@colixsystems/widget-sdk 0.137.0 → 0.139.0

package/README.md

@@ -46,7 +46,7 @@ The data layer lives in **four separate domain-client packages**, each instantia
 | **DATASTORE** | `useDatastoreSchema(tableId)` | `{ schema, loading, error, refetch }` | `schema(tableId)` — `datastore.read:<table>` |
 | **DATASTORE** | `useBoundColumns(tableId, shape, props)` | `{ columns, resolved, missing, loading, error }` | `schema(tableId)` (built on `useDatastoreSchema`) — `datastore.read:<table>`. Resolves author-bound column NAMES from `props` by exact name → case-insensitive name → first unclaimed column matching `shape[key].dataType`, so a column an author renamed after install still resolves instead of `record[props.titleField]` reading `undefined`. `columns` holds the resolved NAME (`record[columns.titleField]`); `resolved` holds the full `Column`; `missing` lists non-`optional` keys that never resolved. Falsy `tableId` collapses to `{ columns: {}, resolved: {}, missing: Object.keys(shape), loading: false, error: null }`. |
 | **DATASTORE** | `useInterpretDraft(tableId)` | `{ interpret, interpreting, error, result, available }` | `interpret(tableId, body)` — `datastore.read:<table>`. Turns ONE sentence a user typed ("walk at 11 am tomorrow") into DRAFT column values so a form can prefill itself. IMPERATIVE: call `interpret(text, { fields?, timeZone? })` from an event handler, never on mount. It DRAFTS and writes nothing — show the values for review, then submit through `useDatastoreMutation().create`. Resolves to `{ values, unresolved }`; `values` is keyed by column NAME (the shape `create()` takes) and `unresolved` names the fields the sentence did not state. Only text / number / boolean / date / datetime / array columns are drafted — `FILE`, `RELATION`, `USER` and `USER_GROUP` carry ids and are never guessed. Fails closed to an empty draft. **Every call spends the workspace's AI credits** and is rate-limited per actor, so call it once per user action (never on mount or in a render loop); once the workspace runs out the call is refused with a generic 429 — an app user is deliberately **not** told the workspace's billing state, since they have never heard of an AI credit and cannot buy one. Never surface a raw error to the person filling the form: say drafting is unavailable and keep every field editable by hand. `available` is false where the host brokers no interpreter. |
-| **DATASTORE** | `useDatastoreMutation(table)` | `{ create, update, delete }` | `records(table).{ create, update (PATCH), delete }` — `datastore.write:*` |
+| **DATASTORE** | `useDatastoreMutation(table)` | `{ create, update, delete }` | `records(table).{ create, update (PATCH), delete }` — `datastore.write:*`. **To CLEAR a cell, pass it empty** — `update(id, { when: null })` (also `""` or `[]`) empties that cell and it reads back as `null` (`[]` on an array column). There is no separate clear call, so never write a sentinel such as `0` or a placeholder date to mean "no value". `false` and `0` are values, not clears, and a REQUIRED column cannot be cleared. |
 | **DATASTORE** | `useDatastoreSubscription(table, handlers, options)` (optional: options) | `{ status }` — `"connecting" \| "live" \| "reconnecting" \| "fallback"` | `records(table).subscribe` — `datastore.read:<table>`. Live `onCreated` / `onUpdated` / `onDeleted` off the REQ-RT-07 socket; never throws, resolving to `{ status: "fallback" }` so the widget polls instead. A whole-table subscribe is gated on read-EVERY-row, because one envelope reaches every subscriber of the table — so for a table governed by per-record grants pass `options.scope`: `{ kind: "record", record_id }` for one row, or `{ kind: "parent", relation_column, record_id }` for the rows whose RELATION column points at that parent (the column must carry `inheritAcl`, else the subscribe reports `"fallback"`). Re-subscribes on the scope's VALUES, so a fresh object literal each render is fine. |
 | **DATASTORE** | `useRecordPermissions(tableId, recordId)` | `{ permissions, loading, error, grant, revoke, update, refetch }` | `records(table).permissions(record).{ list, grant, update, revoke }` — `acl.write:records` (+ `can_grant` on the record) |
 | **DATASTORE** | `useCanWrite(tableId, options)` (optional: options) | `{ canWrite, loading, error, refetch }` | `myPermissions(tableId, { recordId? })` — scope `datastore.read:<table>`. A FLOOR, not a full replacement for domain-specific write rules: answers "may this caller write", reading the same table-ACL answer the write endpoint enforces — so a table granting Create to Everyone answers `true` for a logged-out visitor, and this hook alone is the right gate for a widget meant to work without signing in. Pass `{ recordId }` for a per-row check. A widget whose own rule is MORE SPECIFIC than the table ACL (e.g. "only the assigned user may edit this row") must still hand-check that in addition. Pair with `useUser()` to also tell "not signed in" apart from "signed in but forbidden" — both resolve `canWrite: false` here. Falsy `tableId`, or a host that hasn't injected `myPermissions` (an older host), collapses to `{ canWrite: false, loading: false, error: null, refetch: async () => undefined }` rather than throwing. |
@@ -72,6 +72,23 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 `v0.137.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
 
+### What's new in 0.139.0 (contract 1.108.0)
+
+**An author can BIND a colour field to the workspace brand instead of freezing a hex (sc-7800).** A `type: "color"` field tracked the theme only while it was *unset*, through its `themeDefault` placeholder. The moment the author picked a colour it became a literal that outranked the theme forever, so "make this our brand colour" was inexpressible — the author had to type today's hex, and it went stale silently at the next rebrand.
+
+A colour field's value may now be a **binding** — `"theme:colors.primary"` or `"theme:colors.secondary"` — which both hosts resolve to the workspace's current colour at render.
+
+- **Nothing changes for a widget author.** You keep declaring `{ type: "color", … }` and reading the value off `props.style` / `props`. The host hands your code an ordinary colour string either way, so never branch on a binding, never parse the `theme:` prefix, and never add a "use theme colour" toggle beside a colour field — the Studio's picker already offers the choice, and a second control for it is a dead knob.
+- **Only the two brand tokens are bindable**, listed on `CONTRACT.themeColorTokens`. The derived and contrast-paired tokens (`onPrimary`, `primarySoft`, `primaryStrong`, `loader`) are deliberately withheld: they are the host's to compute, and binding one half of a contrast pair produces unreadable text.
