@colixsystems/widget-sdk 0.180.0 → 0.181.0

package/README.md

@@ -59,7 +59,7 @@ The data layer lives in **four separate domain-client packages**, each instantia
 | **DIRECTORY** (`ctx.directory`) | `useDirectory(query)` (optional: query) | `{ users, loading, error, refetch }` | `directory.users.list` — `directory.read:users` |
 | **DIRECTORY** | `useUsers(query)` (optional: query) | `{ users, loading, error, refetch, invite, deactivate, reactivate, remove, sendPasswordReset }` | `directory.users.*` — `users.read:*` plus the `users.read` (or `users.write`) capability, else `FORBIDDEN` (edits, incl. `sendPasswordReset()`, also `users.write:*`; `remove()` also `users.delete:*`) |
 | **DIRECTORY** | `useGroups(query)` (optional: query) | `{ groups, loading, error, refetch, create, remove, addMember, removeMember }` | `directory.groups.*` — `groups.read:*` (mutations also `groups.write:*`) |
-| **DIRECTORY** | `useInvites(query)` (optional: query) | `{ invites, loading, error, refetch, resend, revoke }` | `directory.invites.*` — `users.write:*` + the SystemAcl `users.write` capability (the whole invite surface, list included). `query` is `{ status?, limit?, offset? }` with `status` ∈ `pending \| accepted \| revoked \| expired \| all` (endpoint default `all`). |
+| **DIRECTORY** | `useInvites(query)` (optional: query) | `{ invites, loading, error, refetch, resend, revoke }` | `directory.invites.*` — `users.write:*` + the SystemAcl `users.write` capability (the whole invite surface, list included). `query` is `{ status?, q?, app_user_id?, limit?, offset? }` with `status` ∈ `pending \| accepted \| revoked \| expired \| open \| all` (endpoint default `all`; `open` = `pending` or `expired`); `q` matches the invite's name or email, `app_user_id` returns the invites reserving that user id. |
 | **DIRECTORY** | `useBankIdLink()` | `{ linked, available, status, qr, message, startLink, refresh, cancel, unlink, refetchStatus, … }` | `directory.bankid.*` — no scope (JWT-gated self-service) |
 | **FILESTORE** (`ctx.filestore`) | `usePdfExport({ spaceType, folderId })` (optional: spaceType, folderId) | `{ openPdf, opening, canOpenPdf, exportToPdf, exporting, error, lastExported }` | `ctx.filestore.files.renderPdf` + `ctx.device.pdfViewer`, `ctx.filestore.files.exportPdf` — `files.write:*`. `openPdf(html, { fileName? })` renders the HTML to a PDF server-side and OPENS it (web: PDF tab; native: print / share sheet) without saving. `exportToPdf(html, { fileName?, folderId? })` renders it and saves it as a file (`application/pdf`). Same server-side renderer on web + native. |
 | **PAYMENTS** (`ctx.payments`) | `usePayments()` | `{ requestPayment, getPayment }` | `ctx.payments.*` — `payments.charge:appUser`. Rejects with `PaymentError { code, message, retryable }`; when `retryable` is `false` show `message` and drop the retry. Charges are accepted ONLY in the currency the workspace sells in — omit `currency` and the platform applies it (a disagreeing literal is a publish-blocking `payment-currency` finding). |
@@ -74,7 +74,22 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.180.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.181.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.181.0 (contract 1.142.0)
+
+**A `USER` column can point at someone who has been invited but has not joined yet.** Every invite now reserves the id its invitee's user account will have, so a record can be assigned to that person straight away and nothing needs rewriting when they accept.
+
+- **`useInvites()` rows carry `app_user_id`** — that reserved id. The `resend()` result carries it too.
+- **`useInvites(query)` takes two more optional keys.** `q` is a case-insensitive substring match on the invite's name or email. `app_user_id` returns only the invites reserving that id, which is how a member-admin widget resolves the person behind a `USER` value before they have joined; an id no invite reserves returns no rows.
