@colixsystems/widget-sdk 0.102.1 → 0.104.0

package/README.md

@@ -68,7 +68,32 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.95.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.104.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.104.0 (contract 1.79.0)
+
+**Each corner can be rounded on its own — the `cornerRadius` property type.** A radius was a single number, so every rounded surface was rounded on all four corners: a card that meets the screen edge, a tab rounded only on top, or a bubble with one squared corner had no expression.
+
+Declare `{ type: "cornerRadius", label: "Corner radius", validation: { min: 0, max: 48 } }` in your `propertySchema` or `styleSchema`. The Studio renders a slider with a typeable number that sets all four corners, plus a disclosure for setting each one. The authored value is `number | { topLeft, topRight, bottomRight, bottomLeft }` — the scalar form is unchanged, so every value stored before is still valid.
+
+Resolve it with the two new exports rather than reading the raw value, because they hide the shape and spell the style props the way BOTH hosts accept:
+
+```js
+import { normaliseCornerRadius, cornerRadiusStyle } from "@colixsystems/widget-sdk";
+
+const radius = normaliseCornerRadius(style.radius, 0, 48);
+return <View style={[styles.card, cornerRadiusStyle(radius)]} />;
+```
+
+`normaliseCornerRadius(value, fallback, max)` returns all four corners resolved and clamped; `cornerRadiusStyle(radius, format)` emits the `borderRadius` shorthand when they agree and the four long-hand props when they differ (pass `n => `+"`${n}px`"+`` for the DOM). `isUniformCornerRadius` and `hasCornerRadius` round out the set. `CONTRACT.version` → `1.79.0`. Additive: every value accepted before is accepted now.
+
+### What's new in 0.103.0 (contract 1.78.0)
+
+**An app-wide style value may have SHAPE — `widgetStyles` is no longer scalars-only.** Your `styleSchema` is offered in two places: the widget editor (per placed instance) and Theme Settings (app-wide, under your widget's own name). A field holding a structured value — an overlay object, a list of ids — persisted in the first and was silently dropped by the second, so the same edit behaved two ways depending on where the author made it.
+
+`normaliseWidgetStyles` now carries objects and arrays, bounded by `CONTRACT.themeWidgetStyles`: `maxValueDepth` (3), `maxValueEntries` (24 per level), `maxValueBytes` (512 per field), and a new `maxBytes` (64000) over the whole map — a ceiling the per-scalar limits never stated, so the worst-case payload of that unauthenticated cold-start read is now *smaller* than before. `__proto__`-style keys are refused at every level.
+
+Host-integration surface only — nothing a widget imports changed, and your widget still reads `props.style` without learning which layer supplied a value. `CONTRACT.version` → `1.78.0`. Additive: every value accepted before is accepted now.
 
 ### What's new in 0.95.0 (contract 1.68.0)
 

package/dist/contract.cjs

@@ -158,6 +158,15 @@ const THEME_WIDGET_STYLES = Object.freeze({
   maxWidgets: 200,
   // Matches the styleSchema field cap the widget agent is held to.
   maxFieldsPerWidget: 12,
+  // sc-5646: a styleSchema field may hold a STRUCTURED value (a container's
+  // overlay, a list of ids), so the ceiling is stated in bytes rather than
+  // assumed to be one short scalar.
+  maxValueBytes: 512,
+  // The whole map, because it rides that unauthenticated cold-start read.
+  maxBytes: 64000,
+  // Nesting/width a structured value may reach before it is dropped.
+  maxValueDepth: 3,
+  maxValueEntries: 24,
 });
 // REQ-NAV-STRUCTURE: the SHAPE an app's navigation takes. One catalogue, four
 // consumers -- the Studio's Navigation page, Mason's set_theme coercion, the web
@@ -230,6 +239,15 @@ const FORM_SUBMIT_FIELDS = Object.freeze({
   gradient: "submitGradient",
 });
 
