@assembly-js/app-foundation 0.14.3 → 0.14.5

package/CHANGELOG.md

@@ -19,6 +19,12 @@ A patch release never changes what an app's build requires; a minor release may
 not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
 `bump: minor` change file.
 
+## 0.14.5
+- [guidance] The build agent now knows the public API accepts `select` (one option key string), `checkbox` (JSON boolean) and `date` (`YYYY-MM-DD`) custom fields, and that only `multiSelect` takes an array.
+
+## 0.14.4
+- [guidance] A selected company now gets one message on its company channel instead of a new individual channel per client.
+
 ## 0.14.3
 - [guidance] The build agent now sets up services that sign in with OAuth (such as Dropbox) with a connection that renews itself, explains every setup step up front, and never asks for a token in chat.
 

package/CLAUDE.md

@@ -29,7 +29,7 @@ Assembly-specific gotchas live in `.claude/skills/<name>/SKILL.md`. Invoke them
 - `assembly-client-users` — customers in the Client Portal
 - `assembly-companies` — many-to-many with clients; placeholder companies (excluded from `listCompanies` by default for these apps)
 - `assembly-clients-companies` — REQUIRED when the app stores or scopes data by client or company: scoped tables carry BOTH a `clientId` and a `companyId` column and are filtered on the intersection (never one dimension); a client viewer always has an active `companyId`; `companyIds[]` builds pickers only and `client.companyId` is deprecated
-- `assembly-custom-fields` — workspace-defined fields, multiSelect rules
+- `assembly-custom-fields` — workspace-defined fields, select / multiSelect rules
 <!-- feature:platform-mcp -->
 - `assembly-platform-mcp` — provisioning workspace configuration at build time via the scoped `mcp__platform__` tools: create a custom field the app depends on instead of shipping an app that gates on missing workspace setup. Workspace configuration only — never client-facing data.
 <!-- /feature:platform-mcp -->
@@ -210,6 +210,14 @@ If the user's prompt says "build a CRM," the answer is mostly **wire up the exis
 <!-- generated: sdk-methods -->
 Generated from the SDK's service classes. Methods are called flat (`assembly.listClients(...)`); every method takes a single object of the named parameters (`?` = optional). Read the `.d.ts` only for nested parameter shapes. Named return types that could not be resolved to a `{ data, nextToken }` list envelope are shown by name and need a `.d.ts` lookup.
 
+**Apps**
+
+| Method | Parameters | Returns |
+|---|---|---|
+| `listApps` | — | `apps_ListAppsResponse` |
+| `retrieveApp` | `appId` | `apps_AppDetail` |
+| `retrieveAppContract` | `appId`, `ifNoneMatch?` | `Record<string, any>` |
+
 **Clients**
 
 | Method | Parameters | Returns |
@@ -261,6 +269,8 @@ Generated from the SDK's service classes. Methods are called flat (`assembly.lis
 |---|---|---|
 | `listCustomFields` | `name?`, `entityType?` | `{ data: Array<customfields_ClientCustomField>, nextToken }` |
 | `createCustomField` | `requestBody` | `customfields_createCustomFieldsResponse` |
+| `deleteCustomField` | `id` | `api_ItemFields` |
+| `updateCustomField` | `id`, `requestBody` | `customfields_ClientCustomField` |
 | `listCustomFieldOptions` | `id`, `label?` | `{ data: Array<customfields_ClientCustomFieldOption>, nextToken }` |
 
 **Events**
@@ -1057,7 +1067,12 @@ await assembly.updateClient({
 
 For option-bearing fields, also call `assembly.listCustomFieldOptions({ id: pizzaField.id })` to get the valid option `key`s — never accept an arbitrary string from a `<select>` without validating it's one of those keys.
 
