@protobase/schema 0.46.6 → 0.46.8

package/dist/access/restrict.d.ts

@@ -3,8 +3,8 @@ import { ResolvedAccess } from "./resolve.js";
 //#region src/access/restrict.d.ts
 /**
  * The resource as one user may see it: only readable fields remain, and a field is `readOnly`
- * unless it is writable on create or update. `search` (and `searchMatch`) shrinks to readable fields, and `tenant`,
- * `softDelete` and `owner` are dropped when their field is hidden, `position` when its field or its `within` is, and each of `parents` whose field is. The event catalogue, whose conditions may use any
+ * unless it is writable on create or update. `search` (and `searchMatch`) shrinks to readable fields, and `tenant` (with
+ * `tenantAcross`), `softDelete` and `owner` are dropped when their field is hidden, `position` when its field or its `within` is, and each of `parents` whose field is. The event catalogue, whose conditions may use any
  * field, is dropped. Key columns always stay,
  * because records are addressed by them.
  *

package/dist/access/restrict.js

@@ -1,8 +1,8 @@
 //#region src/access/restrict.ts
 /**
 * The resource as one user may see it: only readable fields remain, and a field is `readOnly`
-* unless it is writable on create or update. `search` (and `searchMatch`) shrinks to readable fields, and `tenant`,
-* `softDelete` and `owner` are dropped when their field is hidden, `position` when its field or its `within` is, and each of `parents` whose field is. The event catalogue, whose conditions may use any
+* unless it is writable on create or update. `search` (and `searchMatch`) shrinks to readable fields, and `tenant` (with
+* `tenantAcross`), `softDelete` and `owner` are dropped when their field is hidden, `position` when its field or its `within` is, and each of `parents` whose field is. The event catalogue, whose conditions may use any
 * field, is dropped. Key columns always stay,
 * because records are addressed by them.
 *
@@ -17,7 +17,7 @@ const restrictModel = (model, access) => {
 	const keep = (name) => name !== void 0 && visible.has(name) ? name : void 0;
 	const search = model.search?.filter((name) => visible.has(name));
 	const searchMatch = model.searchMatch && Object.entries(model.searchMatch).filter(([name]) => visible.has(name));
-	const { search: _search, searchMatch: _searchMatch, tenant: _tenant, softDelete: _softDelete, owner: _owner, position: _position, parents: _parents, events: _events, ...rest } = model;
+	const { search: _search, searchMatch: _searchMatch, tenant: _tenant, tenantAcross: _tenantAcross, softDelete: _softDelete, owner: _owner, position: _position, parents: _parents, events: _events, ...rest } = model;
 	const tenant = keep(model.tenant);
 	const softDelete = keep(model.softDelete);
 	const owner = keep(model.owner);
@@ -32,6 +32,7 @@ const restrictModel = (model, access) => {
 		...search?.length && { search },
 		...searchMatch?.length && { searchMatch: Object.fromEntries(searchMatch) },
 		...tenant && { tenant },
+		...tenant && model.tenantAcross && { tenantAcross: model.tenantAcross },
 		...softDelete && { softDelete },
 		...owner && { owner },
 		...position && { position: { ...position } },

