uniweb 1.5.0 → 1.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/content-writer": "~1.1.1",
-    "@uniweb/core": "~1.2.1",
-    "@uniweb/schemas": "~1.2.1",
-    "@uniweb/semantic-parser": "~1.7.0"
+    "@uniweb/content-writer": "~1.1.2",
+    "@uniweb/semantic-parser": "~1.8.0",
+    "@uniweb/schemas": "~1.3.0",
+    "@uniweb/core": "~1.2.2"
   },
   "peerDependencies": {
-    "@uniweb/build": "~1.3.1",
-    "@uniweb/semantic-parser": "~1.7.0",
-    "@uniweb/content-reader": "~1.3.1"
+    "@uniweb/content-reader": "~1.3.2",
+    "@uniweb/semantic-parser": "~1.8.0",
+    "@uniweb/build": "~1.3.3"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/partials/agents.md

@@ -2515,11 +2515,16 @@ component that never needed one.
 ### Reading
 
 ```jsx
-const { status, records } = useRecords({ schema: '@/track' })   // summaries: record.brief, no items
-const { entity } = useEntity({ schema: '@/track', uuid: record.uuid })
+const { status, records } = useRecords({ schema: '@acme/track' })   // summaries: record.brief, no items
+const { entity } = useEntity({ schema: '@acme/track', uuid: record.uuid })
 const sessions = entity?.hydrated?.items.filter((item) => item.section === 'sessions')
 ```
 
+⛔ **Name a type by its full name, `@scope/name`** — the scope your foundation registered
+under (`@acme/track`). `@/track` is right in `meta.js` and `queries.yml`, where the build and
+`push` qualify it for you, but a `schema` you hand `@uniweb/api` goes to the backend as written,
+and the backend matches the exact name: `@/track` is a `404`.
+
 ⛔ **What a member wrote is text.** Render a field as `{record.brief.name}` or `<PlainText text={…} />` — never `<P text>`, `<H1>`–`<H6>` or `SafeHtml`, which render HTML: a member who typed `<img src=x onerror=…>` would run it as whoever views the page. A rich-text field (a ProseMirror document) renders through kit's `Render`, which escapes its text.
 
 ⛔ **A listed record is a summary, not the entity.** `record.brief` holds the brief
@@ -2538,7 +2543,7 @@ for the first tells a visitor their content is gone when it was never requested.
 ### Writing
 
 ```jsx
-const writer = useEntityWriter({ schema: '@/track', uuid: track.uuid })
+const writer = useEntityWriter({ schema: '@acme/track', uuid: track.uuid })
 
 await writer.create({ title: 'Keynote' }, { section: 'sessions', position: 'last' })
 await writer.update(itemId, { ...item.data, room: 'Hall A' })   // whole-data replace
@@ -2677,6 +2682,43 @@ sent to an account comes with no link to follow. `unit_name` may be `null`.
 waits — answered in another tab, or withdrawn — is refused with `kind: 'rule'` and
 leaves the list; its `detail` is for people, so branch on `kind`.
 
+### Access to an entry
+
+Whoever administers an entry — its owner, someone given `admin` on it, or a role that
+reaches it while the session is elevated — gives other people `read`, `edit` or `admin` on
+it, and takes it back. An instructor enrolling students in a course is this; name it as
+your solution does ("enrolled", "course staff"):
+
+```jsx
+const { status, grants, grant, revoke, working } = useAccess({ schema: '@/course', uuid: course.uuid })
+// status 'ready' for whoever administers it; 'forbidden' for everyone else — draw nothing
+// grants: [{ account_id, permission, account: { handle, uuid, … }, … }]
+await grant({ handle: 'sam' }, 'read')     // or an account id: a candidate, a grant's account, an owner_id
+await grant([12, 15, 21], 'read')          // many by account id, each on its own: { results }
+await revoke(grants[0])
+```
+
+- ⛔ **Not a grant per entry from your code** — giving access is a person's decision, made
+  through your UI. For "the course's staff read every submission", declare it on the schema
+  (`readable_with`, above) instead of granting each submission as it is created.
+- Giving again replaces: `read` after `edit` lowers it. On a site's backend an entry is
+  given only to the site's members, so an address with no account is refused.
+- An entry given to the viewer lists for them with `via: 'grant'`; they can give it up with
+  `leaveAccess({ schema, uuid })`.
+
+### Where a create lands
+
+Everything a member creates lands at the root of the organization the site's backend is
+founded with — unless the create names one of its units, a department or a course, that the
+viewer is placed in:
+
+```jsx
+const { units } = useUnits()               // [{ unit, id, handle?, name?, parent?, depth, primary }]
+await createEntity({ schema: '@/submission', unit: course.unit, items: [...] })
+```
+
+Landing decides where an entry is, not who may open it.
+
 ### A backend on your machine
 
 You do not need a live backend to build against one. In `site.yml`:
@@ -2701,8 +2743,9 @@ may edit an entry and `append_only`, so a permission you are relying on fails on
 machine rather than in front of a user. The mail it would send is printed in the dev
 server's terminal, its link on your site's root — follow it to try your page. Seed
 `offers: [{ email, invitations: 1 }]` to try an invitation: mailed to an address no
-account holds, or waiting at once for the seeded account whose address it is. State is
-in memory; restart to reset.
+account holds, or waiting at once for the seeded account whose address it is. A seeded
+entity takes `grants: { member: 'read' }`, and `units: [{ handle, parent?, members, floor? }]`
+gives a create somewhere to land. State is in memory; restart to reset.
 
 `uniweb create my-event --template conference` is a worked example of all of this.
 

package/src/framework-index.json

@@ -1,21 +1,21 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-15T14:10:08.789Z",
+  "generatedAt": "2026-10-15T21:06:42.969Z",
   "packages": {
     "@uniweb/api": {
-      "version": "1.2.3"
+      "version": "1.2.5"
     },
     "@uniweb/build": {
-      "version": "1.3.1"
+      "version": "1.3.3"
     },
     "@uniweb/content-reader": {
-      "version": "1.3.1"
+      "version": "1.3.2"
     },
     "@uniweb/content-writer": {
-      "version": "1.1.1"
+      "version": "1.1.2"
     },
     "@uniweb/core": {
-      "version": "1.2.1"
+      "version": "1.2.2"
     },
     "@uniweb/frame-bridge": {
       "version": "1.0.2"
@@ -24,7 +24,7 @@
       "version": "1.0.3"
     },
     "@uniweb/kit": {
-      "version": "1.2.2"
+      "version": "1.2.4"
     },
     "@uniweb/loom": {
       "version": "1.1.0"
@@ -36,19 +36,19 @@
       "version": "1.1.1"
     },
     "@uniweb/runtime": {
-      "version": "1.1.2"
+      "version": "1.1.3"
     },
     "@uniweb/scene": {
       "version": "1.0.1"
     },
     "@uniweb/schemas": {
-      "version": "1.2.1"
+      "version": "1.3.0"
     },
     "@uniweb/scholar": {
       "version": "1.1.0"
     },
     "@uniweb/semantic-parser": {
-      "version": "1.7.0"
+      "version": "1.8.0"
     },
     "@uniweb/snapshot": {
       "version": "1.1.0"
@@ -60,7 +60,7 @@
       "version": "1.2.0"
     },
     "@uniweb/unipress": {
-      "version": "1.1.3"
+      "version": "1.1.4"
     }
   },
   "templates": {