+- **An unresolvable binding falls back to the field's `themeDefault`**, exactly as an unset field does — it never paints blank.
+- **Fully additive.** Every colour already stored is a literal, is untouched, and renders byte-identically.
+
+### What's new in 0.138.0 (contract 1.107.0)
+
+**Every file upload from the Expo export works again.** Expo's `fetch` implements the WEB FormData spec, so a part must be a string or a Blob — but `useCamera`, `useImageEditor` and `<FilePicker>` all handed back React Native's legacy `{ uri, name, type }` triple, which it rejects with `Unsupported FormDataPart implementation` before a byte leaves the device. Web was unaffected because a browser `File` **is** a Blob, so it only ever reproduced on device. All three now hand back expo-file-system's `File`, carrying the same `uri` / `name` / `type` / `size` — so no widget needs a change.
+
+**`useFilestoreUpload` keeps the filename, and `fileName` works on both hosts.** A Blob appended with no filename is stored as `blob`. The name travels as `append()`'s third argument for a real Blob, and is set ON the part otherwise — expo-file-system's `File` is **not** `instanceof Blob` at runtime (`implements Blob` is TypeScript-only), and Expo reads the name off the part. `upload(file, { fileName })` overrides it. The native producers set `type` the same way, because the `File` derives it from the cache URI and leaves it empty when that URI has no extension.
+
 ### What's new in 0.137.0 (contract 1.106.0)
 
 **A `datastoreTemplate` column marked `encrypted` is now actually encrypted in the workspace that installs you (sc-7557).** The field was documented nowhere and honoured nowhere: install built its column rows one way, the republish/upgrade migration built them another way, and neither carried the flag — so a column you declared confidential was created as an ordinary plaintext column and nothing told you or your installer. Both paths now share one projection, so the flag lands on install and on upgrade alike.
@@ -470,7 +487,7 @@ When you take the `useCanWrite`-only route, omit the USER column for a guest (`i
 
 **Dismissing the picker resolves `null`, not an error.** Backing out is the most common outcome, so it is deliberately not a rejection — your happy path needs no `try/catch`. A genuine failure (permission refused, no host broker) rejects with a structured `CameraError` (new named export) carrying a stable `.code` (`PERMISSION_DENIED` / `UNSUPPORTED` / `INTERNAL`).
 
-**One upload path on both hosts.** The resolved asset is normalised to `{ uri, name, mimeType, width, height, size, file }`, where `uri` is directly displayable (`<Image source={{ uri }} />`) and `file` is already the right upload part for the platform — a `File` on web, a `{ uri, name, type }` triple on native. So the same three lines work everywhere:
+**One upload path on both hosts.** The resolved asset is normalised to `{ uri, name, mimeType, width, height, size, file }`, where `uri` is directly displayable (`<Image source={{ uri }} />`) and `file` is already the right upload part for the platform — a Blob on both hosts: a browser `File` on web, expo-file-system's `File` on native. (It must be a Blob: Expo's fetch implements the web FormData spec and rejects React Native's legacy `{ uri, name, type }` part.) So the same three lines work everywhere:
 
 ```js
 const fd = new FormData();
@@ -1495,7 +1512,7 @@ A widget that works but looks unfinished is only half done. `useTheme()` is the
 - **Size to your container — measure it, don't stretch into it.** The same widget sits in a full-width desktop section (~1400px), a half-width grid cell (~700px) and a phone (~360px), so layout built only from `flex: 1` stretches to fill whatever it is handed — a month calendar ends up with 200px day cells and swallows the page. Measure your own width with `onLayout={(e) => setWidth(e.nativeEvent.layout.width)}` on the root `View` (a React Native primitive, so it behaves identically on both hosts), render nothing size-dependent while `width === 0`, and compute every threshold from the measured value: a widget gets no declared breakpoint prop, but it can always measure. **Cap a repeating cell** rather than giving a grid `flex: 1` — `const cell = Math.max(32, Math.min(Math.floor((usable - gap * (columns - 1)) / columns), 64));`, with a calendar day cell topping out at 56–72px on `aspectRatio: 1`, and the grid given its exact computed width plus `alignSelf: 'center'` when the cap leaves slack. **Split two co-equal surfaces above ~720px measured width** (`flexDirection: width >= 720 ? 'row' : 'column'`, each half `{ flex: 1, minWidth: 0 }`) — a picker beside the form it feeds on a wide canvas, stacked in reading order below it. Never hardcode a width, never put `flex: 1` / `height: '100%'` on a content widget's root, and don't read the screen with `Dimensions` — the screen is not the widget.
 - **Compose forms — pair fields into rows, don't stack one per row.** Put short, related fields side by side (first + last name, city + postal code, expiry + CVC): a row of `{ flexDirection: 'row', flexWrap: 'wrap', gap: theme.spacing.md }` with each field cell `{ flexGrow: 1, flexBasis: 160 }` splits the width on a wide card and wraps to stacked on a narrow phone — the right recipe for field pairs because it needs no measurement (a fixed-width column overflows a phone; when a layout needs a real column count instead of wrapping, measure your width as above). Keep wide fields (email, address, notes) full-width with `width: '100%'` — NEVER `flexBasis: '100%'`, which sizes the main axis and therefore claims the parent's whole HEIGHT in a column (sc-7274) — cap it at two–three per row, group a long form into labelled sections, and label every input above it (not placeholder-only). Give a `multiline` field BOTH a floor and a ceiling (`{ minHeight: 150, maxHeight: 260 }`) so a long value scrolls inside the box instead of growing past its card, and keep the Save / Cancel row in normal flow below the fields, never positioned over them. When a field carries an icon beside it (a search glyph, a clear button), the border belongs on the WRAPPER row and the `TextInput` inside it goes borderless and transparent with `flex: 1, minWidth: 0` (the `minWidth: 0` stops a long value pushing the border past its container) — React Native has no `:focus-within`, so drive the wrapper's `borderColor` between `colors.border` and `colors.primary` from the input's own `onFocus` / `onBlur`. A border left on the input rings only its own `<input>` box on web, leaving the icon outside the ring; never absolutely-position the icon over the field to work around it.
 - **Respond to touch.** Give every `Pressable` the lift via the function-style `style={(state) => [base, ...pressableLift(state)]}` — see "Answer the touch" above. Never dim with `opacity`, which reads as the surface disabling itself.
