@colixsystems/widget-sdk 0.239.0 → 0.241.0

package/README.md

@@ -84,7 +84,22 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.239.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.241.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.241.0 (contract 1.195.0)
+
+**A signing round can include people without an account in the app.** `useSigningRound(fileId).prepare(signers)` takes, beside account ids, `{ name, email }` entries, mixed in the order of the places on the signature page. When the round is confirmed, each of those people is emailed a personal BankID signing link that is valid for 24 hours. Anyone who holds the link can sign, so tell the person sending the document before they send it. In the round a manager sees each place's `id`, `kind` (`"app_user"` or `"email"`), `email`, `signed_as` (the name BankID verified, which can differ from the name you entered) and, for an email place, `link`: `{ status, sent_at, expires_at, used_at, links_sent, can_resend }`, where `status` is `"sending"`, `"sent"`, `"delivery_failed"`, `"expired"`, `"used"` or `"cancelled"`. `resendLink(signerId, { email })` replaces the place's link with a new one (the old link stops working), sent to a corrected address when you pass one. Offer it only where `link.can_resend` is true. A refused signer's `errors` entry now carries `index`, its position in the list you sent, so you can mark the right entry. A new link sent too soon is refused with `SIGNING_LINK_RESEND_TOO_SOON` and a `retryAfter` in seconds. A list of account ids alone works exactly as before. **One type changes:** `SigningRoundSigner.app_user_id` widens from `string` to `string | null`, because an email place has no account; TypeScript code that read it as a string must check for null. `resendLink` needs `@colixsystems/filestore-client@0.14.0`; with an older client it is refused with code `NOT_SUPPORTED`.
+
+```jsx
+const { round, prepare, resendLink } = useSigningRound(fileId);
+await prepare(["user_1", { name: "Bo Ek", email: "bo@example.se" }]);
+// later, for an email place whose link.can_resend is true:
+await resendLink(place.id, { email: "bo.ek@example.se" });
+```
+
+### What's new in 0.240.0 (contract 1.194.0)
+
+**A `datastoreTemplate` can describe a whole system.** A template may now declare up to 100 tables of up to 200 columns, up to 100 sample `rows` per table and up to 32 `roles`. Sample rows have one more bound: the whole template seeds at most 20000 cells, where each row counts the keys it sets and at least one, summed over every row of every table. A template past any limit is refused at publish with a message naming the limit and the count. Every template valid under 0.239.0 is still valid.
 
 ### What's new in 0.239.0 (contract 1.193.0)
 
@@ -1601,7 +1616,7 @@ datastoreTemplate: {
 
 `roles` is declared ONCE per template and referenced by every table, so three widgets over two tables ask the installing workspace **one** question per audience rather than one per grant. At install they pick one of their own groups for each role, or have one created for them under the role's label.
 
-- **`key`** is lowercase-kebab (`/^[a-z][a-z0-9-]*$/`), at most 8 roles per template. A `roleGrants` entry naming a role you did not declare is a publish error, as is granting the same role twice on one table or granting it no verb at all.
+- **`key`** is lowercase-kebab (`/^[a-z][a-z0-9-]*$/`); the roles cap is in `WidgetDatastoreTemplate`. A `roleGrants` entry naming a role you did not declare is a publish error, as is granting the same role twice on one table or granting it no verb at all.
 - **`canDelete` is row-level only.** A table-scope grant answers "may I create a record"; only a record permission answers a question about a row. Both halves are written for you from the one declaration.
 - **An unbound role is an ordinary outcome, never a failed install.** If the installer skips a role, no grant is written and they are told which role is still unbound — they can bind it later from the table's permissions.
 - **Purely additive.** A template declaring neither `roles` nor `roleGrants` behaves exactly as it does today.
@@ -2574,7 +2589,7 @@ useEffect(() => {
 
 ### What's new in 0.51.0
 
-**`datastoreTemplate` tables can ship sample `rows` (sc-2070).** Each `WidgetDatastoreTemplateTable` now takes an optional `rows` array — sample data seeded into the table at install time so the widget renders with real content instead of an empty state. Each entry is an object keyed by column `name`; only the scalar/array column types are seedable (`STRING`, `TEXT`, `NUMBER`, `FLOAT`, `BOOL`, `DATE`, `STRING_ARRAY`, `INT_ARRAY`). RELATION, FILE, USER, and USER_GROUP columns are rejected at validation time (a sample row has no way to express their ids). A `null` value skips that cell; at most 25 rows per table. The "Seed data" action and every install path seed these rows in the same transaction that creates the tables. Additive — `rows` is optional and existing templates that omit it behave exactly as before.
+**`datastoreTemplate` tables can ship sample `rows` (sc-2070).** Each `WidgetDatastoreTemplateTable` now takes an optional `rows` array — sample data seeded into the table at install time so the widget renders with real content instead of an empty state. Each entry is an object keyed by column `name`; only the scalar/array column types are seedable (`STRING`, `TEXT`, `NUMBER`, `FLOAT`, `BOOL`, `DATE`, `STRING_ARRAY`, `INT_ARRAY`). RELATION, FILE, USER, and USER_GROUP columns are rejected at validation time (a sample row has no way to express their ids). A `null` value skips that cell; the per-table row cap is on `WidgetDatastoreTemplateTable.rows`. The "Seed data" action and every install path seed these rows in the same transaction that creates the tables. Additive — `rows` is optional and existing templates that omit it behave exactly as before.
 
 ### What's new in 0.49.0
 
@@ -2939,7 +2954,7 @@ The "split-implementation + vetted package list" pivot.
 
 ### What was in 0.3.0
 
-Additive: `WidgetManifest` carries an optional `datastoreTemplate` field. When a tenant installs a widget that declares one, the table set is seeded into their workspace alongside the install. Tables follow the built-in template semantics (auto-suffixed naming, creator-grants, public grants, cross-relation inheritance) and persist when the widget is later uninstalled. See `WidgetDatastoreTemplate` in `src/index.d.ts` for the constraints — at most 8 tables per widget, 24 columns per table, RELATION columns address siblings by `suffix`.
+Additive: `WidgetManifest` carries an optional `datastoreTemplate` field. When a tenant installs a widget that declares one, the table set is seeded into their workspace alongside the install. Tables follow the built-in template semantics (auto-suffixed naming, creator-grants, public grants, cross-relation inheritance) and persist when the widget is later uninstalled. See `WidgetDatastoreTemplate` in `src/index.d.ts` for the current limits; RELATION columns address siblings by `suffix`.
 
