@uniweb/api 1.0.1 → 1.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/api",
-  "version": "1.0.1",
+  "version": "1.1.1",
   "description": "The client for a Uniweb site's own backend — session, records, entities — imported by a foundation the way it imports @uniweb/kit.",
   "type": "module",
   "exports": {
@@ -31,10 +31,10 @@
   },
   "homepage": "https://github.com/uniweb/api#readme",
   "engines": {
-    "node": ">=20.19"
+    "node": ">=22.12"
   },
   "dependencies": {
-    "@uniweb/core": "~1.0.1"
+    "@uniweb/core": "~1.1.0"
   },
   "peerDependencies": {
     "react": "^19.0.0"

package/src/client.js

@@ -762,11 +762,13 @@ export class ApiClient {
    * section names; the item route after it takes ids, and ids differ from one
    * backend to the next. So a name is resolved here, from the Model's definition.
    *
-   * ⚠️ The definition is readable by any signed-in viewer — Models are open, so every
-   * Model is one they may create (2026-09-23; until then only the Models a viewer
-   * could create, and the operator). Where it cannot be read this cannot resolve a
-   * name, and says so — pass the section's numeric id instead (an item's
-   * `section_id` on a read).
+   * ⚠️ The definition is readable by any signed-in viewer, whatever they may create —
+   * closing a Model gates creating its entries, never its definition (`SCHEMA` in
+   * `wire.js`). Where a backend refuses it anyway — a closed Model, from 2026-10-10
+   * until the backend's fix — this cannot resolve a name, and says so: pass the
+   * section's numeric id instead (an item's `section_id` on a read). *(This read
+   * "Models are open, so every Model is one they may create" until 2026-10-14: true
+   * from 2026-09-23, and no reason since closing arrived.)*
    *
    * @param {string} schema
    * @param {string|number} section - a name, a `parent/child` path, or an id

package/src/mock/index.js

@@ -384,9 +384,11 @@ export function createMockBackend({ seed = DEFAULT_SEED, prefix = '/_api', signe
         }
         const model = store.model(q.get(PARAM.model))
         if (!model) return notFound('model', q.get(PARAM.model))
-        // ⭐ No creation gate: Models are open (2026-09-23) — anyone signed in may create
-        // entries of any Model. Until then `creatable_by: unit_members` answered `403
-        // use_model` here for a member.
+        // ⭐ No creation gate: the mock models no closing, so anyone signed in may create
+        // entries of any Model — as on the backend for an open one. A backend can close a
+        // Model's creation since 2026-10-10, and then a create is `403` for anyone but its
+        // owner, its `use` grantees and the holders of a role over it. Until 2026-09-23
+        // `creatable_by: unit_members` answered `403 use_model` here for a member.
         // Any other top-level key is ignored, exactly as the backend ignores it.
         return answer(store.create(model, items.map((i) => ({ ...i, data: i.data ?? {} }))))
       }

package/src/mock/store.js

@@ -36,7 +36,8 @@ import { checkItemWrite, OUTCOME } from './schema-shape.js'
  * drifts and is believed anyway.
  *
  * ⛔ **What it does not model**: entitlements behind `via` (a `via` read is the
- * same read), nested sections, second factors, reference fields, password rules,
+ * same read), a Model whose creation is closed, nested sections, second factors,
+ * reference fields, password rules,
  * an offer's grants (a count, sharing nothing), what joining an organization
  * gives — accepting an invitation answers, and opens nothing to read — and an
  * organization withdrawing an invitation.
@@ -463,10 +464,11 @@ export class MockStore {
   }
 
   /**
-   * The definition is readable by anyone signed in. ⭐ Models are open (2026-09-23):
-   * anyone signed in may create entries of any Model, and what protects content is the
-   * entry — `mayEdit`, `mayRead` — never who may create. *(Until then a Model declaring
-   * `creatable_by: unit_members` was the operator's alone, and so was its definition.)*
+   * The definition is readable by anyone signed in, whatever they may create — as on the
+   * backend, where closing a Model gates creating its entries and never its definition
+   * (ruled 2026-10-14). What protects content is the entry — `mayEdit`, `mayRead` —
+   * never who may create. *(Until 2026-09-23 a Model declaring `creatable_by:
+   * unit_members` was the operator's alone, and so was its definition.)*
    */
   maySeeSchema() {
     return !!this.account

package/src/wire.js

@@ -545,9 +545,13 @@ export const READ = {
  * fields, other_data, constraints }] }` — `kind` is `single` or `multi`;
  * `other_data.append_only` marks an insert-only section.
  *
- * ⚠️ **Readable by the Models the viewer may create, and by the operator.** A
- * member reading entities of a Model only the operator creates gets `404` here —
- * so a member can read those items but cannot learn their section names.
+ * ⭐ **Readable by every signed-in account, whatever it may create** — closing a
+ * Model gates creating its entries, never reading its definition (ruled 2026-10-14;
+ * stated by the backend from its code, not yet measured here). Signed out is `401`,
+ * an unknown Model `404`. ⛔ *Until 2026-10-14 this said readable only by "the Models
+ * the viewer may create, and by the operator" — the rule before 2026-09-23, and in
+ * effect for a closed Model from 2026-10-10 until the backend's fix, where a member
+ * reads that Model's items but not their section names.*
  */
 export const SCHEMA = {
   sections: 'sections',