-- **Drag and drop — show what is being dragged.** A drag where the item stays put reads as broken. Three things change the moment a drag starts: the **drag proxy** (the item lifts and follows the finger — `...theme.elevation.lg`, `{ scale: 1.03 }`, `opacity: 0.9`; for a tall or full-width item drag a compact `primarySoft` pill with its icon + one line of label instead), the **source placeholder** (the vacated slot keeps its height as a quiet `colors.surfaceMuted` block so the list doesn't collapse), and the **drop target** (one slot at a time highlighted with `primarySoft` or a 2px `colors.primary` border). Always animate the release — settle into the new slot, or `Animated.spring(pan, { toValue: { x: 0, y: 0 }, useNativeDriver: false })` back to the origin on cancel. Build it with `Animated` + `PanResponder` from `react-native` (the only mechanism that behaves identically on both hosts) — never HTML5 drag events (`draggable` / `onDragStart` / `dataTransfer` are web-only, and `document` / `window` are banned) — and start the drag from a `GripVertical` grip handle whenever the row is also tappable or sits in a `ScrollView`.
+- **Drag and drop — show what is being dragged.** A drag where the item stays put reads as broken. Three things change the moment a drag starts: the **drag proxy** (the item lifts and follows the finger — `...theme.elevation.lg`, `{ scale: 1.03 }`, `opacity: 0.9`; for a tall or full-width item drag a compact `primarySoft` pill with its icon + one line of label instead), the **source placeholder** (the vacated slot keeps its height as a quiet `colors.surfaceMuted` block so the list doesn't collapse), and the **drop target** (one slot at a time highlighted with `primarySoft` or a 2px `colors.primary` border). Always animate the release — settle into the new slot, or `Animated.spring(pan, { toValue: { x: 0, y: 0 }, useNativeDriver: false })` back to the origin on cancel. Build it with `Animated` + `PanResponder` from `react-native` (the only mechanism that behaves identically on both hosts) — never HTML5 drag events (`draggable` / `onDragStart` / `dataTransfer` are web-only, and `document` / `window` are banned) — and start the drag from a `GripVertical` grip handle whenever the row is also tappable or sits in a `ScrollView`. **A board (kanban, pipeline) drops onto ANOTHER column**, which needs four more things: the board's root renders the one proxy (a column clips whatever leaves it); you hit-test the drop yourself — `measureInWindow` every column and the board when the drag starts and compare the gesture's window `moveX` (never `onLayout` frames, which are relative to a padded or scrolled parent) — highlighting exactly one target; the drop WRITES (`update(id, { [statusField]: value })` through `useDatastoreMutation`, optimistic until `refetch()`, a toast and a spring-back on failure); and three or more columns go in a `horizontal` `ScrollView` below `isNarrowWidth`, with the grip claiming the gesture (`onStartShouldSetPanResponder`, `onPanResponderTerminationRequest: () => false`) and carrying `touchAction: 'none'` on web so a finger drag moves the card instead of scrolling the page. And because `useRef(PanResponder.create(...))` runs ONCE, everything its callbacks read — the `useCanWrite` flag included, which starts `false` — goes through a ref refreshed every render (`latest.current.canDrag`); the publish gate `widget.staleResponder` rejects a value read directly.
 - **Use icons for clarity.** Pair a `lucide-react-native` icon with its label at a consistent size, coloured from the theme. The label never repeats the icon as a character — with a `Plus` icon the button says "Add item", never "+ Add item" (that renders a doubled plus).
 - **Use imagery deliberately.** Render pictures with the `Image` primitive (`source` takes a URL or `{ uri }`); resolve workspace assets via `useAsset()`. Give every image a sized, `radii`-clipped container so it never renders as a raw rectangle, and never hardcode a credentialed image URL — expose an `image`-type property instead. The frame is your decision, never the picture's: size it for the role (a 40–56 square avatar, a 72–96 square row thumbnail, a `16 / 9` card cover, a 160–240 tall band) and let `resizeMode="cover"` crop the photo into it — photos arrive at every size and ratio, so one left to its own proportions breaks the layout. Keep `contain` for art whose whole subject must stay visible (a logo, a diagram), inside a fixed frame.
 - **Design the empty, loading, and error states.** A blank box on a fresh install reads as broken — show a short helper line when a list is empty, a calm loading line, and a single human sentence in `colors.danger` on error.

package/dist/contract.cjs

@@ -121,6 +121,26 @@ const DEFAULT_THEME_TOKENS = Object.freeze({
   widgetStyles: Object.freeze({}),
 });
 
+// sc-7800 -- the colour tokens an AUTHOR may BIND a `type: "color"` field to.
+//
+// A colour field already tracked the theme while unset (its `themeDefault`
+// placeholder); the moment it was set it froze to a hex and stopped following a
+// rebrand. A bound field stores `theme:<path>` instead, and the hosts resolve it
+// per render, so the author's INTENT ("our brand colour") survives the rebrand.
+//
+// Deliberately only the two BRAND tokens. The derived and contrast-paired
+// tokens -- `onPrimary`, `primarySoft`, `primaryStrong`, `loader` -- are the
+// host's to compute: offering them would let an author pick one half of a
+// contrast pair and produce unreadable text with no way to see it was their
+// choice. `label` is the author-facing name; the Studio picker, the host
+// resolver and the AI widget agent all read this ONE list, so what may be
+// written and what will resolve cannot drift.