 ## Public API
 

package/dist/contract.cjs

@@ -1747,15 +1747,27 @@ const HOOKS = [
     signature: "useSigningRound(fileId)",
     description:
       "One file's current signing round, and the actions of someone who " +
-      "manages the file's folder. prepare(signerIds) drafts a round for those " +
-      "users, their places on the signature page in the order given (take the " +
-      "ids from useFileRoster()); it can take " +
+      "manages the file's folder. prepare(signers) drafts a round for those " +
+      "people, their places on the signature page in the order given: each " +
+      "entry is an account id from useFileRoster() (or { app_user_id }), or " +
+      "{ name, email } for someone without an account, who is emailed a " +
+      "personal BankID signing link valid for 24 hours once the round is " +
+      "confirmed (anyone holding that link can sign, so say so before " +
+      "sending); it can take " +
       "up to a minute. preparedFile() returns a five-minute link to the " +
       "prepared document; show it to the user before confirming. confirm() " +
       "opens the round for exactly the document preparedFile() last returned, " +
       "and rejects with code PREVIEW_REQUIRED when it was not called first. " +
       "cancel() ends a draft or an open round and resolves to the cancelled " +
-      "round (status 'CANCELLED'); round is then null. ONE ACTION RUNS AT A " +
+      "round (status 'CANCELLED'); round is then null. " +
+      "resendLink(signerId, { email }) replaces an email place's link with " +
+      "a new one (the old one stops working), sent to the corrected email " +
+      "when given, and resolves to the round; offer it only where the " +
+      "place's link.can_resend is true. A manager sees each place's id, kind " +
+      "('app_user' | 'email'), email, signed_as (the name BankID verified) " +
+      "and link ({ status: 'sending' | 'sent' | 'delivery_failed' | " +
+      "'expired' | 'used' | 'cancelled', sent_at, expires_at, used_at, " +
+      "links_sent, can_resend }, null for an account place). ONE ACTION RUNS AT A " +
       "TIME: while busy is true any other action is refused at once with code " +
       "ACTION_IN_PROGRESS (it is not queued), so disable your buttons on busy. " +
       "round is the full round as the " +
@@ -1763,8 +1775,15 @@ const HOOKS = [
       "every signer's name and position and their own progress only, anyone " +
       "else sees null. A refused action sets error and rejects with it: code " +
       "and message come from the server (show message as it is), errors has " +
-      "one entry per refused signer ({ app_user_id, message, reason, " +
-      "characters }), retryAfter is the seconds to wait. The hook's own " +
+      "one entry per refused signer ({ index, app_user_id, message, reason, " +
+      "characters }; index is the entry's place in the list sent), " +
+      "retryAfter is the seconds to wait. resendLink is refused with " +
+      "SIGNING_LINK_RESEND_TOO_SOON (with retryAfter), " +
+      "SIGNING_LINK_RESEND_IN_PROGRESS, SIGNING_LINK_LIMIT_REACHED, " +
+      "SIGNING_LINK_BUDGET_EXCEEDED, SIGNING_LINK_PLATFORM_LIMIT, " +
+      "INVALID_EMAIL, DUPLICATE_SIGNER, SIGNING_ROUND_NOT_OPEN, " +
+      "SIGNING_ROUND_CLOSED or ALREADY_SIGNED, and by the hook itself with " +
+      "NOT_SUPPORTED when the host's filestore client cannot send links. The hook's own " +
       "refusals (PREVIEW_REQUIRED, ACTION_IN_PROGRESS, NO_SIGNING_ROUND) carry " +
       "a message that can be shown the same way. When a refusal means the " +
       "round is no longer what was shown (it expired, was closed, or the " +
@@ -1776,14 +1795,16 @@ const HOOKS = [
     returnShape: {
       round:
         "{ id, file_id, status: 'DRAFT' | 'OPEN' | 'COMPLETED', created_at, confirmed_at, completed_at, expires_at, " +
-        "signers: { name, position, app_user_id?, signed?, signed_at?, signed_as? }[] } | null",
+        "signers: { name, position, app_user_id?, signed?, signed_at?, signed_as?, id?, kind?: 'app_user' | 'email', email?, " +
+        "link?: { status: 'sending' | 'sent' | 'delivery_failed' | 'expired' | 'used' | 'cancelled', sent_at, expires_at, used_at, links_sent, can_resend } | null }[] } | null",
       loading: "boolean",
       error: "PermissionError | null  // { code, message, retryable, errors, retryAfter }",
       refresh: "() => Promise<void>",
-      prepare: "(signerIds: string[]) => Promise<round>  // status 'DRAFT'",
+      prepare: "(signers: (string | { app_user_id } | { name, email })[]) => Promise<round>  // status 'DRAFT'",
       preparedFile: "() => Promise<{ url, sha256, expires_at, size_bytes }>",
       confirm: "() => Promise<round>  // status 'OPEN'",
       cancel: "() => Promise<round>  // the round it ended, status 'CANCELLED'",
+      resendLink: "(signerId: string, options?: { email?: string }) => Promise<round>  // a new link for an email place",
       busy: "boolean  // an action is running; another one is refused with ACTION_IN_PROGRESS",
     },
     requiredContextSlice: ["filestore.signingRounds"],
@@ -3690,7 +3711,7 @@ const MANIFEST_SCHEMA = {
     type: "object",
     required: false,
     description:
-      "Optional. Tables the widget needs, seeded into the workspace at install time. Authors wire them into the widget's `tableRef` properties via the Properties Panel — the SDK does not auto-bind. Limits: 8 tables, 24 columns per table. RELATION columns address siblings by `targetSuffix` (any table in the same array, in any order; tables may relate to each other both ways). Tables persist across uninstalls. A `tableRef` property may also carry `sharedTable: true`, declaring that the table is the APP'S OWN — the author picks an existing table and the widget seeds nothing for it. That is the correct shape for a widget that reads data it does not own (a chart, a metric, a manager view over another widget's table). `sharedTable` exempts the property from needing a seeded table at publish (`manifest.requiredTableRefsHaveTemplate`) WITHOUT making it optional: the author must still bind one, and the host still refuses to place the widget unbound. Use it instead of dropping `required` — a widget that silently renders an empty tile is the defect it looks like a fix for. sc-7530: a table may also declare `roleGrants` — group-scoped access named SYMBOLICALLY, because a group id belongs to the workspace that installs the widget and could never travel in the manifest. Declare the audiences once at template level as `roles: [{ key, label, description? }]` (key is lowercase kebab, max 8 roles), then per table `roleGrants: [{ role, canRead?, canWrite?, canDelete? }]`. The installing workspace binds each role to one of its own user groups (or has one created) during the install consent step, so a permission model where an admin group does everything and signed-in users only read survives the trip between workspaces. Use `publicGrant` for the two id-less audiences (everyone / any signed-in user) and `roleGrants` for anything that names a group. A role nobody binds simply writes no grant — it never fails the install. sc-7557: a column may declare `encrypted: true` — its values are stored AES-256-GCM encrypted at rest under a per-workspace subkey. The widget still reads and writes PLAINTEXT (the platform encrypts on write, decrypts for end users); studio users see `🔒` instead, and the column cannot be searched, filtered or sorted on. Sample `rows` you seed for it are encrypted the same way. Not valid on `RELATION` — its value is a foreign key the backend must resolve — and publishing one is rejected. An `inheritAcl` RELATION column may add `inheritAclReadOnly: true` — rows then inherit READ access only, so members of the parent read every child and may add children, but change or delete only the rows they created (pair with `grantCreatorPermissions`). A column may declare `defaultValue`, written when a create omits it: `@currentUser` on USER, `@now` on DATE / DATETIME, or a literal of the column's own type (none on FILE, RELATION or USER_GROUP — ids belong to the installing workspace). `defaultLocked: true` on an `@currentUser` / `@now` default makes the server always stamp it and ignore any client value on create and update, so an author column cannot be forged. `immutable: true` makes a column write-once: a create sets it as usual and any value sent for it on update is ignored (not valid on a MANY_TO_MANY relation). A table may declare `presence: true` so the people who share a row see which of each other are online (useOnlineMembers); it takes effect only while the workspace records user activity, and an upgrade that declares it turns it on for the existing table. A ONE_TO_ONE / ONE_TO_MANY RELATION may declare `latestVia: \"<relation column on its target that points back>\"` (onDelete left at SET_NULL; that relation must have inheritAcl and be immutable): the server keeps it at the newest row of the target table that points back at this row. A column may declare `copyOf: { via, column }`: the server keeps it equal to `column` on the row the latest-row column `via` points at (same type, or text into text, cut to 140 characters in a STRING column; a copy of an encrypted column must be encrypted, and a copy cannot inheritAcl). Both are written only by the server, in the same write as the related row; a client value is ignored. A table may declare `constraints`, checked on every write for every client and refused as CONSTRAINT_VIOLATION: `unique` ({ columns, partitionColumns?, unlessRelated?: { relation, column } } — waived for rows whose related row has that yes/no column set), `no-overlap` ({ startColumn, endColumn, partitionColumns? }), `related-open` ({ relation, closedColumn } — no row is added, changed or removed while the related row's column is filled) and `related-index` ({ column, relation, listColumn } — the number must be a position in the related row's list). An upgrade adds a declared constraint to an existing table without judging the rows already in it.",
+      "Optional. Tables the widget needs, seeded into the workspace at install time. Authors wire them into the widget's `tableRef` properties via the Properties Panel — the SDK does not auto-bind. Limits: 100 tables, 200 columns per table, 100 sample rows per table and 20000 sample cells across the whole template (each row counts the keys it sets, and at least one, summed over every table). RELATION columns address siblings by `targetSuffix` (any table in the same array, in any order; tables may relate to each other both ways). Tables persist across uninstalls. A `tableRef` property may also carry `sharedTable: true`, declaring that the table is the APP'S OWN — the author picks an existing table and the widget seeds nothing for it. That is the correct shape for a widget that reads data it does not own (a chart, a metric, a manager view over another widget's table). `sharedTable` exempts the property from needing a seeded table at publish (`manifest.requiredTableRefsHaveTemplate`) WITHOUT making it optional: the author must still bind one, and the host still refuses to place the widget unbound. Use it instead of dropping `required` — a widget that silently renders an empty tile is the defect it looks like a fix for. sc-7530: a table may also declare `roleGrants` — group-scoped access named SYMBOLICALLY, because a group id belongs to the workspace that installs the widget and could never travel in the manifest. Declare the audiences once at template level as `roles: [{ key, label, description? }]` (key is lowercase kebab, max 32 roles), then per table `roleGrants: [{ role, canRead?, canWrite?, canDelete? }]`. The installing workspace binds each role to one of its own user groups (or has one created) during the install consent step, so a permission model where an admin group does everything and signed-in users only read survives the trip between workspaces. Use `publicGrant` for the two id-less audiences (everyone / any signed-in user) and `roleGrants` for anything that names a group. A role nobody binds simply writes no grant — it never fails the install. sc-7557: a column may declare `encrypted: true` — its values are stored AES-256-GCM encrypted at rest under a per-workspace subkey. The widget still reads and writes PLAINTEXT (the platform encrypts on write, decrypts for end users); studio users see `🔒` instead, and the column cannot be searched, filtered or sorted on. Sample `rows` you seed for it are encrypted the same way. Not valid on `RELATION` — its value is a foreign key the backend must resolve — and publishing one is rejected. An `inheritAcl` RELATION column may add `inheritAclReadOnly: true` — rows then inherit READ access only, so members of the parent read every child and may add children, but change or delete only the rows they created (pair with `grantCreatorPermissions`). A column may declare `defaultValue`, written when a create omits it: `@currentUser` on USER, `@now` on DATE / DATETIME, or a literal of the column's own type (none on FILE, RELATION or USER_GROUP — ids belong to the installing workspace). `defaultLocked: true` on an `@currentUser` / `@now` default makes the server always stamp it and ignore any client value on create and update, so an author column cannot be forged. `immutable: true` makes a column write-once: a create sets it as usual and any value sent for it on update is ignored (not valid on a MANY_TO_MANY relation). A table may declare `presence: true` so the people who share a row see which of each other are online (useOnlineMembers); it takes effect only while the workspace records user activity, and an upgrade that declares it turns it on for the existing table. A ONE_TO_ONE / ONE_TO_MANY RELATION may declare `latestVia: \"<relation column on its target that points back>\"` (onDelete left at SET_NULL; that relation must have inheritAcl and be immutable): the server keeps it at the newest row of the target table that points back at this row. A column may declare `copyOf: { via, column }`: the server keeps it equal to `column` on the row the latest-row column `via` points at (same type, or text into text, cut to 140 characters in a STRING column; a copy of an encrypted column must be encrypted, and a copy cannot inheritAcl). Both are written only by the server, in the same write as the related row; a client value is ignored. A table may declare `constraints`, checked on every write for every client and refused as CONSTRAINT_VIOLATION: `unique` ({ columns, partitionColumns?, unlessRelated?: { relation, column } } — waived for rows whose related row has that yes/no column set), `no-overlap` ({ startColumn, endColumn, partitionColumns? }), `related-open` ({ relation, closedColumn } — no row is added, changed or removed while the related row's column is filled) and `related-index` ({ column, relation, listColumn } — the number must be a position in the related row's list). An upgrade adds a declared constraint to an existing table without judging the rows already in it.",
   },
   translations: {
     type: "object",
@@ -3892,7 +3913,7 @@ const WIDGET_CONTEXT_SHAPE = {
       "{ files: { list(query) -> Promise<{ data, meta }>, get(id), upload(formData), update(id, body), copy(id, body), remove(id), preview(id) }, " +
       "folders: { list, create, update, remove }, shares: { ... }, trash: { ... }, " +
       "signatures: { list(fileIds), roster(fileId, query), initiate(fileId), status(id), cancel(id), verify(id) }, " +
-      "signingRounds: { overview(fileIds), list(fileId, query), get(roundId), prepare(fileId, signerIds), preparedFile(roundId), confirm(roundId, preparedSha256), cancel(roundId) }, " +
+      "signingRounds: { overview(fileIds), list(fileId, query), get(roundId), prepare(fileId, signers), preparedFile(roundId), confirm(roundId, preparedSha256), cancel(roundId), resendLink(roundId, signerId, { email }) }, " +
       "objectUrl(token), fetchObject(token) }. " +
       "Backs useFilestoreFiles() + useFilestoreFolders() + useFilestoreCreateFolder() + useFilestoreCopy() + useFileSignature() + useFileSignatures() + useFileRoster() + useSigningRounds() + useSigningRound(). Optional — a host without an end-user filestore omits it and those hooks throw a clear error.",
     required: false,
@@ -6090,7 +6111,13 @@ const CONTRACT = deepFreeze({
   // 1.193.0: additive (sc-11821) — `useNavigation().scrollToSection(id)`
   //    scrolls the page to one of its sections on both hosts, and the
   //    `sectionRef` propertySchema type gives the author a section picker.
-  version: "1.193.0",
+  // 1.194.0: more permissive (sc-11945) — a datastoreTemplate takes 100
+  //    tables, 200 columns, 100 rows per table, 20000 cells and 32 roles.
+  // 1.195.0: additive (sc-11879) — `useSigningRound().prepare` takes
+  //    `{ name, email }` entries for signers without an account, and
+  //    `resendLink(signerId, { email })` sends such a signer a new link.
+  //    The manager's places carry id, kind, email and link.
+  version: "1.195.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/contract.js