+// The Link card's action button -- its own `button*` names, kept distinct from
+// the card surface the button sits on.
+const LINK_ACTION_FIELDS = Object.freeze({
+  background: "buttonBackground",
+  textColor: "buttonTextColor",
+  gradient: "buttonGradient",
+  radius: "buttonRadius",
+});
+
 // REQ-THEME-WIDGET: the card fields whose NAMES are unambiguous, so they bind to
 // ANY widget that reads them -- including a Mason-generated one, whose id can
 // never appear in a hand-maintained allowlist. That allowlist is why "make the
@@ -299,6 +317,8 @@ const THEME_COMPONENTS = Object.freeze({
       }),
       "appstudio.form-input": FORM_SUBMIT_FIELDS,
       "appstudio.form-builder": FORM_SUBMIT_FIELDS,
+      // sc-5757: the Link card's action button, so the button scope reaches it.
+      "appstudio.link": LINK_ACTION_FIELDS,
     }),
   }),
   card: Object.freeze({
@@ -322,6 +342,7 @@ const THEME_COMPONENTS = Object.freeze({
       "appstudio.form-input": CARD_SURFACE_FIELDS,
       "appstudio.form-builder": CARD_SURFACE_FIELDS,
       "appstudio.user-management": CARD_SURFACE_FIELDS,
+      "appstudio.link": CARD_SURFACE_FIELDS,
     }),
   }),
   text: Object.freeze({
@@ -3266,7 +3287,21 @@ const CONTRACT = deepFreeze({
   //    PAGE_ROUTES maps both to the screen name), but the contract said
   //    `pageId` only, so data-driven widgets — whose rows carry slugs —
   //    invented params patterns that navigate nowhere. No code changed shape.
-  version: "1.77.0",
+  // 1.79.0: additive (sc-5890) — the `cornerRadius` property type: a radius
+  // value is `number | { topLeft, topRight, bottomRight, bottomLeft }`, resolved
+  // by `normaliseCornerRadius` and emitted by `cornerRadiusStyle`.
+  // 1.78.0: additive (sc-5646) — `widgetStyles` carries every value shape a
+  //    `styleSchema` field can produce, not just scalars and gradients. The
+  //    Studio offers the SAME field in the widget editor and in Theme
+  //    Settings, so a structured value (a container-style overlay, a list of
+  //    ids) that persisted per instance but was dropped app-wide made one
+  //    edit behave two ways. Objects and arrays are now carried, bounded by
+  //    `themeWidgetStyles.maxValueDepth` / `maxValueEntries` /
+  //    `maxValueBytes`, with `maxBytes` capping the whole map — a ceiling the
+  //    per-scalar limits never stated, so the worst-case unauthenticated
+  //    payload is SMALLER than before. `__proto__`-style keys are refused at
+  //    every level. Additive: every value accepted before is accepted now.
+  version: "1.79.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/contract.js

@@ -158,6 +158,15 @@ const THEME_WIDGET_STYLES = Object.freeze({
   maxWidgets: 200,
   // Matches the styleSchema field cap the widget agent is held to.
   maxFieldsPerWidget: 12,
+  // sc-5646: a styleSchema field may hold a STRUCTURED value (a container's
+  // overlay, a list of ids), so the ceiling is stated in bytes rather than
+  // assumed to be one short scalar.
+  maxValueBytes: 512,
+  // The whole map, because it rides that unauthenticated cold-start read.
+  maxBytes: 64000,
+  // Nesting/width a structured value may reach before it is dropped.
+  maxValueDepth: 3,
+  maxValueEntries: 24,
 });
 // REQ-NAV-STRUCTURE: the SHAPE an app's navigation takes. One catalogue, four
 // consumers -- the Studio's Navigation page, Mason's set_theme coercion, the web
@@ -230,6 +239,15 @@ const FORM_SUBMIT_FIELDS = Object.freeze({
   gradient: "submitGradient",
 });
 
+// The Link card's action button -- its own `button*` names, kept distinct from
+// the card surface the button sits on.
+const LINK_ACTION_FIELDS = Object.freeze({
+  background: "buttonBackground",
+  textColor: "buttonTextColor",
+  gradient: "buttonGradient",
+  radius: "buttonRadius",
+});
+
 // REQ-THEME-WIDGET: the card fields whose NAMES are unambiguous, so they bind to
 // ANY widget that reads them -- including a Mason-generated one, whose id can
 // never appear in a hand-maintained allowlist. That allowlist is why "make the
@@ -299,6 +317,8 @@ const THEME_COMPONENTS = Object.freeze({
       }),
       "appstudio.form-input": FORM_SUBMIT_FIELDS,
       "appstudio.form-builder": FORM_SUBMIT_FIELDS,
+      // sc-5757: the Link card's action button, so the button scope reaches it.
+      "appstudio.link": LINK_ACTION_FIELDS,
     }),
   }),
   card: Object.freeze({
@@ -322,6 +342,7 @@ const THEME_COMPONENTS = Object.freeze({
       "appstudio.form-input": CARD_SURFACE_FIELDS,
       "appstudio.form-builder": CARD_SURFACE_FIELDS,
       "appstudio.user-management": CARD_SURFACE_FIELDS,
+      "appstudio.link": CARD_SURFACE_FIELDS,
     }),
   }),
   text: Object.freeze({
@@ -3266,7 +3287,21 @@ const CONTRACT = deepFreeze({
   //    PAGE_ROUTES maps both to the screen name), but the contract said
   //    `pageId` only, so data-driven widgets — whose rows carry slugs —
   //    invented params patterns that navigate nowhere. No code changed shape.
-  version: "1.77.0",
+  // 1.79.0: additive (sc-5890) — the `cornerRadius` property type: a radius
+  // value is `number | { topLeft, topRight, bottomRight, bottomLeft }`, resolved
+  // by `normaliseCornerRadius` and emitted by `cornerRadiusStyle`.
+  // 1.78.0: additive (sc-5646) — `widgetStyles` carries every value shape a
+  //    `styleSchema` field can produce, not just scalars and gradients. The
+  //    Studio offers the SAME field in the widget editor and in Theme
+  //    Settings, so a structured value (a container-style overlay, a list of
+  //    ids) that persisted per instance but was dropped app-wide made one
+  //    edit behave two ways. Objects and arrays are now carried, bounded by
+  //    `themeWidgetStyles.maxValueDepth` / `maxValueEntries` /
+  //    `maxValueBytes`, with `maxBytes` capping the whole map — a ceiling the
+  //    per-scalar limits never stated, so the worst-case unauthenticated
+  //    payload is SMALLER than before. `__proto__`-style keys are refused at
+  //    every level. Additive: every value accepted before is accepted now.
+  version: "1.79.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/corner-radius.js

