@assembly-js/app-foundation 0.12.0 → 0.14.0

package/CHANGELOG.md

@@ -19,6 +19,15 @@ A patch release never changes what an app's build requires; a minor release may
 not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
 `bump: minor` change file.
 
+## 0.14.0
+- [guidance] The build agent now counts related rows per record with `db.$count` or a joined subquery, instead of a raw correlated subselect that drizzle renders without table names and that reads 0 on every row.
+- [behavior] Later edits to the app now catch a per-record count that would always show 0 (for example "0 answers" on every question) before the change is saved, and fix it in the same edit.
+
+## 0.13.0
+- [new] `<ClientName client={client} />` and `<CompanyName company={company} />` from `@assembly-js/app-foundation/lib-client` render a name that opens the record's CRM page for staff and is plain text for a client viewer.
+- [new] `bun run build` runs `check:linked-names`, which fails when a client's or company's name is rendered by hand instead of through those components. It only runs on apps that carry the platform-links skill.
+- [guidance] `assembly-platform-links` leads with rendering client and company names through the components.
+
 ## 0.12.0
 - [behavior] `check:crons` on a platform update turn now only warns about a cron route the app already had without a schedule; a route added this turn, or one that lost its schedule, still fails.
 

package/CLAUDE.md

@@ -648,6 +648,14 @@ export const items = pgTable('items', {
 - Use `drizzle-kit push` (not `migrate`) — no migration files; schema is pushed directly.
 - Use `@neondatabase/serverless` with `drizzle-orm/neon-http` — not `pg` or `postgres.js`. It's the standard driver for the Vercel serverless (Node) runtime this app deploys to; `lib/db.ts` already wires it up.
 - **No interactive transactions.** `db.transaction(async (tx) => …)` is unsupported on neon-http and throws (a 500). For atomic multi-writes use `db.batch([...])`; otherwise sequential `await`s. See the `assembly-db-transactions` skill.
+- **Per-row counts: `db.$count` or a joined subquery, never a raw correlated subselect.** In a `.select({ … })` field of a query with no join, drizzle writes the columns inside a `sql` template without table names, so `(select count(*) from ${answers} where ${answers.questionId} = ${questions.id})` compares answers with itself and every row counts 0, with no error. (`.where()` is unaffected.) Use one of:
+  ```ts
+  db.select({ id: questions.id, answerCount: db.$count(answers, and(eq(answers.questionId, questions.id), eq(answers.kind, 'answer'))) }).from(questions);
+
+  const ac = db.select({ questionId: answers.questionId, c: count().as('c') }).from(answers).where(eq(answers.kind, 'answer')).groupBy(answers.questionId).as('ac');
+  db.select({ id: questions.id, answerCount: sql<number>`coalesce(${ac.c}, 0)` }).from(questions).leftJoin(ac, eq(ac.questionId, questions.id));
+  ```
+  `bun run build` fails on the raw form (`check:sql-subselects`).
 - **Create writes every field the create form submits.** If a later save writes nested rows (packages, add-ons, blocks), create calls that same writer with the submitted payload. A success toast and a redirect to the editor do not save. See `assembly-record-writes`.
 - `DATABASE_URL` is already in the shell env. Do NOT hardcode it or write it to `.env.local`.
 - Use `db` from `lib/db.ts` in **server components, server actions, and route handlers only** — never in client components. This is enforced: `lib/db.ts` imports `server-only`, so pulling it (or anything that imports it, e.g. a lib file re-exporting constants) into a `'use client'` module fails `bun run build`. Keep client-shared constants/types in their own file, not next to server queries.