+- **`status: 'open'`** is every invite that is neither accepted nor revoked — `pending` or `expired`. A re-invite keeps the reserved id, so `useInvites({ app_user_id, status: 'open' })` is the one invite that still reserves it.
+- **A `USER` column has a third read shape.** A user of the workspace still reads as `{ id, name, email }` and an id that names nobody as `{ id, name: null }`. An invited person who has not joined reads as `{ id, name, invited: true }` — **with no `email`**, so render `name` and treat `email` as optional. Once they accept, the same id reads as an ordinary user and `invited` is gone.
+
+Additive: no existing field changed shape, and the scope is unchanged (`users.write:*` plus the `users.write` capability for the whole invite surface).
+
+### What's new in 0.180.1 (contract 1.141.0 — unchanged)
+
+**A widget built in the Studio turns on the device capability it uses.** The `react-native-nfc-manager` notes said the publisher must enable the NFC tags capability in Publish settings, and told the widget to say so from its error state. Nobody reads a widget's error state before building: a workspace whose widget imported the package shipped an Android build without the `NFC` permission, and the library — which touches the adapter on every activity pause — closed the app at each permission prompt, file picker and camera open. Publishing a widget from Mason or the widget agent now turns on every device capability its source uses (NFC tags for this package; step counting and activity data for `Pedometer` from `expo-sensors`, and only for `Pedometer`). A widget installed any other way is unchanged: its publisher still enables the capability in Publish settings. The notes now say both, and the error state says what is true on the phone — this build does not include NFC and needs a new one. No export, type or rule changed.
 
 ### What's new in 0.180.0 (contract 1.141.0)
 
@@ -644,7 +659,7 @@ Also tightened in this release: the `publicGrant` flags are now type-checked. Th
 **NFC tags are vetted, native-only (`react-native-nfc-manager`).** A widget can now read and write NFC tags on the Expo export — NDEF over `NfcManager.requestTechnology(NfcTech.Ndef)`, plus the raw technologies a badge, asset tag or transit card uses: `NfcTech.IsoDep` on both hosts, `NfcTech.MifareClassic` on Android, `NfcTech.MifareIOS` / `FelicaIOS` / `Iso15693IOS` on iOS. (There is no `NfcTech.FeliCa` — check `index.d.ts` before naming one.) This is the last common "tap a physical thing" input the allowlist was missing; barcode and QR already had `useBarcodeScanner()`.
 
 - **Native-only, and the browser is why.** Web NFC ships in Chrome on Android alone — Safari, Firefox and every desktop browser omit it — so there is no web build to pair with. Put the import in `widget.native.jsx` and give `widget.web.jsx` a real way in: a typed code field, or the SDK's `useBarcodeScanner()` QR path. The linter's `import-platform-mismatch` enforces the split.
-- **Opt-in per workspace — and `isSupported()` cannot see that.** The export claims the iOS NFC entitlement and the Android `NFC` permission only when the publisher enables the **NFC tags** device capability in Publish settings. `isSupported()` probes the **device** (`readingAvailable` on iOS, `hasSystemFeature` on Android), not the gate: on a capable phone in an app that never asked, it returns `true` and the read then fails — Android throws a `SecurityException` from `registerTagEvent`, iOS cannot open the reader session. So wrap `start()` / `requestTechnology()` in a `try` and render a clear **error state** from the `catch` — name what is missing and say the capability has to be switched on in Publish settings. That `catch` is an error path, **not** the web build's typed-code substitute: do not give `widget.native.jsx` a permanent manual-entry field beside the tap target, because in a correctly-configured app the radio works and the field is the typing the tag was meant to replace.
