@antelopejs/interface-dms 0.7.3 → 0.8.0

package/docs/3.base/5.charts-and-widgets.md

@@ -313,10 +313,11 @@ const card = ChartCard({
 | `currencyCode` | `string` | Currency for `valueFormat: "currency"`. |
 | `valuePrecision` | `ValuePrecision` | Fixed fraction digits or `"native"` Intl defaults; omitted keeps legacy formatting. Also applies to the previous value and nested chart's value axis and tooltip. |
 | `showDelta` | `boolean` | Show the change against the comparison period. |
+| `invert` | `boolean` | Treat an increase as bad — for metrics where lower is better. |
 | `showLegend` | `boolean` | Show the primary / comparison legend. Defaults to `true`. |
 | `showSeriesLegend` | `boolean` | Show the nested chart's legend, naming each series. Defaults to `false`. |
 | `primaryLabel` | `string` | Label of the primary series. |
-| `comparisonLabel` | `string` | Label of the comparison series. |
+| `comparisonLabel` | `string` | Label of the comparison series. Without it, a card with a `periodScope` names the selected comparison ("Previous year"). |
 
 ## KpiCard
 
@@ -345,17 +346,20 @@ const denied = KpiCard({
 | `icon` | `string` | Card icon. Defaults to `"i-ph-trend-up"` for the component metadata. |
 | `fetchUrl` | `string` | URL the card loads its value from. |
 | `fetchUrlMethod` | `HttpMethod` | Method for `fetchUrl`. |
-| `periodScope` | `string` | Id of the `PeriodSelector` to follow. |
+| `periodScope` | `string` | Id of the `PeriodSelector` to follow. Its comparison names the change; "No comparison" hides the change, the comparison value and the label. |
+| `realtimeTopic` | `string \| string[]` | Topics whose events make the card read `fetchUrl` again, through the page's `live` gate. The builder registers them on the page. |
 | `valueFormat` | `ValueFormat` | How the value is formatted. |
 | `currencyCode` | `string` | Currency for `valueFormat: "currency"`. |
 | `valuePrecision` | `ValuePrecision` | Fixed fraction digits or `"native"` Intl defaults; omitted keeps legacy formatting. |
 | `showDelta` | `boolean` | Show the change against the comparison period. |
+| `showPreviousValue` | `boolean` | Show the route's `previousValue` next to the change ("vs €42,900"), formatted as the value. Defaults to `true`. |
 | `showSparkline` | `boolean` | Show the sparkline. |
 | `sparklineAccent` | `ChartColorValue \| "auto"` | Sparkline colour. |
 | `invert` | `boolean` | Treat an increase as bad — for metrics where lower is better. |
-| `compareLabel` | `string` | Label next to the delta. |
+| `compareLabel` | `string` | Label next to the delta. Without it (and without `description`), a card with a `periodScope` names the selected comparison ("vs previous year"). Shown with the delta only: with no comparison, the `description` shows instead. |
 | `staticValue` | `number` | Inline value, as an alternative to `fetchUrl`. |
 | `staticDelta` | `number` | Inline delta, in percent (`12.5` reads +12.5 %). |
+| `staticPreviousValue` | `number` | Inline value compared against, as a fetched `previousValue`. |
 | `staticSparkline` | `number[]` | Inline sparkline points. |
 