package/dist/index.d.ts

@@ -10,7 +10,7 @@ import { f } from "./fields.js";
 import { FieldRefs, FieldsInput, Ref, Refs } from "./refs.js";
 import { CreatedOptions, DeletedOptions, EventActor, EventContext, EventHelpers, EventMatch, EventSpec, UndeletedOptions, UpdatedOptions } from "./events/event-helpers.js";
 import { Access, InferRecord, Issue, KeyOf, KeyRefs, RecordKey, RecordOf } from "./resource-types.js";
-import { ResourceBuilder, SearchRef, SearchRefs, Validator, resource } from "./resource.js";
+import { ResourceBuilder, SearchRef, SearchRefs, TenantOptions, Validator, resource } from "./resource.js";
 import { isRecordCondition } from "./record-when.js";
 import { ChartInput, GroupChartInput, PeriodChartInput } from "./view-chart.js";
 import { FormInput } from "./view-form.js";
@@ -45,4 +45,4 @@ import { AccessSource, ResolveOptions, ResolvedAccess, RowFilterOperation, acces
 import { restrictModel } from "./access/restrict.js";
 import "./access/index.js";
 import { AssistantAction, AssistantActionRequest, AssistantCardPart, AssistantDiff, AssistantEvent, AssistantMessage, AssistantMessageRequest, AssistantPart, AssistantState, AssistantStep, AssistantStepState, AssistantTablePart, AssistantTextPart, AssistantTone, AssistantWidgetPart } from "./assistant/protocol.js";
-export { type Access, type AccessAction, type AccessContext, type AccessFn, type AccessResult, type AccessSource, type AccessUser, type ActionInputKind, type ActionInputModel, type ActionModel, type ActionRun, type AnyField, type AppAddress, type AssistantAction, type AssistantActionRequest, type AssistantCardPart, type AssistantDiff, type AssistantEvent, type AssistantMessage, type AssistantMessageRequest, type AssistantPart, type AssistantState, type AssistantStep, type AssistantStepState, type AssistantTablePart, type AssistantTextPart, type AssistantTone, type AssistantWidgetPart, type BadgeShape, type BottomBarItemModel, type BottomBarModel, type BottomBarNames, type BottomBarSource, type CalendarView, type Capability, type CapabilityAction, type CapabilityLimit, type CapabilityScope, type CardFavoriteModel, type CardPhotosModel, type ChartGranularity, type ChartInput, type ChartModel, type ChartRange, type CheckResult, type CheckedFilter, type CommentsSectionModel, type CompareOp, type ComponentRef, type ConnectAddress, type Constraint, type CreateModel, type CreatedOptions, type CustomSectionModel, type DatePreset, type DeletedOptions, type DurationLiteral, type DurationUnit, type Encrypted, type EvaluateOptions, type EventActor, type EventContext, type EventHelpers, type EventMatch, type EventModel, type EventOperation, type EventSpec, type ExactCapability, type ExportModel, type Field, type FieldAccess, type FieldFormat, type FieldMeta, type FieldModel, type FieldPath, type FieldRefValue, type FieldRefs, type FieldRule, type FieldType, type FieldTypeDef, type FieldView, type FieldViewModel, type FieldViews, type FieldWidgetModel, type FieldsInput, type FileField, type FileFieldModel, type FileOptions, type FileProcessor, type FileProcessorInput, type FilterError, type FilterErrorCode, type FilterExpr, type FilterLayout, type FilterLimits, type FilterOf, type FilterParse, type FilterValue, type FilterWidgetModel, type FormAddress, type FormInput, type FormModel, type GalleryModel, type Grant, type GroupChartInput, type GroupChartModel, type GroupItemModel, type GroupModel, type HeldCapability, type HelpWhen, type HistorySectionModel, type ImageFormat, type ImageVariant, type ImageVariantOptions, type InferRecord, type Issue, type JsonValue, type KeyOf, type KeyRefs, type KeyType, type KeyValue, type LayoutItemModel, type ListColumn, type ListDisplayModel, type ListDragModel, type ListModel, type ListQuery, type Literal, type MapSectionModel, type MapView, type NamedListModel, type NavModel, type NavRecentModel, type NowValue, type OrderByCheck, type OrderByItem, type OrderByParse, type ParentAccess, type ParentModel, type PeriodChartInput, type PeriodChartModel, type PositionAfterModel, type RecordChartModel, type RecordChartRange, type RecordKey, type RecordMode, type RecordOf, type RecordWhen, type Ref, type Refs, type RelatedColumnModel, type RelatedModel, type RelatedPresentation, type RelationField, type ResolveOptions, type ResolvedAccess, type ResourceBuilder, type ResourceModel, type RoleEntry, type RoleLimit, type Roles, type RolesOptions, type Rollup, type RollupCount, type RollupFn, type RollupSource, type RollupValue, type RowFilterOperation, type Rule, type SaveFeedback, type SaveSearchModel, type SearchMatch, type SearchRef, type SearchRefs, type SearchResultModel, type SearchesOfModel, type SectionModel, type SectionPresentation, type ShowWhen, type SignInAddress, type SignInPromptModel, type SignInStep, type SignInViewModel, type SortSpec, type Span, type StatusTone, type TabItemModel, type TabModel, type TimelineView, type UndeletedOptions, type UpdatedOptions, type UserMenuItemModel, type UserMenuModel, type UserMenuSource, type Validator, type ViewBuilder, type ViewModel, type ViewProps, accessWarnings, addressWords, anonymousRole, appPath, bottomBar, bottomBarErrors, checkFilter, checkOrderBy, checkRecord, connectParams, connectPath, connectRoute, createWhere, defineRoles, encrypted, enumLabel, evaluateFilter, f, fieldRef, fieldsUsedBy, fitsKeyType, formPath, formRoute, imageFormats, isRecordCondition, keyTypes, layout as l, maxBottomBarItems, parseFilter, parseOrderBy, pickView, printFilter, printOrderBy, readAppPath, readConnectAddress, readFormAddress, readSignInAddress, resolveAccess, resource, restrictModel, rule, signInParams, signInPath, signInRoute, signInSteps, userMenu, view, where };