+- **A per-workspace device capability — and `isSupported()` cannot see it.** The export claims the iOS NFC entitlement and the Android `NFC` permission only while the workspace's **NFC tags** device capability is on. A widget built in the Studio by Mason or the widget agent turns it on when it is published; for any other widget the publisher enables it in Publish settings. Either way it reaches a phone only with the next native build. `isSupported()` probes the **device** (`readingAvailable` on iOS, `hasSystemFeature` on Android), not the gate: on a capable phone running a build made without the capability, it returns `true` and the read then fails — Android throws a `SecurityException` from `registerTagEvent`, iOS cannot open the reader session. So wrap `start()` / `requestTechnology()` in a `try` and render a clear **error state** from the `catch` — say this build of the app does not include NFC and that it needs a new build. That `catch` is an error path, **not** the web build's typed-code substitute: do not give `widget.native.jsx` a permanent manual-entry field beside the tap target, because in a correctly-configured app the radio works and the field is the typing the tag was meant to replace.
 - **Clean up the session.** `cancelTechnologyRequest()` in your effect cleanup; an abandoned request leaves the reader sheet up on iOS.
 - **It is a write capability too.** Read with `getNdefMessage()`; write with `writeNdefMessage(bytes)`, `formatNdef(bytes)` (Android only, for a blank tag) and `transceive(bytes)` on the `IsoDep` / `NfcA` / `NfcV` handlers. One capability covers both — Android expresses read and write through the single `android.permission.NFC` — so the workspace owner who enables it is consenting to every widget in the workspace being able to rewrite the tags their users tap. Raw ISO7816 `transceive` on iOS additionally needs `select-identifiers` on the entitlement, which the export does not declare; NDEF read and write work on both hosts.
 - **`makeReadOnly()` is irreversible.** It permanently locks the tag — no later write will ever succeed, on any device, by any app. Call it only where the feature genuinely wants a one-time-programmable tag, and never as a cleanup step after writing.
@@ -2110,9 +2125,17 @@ function PendingInvites() {
 }
 ```
 
-Rows are snake_case: `{ id, email, name, group_ids, status, expires_at, accepted_at,
-revoked_at, created_at }`. Trust the server-computed `status` rather than comparing
-`expires_at` against the device clock.
+Rows are snake_case: `{ id, app_user_id, email, name, group_ids, status, expires_at,
+accepted_at, revoked_at, created_at }`. Trust the server-computed `status` rather than
+comparing `expires_at` against the device clock.
+
+`query` also takes `q` (a case-insensitive substring match on the invite's name or
+email) and `app_user_id`. Each row's `app_user_id` is the id the invitee's user account
+will have once they accept. A `USER` column may hold that id before the person has
+joined — it then reads back as `{ id, name, invited: true }`, with no `email` — and
+`useInvites({ app_user_id: value.id, status: 'open', limit: 1 })` returns the invite
+behind it. `status: 'open'` is every invite that is neither accepted nor revoked
+(`pending` or `expired`); a re-invite keeps the id, so without it earlier invites match too.
 
 **The gate is `users.write`, not `users.read`.** A pending invite exposes the email of
 someone who is not a member yet, so the backend gates the entire invite surface —

package/dist/contract.cjs

@@ -1787,9 +1787,18 @@ const HOOKS = [
       "returns the { data, meta } envelope verbatim — the hook unwraps " +
       "res.data; rows are snake_case (email, status, expires_at, …) and " +
       "status is the server-computed pending/accepted/revoked/expired " +
-      "value. query is { status?, limit?, offset? } passed verbatim; the " +
-      "endpoint defaults to status 'all', so pass { status: 'pending' } " +
-      "for the usual outstanding-invite list. The WHOLE invite surface — " +
+      "value. query is { status?, q?, app_user_id?, limit?, offset? } passed " +
+      "verbatim; the endpoint defaults to status 'all', so pass " +
+      "{ status: 'pending' } for the usual outstanding-invite list; " +