 ## TopListCard
@@ -450,7 +454,7 @@ const selector = PeriodSelector({
 | `size` | `"xs" \| "sm" \| "md" \| "lg" \| "xl"` | Control size. |
 | `showRangeLabel` | `boolean` | Show the resolved date range as text. |
 | `rangeLabel` | `PeriodRangeLabel` | `"absolute"` (default): both bounds. `"relative"`: the start of a window reaching now, "since yesterday 11:52". |
-| `comparisonControl` | `PeriodComparisonControl` | `"menu"`, `"toggle"` (one inline button switching a comparison on and off) or `"hidden"` (nothing drawn, the comparison kept on). Defaults to `"toggle"` when `comparisons` offers a single comparison besides `"none"`, `"menu"` otherwise. |
+| `comparisonControl` | `PeriodComparisonControl` | `"menu"`, `"toggle"` (one inline button switching a comparison on and off) or `"hidden"` (nothing drawn, the comparison kept on). Defaults to `"toggle"` when `comparisons` offers a single comparison besides `"none"`, `"menu"` otherwise. The menu's trigger names the compared window ("vs 16 – 17 Oct", the option's name in its tooltip and its list), so the range label beside it keeps the current window only. |
 | `rememberKey` | `string` | Selectors carrying the same key share the remembered last choice, on any page. |
 | `variant` | `PeriodSelectorVariant` | `"default"` or `"segmented"`. |
 | `maxDays` | `number` | The longest custom range, in days (both ends included), the user can pick in the calendar or the date fields. Presets and a range given by the URL are not limited. |

package/docs/3.base/6.layout.md

@@ -195,6 +195,7 @@ export class OverviewPage extends PageController(
 | `hideHeader` | `boolean` | Omit the page header. |
 | `fillHeight` | `boolean` | Let the page fill the height of the panel instead of growing with its content, for a tool that scrolls inside itself — see [Pages that fill the panel](#pages-that-fill-the-panel). Defaults to `false`. |
 | `headerActions` | `CustomButton[]` | Buttons right of the page title, in order — see [Header actions](#header-actions). |
+| `record` | `PageRecordSource` | The record the page shows (`{ fetchUrl }`), which header buttons act on — see [Buttons acting on the page's record](#buttons-acting-on-the-pages-record). |
 
 Dashboard pages are full-width unless they opt out, which is what a table, a grid of cards or a chart wants. Set `fullWidth: false` for a page that only holds a form, where a constrained column stays readable — or use `FormPageLayout`, which is exactly that:
 
@@ -275,7 +276,7 @@ A page scoped by its URL — `?workspace=web`, a record id in the path — decla
 
 A label's translation takes the page's route and query parameters as its own (a query parameter wins over a route parameter of the same name), so `"Download {locale}.json"` names the language of `?locale=fr` and follows it as the URL changes.
 
