@colixsystems/widget-sdk 0.259.0 → 0.261.0

package/src/contract.js

@@ -1,12 +1,7 @@
-// ESM mirror of contract.cjs. Generated from contract.cjs — keep both in lockstep.
-// runtime) can `require()` it directly without dynamic import gymnastics.
-//
-// The ESM `contract.js` re-exports the SAME object as the `CONTRACT` named
-// export. The contract test asserts the two are identical (deep-equal) so
-// drift between this file and the ESM source-of-truth is caught in CI.
-//
-// Keep edits in lockstep between `contract.cjs` and `contract.js`. The
-// SDK build script copies both into `dist/`.
+// The widget SDK contract: the ONE source the linter, the AI agents, the
+// compiler and both hosts read. `contract.cjs` is GENERATED from `contract.js`
+// (`npm run generate:contract`) for CommonJS consumers — never edit it by hand;
+// contract-cjs-generated.test.js fails when it is stale.
 
 // REQ-AI-AGENT-DESIGN (sc-3696): the ONE cross-platform elevation vocabulary.
 // `shadow*` applies on iOS + react-native-web, `elevation` drives Android.
@@ -2645,7 +2640,7 @@ const HOOKS = [
     scopes: ["users.write:*"],
   },
   // REQ-BANKID-AUTH — link / unlink a BankID identity to the signed-in
-  // app-user. Self-service + JWT-gated (no widget scope). Mirror of contract.cjs.
+  // app-user. Self-service + JWT-gated (no widget scope).
   {
     name: "useBankIdLink",
     signature: "useBankIdLink()",
@@ -2681,7 +2676,7 @@ const HOOKS = [
     scopes: null,
   },
   // REQ-IDENT (sc-4313) — identify a visitor who is NOT signed in and keep the
-  // result. Anonymous by design (no widget scope, no session). Mirror of contract.cjs.
+  // result. Anonymous by design (no widget scope, no session).
   {
     name: "useIdentification",
     signature: "useIdentification(options)",
@@ -2732,7 +2727,7 @@ const HOOKS = [
     scopes: null,
   },
   // REQ-ACL-06 / REQ-ACL-RELINHERIT-05 — per-record VirtualPermission
-  // management for a single record. Mirror of contract.js.
+  // management for a single record.
   {
     name: "useRecordPermissions",
     signature: "useRecordPermissions(tableId, recordId)",
@@ -2865,7 +2860,7 @@ const HOOKS = [
     requiredContextSlice: ["datastore.records"],
     scopes: ["datastore.read:<table>"],
   },
-  // REQ-WSDK-PLATFORM §6 — Tier A SDK hooks. Mirror of contract.js.
+  // REQ-WSDK-PLATFORM §6 — Tier A SDK hooks.
   {
     name: "useClipboard",
     signature: "useClipboard()",
@@ -3701,6 +3696,10 @@ const ACTION_TRIGGER_TYPES = [
 // Globals the action script runs against (the runner's surface) — distinct
 // from the React/SDK widget surface, so the component import/banned-API
 // linter does NOT scan action scripts.
+// sc-7877 deliberately does NOT add `directory` here. That global is
+// reachable only by a MARKETPLACE action whose install consented to a
+// `directory:` scope; a widget-declared action has no install, so
+// resolveForActionRow grants it nothing and the global is never defined.
 const ACTION_SCRIPT_GLOBALS = [
   "datastore",
   "secrets",
@@ -4213,14 +4212,14 @@ const WIDGET_CONTEXT_SHAPE = {
     required: true,
     fields: { requestPayment: "function", getPayment: "function" },
   },
-  // sc-890 — backs useSendNotification(). Mirror of contract.cjs.
+  // sc-890 — backs useSendNotification().
   notifications: {
     description:
       "Injected @colixsystems/notifications-client instance (sc-890). { send(body) -> Promise<notification>, mutes: { get, set, clear } }. send backs useSendNotification(); requires the notifications.send:appUser scope. The host POSTs the body snake_case verbatim ({ recipient_user_id, title, body, link?, payload? }) to /notifications/send and returns the created notification row; the call is imperative (a send never fires on mount). mutes backs useRecordMute() and useRecordMutes() (sc-10268): get({ table_id, record_id }) / set({ table_id, record_id, muted_until }) -> { muted, muted_until }, clear({ table_id, record_id }) -> undefined, list({ table_id, limit?, offset? }) -> { data: [{ record_id, muted_until }], meta }. mutes is optional — a host without it (the Builder canvas preview) leaves useRecordMute() reading not muted.",
     required: true,
     fields: { send: "function", mutes: "object" },
   },
-  // REQ-IDENT (sc-4313) — backs useIdentification(). Mirror of contract.cjs.
+  // REQ-IDENT (sc-4313) — backs useIdentification().
   identification: {
     description:
       "Injected @colixsystems/identification-client instance (REQ-IDENT). { available() -> Promise<{ available, providers }>, start(body) -> Promise<order>, get(id) -> Promise<state>, cancel(id) -> Promise<state> }. Backs useIdentification(); no widget scope and no signed-in user required — identifying a NOT-signed-in visitor is the point, so the endpoints are anonymous. Bodies and rows are snake_case verbatim. A completed identification exposes name + personal_number_masked + a stable subject_hash; the RAW personal number is never reachable from a widget (it lives behind a studio-admin endpoint).",
@@ -4261,7 +4260,7 @@ const WIDGET_CONTEXT_SHAPE = {
       error: "function",
     },
   },
-  // REQ-WSDK-PLATFORM §6 — backs useToast(). Mirror of contract.js.
+  // REQ-WSDK-PLATFORM §6 — backs useToast().
   toast: {
     description:
       "Optional host toast slot. { showToast({ kind, message }): void }. " +
@@ -4705,7 +4704,7 @@ const VETTED_IMPORTS = [
 // `allowedBareImports` (so the loader's shim⊆vetted guard treats them as
 // vetted) WITHOUT bloating the rich `VETTED_IMPORTS` reference the AI prompt /
 // Developer guide enumerate — the SAME treatment `react/jsx-runtime` gets, but
-// kept out of the author-facing list. Mirror of contract.cjs.
+// kept out of the author-facing list.
 const CORE_INFRA_BARE_IMPORTS = ["react-dom", "react-dom/client"];
 
 // Back-compat shape — every existing consumer (widgetLoader, the static
@@ -6375,7 +6374,9 @@ const CONTRACT = deepFreeze({
   //    `<testID>-option-<id>`.
   // 1.210.0: behaviour (sc-12245) — `<Avatar url>` falls back to the
   //    initials when its picture fails to load. No API change.
-  version: "1.210.0",
+  // 1.211.0: additive (sc-9168) — `maxFontSizeMultiplier`: native `<Text>` /
+  //    `<TextInput>` follow the device font scale up to this bound.
+  version: "1.211.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -6404,6 +6405,10 @@ const CONTRACT = deepFreeze({
   bundleExportContract: BUNDLE_EXPORT_CONTRACT,
   // sc-10829 — the hook a `badgeCounter: true` entry exports by name.
   badgeCounterExport: "useBadgeCount",
+  // sc-9168 — the most native text grows with the device font-scale setting.
+  // Above it a layout sized against the Player overflows; the browser has no
+  // such setting to preview it with.
+  maxFontSizeMultiplier: 1.3,
   bannedApis: BANNED_APIS,
   vettedImports: VETTED_IMPORTS,
   allowedBareImports: ALLOWED_BARE_IMPORTS,