-**Critical: `multiSelect` is the ONLY option-bearing type in Assembly.** There is no `singleSelect`, `dropdown`, or `select` type — anything that looks like a select-style field (a "Favorite pizza" with a fixed set of options, a "Tier" with Gold/Silver/Bronze, etc.) IS a `multiSelect` from the API's perspective. That has implications for how you write the value:
+**Critical: there are two option-bearing types, `select` (pick one) and `multiSelect` (pick many), and they take different value shapes.** Check the field's `type` from `listCustomFields` before writing:
+
+- **`select`: the value is ONE option key as a string** — `{ tier: 'gold' }`. Send `''` to clear. An array is rejected.
+- **`multiSelect`: the value is an array of option keys** (details below).
+
+For `multiSelect`:
 
 - **The value MUST be an array of option keys, even if you're only setting one.** Sending a scalar string for a multiSelect field returns `400 invalid custom field option <value> provided for custom field: <key>`. The platform-api's validator casts the value to `[]interface{}` first thing — if it's not an array, the entire value (e.g. `"pepperoni"`) gets reported as the invalid option.
 - A "single-pick" UX (a `<select>` with one selected option) still maps to `[selectedKey]` — wrap the user's selection in a one-element array on every write.
@@ -1079,7 +1094,7 @@ Identifier is flexible: the validator accepts either the option's `key` OR its `
 
 For genuinely multi-pick UIs (checkbox group, etc.), pass the full selected array: `[a.key, b.key]`.
 
-Keys in the `customFields` object are the field's `key` property (from `listCustomFields`). `multiSelect` fields take an array; `address` fields take a structured object (see the `assembly-custom-fields` skill — don't flatten it to a string, that drops city/region/postal code); every other field type takes a direct string value — stringify numbers and booleans yourself (`{ mrr: '5000' }`, not `{ mrr: 5000 }`).
+Keys in the `customFields` object are the field's `key` property (from `listCustomFields`). `multiSelect` fields take an array and `select` fields a single option key string; `address` fields take a structured object (see the `assembly-custom-fields` skill — don't flatten it to a string, that drops city/region/postal code); `checkbox` fields take a real JSON boolean (`{ onboarded: true }`; the string `'true'` is rejected); `date` fields take a `YYYY-MM-DD` string (`''` clears); every other field type takes a direct string value — stringify numbers yourself (`{ mrr: '5000' }`, not `{ mrr: 5000 }`).
 
 **Match the field by name with a case-insensitive substring of the user's wording.** Don't match on internal `key`. The user knows their fields by display name, not by key.
 
@@ -1227,7 +1242,7 @@ Use `AssemblyBridge.header.*` for breadcrumbs, CTAs, and actions menu. See `.cla
 - ❌ Don't re-notify a still-true condition from a cron. Mark a recipient sent only after `createNotification` succeeds, and clear that record when the condition ends unless the alert is once per billing period; keep those successful outcomes until the period resets, even if usage dips below the threshold. See "Recurring conditions" in `assembly-notifications`.
 - ❌ Don't use title case — see "Labels, copy, and dropdowns" above.
 - ❌ Don't render raw IDs or pass a raw ID string as `value` on `ComboboxItem` — see "Select and Combobox — base-ui differences" above.
-- ❌ Don't write a scalar string to a custom field that has options. **All option-bearing custom fields are `multiSelect` in Assembly's schema** — even ones that LOOK like single-select dropdowns. The value must always be an array of option keys: `{ favorite_pizza: ['pepperoni'] }`, never `{ favorite_pizza: 'pepperoni' }`. A scalar string for a multiSelect causes a 400 with `invalid custom field option <value> provided`.
+- ❌ Don't write a scalar string to a custom field that has options. **A `multiSelect` field takes an array of option keys** (`{ favorite_pizza: ['pepperoni'] }`, never `{ favorite_pizza: 'pepperoni' }`); a `select` field takes a single option key string. Check the field's `type` first. A scalar string for a multiSelect causes a 400 with `invalid custom field option <value> provided`.
 - ❌ Don't read `searchParams.token` anywhere — not even the entry route. Auth lives in the bearer cookie; `getAssembly()` / `getSessionIdentity()` read it. The `?token=` on first load is the middleware's to consume, once.
 - ❌ Don't design desktop-down. The app must work at 320 px. Build layouts mobile-first and add complexity at wider breakpoints.
 - ❌ Don't render user-provided text (filenames, URLs, names) in a flex or grid container without overflow protection. CSS Grid and Flexbox children default to `min-width: auto` — a long string expands every ancestor up to the nearest `overflow-hidden` or `min-w-0`. Add `min-w-0` to **every** flex/grid child in the chain from the constrained container (e.g. `DialogContent`) to the text element, and `truncate` on the text itself. Missing `min-w-0` on even one ancestor breaks the entire chain.