-An `availability` receives the page URL's query as `context.query` (one value per name; caller-supplied, so check it like any input). The header asks again whenever the query changes — only when one of its buttons declares an `availability` — and keeps the buttons it has until the answer lands. The keys the DMS writes for the view itself never cause a request: `record` (the row open in a side panel), `live` (the paused live mode) and a period selector's `<id>.period`, `<id>.compare`, `<id>.from`, `<id>.to`, `<id>.compareFrom` and `<id>.compareTo`. A query key may carry dots, so `{{query.api.period}}` reads a period selector's choice.
+An `availability` receives the page URL's query as `context.query` (one value per name; caller-supplied, so check it like any input) and its route parameters as `context.params` (`/projects/project/p1` on a page registered at `/projects/project/:id` is `{ id: "p1" }`). The header asks again whenever the query or the route parameters change — only when one of its buttons declares an `availability` — and keeps the buttons it has until the answer lands. The keys the DMS writes for the view itself never cause a request: `record` (the row open in a side panel), `live` (the paused live mode) and a period selector's `<id>.period`, `<id>.compare`, `<id>.from`, `<id>.to`, `<id>.compareFrom` and `<id>.compareTo`. A query key may carry dots, so `{{query.api.period}}` reads a period selector's choice.
 
 ```typescript
 DefaultLayout({
@@ -301,6 +302,26 @@ A table view of the page places its own buttons in the header with `placement: "
 
 Who sees a button is settled on the server when the layout is served: a button whose `permission` or `permissionId` the user lacks is left out of the layout, and a quick-action button only shows to the users the quick action is served to — that is, the users its page admits. A page drawn by a Vue page component can add its own buttons next to these with `usePageHeaderActions`; call it before the first `await` of the component's setup, so the server renders the buttons with the page and they never pop in. A page whose changes save as soon as they are made shows the shared **Saved instantly** pill there with `useInstantSaveHeader` ([Instant save or a save bar](/docs/components/lists-and-settings/section#instant-save-or-a-save-bar)).
 
+#### Buttons acting on the page's record
+
+A page about one record (a site, an invoice) declares it with `record: { fetchUrl }` — typically its controller's `get` route, `{{params.X}}` and `{{query.X}}` filled in from the page URL. The browser reads it for the header, and a button's target names its fields as `{{record.X}}`, percent-encoded: a maps link to the site's address, an API call on its own id. A button acting on the record — one whose target names `{{record.X}}`, or declaring `requiresRecord: true` (an "Edit" link that only needs `{{params.id}}`) — is disabled while the record loads, and left out of a page whose record cannot be read (not found, refused). The other buttons never wait for it:
+
+```typescript
+DefaultLayout({
+  record: { fetchUrl: "/api/sites/get?id={{params.id}}" },
+  headerActions: [
+    {
+      label: "$sites.directions",
+      icon: "i-ph-map-pin",
+      target: { type: "external", url: "https://www.google.com/maps/search/?api=1&query={{record.address}}", newTab: true },
+    },
+    { label: "$sites.edit", requiresRecord: true, target: { type: "page", url: "/sites/{{params.id}}/edit" } },
+  ],
+});
+```
+
+The record is read like a block's `fetchUrl` (`useApiData`, keyed on the URL): a block of the page reading the same URL — the `ResourceForm` or `KeyValueList` showing the record — shares the one request, and a server render hands it to the browser with the page. Its fields only shape the buttons; the route behind each one still checks the record on its own.
+
 #### Hidden or disabled
 
 An `availability` has three answers. `undefined` leaves the button as declared, `{ reason }` disables it with the reason in a tooltip — for something the user can change ("No seat left: upgrade the plan") — and `{ hidden: true }` leaves it out of the header, as a missing permission does — for a button that makes no sense in the scope the page shows. Like a disabled one, a hidden button follows the page URL: the header asks again when the query changes, so a button can disappear on one `?workspace=` and come back on another, and the server-rendered header already carries the answer for the URL it was rendered for.
@@ -320,6 +341,22 @@ DefaultLayout({
 });
 ```
 
+A detail page reads its record from `context.params`, and hides the buttons that act on it when the record does not exist — the page then shows its "not found" state with no "Edit" or "Delete" beside the title:
+
+```typescript
+DefaultLayout({
+  headerActions: [
+    {
+      id: "edit",
+      label: "$projects.edit",
+      target: { type: "page", url: "/projects/project/{{params.id}}/edit" },
+      availability: async ({ params }) =>
+        (await projectExists(params?.id)) ? undefined : { hidden: true },
+    },
+  ],
+});
+```
+
 Hiding only shapes the UI: the route behind the button must still refuse the operation on its own.
 
