@colixsystems/widget-sdk 0.258.0 → 0.260.0

package/README.md

@@ -85,7 +85,15 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.258.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.260.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.260.0 (contract 1.211.0)
+
+**Text on a phone grows with the device's text-size setting only up to 1.3×** (`CONTRACT.maxFontSizeMultiplier`). React Native multiplies every font size by that setting and a browser has no equivalent, so the Player and the Builder canvas always show 1×; unbounded, a heading that fits there overflowed on a phone set to a large text size. The native `<Text>` and `<TextInput>` (and every SDK component built on them) now carry the bound, so accessibility scaling still works but a layout only has to survive 1.3×. Pass your own `maxFontSizeMultiplier` to change it for one element.
+
+### What's new in 0.259.0 (contract 1.210.0)
+
+**`<Avatar url>` falls back to the initials** when its picture fails to load, instead of showing a broken image (as `<Avatar fileId>` already did). The built-in form fields for users, groups and related records now use `<PeoplePicker>`, and the User widget's photo uses `<Avatar>`.
 
 ### What's new in 0.258.0 (contract 1.209.0)
 

package/dist/accordion.native.js

@@ -1,7 +1,8 @@
 // `<Accordion>` / `<AccordionItem>` (native). Binds ./accordion-view.js to
 // React Native's own primitives; only the import differs from ./accordion.js.
 
-import { View, Text, Pressable } from "react-native";
+import { View, Pressable } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeAccordion } from "./accordion-view.js";
 
 export const { Accordion, AccordionItem } = makeAccordion({ View, Text, Pressable });

package/dist/banner.native.js

@@ -1,7 +1,8 @@
 // `<Banner>` (native). Binds ./banner-view.js to React Native's own
 // primitives; only the import differs from ./banner.js.
 
-import { View, Text, Pressable } from "react-native";
+import { View, Pressable } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeBanner } from "./banner-view.js";
 
 export const Banner = makeBanner({ View, Text, Pressable });

package/dist/bounded-text.native.js

@@ -0,0 +1,29 @@
+// sc-9168 — native Text / TextInput, bounded to the contract's font-scale cap.
+//
+// React Native multiplies every font size by the device's font-scale setting;
+// a browser has no equivalent (page zoom scales the whole layout, so nothing
+// overflows), which is why this file has no web twin and the Player and the
+// Builder canvas render at scale 1.0. Unbounded, a layout that fits there
+// overflows on a phone set to a large text size. The cap keeps accessibility
+// scaling working up to that bound; a caller's own prop still wins.
+//
+// Every SDK native module takes Text / TextInput from here, never from
+// `react-native` directly — bounded-text-native.test.js enforces it.
+import React from "react";
+import { Text as RNText, TextInput as RNTextInput } from "react-native";
+import { CONTRACT } from "./contract.js";
+
+function bounded(Component, displayName) {
+  const Bounded = React.forwardRef(function BoundedText(props, ref) {
+    return React.createElement(Component, {
+      maxFontSizeMultiplier: CONTRACT.maxFontSizeMultiplier,
+      ...props,
+      ref,
+    });
+  });
+  Bounded.displayName = displayName;
+  return Bounded;
+}
+
+export const Text = bounded(RNText, "Text");
+export const TextInput = bounded(RNTextInput, "TextInput");

package/dist/button.native.js

@@ -2,7 +2,8 @@
 // Native, the expo-linear-gradient `<Gradient>` and the native `<Spinner>`;
 // only the imports differ from ./button.js.
 
-import { View, Text, Pressable, StyleSheet, Platform } from "react-native";
+import { View, Pressable, StyleSheet, Platform } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { Gradient } from "./gradient.native.js";
 import { Spinner } from "./loading.native.js";
 import { makeButton, BUTTON_VARIANTS } from "./button-view.js";

package/dist/chart.native.js

@@ -1,7 +1,8 @@
 // `<Chart>` (native). Binds ./chart-view.js to React Native and
 // react-native-svg; only the imports differ from ./chart.js.
 
-import { View, Text } from "react-native";
+import { View } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import Svg, { G, Path, Line, Circle, Text as SvgText } from "react-native-svg";
 import { Skeleton } from "./loading.native.js";
 import { EmptyState } from "./list.native.js";

package/dist/checkbox.native.js

@@ -1,7 +1,8 @@
 // `<Checkbox>` (native). Binds ./checkbox-view.js to React Native's own
 // primitives; only the import differs from ./checkbox.js.
 
-import { View, Text, Pressable } from "react-native";
+import { View, Pressable } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeCheckbox } from "./checkbox-view.js";
 
 export const Checkbox = makeCheckbox({ View, Text, Pressable });

package/dist/chip.native.js

@@ -1,7 +1,8 @@
 // `<Chip>` / `<ChipGroup>` (native). Binds ./chip-view.js to React Native's own
 // primitives; only the import differs from ./chip.js.
 
-import { View, Text, Pressable } from "react-native";
+import { View, Pressable } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeChip } from "./chip-view.js";
 
 export const { Chip, ChipGroup } = makeChip({ View, Text, Pressable });

package/dist/confirm-dialog.native.js

@@ -1,8 +1,8 @@
-// `<ConfirmDialog>` (native). Binds ./confirm-dialog-view.js to React Native's
-// own primitives and the native `<Modal>`, `<Button>` and `<Spinner>`; only the
+// `<ConfirmDialog>` (native). Binds ./confirm-dialog-view.js to the bounded
+// native Text and the native `<Modal>`, `<Button>` and `<Spinner>`; only the
 // imports differ from ./confirm-dialog.js.
 
