@lessly/sdk-app 62.1.0 → 63.1.0

package/docs/rules.md

@@ -382,6 +382,14 @@ The level MUST come from the generated method itself (`op.level`, on the
 the App, not a literal, and never a rule of thumb about verbs — `analytics_*_delete`
 is `write` while `mail_domain_create` is `admin`, and only the catalog knows.
 
+Where there is no method to read from — a test double, a runtime probe over keys
+it was handed — the App MUST NOT hand-type the level either. `@lessly/sdk-app`
+exports `operations`, the catalog's own level map
+(`Readonly<Record<string, ToolLevel>>`, keyed by operation key), regenerated at
+publish time from the live catalog; read the level from it. A key it does not
+carry answers `undefined`, which is exactly the case `accessReason`'s string form
+covers — no level is invented for it.
+
 The gate belongs to the OPERATION, not to a gesture: where a write is reachable
 by several paths (drag and arrow keys, click and Enter, button and hotkey) all of
 them MUST be gated together, or the hole left behind is one only keyboard users
@@ -389,6 +397,20 @@ find. Implicit form submission is such a path: a disabled submit button does not
 reliably stop Enter inside a field, so the `onSubmit` handler MUST be gated (or
 the fields made `readOnly`) rather than the button alone.
 
+A gate that disables a capability across a WHOLE SURFACE — dragging any node on
+a canvas, a bulk action over a list or a grid — MUST attach the reason to the
+control that owns the capability (the toggle, the toolbar, the surface header)
+and MUST NOT attach it to every affected element: thirty identical focusable
+wrappers are thirty extra tab stops and one sentence thirty times, not thirty
+explanations. Keyboard reachability is satisfied on the owning control; the
+elements themselves just go inert.
+
+A control that STAGES a change — it writes nothing itself, the write is sent
+later by a Save or an Apply — MUST be gated on the operation the staged change
+will send, UNLESS the upstream control that reaches it is already gated on that
+same operation. Never on nothing (the caller does the work and meets the refusal
+later, somewhere else) and never twice in a row.
+
 A control that performs SEVERAL operations per click is disabled if ANY of them
 is denied. A DISPATCHER control — one operation per click, selected by a mode or
 a switch — MUST instead be gated on the operation it is about to call, and name

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lessly/sdk-app",
-  "version": "62.1.0",
+  "version": "63.1.0",
   "type": "module",
   "sideEffects": false,
   "engines": {