 #### Ordering the header

package/docs/3.base/8.data-types.md

@@ -73,6 +73,7 @@ abstract class DataType {
   filter(context, proxy, key, value, mode, row): ValueProxyOrValue<boolean>;
   filterComponents(): Record<string, ComponentInfoSerialized> & { default: ComponentInfoSerialized };
   inputComponent(): ComponentInfoSerialized;
+  describedInputComponent(): ComponentInfoSerialized;
   decorateField?(target: unknown, key: PropertyKey, descriptor?: PropertyDescriptor): void;
 }
 ```
@@ -85,6 +86,7 @@ abstract class DataType {
 | `defaultInputComponent()` | Abstract. Returns the input component the type renders. Implemented by every concrete type. |
 | `getValidation()` | Abstract. Returns the Zod schema for one value of this type, before the field-level adaptation described in [Forms](/docs/interfaces/base/forms). |
 | `inputComponent()` | The form input. Defaults to `defaultInputComponent()`. |
+| `describedInputComponent()` | The input as it is described where nothing is entered through it: a table column's type (its cells, cards and quick filters read the options) and a read-only form field. Defaults to `inputComponent()`; a type leaves out what only an editable control uses, as a relation leaves out its add form. |
 | `filterComponents()` | The filter inputs, keyed by compare-mode id with a mandatory `default`. Defaults to `{ default: defaultInputComponent() }`. |
 | `filter()` | Applies a filter for one compare mode. The base implementation looks the mode up in the compare-mode registry and delegates to it; a type overrides it when a mode needs different semantics. |
 | `decorateField()` | Optional. Called by the `@Column` decorator so the type can add further decorators to the field — this is how the relation types install their join. |
@@ -207,7 +209,7 @@ function serializeType(instance?: DataType): DataTypeSerialized | undefined;
 | `compareModes` | `string[]` | Ids of the type's compare modes; unregistered ones are dropped. |
 | `defaultCompareMode` | `string` | Id of the default mode. |
 | `filterComponents` | `Record<string, FilterComponent>` | Filter inputs by mode id, from `filterComponents()`, with every `noInput` mode's entry replaced by the literal `"noInput"`. |
-| `inputComponent` | `ComponentInfoSerialized` | The form input, from `inputComponent()`. |
+| `inputComponent` | `ComponentInfoSerialized` | The input the column's cells and quick filters read the options of, from `describedInputComponent()`. |
 
 `FilterComponent` is `ComponentInfoSerialized | "noInput"`. The value-level counterpart, `ComponentOrNoInput`, is described in [Shared Types](/docs/interfaces/base/types).
 
@@ -232,7 +234,7 @@ function serializeType(instance?: DataType): DataTypeSerialized | undefined;
 | `NotContains` | `not_contains` | value |
 | `ArrayContainsString` | `array_contains_string` | value |
 
-`IsEmpty` and `IsNotEmpty` are the two registered with `noInput`. The namespace also exports `escapeRegex(str: string): string`, the helper the substring modes use to make a viewer-supplied value safe inside a pattern.
+`IsEmpty` and `IsNotEmpty` are the two registered with `noInput`. `Include`, `Exclude` and `ArrayContainsString` read a `null` or missing list as an empty one, so a row saved without a value never fails the query: it is left out by `include` and `array_contains_string`, and kept by `exclude`. The namespace also exports `escapeRegex(str: string): string`, the helper the substring modes use to make a viewer-supplied value safe inside a pattern.
 
 ## The Default Types
 
@@ -264,12 +266,13 @@ function serializeType(instance?: DataType): DataTypeSerialized | undefined;
 
 | Options interface | Fields |
 | --- | --- |
-| `StringTypeOptions` | `placeholder?`, `maxLength?`, `minLength?`, `showCount?`, `textarea?`, `rows?`, `fallback?` |
-| `NumberTypeOptions` | `min?`, `max?`, `step?`, `placeholder?`, `suffix?`, `fallback?` |
+| `StringTypeOptions` | `placeholder?`, `maxLength?`, `minLength?`, `showCount?`, `textarea?`, `rows?`, `width?`, `fallback?` |
+| `NumberTypeOptions` | `min?`, `max?`, `step?`, `placeholder?`, `suffix?`, `width?`, `fallback?` |
 | `DateTypeOptions` | `range?`, `multiple?`, `minDate?`, `maxDate?`, `fallback?` |
 | `BooleanTypeOptions` | `fallback?` |
 | `SelectTypeOptions` | `items: FormComponents.SelectOption[]`, `placeholder?`, `multiple?`, `deselectable?`, `display?`, `columns?` (cards per row of the `cards` display, 2 by default), `fallback?` |
-| `EmailTypeOptions`, `ColorTypeOptions`, `UrlTypeOptions`, `RichTextTypeOptions` | `placeholder?`, `fallback?` |
+| `EmailTypeOptions`, `ColorTypeOptions`, `RichTextTypeOptions` | `placeholder?`, `fallback?` |
+| `UrlTypeOptions` | `placeholder?`, `preview?` (`"avatar"` \| `"image"`: shown read-only, the URL is drawn as the image it points to; the form still edits it as text), `fallback?` |
 | `PasswordTypeOptions` | `placeholder?`, `minLength?`, `confirmPassword?`, `confirmPlaceholder?`, `fallback?` |
 | `PhoneTypeOptions` | `placeholder?`, `requiredPrefix?`, `fallback?` |
 | `StringTimeTypeOptions` | `placeholder?`, `min?`, `max?`, `fallback?` |
@@ -279,6 +282,7 @@ Notes on the ones whose behaviour is not obvious from the options:
 - `StringType` renders a textarea instead of a single-line input when `textarea` is set, and passes `rows` to it.
 - `StringType` with `showCount` shows the characters typed, out of `maxLength` when set ("4 / 60"), in its input or under its textarea.
 - `NumberType` hands `suffix` (an i18n key with `$`, or a literal) to its input, which writes it after the field; the value stays a number. `PriceType` inherits it; `PercentageType` keeps its own `%`.