-import { Text } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeConfirmDialog } from "./confirm-dialog-view.js";
 import { Modal } from "./modal.native.js";
 import { Button } from "./button.native.js";

package/dist/contract.cjs

@@ -1,12 +1,10 @@
-// CommonJS-flavoured copy of the contract data so backend services (CJS
-// runtime) can `require()` it directly without dynamic import gymnastics.
-//
-// The ESM `contract.js` re-exports the SAME object as the `CONTRACT` named
-// export. The contract test asserts the two are identical (deep-equal) so
-// drift between this file and the ESM source-of-truth is caught in CI.
-//
-// Keep edits in lockstep between `contract.cjs` and `contract.js`. The
-// SDK build script copies both into `dist/`.
+// GENERATED from contract.js by scripts/contract-cjs.js — DO NOT EDIT.
+// Change contract.js, then run `npm run generate:contract` in packages/widget-sdk.
+
+// The widget SDK contract: the ONE source the linter, the AI agents, the
+// compiler and both hosts read. `contract.cjs` is GENERATED from `contract.js`
+// (`npm run generate:contract`) for CommonJS consumers — never edit it by hand;
+// contract-cjs-generated.test.js fails when it is stale.
 
 // REQ-AI-AGENT-DESIGN (sc-3696): the ONE cross-platform elevation vocabulary.
 // `shadow*` applies on iOS + react-native-web, `elevation` drives Android.
@@ -2645,7 +2643,7 @@ const HOOKS = [
     scopes: ["users.write:*"],
   },
   // REQ-BANKID-AUTH — link / unlink a BankID identity to the signed-in
-  // app-user. Self-service + JWT-gated (no widget scope). Mirror of contract.js.
+  // app-user. Self-service + JWT-gated (no widget scope).
   {
     name: "useBankIdLink",
     signature: "useBankIdLink()",
@@ -2681,7 +2679,7 @@ const HOOKS = [
     scopes: null,
   },
   // REQ-IDENT (sc-4313) — identify a visitor who is NOT signed in and keep the
-  // result. Anonymous by design (no widget scope, no session). Mirror of contract.js.
+  // result. Anonymous by design (no widget scope, no session).
   {
     name: "useIdentification",
     signature: "useIdentification(options)",
@@ -2732,7 +2730,7 @@ const HOOKS = [
     scopes: null,
   },
   // REQ-ACL-06 / REQ-ACL-RELINHERIT-05 — per-record VirtualPermission
-  // management for a single record. Mirror of contract.js.
+  // management for a single record.
   {
     name: "useRecordPermissions",
     signature: "useRecordPermissions(tableId, recordId)",
@@ -2865,7 +2863,7 @@ const HOOKS = [
     requiredContextSlice: ["datastore.records"],
     scopes: ["datastore.read:<table>"],
   },
-  // REQ-WSDK-PLATFORM §6 — Tier A SDK hooks. Mirror of contract.js.
+  // REQ-WSDK-PLATFORM §6 — Tier A SDK hooks.
   {
     name: "useClipboard",
     signature: "useClipboard()",
@@ -4217,14 +4215,14 @@ const WIDGET_CONTEXT_SHAPE = {
     required: true,
     fields: { requestPayment: "function", getPayment: "function" },
   },
-  // sc-890 — backs useSendNotification(). Mirror of contract.js.
+  // sc-890 — backs useSendNotification().
   notifications: {
     description:
       "Injected @colixsystems/notifications-client instance (sc-890). { send(body) -> Promise<notification>, mutes: { get, set, clear } }. send backs useSendNotification(); requires the notifications.send:appUser scope. The host POSTs the body snake_case verbatim ({ recipient_user_id, title, body, link?, payload? }) to /notifications/send and returns the created notification row; the call is imperative (a send never fires on mount). mutes backs useRecordMute() and useRecordMutes() (sc-10268): get({ table_id, record_id }) / set({ table_id, record_id, muted_until }) -> { muted, muted_until }, clear({ table_id, record_id }) -> undefined, list({ table_id, limit?, offset? }) -> { data: [{ record_id, muted_until }], meta }. mutes is optional — a host without it (the Builder canvas preview) leaves useRecordMute() reading not muted.",
     required: true,
     fields: { send: "function", mutes: "object" },
   },
-  // REQ-IDENT (sc-4313) — backs useIdentification(). Mirror of contract.js.
+  // REQ-IDENT (sc-4313) — backs useIdentification().
   identification: {
     description:
       "Injected @colixsystems/identification-client instance (REQ-IDENT). { available() -> Promise<{ available, providers }>, start(body) -> Promise<order>, get(id) -> Promise<state>, cancel(id) -> Promise<state> }. Backs useIdentification(); no widget scope and no signed-in user required — identifying a NOT-signed-in visitor is the point, so the endpoints are anonymous. Bodies and rows are snake_case verbatim. A completed identification exposes name + personal_number_masked + a stable subject_hash; the RAW personal number is never reachable from a widget (it lives behind a studio-admin endpoint).",
@@ -4265,7 +4263,7 @@ const WIDGET_CONTEXT_SHAPE = {
       error: "function",
     },
   },
-  // REQ-WSDK-PLATFORM §6 — backs useToast(). Mirror of contract.js.
+  // REQ-WSDK-PLATFORM §6 — backs useToast().
   toast: {
     description:
       "Optional host toast slot. { showToast({ kind, message }): void }. " +
@@ -4709,7 +4707,7 @@ const VETTED_IMPORTS = [
 // `allowedBareImports` (so the loader's shim⊆vetted guard treats them as
 // vetted) WITHOUT bloating the rich `VETTED_IMPORTS` reference the AI prompt /
 // Developer guide enumerate — the SAME treatment `react/jsx-runtime` gets, but
-// kept out of the author-facing list. Mirror of contract.js.
+// kept out of the author-facing list.
 const CORE_INFRA_BARE_IMPORTS = ["react-dom", "react-dom/client"];
 