+const THEME_COLOR_TOKENS = Object.freeze([
+  Object.freeze({ path: "colors.primary", label: "Primary" }),
+  Object.freeze({ path: "colors.secondary", label: "Secondary" }),
+]);
+
+
 // REQ-THEME-15 (sc-1497) — per-component style tokens. The global palette is a
 // single lever: remapping `primaryColor` to recolour "the buttons" recolours
 // every element that shares it. A theme may therefore also carry
@@ -886,8 +906,11 @@ const HOOKS = [
       "from the host context, builds a multipart FormData with the " +
       "snake_case fields the backend reads verbatim (`space_type`, " +
       "`owner_id`, `folder_id`, plus the binary `file`), and POSTs through " +
-      "ctx.filestore.files.upload. `upload(file, { folderId?, compress? })` " +
-      "resolves to the created file row or throws the wire error. Branch " +
+      "ctx.filestore.files.upload. `upload(file, { folderId?, compress?, fileName? })` " +
+      "resolves to the created file row or throws the wire error. `file` must be a BLOB — a browser File on web, " +
+      "expo-file-system's File on native (what FilePicker / useCamera / useImageEditor hand back); Expo's fetch rejects " +
+      "React Native's legacy { uri, name, type } part with \"Unsupported FormDataPart implementation\". The stored name " +
+      "comes from the Blob's `.name` unless `fileName` overrides it. Branch " +
       "on `err.status`: 403 means the destination denied the add and says " +
       "so, because the caller can see that position — for a public space " +
       "that means an operator has not switched upload access on yet; 404 " +
@@ -907,7 +930,7 @@ const HOOKS = [
       "'project' for content restricted to signed-in workspace users, " +
       "'personal' for a file private to the uploading app user.",
     returnShape: {
-      upload: "(file, { folderId?, compress? }) => Promise<FilestoreFile>",
+      upload: "(file, { folderId?, compress?, fileName? }) => Promise<FilestoreFile>",
       uploading: "boolean",
       error: "Error | null",
       lastUploaded: "FilestoreFile | null",
@@ -1668,7 +1691,8 @@ const HOOKS = [
       "{ uri, name, mimeType, width, height, size, file }, or NULL when the user dismisses the picker — dismissal is the " +
       "common case and is deliberately NOT an error, so no try/catch is needed on the happy path. They reject with a " +
       "CameraError whose .code is one of PERMISSION_DENIED | UNSUPPORTED | INTERNAL. `asset.file` is already the right " +
-      "upload part for the host (a File on web, { uri, name, type } on native): append it to a FormData as `file` and pass " +
+      "upload part for the host — a BLOB on both (a File on web, expo-file-system's File on native), because Expo's fetch " +
+      "implements the web FormData spec and rejects React Native's legacy { uri, name, type } part outright: append it to a FormData as `file` and pass " +
       "that to ctx.assets.upload(fd) — one code path on both platforms. reset() clears the asset and releases it. Check " +
       "`supported` before rendering a camera button. options: { allowsEditing, quality } are HINTS the host honours where it " +
       "can — the Expo export applies both, the web camera applies quality only, so never depend on a cropped result. " +
@@ -3926,7 +3950,33 @@ const CONTRACT = deepFreeze({
   //    template declaring neither behaves exactly as before, and a role nobody
   //    binds writes no grant rather than failing the install. Minor bump on the
   //    pre-1.0 channel.
-  version: "1.106.0",
+  //
+  // 1.107.0: fix + additive — every FILE UPLOAD from the Expo export failed
+  //    with "Unsupported FormDataPart implementation". Expo's fetch implements
+  //    the WEB FormData spec, so a part must be a string or a Blob, but all
+  //    three native producers (`useCamera`, `useImageEditor`, `<FilePicker>`)
+  //    handed back React Native's legacy `{ uri, name, type }` triple, which it
+  //    rejects before a byte leaves the device. Web was unaffected because a
+  //    browser `File` IS a Blob. All three now hand back expo-file-system's
+  //    `File`, the shape Expo's fetch accepts, exposing the same
+  //    `uri` / `name` / `type` / `size`, so a widget reading those is
+  //    unaffected — each producer shadows the name + type the cache URI
+  //    would otherwise impose. `useFilestoreUpload` additionally carries the
+  //    multipart FILENAME (a bare Blob would be stored as "blob") and accepts a
+  //    `fileName` override: as append()'s third argument for a real Blob, and
+  //    ON the part otherwise, since expo-file-system's File is NOT
+  //    `instanceof Blob` at runtime and Expo reads the name off the part.
+  //    One upload path on both hosts, as before.
+  // 1.108.0: additive (sc-7800) -- `themeColorTokens`: the brand colour tokens
+  //    an author may BIND a `type: "color"` field to, plus the `theme:<path>`
+  //    value grammar and the `resolveThemeTokenRefs` host resolver behind it.
+  //    A set colour field used to freeze to a hex literal and stop following
+  //    the workspace theme, so "make this our brand colour" was inexpressible
+  //    and every picked colour went stale on the next rebrand. Purely additive:
+  //    a stored hex is untouched and still renders byte-identically, and an
+  //    unresolvable binding falls back to the field's `themeDefault` rather
+  //    than painting blank.
+  version: "1.108.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -3937,6 +3987,7 @@ const CONTRACT = deepFreeze({
   actionScriptGlobals: ACTION_SCRIPT_GLOBALS,
   actionScriptMaxBytes: ACTION_SCRIPT_MAX_BYTES,
   themeTokens: DEFAULT_THEME_TOKENS,
+  themeColorTokens: THEME_COLOR_TOKENS,
   themeComponents: THEME_COMPONENTS,
   themeComponentShadows: THEME_COMPONENT_SHADOWS,
   themeComponentTextTransforms: THEME_COMPONENT_TEXT_TRANSFORMS,

package/dist/contract.js

@@ -121,6 +121,26 @@ const DEFAULT_THEME_TOKENS = Object.freeze({
   widgetStyles: Object.freeze({}),
 });
 
+// sc-7800 -- the colour tokens an AUTHOR may BIND a `type: "color"` field to.
+//
+// A colour field already tracked the theme while unset (its `themeDefault`
+// placeholder); the moment it was set it froze to a hex and stopped following a
+// rebrand. A bound field stores `theme:<path>` instead, and the hosts resolve it
+// per render, so the author's INTENT ("our brand colour") survives the rebrand.
+//
+// Deliberately only the two BRAND tokens. The derived and contrast-paired
+// tokens -- `onPrimary`, `primarySoft`, `primaryStrong`, `loader` -- are the
+// host's to compute: offering them would let an author pick one half of a
+// contrast pair and produce unreadable text with no way to see it was their
+// choice. `label` is the author-facing name; the Studio picker, the host
+// resolver and the AI widget agent all read this ONE list, so what may be
+// written and what will resolve cannot drift.
