@colixsystems/widget-sdk 0.106.0 → 0.107.0

package/README.md

@@ -68,7 +68,30 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.106.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.107.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.107.0 (contract 1.81.0)
+
+**Widgets can render QR codes — `react-native-qrcode-svg` is now a vetted import (sc-6105).** There was no QR encoder on the allowlist, so a check-in code, an install link, a table-ordering code, or a payment hand-off could not be built at all. The only QR the platform produced was a PNG the backend renders for one specific BankID sign order, which encodes nothing else.
+
+The package is vetted for **both platforms** and needs no split file: it draws with the already-vetted `react-native-svg`, so one component covers the web Player and the Expo export.
+
+```js
+import QRCode from "react-native-qrcode-svg";
+import { View } from "@colixsystems/widget-sdk";
+
+export default function TicketCode({ ticketUrl }) {
+  return (
+    <View>
+      <QRCode value={ticketUrl} size={180} ecl="M" />
+    </View>
+  );
+}
+```
+
+`value` is the encoded string; `size`, `color`, `backgroundColor`, `quietZone`, `ecl` (`"L" | "M" | "Q" | "H"`) and the `logo*` props shape the render. Encoding happens on-device — no network call, so it works offline in both hosts.
+
+One caveat carried over from the package: it documents a Metro transformer that injects a `TextEncoder` polyfill for React Native **below 0.75**. The export ships RN 0.85.3, which has `TextEncoder` as a global, so that transformer is intentionally not wired up — don't add it.
 
 ### What's new in 0.106.0 (contract 1.80.0)
 

package/dist/contract.cjs

@@ -2457,6 +2457,13 @@ const VETTED_IMPORTS = [
     description:
       "Embeds web content in a native WebView. Native-only; on web render an <iframe> (or a View with the URL) in widget.web.jsx.",
   },
+  {
+    specifier: "react-native-qrcode-svg",
+    platforms: ["web", "native"],
+    category: "drawing",
+    description:
+      "Renders a QR code, drawn as SVG through the vetted react-native-svg — so one `<QRCode value={…} size={…} />` covers both platforms with no split file. Pure JS with no native module of its own: the web host resolves it and the Expo export pins it, exactly like date-fns. Its `text-encoding` polyfill is opt-in for React Native < 0.75 only; the export ships RN 0.85.3, which has a global TextEncoder, so the Metro transformer that package documents is deliberately not wired up.",
+  },
 ];
 
 // sc-1064: CORE React infrastructure specifiers the host RESOLVES at runtime
@@ -3311,7 +3318,15 @@ const CONTRACT = deepFreeze({
   //    blocked every first-party publish for twelve days. The flag separates
   //    who PROVIDES the table from whether the author may skip it; `required`
   //    still means required.
-  version: "1.80.0",
+  // 1.81.0: additive (sc-6105) — `react-native-qrcode-svg` joins
+  //    VETTED_IMPORTS as a web+native `drawing` package. Widgets had no QR
+  //    encoder at all: the only QR the platform produced was the BankID PNG
+  //    the backend renders for a specific sign order, so a check-in code, an
+  //    install link, or a table-ordering code was unbuildable. It draws
+  //    through the already-vetted react-native-svg and carries no native
+  //    module of its own, so it is host-shimmed on web and pinned in the
+  //    export like date-fns. No existing entry changed shape.
+  version: "1.81.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/contract.js

@@ -2457,6 +2457,13 @@ const VETTED_IMPORTS = [
     description:
       "Embeds web content in a native WebView. Native-only; on web render an <iframe> (or a View with the URL) in widget.web.jsx.",
   },
+  {
+    specifier: "react-native-qrcode-svg",
+    platforms: ["web", "native"],
+    category: "drawing",
+    description:
+      "Renders a QR code, drawn as SVG through the vetted react-native-svg — so one `<QRCode value={…} size={…} />` covers both platforms with no split file. Pure JS with no native module of its own: the web host resolves it and the Expo export pins it, exactly like date-fns. Its `text-encoding` polyfill is opt-in for React Native < 0.75 only; the export ships RN 0.85.3, which has a global TextEncoder, so the Metro transformer that package documents is deliberately not wired up.",
+  },
 ];
 
 // sc-1064: CORE React infrastructure specifiers the host RESOLVES at runtime
@@ -3311,7 +3318,15 @@ const CONTRACT = deepFreeze({
   //    blocked every first-party publish for twelve days. The flag separates
   //    who PROVIDES the table from whether the author may skip it; `required`
   //    still means required.
-  version: "1.80.0",
+  // 1.81.0: additive (sc-6105) — `react-native-qrcode-svg` joins
+  //    VETTED_IMPORTS as a web+native `drawing` package. Widgets had no QR
+  //    encoder at all: the only QR the platform produced was the BankID PNG
+  //    the backend renders for a specific sign order, so a check-in code, an
+  //    install link, or a table-ordering code was unbuildable. It draws
+  //    through the already-vetted react-native-svg and carries no native
+  //    module of its own, so it is host-shimmed on web and pinned in the
+  //    export like date-fns. No existing entry changed shape.
+  version: "1.81.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/dev-shims.js

