@lessly/sdk-app 63.2.3 → 63.2.4

package/docs/recipes/access.md

@@ -190,7 +190,11 @@ accessReason(app.mail.domain.create);
 ```
 
 Use it in every example below; nothing in an App should assemble this text by
-hand.
+hand. It never throws and never renders the word `undefined`: an object with a
+key but no usable level degrades to the key-only sentence, and an input with no
+usable key at all falls back to `"Not available for your role. Ask an admin of
+this product."` (plus one `console.warn` outside production, because that input
+is a caller bug).
 
 It takes **one** operation. Choosing which operation to explain — the first one
 `can()` denied, out of the several a button performs — is the caller's job, and
@@ -227,11 +231,26 @@ exactly what the gateway does with an uncatalogued key.
 >
 > ```ts
 > import type { Operation } from '@lessly/sdk-app';
-> export const accessReason = (op: Operation | string): string =>
->   typeof op === 'string'
->     ? `Requires access to ${op}. Ask an admin of this product.`
->     : `Requires level:${op.level} (${op.operationKey}). Ask an admin of this product.`;
+>
+> const ok = (v: unknown): v is string => typeof v === 'string' && v.trim() !== '';
+>
+> export const accessReason = (op: Operation | string): string => {
+>   if (ok(op)) return `Requires access to ${op}. Ask an admin of this product.`;
+>   // A generated method is a CALLABLE carrying operationKey/level, so not just 'object'.
+>   if (op !== null && (typeof op === 'object' || typeof op === 'function')) {
+>     const { operationKey, level } = op as { operationKey?: unknown; level?: unknown };
+>     if (ok(operationKey)) {
+>       return ok(level) && ['read', 'write', 'admin'].includes(level)
+>         ? `Requires level:${level} (${operationKey}). Ask an admin of this product.`
+>         : `Requires access to ${operationKey}. Ask an admin of this product.`;
+>     }
+>   }
+>   return 'Not available for your role. Ask an admin of this product.';
+> };
 > ```
+>
+> It never throws — a render helper that crashes takes the whole screen with it —
+> and never renders `level:undefined`.
 
 **Why both values.** The reason says what an admin has to *grant*, not what the
 caller happens to be — a role name gives them nothing to act on, and "your role

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lessly/sdk-app",
-  "version": "63.2.3",
+  "version": "63.2.4",
   "type": "module",
   "sideEffects": false,
   "engines": {