package/dist/scripts.js

@@ -8,6 +8,7 @@ var __export = (target, all) => {
 var api_exports = {};
 __export(api_exports, {
   ApiError: () => ApiError,
+  AppsService: () => AppsService,
   CancelError: () => CancelError,
   CancelablePromise: () => CancelablePromise,
   ClientsService: () => ClientsService,
@@ -44,6 +45,7 @@ __export(api_exports, {
   WorkspacesService: () => WorkspacesService,
   api_ClientItem: () => api_ClientItem,
   api_InternalUserItem: () => api_InternalUserItem,
+  api_UpdateClientInput: () => api_UpdateClientInput,
   appConnection_AppConnectionMembershipType: () => appConnection_AppConnectionMembershipType,
   appConnection_AppConnectionType: () => appConnection_AppConnectionType,
   app_instance_AppConnectInput: () => app_instance_AppConnectInput,
@@ -66,6 +68,7 @@ __export(api_exports, {
   contracts_SignatureEventType: () => contracts_SignatureEventType,
   customfields_ClientCustomField: () => customfields_ClientCustomField,
   customfields_createCustomFieldInput: () => customfields_createCustomFieldInput,
+  customfields_patchCustomFieldRequest: () => customfields_patchCustomFieldRequest,
   fields_models_VisibilityComparator: () => fields_models_VisibilityComparator,
   fields_models_VisibilityRuleType: () => fields_models_VisibilityRuleType,
   filechannel_CreateFileChannelInput: () => filechannel_CreateFileChannelInput,
@@ -265,6 +268,7 @@ var api_ClientItem;
   (function(status2) {
     status2["UNKNOWN"] = "unknown";
     status2["DELETED"] = "deleted";
+    status2["ARCHIVED"] = "archived";
     status2["ACTIVE"] = "active";
     status2["NOT_INVITED"] = "notInvited";
     status2["INVITED"] = "invited";
@@ -281,6 +285,16 @@ var api_InternalUserItem;
   })(role = api_InternalUserItem2.role || (api_InternalUserItem2.role = {}));
 })(api_InternalUserItem || (api_InternalUserItem = {}));
 