+export { type Access, type AccessAction, type AccessContext, type AccessFn, type AccessResult, type AccessSource, type AccessUser, type ActionInputKind, type ActionInputModel, type ActionModel, type ActionRun, type AnyField, type AppAddress, type AssistantAction, type AssistantActionRequest, type AssistantCardPart, type AssistantDiff, type AssistantEvent, type AssistantMessage, type AssistantMessageRequest, type AssistantPart, type AssistantState, type AssistantStep, type AssistantStepState, type AssistantTablePart, type AssistantTextPart, type AssistantTone, type AssistantWidgetPart, type BadgeShape, type BottomBarItemModel, type BottomBarModel, type BottomBarNames, type BottomBarSource, type CalendarView, type Capability, type CapabilityAction, type CapabilityLimit, type CapabilityScope, type CardFavoriteModel, type CardPhotosModel, type ChartGranularity, type ChartInput, type ChartModel, type ChartRange, type CheckResult, type CheckedFilter, type CommentsSectionModel, type CompareOp, type ComponentRef, type ConnectAddress, type Constraint, type CreateModel, type CreatedOptions, type CustomSectionModel, type DatePreset, type DeletedOptions, type DurationLiteral, type DurationUnit, type Encrypted, type EvaluateOptions, type EventActor, type EventContext, type EventHelpers, type EventMatch, type EventModel, type EventOperation, type EventSpec, type ExactCapability, type ExportModel, type Field, type FieldAccess, type FieldFormat, type FieldMeta, type FieldModel, type FieldPath, type FieldRefValue, type FieldRefs, type FieldRule, type FieldType, type FieldTypeDef, type FieldView, type FieldViewModel, type FieldViews, type FieldWidgetModel, type FieldsInput, type FileField, type FileFieldModel, type FileOptions, type FileProcessor, type FileProcessorInput, type FilterError, type FilterErrorCode, type FilterExpr, type FilterLayout, type FilterLimits, type FilterOf, type FilterParse, type FilterValue, type FilterWidgetModel, type FormAddress, type FormInput, type FormModel, type GalleryModel, type Grant, type GroupChartInput, type GroupChartModel, type GroupItemModel, type GroupModel, type HeldCapability, type HelpWhen, type HistorySectionModel, type ImageFormat, type ImageVariant, type ImageVariantOptions, type InferRecord, type Issue, type JsonValue, type KeyOf, type KeyRefs, type KeyType, type KeyValue, type LayoutItemModel, type ListColumn, type ListDisplayModel, type ListDragModel, type ListModel, type ListQuery, type Literal, type MapSectionModel, type MapView, type NamedListModel, type NavModel, type NavRecentModel, type NowValue, type OrderByCheck, type OrderByItem, type OrderByParse, type ParentAccess, type ParentModel, type PeriodChartInput, type PeriodChartModel, type PositionAfterModel, type RecordChartModel, type RecordChartRange, type RecordKey, type RecordMode, type RecordOf, type RecordWhen, type Ref, type Refs, type RelatedColumnModel, type RelatedModel, type RelatedPresentation, type RelationField, type ResolveOptions, type ResolvedAccess, type ResourceBuilder, type ResourceModel, type RoleEntry, type RoleLimit, type Roles, type RolesOptions, type Rollup, type RollupCount, type RollupFn, type RollupSource, type RollupValue, type RowFilterOperation, type Rule, type SaveFeedback, type SaveSearchModel, type SearchMatch, type SearchRef, type SearchRefs, type SearchResultModel, type SearchesOfModel, type SectionModel, type SectionPresentation, type ShowWhen, type SignInAddress, type SignInPromptModel, type SignInStep, type SignInViewModel, type SortSpec, type Span, type StatusTone, type TabItemModel, type TabModel, type TenantOptions, type TimelineView, type UndeletedOptions, type UpdatedOptions, type UserMenuItemModel, type UserMenuModel, type UserMenuSource, type Validator, type ViewBuilder, type ViewModel, type ViewProps, accessWarnings, addressWords, anonymousRole, appPath, bottomBar, bottomBarErrors, checkFilter, checkOrderBy, checkRecord, connectParams, connectPath, connectRoute, createWhere, defineRoles, encrypted, enumLabel, evaluateFilter, f, fieldRef, fieldsUsedBy, fitsKeyType, formPath, formRoute, imageFormats, isRecordCondition, keyTypes, layout as l, maxBottomBarItems, parseFilter, parseOrderBy, pickView, printFilter, printOrderBy, readAppPath, readConnectAddress, readFormAddress, readSignInAddress, resolveAccess, resource, restrictModel, rule, signInParams, signInPath, signInRoute, signInSteps, userMenu, view, where };