+const THEME_COLOR_TOKENS = Object.freeze([
+  Object.freeze({ path: "colors.primary", label: "Primary" }),
+  Object.freeze({ path: "colors.secondary", label: "Secondary" }),
+]);
+
+
 // REQ-THEME-15 (sc-1497) — per-component style tokens. The global palette is a
 // single lever: remapping `primaryColor` to recolour "the buttons" recolours
 // every element that shares it. A theme may therefore also carry
@@ -886,8 +906,11 @@ const HOOKS = [
       "from the host context, builds a multipart FormData with the " +
       "snake_case fields the backend reads verbatim (`space_type`, " +
       "`owner_id`, `folder_id`, plus the binary `file`), and POSTs through " +
-      "ctx.filestore.files.upload. `upload(file, { folderId?, compress? })` " +
-      "resolves to the created file row or throws the wire error. Branch " +
+      "ctx.filestore.files.upload. `upload(file, { folderId?, compress?, fileName? })` " +
+      "resolves to the created file row or throws the wire error. `file` must be a BLOB — a browser File on web, " +
+      "expo-file-system's File on native (what FilePicker / useCamera / useImageEditor hand back); Expo's fetch rejects " +
+      "React Native's legacy { uri, name, type } part with \"Unsupported FormDataPart implementation\". The stored name " +
+      "comes from the Blob's `.name` unless `fileName` overrides it. Branch " +
       "on `err.status`: 403 means the destination denied the add and says " +
       "so, because the caller can see that position — for a public space " +
       "that means an operator has not switched upload access on yet; 404 " +
@@ -907,7 +930,7 @@ const HOOKS = [
       "'project' for content restricted to signed-in workspace users, " +
       "'personal' for a file private to the uploading app user.",
     returnShape: {
-      upload: "(file, { folderId?, compress? }) => Promise<FilestoreFile>",
+      upload: "(file, { folderId?, compress?, fileName? }) => Promise<FilestoreFile>",
       uploading: "boolean",
       error: "Error | null",
       lastUploaded: "FilestoreFile | null",
@@ -1668,7 +1691,8 @@ const HOOKS = [
       "{ uri, name, mimeType, width, height, size, file }, or NULL when the user dismisses the picker — dismissal is the " +
       "common case and is deliberately NOT an error, so no try/catch is needed on the happy path. They reject with a " +
       "CameraError whose .code is one of PERMISSION_DENIED | UNSUPPORTED | INTERNAL. `asset.file` is already the right " +
-      "upload part for the host (a File on web, { uri, name, type } on native): append it to a FormData as `file` and pass " +
+      "upload part for the host — a BLOB on both (a File on web, expo-file-system's File on native), because Expo's fetch " +
+      "implements the web FormData spec and rejects React Native's legacy { uri, name, type } part outright: append it to a FormData as `file` and pass " +
       "that to ctx.assets.upload(fd) — one code path on both platforms. reset() clears the asset and releases it. Check " +
       "`supported` before rendering a camera button. options: { allowsEditing, quality } are HINTS the host honours where it " +
       "can — the Expo export applies both, the web camera applies quality only, so never depend on a cropped result. " +
@@ -3926,7 +3950,33 @@ const CONTRACT = deepFreeze({
   //    template declaring neither behaves exactly as before, and a role nobody
   //    binds writes no grant rather than failing the install. Minor bump on the
   //    pre-1.0 channel.
-  version: "1.106.0",
+  //
+  // 1.107.0: fix + additive — every FILE UPLOAD from the Expo export failed
+  //    with "Unsupported FormDataPart implementation". Expo's fetch implements
+  //    the WEB FormData spec, so a part must be a string or a Blob, but all
+  //    three native producers (`useCamera`, `useImageEditor`, `<FilePicker>`)
+  //    handed back React Native's legacy `{ uri, name, type }` triple, which it
+  //    rejects before a byte leaves the device. Web was unaffected because a
+  //    browser `File` IS a Blob. All three now hand back expo-file-system's
+  //    `File`, the shape Expo's fetch accepts, exposing the same
+  //    `uri` / `name` / `type` / `size`, so a widget reading those is
+  //    unaffected — each producer shadows the name + type the cache URI
+  //    would otherwise impose. `useFilestoreUpload` additionally carries the
+  //    multipart FILENAME (a bare Blob would be stored as "blob") and accepts a
+  //    `fileName` override: as append()'s third argument for a real Blob, and
+  //    ON the part otherwise, since expo-file-system's File is NOT
+  //    `instanceof Blob` at runtime and Expo reads the name off the part.
+  //    One upload path on both hosts, as before.
+  // 1.108.0: additive (sc-7800) -- `themeColorTokens`: the brand colour tokens
+  //    an author may BIND a `type: "color"` field to, plus the `theme:<path>`
+  //    value grammar and the `resolveThemeTokenRefs` host resolver behind it.
+  //    A set colour field used to freeze to a hex literal and stop following
+  //    the workspace theme, so "make this our brand colour" was inexpressible
+  //    and every picked colour went stale on the next rebrand. Purely additive:
+  //    a stored hex is untouched and still renders byte-identically, and an
+  //    unresolvable binding falls back to the field's `themeDefault` rather
+  //    than painting blank.
+  version: "1.108.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -3937,6 +3987,7 @@ const CONTRACT = deepFreeze({
   actionScriptGlobals: ACTION_SCRIPT_GLOBALS,
   actionScriptMaxBytes: ACTION_SCRIPT_MAX_BYTES,
   themeTokens: DEFAULT_THEME_TOKENS,
+  themeColorTokens: THEME_COLOR_TOKENS,
   themeComponents: THEME_COMPONENTS,
   themeComponentShadows: THEME_COMPONENT_SHADOWS,
   themeComponentTextTransforms: THEME_COMPONENT_TEXT_TRANSFORMS,

package/dist/filepicker.native.js

@@ -10,15 +10,20 @@
 //
 // `onPick` receives the same shape on both platforms:
 //   - web → the browser's `File` object (a `Blob` with name + type).
-//   - native → `{ uri, name, type, size }` — React Native's
-//     FormData-friendly file part. `useFilestoreUpload` appends whichever
-//     verbatim into the multipart body; the React Native fetch
-//     implementation reads `uri` and streams the bytes.
+//   - native → expo-file-system's `File` — ALSO a `Blob`, and carrying the
+//     same `uri` / `name` / `type` / `size` the old React Native
+//     `{ uri, name, type, size }` part did, so a widget reading those is
+//     unaffected. It must be a Blob: Expo's fetch implements the WEB
+//     FormData spec and rejects the RN triple outright ("Unsupported
+//     FormDataPart implementation"), which failed every native upload.