+// node_modules/@assembly-js/node-sdk/dist/codegen/api/models/api_UpdateClientInput.js
+var api_UpdateClientInput;
+(function(api_UpdateClientInput2) {
+  let status;
+  (function(status2) {
+    status2["ARCHIVED"] = "archived";
+    status2["ACTIVE"] = "active";
+  })(status = api_UpdateClientInput2.status || (api_UpdateClientInput2.status = {}));
+})(api_UpdateClientInput || (api_UpdateClientInput = {}));
+
 // node_modules/@assembly-js/node-sdk/dist/codegen/api/models/app_instance_AppConnectInput.js
 var app_instance_AppConnectInput;
 (function(app_instance_AppConnectInput2) {
@@ -356,11 +370,15 @@ var audit_log_AuditEventType;
   audit_log_AuditEventType2["EventClientUpdated"] = "clientUpdated";
   audit_log_AuditEventType2["EventClientDeleted"] = "clientDeleted";
   audit_log_AuditEventType2["EventClientInvited"] = "clientInvited";
+  audit_log_AuditEventType2["EventClientArchived"] = "clientArchived";
+  audit_log_AuditEventType2["EventClientRestored"] = "clientRestored";
   audit_log_AuditEventType2["EventCompanyCreated"] = "companyCreated";
   audit_log_AuditEventType2["EventCompanyUpdated"] = "companyUpdated";
   audit_log_AuditEventType2["EventCompanyCustomFieldsUpdated"] = "companyCustomFieldsUpdated";
   audit_log_AuditEventType2["EventCompanyDeleted"] = "companyDeleted";
   audit_log_AuditEventType2["EventClientCustomFieldsUpdated"] = "clientCustomFieldsUpdated";
+  audit_log_AuditEventType2["EventCustomFieldUpdated"] = "customFieldUpdated";
+  audit_log_AuditEventType2["EventCustomFieldDeleted"] = "customFieldDeleted";
   audit_log_AuditEventType2["EventFileCreated"] = "fileCreated";
   audit_log_AuditEventType2["EventFileUpdated"] = "fileUpdated";
   audit_log_AuditEventType2["EventFileDeleted"] = "fileDeleted";
@@ -408,12 +426,16 @@ var audit_log_AuditEventType;
   audit_log_AuditEventType2["EventInternalUserDeleted"] = "internalUserDeleted";
   audit_log_AuditEventType2["EventInternalUserAccessLevelChanged"] = "internalUserAccessLevelChanged";
   audit_log_AuditEventType2["EventInternalUserClientVisibilitySet"] = "internalUserClientVisibilitySet";
+  audit_log_AuditEventType2["EventAssistantAccessUpdated"] = "assistantAccessUpdated";
   audit_log_AuditEventType2["EventAPIKeyCreated"] = "apiKeyCreated";
   audit_log_AuditEventType2["EventAPIKeyDeleted"] = "apiKeyDeleted";
   audit_log_AuditEventType2["EventConnectorConnected"] = "connectorConnected";
   audit_log_AuditEventType2["EventConnectorReconnected"] = "connectorReconnected";
   audit_log_AuditEventType2["EventConnectorRevoked"] = "connectorRevoked";
   audit_log_AuditEventType2["EventConnectorRevokedExternally"] = "connectorRevokedExternally";
+  audit_log_AuditEventType2["EventSiteCredentialCreated"] = "siteCredentialCreated";
+  audit_log_AuditEventType2["EventSiteCredentialUsed"] = "siteCredentialUsed";
+  audit_log_AuditEventType2["EventSiteCredentialDeleted"] = "siteCredentialDeleted";
   audit_log_AuditEventType2["EventFormCreated"] = "formCreated";
   audit_log_AuditEventType2["EventFormEdited"] = "formEdited";
   audit_log_AuditEventType2["EventFormAssigned"] = "formAssigned";
@@ -429,6 +451,8 @@ var audit_log_AuditEventType;
   audit_log_AuditEventType2["EventAppAccessDeleted"] = "appAccessDeleted";
   audit_log_AuditEventType2["EventAppBuilderSecretUpdated"] = "appBuilderSecretUpdated";
   audit_log_AuditEventType2["EventAppEventEmitted"] = "appEventEmitted";
+  audit_log_AuditEventType2["EventAppDataChanged"] = "appDataChanged";
+  audit_log_AuditEventType2["EventClientCallRiskAccepted"] = "clientCallRiskAccepted";
   audit_log_AuditEventType2["EventQAAgentBearerMinted"] = "qaAgentBearerMinted";
   audit_log_AuditEventType2["EventQAImpersonationTokenMinted"] = "qaImpersonationTokenMinted";
   audit_log_AuditEventType2["EventQAPrincipalCreated"] = "qaPrincipalCreated";
@@ -613,6 +637,9 @@ var customfields_ClientCustomField;
     type2["PHONE_NUMBER"] = "phoneNumber";
     type2["ADDRESS"] = "address";
     type2["MULTI_SELECT"] = "multiSelect";
+    type2["DATE"] = "date";
+    type2["CHECKBOX"] = "checkbox";
+    type2["SELECT"] = "select";
   })(type = customfields_ClientCustomField2.type || (customfields_ClientCustomField2.type = {}));
 })(customfields_ClientCustomField || (customfields_ClientCustomField = {}));
 
@@ -633,9 +660,35 @@ var customfields_createCustomFieldInput;
     type2["PHONE_NUMBER"] = "phoneNumber";
     type2["ADDRESS"] = "address";
     type2["MULTI_SELECT"] = "multiSelect";
+    type2["DATE"] = "date";
+    type2["CHECKBOX"] = "checkbox";
+    type2["SELECT"] = "select";
   })(type = customfields_createCustomFieldInput2.type || (customfields_createCustomFieldInput2.type = {}));
 })(customfields_createCustomFieldInput || (customfields_createCustomFieldInput = {}));
 