@@ -1747,15 +1747,27 @@ const HOOKS = [
     signature: "useSigningRound(fileId)",
     description:
       "One file's current signing round, and the actions of someone who " +
-      "manages the file's folder. prepare(signerIds) drafts a round for those " +
-      "users, their places on the signature page in the order given (take the " +
-      "ids from useFileRoster()); it can take " +
+      "manages the file's folder. prepare(signers) drafts a round for those " +
+      "people, their places on the signature page in the order given: each " +
+      "entry is an account id from useFileRoster() (or { app_user_id }), or " +
+      "{ name, email } for someone without an account, who is emailed a " +
+      "personal BankID signing link valid for 24 hours once the round is " +
+      "confirmed (anyone holding that link can sign, so say so before " +
+      "sending); it can take " +
       "up to a minute. preparedFile() returns a five-minute link to the " +
       "prepared document; show it to the user before confirming. confirm() " +
       "opens the round for exactly the document preparedFile() last returned, " +
       "and rejects with code PREVIEW_REQUIRED when it was not called first. " +
       "cancel() ends a draft or an open round and resolves to the cancelled " +
-      "round (status 'CANCELLED'); round is then null. ONE ACTION RUNS AT A " +
+      "round (status 'CANCELLED'); round is then null. " +
+      "resendLink(signerId, { email }) replaces an email place's link with " +
+      "a new one (the old one stops working), sent to the corrected email " +
+      "when given, and resolves to the round; offer it only where the " +
+      "place's link.can_resend is true. A manager sees each place's id, kind " +
+      "('app_user' | 'email'), email, signed_as (the name BankID verified) " +
+      "and link ({ status: 'sending' | 'sent' | 'delivery_failed' | " +
+      "'expired' | 'used' | 'cancelled', sent_at, expires_at, used_at, " +
+      "links_sent, can_resend }, null for an account place). ONE ACTION RUNS AT A " +
       "TIME: while busy is true any other action is refused at once with code " +
       "ACTION_IN_PROGRESS (it is not queued), so disable your buttons on busy. " +
       "round is the full round as the " +
@@ -1763,8 +1775,15 @@ const HOOKS = [
       "every signer's name and position and their own progress only, anyone " +
       "else sees null. A refused action sets error and rejects with it: code " +
       "and message come from the server (show message as it is), errors has " +
-      "one entry per refused signer ({ app_user_id, message, reason, " +
-      "characters }), retryAfter is the seconds to wait. The hook's own " +
+      "one entry per refused signer ({ index, app_user_id, message, reason, " +
+      "characters }; index is the entry's place in the list sent), " +
+      "retryAfter is the seconds to wait. resendLink is refused with " +
+      "SIGNING_LINK_RESEND_TOO_SOON (with retryAfter), " +
+      "SIGNING_LINK_RESEND_IN_PROGRESS, SIGNING_LINK_LIMIT_REACHED, " +
+      "SIGNING_LINK_BUDGET_EXCEEDED, SIGNING_LINK_PLATFORM_LIMIT, " +
+      "INVALID_EMAIL, DUPLICATE_SIGNER, SIGNING_ROUND_NOT_OPEN, " +
+      "SIGNING_ROUND_CLOSED or ALREADY_SIGNED, and by the hook itself with " +
+      "NOT_SUPPORTED when the host's filestore client cannot send links. The hook's own " +
       "refusals (PREVIEW_REQUIRED, ACTION_IN_PROGRESS, NO_SIGNING_ROUND) carry " +
       "a message that can be shown the same way. When a refusal means the " +
       "round is no longer what was shown (it expired, was closed, or the " +
@@ -1776,14 +1795,16 @@ const HOOKS = [
     returnShape: {
       round:
         "{ id, file_id, status: 'DRAFT' | 'OPEN' | 'COMPLETED', created_at, confirmed_at, completed_at, expires_at, " +
-        "signers: { name, position, app_user_id?, signed?, signed_at?, signed_as? }[] } | null",
+        "signers: { name, position, app_user_id?, signed?, signed_at?, signed_as?, id?, kind?: 'app_user' | 'email', email?, " +
+        "link?: { status: 'sending' | 'sent' | 'delivery_failed' | 'expired' | 'used' | 'cancelled', sent_at, expires_at, used_at, links_sent, can_resend } | null }[] } | null",
       loading: "boolean",
       error: "PermissionError | null  // { code, message, retryable, errors, retryAfter }",
       refresh: "() => Promise<void>",
-      prepare: "(signerIds: string[]) => Promise<round>  // status 'DRAFT'",
+      prepare: "(signers: (string | { app_user_id } | { name, email })[]) => Promise<round>  // status 'DRAFT'",
       preparedFile: "() => Promise<{ url, sha256, expires_at, size_bytes }>",
       confirm: "() => Promise<round>  // status 'OPEN'",
       cancel: "() => Promise<round>  // the round it ended, status 'CANCELLED'",
+      resendLink: "(signerId: string, options?: { email?: string }) => Promise<round>  // a new link for an email place",
       busy: "boolean  // an action is running; another one is refused with ACTION_IN_PROGRESS",
     },
     requiredContextSlice: ["filestore.signingRounds"],
@@ -3686,7 +3707,7 @@ const MANIFEST_SCHEMA = {
     type: "object",
     required: false,
     description:
-      "Optional. Tables the widget needs, seeded into the workspace at install time. Authors wire them into the widget's `tableRef` properties via the Properties Panel — the SDK does not auto-bind. Limits: 8 tables, 24 columns per table. RELATION columns address siblings by `targetSuffix` (any table in the same array, in any order; tables may relate to each other both ways). Tables persist across uninstalls. A `tableRef` property may also carry `sharedTable: true`, declaring that the table is the APP'S OWN — the author picks an existing table and the widget seeds nothing for it. That is the correct shape for a widget that reads data it does not own (a chart, a metric, a manager view over another widget's table). `sharedTable` exempts the property from needing a seeded table at publish (`manifest.requiredTableRefsHaveTemplate`) WITHOUT making it optional: the author must still bind one, and the host still refuses to place the widget unbound. Use it instead of dropping `required` — a widget that silently renders an empty tile is the defect it looks like a fix for. sc-7530: a table may also declare `roleGrants` — group-scoped access named SYMBOLICALLY, because a group id belongs to the workspace that installs the widget and could never travel in the manifest. Declare the audiences once at template level as `roles: [{ key, label, description? }]` (key is lowercase kebab, max 8 roles), then per table `roleGrants: [{ role, canRead?, canWrite?, canDelete? }]`. The installing workspace binds each role to one of its own user groups (or has one created) during the install consent step, so a permission model where an admin group does everything and signed-in users only read survives the trip between workspaces. Use `publicGrant` for the two id-less audiences (everyone / any signed-in user) and `roleGrants` for anything that names a group. A role nobody binds simply writes no grant — it never fails the install. sc-7557: a column may declare `encrypted: true` — its values are stored AES-256-GCM encrypted at rest under a per-workspace subkey. The widget still reads and writes PLAINTEXT (the platform encrypts on write, decrypts for end users); studio users see `🔒` instead, and the column cannot be searched, filtered or sorted on. Sample `rows` you seed for it are encrypted the same way. Not valid on `RELATION` — its value is a foreign key the backend must resolve — and publishing one is rejected. An `inheritAcl` RELATION column may add `inheritAclReadOnly: true` — rows then inherit READ access only, so members of the parent read every child and may add children, but change or delete only the rows they created (pair with `grantCreatorPermissions`). A column may declare `defaultValue`, written when a create omits it: `@currentUser` on USER, `@now` on DATE / DATETIME, or a literal of the column's own type (none on FILE, RELATION or USER_GROUP — ids belong to the installing workspace). `defaultLocked: true` on an `@currentUser` / `@now` default makes the server always stamp it and ignore any client value on create and update, so an author column cannot be forged. `immutable: true` makes a column write-once: a create sets it as usual and any value sent for it on update is ignored (not valid on a MANY_TO_MANY relation). A table may declare `presence: true` so the people who share a row see which of each other are online (useOnlineMembers); it takes effect only while the workspace records user activity, and an upgrade that declares it turns it on for the existing table. A ONE_TO_ONE / ONE_TO_MANY RELATION may declare `latestVia: \"<relation column on its target that points back>\"` (onDelete left at SET_NULL; that relation must have inheritAcl and be immutable): the server keeps it at the newest row of the target table that points back at this row. A column may declare `copyOf: { via, column }`: the server keeps it equal to `column` on the row the latest-row column `via` points at (same type, or text into text, cut to 140 characters in a STRING column; a copy of an encrypted column must be encrypted, and a copy cannot inheritAcl). Both are written only by the server, in the same write as the related row; a client value is ignored. A table may declare `constraints`, checked on every write for every client and refused as CONSTRAINT_VIOLATION: `unique` ({ columns, partitionColumns?, unlessRelated?: { relation, column } } — waived for rows whose related row has that yes/no column set), `no-overlap` ({ startColumn, endColumn, partitionColumns? }), `related-open` ({ relation, closedColumn } — no row is added, changed or removed while the related row's column is filled) and `related-index` ({ column, relation, listColumn } — the number must be a position in the related row's list). An upgrade adds a declared constraint to an existing table without judging the rows already in it.",
+      "Optional. Tables the widget needs, seeded into the workspace at install time. Authors wire them into the widget's `tableRef` properties via the Properties Panel — the SDK does not auto-bind. Limits: 100 tables, 200 columns per table, 100 sample rows per table and 20000 sample cells across the whole template (each row counts the keys it sets, and at least one, summed over every table). RELATION columns address siblings by `targetSuffix` (any table in the same array, in any order; tables may relate to each other both ways). Tables persist across uninstalls. A `tableRef` property may also carry `sharedTable: true`, declaring that the table is the APP'S OWN — the author picks an existing table and the widget seeds nothing for it. That is the correct shape for a widget that reads data it does not own (a chart, a metric, a manager view over another widget's table). `sharedTable` exempts the property from needing a seeded table at publish (`manifest.requiredTableRefsHaveTemplate`) WITHOUT making it optional: the author must still bind one, and the host still refuses to place the widget unbound. Use it instead of dropping `required` — a widget that silently renders an empty tile is the defect it looks like a fix for. sc-7530: a table may also declare `roleGrants` — group-scoped access named SYMBOLICALLY, because a group id belongs to the workspace that installs the widget and could never travel in the manifest. Declare the audiences once at template level as `roles: [{ key, label, description? }]` (key is lowercase kebab, max 32 roles), then per table `roleGrants: [{ role, canRead?, canWrite?, canDelete? }]`. The installing workspace binds each role to one of its own user groups (or has one created) during the install consent step, so a permission model where an admin group does everything and signed-in users only read survives the trip between workspaces. Use `publicGrant` for the two id-less audiences (everyone / any signed-in user) and `roleGrants` for anything that names a group. A role nobody binds simply writes no grant — it never fails the install. sc-7557: a column may declare `encrypted: true` — its values are stored AES-256-GCM encrypted at rest under a per-workspace subkey. The widget still reads and writes PLAINTEXT (the platform encrypts on write, decrypts for end users); studio users see `🔒` instead, and the column cannot be searched, filtered or sorted on. Sample `rows` you seed for it are encrypted the same way. Not valid on `RELATION` — its value is a foreign key the backend must resolve — and publishing one is rejected. An `inheritAcl` RELATION column may add `inheritAclReadOnly: true` — rows then inherit READ access only, so members of the parent read every child and may add children, but change or delete only the rows they created (pair with `grantCreatorPermissions`). A column may declare `defaultValue`, written when a create omits it: `@currentUser` on USER, `@now` on DATE / DATETIME, or a literal of the column's own type (none on FILE, RELATION or USER_GROUP — ids belong to the installing workspace). `defaultLocked: true` on an `@currentUser` / `@now` default makes the server always stamp it and ignore any client value on create and update, so an author column cannot be forged. `immutable: true` makes a column write-once: a create sets it as usual and any value sent for it on update is ignored (not valid on a MANY_TO_MANY relation). A table may declare `presence: true` so the people who share a row see which of each other are online (useOnlineMembers); it takes effect only while the workspace records user activity, and an upgrade that declares it turns it on for the existing table. A ONE_TO_ONE / ONE_TO_MANY RELATION may declare `latestVia: \"<relation column on its target that points back>\"` (onDelete left at SET_NULL; that relation must have inheritAcl and be immutable): the server keeps it at the newest row of the target table that points back at this row. A column may declare `copyOf: { via, column }`: the server keeps it equal to `column` on the row the latest-row column `via` points at (same type, or text into text, cut to 140 characters in a STRING column; a copy of an encrypted column must be encrypted, and a copy cannot inheritAcl). Both are written only by the server, in the same write as the related row; a client value is ignored. A table may declare `constraints`, checked on every write for every client and refused as CONSTRAINT_VIOLATION: `unique` ({ columns, partitionColumns?, unlessRelated?: { relation, column } } — waived for rows whose related row has that yes/no column set), `no-overlap` ({ startColumn, endColumn, partitionColumns? }), `related-open` ({ relation, closedColumn } — no row is added, changed or removed while the related row's column is filled) and `related-index` ({ column, relation, listColumn } — the number must be a position in the related row's list). An upgrade adds a declared constraint to an existing table without judging the rows already in it.",
   },
   translations: {
     type: "object",
@@ -3888,7 +3909,7 @@ const WIDGET_CONTEXT_SHAPE = {
       "{ files: { list(query) -> Promise<{ data, meta }>, get(id), upload(formData), update(id, body), copy(id, body), remove(id), preview(id) }, " +
       "folders: { list, create, update, remove }, shares: { ... }, trash: { ... }, " +
       "signatures: { list(fileIds), roster(fileId, query), initiate(fileId), status(id), cancel(id), verify(id) }, " +
-      "signingRounds: { overview(fileIds), list(fileId, query), get(roundId), prepare(fileId, signerIds), preparedFile(roundId), confirm(roundId, preparedSha256), cancel(roundId) }, " +
+      "signingRounds: { overview(fileIds), list(fileId, query), get(roundId), prepare(fileId, signers), preparedFile(roundId), confirm(roundId, preparedSha256), cancel(roundId), resendLink(roundId, signerId, { email }) }, " +
       "objectUrl(token), fetchObject(token) }. " +
       "Backs useFilestoreFiles() + useFilestoreFolders() + useFilestoreCreateFolder() + useFilestoreCopy() + useFileSignature() + useFileSignatures() + useFileRoster() + useSigningRounds() + useSigningRound(). Optional — a host without an end-user filestore omits it and those hooks throw a clear error.",
     required: false,
@@ -6086,7 +6107,13 @@ const CONTRACT = deepFreeze({
   // 1.193.0: additive (sc-11821) — `useNavigation().scrollToSection(id)`
   //    scrolls the page to one of its sections on both hosts, and the
   //    `sectionRef` propertySchema type gives the author a section picker.
-  version: "1.193.0",
+  // 1.194.0: more permissive (sc-11945) — a datastoreTemplate takes 100
+  //    tables, 200 columns, 100 rows per table, 20000 cells and 32 roles.
+  // 1.195.0: additive (sc-11879) — `useSigningRound().prepare` takes
+  //    `{ name, email }` entries for signers without an account, and
+  //    `resendLink(signerId, { email })` sends such a signer a new link.
+  //    The manager's places carry id, kind, email and link.
+  version: "1.195.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/index.d.ts