+//     `useFilestoreUpload` appends whichever verbatim into the multipart body.
 
 import React, { useCallback, useMemo } from "react";
 import { Pressable, View } from "react-native";
 // eslint-disable-next-line no-restricted-syntax
 import { getDocumentAsync } from "expo-document-picker";
+// eslint-disable-next-line no-restricted-syntax
+import { File as FsFile } from "expo-file-system";
 
 // Map an HTML `accept` string (the web contract — "image/*", "audio/*",
 // "image/png,image/jpeg", …) to expo-document-picker's `type` arg, which
@@ -38,17 +43,28 @@ function _mapAccept(accept) {
 }
 
 // expo-document-picker returns `{ canceled, assets: [{ uri, name,
-// mimeType, size }] }`. Normalise each asset to the FormData-friendly
-// `{ uri, name, type, size }` shape useFilestoreUpload appends into the
-// multipart body — `type` is the field React Native's FormData reads
-// for the part's content-type, mirroring the browser File's `.type`.
+// mimeType, size }] }`. The part handed to onPick is expo-file-system's
+// File, exposing the same uri / name / type / size the old plain object
+// did. It must NOT be the old object: Expo's fetch refuses that shape, so
+// keeping it as a fallback would only defer the failure.
 function _asset(picked) {
-  return {
-    uri: picked.uri,
-    name: picked.name || "upload",
-    type: picked.mimeType || "application/octet-stream",
-    size: typeof picked.size === "number" ? picked.size : undefined,
-  };
+  const file = new FsFile(picked.uri);
+  // Both are read off the PART when the multipart is serialised (the third
+  // `append` argument is ignored for a non-Blob), and both are derived from
+  // the cache URI — which may be renamed, percent-encoded, or extensionless.
+  // The picker's own values are the ones the user and the backend expect.
+  _shadow(file, "name", picked.name || "upload");
+  _shadow(file, "type", picked.mimeType || "application/octet-stream");
+  return file;
+}
+
+function _shadow(file, key, value) {
+  if (!value || file[key] === value) return;
+  try {
+    Object.defineProperty(file, key, { value, configurable: true });
+  } catch {
+    /* non-configurable: whatever the platform derived stands */
+  }
 }
 
 export function FilePicker({

package/dist/hooks.js

@@ -3571,13 +3571,14 @@ export function useFilestoreFile(fileId) {
  * same way the read hooks do (tenant for PROJECT, app user for PERSONAL)
  * and posts a multipart FormData to `ctx.filestore.files.upload`.
  *
- * `upload(file, { folderId? })` accepts whatever the host's FormData
- * implementation reads as a binary file part — on the web Player a
- * browser `File`, on the Expo export the React Native shape
- * `{ uri, name, type }` returned by `<FilePicker>` (which wraps
- * `expo-document-picker` natively and a hidden DOM `<input type="file">`
- * on web). FormData serialises both verbatim, so the same hook code path
- * feeds the multipart on both platforms.
+ * `upload(file, { folderId?, fileName? })` takes a BLOB on both hosts — a
+ * browser `File` on the web Player, expo-file-system's `File` (also a Blob)
+ * on the Expo export, as `<FilePicker>`, `useCamera()` and `useImageEditor()`
+ * all hand back. It must be a Blob: Expo's fetch implements the web FormData
+ * spec and rejects React Native's legacy `{ uri, name, type }` part with
+ * "Unsupported FormDataPart implementation", which failed every native
+ * upload. `fileName` overrides the stored name, which otherwise comes from
+ * the Blob's own `.name`.
  *
  * The destination can refuse the add two ways (sc-6977). BRANCH ON
  * `err.status`: 403 means the caller may know why — most often a public space
@@ -3636,7 +3637,27 @@ export function useFilestoreUpload(options) {
       // sc-5402: only the opt-out is sent, so the backend stays the single
       // source of the default (it compresses images to WebP).
       if (compress === false) form.append("compress", "false");
-      form.append("file", file);
+      // The multipart FILENAME is what the backend stores as the file's name
+      // (multer's `originalname`), and a Blob with no third argument lands as
+      // "blob". Both hosts' parts carry `.name` — a browser File, and
+      // expo-file-system's File on native — so pass it through explicitly.
+      const partName =
+        (overrides && typeof overrides.fileName === "string" && overrides.fileName) ||
+        (typeof file.name === "string" && file.name ? file.name : null);
+      // The three-argument append is SPEC'd for a Blob only — a compliant
+      // FormData throws on anything else, and Expo's ignores the name. So a
+      // non-Blob part (expo-file-system's File: `implements Blob` is erased at
+      // runtime) carries its name ON itself, which is where Expo reads it.
+      const isBlob = typeof Blob !== "undefined" && file instanceof Blob;
+      if (partName && !isBlob && file.name !== partName) {
+        try {
+          Object.defineProperty(file, "name", { value: partName, configurable: true });
+        } catch {
+          /* non-configurable: the part's own name stands */
+        }
+      }
+      if (partName && isBlob) form.append("file", file, partName);
+      else form.append("file", file);
       setUploading(true);
       setError(null);
       try {

package/dist/host.d.ts

@@ -334,3 +334,28 @@ export interface LoginDesign {
 
 /** The sign-in screen's authored design, or null when nothing is configured. */
 export function normaliseLoginDesign(raw: unknown): LoginDesign | null;
+
+/** sc-7800 — true when a stored value is a `theme:<path>` colour binding. */
+export function isThemeTokenRef(value: unknown): boolean;
+
+/**
+ * Resolve one `theme:<path>` binding against a resolved widget theme. Returns
+ * `undefined` for a non-binding, a token outside `CONTRACT.themeColorTokens`,
+ * or a path that does not resolve to a colour.
+ */
+export function resolveThemeTokenRef(
+  value: unknown,
+  theme: unknown,
+): string | undefined;
+
+/**
+ * Replace every bound `type: "color"` field on a widget's props — both the
+ * top-level `propertySchema` fields and the `styleSchema` fields under
+ * `props.style` — with the colour its token currently resolves to. Returns the
+ * same reference when nothing is bound.