+- `NumberType` (and the types extending it) and a single-line `StringType` hand `width` (`FormComponents.InputWidth`) to their input: `"compact"` sizes it for a short value from `sm` up, `"full"` fills the row, and left out the input is compact when `min` / `max` fit in 6 digits or `maxLength` is 16 or less.
 - `DateType` overrides `filter` so `is`, `is_not` and `is_between` compare whole UTC days rather than instants, and adds a range picker as the filter component for `is_between`. Its schema accepts a `Date` or an ISO-shaped string and transforms it to a `Date`; with `multiple` the value becomes an array, and with `range` it becomes `{ start, end }`, `end` on or after `start` (a pair `[start, end]` is still read and validates to the same object).
 - `BooleanType` uses a two-option select as its filter component, so a viewer picks "checked"/"unchecked" rather than typing a value.
 - `SelectType` validates against the `value`s of its `items`, as an enum or an array of that enum when `multiple` is set.
@@ -317,9 +321,12 @@ declare customerId: string;
 | `deselectable` | `boolean` | Allow clearing the selection. |
 | `filterOnly` | `boolean` | Skip the join entirely: the raw scalar id stays in the list output and the funnel filter runs equality on it. |
 | `addForm` | `{ displayName?: string; description?: string }` | Title and description of the drawer the picker's "add" entry opens ("New customer"). `$`-prefixed: i18n keys. Default to "New entry". |
+| `filterBy` | `{ field, from }` | List only the target rows whose `field` equals the form's current value of the field `from`, e.g. `{ field: "customerId", from: "customerId" }` for a site among its customer's sites. `field` must be filterable on the target (`filterable: true` or `@Filter`); `decorateField` throws otherwise. |
 | `fallback` | `string` | Text used in place of an empty value. |
 
-When the target controller exposes a `new` endpoint and has form fields, the picker also carries an inline "add" form built from the target's `new` fields, plus the permission id of the target's `add` action.
+With `filterBy`, the picker sends the table filter syntax to the `select` endpoint (`filter_<field>=is:<value>`), which honors only the filters the target controller declares. It searches again when `from` changes and clears a pick made for its previous value; the pair a record loaded with is kept, and while `from` is empty every row is offered. It narrows what is offered only: a rule that must hold on save belongs to the module's routes.
+
+When the target controller exposes a `new` endpoint and has form fields, the picker of an editable form field also carries an inline "add" form built from the target's `new` fields, plus the permission id of the target's `add` action. That form is the bulk of the component — the target's fields, its validation schema, its own relations' add forms — so a table column's type, its filter and a read-only field leave it out: they read the related rows through the `select` route, and a filter only picks among them.
 
 `CascaderRelationType<T>` is the same idea for a self-referencing table: the target's `select` endpoint returns a flat list, and the widget rebuilds the tree client-side. Its `keyMapping` is required and adds `parent` — the field pointing at the parent row, which must itself carry `@Select()` — alongside the required `label` and `value`. It adds `maxDepth` and `leafOnly` to the relation options, and supports the same `filterOnly` behaviour. In a table cell it shows the path of the picked node ("Electronics / Audio"); a `multiple` one shows a badge per picked node, named by its own label with its path on hover, and folds those past three into `+N`.
 
@@ -338,7 +345,7 @@ When the target controller exposes a `new` endpoint and has form fields, the pic
 | `addressLine2` | no | Supplementary delivery information. |
 | `countrySubdivision` | no | Region, state or province. |
 
-The type's options are `placeholder` (one string per address component), `autocomplete`, an optional `dataApiController` with a `keyMapping` of `label` / `value` for picking an existing address, and `fallback`. `AddressAutocomplete` configures the geocoder:
+The type's options are `placeholder` (one string per address component), `autocomplete`, `defaultCountry` (the ISO 3166-1 alpha-2 country shown while the address has none and whose places the street suggestions list first, written with the first part typed: an address left empty stays empty), an optional `dataApiController` with a `keyMapping` of `label` / `value` for picking an existing address, and `fallback`. `AddressAutocomplete` configures the geocoder:
 
 | Option | Type | Description |
 | --- | --- | --- |

package/docs/4.notifications/3.sending.md

@@ -33,7 +33,7 @@ A `SendableNotification` is immutable and holds no recipient, so you can build o
 | `toUser` | `(userId: string, options?: SendOptions) => Promise<void>` | Send to one user. |
 | `toUsers` | `(userIds: string[], options?: SendOptions) => Promise<void>` | Send to a list of users. |
 | `toUsersIdempotently` | `(userIds: string[], idempotencyKey: string, options?: SendOptions) => Promise<void>` | Send a durable event once per recipient, including after dismissal. |
-| `toRoles` | `(roleIds: string[], options?: SendOptions) => Promise<void>` | Send to every user holding at least one of the roles. |
+| `toRoles` | `(roleIds: string[], options?: RoleSendOptions) => Promise<void>` | Send to every user holding at least one of the roles, in `options.tenantId` when set. |
 | `broadcast` | `(options?: SendOptions) => Promise<void>` | Send to every user. |
 
 ## Building a Notification
@@ -146,10 +146,10 @@ await shipped.toUsers([ownerId, managerId], { readScope: "shared" });
 `toRoles(roleIds, options?)` resolves the users that hold any of the given roles and sends to them. An empty `roleIds` array sends nothing, and so does a set of roles nobody holds.
 