+      "status 'open' is every invite neither accepted nor revoked (pending " +
+      "or expired). q is a " +
+      "case-insensitive substring match on the invite's name or email. " +
+      "Each row's app_user_id is the id the invitee's user account will " +
+      "have once they accept; a USER column may already hold it, and " +
+      "{ app_user_id, status: 'open' } returns the invite behind such an id " +
+      "(a re-invite keeps the id, so without the status earlier invites " +
+      "match too; an id no invite reserves returns no rows). The WHOLE " +
+      "invite surface — " +
       "list included — is gated on users.write:* plus the users.write " +
       "SystemAcl capability, because a pending invite exposes the email of " +
       "someone who is not a member yet; a users.read-only caller cannot see " +
@@ -1799,7 +1808,7 @@ const HOOKS = [
       "refetch on success.",
     returnShape: {
       invites:
-        "Array<{ id, email, name, group_ids, status, expires_at, accepted_at, revoked_at, created_at }>  // snake_case rows; unwrapped from { data, meta }",
+        "Array<{ id, app_user_id, email, name, group_ids, status, expires_at, accepted_at, revoked_at, created_at }>  // snake_case rows; unwrapped from { data, meta }",
       loading: "boolean",
       error: "DirectoryError | null  // { code, message, retryable }",
       refetch: "() => Promise<void>",
@@ -3371,7 +3380,7 @@ const VETTED_IMPORTS = [
     platforms: ["native"],
     category: "system",
     description:
-      "Read and write NFC tags on the Expo export: NDEF records via NfcManager.requestTechnology(NfcTech.Ndef), plus the raw technologies a badge, asset tag or transit card uses - NfcTech.IsoDep on both hosts, NfcTech.MifareClassic on Android, NfcTech.MifareIOS / FelicaIOS / Iso15693IOS on iOS (there is no NfcTech.FeliCa; check index.d.ts before naming one). Read with ndefHandler.getNdefMessage(); WRITE with writeNdefMessage(bytes), formatNdef(bytes) (Android only, for a blank tag) and transceive(bytes) on the IsoDep / NfcA / NfcV handlers. makeReadOnly() PERMANENTLY locks a tag - it cannot be undone and no later write will ever succeed, so call it only where the brief actually asks for a one-time-programmable tag, never as a tidy-up step. Raw ISO7816 transceive on iOS additionally needs select-identifiers on the entitlement, which this export does not declare - NDEF read and write work on both hosts. Always cancelTechnologyRequest() in a cleanup - an abandoned session leaves the reader sheet up on iOS. Native-only because no browser hands the Player a reader: Web NFC exists in Chrome on Android alone (Safari, Firefox and every desktop browser omit it), so there is no web build to pair with. Author it in widget.native.jsx and give widget.web.jsx a real way in instead - a typed code field, or the SDK's useBarcodeScanner() QR path. The radio is ALSO opt-in per workspace: the export claims the iOS NFC entitlement and the Android NFC permission only when the publisher enables the 'nfc' device capability in Publish settings. isSupported() does NOT see that gate - it probes the DEVICE (readingAvailable on iOS, hasSystemFeature on Android), so on a capable phone in an app that never asked it returns true and the read then fails: Android throws a SecurityException from registerTagEvent, iOS cannot open the reader session. So wrap start() / requestTechnology() in a try and render a clear ERROR STATE from the catch - name what is missing and say the maker must switch 'nfc' on in Publish settings. That catch is an ERROR path, NOT the web build's typed-code substitute: do not give widget.native.jsx a permanent manual-entry field beside the tap target, because in a correctly-configured app the radio works and the field is the typing the tag was meant to replace. Pinned at 3.17.2, the current stable release (4.x is still beta); a community package, so Expo bundledNativeModules has no version opinion on it.",