 // Back-compat shape — every existing consumer (widgetLoader, the static
@@ -6377,7 +6375,11 @@ const CONTRACT = deepFreeze({
   // 1.209.0: additive (sc-12242) — `<PeoplePicker>` takes `activeOnly`
   //    (users), a function `loadErrorText(error)`, and gives each option a
   //    `<testID>-option-<id>`.
-  version: "1.209.0",
+  // 1.210.0: behaviour (sc-12245) — `<Avatar url>` falls back to the
+  //    initials when its picture fails to load. No API change.
+  // 1.211.0: additive (sc-9168) — `maxFontSizeMultiplier`: native `<Text>` /
+  //    `<TextInput>` follow the device font scale up to this bound.
+  version: "1.211.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -6406,6 +6408,10 @@ const CONTRACT = deepFreeze({
   bundleExportContract: BUNDLE_EXPORT_CONTRACT,
   // sc-10829 — the hook a `badgeCounter: true` entry exports by name.
   badgeCounterExport: "useBadgeCount",
+  // sc-9168 — the most native text grows with the device font-scale setting.
+  // Above it a layout sized against the Player overflows; the browser has no
+  // such setting to preview it with.
+  maxFontSizeMultiplier: 1.3,
   bannedApis: BANNED_APIS,
   vettedImports: VETTED_IMPORTS,
   allowedBareImports: ALLOWED_BARE_IMPORTS,

package/dist/contract.js

@@ -1,12 +1,7 @@
-// ESM mirror of contract.cjs. Generated from contract.cjs — keep both in lockstep.
-// runtime) can `require()` it directly without dynamic import gymnastics.
-//
-// The ESM `contract.js` re-exports the SAME object as the `CONTRACT` named
-// export. The contract test asserts the two are identical (deep-equal) so
-// drift between this file and the ESM source-of-truth is caught in CI.
-//
-// Keep edits in lockstep between `contract.cjs` and `contract.js`. The
-// SDK build script copies both into `dist/`.
+// The widget SDK contract: the ONE source the linter, the AI agents, the
+// compiler and both hosts read. `contract.cjs` is GENERATED from `contract.js`
+// (`npm run generate:contract`) for CommonJS consumers — never edit it by hand;
+// contract-cjs-generated.test.js fails when it is stale.
 