@@ -0,0 +1,95 @@
+// REQ-LAY-16 (sc-5890): the per-corner radius vocabulary. ONE normaliser and
+// ONE style emitter for the web Player, the Builder canvas, the exported Expo
+// app, and any custom widget declaring a `cornerRadius` field — so the four can
+// never disagree about what a radius value means.
+//
+// The authored value is `number | { topLeft, topRight, bottomRight, bottomLeft }`.
+// The scalar form is the one sc-3797 shipped and is still what most styles hold,
+// so it stays first-class rather than being migrated away: widening the shape
+// beats adding a second key beside it (CLAUDE.md §3).
+//
+// Both hosts spell the long-hand props identically (`borderTopLeftRadius` &co in
+// React inline style AND in React Native), which is why one emitter serves both.
+
+export const CORNER_RADIUS_KEYS = Object.freeze([
+  "topLeft",
+  "topRight",
+  "bottomRight",
+  "bottomLeft",
+]);
+
+const LONGHAND_PROP = Object.freeze({
+  topLeft: "borderTopLeftRadius",
+  topRight: "borderTopRightRadius",
+  bottomRight: "borderBottomRightRadius",
+  bottomLeft: "borderBottomLeftRadius",
+});
+
+function clampCorner(value, fallback, max) {
+  // Unset (undefined/null/"") falls back; an explicit 0 is honoured — that
+  // distinction is what makes "square just this corner" expressible.
+  if (value === undefined || value === null || value === "") return fallback;
+  const n = Number(value);
+  if (!Number.isFinite(n)) return fallback;
+  return Math.min(Math.max(Math.round(n), 0), max);
+}
+
+/**
+ * Resolve an authored radius to its four corners.
+ *
+ * @param {number|object|null|undefined} value the authored `number | {corners}`
+ * @param {number} [fallback] the value each unset corner takes
+ * @param {number} [max] the upper clamp, matching the field's declared max
+ * @returns {{topLeft:number, topRight:number, bottomRight:number, bottomLeft:number}}
+ */
+export function normaliseCornerRadius(value, fallback = 0, max = 48) {
+  const base = clampCorner(
+    typeof value === "number" || typeof value === "string" ? value : undefined,
+    clampCorner(fallback, 0, max),
+    max,
+  );
+  const corners = value && typeof value === "object" ? value : null;
+  const out = {};
+  for (const key of CORNER_RADIUS_KEYS) {
+    out[key] = clampCorner(corners ? corners[key] : undefined, base, max);
+  }
+  return out;
+}
+
+/** True when all four corners resolve to the same number. */
+export function isUniformCornerRadius(radius) {
+  if (!radius) return true;
+  const { topLeft } = radius;
+  return CORNER_RADIUS_KEYS.every((key) => radius[key] === topLeft);
+}
+
+/**
+ * The style props for a resolved radius, in the spelling BOTH hosts accept.
+ * A uniform radius emits the `borderRadius` shorthand so an untouched style is
+ * byte-identical to what sc-3797 produced; only a genuinely mixed radius pays
+ * for the four long-hand props. A radius of all-zero emits nothing at all.
+ *
+ * @param {object|null} radius output of {@link normaliseCornerRadius}
+ * @param {(n: number) => any} [format] wraps each number — the DOM needs "12px"
+ * @returns {object|null}
+ */
+export function cornerRadiusStyle(radius, format) {
+  if (!radius) return null;
+  const wrap = format || ((n) => n);
+  if (isUniformCornerRadius(radius)) {
+    return radius.topLeft > 0 ? { borderRadius: wrap(radius.topLeft) } : null;
+  }
+  const out = {};
+  for (const key of CORNER_RADIUS_KEYS) {
+    out[LONGHAND_PROP[key]] = wrap(radius[key]);
+  }
+  return out;
+}
+
+/**
+ * True when the authored value asks for anything rounded. Callers use it to
+ * decide whether a background layer needs clipping at all.
+ */
+export function hasCornerRadius(radius) {
+  return Boolean(radius) && CORNER_RADIUS_KEYS.some((key) => radius[key] > 0);
+}