+ */
+export function resolveThemeTokenRefs<T>(
+  props: T,
+  theme: unknown,
+  schemas?: { propertySchema?: unknown; styleSchema?: unknown },
+): T;

package/dist/host.js

@@ -23,6 +23,17 @@ export {
   applyThemeComponentStyle,
 } from "./theme-components.js";
 
+// sc-7800: the theme-token colour bindings. `resolveThemeTokenRefs` replaces a
+// bound `type: "color"` field with the colour its token currently resolves to,
+// at the SAME render boundary on both hosts — so a rebrand repaints the Player,
+// the Canvas and the exported app alike, and the widget still receives a plain
+// colour string.
+export {
+  isThemeTokenRef,
+  resolveThemeTokenRef,
+  resolveThemeTokenRefs,
+} from "./theme-token-refs.js";
+
 // REQ-THEME-SURFACE: the surface-token derivation both hosts apply per painted
 // surface — the page background and every container that carries its own fill.
 // Host plumbing, deliberately off the author entry point: a widget reads the

package/dist/index.d.ts

@@ -1674,7 +1674,8 @@ export interface CameraAsset {
   /** Bytes, when the host reports it. */
   size: number | null;
   /**
-   * Ready-to-upload part — a `File` on web, `{ uri, name, type }` on native.
+   * Ready-to-upload part — a Blob on both hosts: a `File` on web,
+   * expo-file-system's `File` on native. Expo's fetch rejects any other shape.
    * Append it to a FormData and hand that to `ctx.assets.upload(...)`.
    */
   file: unknown;
@@ -1749,7 +1750,7 @@ export interface EditedImage {
   size: number | null;
   /** Present only when `base64` was requested. */
   base64?: string;
-  /** Ready-to-upload part — a `File` on web, `{ uri, name, type }` on native. */
+  /** Ready-to-upload part — a Blob on both: a `File` on web, expo-file-system's `File` on native. */
   file: unknown;
 }
 
@@ -2699,6 +2700,8 @@ export interface AiWidgetContract {
   readonly manifestCategories: ReadonlyArray<string>;
   readonly manifestPlatforms: ReadonlyArray<string>;
   readonly themeTokens: ThemeTokens;
+  /** sc-7800 — the brand colour tokens a `type: "color"` field may bind to. */
+  readonly themeColorTokens: ReadonlyArray<{ path: string; label: string }>;
   readonly widgetContextShape: Readonly<
     Record<
       string,

package/dist/theme-token-refs.js

@@ -0,0 +1,198 @@
+// sc-7800 — the host side of THEME-TOKEN COLOUR BINDINGS.
+//
+// Host-integration surface, re-exported from `host.js`: consumed ONLY by the
+// platform hosts that render widgets (the web Player / Studio Canvas via
+// buildHostWidgetContext.js, and the exported Expo app's generated WidgetHost),
+// never by a widget author. A widget keeps reading a plain colour string off
+// `props` / `props.style` and never learns a token was involved.
+//
+// Living here — one implementation both hosts import — is what makes a bound
+// colour resolve identically in the Player and the export (widget-parity
+// skill). The alternative, a copy per host, is the drift this file exists to
+// prevent.
+//
+// WHY THIS EXISTS: a `type: "color"` field already tracks the workspace theme
+// while it is UNSET, through its `themeDefault` placeholder. The moment an
+// author picks a colour it became a frozen hex that never followed a rebrand
+// again, and "make this our brand colour" was inexpressible — the author had to
+// type today's hex, which went stale silently. A bound field stores the TOKEN,
+// so the intent survives the rebrand.
+
+import { CONTRACT } from "./contract.js";
+
+// A value is a binding, not a colour, when it carries this prefix. No CSS
+// colour can begin with it, so a stored literal can never be misread as one.
+const PREFIX = "theme:";
+
+/** True when `value` is a theme-token binding rather than a literal colour. */
+export function isThemeTokenRef(value) {
+  return typeof value === "string" && value.startsWith(PREFIX);
+}
+
+/**
+ * Resolve one binding against a resolved widget theme.
+ *
+ * Returns `undefined` for anything that is not a binding, names a token outside
+ * the bindable allowlist, or resolves to a non-string — the caller then leaves
+ * the field unset so it falls back to its `themeDefault` exactly as an
+ * un-bound field does. A malformed binding must never paint blank.
+ */
+export function resolveThemeTokenRef(value, theme) {
+  if (!isThemeTokenRef(value)) return undefined;
+  const path = value.slice(PREFIX.length);
+  // The allowlist is the contract's, so what the Studio may WRITE and what a
+  // host will RESOLVE cannot drift apart.
+  if (!CONTRACT.themeColorTokens.some((token) => token.path === path)) {
+    return undefined;
+  }
+  const resolved = path
+    .split(".")
+    .reduce((o, k) => (o == null ? undefined : o[k]), theme);
+  return typeof resolved === "string" && resolved.trim() !== ""
+    ? resolved
+    : undefined;
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+// The same guard the neighbouring style validators apply: these props are
+// author-stored JSON, and assigning such a key while rebuilding an object would
+// silently reseat its prototype instead of carrying the value.
+const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+/**
+ * Walk a declared schema alongside a value and replace every bound `color`
+ * leaf with the colour its token currently resolves to.
+ *
+ * Schema-GUIDED rather than a blind string sweep, because top-level props hold
+ * arbitrary author content — body copy, rich text, a stored link — where a
+ * `theme:`-prefixed string is data and must be left verbatim. Only a field the
+ * widget declared as a colour is eligible here. (`props.style` is different and
+ * is handled by `resolveStyleBag` below.)
+ *
+ * Returns the SAME reference when nothing is bound, so an app that uses no
+ * bindings takes no extra render work and behaves exactly as it did before.
+ */
+function resolveAgainstSchema(schema, value, theme) {
+  if (!isPlainObject(schema) || !isPlainObject(value)) return value;
+  let changed = false;
+  const out = {};
+  for (const [key, raw] of Object.entries(value)) {
+    if (UNSAFE_KEYS.has(key)) continue;
+    const def = schema[key];
+    out[key] = raw;
+    if (!isPlainObject(def)) continue;
+
+    if (def.type === "color") {
+      if (isThemeTokenRef(raw)) {
+        // An unresolvable binding is dropped rather than painted: the field goes
+        // back to unset, which is what already renders its `themeDefault`.
