@colixsystems/widget-sdk 0.272.0 → 0.274.0

package/README.md

@@ -86,7 +86,15 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.272.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.274.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.274.0 (contract 1.224.0)
+
+**The shared widget strings ship in Swedish.** Every entry in `CONTRACT.sharedTranslationKeys` now carries a hand-written `sv` value beside `en` (`cancel` is `{ en: "Cancel", sv: "Avbryt" }`), so a Swedish workspace gets the right word instead of a machine translation of a lone word. Translation seeding also matches a regional language to its primary one: a workspace language `sv-SE` takes the `sv` text a widget's `manifest.translations` ships, unless the widget ships `sv-SE` itself.
+
+### What's new in 0.273.0 (contract 1.223.0)
+
+**A widget never mints or sets its own permission header.** The host attaches each widget's `X-Widget-Scopes` header itself, from what that widget was granted. Source that calls `/widgets/scope-token` or sets `X-Widget-Scopes` (any casing) is now a blocking `no-scope-header-mint` finding, listed in the new `CONTRACT.scopeMintPatterns`. Comments are not scanned. Declare the scopes your hooks need in `manifest.requestedScopes`, as before; a widget that does that is unaffected.
 
 ### What's new in 0.272.0 (contract 1.222.0)
 
@@ -3628,7 +3636,7 @@ export default function OpenTasks({ tableId, titleField, statusField }) {
 | `filter` | Keeps the rows that match. A map `{ column: "op:value" }` (an array of expressions puts a range on one column), or an array `[{ column, operator, value }]`. |
 | `filterMode` | `"and"` (the default) keeps rows matching every condition; `"or"` keeps rows matching any. |
 | `q` | Free-text search: a case-insensitive substring match across every text column of the table (encrypted columns excepted). |
-| `sort` | `{ field, dir }` with `dir` `"asc"` or `"desc"`, or the string `"field:desc"`. One column; `created_at` and `updated_at` work too. |
+| `sort` | `{ field, dir }` with `dir` `"asc"` or `"desc"`, or the string `"field:desc"`. One column; `created_at` and `updated_at` work too. Newest first is `{ field: "created_at", dir: "desc" }`. `"-field"` or an unknown column is refused: `data` stays empty and `error` names the sortable columns. |
 | `limit` | Rows per page: 50 when left out, at most 1000. |
 | `offset` | Rows to skip, for the next page. |
 | `includeCapabilities` | `true` stamps each row with `_capabilities`, what the signed-in user may do to it. |
@@ -3661,12 +3669,13 @@ export default function ContactList({ tableId }) {
     limit: PAGE,
     offset: page * PAGE,
   }));
-  const { data, total, loading } = useDatastoreQuery(tableId, query);
+  const { data, total, loading, error } = useDatastoreQuery(tableId, query);
   const pick = (next) => { setStatus(next); setPage(0); };
   return (
     <View>
       <TextInput value={draft} onChangeText={setDraft} placeholder="Search" />
       <Pressable onPress={() => pick(status === "Won" ? "" : "Won")}><Text>Won</Text></Pressable>
+      {error ? <Text>{error.message}</Text> : null}
       {loading ? <Text>Loading…</Text> : data.map((row) => <Text key={row.id}>{row.name}</Text>)}
       <Text>{total ?? 0} contacts</Text>
       {(page + 1) * PAGE < (total ?? 0) ? (

package/dist/contract.cjs

@@ -4956,6 +4956,12 @@ const TRANSLATION_API_HOSTS = [
   "lingvanex.com",
 ];
 
+// sc-12906: the host mints a widget's `X-Widget-Scopes` header, never the
+// widget. Bundles share the host's JS realm, so a widget calling the mint
+// itself, or forging the header, could borrow another widget's scopes. Matched
+// case-insensitively against code (comments are blanked before matching).
+const SCOPE_MINT_PATTERNS = ["/widgets/scope-token", "x-widget-scopes"];
+
 // sc-4686 — the currency a price renders in when the HOST does not supply the
 // workspace's own (a host predating the workspace.currency slice, or a caller
 // that forgot to wire it). A rendering fallback so a price is never blank or
@@ -5121,32 +5127,33 @@ function sharedTranslationKey(key) {
   return `${SHARED_TRANSLATION_PREFIX}${key}`;
 }
 