package/dist/host.d.ts

@@ -45,6 +45,17 @@ export function normaliseThemeComponents(raw: unknown): ThemeComponents;
  * contract, so the authoritative field type is the widget's own styleSchema.
  * Bounded by `CONTRACT.themeWidgetStyles`.
  */
+/**
+ * sc-5646 host helper: validates ONE widget style object — a placed node's
+ * `props.style` or an app-wide `widgetStyles[id]` entry. Both scopes hold the
+ * same vocabulary, so both are validated the same way; `maxFields` applies the
+ * per-widget cap only the app-wide map needs.
+ */
+export function normaliseWidgetStyleFields(
+  raw: unknown,
+  options?: { maxFields?: number },
+): Record<string, unknown>;
+
 export function normaliseWidgetStyles(raw: unknown): ThemeWidgetStyles;
 
 /**

package/dist/host.js

@@ -18,6 +18,7 @@ export { resolveProps } from "./property-schema.js";
 // hosts, so the Player and the Expo export cannot diverge.
 export {
   normaliseThemeComponents,
+  normaliseWidgetStyleFields,
   normaliseWidgetStyles,
   applyThemeComponentStyle,
 } from "./theme-components.js";

package/dist/index.d.ts

@@ -53,6 +53,10 @@ export type WidgetPropertyType =
   // label, required, optionsSource, inlineOptions, optionsTableId,
   // optionsValueColumn, optionsLabelColumn }.
   | "fieldList"
+  // REQ-LAY-16 (sc-5890): corner-radius picker. Value is
+  // `number | { topLeft, topRight, bottomRight, bottomLeft }` — a scalar rounds
+  // all four corners, the object rounds each independently.
+  | "cornerRadius"
   | "expression"
   | "eventBinding"
   | "object"
@@ -692,6 +696,44 @@ export function validateProps<T = Record<string, unknown>>(
   props: unknown,
 ): { ok: true; value: T } | { ok: false; errors: string[] };
 
+/**
+ * REQ-LAY-16 (sc-5890): the per-corner radius vocabulary. A `cornerRadius`
+ * field's authored value is a scalar or a per-corner object; resolve it with
+ * `normaliseCornerRadius` and turn it into style props with `cornerRadiusStyle`
+ * — both hosts spell the long-hand props identically, so one call serves the
+ * web Player and the Expo export.
+ */
+export type CornerRadiusKey =
+  | "topLeft"
+  | "topRight"
+  | "bottomRight"
+  | "bottomLeft";
+
+export type CornerRadiusValue = number | Partial<Record<CornerRadiusKey, number>>;
+
+export type ResolvedCornerRadius = Record<CornerRadiusKey, number>;
+
+export const CORNER_RADIUS_KEYS: readonly CornerRadiusKey[];
+
+export function normaliseCornerRadius(
+  value: CornerRadiusValue | null | undefined,
+  fallback?: number,
+  max?: number,
+): ResolvedCornerRadius;
+
+export function isUniformCornerRadius(
+  radius: ResolvedCornerRadius | null | undefined,
+): boolean;
+
+export function cornerRadiusStyle<T = number>(
+  radius: ResolvedCornerRadius | null | undefined,
+  format?: (n: number) => T,
+): Record<string, T> | null;
+
+export function hasCornerRadius(
+  radius: ResolvedCornerRadius | null | undefined,
+): boolean;
+
 export interface Query {
   filter?: Record<string, unknown>;
   sort?: Array<{ field: string; dir: "asc" | "desc" }>;

package/dist/index.js

@@ -5,6 +5,14 @@
 export { defineWidget } from "./define-widget.js";
 export { validateManifest, canonicalCategory } from "./manifest.js";
 export { validatePropertySchema, validateProps } from "./property-schema.js";
+// REQ-LAY-16 (sc-5890): per-corner radius — one normaliser/emitter for both hosts.
+export {
+  CORNER_RADIUS_KEYS,
+  normaliseCornerRadius,
+  isUniformCornerRadius,
+  cornerRadiusStyle,
+  hasCornerRadius,
+} from "./corner-radius.js";
 export {
   WidgetContextProvider,
   DatastoreError,