+      "Read and write NFC tags on the Expo export: NDEF records via NfcManager.requestTechnology(NfcTech.Ndef), plus the raw technologies a badge, asset tag or transit card uses - NfcTech.IsoDep on both hosts, NfcTech.MifareClassic on Android, NfcTech.MifareIOS / FelicaIOS / Iso15693IOS on iOS (there is no NfcTech.FeliCa; check index.d.ts before naming one). Read with ndefHandler.getNdefMessage(); WRITE with writeNdefMessage(bytes), formatNdef(bytes) (Android only, for a blank tag) and transceive(bytes) on the IsoDep / NfcA / NfcV handlers. makeReadOnly() PERMANENTLY locks a tag - it cannot be undone and no later write will ever succeed, so call it only where the brief actually asks for a one-time-programmable tag, never as a tidy-up step. Raw ISO7816 transceive on iOS additionally needs select-identifiers on the entitlement, which this export does not declare - NDEF read and write work on both hosts. Always cancelTechnologyRequest() in a cleanup - an abandoned session leaves the reader sheet up on iOS. Native-only because no browser hands the Player a reader: Web NFC exists in Chrome on Android alone (Safari, Firefox and every desktop browser omit it), so there is no web build to pair with. Author it in widget.native.jsx and give widget.web.jsx a real way in instead - a typed code field, or the SDK's useBarcodeScanner() QR path. The radio is ALSO a per-workspace device capability: the export claims the iOS NFC entitlement and the Android NFC permission only while the workspace's 'nfc' device capability is on. A widget built in the Studio by Mason or the widget agent turns it on when it is published; for any other widget the publisher enables it in Publish settings. Either way it reaches a phone only with the next native build. isSupported() does NOT see that gate - it probes the DEVICE (readingAvailable on iOS, hasSystemFeature on Android), so on a capable phone running a build made without the capability it returns true and the read then fails: Android throws a SecurityException from registerTagEvent, iOS cannot open the reader session. So wrap start() / requestTechnology() in a try and render a clear ERROR STATE from the catch - say this build of the app does not include NFC and that it needs a new build. That catch is an ERROR path, NOT the web build's typed-code substitute: do not give widget.native.jsx a permanent manual-entry field beside the tap target, because in a correctly-configured app the radio works and the field is the typing the tag was meant to replace. Pinned at 3.17.2, the current stable release (4.x is still beta); a community package, so Expo bundledNativeModules has no version opinion on it.",
   },
   {
     specifier: "decimal.js",
@@ -4767,7 +4776,11 @@ const CONTRACT = deepFreeze({
   // 1.141.0: additive (sc-9346) — inside a section that paints its own fill,
   //    `theme.colors.backdrop` is that fill, and `<Button>` re-inks a variant
   //    colour that cannot be read against it by the rule its text follows.
-  version: "1.141.0",
+  // 1.142.0: additive (sc-9713) — `useInvites(query)` takes `q`,
+  //    `app_user_id` and `status: "open"`, and each invite row carries
+  //    `app_user_id`: the id the invitee's user account will have once they
+  //    accept.
+  version: "1.142.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/contract.js

@@ -1787,9 +1787,18 @@ const HOOKS = [
       "returns the { data, meta } envelope verbatim — the hook unwraps " +
       "res.data; rows are snake_case (email, status, expires_at, …) and " +
       "status is the server-computed pending/accepted/revoked/expired " +
-      "value. query is { status?, limit?, offset? } passed verbatim; the " +
-      "endpoint defaults to status 'all', so pass { status: 'pending' } " +
-      "for the usual outstanding-invite list. The WHOLE invite surface — " +
+      "value. query is { status?, q?, app_user_id?, limit?, offset? } passed " +
+      "verbatim; the endpoint defaults to status 'all', so pass " +
+      "{ status: 'pending' } for the usual outstanding-invite list; " +
+      "status 'open' is every invite neither accepted nor revoked (pending " +
+      "or expired). q is a " +
+      "case-insensitive substring match on the invite's name or email. " +
+      "Each row's app_user_id is the id the invitee's user account will " +
+      "have once they accept; a USER column may already hold it, and " +
+      "{ app_user_id, status: 'open' } returns the invite behind such an id " +