package/bin/check-linked-names.mjs

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+// Fails the build when a client's or company's name is rendered by hand in a
+// component instead of through `<ClientName>` / `<CompanyName>` from
+// `@assembly-js/app-foundation/lib-client`. The components link the name to the
+// record's CRM page for staff and render plain text for a client viewer; a
+// hand-rendered name never links, and the prose guidance to call `linkTo` was
+// not followed. The match favours precision, because a false positive blocks the
+// build: it only looks at a name placed directly in JSX, or a full name built
+// from `X.givenName` and `X.familyName`, where the object is called `client`
+// or `customer` (and `company` for the company name).
+// Dependency free on purpose: it runs inside the generated app's sandbox before
+// any deps beyond Node are guaranteed.
+//
+// Inert unless the platform-links skill was written into the app (it ships only when
+// the deep-link flag is on) and the app depends on the foundation package, which is
+// where the components live: a vendored app has nothing to switch to.
+// On a platform update turn (ASSEMBLY_UPDATE_TURN=1) it only warns, because an
+// update never rewrites how an app renders names.
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+
+const ROOT = process.cwd();
+const UPDATE_TURN = process.env.ASSEMBLY_UPDATE_TURN === '1';
+const PLATFORM_LINKS_SKILL = join(ROOT, '.claude', 'skills', 'assembly-platform-links', 'SKILL.md');
+const SOURCE_FILE = /\.(tsx|jsx)$/;
+const PACKAGE_JSON = join(ROOT, 'package.json');
+const OPT_OUT = /linked-names:\s*plain/;
+
+const OBJECT_PATH = String.raw`(?:[\w$]+\??\.)*`;
+const FALLBACK = String.raw`(?:\s*(?:\?\?|\|\|)\s*(?:'[^']*'|"[^"]*"))?`;
+// `{client.givenName}` placed in JSX, not an attribute value (`=`) or a template (`$`).
+const CLIENT_NAME_CHILD = new RegExp(
+  String.raw`(?<!=\s*)(?<!\$)\{\s*${OBJECT_PATH}(?:client|customer)\??\.(?:givenName|familyName)${FALLBACK}\s*\}`,
+  'gi',
+);
+const COMPANY_NAME_CHILD = new RegExp(
+  String.raw`(?<!=\s*)(?<!\$)\{\s*${OBJECT_PATH}company\??\.name${FALLBACK}\s*\}`,
+  'gi',
+);
+// `${client.givenName} ${client.familyName}`, `[client.givenName, client.familyName].join(' ')`
+// and `client.givenName + ' ' + client.familyName`; a lone `[0]` initial is not a name.
+const FULL_NAME = new RegExp(
+  String.raw`(?:` +
+    String.raw`\$\{\s*${OBJECT_PATH}(?:client|customer)\??\.givenName\s*\}[^\`]{0,20}\$\{\s*${OBJECT_PATH}(?:client|customer)\??\.familyName\s*\}` +
+    String.raw`|\[\s*${OBJECT_PATH}(?:client|customer)\??\.givenName\s*,\s*${OBJECT_PATH}(?:client|customer)\??\.familyName\s*\]` +
+    String.raw`|${OBJECT_PATH}(?:client|customer)\??\.givenName\s*\+\s*['"\`][^'"\`]*['"\`]\s*\+\s*${OBJECT_PATH}(?:client|customer)\??\.familyName` +
+    String.raw`)`,
+  'gi',
+);
+
+function sourceFiles(dir) {
+  const out = [];
+  if (!existsSync(dir)) return out;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name === '.next') continue;
+      out.push(...sourceFiles(full));
+    } else if (SOURCE_FILE.test(entry.name)) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+// An attribute value (`alt={...}`, `title={`...`}`) is not rendered text.
+function inAttribute(src, index) {
+  return /=\s*\{\s*`?$/.test(src.slice(Math.max(0, index - 16), index));
+}
+
+// A built string that is not rendered as JSX text (an object label, a filter key) cannot
+// be a component; only a name sitting in text, or returned/assigned for display, is flagged.
+function inStringOnlyUse(src, index) {
+  const lineStart = src.lastIndexOf('\n', index) + 1;
+  return /(?:\blabel|\bvalue|\bkey|\bsearch\w*|\bfilter\w*|\bquery)\s*[:=]\s*[^\n]*$/i.test(src.slice(lineStart, index));
+}
+
+function lineOf(src, index) {
+  return src.slice(0, index).split('\n').length;
+}
+
+if (!existsSync(PLATFORM_LINKS_SKILL)) process.exit(0);
+try {
+  if (!readFileSync(PACKAGE_JSON, 'utf8').includes('app-foundation')) process.exit(0);
+} catch {
+  process.exit(0);
+}
+
+const violations = [];
+for (const file of [...sourceFiles(join(ROOT, 'app')), ...sourceFiles(join(ROOT, 'components'))]) {
+  const src = readFileSync(file, 'utf8');
+  if (OPT_OUT.test(src)) continue;
+  const where = relative(ROOT, file).split(sep).join('/');
+  const found = new Map();
+  for (const [re, kind] of [
+    [CLIENT_NAME_CHILD, 'client name'],
+    [FULL_NAME, 'client name'],
+    [COMPANY_NAME_CHILD, 'company name'],
+  ]) {
+    for (const m of src.matchAll(re)) if (!inAttribute(src, m.index) && !(re === FULL_NAME && inStringOnlyUse(src, m.index))) found.set(m.index, `${where}:${lineOf(src, m.index)}  (${kind}: ${m[0].trim()})`);
+  }
+  violations.push(...[...found.entries()].sort((a, b) => a[0] - b[0]).map(([, v]) => v));
+}
+
+if (violations.length > 0 && UPDATE_TURN) {
+  console.warn('');
+  console.warn('check-linked-names: names rendered by hand (this update turn is not failed for it):');
+  for (const v of violations) console.warn('  - ' + v);
+  console.warn('');
+} else if (violations.length > 0) {
+  console.error('');
+  console.error('A client or company name is rendered by hand, so it never links to its record:');
+  console.error('');
+  for (const v of violations) console.error('  - ' + v);
+  console.error('');
+  console.error("Render it with the components from '@assembly-js/app-foundation/lib-client':");
+  console.error('  <ClientName client={client} className="..." />   // a client with givenName/familyName');
+  console.error('  <CompanyName company={company} className="..." />   // a company with name');
+  console.error('Staff get a link to the CRM record; a client viewer gets plain text.');
+  console.error('A name that must stay plain (the viewer\'s own greeting, a title attribute) can add the');
+  console.error('comment `// linked-names: plain` to the file.');
+  console.error('A string-only use (a `label:` or `filter` value) is not flagged.');
+  process.exit(1);
+}