package/dist/index.native.js

@@ -5,6 +5,14 @@
 export { defineWidget } from "./define-widget.js";
 export { validateManifest, canonicalCategory } from "./manifest.js";
 export { validatePropertySchema, validateProps } from "./property-schema.js";
+// REQ-LAY-16 (sc-5890): per-corner radius — one normaliser/emitter for both hosts.
+export {
+  CORNER_RADIUS_KEYS,
+  normaliseCornerRadius,
+  isUniformCornerRadius,
+  cornerRadiusStyle,
+  hasCornerRadius,
+} from "./corner-radius.js";
 export {
   WidgetContextProvider,
   DatastoreError,

package/dist/property-schema.js

@@ -1,6 +1,8 @@
 // Property schema validation per docs/architecture/widget-marketplace.md §2.2.
 // Drives the schema-driven Properties Panel and validates persisted page JSON.
 
+import { CORNER_RADIUS_KEYS } from "./corner-radius.js";
+
 const VALID_TYPES = new Set([
   "string", "number", "boolean",
   "color", "icon", "image",
@@ -47,6 +49,14 @@ const VALID_TYPES = new Set([
   // NOT copied, so tenant-copy leaves the id as-is (it resolves to the space
   // root if absent in the target).
   "folderRef",
+  // REQ-LAY-16 (sc-5890): `cornerRadius` is a corner-radius picker. Its value
+  // is `number | { topLeft, topRight, bottomRight, bottomLeft }` — a scalar
+  // rounds all four, the object rounds each independently. The Studio renders
+  // a slider + typeable number with a per-corner disclosure; a widget turns
+  // the value into style props with `cornerRadiusStyle(normaliseCornerRadius(v))`,
+  // which both hosts spell identically. Plain numbers, so tenant-copy needs
+  // no remap.
+  "cornerRadius",
   "expression", "eventBinding",
   "object", "array",
 ]);
@@ -152,6 +162,36 @@ function coerceLeaf(def, value, path, errors) {
     case "boolean":
       if (typeof value !== "boolean") errors.push(`${path}: expected boolean`);
       return value;
+    case "cornerRadius": {
+      // REQ-LAY-16: a scalar rounds all four corners; an object rounds each.
+      // Every corner is optional so a half-set object stays valid while the
+      // author is still adjusting — an unset corner falls back to the scalar.
+      const { min = 0, max } = def.validation || {};
+      const checkCorner = (n, at) => {
+        if (typeof n !== "number" || Number.isNaN(n)) {
+          errors.push(`${at}: expected number`);
+          return;
+        }
+        if (n < min) errors.push(`${at}: must be >= ${min}`);
+        if (max !== undefined && n > max) errors.push(`${at}: must be <= ${max}`);
+      };
+      if (typeof value === "number") {
+        checkCorner(value, path);
+        return value;
+      }
+      if (!isPlainObject(value)) {
+        errors.push(`${path}: expected number or per-corner object`);
+        return value;
+      }
+      for (const [k, n] of Object.entries(value)) {
+        if (!CORNER_RADIUS_KEYS.includes(k)) {
+          errors.push(`${path}.${k}: unknown corner`);
+        } else if (n !== undefined && n !== null) {
+          checkCorner(n, `${path}.${k}`);
+        }
+      }
+      return value;
+    }
     case "select":
       if (Array.isArray(def.enum) && !def.enum.some((e) => e.value === value)) {
         errors.push(`${path}: value not in enum`);