 // REQ-AI-AGENT-DESIGN (sc-3696): the ONE cross-platform elevation vocabulary.
 // `shadow*` applies on iOS + react-native-web, `elevation` drives Android.
@@ -2645,7 +2640,7 @@ const HOOKS = [
     scopes: ["users.write:*"],
   },
   // REQ-BANKID-AUTH — link / unlink a BankID identity to the signed-in
-  // app-user. Self-service + JWT-gated (no widget scope). Mirror of contract.cjs.
+  // app-user. Self-service + JWT-gated (no widget scope).
   {
     name: "useBankIdLink",
     signature: "useBankIdLink()",
@@ -2681,7 +2676,7 @@ const HOOKS = [
     scopes: null,
   },
   // REQ-IDENT (sc-4313) — identify a visitor who is NOT signed in and keep the
-  // result. Anonymous by design (no widget scope, no session). Mirror of contract.cjs.
+  // result. Anonymous by design (no widget scope, no session).
   {
     name: "useIdentification",
     signature: "useIdentification(options)",
@@ -2732,7 +2727,7 @@ const HOOKS = [
     scopes: null,
   },
   // REQ-ACL-06 / REQ-ACL-RELINHERIT-05 — per-record VirtualPermission
-  // management for a single record. Mirror of contract.js.
+  // management for a single record.
   {
     name: "useRecordPermissions",
     signature: "useRecordPermissions(tableId, recordId)",
@@ -2865,7 +2860,7 @@ const HOOKS = [
     requiredContextSlice: ["datastore.records"],
     scopes: ["datastore.read:<table>"],
   },
-  // REQ-WSDK-PLATFORM §6 — Tier A SDK hooks. Mirror of contract.js.
+  // REQ-WSDK-PLATFORM §6 — Tier A SDK hooks.
   {
     name: "useClipboard",
     signature: "useClipboard()",
@@ -3701,6 +3696,10 @@ const ACTION_TRIGGER_TYPES = [
 // Globals the action script runs against (the runner's surface) — distinct
 // from the React/SDK widget surface, so the component import/banned-API
 // linter does NOT scan action scripts.
+// sc-7877 deliberately does NOT add `directory` here. That global is
+// reachable only by a MARKETPLACE action whose install consented to a
+// `directory:` scope; a widget-declared action has no install, so
+// resolveForActionRow grants it nothing and the global is never defined.
 const ACTION_SCRIPT_GLOBALS = [
   "datastore",
   "secrets",
@@ -4213,14 +4212,14 @@ const WIDGET_CONTEXT_SHAPE = {
     required: true,
     fields: { requestPayment: "function", getPayment: "function" },
   },
-  // sc-890 — backs useSendNotification(). Mirror of contract.cjs.
+  // sc-890 — backs useSendNotification().
   notifications: {
     description:
       "Injected @colixsystems/notifications-client instance (sc-890). { send(body) -> Promise<notification>, mutes: { get, set, clear } }. send backs useSendNotification(); requires the notifications.send:appUser scope. The host POSTs the body snake_case verbatim ({ recipient_user_id, title, body, link?, payload? }) to /notifications/send and returns the created notification row; the call is imperative (a send never fires on mount). mutes backs useRecordMute() and useRecordMutes() (sc-10268): get({ table_id, record_id }) / set({ table_id, record_id, muted_until }) -> { muted, muted_until }, clear({ table_id, record_id }) -> undefined, list({ table_id, limit?, offset? }) -> { data: [{ record_id, muted_until }], meta }. mutes is optional — a host without it (the Builder canvas preview) leaves useRecordMute() reading not muted.",
     required: true,
     fields: { send: "function", mutes: "object" },
   },
-  // REQ-IDENT (sc-4313) — backs useIdentification(). Mirror of contract.cjs.
+  // REQ-IDENT (sc-4313) — backs useIdentification().
   identification: {
     description:
       "Injected @colixsystems/identification-client instance (REQ-IDENT). { available() -> Promise<{ available, providers }>, start(body) -> Promise<order>, get(id) -> Promise<state>, cancel(id) -> Promise<state> }. Backs useIdentification(); no widget scope and no signed-in user required — identifying a NOT-signed-in visitor is the point, so the endpoints are anonymous. Bodies and rows are snake_case verbatim. A completed identification exposes name + personal_number_masked + a stable subject_hash; the RAW personal number is never reachable from a widget (it lives behind a studio-admin endpoint).",
@@ -4261,7 +4260,7 @@ const WIDGET_CONTEXT_SHAPE = {
       error: "function",
     },
   },
-  // REQ-WSDK-PLATFORM §6 — backs useToast(). Mirror of contract.js.
+  // REQ-WSDK-PLATFORM §6 — backs useToast().
   toast: {
     description:
       "Optional host toast slot. { showToast({ kind, message }): void }. " +
@@ -4705,7 +4704,7 @@ const VETTED_IMPORTS = [
 // `allowedBareImports` (so the loader's shim⊆vetted guard treats them as
 // vetted) WITHOUT bloating the rich `VETTED_IMPORTS` reference the AI prompt /
 // Developer guide enumerate — the SAME treatment `react/jsx-runtime` gets, but
-// kept out of the author-facing list. Mirror of contract.cjs.
+// kept out of the author-facing list.
 const CORE_INFRA_BARE_IMPORTS = ["react-dom", "react-dom/client"];
 
 // Back-compat shape — every existing consumer (widgetLoader, the static
@@ -6373,7 +6372,11 @@ const CONTRACT = deepFreeze({
   // 1.209.0: additive (sc-12242) — `<PeoplePicker>` takes `activeOnly`
   //    (users), a function `loadErrorText(error)`, and gives each option a
   //    `<testID>-option-<id>`.
-  version: "1.209.0",
+  // 1.210.0: behaviour (sc-12245) — `<Avatar url>` falls back to the
+  //    initials when its picture fails to load. No API change.
+  // 1.211.0: additive (sc-9168) — `maxFontSizeMultiplier`: native `<Text>` /
+  //    `<TextInput>` follow the device font scale up to this bound.
+  version: "1.211.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -6402,6 +6405,10 @@ const CONTRACT = deepFreeze({
   bundleExportContract: BUNDLE_EXPORT_CONTRACT,
   // sc-10829 — the hook a `badgeCounter: true` entry exports by name.
   badgeCounterExport: "useBadgeCount",
+  // sc-9168 — the most native text grows with the device font-scale setting.
+  // Above it a layout sized against the Player overflows; the browser has no
+  // such setting to preview it with.
+  maxFontSizeMultiplier: 1.3,
   bannedApis: BANNED_APIS,
   vettedImports: VETTED_IMPORTS,
   allowedBareImports: ALLOWED_BARE_IMPORTS,

package/dist/data-table.native.js

@@ -1,7 +1,8 @@
 // `<DataTable>` (native). Binds ./data-table-view.js to React Native's own
 // primitives and the native parts; only the imports differ from ./data-table.js.
 