+// node_modules/@assembly-js/node-sdk/dist/codegen/api/models/customfields_patchCustomFieldRequest.js
+var customfields_patchCustomFieldRequest;
+(function(customfields_patchCustomFieldRequest2) {
+  let entityType;
+  (function(entityType2) {
+    entityType2["CLIENT"] = "client";
+    entityType2["COMPANY"] = "company";
+  })(entityType = customfields_patchCustomFieldRequest2.entityType || (customfields_patchCustomFieldRequest2.entityType = {}));
+  let type;
+  (function(type2) {
+    type2["TEXT"] = "text";
+    type2["NUMBER"] = "number";
+    type2["EMAIL"] = "email";
+    type2["URL"] = "url";
+    type2["PHONE_NUMBER"] = "phoneNumber";
+    type2["ADDRESS"] = "address";
+    type2["MULTI_SELECT"] = "multiSelect";
+    type2["DATE"] = "date";
+    type2["CHECKBOX"] = "checkbox";
+    type2["SELECT"] = "select";
+  })(type = customfields_patchCustomFieldRequest2.type || (customfields_patchCustomFieldRequest2.type = {}));
+})(customfields_patchCustomFieldRequest || (customfields_patchCustomFieldRequest = {}));
+
 // node_modules/@assembly-js/node-sdk/dist/codegen/api/models/fields_models_VisibilityComparator.js
 var fields_models_VisibilityComparator;
 (function(fields_models_VisibilityComparator2) {
@@ -1445,6 +1498,89 @@ var request = (config, options) => {
   }));
 };
 