@@ -155,12 +155,15 @@ export interface WidgetInputDescriptor {
  * tenant may have authored records into them.
  *
  * The shape mirrors the built-in template registry on the backend, with
- * two limits a third-party widget must satisfy (enforced at submission
- * time by the static analyzer):
+ * limits a third-party widget must satisfy (enforced at submission time by
+ * the static analyzer):
  *
- *   - At most 8 tables per widget. Templates exist to seed schema, not
- *     to be a full database design tool.
- *   - At most 24 columns per table. Same reason.
+ *   - At most 100 tables per widget.
+ *   - At most 200 columns per table.
+ *   - At most 100 sample rows per table, and 20000 sample cells across the
+ *     whole template (each row counts the keys it sets, and at least one,
+ *     summed over every table).
+ *   - At most 32 roles.
  *
  * RELATION columns reference siblings within the same template via
  * `targetSuffix` — that suffix MUST belong to a table in the same array,
@@ -316,7 +319,9 @@ export interface WidgetDatastoreTemplateTable {
    * Optional sample rows seeded into the table at install time so the widget
    * renders with real data instead of an empty state. Each key is a column
    * `name`; only non-relation/file/user columns are seedable (RELATION, FILE,
-   * USER, USER_GROUP are rejected). `null` skips that cell. Max 25 rows.
+   * USER, USER_GROUP are rejected). `null` skips that cell. Max 100 rows, and
+   * each row counts the keys it sets, and at least one, toward the
+   * template's 20000-cell budget.
    */
   rows?: Array<
     Record<string, string | number | boolean | string[] | number[] | null>
@@ -5106,6 +5111,9 @@ export interface SigningRefusalEntry {
   field?: string;
   message: string;
   code?: string;
+  /** The entry's place in the list of signers that was sent. */
+  index?: number;
+  /** Set when the entry names an account. */
   app_user_id?: string;
   reason?: SignatureNameRefusal["reason"];
   characters?: string[];
@@ -5166,14 +5174,43 @@ export function useSigningRounds(fileIds: string[] | null | undefined): {
 export interface SigningRoundSigner {
   name: string;
   position: number;
-  /** Present for every place when the user manages the folder; otherwise for their own place only. */
-  app_user_id?: string;
+  /**
+   * Present for every place when the user manages the folder; otherwise for
+   * their own place only. Null for a place held by someone without an account.
+   */
+  app_user_id?: string | null;
   signed?: boolean;
   signed_at?: string | null;
   /** The name BankID verified on this place. Managers only. */
   signed_as?: string | null;
+  /** The place, as `resendLink` names it. Managers only. */
+  id?: string;
+  /** Who holds the place: an account, or someone signing through an emailed link. Managers only. */
+  kind?: "app_user" | "email";
+  /** An email place's address; null once the round has closed. Managers only. */
+  email?: string | null;
+  /** An email place's current link; null for an account place. Managers only. */
+  link?: SigningRoundSignerLink | null;
+}
+
+export interface SigningRoundSignerLink {
+  status: "sending" | "sent" | "delivery_failed" | "expired" | "used" | "cancelled";
+  sent_at: string | null;
+  expires_at: string | null;
+  used_at: string | null;
+  links_sent: number;
+  /** A new link may be sent now. */
+  can_resend: boolean;
 }
 