package/dist/model.d.ts

@@ -112,6 +112,11 @@ export type ResourceModel = {
   softDelete?: string;
   /** The field that separates tenants: every query is limited to the caller's tenant (`.tenant()`). */
   tenant?: string;
+  /**
+   * `memberships`: lists also read the other tenants the caller is a member of, each as the caller's role there allows
+   * (`.tenant(pick, { across })`); a record's own reads and every write stay in the caller's tenant.
+   */
+  tenantAcross?: 'memberships';
   /** Field names that the bare-text `search` filter matches against. */
   search?: string[];
   /** How a search field matches when not by containing the word; see `SearchMatch`. */
@@ -1114,6 +1119,12 @@ export type NavModel = {
   order?: number;
   /** A few of its records listed under its entry. */
   recent?: NavRecentModel;
+  /**
+   * `current`: the entry opens the list on the caller's own tenant, and its recent records are that tenant's, for a
+   * resource whose lists read across tenants (`.tenant(pick, { across })`). `/meta` writes it into the list's opening
+   * filter and the recent records' filter as `tenantField = "<tenant>"`, which the person can clear or change.
+   */
+  tenant?: 'current';
 };
 /** An entry in the menu under the signed-in user, at the bottom of the sidebar. */
 export type UserMenuItemModel = {

package/dist/resource-model.d.ts

@@ -9,6 +9,7 @@ export type ResourceState = {
   primaryKey?: string[];
   softDelete?: string;
   tenant?: string;
+  tenantAcross?: 'memberships';
   search?: string[];
   searchMatch?: Record<string, SearchMatch>;
   owner?: string;