+// node_modules/@assembly-js/node-sdk/dist/codegen/api/services/AppsService.js
+var AppsService = class {
+  /**
+   * List callable apps
+   *
+   * Lists the other apps installed in the workspace that the calling app may
+   * call through the platform proxy, each with the hash of its published API
+   * description.
+   *
+   * @example
+   * await assembly.listApps();
+   */
+  static listApps() {
+    return request(OpenAPI, {
+      method: "GET",
+      url: "/v1/apps",
+      errors: {
+        401: `Missing or invalid credential`,
+        403: `The credential is not an app's`
+      }
+    });
+  }
+  /**
+   * Retrieve an app's operations
+   *
+   * Returns one app the caller may call with the operations the platform
+   * proxy serves for it: method, path and the label from its API description.
+   * Retrieve the app's contract for each operation's description, inputs and
+   * outputs. A workspace member also sees the operations the app's API
+   * registry declares, each with its description and input fields.
+   *
+   * @param appId The app's id
+   *
+   * @example
+   * await assembly.retrieveApp({ appId: ... });
+   */
+  static retrieveApp({ appId }) {
+    return request(OpenAPI, {
+      method: "GET",
+      url: "/v1/apps/{appId}",
+      path: {
+        "appId": appId
+      },
+      errors: {
+        401: `Missing or invalid credential`,
+        403: `The credential is not an app's`,
+        404: `app_not_found`
+      }
+    });
+  }
+  /**
+   * Retrieve an app's API description
+   *
+   * Returns the OpenAPI document the app published. The ETag is the
+   * contractHash from the apps list; send it back in If-None-Match to get a
+   * 304 when it has not changed.
+   *
+   * @param appId The app's id
+   * @param If-None-Match ETag of a copy the caller already holds
+   *
+   * @example
+   * await assembly.retrieveAppContract({ appId: ... });
+   */
+  static retrieveAppContract({ appId, ifNoneMatch }) {
+    return request(OpenAPI, {
+      method: "GET",
+      url: "/v1/apps/{appId}/contract",
+      path: {
+        "appId": appId
+      },
+      headers: {
+        "If-None-Match": ifNoneMatch
+      },
+      errors: {
+        304: `The description has not changed`,
+        401: `Missing or invalid credential`,
+        403: `The credential is not an app's`,
+        404: `app_not_found or contract_not_found`
+      }
+    });
+  }
+};
+
 // node_modules/@assembly-js/node-sdk/dist/codegen/api/services/ClientsService.js
 var ClientsService = class {
   /**
@@ -1487,8 +1623,9 @@ var ClientsService = class {
   /**
    * Create a client
    *
-   * Creates a client. Requires givenName, familyName, email, and a company
-   * association (companyId, or companyIds in multi-company portals). Set the
+   * Creates a client. Requires givenName, familyName, and a company
+   * association (plus email, unless the workspace allows clients without one)
+   * (companyId, or companyIds in multi-company portals). Set the
    * `sendInvite=true` query param to email the client an invite on creation.
    *
    * @param sendInvite Send the client an invite email on creation
@@ -1564,11 +1701,14 @@ var ClientsService = class {
   /**
    * Update a client
    *
-   * Partially updates a client. Only givenName, familyName, companyId, and
-   * customFields are mutable; any other field in the body is ignored and
-   * echoed back in the `X-Ignored-Fields` response header. Set
+   * Partially updates a client. Only givenName, familyName, companyId,
+   * customFields and status are mutable; any other field in the body is
+   * ignored and echoed back in the `X-Ignored-Fields` response header. Set
    * `sendInvite=true` to send (or resend) the client's invite when they are
-   * not yet active.
+   * not yet active. Set `status` to `archived` to archive the client or
+   * `active` to restore it; send it on its own, without other fields. An
+   * archived client rejects any other edit with a `client_archived` error
+   * until it is restored.
    *
    * @param id Client ID
    * @param sendInvite Send or resend the client's invite email
@@ -1591,7 +1731,9 @@ var ClientsService = class {
       errors: {
         400: `Invalid request body`,
         401: `Missing or invalid API key`,
+        403: `Client archiving is not available`,
         404: `Client not found`,
+        409: `Client is archived`,
         500: `Unexpected server error`
       }
     });
@@ -2064,7 +2206,7 @@ var CustomFieldsService = class {
    *
    * Creates one or more custom fields for the portal. Each field requires a
    * name, a type, and the entity it belongs to. Options may only be supplied
-   * for multi-select fields.
+   * for multi-select and select fields.
    *
    * @example
    * await assembly.createCustomField({ requestBody: ... });
@@ -2082,6 +2224,62 @@ var CustomFieldsService = class {
       }
     });
   }
+  /**
+   * Delete a custom field
+   *
+   * Deletes a custom field definition by its ID. Returns the deleted object
+   * marker.
+   *
+   * @param id Custom field ID
+   *
+   * @example
+   * await assembly.deleteCustomField({ id: ... });
+   */
+  static deleteCustomField({ id }) {
+    return request(OpenAPI, {
+      method: "DELETE",
+      url: "/v1/custom-fields/{id}",
+      path: {
+        "id": id
+      },
+      errors: {
+        400: `Missing custom field ID`,
+        401: `Missing or invalid API key`,
+        404: `Custom field not found`,
+        500: `Unexpected server error`
+      }
+    });
+  }
+  /**
+   * Update a custom field
+   *
+   * Renames a custom field and/or replaces the option set of a multiSelect or
+   * select custom field. A custom field's key, type, and entityType cannot be
+   * changed; supplying a type or entityType that differs from the field's
+   * current value is rejected.
+   *
+   * @param id Custom field ID
+   *
+   * @example
+   * await assembly.updateCustomField({ id: ..., requestBody: ... });
+   */
+  static updateCustomField({ id, requestBody }) {
+    return request(OpenAPI, {
+      method: "PATCH",
+      url: "/v1/custom-fields/{id}",
+      path: {
+        "id": id
+      },
+      body: requestBody,
+      mediaType: "application/json",
+      errors: {
+        400: `Invalid request body, attempted type/entityType change, or options provided for a field that has none`,
+        401: `Missing or invalid API key`,
+        404: `Custom field not found`,
+        500: `Unexpected server error`
+      }
+    });
+  }
   /**
    * List custom field options
    *
@@ -4276,15 +4474,25 @@ var TokenService = class {
    * Issues a short-lived, app-scoped bearer token using the app API key alone
    * — no user session required. Intended for cron jobs and background workers
    * that operate outside a user iframe. The token expires after one hour;
-   * re-mint it from the API key on expiry.
+   * re-mint it from the API key on expiry. An optional JSON body field
+   * `parent` carries the viewer bearer of the person whose request the app is
+   * serving. A valid parent makes the minted bearer carry a signed statement
+   * of who that person is and which company is active, and caps its lifetime
+   * at the parent's. A present but invalid parent is refused with
+   * `parent_invalid` (403) or `parent_expired` (401); it is never ignored. A
+   * parent that reached this app through another app's call extends that call
+   * chain by this app. The minted bearer's permissions are the same with or
+   * without a parent.
    *
    * @example
-   * await assembly.offlineTokenIssue();
+   * await assembly.offlineTokenIssue({ requestBody: ... });
    */
-  static offlineTokenIssue() {
+  static offlineTokenIssue({ requestBody }) {
     return request(OpenAPI, {
       method: "POST",
       url: "/v1/token",
+      body: requestBody,
+      mediaType: "application/json",
       errors: {
         401: `App API key required`,
         403: `Missing or invalid API key`,
@@ -4451,7 +4659,7 @@ var __awaiter3 = function(thisArg, _arguments, P, generator) {
   });
 };
 var { OpenAPI: OpenAPI2 } = api_exports;
-var SDK_VERSION = "4.2.4";
+var SDK_VERSION = "4.3.0";
 installOpenAPIProxy(OpenAPI2);
 var CLASS_OWN_KEYS = /* @__PURE__ */ new Set(["length", "name", "prototype"]);
 var SERVICE_NAME_PATTERN = /Service$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [
@@ -52,7 +52,7 @@
   },
   "devDependencies": {
     "@assembly-js/app-bridge": "2.0.0",
-    "@assembly-js/node-sdk": "4.2.4",
+    "@assembly-js/node-sdk": "4.3.0",
     "@neondatabase/serverless": "^1.1.0",
     "@types/bun": "^1.1.0",
     "@types/node": "^22",