@@ -94,9 +94,12 @@ export const REACT_JSX_RUNTIME_EXPORTS = ["jsx", "jsxs", "Fragment", "jsxDEV"];
 //     host namespace (sc-1064).
 //   * `@colixsystems/widget-sdk` — the widget must route hooks through the SAME
 //     SDK instance the host built (datastore/theme/navigation live there).
-//   * `lucide-react-native`, `react-native-svg`, `date-fns` — vetted packages
-//     the host already bundles + shims (`_hostVettedModules`); sharing the
-//     host copy keeps icons/SVG on the host's react-native-web instance.
+//   * `lucide-react-native`, `react-native-svg`, `date-fns`,
+//     `react-native-qrcode-svg` — vetted packages the host already bundles +
+//     shims (`_hostVettedModules`); sharing the host copy keeps icons/SVG on
+//     the host's react-native-web instance. qrcode-svg draws through
+//     react-native-svg, so externalising it keeps the QR on that same
+//     instance instead of a bundle inlining a second one (sc-6105).
 const HOST_EXTERNAL_SPECIFIERS = [
   "react",
   "react/jsx-runtime",
@@ -107,6 +110,7 @@ const HOST_EXTERNAL_SPECIFIERS = [
   "lucide-react-native",
   "react-native-svg",
   "date-fns",
+  "react-native-qrcode-svg",
   // sc-1265: a bundled widget (and any vetted RN package it inlines, e.g.
   // react-native-gesture-handler) imports `react-native`; the host resolves it
   // to its OWN single react-native-web instance through a blob shim, so the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.106.0",
+  "version": "0.107.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "type": "module",
   "main": "./dist/index.js",
@@ -48,7 +48,7 @@
   ],
   "scripts": {
     "build": "node scripts/build.js",
-    "test": "node --test src/__tests__/contract.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-invites.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-page-url.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/corner-radius.test.js src/__tests__/theme-components-parity.test.js src/__tests__/navigation-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/toast-host.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js src/__tests__/hooks-bound-columns.test.js src/__tests__/hooks-stable-query.test.js src/__tests__/hooks-can-write.test.js src/__tests__/widget-route.test.js"
+    "test": "node --test src/__tests__/contract.test.js src/__tests__/vetted-imports-audit.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-invites.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-page-url.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/corner-radius.test.js src/__tests__/theme-components-parity.test.js src/__tests__/navigation-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/toast-host.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js src/__tests__/hooks-bound-columns.test.js src/__tests__/hooks-stable-query.test.js src/__tests__/hooks-can-write.test.js src/__tests__/widget-route.test.js"
   },
   "engines": {
     "node": ">=18"

package/src/dev-shims.js

@@ -94,9 +94,12 @@ export const REACT_JSX_RUNTIME_EXPORTS = ["jsx", "jsxs", "Fragment", "jsxDEV"];
 //     host namespace (sc-1064).
 //   * `@colixsystems/widget-sdk` — the widget must route hooks through the SAME
 //     SDK instance the host built (datastore/theme/navigation live there).
-//   * `lucide-react-native`, `react-native-svg`, `date-fns` — vetted packages
-//     the host already bundles + shims (`_hostVettedModules`); sharing the
-//     host copy keeps icons/SVG on the host's react-native-web instance.
+//   * `lucide-react-native`, `react-native-svg`, `date-fns`,
+//     `react-native-qrcode-svg` — vetted packages the host already bundles +
+//     shims (`_hostVettedModules`); sharing the host copy keeps icons/SVG on
+//     the host's react-native-web instance. qrcode-svg draws through
+//     react-native-svg, so externalising it keeps the QR on that same
+//     instance instead of a bundle inlining a second one (sc-6105).
 const HOST_EXTERNAL_SPECIFIERS = [
   "react",
   "react/jsx-runtime",
@@ -107,6 +110,7 @@ const HOST_EXTERNAL_SPECIFIERS = [
   "lucide-react-native",
   "react-native-svg",
   "date-fns",
+  "react-native-qrcode-svg",
   // sc-1265: a bundled widget (and any vetted RN package it inlines, e.g.
   // react-native-gesture-handler) imports `react-native`; the host resolves it
   // to its OWN single react-native-web instance through a blob shim, so the