package/dist/theme-components.cjs

@@ -99,12 +99,30 @@ function normaliseThemeComponents(raw) {
 }
 
 
+// Values are assigned onto plain object literals, so `__proto__` would set a
+// PROTOTYPE rather than a style field. Refused at every level.
+const UNSAFE_STYLE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+function isUsableStyleKey(key) {
+  return (
+    typeof key === "string" &&
+    key.length > 0 &&
+    key.length <= 64 &&
+    !UNSAFE_STYLE_KEYS.has(key)
+  );
+}
+
 // REQ-THEME-ELEMENT: one value out of the per-widget map. Unlike a component
 // token, there is no declared `type` to coerce against -- the key space is the
 // workspace's widget catalog, not the contract -- so validation here is
 // STRUCTURAL. The authoritative type is the widget's own styleSchema, which the
 // Studio honours by only ever offering fields that widget declares.
-function coerceWidgetStyleValue(value) {
+//
+// sc-5646: that same field is offered per instance AND app-wide, so carrying
+// only scalars here made one edit behave two ways. A structured value rides
+// along too -- bounded by depth, width and bytes, never by trust.
+function coerceWidgetStyleValue(value, depth = 0) {
+  const { maxValueDepth, maxValueEntries } = CONTRACT.themeWidgetStyles;
   if (typeof value === "string") {
     const trimmed = value.trim();
     // Long enough for a hex, an enum value or a font name; short enough that a
@@ -113,10 +131,75 @@ function coerceWidgetStyleValue(value) {
   }
   if (typeof value === "number") return Number.isFinite(value) ? value : undefined;
   if (typeof value === "boolean") return value;
-  if (isPlainObject(value)) return normaliseComponentGradient(value) || undefined;
+  if (depth >= maxValueDepth) return undefined;
+  if (Array.isArray(value)) {
+    const items = [];
+    for (const item of value) {
+      if (items.length >= maxValueEntries) break;
+      const coerced = coerceWidgetStyleValue(item, depth + 1);
+      if (coerced !== undefined) items.push(coerced);
+    }
+    return items.length > 0 ? items : undefined;
+  }
+  if (isPlainObject(value)) {
+    // A gradient keeps its own normaliser -- its stops are interpolated into
+    // CSS and into generated export source, so they never ride the generic
+    // path. Claiming the grammar is enough to be held to it: an invalid one is
+    // dropped rather than carried through as a plain object.
+    if ("from" in value || "to" in value) {
+      return normaliseComponentGradient(value) || undefined;
+    }
+    const out = {};
+    let kept = 0;
+    for (const [key, item] of Object.entries(value)) {
+      if (kept >= maxValueEntries) break;
+      if (!isUsableStyleKey(key)) continue;
+      const coerced = coerceWidgetStyleValue(item, depth + 1);
+      if (coerced === undefined) continue;
+      out[key] = coerced;
+      kept += 1;
+    }
+    return kept > 0 ? out : undefined;
+  }
   return undefined;
 }
 
+// What the value actually costs the cold-start read and the baked export.
+function styleValueBytes(value) {
+  const json = JSON.stringify(value);
+  return typeof json === "string" ? json.length : Infinity;
+}
+
+/**
+ * sc-5646: ONE widget's style fields, validated. The app-wide layer and a placed
+ * node's `props.style` hold the SAME vocabulary at different scopes, so they must
+ * accept the same values — a field an author can set on a node and not app-wide
+ * (or the reverse) is exactly the divergence the two surfaces are meant not to
+ * have. The per-widget FIELD cap is deliberately not applied here: it bounds the
+ * app-wide map that rides the unauthenticated cold-start read, not one node in a
+ * page layout the builder already writes unbounded.
+ *
+ * @param {unknown} raw — a `props.style` / `widgetStyles[id]` object.
+ * @param {{ maxFields?: number }} [options]
+ * @returns {Record<string, unknown>} the fields that survived; `{}` for junk.
+ */
+function normaliseWidgetStyleFields(raw, { maxFields } = {}) {
+  if (!isPlainObject(raw)) return {};
+  const { maxValueBytes } = CONTRACT.themeWidgetStyles;
+  const out = {};
+  let count = 0;
+  for (const [field, value] of Object.entries(raw)) {
+    if (maxFields !== undefined && count >= maxFields) break;
+    if (!isUsableStyleKey(field)) continue;
+    const coerced = coerceWidgetStyleValue(value);
+    if (coerced === undefined) continue;
+    if (styleValueBytes(coerced) > maxValueBytes) continue;
+    out[field] = coerced;
+    count += 1;
+  }
+  return out;
+}
+
 /**
  * REQ-THEME-ELEMENT: validate `themeConfig.widgetStyles` -- app-wide style values
  * keyed by WIDGET MANIFEST ID, then by that widget's own styleSchema field name.
@@ -132,26 +215,31 @@ function coerceWidgetStyleValue(value) {
  */
 function normaliseWidgetStyles(raw) {
   if (!isPlainObject(raw)) return {};
-  const { maxWidgets, maxFieldsPerWidget } = CONTRACT.themeWidgetStyles;
+  const { maxWidgets, maxFieldsPerWidget, maxBytes } =
+    CONTRACT.themeWidgetStyles;
   const idPattern = CONTRACT.manifestSchema.id.pattern;
   const out = {};
   let widgets = 0;
+  let bytes = 0;
   for (const [manifestId, fields] of Object.entries(raw)) {
     if (widgets >= maxWidgets) break;
     if (!idPattern.test(manifestId) || !isPlainObject(fields)) continue;
-    const kept = {};
-    let count = 0;
-    for (const [field, value] of Object.entries(fields)) {
-      if (count >= maxFieldsPerWidget) break;
-      const coerced = coerceWidgetStyleValue(value);
-      if (coerced === undefined) continue;
-      kept[field] = coerced;
-      count += 1;
-    }
+    // The SAME per-field validation a placed node's style gets, plus the cap
+    // that only this map needs.
+    const kept = normaliseWidgetStyleFields(fields, {
+      maxFields: maxFieldsPerWidget,
+    });
+    const count = Object.keys(kept).length;
     // An emptied entry is dropped rather than persisted as `{}`, mirroring
     // normaliseThemeComponents.
     if (count === 0) continue;
+    // Whole entries, never half of one: a widget rendering with SOME of its
+    // app-wide fields reads as a bug, where one rendering with none reads as
+    // "not styled yet".
+    const entryBytes = styleValueBytes(kept) + manifestId.length;
+    if (bytes + entryBytes > maxBytes) break;
     out[manifestId] = kept;
+    bytes += entryBytes;
     widgets += 1;
   }
   return out;
@@ -245,4 +333,4 @@ function applyThemeComponentStyle(manifestId, theme, props, styleSchema) {
   return { ...base, style: { ...themed, ...authored } };
 }
 