-import { View, Text, Pressable, ScrollView, Platform, AccessibilityInfo } from "react-native";
+import { View, Pressable, ScrollView, Platform, AccessibilityInfo } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { List, ListRow, ListHeader, EmptyState } from "./list.native.js";
 import { Skeleton } from "./loading.native.js";
 import { Menu } from "./popover.native.js";

package/dist/datetimepicker.native.js

@@ -6,7 +6,8 @@
 import React from "react";
 // eslint-disable-next-line no-restricted-syntax
 import RNDateTimePicker from "@react-native-community/datetimepicker";
-import { View, Text, Pressable, Platform } from "react-native";
+import { View, Pressable, Platform } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeDateTimePicker } from "./datetimepicker-view.js";
 import { nowParts, partsToDate, valueToParts } from "./datetimepicker-format.js";
 import { clampToBounds } from "./datetimepicker-calendar.js";

package/dist/detail-parts-view.js

@@ -111,6 +111,13 @@ export function makeDetailParts(rn) {
     );
   }
 
+  // A photo that cannot load gives way to the initials.
+  function UrlAvatar({ photo, monogram }) {
+    const [failed, setFailed] = React.useState(false);
+    if (failed) return monogram;
+    return h(Image, { ...photo, onError: () => setFailed(true) });
+  }
+
   function Avatar({ name, url, fileId, seed, size = "md", shape = "circle", accessibilityLabel, style, testID }) {
     const { colors, radii, typography } = useDetailTheme();
     const px = avatarPixelSize(size);
@@ -127,15 +134,6 @@ export function makeDetailParts(rn) {
     const stored = typeof fileId === "string" && fileId !== "";
     const source = typeof url === "string" ? url.trim() : "";
     const label = accessibilityLabel || captionText(name) || "Avatar";
-    if (source && !stored) {
-      return h(Image, {
-        source: { uri: source },
-        accessibilityLabel: label,
-        resizeMode: "cover",
-        style: [box, style],
-        testID,
-      });
-    }
     const initials = initialsFor(name);
     const fallback = { alignItems: "center", justifyContent: "center" };
     const content = initials
@@ -152,11 +150,16 @@ export function makeDetailParts(rn) {
           initials,
         )
       : h(Icon, { name: "user", size: Math.round(px * 0.55), color: ink });
+    const monogram = h(View, { style: [box, fallback, style], accessibilityLabel: label, testID }, content);
+    if (source && !stored) {
+      const photo = { source: { uri: source }, accessibilityLabel: label, resizeMode: "cover", style: [box, style], testID };
+      return h(UrlAvatar, { key: source, photo, monogram });
+    }
     if (stored) {
       const frame = { style: [box, fallback, { overflow: "hidden" }, style], accessibilityLabel: label, testID };
       return h(FileAvatar, { key: fileId, fileId, px, frame, monogram: content });
     }
-    return h(View, { style: [box, fallback, style], accessibilityLabel: label, testID }, content);
+    return monogram;
   }
   Avatar.displayName = "Avatar";
 

package/dist/detail-parts.native.js

@@ -2,7 +2,8 @@
 // ./detail-parts-view.js to React Native; only the imports differ from
 // ./detail-parts.js.
 
-import { View, Text, Image } from "react-native";
+import { View, Image } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import Svg, { Circle } from "react-native-svg";
 import { makeDetailParts } from "./detail-parts-view.js";
 

package/dist/emoji-picker.native.js

@@ -2,7 +2,8 @@
 // ./emoji-picker-view.js to React Native's own primitives plus the native
 // `<Overlay>`. Only the imports differ from the web mirror (./emoji-picker.js).
 
-import { View, Text, Pressable, ScrollView, TextInput } from "react-native";
+import { View, Pressable, ScrollView } from "react-native";
+import { Text, TextInput } from "./bounded-text.native.js";
 import { makeEmojiPicker } from "./emoji-picker-view.js";
 import { Overlay } from "./overlay.native.js";
 

package/dist/file-upload.native.js

@@ -2,7 +2,8 @@
 // native `<FilePicker>` (the OS document picker). No drop target: React Native
 // has no events for files dragged onto an app, so the button is the control.
 
-import { View, Text, Pressable, Platform } from "react-native";
+import { View, Pressable, Platform } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeFileUpload } from "./file-upload-view.js";
 import { FilePicker } from "./filepicker.native.js";
 import { Button } from "./button.native.js";

package/dist/form.native.js

@@ -2,7 +2,8 @@
 // (native). Binds ./form-view.js to React Native's own primitives and the
 // native `<Grid>`; only the imports differ from ./form.js.
 
-import { View, Text, Pressable, Platform } from "react-native";
+import { View, Pressable, Platform } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeForm } from "./form-view.js";
 import { Grid } from "./grid.native.js";
 

package/dist/index.d.ts

@@ -4151,7 +4151,7 @@ export const Avatar: (props: {
   name?: string;
   /** A stable id (a user id): tints the monogram with that person's colour. */
   seed?: string;
-  /** An absolute image URL. */
+  /** An absolute image URL; the initials show if it cannot load. */
   url?: string;
   /**
    * A filestore file id (a FILE column's value). Takes precedence over `url`;
@@ -5868,6 +5868,8 @@ export interface AiWidgetContract {
   readonly bundleExportContract: ReadonlyArray<ContractBundleShape>;
   /** sc-10829 — the export name of a `badgeCounter: true` entry's hook. */
   readonly badgeCounterExport: "useBadgeCount";
+  /** The most native Text / TextInput grow with the device font-scale setting. */
+  readonly maxFontSizeMultiplier: number;
   readonly bannedApis: ReadonlyArray<ContractBannedApi>;
   readonly allowedBareImports: ReadonlyArray<string>;
   /** Bare specifiers the web host provides by exact name; a widget bundle never inlines them. */

package/dist/linter.cjs

@@ -4,7 +4,7 @@
 // The ESM `linter.js` is the source-of-truth. This file MUST mirror its
 // rule set byte-for-byte — the contract test in packages/widget-sdk
 // asserts the two are behaviour-equivalent. When you edit one, edit the
-// other in the same PR. (Pattern matches `contract.cjs` / `contract.js`.)
+// other in the same PR.
 //
 // The SDK build script copies both into `dist/`.
 

package/dist/list.native.js

@@ -1,7 +1,8 @@
 // `<List>`, `<ListRow>`, `<ListHeader>`, `<EmptyState>` (native). Binds
 // ./list-view.js to React Native's own primitives; only the imports differ from ./list.js.
 