package/bin/check-sql-subselects.mjs

@@ -0,0 +1,224 @@
+#!/usr/bin/env node
+// Fails the build when a raw `sql` template in a drizzle `.select({ … })` field
+// list runs a correlated subselect against another table and the statement has
+// no join. drizzle renders columns embedded in a select field as bare names when
+// the query has a single table, so `where ${answers.questionId} = ${questions.id}`
+// becomes `where "question_id" = "id"`: the inner table is compared with itself,
+// the SQL stays valid, and a per-row count is 0 for every row. A field that names
+// the template through a const in the same file is followed too.
+// Dependency free on purpose: it runs inside the generated app's sandbox before
+// any deps beyond Node are guaranteed.
+//
+// On a platform update turn (ASSEMBLY_UPDATE_TURN=1) it only warns, because an
+// update never rewrites an app's queries.
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+
+const ROOT = process.cwd();
+const UPDATE_TURN = process.env.ASSEMBLY_UPDATE_TURN === '1';
+const SOURCE_DIRS = ['app', 'lib', 'components', 'src'];
+const SOURCE_FILE = /\.(tsx|ts|jsx|js|mjs)$/;
+const OPT_OUT = /sql-subselects:\s*qualified/;
+const SELECT_OBJECT = /\.select\s*\(\s*\{/g;
+const SQL_TEMPLATE = /\bsql\s*(?:<[^`;]*?>)?\s*`/g;
+// `const answerCountSql = sql\`…\`` or `const answerCountSql = (…) => sql\`…\``.
+const NAMED_TEMPLATE =
+  /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=;]+)?=\s*(?:\([^)]*\)\s*(?::[^=;]+)?=>\s*)?sql\s*(?:<[^`;]*?>)?\s*`/g;
+const DECLARATION = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)/g;
+const FIELD_VALUE = /:\s*([A-Za-z_$][\w$]*)\b/g;
+const SUBSELECT = /\(\s*select\b/i;
+const FROM_TABLE = /\bfrom\s+\$\{\s*([A-Za-z_$][\w$]*)\s*\}/gi;
+const COLUMN_REF = /\$\{\s*([A-Za-z_$][\w$]*)\.[A-Za-z_$]/g;
+const JOIN = /\.(?:left|inner|right|full|cross)Join(?:Lateral)?\s*\(/;
+// A line that starts a new statement; without semicolons the next query would
+// otherwise be read as part of this one and its join would excuse this query.
+const NEXT_STATEMENT = /^\n\s*(?:export|const|let|var|function|async|return|await|if|for|while|class|import)\b/;
+
+function sourceFiles(dir) {
+  const out = [];
+  if (!existsSync(dir)) return out;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name === '.next') continue;
+      out.push(...sourceFiles(full));
+    } else if (SOURCE_FILE.test(entry.name)) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+// Index just past a string, template literal or comment starting at `i`, or `i`
+// when none starts there. Templates recurse through their `${…}` holes.
+function skipLiteral(src, i) {
+  const c = src[i];
+  if (c === '/' && src[i + 1] === '/') {
+    const end = src.indexOf('\n', i);
+    return end === -1 ? src.length : end;
+  }
+  if (c === '/' && src[i + 1] === '*') {
+    const end = src.indexOf('*/', i + 2);
+    return end === -1 ? src.length : end + 2;
+  }
+  if (c === '"' || c === "'") {
+    let j = i + 1;
+    while (j < src.length && src[j] !== c && src[j] !== '\n') j += src[j] === '\\' ? 2 : 1;
+    return j + 1;
+  }
+  if (c === '`') return templateEnd(src, i);
+  return i;
+}
+
+// Index just past the template literal whose opening backtick is at `i`.
+function templateEnd(src, i) {
+  let j = i + 1;
+  while (j < src.length) {
+    if (src[j] === '\\') j += 2;
+    else if (src[j] === '`') return j + 1;
+    else if (src[j] === '$' && src[j + 1] === '{') j = closingIndex(src, j + 1) + 1;
+    else j += 1;
+  }
+  return src.length;
+}
+
+// Index of the bracket that closes the one at `i`.
+function closingIndex(src, i) {
+  let depth = 0;
+  let j = i;
+  while (j < src.length) {
+    const skipped = skipLiteral(src, j);
+    if (skipped !== j) {
+      j = skipped;
+      continue;
+    }
+    const c = src[j];
+    if (c === '(' || c === '[' || c === '{') depth += 1;
+    else if (c === ')' || c === ']' || c === '}') {
+      depth -= 1;
+      if (depth === 0) return j;
+    }
+    j += 1;
+  }
+  return src.length;
+}
+
+// The statement a `.select(` belongs to, from it to the next `;` at depth 0, a
+// new statement on a later line, or the bracket that closes the expression around it.
+function statementTail(src, i) {
+  let depth = 0;
+  let j = i;
+  while (j < src.length) {
+    const skipped = skipLiteral(src, j);
+    if (skipped !== j) {
+      j = skipped;
+      continue;
+    }
+    const c = src[j];
+    if (c === '(' || c === '[' || c === '{') depth += 1;