+/**
+ * One signer to prepare, in the order of the places: an account id (or
+ * `{ app_user_id }`), or someone without an account, who is emailed a
+ * personal signing link valid for 24 hours when the round is confirmed.
+ * Anyone holding that link can sign.
+ */
+export type SigningRoundSignerInput = string | { app_user_id: string } | { name: string; email: string };
+
 export interface SigningRound {
   id: string;
   file_id: string;
@@ -5216,13 +5253,25 @@ export function useSigningRound(fileId: string | null | undefined): {
   loading: boolean;
   error: SigningRoundError | null;
   refresh(): Promise<void>;
-  /** `signerIds` in the order their places appear on the signature page. Resolves to the DRAFT. */
-  prepare(signerIds: string[]): Promise<SigningRound>;
+  /** `signers` in the order their places appear on the signature page. Resolves to the DRAFT. */
+  prepare(signers: SigningRoundSignerInput[]): Promise<SigningRound>;
   preparedFile(): Promise<SigningRoundPreparedFile>;
   /** Resolves to the OPEN round. */
   confirm(): Promise<SigningRound>;
   /** Resolves to the round it ended, with status "CANCELLED". */
   cancel(): Promise<SigningRound>;
+  /**
+   * Replace an email place's link with a new one, sent to `email` when given
+   * (a corrected address). Offer it only where `link.can_resend` is true.
+   * Resolves to the round. Refusals: `SIGNING_LINK_RESEND_TOO_SOON` (with
+   * `retryAfter`), `SIGNING_LINK_RESEND_IN_PROGRESS`,
+   * `SIGNING_LINK_LIMIT_REACHED`, `SIGNING_LINK_BUDGET_EXCEEDED`,
+   * `SIGNING_LINK_PLATFORM_LIMIT`, `INVALID_EMAIL`, `DUPLICATE_SIGNER`,
+   * `SIGNING_ROUND_NOT_OPEN`, `SIGNING_ROUND_CLOSED`, `ALREADY_SIGNED`, and
+   * the hook's own `NOT_SUPPORTED` when the host's filestore client predates
+   * sending links.
+   */
+  resendLink(signerId: string, options?: { email?: string }): Promise<SigningRound>;
   /** An action is running; another one is refused with `ACTION_IN_PROGRESS`. */
   busy: boolean;
 };