-import { View, Text, Pressable } from "react-native";
+import { View, Pressable } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { Card } from "./card.native.js";
 import { makeList } from "./list-view.js";
 

package/dist/loading.native.js

@@ -1,7 +1,8 @@
 // `<Spinner>` and `<Skeleton>` (native). Binds ./loading-view.js to React
 // Native's own primitives; only the import differs from ./loading.js.
 
-import { View, Text, Animated, Easing, AccessibilityInfo } from "react-native";
+import { View, Animated, Easing, AccessibilityInfo } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeLoading } from "./loading-view.js";
 
 export const { Spinner, Skeleton } = makeLoading(

package/dist/markdown-input.native.js

@@ -2,7 +2,8 @@
 // ./markdown-input-view.js to React Native's own primitives and the native
 // `<RichText>`. Only the imports differ from the web mirror.
 
-import { Text, View, Pressable, TextInput, ScrollView } from "react-native";
+import { View, Pressable, ScrollView } from "react-native";
+import { Text, TextInput } from "./bounded-text.native.js";
 import { makeMarkdownInput } from "./markdown-input-view.js";
 import { RichText } from "./richtext.native.js";
 import { Modal } from "./modal.native.js";

package/dist/modal.native.js

@@ -6,12 +6,12 @@
 import React from "react";
 import {
   View,
-  Text,
   Pressable,
   ScrollView,
   KeyboardAvoidingView,
   Platform,
 } from "react-native";
+import { Text } from "./bounded-text.native.js";
 // Host-provided: the exported app pins it and mounts its provider at the root.
 import { SafeAreaInsetsContext } from "react-native-safe-area-context";
 import { makeModal } from "./modal-view.js";

package/dist/popover.native.js

@@ -3,7 +3,8 @@
 // differ from ./popover.js, plus the safe-area inset a bottom sheet pads by.
 
 import React from "react";
-import { View, Text, Pressable, ScrollView, Platform, useWindowDimensions } from "react-native";
+import { View, Pressable, ScrollView, Platform, useWindowDimensions } from "react-native";
+import { Text } from "./bounded-text.native.js";
 // Host-provided: the exported app pins it and mounts its provider at the root.
 import { SafeAreaInsetsContext } from "react-native-safe-area-context";
 import { makePopover } from "./popover-view.js";

package/dist/primitives.native.js

@@ -7,12 +7,10 @@
 // `./primitives.js`.
 
 export {
-  Text,
   View,
   Pressable,
   Image,
   ScrollView,
-  TextInput,
   FlatList,
   SectionList,
   ActivityIndicator,
@@ -20,6 +18,8 @@ export {
   StyleSheet,
   Linking,
 } from "react-native";
+// sc-9168 — bounded to the device font-scale cap; no web twin (no such setting).
+export { Text, TextInput } from "./bounded-text.native.js";
 
 // REQ-WSDK-PLATFORM §6 — `<Icon>` is implemented in one file that runs on
 // both platforms (lucide-react-native ships a working build for both).

package/dist/radio-group.native.js

@@ -1,7 +1,8 @@
 // `<RadioGroup>` (native). Binds ./radio-group-view.js to React Native's own
 // primitives; only the import differs from ./radio-group.js.
 
-import { View, Text, Pressable, Platform } from "react-native";
+import { View, Pressable, Platform } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeRadioGroup } from "./radio-group-view.js";
 
 export const RadioGroup = makeRadioGroup({ View, Text, Pressable, Platform });

package/dist/richtext.native.js

@@ -2,7 +2,8 @@
 // ./richtext-view.js to React Native's own primitives. Only the import differs
 // from the web mirror in ./richtext.js.
 
-import { Text, View, Image } from "react-native";
+import { View, Image } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeRichText } from "./richtext-view.js";
 
 export const RichText = makeRichText({ Text, View, Image });

package/dist/search-field.native.js

@@ -2,7 +2,8 @@
 // primitives and the native `<TextField>`; only the imports differ from
 // ./search-field.js.
 
-import { View, Text, Pressable } from "react-native";
+import { View, Pressable } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeSearchField } from "./search-field-view.js";
 import { TextField } from "./text-field.native.js";
 

package/dist/select.native.js

@@ -2,7 +2,8 @@
 // primitives and the native `<Overlay>`, `<Button>`, `<Chip>`,
 // `<SearchField>` and `<Spinner>`; only the imports differ from ./select.js.
 
-import { View, Text, Pressable, ScrollView, Platform } from "react-native";
+import { View, Pressable, ScrollView, Platform } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeSelect } from "./select-view.js";
 import { Overlay } from "./overlay.native.js";
 import { Button } from "./button.native.js";

package/dist/sortable.native.js

@@ -2,7 +2,8 @@
 // Native's own primitives; only the imports and the handle style differ from
 // ./sortable.js.
 