+    else if (c === ')' || c === ']' || c === '}') {
+      depth -= 1;
+      if (depth < 0) break;
+    } else if (depth === 0 && (c === ';' || (c === '\n' && NEXT_STATEMENT.test(src.slice(j, j + 40))))) break;
+    j += 1;
+  }
+  return src.slice(i, j);
+}
+
+// Bodies of every `sql` template in `text`, with their offset in it.
+function templatesIn(text) {
+  const out = [];
+  for (const m of text.matchAll(SQL_TEMPLATE)) {
+    const start = m.index + m[0].length - 1;
+    out.push({ body: text.slice(start, templateEnd(text, start)), offset: m.index });
+  }
+  return out;
+}
+
+function correlatesAnotherTable(body) {
+  if (!SUBSELECT.test(body)) return false;
+  const inner = new Set([...body.matchAll(FROM_TABLE)].map((m) => m[1]));
+  if (inner.size === 0) return false;
+  return [...body.matchAll(COLUMN_REF)].some((m) => !inner.has(m[1]));
+}
+
+// The source with comments and quoted strings blanked out (newlines and quotes
+// kept, so offsets and line numbers still match), so a query kept in a comment
+// or an example string is never checked. Template literals stay: `sql` is one.
+function withoutComments(src) {
+  let out = '';
+  let i = 0;
+  while (i < src.length) {
+    const end = skipLiteral(src, i);
+    if (end === i) {
+      out += src[i];
+      i += 1;
+      continue;
+    }
+    const chunk = src.slice(i, end);
+    if (src[i] === '/') out += chunk.replace(/[^\n]/g, ' ');
+    else if (src[i] === '`') out += chunk;
+    else out += chunk[0] + chunk.slice(1, -1).replace(/[^\n]/g, ' ') + chunk.slice(-1);
+    i = end;
+  }
+  return out;
+}
+
+function lineAt(src, index) {
+  return src.slice(0, index).split('\n').length;
+}
+
+const files = SOURCE_DIRS.flatMap((dir) => sourceFiles(join(ROOT, dir)));
+const violations = [];
+for (const file of files) {
+  const raw = readFileSync(file, 'utf8');
+  if (!raw.includes('.select(') || OPT_OUT.test(raw)) continue;
+  const src = withoutComments(raw);
+
+  // A name declared more than once in the file cannot be tied to one template
+  // without scope analysis, so it is not followed rather than guessed.
+  const declared = new Map();
+  for (const m of src.matchAll(DECLARATION)) declared.set(m[1], (declared.get(m[1]) ?? 0) + 1);
+  const named = new Map();
+  for (const m of src.matchAll(NAMED_TEMPLATE)) {
+    if (declared.get(m[1]) > 1) continue;
+    const start = m.index + m[0].length - 1;
+    named.set(m[1], src.slice(start, templateEnd(src, start)));
+  }
+
+  for (const m of src.matchAll(SELECT_OBJECT)) {
+    const objStart = m.index + m[0].length - 1;
+    const fields = src.slice(objStart, closingIndex(src, objStart) + 1);
+    const hits = templatesIn(fields)
+      .filter((t) => correlatesAnotherTable(t.body))
+      .map((t) => objStart + t.offset);
+    for (const v of fields.matchAll(FIELD_VALUE)) {
+      const body = named.get(v[1]);
+      if (body && correlatesAnotherTable(body)) hits.push(objStart + v.index);
+    }
+    if (hits.length === 0 || JOIN.test(statementTail(src, m.index))) continue;
+    const rel = relative(ROOT, file).split(sep).join('/');
+    for (const at of hits) violations.push(`${rel}:${lineAt(src, at)}`);
+  }
+}
+
+if (violations.length > 0 && UPDATE_TURN) {
+  console.warn('');
+  console.warn('check-sql-subselects: correlated sql subselect in a single-table select (this update turn is not failed for it):');
+  for (const v of violations) console.warn('  - ' + v);
+  console.warn('');
+} else if (violations.length > 0) {
+  console.error('');
+  console.error('A raw sql subselect in a .select({ … }) field reads another table, and the query has no join:');
+  console.error('');
+  for (const v of violations) console.error('  - ' + v);
+  console.error('');
+  console.error('drizzle writes the columns in that template without table names when the query has');
+  console.error('one table, so `${answers.questionId} = ${questions.id}` compares answers with itself');
+  console.error('and the count is 0 on every row. Use db.$count as the field instead:');
+  console.error('  answerCount: db.$count(answers, and(eq(answers.questionId, questions.id), eq(answers.kind, "answer")))');
+  console.error('or group the counts in a subquery (.groupBy(...).as("ac")) and .leftJoin it.');
+  console.error('A template whose names are already qualified (sql.raw) can add the comment');
+  console.error('`// sql-subselects: qualified` to the file.');
+  process.exit(1);
+}

