ddcore 0.26

0.26.3 — 2026-10-05

A form's field widths follow the width of the form itself, not the browser window, so an open sidebar no longer squeezes a quarter-line field (a Datetime, say) until its value is cut off. Below 800px of line a quarter takes half the line; below 480px every field takes the whole line, as a phone already did.

On a site with tenancy, a workspace can show something in one space only: space: "platform" | "tenant" on the workspace, or on a sidebar, shortcuts or numberCards entry. Boot leaves out the other space's, and its number cards answer 404 there. Without space it shows in both, as before; any other value fails the load. See report-api (#76).
On a site with tenancy, the desk says which space it is in at the top: under the site's name in the sidebar (and in the mobile header), the tenant's title, or Platform in its own color, so the space that changes what every tenant shares never looks like a tenant. For an operator it opens the tenant menu. With the sidebar collapsed, the logo keeps the space's color. Page titles end with the space (Projects · Demo Ltd), so browser tabs of two spaces can be told apart (#77).

Inside a tenant, a shared DocType no longer looks editable only to fail at save: the permissions the desk receives for it leave out write, create, delete, submit, cancel, amend and import, so Save, New, Delete, Rename, Duplicate and Import disappear, and its form and list say "Shared by every tenant: read only here" (an operator also gets Go to the platform, back to the same page). See tenancy (#75).
A saved document's form is read only when the user may not write it, for any DocType, not only a Single or one under a workflow; its fields were left editable before (#75).

A field can stay out of the desk's Duplicate with noCopy: true; the copy takes the field's default, and a Table with it starts empty. See fieldtypes (#74).
On a site with tenancy, desk URLs name their tenant (?tenant=<id>), so a link copied from the address bar opens in the space it was copied from. A link naming another tenant no longer loads the page: an operator is asked to enter that tenant (which moves the session, every tab with it), and a tenant's own user is told the link is not theirs. See tenancy.

Duplicate no longer copies a unique field nor a readOnly one (a fetchFrom still follows its Link), on the document and on its child rows: the copy takes their defaults, so it no longer fails at save with a duplicate value or carries what the server wrote on the original (#74).

An app can serve a static site to anyone under a URL prefix of its own: defineApp({ www: { "/r": "client/checkout/build" } }) serves that folder at /r/, with index.html for a directory and as the fallback of a client-side route (fallback: null for a plain 404), so a public page — a SvelteKit adapter-static build with paths.base: "/r" — no longer needs a server of its own. GET/HEAD only, /r redirects to /r/, a path that climbs out of the folder is a 404, and every file goes out with nosniff, a referrer policy and X-Frame-Options: DENY (frame: true lifts it). A prefix is one lowercase segment, not one ddcore uses nor another app's; the load says which rule a declaration broke. The site's data comes from guest methods on the same origin. See www (#68).
A whitelisted method declared with cors: true can be called by pages on the origins listed in "cors": { "origins": [...] } in ddcore.json, or DDCORE_CORS_ORIGINS (comma-separated): https://shop.example.com, https://*.partner.example for its subdomains, or *. The preflight answers 204 with the origin echoed and the method's own methods, and the call's response (an error too) is readable by the page, X-Request-Id included. Credentials are never allowed, so the caller sends an API key or comes as Guest. Every other route, and every method without cors, answers as before. See controller-api → "Calls from another origin" (#68).