package/dist/resource-model.js

@@ -65,6 +65,7 @@ const assembleModel = (state) => {
 		primaryKey: [...primaryKey],
 		...state.softDelete && { softDelete: state.softDelete },
 		...state.tenant && { tenant: state.tenant },
+		...state.tenant && state.tenantAcross && { tenantAcross: state.tenantAcross },
 		...state.search && { search: [...state.search] },
 		...state.searchMatch && Object.keys(state.searchMatch).length > 0 && { searchMatch: { ...state.searchMatch } },
 		...state.owner && { owner: state.owner },

package/dist/resource.d.ts

@@ -17,6 +17,14 @@ export type SearchRefs<F> = { readonly [K in keyof FieldRefs<F>]: FieldRefs<F>[K
   /** Matches only the end of the field's digits, ignoring spaces, `+` and dashes, for phone numbers. */
   digitsEnd(): SearchRef;
 }; };
+/** How `.tenant()` separates tenants. */
+export type TenantOptions = {
+  /**
+   * `memberships`: lists also read every other tenant the caller is a member of, each with the caller's role there,
+   * so the tenant field works as a filter across them. A record's own reads and every write stay in the caller's tenant.
+   */
+  across?: 'memberships';
+};
 /** A rule over a whole record for `.validate()`: the issues it finds, or `undefined` when there are none. */
 export type Validator<F> = (record: RecordOf<F>) => Issue<F>[] | undefined;
 /**
@@ -58,9 +66,10 @@ export declare class ResourceBuilder<F extends FieldsInput = {}, K = never> {
   softDelete(pick: (r: FieldRefs<F>) => Ref): ResourceBuilder<F, K>;
   /**
    * The field that separates tenants: every query is limited to the caller's tenant, creates set it, and a request body
-   * may not.
+   * may not. With `across: 'memberships'`, its lists also read the other tenants the caller is a member of, each as the
+   * caller's role there allows; see [Lists across organizations](website/src/content/docs/reference/access.mdx#lists-across-organizations).
    */
-  tenant(pick: (r: FieldRefs<F>) => Ref): ResourceBuilder<F, K>;
+  tenant(pick: (r: FieldRefs<F>) => Ref, options?: TenantOptions): ResourceBuilder<F, K>;
   /**
    * Fields matched by `search("...")` and bare words in filters. Authoritative over the UI's list search defaults.
    * `r.phone.digitsEnd()` matches only the end of the field's digits, for phone numbers.

package/dist/resource.js

@@ -50,10 +50,14 @@ var ResourceBuilder = class ResourceBuilder {
 	}
 	/**
 	* The field that separates tenants: every query is limited to the caller's tenant, creates set it, and a request body
-	* may not.
+	* may not. With `across: 'memberships'`, its lists also read the other tenants the caller is a member of, each as the
+	* caller's role there allows; see [Lists across organizations](website/src/content/docs/reference/access.mdx#lists-across-organizations).
 	*/
-	tenant(pick) {
-		return this.next({ tenant: pick(this.refs()).name });
+	tenant(pick, options = {}) {
+		return this.next({
+			tenant: pick(this.refs()).name,
+			...options.across && { tenantAcross: options.across }
+		});
 	}
 	/**
 	* Fields matched by `search("...")` and bare words in filters. Authoritative over the UI's list search defaults.