package/dist/lib-client.d.ts

@@ -1,4 +1,6 @@
+import type { ReactElement } from 'react';
 import type { NavigateDestination, NavigateToOptions } from './bridge-vnext.js';
+import { type ClientNameRecord, type CompanyNameRecord } from './record-names.js';
 export declare function resetRenewalStateForTests(): void;
 export declare function reexchangeBearer(): Promise<boolean>;
 export declare function authFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
@@ -28,3 +30,22 @@ export declare function handleVisibilityChangeForTests(): void;
  * </button>
  */
 export declare function linkTo(destination: NavigateDestination, options?: NavigateToOptions): () => void;
+interface RecordNameProps {
+    className?: string;
+    viewer?: 'internal' | 'client';
+}
+/**
+ * A client's name that opens their CRM record for staff and is plain text for a
+ * client viewer, who cannot reach the destination.
+ *
+ * @example
+ * <ClientName client={client} className="font-medium" />
+ */
+export declare function ClientName({ client, className, viewer }: RecordNameProps & {
+    client: ClientNameRecord;
+}): ReactElement;
+/** A company's name that opens its CRM record for staff and is plain text for a client viewer. */
+export declare function CompanyName({ company, className, viewer }: RecordNameProps & {
+    company: CompanyNameRecord;
+}): ReactElement;
+export {};