-import { View, Text, ScrollView, Animated, PanResponder, Platform, AccessibilityInfo } from "react-native";
+import { View, ScrollView, Animated, PanResponder, Platform, AccessibilityInfo } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { List, ListRow } from "./list.native.js";
 import { Card } from "./card.native.js";
 import { Menu } from "./popover.native.js";

package/dist/surface-theme.js

@@ -26,8 +26,8 @@ import {
  * derived from an image, so its subtree keeps what it inherited and the scrim
  * plus an explicit light text colour carries the hero.
  *
- * The web Player calls this; the export's generated layout renderer mirrors
- * it — the two hosts must not differ here (CLAUDE.md §8).
+ * The web Player and the export's generated layout renderer both call this,
+ * so the two hosts cannot differ here (CLAUDE.md §8).
  */
 export function surfaceAwareTheme(tenantTheme, backgroundColor) {
   const surfaceTokens = deriveSurfaceTokens(backgroundColor);

package/dist/switch.native.js

@@ -1,7 +1,8 @@
 // `<Switch>` (native). Binds ./switch-view.js to React Native's own
 // primitives; only the import differs from ./switch.js.
 
-import { View, Text, Pressable, Switch as PlatformSwitch } from "react-native";
+import { View, Pressable, Switch as PlatformSwitch } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeSwitch } from "./switch-view.js";
 
 export const Switch = makeSwitch({ View, Text, Pressable, Switch: PlatformSwitch });

package/dist/tabs.native.js

@@ -1,7 +1,8 @@
 // `<Tabs>` (native). Binds ./tabs-view.js to React Native's own primitives;
 // only the import differs from ./tabs.js.
 
-import { View, Text, Pressable, ScrollView } from "react-native";
+import { View, Pressable, ScrollView } from "react-native";
+import { Text } from "./bounded-text.native.js";
 import { makeTabs } from "./tabs-view.js";
 
 export const Tabs = makeTabs({ View, Text, Pressable, ScrollView });

package/dist/text-field.native.js

@@ -1,7 +1,8 @@
 // `<TextField>` (native). Binds ./text-field-view.js to React Native's own
 // primitives; only the import differs from ./text-field.js.
 
-import { TextInput, View, Text, Pressable } from "react-native";
+import { View, Pressable } from "react-native";
+import { TextInput, Text } from "./bounded-text.native.js";
 import { makeTextField } from "./text-field-view.js";
 
 export const TextField = makeTextField({ TextInput, View, Text, Pressable });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.258.0",
+  "version": "0.260.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "homepage": "https://github.com/Colix-AB/AppStudio",
   "type": "module",
@@ -56,6 +56,7 @@
   ],
   "scripts": {
     "build": "node scripts/build.js",
+    "generate:contract": "node scripts/contract-cjs.js",
     "test": "node --test \"src/__tests__/*.test.js\""
   },
   "engines": {

package/src/contract.js

@@ -1,12 +1,7 @@
-// ESM mirror of contract.cjs. Generated from contract.cjs — keep both in lockstep.
-// runtime) can `require()` it directly without dynamic import gymnastics.
-//
-// The ESM `contract.js` re-exports the SAME object as the `CONTRACT` named
-// export. The contract test asserts the two are identical (deep-equal) so
-// drift between this file and the ESM source-of-truth is caught in CI.
-//
-// Keep edits in lockstep between `contract.cjs` and `contract.js`. The
-// SDK build script copies both into `dist/`.
+// The widget SDK contract: the ONE source the linter, the AI agents, the
+// compiler and both hosts read. `contract.cjs` is GENERATED from `contract.js`
+// (`npm run generate:contract`) for CommonJS consumers — never edit it by hand;
+// contract-cjs-generated.test.js fails when it is stale.
 
