@lemonadecms/client 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 0.2.2
+
+- Correct the npm-specific README with global/collection defaults, direct
+  reference-ID filtering, authorization limits and accurate 0.2.1 feature
+  availability. No SDK runtime, CLI or dependency changes from 0.2.1.
+
 ## 0.2.1
 
 - Filter top-level Reference fields by linked entry UUID with eq/ne/in/not_in,

package/README.md

@@ -30,7 +30,7 @@ runtime library or framework dependency is required.
 
 ## Configure and read content
 
-Version 0.2.0 connects to `https://api.lemonadecms.com` automatically. Strict hostname routing returns 404 for API URLs on `https://lemonadecms.com`. Upgrade earlier clients to 0.2.0 and change explicit CLI/configured-target URLs to `https://api.lemonadecms.com`. Explicit CLI settings still take precedence; no redirect or fallback is attempted. Configure your
+Version 0.2.0 connects to `https://api.lemonadecms.com` automatically. Strict hostname routing returns 404 for API URLs on `https://lemonadecms.com`. Upgrade earlier clients to 0.2.2 and change explicit CLI/configured-target URLs to `https://api.lemonadecms.com`. Explicit CLI settings still take precedence; no redirect or fallback is attempted. Configure your
 workspace and delivery key; there is no URL or local CMS option. Your website
 can run locally while reading content from Lemonade production. Installing the
 package does not create an account, workspace or delivery key.
@@ -85,6 +85,64 @@ environment override. Ask your Owner for a credential belonging to the intended
 environment. The server rechecks current access, expiry and revocation on every
 request.
 
+## Global and collection defaults (0.2.1+)
+
+Use `defaults` for shared locale, limit, filters, sort, includeRemote and maxPages.
+Use `collections` for typed per-model settings. Request values override collection
+values, then global values. Global, collection and request filters combine with
+AND; `filters: []` does not remove configured predicates. Configuration is copied
+at client construction. No schema fetch, retry or runtime dependency is added.
+
+The example assumes generated `article` and `product` models, each with a top-level
+Reference field named `tenant`. Filter directly by the linked entry UUID; a
+separate `tenant_id` text field is unnecessary. Regenerate your model types after
+adding the relation. Relation predicates require the matching CMS backend.
+
+```ts
+import { createCMSClient } from '@lemonadecms/client';
+import type { Models } from './cms-models';
+
+type TenantContent = Pick<Models, 'article' | 'product'>;
+const tenantId = 'YOUR_TENANT_ENTRY_UUID';
+const cms = createCMSClient<TenantContent>({
+  projectId: 'YOUR_WORKSPACE_UUID',
+  publicKey: 'YOUR_PUBLIC_DELIVERY_KEY',
+  defaults: {
+    locale: 'en',
+    limit: 25,
+    filters: [{ field: 'tenant', op: 'eq', value: tenantId }],
+  },
+});
+const articles = await cms.content('article').list({ limit: 10 });
+```
+
+`tenantId` must come from your application's intended tenant entry UUID. Global
+fields must exist on every queried model; use collection defaults when only some
+models have the relation. Use another client for the tenant directory itself.
+
+| Field | Operators | Values |
+| --- | --- | --- |
+| Reference | `eq`, `ne` | Linked entry UUID or `null` |
+| Reference | `in`, `not_in` | 1–100 UUIDs |
+| References | `contains_any`, `contains_all` | 1–100 unique UUIDs |
+
+IDs are compared case-insensitively in the requested published or saved-draft
+snapshot. These filters do not fetch or traverse target fields. Both source and
+target models must be accessible in the requested language. Dotted `tenant.id`,
+nested relations, reverse-list predicates and relation sorting are unsupported.
+Existing ten-leaf, depth-four, 31-node and 4 KiB filter limits still apply.
+
+Defaults are query conveniences, **not tenant authorization**. `get()`/`getMany()`
+inherit locale/includeRemote only and do not inherit filters. Reference expansion
+is not constrained by defaults. A shared public key can read every record it
+permits. Use separate workspace credentials for hard isolation, or trusted server
+authorization for every entry and referenced resource. Never rely on a caller's
+unverified tenant ID as authorization.
+
+Statistics inherit locale/filters; `findOne()` keeps limit 1. Related reads inherit
+global defaults only, never the parent collection's settings. Traversal snapshots
+its effective query and honors maxPages (default 1,000; maximum 10,000).
+
 ## Find one entry
 
 In the updated source build, `findOne()` returns the first matching complete
@@ -202,14 +260,14 @@ resources. Unavailable embeds are omitted; entry routes are never invented.
 Plain text retains authored text with block/list/hard-break newlines. Plain text
 is not escaped HTML: use text interpolation.
 
-The source SDK also supports opt-in v2 quotations, escaped code blocks, accessible
+SDK 0.2.1 and later support opt-in v2 quotations, escaped code blocks, accessible
 rectangular tables and external-media cards. Configure the field's
 `document_version: 2` and enabled features, then set `richTextVersion: 2` on the
 published or server preview client. This explicitly sends
 `Lemonade-Accept-Content: rich-text.v2`; default reads remain v1. The updated type
 generator requests `relationships.v1,rich-text.v2,unique-identifiers.v1` schema extensions.
-These additions require the updated backend, SDK and website renderer; published
-0.2.0 does not contain them.
+These additions require the updated backend and website renderer, together with
+SDK 0.2.1 or later. Earlier packages do not contain these advanced formats.
 
 External-media HTML stays static: no iframe, autoplay or provider request is
 created by these helpers. `externalMediaDescriptor(node)` returns validated,
@@ -335,16 +393,16 @@ saved-draft previews remain supported. The browser helper is the dependency-free
 See [setup, editor workflow, Astro reference and protocol](https://github.com/ilara-booqself/lemonadecms/blob/main/docs/visual-composer.md).
 
 
-## Source additions awaiting a release
+## Reverse relationships (0.2.1+)
 
-The source checkout adds opt-in rich-text v2 (described above) and on-demand
+SDK 0.2.1 adds opt-in rich-text v2 (described above) and on-demand
 reverse collections through
 `cms.content('author').related(authorId, 'articles', {limit: 10})`. Updated
 `lemonade types generate` negotiates the relationship extension and generates a
 separate `Relationships` map for `createCMSClient<Models, Relationships>`.
 Ordinary entries and `fields` retain their shape. This requires the updated
-backend and a separately published package beyond 0.2.0; deployment and npm
-publication are separate gates. The source SDK retains zero runtime dependencies.
+backend and SDK 0.2.1 or later. Installing npm does not deploy the backend.
+The SDK retains zero runtime dependencies.
 
 Management migrations configuring a reverse list need both source and target
 model keys and actions in the management credential, independently of the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lemonadecms/client",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Framework-independent content delivery and developer tooling for Lemonade CMS",
   "license": "MIT",
   "homepage": "https://lemonadecms.com/guides/sdk",