-module.exports = { normaliseThemeComponents, normaliseWidgetStyles, applyThemeComponentStyle };
+module.exports = { normaliseThemeComponents, normaliseWidgetStyleFields, normaliseWidgetStyles, applyThemeComponentStyle };

package/dist/theme-components.js

@@ -91,12 +91,30 @@ export function normaliseThemeComponents(raw) {
 }
 
 
+// Values are assigned onto plain object literals, so `__proto__` would set a
+// PROTOTYPE rather than a style field. Refused at every level.
+const UNSAFE_STYLE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+function isUsableStyleKey(key) {
+  return (
+    typeof key === "string" &&
+    key.length > 0 &&
+    key.length <= 64 &&
+    !UNSAFE_STYLE_KEYS.has(key)
+  );
+}
+
 // REQ-THEME-ELEMENT: one value out of the per-widget map. Unlike a component
 // token, there is no declared `type` to coerce against -- the key space is the
 // workspace's widget catalog, not the contract -- so validation here is
 // STRUCTURAL. The authoritative type is the widget's own styleSchema, which the
 // Studio honours by only ever offering fields that widget declares.
-function coerceWidgetStyleValue(value) {
+//
+// sc-5646: that same field is offered per instance AND app-wide, so carrying
+// only scalars here made one edit behave two ways. A structured value rides
+// along too -- bounded by depth, width and bytes, never by trust.
+function coerceWidgetStyleValue(value, depth = 0) {
+  const { maxValueDepth, maxValueEntries } = CONTRACT.themeWidgetStyles;
   if (typeof value === "string") {
     const trimmed = value.trim();
     // Long enough for a hex, an enum value or a font name; short enough that a
@@ -105,10 +123,75 @@ function coerceWidgetStyleValue(value) {
   }
   if (typeof value === "number") return Number.isFinite(value) ? value : undefined;
   if (typeof value === "boolean") return value;
-  if (isPlainObject(value)) return normaliseComponentGradient(value) || undefined;
+  if (depth >= maxValueDepth) return undefined;
+  if (Array.isArray(value)) {
+    const items = [];
+    for (const item of value) {
+      if (items.length >= maxValueEntries) break;
+      const coerced = coerceWidgetStyleValue(item, depth + 1);
+      if (coerced !== undefined) items.push(coerced);
+    }
+    return items.length > 0 ? items : undefined;
+  }
+  if (isPlainObject(value)) {
+    // A gradient keeps its own normaliser -- its stops are interpolated into
+    // CSS and into generated export source, so they never ride the generic
+    // path. Claiming the grammar is enough to be held to it: an invalid one is
+    // dropped rather than carried through as a plain object.
+    if ("from" in value || "to" in value) {
+      return normaliseComponentGradient(value) || undefined;
+    }
+    const out = {};
+    let kept = 0;
+    for (const [key, item] of Object.entries(value)) {
+      if (kept >= maxValueEntries) break;
+      if (!isUsableStyleKey(key)) continue;
+      const coerced = coerceWidgetStyleValue(item, depth + 1);
+      if (coerced === undefined) continue;
+      out[key] = coerced;
+      kept += 1;
+    }
+    return kept > 0 ? out : undefined;
+  }
   return undefined;
 }
 