package/dist/signing-hooks.js

@@ -15,11 +15,13 @@ import {
   indexOverview,
   readRefusalDetail,
   reportedRoundId,
+  resendLinkOptions,
   roundChangedUnderneath,
   signOrderStateAfterAnswer,
   signOrderStateAfterCancel,
   signOrderStateAfterInitiate,
   signedOrderState,
+  signerListForPrepare,
   uniqueFileIds,
 } from "./signing-state.js";
 
@@ -209,6 +211,10 @@ const previewRequired = () =>
 const actionInProgress = () =>
   localRefusal("ACTION_IN_PROGRESS", "Another change to this signing round is still in progress. Try again in a moment.");
 const noFile = () => localRefusal("VALIDATION", "Choose a document first.");
+const noResend = () =>
+  localRefusal("NOT_SUPPORTED", "Sending a new link is not available in this version of the app.");
+const badSignerList = () =>
+  localRefusal("VALIDATION", "Each signer needs to be a person in the app, or a name and an email address.");
 
 function signingRoundsClientOrThrow(ctx, hookName) {
   const rounds = ctx.filestore && ctx.filestore.signingRounds;
@@ -289,19 +295,24 @@ export function useSigningRounds(fileIds) {
 /**
  * One file's current signing round and the actions of whoever manages the
  * file's folder. Returns `{ round, loading, error, refresh, prepare,
- * preparedFile, confirm, cancel, busy }`.
+ * preparedFile, confirm, cancel, resendLink, busy }`.
  *
- * `prepare(signerIds)` drafts a round for those people, in the order their
- * places appear on the signature page; `preparedFile()` answers `{ url,
- * sha256, expires_at, size_bytes }` for the draft's document; `confirm()`
- * opens the round for the document that `preparedFile()` last returned, so it
- * needs no argument; `cancel()` ends a draft or an open round and resolves to
- * the cancelled round. One action runs at a time: while `busy` is true another
- * one is refused with code `ACTION_IN_PROGRESS`, never queued. A refused
- * action sets `error` and rejects with it: `code` and `message` come from the
- * server, `errors` has one entry per refused signer, `retryAfter` is the
- * seconds to wait. When the refusal means the round is no longer what was
- * shown, the round is read again.
+ * `prepare(signers)` drafts a round for those people, in the order their
+ * places appear on the signature page: each is an account id (or
+ * `{ app_user_id }`), or `{ name, email }` for someone without an account,
+ * who is emailed a 24-hour signing link once the round is confirmed;
+ * `preparedFile()` answers `{ url, sha256, expires_at, size_bytes }` for the
+ * draft's document; `confirm()` opens the round for the document that
+ * `preparedFile()` last returned, so it needs no argument; `cancel()` ends a
+ * draft or an open round and resolves to the cancelled round;
+ * `resendLink(signerId, { email })` replaces an email place's link with a new
+ * one, sent to the corrected address when given. One action runs at a time:
+ * while `busy` is true another one is refused with code `ACTION_IN_PROGRESS`,
+ * never queued. A refused action sets `error` and rejects with it: `code` and
+ * `message` come from the server, `errors` has one entry per refused signer
+ * (with `index`, its place in the list sent), `retryAfter` is the seconds to
+ * wait. When the refusal means the round is no longer what was shown, the
+ * round is read again.
  */
 export function useSigningRound(fileId) {
   const ctx = useWidgetContextOrThrow("useSigningRound");
@@ -395,10 +406,12 @@ export function useSigningRound(fileId) {
   );
 
   const prepare = useCallback(
-    (signerIds) =>
+    (signers) =>
       run(async (rounds, _round, forFile) => {
         if (!forFile) throw noFile();
-        const draft = await rounds.prepare(forFile, signerIds);
+        const list = signerListForPrepare(signers);
+        if (!list) throw badSignerList();
+        const draft = await rounds.prepare(forFile, list);
         return { value: draft, round: draft };
       }),
     [run],
@@ -438,6 +451,18 @@ export function useSigningRound(fileId) {
     [run],
   );
 
+  const resendLink = useCallback(
+    (signerId, options) =>
+      run(async (rounds, round) => {
+        if (!round) throw noRound();
+        // A filestore client older than 0.14.0 has no resendLink.
+        if (typeof rounds.resendLink !== "function") throw noResend();
+        const resent = await rounds.resendLink(round.id, signerId, resendLinkOptions(options));
+        return { value: resent, round: resent };
+      }),
+    [run],
+  );
+
   return {
     round: current.round,
     loading: Boolean(fileId) && (!current.settled || reading),
@@ -447,6 +472,7 @@ export function useSigningRound(fileId) {
     preparedFile,
     confirm,
     cancel,
+    resendLink,
     busy,
   };
 }

package/dist/signing-state.js

@@ -71,8 +71,9 @@ export function signOrderStateAfterCancel(previous, answer) {
 
 /**
  * The parts of a refusal a widget shows beside its message, as the filestore
- * client put them on its error: one entry per refused signer (`app_user_id`,
- * `message`, and for a name `reason` and `characters`), and how many seconds
+ * client put them on its error: one entry per refused signer (`index`, its
+ * place in the list that was sent, `app_user_id` for an account, `message`,
+ * and for a name `reason` and `characters`), and how many seconds
  * to wait before trying again. An error from anywhere else has neither.
  */
 export function readRefusalDetail(err) {
@@ -81,6 +82,39 @@ export function readRefusalDetail(err) {
   return { errors, retryAfter: typeof wait === "number" && Number.isFinite(wait) && wait >= 0 ? wait : null };
 }
 