package/dist/view.d.ts

@@ -61,7 +61,11 @@ export declare class ViewBuilder<R extends {
     title?: Ref | Ref[];
     subtitle?: Ref;
   }): ViewBuilder<R>;
-  /** Where the resource sits in the sidebar; `recent` lists a few of its records under the entry (see [Sidebar](website/src/content/docs/reference/sidebar.md#recent-records)). */
+  /**
+   * Where the resource sits in the sidebar; `recent` lists a few of its records under the entry (see
+   * [Sidebar](website/src/content/docs/reference/sidebar.md#recent-records)), and `tenant: 'current'` opens it on the
+   * caller's own tenant (see [The current organization](website/src/content/docs/reference/sidebar.md#the-current-organization)).
+   */
   nav(nav: NavInput<R>): ViewBuilder<R>;
   /** A line under the list's title. */
   help(help: string): ViewBuilder<R>;
@@ -197,7 +201,7 @@ export declare class ViewBuilder<R extends {
     };
     limit?: number;
   }): ViewBuilder<R>;
-  /** With the resource's model, also verifies the title, search result and list display fields, related column names, a gallery's image, `listOf`, `searchesOf`, the sidebar's `recent` group and the forms' fields. */
+  /** With the resource's model, also verifies the title, search result and list display fields, related column names, a gallery's image, `listOf`, `searchesOf`, the sidebar's `recent` group and `tenant`, and the forms' fields. */
   toModel(resource?: ResourceModel): ViewModel;
   private refs;
   private next;

package/dist/view.js

@@ -69,7 +69,11 @@ var ViewBuilder = class ViewBuilder {
 			...subtitle && { subtitle: subtitle.name }
 		} });
 	}
-	/** Where the resource sits in the sidebar; `recent` lists a few of its records under the entry (see [Sidebar](website/src/content/docs/reference/sidebar.md#recent-records)). */
+	/**
+	* Where the resource sits in the sidebar; `recent` lists a few of its records under the entry (see
+	* [Sidebar](website/src/content/docs/reference/sidebar.md#recent-records)), and `tenant: 'current'` opens it on the
+	* caller's own tenant (see [The current organization](website/src/content/docs/reference/sidebar.md#the-current-organization)).
+	*/
 	nav(nav) {
 		return this.next({ nav });
 	}
@@ -283,7 +287,7 @@ var ViewBuilder = class ViewBuilder {
 		};
 		return this.next({ searchesOf: searches });
 	}
-	/** With the resource's model, also verifies the title, search result and list display fields, related column names, a gallery's image, `listOf`, `searchesOf`, the sidebar's `recent` group and the forms' fields. */
+	/** With the resource's model, also verifies the title, search result and list display fields, related column names, a gallery's image, `listOf`, `searchesOf`, the sidebar's `recent` group and `tenant`, and the forms' fields. */
 	toModel(resource) {
 		const { title, nav, searchResult, list, listOf } = this.state;
 		if (resource && title !== void 0 && !Object.hasOwn(resource.fields, title)) throw new Error(`View "${this.state.resource}": title field "${title}" does not exist on the resource`);
@@ -331,6 +335,9 @@ var ViewBuilder = class ViewBuilder {
 			const unknown = form.fields.find((name) => !Object.hasOwn(resource.fields, name));
 			if (unknown !== void 0) throw new Error(`View "${this.state.resource}": form "${form.name}" names field "${unknown}", which the resource does not have`);
 		}
+		if (nav?.tenant === "current" && !list) throw new Error(`View "${this.state.resource}": nav.tenant narrows the opening filter of the list, so the view needs .list(...)`);
+		const tenantField = resource?.tenant === void 0 ? void 0 : resource.fields[resource.tenant];
+		if (resource && nav?.tenant === "current" && !tenantField?.filterable) throw new Error(`View "${this.state.resource}": nav.tenant opens the list on the current tenant, so the resource needs .tenant() on a .filterable() field`);
 		const recentErrors = resource && nav?.recent ? navRecentErrors(nav.recent, resource) : [];
 		if (recentErrors.length > 0) throw new Error(`View "${this.state.resource}": nav.recent ${recentErrors.join("; ")}`);
 		if (this.state.lists?.length && (listOf !== void 0 || this.state.searchesOf)) throw new Error(`View "${this.state.resource}": named lists cannot go with listOf or searchesOf, which replace the list page`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/schema",
-  "version": "0.46.6",
+  "version": "0.46.8",
   "description": "Resource, field, view and access definitions for Protobase configs.",
   "license": "Apache-2.0",
   "repository": {