package/skills/assembly-custom-fields/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: assembly-custom-fields
-description: Use any time the app reads or writes a workspace-defined custom field on a Client or Company. Two non-negotiable rules — never hardcode the field key (workspace owners pick their own), and option-bearing values must be arrays (multiSelect is the ONLY option-bearing type, even for single-pick UIs).
+description: Use any time the app reads or writes a workspace-defined custom field on a Client or Company. Two non-negotiable rules — never hardcode the field key (workspace owners pick their own), and multiSelect values are arrays while select values are a single option key string.
 ---
 
 ## The two non-negotiables
 
 1. **Never hardcode a field `key`.** Workspace owners pick their own keys (`favorite_pizza`, `fav_pizza`, `pizza`, anything). Wrong-guess reads silently return `undefined`; wrong-guess writes silently no-op. Discover dynamically by name.
-2. **Option-bearing values are arrays.** `multiSelect` is the ONLY option-bearing type in Assembly — there's no `singleSelect`, `dropdown`, or `select`. Anything that *looks like* a select is a `multiSelect`. Even single-pick UIs must wrap the value in a one-element array.
+2. **Match the value shape to the field `type`.** `select` (pick one) takes ONE option key as a string; `multiSelect` (pick many) takes an array of option keys, even from a single-pick UI. `checkbox` takes a real boolean and `date` a `YYYY-MM-DD` string. `address` takes a structured object (see below). Everything else is a string.
 
 ## Discovery (server-side)
 
@@ -30,17 +30,20 @@ const optionsRes = await assembly.listCustomFieldOptions({ id: pizzaField.id });
 
 ```ts
 const value = (client.customFields as Record<string, unknown>)?.[pizzaField.key];
-// For multiSelect: value is the option key array, e.g. ['pepperoni'], or undefined / [] if unset.
+// select: an option key string (or undefined if unset). multiSelect: an option key array, e.g. ['pepperoni'], or undefined / [] if unset.
+// checkbox: boolean (missing means unchecked). date: 'YYYY-MM-DD' string.
 ```
 