+const nonEmptyString = (value) => typeof value === "string" && value.trim() !== "";
+const isObject = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+
+/** One prepare entry as the filestore client takes it, or null when it is neither form. */
+function signerForPrepare(signer) {
+  if (nonEmptyString(signer)) return signer;
+  if (!isObject(signer)) return null;
+  const keys = Object.keys(signer).sort().join(",");
+  if (keys === "app_user_id" && nonEmptyString(signer.app_user_id)) return signer.app_user_id;
+  if (keys === "email,name" && nonEmptyString(signer.name) && nonEmptyString(signer.email)) {
+    return { name: signer.name.trim(), email: signer.email.trim() };
+  }
+  return null;
+}
+
+/**
+ * The signers of a prepare, in their order, as the filestore client takes
+ * them: an account as its id (a list of ids alone keeps the request older
+ * servers read), someone without an account as `{ name, email }` trimmed.
+ * Null when an entry is neither an id, `{ app_user_id }` nor `{ name, email }`.
+ */
+export function signerListForPrepare(signers) {
+  if (!Array.isArray(signers)) return null;
+  const list = signers.map(signerForPrepare);
+  return list.includes(null) ? null : list;
+}
+
+/** The body of a new link: a corrected `email` when one is given, otherwise nothing. */
+export function resendLinkOptions(options) {
+  const email = isObject(options) && typeof options.email === "string" ? options.email.trim() : "";
+  return email ? { email } : {};
+}
+
 // The round is no longer what the widget is showing: read it again.
 const ROUND_CHANGED_CODES = new Set([
   "SIGNING_ROUND_EXPIRED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.239.0",
+  "version": "0.241.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "homepage": "https://github.com/Colix-AB/AppStudio",
   "type": "module",