+      "(a re-invite keeps the id, so without the status earlier invites " +
+      "match too; an id no invite reserves returns no rows). The WHOLE " +
+      "invite surface — " +
       "list included — is gated on users.write:* plus the users.write " +
       "SystemAcl capability, because a pending invite exposes the email of " +
       "someone who is not a member yet; a users.read-only caller cannot see " +
@@ -1799,7 +1808,7 @@ const HOOKS = [
       "refetch on success.",
     returnShape: {
       invites:
-        "Array<{ id, email, name, group_ids, status, expires_at, accepted_at, revoked_at, created_at }>  // snake_case rows; unwrapped from { data, meta }",
+        "Array<{ id, app_user_id, email, name, group_ids, status, expires_at, accepted_at, revoked_at, created_at }>  // snake_case rows; unwrapped from { data, meta }",
       loading: "boolean",
       error: "DirectoryError | null  // { code, message, retryable }",
       refetch: "() => Promise<void>",
@@ -3367,7 +3376,7 @@ const VETTED_IMPORTS = [
     platforms: ["native"],
     category: "system",
     description:
-      "Read and write NFC tags on the Expo export: NDEF records via NfcManager.requestTechnology(NfcTech.Ndef), plus the raw technologies a badge, asset tag or transit card uses - NfcTech.IsoDep on both hosts, NfcTech.MifareClassic on Android, NfcTech.MifareIOS / FelicaIOS / Iso15693IOS on iOS (there is no NfcTech.FeliCa; check index.d.ts before naming one). Read with ndefHandler.getNdefMessage(); WRITE with writeNdefMessage(bytes), formatNdef(bytes) (Android only, for a blank tag) and transceive(bytes) on the IsoDep / NfcA / NfcV handlers. makeReadOnly() PERMANENTLY locks a tag - it cannot be undone and no later write will ever succeed, so call it only where the brief actually asks for a one-time-programmable tag, never as a tidy-up step. Raw ISO7816 transceive on iOS additionally needs select-identifiers on the entitlement, which this export does not declare - NDEF read and write work on both hosts. Always cancelTechnologyRequest() in a cleanup - an abandoned session leaves the reader sheet up on iOS. Native-only because no browser hands the Player a reader: Web NFC exists in Chrome on Android alone (Safari, Firefox and every desktop browser omit it), so there is no web build to pair with. Author it in widget.native.jsx and give widget.web.jsx a real way in instead - a typed code field, or the SDK's useBarcodeScanner() QR path. The radio is ALSO opt-in per workspace: the export claims the iOS NFC entitlement and the Android NFC permission only when the publisher enables the 'nfc' device capability in Publish settings. isSupported() does NOT see that gate - it probes the DEVICE (readingAvailable on iOS, hasSystemFeature on Android), so on a capable phone in an app that never asked it returns true and the read then fails: Android throws a SecurityException from registerTagEvent, iOS cannot open the reader session. So wrap start() / requestTechnology() in a try and render a clear ERROR STATE from the catch - name what is missing and say the maker must switch 'nfc' on in Publish settings. That catch is an ERROR path, NOT the web build's typed-code substitute: do not give widget.native.jsx a permanent manual-entry field beside the tap target, because in a correctly-configured app the radio works and the field is the typing the tag was meant to replace. Pinned at 3.17.2, the current stable release (4.x is still beta); a community package, so Expo bundledNativeModules has no version opinion on it.",
+      "Read and write NFC tags on the Expo export: NDEF records via NfcManager.requestTechnology(NfcTech.Ndef), plus the raw technologies a badge, asset tag or transit card uses - NfcTech.IsoDep on both hosts, NfcTech.MifareClassic on Android, NfcTech.MifareIOS / FelicaIOS / Iso15693IOS on iOS (there is no NfcTech.FeliCa; check index.d.ts before naming one). Read with ndefHandler.getNdefMessage(); WRITE with writeNdefMessage(bytes), formatNdef(bytes) (Android only, for a blank tag) and transceive(bytes) on the IsoDep / NfcA / NfcV handlers. makeReadOnly() PERMANENTLY locks a tag - it cannot be undone and no later write will ever succeed, so call it only where the brief actually asks for a one-time-programmable