **Omit entirely** for ordinary entities, including reference data with no ref to the boundary entity — those are global by construction, since there is nothing to partition on.
+   Two separate keys, because they answer questions about different entities:
 
-   Do not guess at this. A tenant and a group look identical in a blueprint (an entity, a membership field, an id on the records they cover), but a tenant **confines** results while a group **widens** them. Mark `"boundary"` only when the app description actually describes tenant isolation; if it describes teams, clans, or groups that share access, leave `tenancy` off and model it with `scope` instead.
+   - **`"tenant": true`** — on the boundary entity itself, and at most one entity per blueprint. `true` is the only valid value; omit the key everywhere else. Nothing is partitioned until some entity declares it. Once declared, every entity with a ref to it is confined automatically — no per-entity declaration needed. `User` must have exactly one field ref-ing it (`objectId[]` if a user can belong to several tenants, `objectId` for exactly one); that field is discovered as the membership field.
+   - **`"tenancy"`** — on a *member* entity, to record an exception:
+     - **absent** (the default): strictly partitioned if it refs the boundary entity. This is the safe state — a forgotten key confines rather than exposes.
+     - **`"optional"`**: partitioned, but rows with NO tenant are visible to everyone — a shared default with per-tenant overrides. Use for settings, templates, categories, feature flags.
+     - **`"none"`**: never confined despite ref-ing the boundary — a tenant id kept for provenance rather than ownership, such as an audit row naming the org an action occurred in.
+   - **Omit both** on ordinary entities, including reference data with no ref to the boundary — those are global by construction, since there is nothing to partition on.
+
+   Do not guess at any of this:
+   - A tenant and a group look identical in a blueprint (an entity, a membership field, an id on the records they cover), but a tenant **confines** results while a group **widens** them. Set `"tenant": true` only when the description actually describes tenant isolation; if it describes teams, clans, or groups that share access, leave these keys off and model it with `scope` instead.
+   - Never infer `"optional"` from the ref field being non-required. A nullable tenant ref means "shared with everyone" in one app and "not backfilled yet, keep hidden" in another — identical shape, opposite intent. Declare `"optional"` only when the description says the rows are genuinely shared.
+
+   Note that `ownership` is a different axis: it says who owns rows (`"user"` or `"system"`), not what partitions them.
 
 10. **Enhanced Enums**: Use key-value pairs for better UX:
    ```json

package/schemas/types.schema.json

@@ -55,13 +55,17 @@
             },
             "ownership": {
               "type": "string",
-              "enum": ["user", "system", "tenant"],
+              "enum": ["user", "system"],
               "default": "user"
             },
+            "tenant": {
+              "const": true,
+              "description": "This entity is the tenancy boundary (Org, Workspace, Clinic). Nothing is partitioned until exactly one entity declares this. Every entity with a ref to it is then confined to the caller's tenants. Only true is valid — omit the key on every other entity. Unrelated to ownership, which says who owns rows rather than what partitions them."
+            },
             "tenancy": {
               "type": "string",
-              "enum": ["boundary", "global"],
-              "description": "\"boundary\": this entity is the tenancy boundary (Org, Workspace, Clinic) — every entity with a ref to it is confined to the caller's active tenant. \"global\": this entity has a ref to the boundary entity but is NOT confined by it (a tenant id kept for provenance, not ownership). Absent: ordinary — confined if it refs the boundary entity, unconstrained if it does not."
+              "enum": ["optional", "none"],
+              "description": "How tenancy applies to THIS entity. Absent (the default): strictly partitioned, if it refs the boundary entity. \"optional\": partitioned, but rows with NO tenant are visible to everyone — a shared default with per-tenant overrides. \"none\": never confined, even though it refs the boundary (a tenant id kept for provenance, not ownership)."
             },
             "extends": {
               "type": "string",