package/src/contract.js

@@ -1747,15 +1747,27 @@ const HOOKS = [
     signature: "useSigningRound(fileId)",
     description:
       "One file's current signing round, and the actions of someone who " +
-      "manages the file's folder. prepare(signerIds) drafts a round for those " +
-      "users, their places on the signature page in the order given (take the " +
-      "ids from useFileRoster()); it can take " +
+      "manages the file's folder. prepare(signers) drafts a round for those " +
+      "people, their places on the signature page in the order given: each " +
+      "entry is an account id from useFileRoster() (or { app_user_id }), or " +
+      "{ name, email } for someone without an account, who is emailed a " +
+      "personal BankID signing link valid for 24 hours once the round is " +
+      "confirmed (anyone holding that link can sign, so say so before " +
+      "sending); it can take " +
       "up to a minute. preparedFile() returns a five-minute link to the " +
       "prepared document; show it to the user before confirming. confirm() " +
       "opens the round for exactly the document preparedFile() last returned, " +
       "and rejects with code PREVIEW_REQUIRED when it was not called first. " +
       "cancel() ends a draft or an open round and resolves to the cancelled " +
-      "round (status 'CANCELLED'); round is then null. ONE ACTION RUNS AT A " +
+      "round (status 'CANCELLED'); round is then null. " +
+      "resendLink(signerId, { email }) replaces an email place's link with " +
+      "a new one (the old one stops working), sent to the corrected email " +
+      "when given, and resolves to the round; offer it only where the " +
+      "place's link.can_resend is true. A manager sees each place's id, kind " +
+      "('app_user' | 'email'), email, signed_as (the name BankID verified) " +
+      "and link ({ status: 'sending' | 'sent' | 'delivery_failed' | " +
+      "'expired' | 'used' | 'cancelled', sent_at, expires_at, used_at, " +
+      "links_sent, can_resend }, null for an account place). ONE ACTION RUNS AT A " +
       "TIME: while busy is true any other action is refused at once with code " +
       "ACTION_IN_PROGRESS (it is not queued), so disable your buttons on busy. " +
       "round is the full round as the " +
@@ -1763,8 +1775,15 @@ const HOOKS = [
       "every signer's name and position and their own progress only, anyone " +
       "else sees null. A refused action sets error and rejects with it: code " +
       "and message come from the server (show message as it is), errors has " +
-      "one entry per refused signer ({ app_user_id, message, reason, " +
-      "characters }), retryAfter is the seconds to wait. The hook's own " +
+      "one entry per refused signer ({ index, app_user_id, message, reason, " +
+      "characters }; index is the entry's place in the list sent), " +
+      "retryAfter is the seconds to wait. resendLink is refused with " +
+      "SIGNING_LINK_RESEND_TOO_SOON (with retryAfter), " +
+      "SIGNING_LINK_RESEND_IN_PROGRESS, SIGNING_LINK_LIMIT_REACHED, " +
+      "SIGNING_LINK_BUDGET_EXCEEDED, SIGNING_LINK_PLATFORM_LIMIT, " +
+      "INVALID_EMAIL, DUPLICATE_SIGNER, SIGNING_ROUND_NOT_OPEN, " +
+      "SIGNING_ROUND_CLOSED or ALREADY_SIGNED, and by the hook itself with " +
+      "NOT_SUPPORTED when the host's filestore client cannot send links. The hook's own " +
       "refusals (PREVIEW_REQUIRED, ACTION_IN_PROGRESS, NO_SIGNING_ROUND) carry " +
       "a message that can be shown the same way. When a refusal means the " +
       "round is no longer what was shown (it expired, was closed, or the " +
@@ -1776,14 +1795,16 @@ const HOOKS = [
     returnShape: {
       round:
         "{ id, file_id, status: 'DRAFT' | 'OPEN' | 'COMPLETED', created_at, confirmed_at, completed_at, expires_at, " +
-        "signers: { name, position, app_user_id?, signed?, signed_at?, signed_as? }[] } | null",
+        "signers: { name, position, app_user_id?, signed?, signed_at?, signed_as?, id?, kind?: 'app_user' | 'email', email?, " +
+        "link?: { status: 'sending' | 'sent' | 'delivery_failed' | 'expired' | 'used' | 'cancelled', sent_at, expires_at, used_at, links_sent, can_resend } | null }[] } | null",
       loading: "boolean",
       error: "PermissionError | null  // { code, message, retryable, errors, retryAfter }",
       refresh: "() => Promise<void>",
-      prepare: "(signerIds: string[]) => Promise<round>  // status 'DRAFT'",
+      prepare: "(signers: (string | { app_user_id } | { name, email })[]) => Promise<round>  // status 'DRAFT'",
       preparedFile: "() => Promise<{ url, sha256, expires_at, size_bytes }>",
       confirm: "() => Promise<round>  // status 'OPEN'",
       cancel: "() => Promise<round>  // the round it ended, status 'CANCELLED'",
+      resendLink: "(signerId: string, options?: { email?: string }) => Promise<round>  // a new link for an email place",
       busy: "boolean  // an action is running; another one is refused with ACTION_IN_PROGRESS",
     },
     requiredContextSlice: ["filestore.signingRounds"],
@@ -3686,7 +3707,7 @@ const MANIFEST_SCHEMA = {
     type: "object",
     required: false,
     description:
-      "Optional. Tables the widget needs, seeded into the workspace at install time. Authors wire them into the widget's `tableRef` properties via the Properties Panel — the SDK does not auto-bind. Limits: 8 tables, 24 columns per table. RELATION columns address siblings by `targetSuffix` (any table in the same array, in any order; tables may relate to each other both ways). Tables persist across uninstalls. A `tableRef` property may also carry `sharedTable: true`, declaring that the table is the APP'S OWN — the author picks an existing table and the widget seeds nothing for it. That is the correct shape for a widget that reads data it does not own (a chart, a metric, a manager view over another widget's table). `sharedTable` exempts the property from needing a seeded table at publish (`manifest.requiredTableRefsHaveTemplate`) WITHOUT making it optional: the author must still bind one, and the host still refuses to place the widget unbound. Use it instead of dropping `required` — a widget that silently renders an empty tile is the defect it looks like a fix for. sc-7530: a table may also declare `roleGrants` — group-scoped access named SYMBOLICALLY, because a group id belongs to the workspace that installs the widget and could never travel in the manifest. Declare the audiences once at template level as `roles: [{ key, label, description? }]` (key is lowercase kebab, max 8 roles), then per table `roleGrants: [{ role, canRead?, canWrite?, canDelete? }]`. The installing workspace binds each role to one of its own user groups (or has one created) during the install consent step, so a permission model where an admin group does everything and signed-in users only read survives the trip between workspaces. Use `publicGrant` for the two id-less audiences (everyone / any signed-in user) and `roleGrants` for anything that names a group. A role nobody binds simply writes no grant — it never fails the install. sc-7557: a column may declare `encrypted: true` — its values are stored AES-256-GCM encrypted at rest under a per-workspace subkey. The widget still reads and writes PLAINTEXT (the platform encrypts on write, decrypts for end users); studio users see `🔒` instead, and the column cannot be searched, filtered or sorted on. Sample `rows` you seed for it are encrypted the same way. Not valid on `RELATION` — its value is a foreign key the backend must resolve — and publishing one is rejected. An `inheritAcl` RELATION column may add `inheritAclReadOnly: true` — rows then inherit READ access only, so members of the parent read every child and may add children, but change or delete only the rows they created (pair with `grantCreatorPermissions`). A column may declare `defaultValue`, written when a create omits it: `@currentUser` on USER, `@now` on DATE / DATETIME, or a literal of the column's own type (none on FILE, RELATION or USER_GROUP — ids belong to the installing workspace). `defaultLocked: true` on an `@currentUser` / `@now` default makes the server always stamp it and ignore any client value on create and update, so an author column cannot be forged. `immutable: true` makes a column write-once: a create sets it as usual and any value sent for it on update is ignored (not valid on a MANY_TO_MANY relation). A table may declare `presence: true` so the people who share a row see which of each other are online (useOnlineMembers); it takes effect only while the workspace records user activity, and an upgrade that declares it turns it on for the existing table. A ONE_TO_ONE / ONE_TO_MANY RELATION may declare `latestVia: \"<relation column on its target that points back>\"` (onDelete left at SET_NULL; that relation must have inheritAcl and be immutable): the server keeps it at the newest row of the target table that points back at this row. A column may declare `copyOf: { via, column }`: the server keeps it equal to `column` on the row the latest-row column `via` points at (same type, or text into text, cut to 140 characters in a STRING column; a copy of an encrypted column must be encrypted, and a copy cannot inheritAcl). Both are written only by the server, in the same write as the related row; a client value is ignored. A table may declare `constraints`, checked on every write for every client and refused as CONSTRAINT_VIOLATION: `unique` ({ columns, partitionColumns?, unlessRelated?: { relation, column } } — waived for rows whose related row has that yes/no column set), `no-overlap` ({ startColumn, endColumn, partitionColumns? }), `related-open` ({ relation, closedColumn } — no row is added, changed or removed while the related row's column is filled) and `related-index` ({ column, relation, listColumn } — the number must be a position in the related row's list). An upgrade adds a declared constraint to an existing table without judging the rows already in it.",
+      "Optional. Tables the widget needs, seeded into the workspace at install time. Authors wire them into the widget's `tableRef` properties via the Properties Panel — the SDK does not auto-bind. Limits: 100 tables, 200 columns per table, 100 sample rows per table and 20000 sample cells across the whole template (each row counts the keys it sets, and at least one, summed over every table). RELATION columns address siblings by `targetSuffix` (any table in the same array, in any order; tables may relate to each other both ways). Tables persist across uninstalls. A `tableRef` property may also carry `sharedTable: true`, declaring that the table is the APP'S OWN — the author picks an existing table and the widget seeds nothing for it. That is the correct shape for a widget that reads data it does not own (a chart, a metric, a manager view over another widget's table). `sharedTable` exempts the property from needing a seeded table at publish (`manifest.requiredTableRefsHaveTemplate`) WITHOUT making it optional: the author must still bind one, and the host still refuses to place the widget unbound. Use it instead of dropping `required` — a widget that silently renders an empty tile is the defect it looks like a fix for. sc-7530: a table may also declare `roleGrants` — group-scoped access named SYMBOLICALLY, because a group id belongs to the workspace that installs the widget and could never travel in the manifest. Declare the audiences once at template level as `roles: [{ key, label, description? }]` (key is lowercase kebab, max 32 roles), then per table `roleGrants: [{ role, canRead?, canWrite?, canDelete? }]`. The installing workspace binds each role to one of its own user groups (or has one created) during the install consent step, so a permission model where an admin group does everything and signed-in users only read survives the trip between workspaces. Use `publicGrant` for the two id-less audiences (everyone / any signed-in user) and `roleGrants` for anything that names a group. A role nobody binds simply writes no grant — it never fails the install. sc-7557: a column may declare `encrypted: true` — its values are stored AES-256-GCM encrypted at rest under a per-workspace subkey. The widget still reads and writes PLAINTEXT (the platform encrypts on write, decrypts for end users); studio users see `🔒` instead, and the column cannot be searched, filtered or sorted on. Sample `rows` you seed for it are encrypted the same way. Not valid on `RELATION` — its value is a foreign key the backend must resolve — and publishing one is rejected. An `inheritAcl` RELATION column may add `inheritAclReadOnly: true` — rows then inherit READ access only, so members of the parent read every child and may add children, but change or delete only the rows they created (pair with `grantCreatorPermissions`). A column may declare `defaultValue`, written when a create omits it: `@currentUser` on USER, `@now` on DATE / DATETIME, or a literal of the column's own type (none on FILE, RELATION or USER_GROUP — ids belong to the installing workspace). `defaultLocked: true` on an `@currentUser` / `@now` default makes the server always stamp it and ignore any client value on create and update, so an author column cannot be forged. `immutable: true` makes a column write-once: a create sets it as usual and any value sent for it on update is ignored (not valid on a MANY_TO_MANY relation). A table may declare `presence: true` so the people who share a row see which of each other are online (useOnlineMembers); it takes effect only while the workspace records user activity, and an upgrade that declares it turns it on for the existing table. A ONE_TO_ONE / ONE_TO_MANY RELATION may declare `latestVia: \"<relation column on its target that points back>\"` (onDelete left at SET_NULL; that relation must have inheritAcl and be immutable): the server keeps it at the newest row of the target table that points back at this row. A column may declare `copyOf: { via, column }`: the server keeps it equal to `column` on the row the latest-row column `via` points at (same type, or text into text, cut to 140 characters in a STRING column; a copy of an encrypted column must be encrypted, and a copy cannot inheritAcl). Both are written only by the server, in the same write as the related row; a client value is ignored. A table may declare `constraints`, checked on every write for every client and refused as CONSTRAINT_VIOLATION: `unique` ({ columns, partitionColumns?, unlessRelated?: { relation, column } } — waived for rows whose related row has that yes/no column set), `no-overlap` ({ startColumn, endColumn, partitionColumns? }), `related-open` ({ relation, closedColumn } — no row is added, changed or removed while the related row's column is filled) and `related-index` ({ column, relation, listColumn } — the number must be a position in the related row's list). An upgrade adds a declared constraint to an existing table without judging the rows already in it.",
   },
   translations: {
     type: "object",
@@ -3888,7 +3909,7 @@ const WIDGET_CONTEXT_SHAPE = {
       "{ files: { list(query) -> Promise<{ data, meta }>, get(id), upload(formData), update(id, body), copy(id, body), remove(id), preview(id) }, " +
       "folders: { list, create, update, remove }, shares: { ... }, trash: { ... }, " +
       "signatures: { list(fileIds), roster(fileId, query), initiate(fileId), status(id), cancel(id), verify(id) }, " +
-      "signingRounds: { overview(fileIds), list(fileId, query), get(roundId), prepare(fileId, signerIds), preparedFile(roundId), confirm(roundId, preparedSha256), cancel(roundId) }, " +
+      "signingRounds: { overview(fileIds), list(fileId, query), get(roundId), prepare(fileId, signers), preparedFile(roundId), confirm(roundId, preparedSha256), cancel(roundId), resendLink(roundId, signerId, { email }) }, " +
       "objectUrl(token), fetchObject(token) }. " +
       "Backs useFilestoreFiles() + useFilestoreFolders() + useFilestoreCreateFolder() + useFilestoreCopy() + useFileSignature() + useFileSignatures() + useFileRoster() + useSigningRounds() + useSigningRound(). Optional — a host without an end-user filestore omits it and those hooks throw a clear error.",
     required: false,
@@ -6086,7 +6107,13 @@ const CONTRACT = deepFreeze({
   // 1.193.0: additive (sc-11821) — `useNavigation().scrollToSection(id)`
   //    scrolls the page to one of its sections on both hosts, and the
   //    `sectionRef` propertySchema type gives the author a section picker.
-  version: "1.193.0",
+  // 1.194.0: more permissive (sc-11945) — a datastoreTemplate takes 100
+  //    tables, 200 columns, 100 rows per table, 20000 cells and 32 roles.
+  // 1.195.0: additive (sc-11879) — `useSigningRound().prepare` takes
+  //    `{ name, email }` entries for signers without an account, and
+  //    `resendLink(signerId, { email })` sends such a signer a new link.
+  //    The manager's places carry id, kind, email and link.
+  version: "1.195.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,