 ```typescript
-await shipped.toRoles([adminRoleId], { readScope: "shared" });
+await shipped.toRoles([adminRoleId], { readScope: "shared", tenantId });
 ```
 
-Role ids are the DMS role identifiers described in the DMS tenancy and permissions guide; membership is resolved across tenants, so a user holding the role in any tenant is included.
+Role ids are the DMS role identifiers described in the DMS tenancy and permissions guide, and they belong to a tenant. `tenantId` (`RoleSendOptions`) restricts the recipients to that tenant's members; without it, membership is resolved across tenants, so a user holding the role in any tenant is included.
 
 ## Broadcasting
 
@@ -168,6 +168,7 @@ Every dispatch method accepts an optional `SendOptions` object.
 | `readScope` | `ReadScope` (optional) | Read-state grouping for a multi-recipient send. Defaults to `"individual"` — see [Read Scope](/docs/interfaces/notifications/categories-and-subjects#read-scope). |
 | `idempotencyKey` | `string` (optional) | Stable event key, unique across producers: prefix it with your module ID. Reusing it for a recipient preserves the original notification and dismissal state. |
 | `dedupe` | `boolean` (optional) | `false` stores every unkeyed send, even one identical to a notification the recipient got less than 10 seconds earlier. Defaults to `true`; see below. |
+| `tenantId` | `string` (optional, `toRoles` only: `RoleSendOptions`) | Only the members of this tenant holding the roles; every tenant when unset. |
 
 Pick `"shared"` for alerts that only need one person to act on them, and `"individual"` for anything each recipient has to see for themselves.
 

package/docs/5.html-render/1.introduction.md

@@ -255,7 +255,7 @@ Types the `htmlRender` block of the DMS module configuration in `antelope.config
 | Option | Type | Description |
 | ------ | ---- | ----------- |
 | `renderEndpoint` | `string` | Absolute URL `GenerateHtml` posts to. Default `http://localhost:3001/api/html/render`. |
-| `serviceSecret` | `string` | Secret used to sign the service token that authenticates the render call. Default `"dev"` — set a strong value in production. |
+| `serviceSecret` | `string` | Secret used to sign the service token that authenticates the render call. Default `"dev"`, which the DMS refuses in production. |
 | `serviceTokenLifetime` | `number` | Lifetime of that service token, in milliseconds. The frontend render server rejects a token valid for more than five minutes. Default `300000` (5 minutes). |
 
 The DMS merges the block you supply over those defaults, so a configuration only needs the keys it changes:
@@ -263,13 +263,12 @@ The DMS merges the block you supply over those defaults, so a configuration only
 ```typescript
 import { defineConfig } from "@antelopejs/interface-core/config";
 