package/dist/lib-client.js

@@ -5,7 +5,10 @@
 // never be dragged into the Edge middleware bundle that imports ./client
 // (proxy.ts pulls constants from that barrel).
 import { AssemblyBridge } from '@assembly-js/app-bridge';
+import { createElement } from 'react';
+import { usePathname } from 'next/navigation';
 import { APP_CSRF_HEADER, COOKIE_PROBE_NAME, logRenewOutcome, TOKEN_EXPIRED_HEADER, } from './session-exchange.js';
+import { clientDisplayName, isClientSurfacePath, } from './record-names.js';
 import { readBearerExpiry, readCookie } from './origin-bootstrap.js';
 import { cookielessReexchangeHeaders, cookiesAreBlocked, getCookielessBearer, setCookielessBearer, } from './cookieless-bearer.js';
 const REEXCHANGE_PATH = '/api/assembly-reexchange';
@@ -338,3 +341,43 @@ export function linkTo(destination, options) {
         });
     };
 }
+function isClientViewer(viewer, pathname) {
+    return viewer ? viewer === 'client' : isClientSurfacePath(pathname);
+}
+// A button so the link is keyboard reachable, reset to read as inline text; the
+// colour is only inherited when the app gave no class, so its own colour wins.
+// createElement keeps the package free of a jsx compiler setting.
+function recordName(name, destination, className) {
+    if (!destination)
+        return createElement('span', { className }, name);
+    return createElement('button', {
+        type: 'button',
+        className,
+        onClick: linkTo(destination),
+        style: {
+            background: 'none',
+            border: 0,
+            padding: 0,
+            font: 'inherit',
+            textAlign: 'inherit',
+            cursor: 'pointer',
+            color: className ? undefined : 'inherit',
+        },
+    }, name);
+}
+/**
+ * A client's name that opens their CRM record for staff and is plain text for a
+ * client viewer, who cannot reach the destination.
+ *
+ * @example
+ * <ClientName client={client} className="font-medium" />
+ */
+export function ClientName({ client, className, viewer }) {
+    const isClient = isClientViewer(viewer, usePathname());
+    return recordName(clientDisplayName(client), isClient ? null : { to: 'client', clientId: client.id }, className);
+}
+/** A company's name that opens its CRM record for staff and is plain text for a client viewer. */
+export function CompanyName({ company, className, viewer }) {
+    const isClient = isClientViewer(viewer, usePathname());
+    return recordName(company.name ?? '', isClient ? null : { to: 'company', companyId: company.id }, className);
+}

package/dist/record-names.d.ts

@@ -0,0 +1,16 @@
+export interface ClientNameRecord {
+    id: string;
+    givenName?: string | null;
+    familyName?: string | null;
+}
+export interface CompanyNameRecord {
+    id: string;
+    name?: string | null;
+}
+export declare function clientDisplayName(client: ClientNameRecord): string;
+/**
+ * Whether the page is rendered for a client in the portal. `client` and `company`
+ * are staff-only destinations, so an unknown surface also counts as a client:
+ * plain text is the safe failure, a dead link is not.
+ */
+export declare function isClientSurfacePath(pathname: string): boolean;

package/dist/record-names.js

@@ -0,0 +1,15 @@
+import { getSurfacePrefix } from './location-prefix.js';
+// The notification surface is staff-facing, so only the other prefixed surface is the client portal.
+const NOTIFICATION_PREFIX = '/n';
+export function clientDisplayName(client) {
+    return [client.givenName, client.familyName].filter(Boolean).join(' ');
+}
+/**
+ * Whether the page is rendered for a client in the portal. `client` and `company`
+ * are staff-only destinations, so an unknown surface also counts as a client:
+ * plain text is the safe failure, a dead link is not.
+ */
+export function isClientSurfacePath(pathname) {
+    const prefix = getSurfacePrefix(pathname);
+    return prefix !== '' && prefix !== NOTIFICATION_PREFIX;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [

package/skills/assembly-platform-links/SKILL.md

@@ -22,6 +22,10 @@ If it reports `unsupported`, upgrade the app in this same turn instead of skippi
 4. Run `bunx tsc --noEmit` and `bun run build`, and confirm the existing header and toast bridge calls still type-check. Fix any break before continuing.
 5. Re-run the check above, then proceed with this skill.
 
+## Client and company names: use the components
+
+Render every client or company name with `<ClientName client={client} />` and `<CompanyName company={company} />` from `@assembly-js/app-foundation/lib-client`, in place of `{client.givenName} {client.familyName}` or `{company.name}`. They take the record objects the app already fetches and accept `className`. Staff get a link to the record's CRM page; a client viewer gets plain text. `bun run build` fails `check:linked-names` for a name rendered by hand. The rest of this skill covers other destinations.
+
 ## When to reach for this skill
 
 Any time the app renders a **name or reference to a platform entity** — a client name, a company badge, an invoice number, a contract, a form, a file — offer a link that opens the platform's canonical detail page, on surfaces where that destination is reachable (see the "Client portal" column in the destination catalog below). Internal/staff users can navigate to any destination. Clients in the portal can only reach the destinations marked available there — their own invoices, contracts, help articles, files, channels, and other installed apps — not `client`, `company`, `form`, or the other staff-only destinations, which the host rejects for a client viewer.