tag, never as a tidy-up step. Raw ISO7816 transceive on iOS additionally needs select-identifiers on the entitlement, which this export does not declare - NDEF read and write work on both hosts. Always cancelTechnologyRequest() in a cleanup - an abandoned session leaves the reader sheet up on iOS. Native-only because no browser hands the Player a reader: Web NFC exists in Chrome on Android alone (Safari, Firefox and every desktop browser omit it), so there is no web build to pair with. Author it in widget.native.jsx and give widget.web.jsx a real way in instead - a typed code field, or the SDK's useBarcodeScanner() QR path. The radio is ALSO a per-workspace device capability: the export claims the iOS NFC entitlement and the Android NFC permission only while the workspace's 'nfc' device capability is on. A widget built in the Studio by Mason or the widget agent turns it on when it is published; for any other widget the publisher enables it in Publish settings. Either way it reaches a phone only with the next native build. isSupported() does NOT see that gate - it probes the DEVICE (readingAvailable on iOS, hasSystemFeature on Android), so on a capable phone running a build made without the capability it returns true and the read then fails: Android throws a SecurityException from registerTagEvent, iOS cannot open the reader session. So wrap start() / requestTechnology() in a try and render a clear ERROR STATE from the catch - say this build of the app does not include NFC and that it needs a new build. That catch is an ERROR path, NOT the web build's typed-code substitute: do not give widget.native.jsx a permanent manual-entry field beside the tap target, because in a correctly-configured app the radio works and the field is the typing the tag was meant to replace. Pinned at 3.17.2, the current stable release (4.x is still beta); a community package, so Expo bundledNativeModules has no version opinion on it.",
   },
   {
     specifier: "decimal.js",
@@ -4763,7 +4772,11 @@ const CONTRACT = deepFreeze({
   // 1.141.0: additive (sc-9346) — inside a section that paints its own fill,
   //    `theme.colors.backdrop` is that fill, and `<Button>` re-inks a variant
   //    colour that cannot be read against it by the rule its text follows.
-  version: "1.141.0",
+  // 1.142.0: additive (sc-9713) — `useInvites(query)` takes `q`,
+  //    `app_user_id` and `status: "open"`, and each invite row carries
+  //    `app_user_id`: the id the invitee's user account will have once they
+  //    accept.
+  version: "1.142.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/index.d.ts

@@ -2185,6 +2185,12 @@ export type AppUserInviteStatus =
 
 export interface AppUserInviteRow {
   id: string;
+  /**
+   * The id the invitee's user account will have once they accept. On every
+   * `useInvites()` row and the `resend()` result; `useUsers().invite()` does
+   * not return it.
+   */
+  app_user_id?: string;
   email: string;
   /** Server-computed lifecycle value — prefer it over re-deriving expiry. */
   status: AppUserInviteStatus;
@@ -2258,8 +2264,20 @@ export function useGroups(query?: GroupsQuery): GroupsApi;
 // sc-5097 — pending AppUser invite administration.
 
 export interface InvitesQuery {
-  /** Defaults to "all" server-side; pass "pending" for outstanding invites. */
-  status?: AppUserInviteStatus | "all";
+  /**
+   * Defaults to "all" server-side; pass "pending" for outstanding invites.
+   * "open" is "pending" or "expired": neither accepted nor revoked.
+   */
+  status?: AppUserInviteStatus | "open" | "all";
+  /** Case-insensitive substring match on the invite's name or email. */
+  q?: string;
+  /**
+   * Only the invites reserving this user id (a row's `app_user_id`) — resolves
+   * the person behind an id a USER column holds before they have joined. A
+   * re-invite keeps the id, so add `status: "open"` for the one that still
+   * reserves it. An id no invite reserves returns no rows.
+   */
+  app_user_id?: string;
   limit?: number;
   offset?: number;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.180.0",
+  "version": "0.181.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "homepage": "https://github.com/Colix-AB/AppStudio",
   "type": "module",