-const renderSecret = process.env.DMS_HTML_RENDER_SECRET;
-if (!renderSecret) {
-  throw new Error("DMS_HTML_RENDER_SECRET is not set");
-}
-
 export default defineConfig({
   name: "acme-admin",
+  // Read at start; a production start without it is refused by the DMS.
+  envOverrides: {
+    DMS_HTML_RENDER_SECRET: "modules.dms.config.htmlRender.serviceSecret",
+  },
   modules: {
     dms: {
       source: {
@@ -280,7 +279,6 @@ export default defineConfig({
       config: {
         htmlRender: {
           renderEndpoint: "https://admin.example.com/api/html/render",
-          serviceSecret: renderSecret,
         },
       },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/interface-dms",
-  "version": "0.7.3",
+  "version": "0.8.0",
   "description": "Public AntelopeJS interfaces of the DMS: pages, components, permissions, tenancy, auth, notifications and HTML rendering.",
   "keywords": [
     "antelopejs",
@@ -45,7 +45,6 @@
     "knip:all": "knip"
   },
   "dependencies": {
-    "jsonwebtoken": "^9.0.3",
     "randomstring": "^1.3.1",
     "zod": "~3.24.2",
     "zod-to-json-schema": "~3.24.6"
@@ -53,9 +52,8 @@
   "peerDependencies": {
     "@antelopejs/interface-api": ">=0.0.15 <1.0.0",
     "@antelopejs/interface-api-util": ">=0.1.3 <1.0.0",
-    "@antelopejs/interface-auth": ">=0.0.7 <1.0.0",
     "@antelopejs/interface-core": ">=0.2.4 <1.0.0",
-    "@antelopejs/interface-data-api": ">=0.2.2 <1.0.0",
+    "@antelopejs/interface-data-api": ">=0.3.0 <1.0.0",
     "@antelopejs/interface-database": ">=0.1.10 <1.0.0",
     "@antelopejs/interface-database-decorators": ">=0.1.9 <1.0.0",
     "@antelopejs/interface-file-storage": ">=0.1.4 <1.0.0"
@@ -63,13 +61,11 @@
   "devDependencies": {
     "@antelopejs/interface-api": ">=0.0.15 <1.0.0",
     "@antelopejs/interface-api-util": ">=0.1.3 <1.0.0",
-    "@antelopejs/interface-auth": ">=0.0.7 <1.0.0",
     "@antelopejs/interface-core": ">=0.2.4 <1.0.0",
-    "@antelopejs/interface-data-api": ">=0.2.2 <1.0.0",
+    "@antelopejs/interface-data-api": ">=0.3.0 <1.0.0",
     "@antelopejs/interface-database": ">=0.1.10 <1.0.0",
     "@antelopejs/interface-database-decorators": ">=0.1.9 <1.0.0",
     "@antelopejs/interface-file-storage": ">=0.1.4 <1.0.0",
-    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^24.0.0",
     "@types/randomstring": "^1.3.0",
     "knip": "^6.34.0",