+// What the value actually costs the cold-start read and the baked export.
+function styleValueBytes(value) {
+  const json = JSON.stringify(value);
+  return typeof json === "string" ? json.length : Infinity;
+}
+
+/**
+ * sc-5646: ONE widget's style fields, validated. The app-wide layer and a placed
+ * node's `props.style` hold the SAME vocabulary at different scopes, so they must
+ * accept the same values — a field an author can set on a node and not app-wide
+ * (or the reverse) is exactly the divergence the two surfaces are meant not to
+ * have. The per-widget FIELD cap is deliberately not applied here: it bounds the
+ * app-wide map that rides the unauthenticated cold-start read, not one node in a
+ * page layout the builder already writes unbounded.
+ *
+ * @param {unknown} raw — a `props.style` / `widgetStyles[id]` object.
+ * @param {{ maxFields?: number }} [options]
+ * @returns {Record<string, unknown>} the fields that survived; `{}` for junk.
+ */
+export function normaliseWidgetStyleFields(raw, { maxFields } = {}) {
+  if (!isPlainObject(raw)) return {};
+  const { maxValueBytes } = CONTRACT.themeWidgetStyles;
+  const out = {};
+  let count = 0;
+  for (const [field, value] of Object.entries(raw)) {
+    if (maxFields !== undefined && count >= maxFields) break;
+    if (!isUsableStyleKey(field)) continue;
+    const coerced = coerceWidgetStyleValue(value);
+    if (coerced === undefined) continue;
+    if (styleValueBytes(coerced) > maxValueBytes) continue;
+    out[field] = coerced;
+    count += 1;
+  }
+  return out;
+}
+
 /**
  * REQ-THEME-ELEMENT: validate `themeConfig.widgetStyles` -- app-wide style values
  * keyed by WIDGET MANIFEST ID, then by that widget's own styleSchema field name.
@@ -124,26 +207,31 @@ function coerceWidgetStyleValue(value) {
  */
 export function normaliseWidgetStyles(raw) {
   if (!isPlainObject(raw)) return {};
-  const { maxWidgets, maxFieldsPerWidget } = CONTRACT.themeWidgetStyles;
+  const { maxWidgets, maxFieldsPerWidget, maxBytes } =
+    CONTRACT.themeWidgetStyles;
   const idPattern = CONTRACT.manifestSchema.id.pattern;
   const out = {};
   let widgets = 0;
+  let bytes = 0;
   for (const [manifestId, fields] of Object.entries(raw)) {
     if (widgets >= maxWidgets) break;
     if (!idPattern.test(manifestId) || !isPlainObject(fields)) continue;
-    const kept = {};
-    let count = 0;
-    for (const [field, value] of Object.entries(fields)) {
-      if (count >= maxFieldsPerWidget) break;
-      const coerced = coerceWidgetStyleValue(value);
-      if (coerced === undefined) continue;
-      kept[field] = coerced;
-      count += 1;
-    }
+    // The SAME per-field validation a placed node's style gets, plus the cap
+    // that only this map needs.
+    const kept = normaliseWidgetStyleFields(fields, {
+      maxFields: maxFieldsPerWidget,
+    });
+    const count = Object.keys(kept).length;
     // An emptied entry is dropped rather than persisted as `{}`, mirroring
     // normaliseThemeComponents.
     if (count === 0) continue;
+    // Whole entries, never half of one: a widget rendering with SOME of its
+    // app-wide fields reads as a bug, where one rendering with none reads as
+    // "not styled yet".
+    const entryBytes = styleValueBytes(kept) + manifestId.length;
+    if (bytes + entryBytes > maxBytes) break;
     out[manifestId] = kept;
+    bytes += entryBytes;
     widgets += 1;
   }
   return out;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.102.1",
+  "version": "0.104.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "type": "module",
   "main": "./dist/index.js",
@@ -48,7 +48,7 @@
   ],
   "scripts": {
     "build": "node scripts/build.js",
-    "test": "node --test src/__tests__/contract.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-invites.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-page-url.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/theme-components-parity.test.js src/__tests__/navigation-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/toast-host.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js src/__tests__/hooks-bound-columns.test.js src/__tests__/hooks-stable-query.test.js src/__tests__/hooks-can-write.test.js src/__tests__/widget-route.test.js"
+    "test": "node --test src/__tests__/contract.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-invites.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-page-url.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/corner-radius.test.js src/__tests__/theme-components-parity.test.js src/__tests__/navigation-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/toast-host.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js src/__tests__/hooks-bound-columns.test.js src/__tests__/hooks-stable-query.test.js src/__tests__/hooks-can-write.test.js src/__tests__/widget-route.test.js"
   },
   "engines": {
     "node": ">=18"