@declarion/react 0.9.0 → 0.10.0

package/dist-lib/types/schema.d.ts

@@ -256,6 +256,17 @@ export interface EntityMutations {
     delete?: boolean;
     restore?: boolean;
 }
+/** A set of CRUD op flags, each present or absent. The YAML-decoded shape of
+ *  an entity's `public` opt-out block (deny-by-default authorization, plan
+ *  2026-06-17). A flag being true means that op is open to ALL authenticated
+ *  callers with no grant required. Mirrors engine.OpSet. On the /api/schema
+ *  wire it always serializes as this object (never a bare bool, even though
+ *  YAML accepts `public: true`). */
+export interface OpSet {
+    read?: boolean;
+    write?: boolean;
+    delete?: boolean;
+}
 export interface Entity {
     table: string;
     primary_key?: string[];
@@ -299,14 +310,22 @@ export interface Entity {
      *  OR `$caller.*` expressions (`$caller.user_id`, `$caller.tenant_id`)
      *  resolved at request time. Security boundary, not a UX hint. */
     prefilter?: Record<string, unknown>;
-    /** Hard entity-wide access gate. `"self"` restricts every read/write
-     *  to rows where the field marked `owner: true` matches the caller's
-     *  user id (chokepoint + with_check). `"platform_admin"` restricts to
-     *  platform owner / superadmin roles. Empty = standard RBAC. */
-    access?: "self" | "platform_admin";
-    /** Whether the entity participates in RBAC permission gating
-     *  (`entity:<code>:<op>` grants). Mirrors engine.Entity.Permissions. */
-    permissions?: boolean;
+    /** Hard entity-wide access tier gate (checked BEFORE the deny-by-default
+     *  read/write decision). `"self"` restricts every read/write to rows where
+     *  the field marked `owner: true` matches the caller's user id (chokepoint +
+     *  with_check). `"tenant_admin"` admits any administrative standing in the
+     *  active tenant (superadmin / tenant_owner / any role grant). `"superadmin"`
+     *  admits only the platform-wide god flag. Empty = no tier floor (standard
+     *  RBAC). The legacy `"platform_admin"` alias was removed (plan 2026-06-17). */
+    access?: "self" | "tenant_admin" | "superadmin";
+    /** Deny-by-default authorization (plan 2026-06-17). Absent = every op
+     *  requires its `entity:<code>:<op>` grant. `public.<op>: true` opts that op
+     *  out of the grant requirement, opening it to all authenticated callers
+     *  (NOT anonymous). The Entity.Access floor is checked first and is never
+     *  waived by `public`. Mirrors engine.Entity.Public (*OpSet). The wire form
+     *  is always the object shape (never a bare bool). Replaces the removed
+     *  boolean `permissions`. */
+    public?: OpSet;
     /**
      * Optional structural tree for placing and grouping actions across all
      * placement slots. Absent = runtime composes a flat list from all actions
@@ -449,11 +468,34 @@ export interface AuditConfig {
     enabled?: boolean;
     lines?: AuditLineDef[];
 }
+/** Resolved per-screen visibility decision (deny-by-default authorization,
+ *  plan 2026-06-17). Computed by the engine at load - authors write
+ *  `public` / `required_permission`, never this. `public` and
+ *  `required_permission` are mutually exclusive; `source` is the audit
+ *  provenance (authored:public | authored | authored->public |
+ *  derived:public-entity | derived:entity | derived:screen). Mirrors
+ *  engine.ScreenVisibility. */
+export interface ScreenVisibility {
+    public: boolean;
+    required_permission: string;
+    source: string;
+}
 export interface Screen {
     type: "list" | "detail" | "custom" | "record_list";
     entity?: string;
     route: string;
     component?: string;
+    /** Deny-by-default authorization. CUSTOM (entity-less) screens only: true
+     *  makes the screen visible to all authenticated callers (data inside still
+     *  gates per entity). A load error on an entity-bound screen. Mirrors
+     *  engine.Screen.Public (*bool). */
+    public?: boolean;
+    /** Overrides the derived visibility rule for this screen (any grant string,
+     *  typically `screen:<code>` to retarget or to tighten an entity-bound
+     *  screen below its entity read). REPLACES the derived rule, not ANDs it. */
+    required_permission?: string;
+    /** Resolved visibility (engine-computed at load; never authored). */
+    visibility?: ScreenVisibility;
     display?: {
         name: LocalizedString;
         icon: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@declarion/react",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": false,
   "license": "MIT",
   "description": "React SDK for Declarion, the schema-driven business apps platform.",