-## Write — value MUST be an array, even single-pick
+## Write — multiSelect MUST be an array, even single-pick
 
 ```ts
 await assembly.updateClient({
   id: clientId,
   requestBody: {
     customFields: {
-      [pizzaField.key]: selectedKey ? [selectedKey] : [],   // ← array, ALWAYS
+      [pizzaField.key]: selectedKey ? [selectedKey] : [],   // ← multiSelect: array, ALWAYS
+      // select field: [tierField.key]: selectedKey ?? ''  (one key string, '' clears)
+      // checkbox field: [flagField.key]: true  (boolean)   date field: [dateField.key]: '2026-11-19'
     },
     // ↑ Pass a plain object. Do NOT JSON.stringify() it.
   },
@@ -81,6 +84,7 @@ Send the structured object — a bare string is accepted for backwards compatibi
 ## Edge cases
 
 - **Multi-pick UI** (checkbox group): pass full array `[a.key, b.key]`.
-- **Clearing a value**: empty array `[]`, not `null` or `undefined`.
+- **Clearing a value**: empty array `[]` for multiSelect; `''` for select and date; not `null` or `undefined`.
+- **Checkbox** rejects the string `'true'`; send a JSON boolean.
 - **Either `key` or `id` works** as the inner option value — use `key` by convention.
 - Same shape applies to `createClient`, `createCompany`, `updateCompany`.

package/skills/assembly-native-resources/SKILL.md

@@ -69,6 +69,41 @@ await assembly.sendMessage({
 
 `retrieveMessageChannel({ id })` is for a channel id you already resolved this request — never for one typed into the source.
 
+## A company is one channel
+
+When the user selects a **company**, send one message on that company's channel. Do not expand the company into its clients, and do not create an individual channel per client. That fan-out opens a new 1:1 thread for every person in the company and delivers the message there instead of the company thread they asked for.
+
+Individual channels are only for a recipient the user picked as a specific client. The same rule applies to file channels: a company attachment goes on the company file channel.
+
+```ts
+async function findOrCreateCompanyMessageChannel(
+  assembly: AssemblyAPI,
+  companyId: string,
+): Promise<string> {
+  const { data } = await assembly.listMessageChannels({
+    companyId,
+    membershipType: 'company',
+    limit: 1,
+  });
+  // A 1:1 thread for someone at this company also carries companyId. Send only
+  // when the row is the company channel.
+  const existing = data?.find((channel) => channel.membershipType === 'company');
+  if (existing?.id) return existing.id;
+
+  // membershipType is a string enum the package root does not re-export, so a
+  // bare 'company' literal does not typecheck. Assert the request body.
+  const created = await assembly.createMessageChannel({
+    requestBody: { companyId, membershipType: 'company' } as Parameters<
+      AssemblyAPI['createMessageChannel']
+    >[0]['requestBody'],
+  });
+  if (!created.id) throw new Error('Company channel was not created');
+  return created.id;
+}
+```
+
+Pass `companyId` when creating an individual channel for a client who belongs to more than one company. A create with only `clientId` is rejected for those clients.
+
 ## Discovering a file channel
 
 ```ts
@@ -113,6 +148,7 @@ Render an explicit, honest empty state and stop — "The intake form hasn't been
 | Matched on the id instead of a stable attribute | Same — an id is not stable across workspaces, a name is |
 | Matched a form on `form.name` | Always undefined; the display name is `form.fields.name`, so nothing ever matches and the app renders its empty state forever |
 | Fell back to a literal id when discovery found nothing | The feature appears to work and writes into the wrong place, or fails on a resource the workspace can't see |
+| Expanded a selected company into one individual channel per client | The workspace gets a burst of new 1:1 threads, and the message never lands in the company channel |
 | Used the Files module for app-private uploads | Attachments show up in the client's portal Files tab |
 
 ## Edge cases
@@ -121,5 +157,5 @@ Render an explicit, honest empty state and stop — "The intake form hasn't been
 - **Every list method takes an options object**, even when you pass no filters — `listForms({})`, not `listForms()`.
 - **List responses are paginated envelopes**, and `data` is nullable: destructure with a default and still index defensively (`const { data: forms = [] } = …; forms?.[0]`).
 - **Narrow before you index.** Taking `[0]` off an unfiltered list is the same guess as a hardcoded id. Filter by `membershipType` (and `companyId` for a client in multiple companies); if two candidates genuinely remain, surface the choice rather than picking one.
-- **Creating a channel is not a substitute for finding one.** `createMessageChannel` requires a `membershipType`, and its type is a string enum the SDK does not re-export from its package root — you cannot satisfy it with a plain `'individual'` string. Work with the channels the workspace already has; check the SDK types first if you genuinely need to create one.
+- **Look up the channel, then create it only if that company or client does not have one yet.** Use `membershipType: 'company'` with `companyId` for a company, and `membershipType: 'individual'` with `clientId` (plus `companyId` when the client is in multiple companies) for one client. The enum is not re-exported from the package root, so assert the request body as in the company example. Never turn a company selection into one individual channel per member.
 - **Ids from the app bridge or a route param** are runtime values, not literals — those are fine to pass straight to `retrieve*`, after the usual auth and scope checks (see `assembly-auth`).