+        out[key] = resolveThemeTokenRef(raw, theme);
+        changed = true;
+      }
+      continue;
+    }
+    if (def.type === "object" && isPlainObject(def.properties)) {
+      const next = resolveAgainstSchema(def.properties, raw, theme);
+      if (next !== raw) {
+        out[key] = next;
+        changed = true;
+      }
+      continue;
+    }
+    if (def.type === "array" && isPlainObject(def.items) && Array.isArray(raw)) {
+      let itemChanged = false;
+      const items = raw.map((item) => {
+        const next =
+          def.items.type === "object" && isPlainObject(def.items.properties)
+            ? resolveAgainstSchema(def.items.properties, item, theme)
+            : item;
+        if (next !== item) itemChanged = true;
+        return next;
+      });
+      if (itemChanged) {
+        out[key] = items;
+        changed = true;
+      }
+    }
+  }
+  return changed ? out : value;
+}
+
+// A style bag is resolved WITHOUT a schema, and deliberately so. Both hosts
+// thread `styleSchema` only for marketplace / AI-agent widgets; a BUILT-IN
+// passes `undefined` on web and `null` on native (it keeps its defaults in
+// code). Requiring the schema would therefore have left every built-in's colour
+// field bindable in the Studio but unresolved at render — the author picks
+// "Primary" and the widget is handed the literal string. Resolving the bag
+// directly is what makes a built-in and a generated widget behave the same, on
+// both hosts, with nothing new baked into the export.
+//
+// Safe without a schema because `props.style` is by construction a bag of style
+// VALUES — colours, sizes, enums — so an allowlisted `theme:` string in it can
+// only ever have been a binding. The depth cap keeps the walk bounded for the
+// structured style values (a gradient's stops, per-corner radii).
+const MAX_STYLE_DEPTH = 3;
+
+function resolveStyleBag(value, theme, depth) {
+  if (typeof value === "string") {
+    if (!isThemeTokenRef(value)) return value;
+    // Unresolvable drops to unset, which is what renders `themeDefault`.
+    return resolveThemeTokenRef(value, theme);
+  }
+  if (depth >= MAX_STYLE_DEPTH) return value;
+  if (Array.isArray(value)) {
+    let changed = false;
+    const items = value.map((item) => {
+      const next = resolveStyleBag(item, theme, depth + 1);
+      if (next !== item) changed = true;
+      return next;
+    });
+    return changed ? items : value;
+  }
+  if (isPlainObject(value)) {
+    let changed = false;
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      if (UNSAFE_KEYS.has(key)) continue;
+      const next = resolveStyleBag(item, theme, depth + 1);
+      out[key] = next;
+      if (next !== item) changed = true;
+    }
+    return changed ? out : value;
+  }
+  return value;
+}
+
+/**
+ * The host render-boundary call: resolve every theme-token colour binding on a
+ * widget's props, both the top-level `propertySchema` fields and the style
+ * values under `props.style`.
+ *
+ * Called by BOTH hosts in the same place, immediately after
+ * `applyThemeComponentStyle` — a binding is the author's own per-instance
+ * value, so it sits at the top of the style precedence and is resolved once the
+ * lower layers have been folded in.
+ *
+ * @param {object} props — the widget's props (post-`applyThemeComponentStyle`).
+ * @param {object} theme — the resolved widget theme (`workspace.theme`).
+ * @param {object} [schemas] — `{ propertySchema }` as declared by the widget's
+ *   manifest, used for the top-level props only. `props.style` needs no schema
+ *   (see above), so a built-in resolves exactly like a generated widget.
+ * @returns {object} props, with every bound colour resolved.
+ */
+export function resolveThemeTokenRefs(props, theme, schemas) {
+  if (!isPlainObject(props)) return props;
+  const { propertySchema } = schemas || {};
+  let out = resolveAgainstSchema(propertySchema, props, theme);
+  const style = out.style;
+  if (isPlainObject(style)) {
+    const nextStyle = resolveStyleBag(style, theme, 1);
+    if (nextStyle !== style) {
+      out = { ...out, style: nextStyle };
+    }
+  }
+  return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.137.0",
+  "version": "0.139.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "homepage": "https://github.com/Colix-AB/AppStudio",
   "type": "module",
@@ -49,7 +49,7 @@
   ],
   "scripts": {
     "build": "node scripts/build.js",
-    "test": "node --test src/__tests__/contract.test.js src/__tests__/vetted-imports-audit.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-invites.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-page-url.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-flex-basis-percent.test.js src/__tests__/linter-hardcoded-design.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/flatten-entry.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/corner-radius.test.js src/__tests__/theme-components-parity.test.js src/__tests__/navigation-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/interaction-lift.test.js src/__tests__/toast-host.test.js src/__tests__/overlay-tokens.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js src/__tests__/hooks-camera.test.js src/__tests__/hooks-barcode.test.js src/__tests__/hooks-image-editor.test.js src/__tests__/hooks-bound-columns.test.js src/__tests__/hooks-stable-query.test.js src/__tests__/hooks-can-write.test.js src/__tests__/widget-route.test.js src/__tests__/linter-html-in-content.test.js src/__tests__/markdown.test.js src/__tests__/markdown-edit.test.js src/__tests__/richtext-tokens.test.js src/__tests__/style-group.test.js"
+    "test": "node --test src/__tests__/contract.test.js src/__tests__/theme-token-refs.test.js src/__tests__/vetted-imports-audit.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-invites.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-page-url.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-flex-basis-percent.test.js src/__tests__/linter-hardcoded-design.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/flatten-entry.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/corner-radius.test.js src/__tests__/theme-components-parity.test.js src/__tests__/navigation-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/interaction-lift.test.js src/__tests__/toast-host.test.js src/__tests__/overlay-tokens.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js src/__tests__/hooks-camera.test.js src/__tests__/hooks-barcode.test.js src/__tests__/hooks-image-editor.test.js src/__tests__/hooks-bound-columns.test.js src/__tests__/hooks-stable-query.test.js src/__tests__/hooks-can-write.test.js src/__tests__/widget-route.test.js src/__tests__/linter-html-in-content.test.js src/__tests__/markdown.test.js src/__tests__/markdown-edit.test.js src/__tests__/richtext-tokens.test.js src/__tests__/style-group.test.js"
   },
   "engines": {
     "node": ">=18"