 // REQ-AI-AGENT-DESIGN (sc-3696): the ONE cross-platform elevation vocabulary.
 // `shadow*` applies on iOS + react-native-web, `elevation` drives Android.
@@ -2645,7 +2640,7 @@ const HOOKS = [
     scopes: ["users.write:*"],
   },
   // REQ-BANKID-AUTH — link / unlink a BankID identity to the signed-in
-  // app-user. Self-service + JWT-gated (no widget scope). Mirror of contract.cjs.
+  // app-user. Self-service + JWT-gated (no widget scope).
   {
     name: "useBankIdLink",
     signature: "useBankIdLink()",
@@ -2681,7 +2676,7 @@ const HOOKS = [
     scopes: null,
   },
   // REQ-IDENT (sc-4313) — identify a visitor who is NOT signed in and keep the
-  // result. Anonymous by design (no widget scope, no session). Mirror of contract.cjs.
+  // result. Anonymous by design (no widget scope, no session).
   {
     name: "useIdentification",
     signature: "useIdentification(options)",
@@ -2732,7 +2727,7 @@ const HOOKS = [
     scopes: null,
   },
   // REQ-ACL-06 / REQ-ACL-RELINHERIT-05 — per-record VirtualPermission
-  // management for a single record. Mirror of contract.js.
+  // management for a single record.
   {
     name: "useRecordPermissions",
     signature: "useRecordPermissions(tableId, recordId)",
@@ -2865,7 +2860,7 @@ const HOOKS = [
     requiredContextSlice: ["datastore.records"],
     scopes: ["datastore.read:<table>"],
   },
-  // REQ-WSDK-PLATFORM §6 — Tier A SDK hooks. Mirror of contract.js.
+  // REQ-WSDK-PLATFORM §6 — Tier A SDK hooks.
   {
     name: "useClipboard",
     signature: "useClipboard()",
@@ -3701,6 +3696,10 @@ const ACTION_TRIGGER_TYPES = [
 // Globals the action script runs against (the runner's surface) — distinct
 // from the React/SDK widget surface, so the component import/banned-API
 // linter does NOT scan action scripts.
+// sc-7877 deliberately does NOT add `directory` here. That global is
+// reachable only by a MARKETPLACE action whose install consented to a
+// `directory:` scope; a widget-declared action has no install, so
+// resolveForActionRow grants it nothing and the global is never defined.
 const ACTION_SCRIPT_GLOBALS = [
   "datastore",
   "secrets",
@@ -4213,14 +4212,14 @@ const WIDGET_CONTEXT_SHAPE = {
     required: true,
     fields: { requestPayment: "function", getPayment: "function" },
   },
-  // sc-890 — backs useSendNotification(). Mirror of contract.cjs.
+  // sc-890 — backs useSendNotification().
   notifications: {
     description:
       "Injected @colixsystems/notifications-client instance (sc-890). { send(body) -> Promise<notification>, mutes: { get, set, clear } }. send backs useSendNotification(); requires the notifications.send:appUser scope. The host POSTs the body snake_case verbatim ({ recipient_user_id, title, body, link?, payload? }) to /notifications/send and returns the created notification row; the call is imperative (a send never fires on mount). mutes backs useRecordMute() and useRecordMutes() (sc-10268): get({ table_id, record_id }) / set({ table_id, record_id, muted_until }) -> { muted, muted_until }, clear({ table_id, record_id }) -> undefined, list({ table_id, limit?, offset? }) -> { data: [{ record_id, muted_until }], meta }. mutes is optional — a host without it (the Builder canvas preview) leaves useRecordMute() reading not muted.",
     required: true,
     fields: { send: "function", mutes: "object" },
   },
-  // REQ-IDENT (sc-4313) — backs useIdentification(). Mirror of contract.cjs.
+  // REQ-IDENT (sc-4313) — backs useIdentification().
   identification: {
     description:
       "Injected @colixsystems/identification-client instance (REQ-IDENT). { available() -> Promise<{ available, providers }>, start(body) -> Promise<order>, get(id) -> Promise<state>, cancel(id) -> Promise<state> }. Backs useIdentification(); no widget scope and no signed-in user required — identifying a NOT-signed-in visitor is the point, so the endpoints are anonymous. Bodies and rows are snake_case verbatim. A completed identification exposes name + personal_number_masked + a stable subject_hash; the RAW personal number is never reachable from a widget (it lives behind a studio-admin endpoint).",
@@ -4261,7 +4260,7 @@ const WIDGET_CONTEXT_SHAPE = {
       error: "function",
     },
   },
-  // REQ-WSDK-PLATFORM §6 — backs useToast(). Mirror of contract.js.
+  // REQ-WSDK-PLATFORM §6 — backs useToast().
   toast: {
     description:
       "Optional host toast slot. { showToast({ kind, message }): void }. " +
@@ -4705,7 +4704,7 @@ const VETTED_IMPORTS = [
 // `allowedBareImports` (so the loader's shim⊆vetted guard treats them as
 // vetted) WITHOUT bloating the rich `VETTED_IMPORTS` reference the AI prompt /
 // Developer guide enumerate — the SAME treatment `react/jsx-runtime` gets, but
-// kept out of the author-facing list. Mirror of contract.cjs.
+// kept out of the author-facing list.
 const CORE_INFRA_BARE_IMPORTS = ["react-dom", "react-dom/client"];
 
 // Back-compat shape — every existing consumer (widgetLoader, the static
@@ -6373,7 +6372,11 @@ const CONTRACT = deepFreeze({
   // 1.209.0: additive (sc-12242) — `<PeoplePicker>` takes `activeOnly`
   //    (users), a function `loadErrorText(error)`, and gives each option a
   //    `<testID>-option-<id>`.
-  version: "1.209.0",
+  // 1.210.0: behaviour (sc-12245) — `<Avatar url>` falls back to the
+  //    initials when its picture fails to load. No API change.
+  // 1.211.0: additive (sc-9168) — `maxFontSizeMultiplier`: native `<Text>` /
+  //    `<TextInput>` follow the device font scale up to this bound.
+  version: "1.211.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -6402,6 +6405,10 @@ const CONTRACT = deepFreeze({
   bundleExportContract: BUNDLE_EXPORT_CONTRACT,
   // sc-10829 — the hook a `badgeCounter: true` entry exports by name.
   badgeCounterExport: "useBadgeCount",
+  // sc-9168 — the most native text grows with the device font-scale setting.
+  // Above it a layout sized against the Player overflows; the browser has no
+  // such setting to preview it with.
+  maxFontSizeMultiplier: 1.3,
   bannedApis: BANNED_APIS,
   vettedImports: VETTED_IMPORTS,
   allowedBareImports: ALLOWED_BARE_IMPORTS,