-// The predefined set. Map of bare key -> { en } (English default only; the
-// tenant adds target-language values once in the Translations admin and every
-// widget inherits them). Adding/removing a key is a CONTRACT change (it grows
-// the dictionary every tenant gets), so the list lives with the contract and
-// the seeder reads it from here — never a second copy.
+// The predefined set. Map of bare key -> { en, sv }. Swedish is shipped by
+// hand because a lone word machine-translates to the wrong sense ("Cancel" ->
+// "Avboka"); other languages are translated in the Translations admin and
+// every widget inherits them. Adding/removing a key is a CONTRACT change (it
+// grows the dictionary every tenant gets), so the list lives with the contract
+// and the seeder reads it from here — never a second copy.
 const SHARED_TRANSLATION_KEYS = Object.freeze({
-  submit: { en: "Submit" },
-  cancel: { en: "Cancel" },
-  save: { en: "Save" },
-  delete: { en: "Delete" },
-  edit: { en: "Edit" },
-  close: { en: "Close" },
-  confirm: { en: "Confirm" },
-  back: { en: "Back" },
-  next: { en: "Next" },
-  previous: { en: "Previous" },
-  yes: { en: "Yes" },
-  no: { en: "No" },
-  ok: { en: "OK" },
-  loading: { en: "Loading…" },
-  search: { en: "Search" },
-  no_results: { en: "No results" },
-  required: { en: "Required" },
-  retry: { en: "Retry" },
-  add: { en: "Add" },
-  remove: { en: "Remove" },
+  submit: { en: "Submit", sv: "Skicka" },
+  cancel: { en: "Cancel", sv: "Avbryt" },
+  save: { en: "Save", sv: "Spara" },
+  delete: { en: "Delete", sv: "Ta bort" },
+  edit: { en: "Edit", sv: "Redigera" },
+  close: { en: "Close", sv: "Stäng" },
+  confirm: { en: "Confirm", sv: "Bekräfta" },
+  back: { en: "Back", sv: "Tillbaka" },
+  next: { en: "Next", sv: "Nästa" },
+  previous: { en: "Previous", sv: "Föregående" },
+  yes: { en: "Yes", sv: "Ja" },
+  no: { en: "No", sv: "Nej" },
+  ok: { en: "OK", sv: "OK" },
+  loading: { en: "Loading…", sv: "Laddar…" },
+  search: { en: "Search", sv: "Sök" },
+  no_results: { en: "No results", sv: "Inga resultat" },
+  required: { en: "Required", sv: "Obligatoriskt" },
+  retry: { en: "Retry", sv: "Försök igen" },
+  add: { en: "Add", sv: "Lägg till" },
+  remove: { en: "Remove", sv: "Ta bort" },
 });
 
 // True when `key` is one of the predefined shared keys — the discriminator
@@ -6559,7 +6566,12 @@ const CONTRACT = deepFreeze({
   // 1.222.0: stricter (sc-14479) — `self`, `top`, `parent`, `frames`,
   //    `opener`, `frameElement` and `.constructor` join bannedApis; `eval` and
   //    `Function` are refused as any reference, not only as a call.
-  version: "1.222.0",
+  // 1.223.0: stricter (sc-12906) — `scopeMintPatterns`; a widget that calls
+  //    the scope-header mint or sets `X-Widget-Scopes` is refused
+  //    (`no-scope-header-mint`).
+  // 1.224.0: additive (sc-14501) — every `sharedTranslationKeys` entry
+  //    ships a hand-written `sv` value beside `en`.
+  version: "1.224.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -6604,6 +6616,7 @@ const CONTRACT = deepFreeze({
   currencyFormats: CURRENCY_FORMATS,
   currencyFormatFallback: CURRENCY_FORMAT_FALLBACK,
   translationApiHosts: TRANSLATION_API_HOSTS,
+  scopeMintPatterns: SCOPE_MINT_PATTERNS,
 });
 
 function isHookAllowed(name) {

package/dist/contract.js

@@ -4953,6 +4953,12 @@ const TRANSLATION_API_HOSTS = [
   "lingvanex.com",
 ];
 
+// sc-12906: the host mints a widget's `X-Widget-Scopes` header, never the
+// widget. Bundles share the host's JS realm, so a widget calling the mint
+// itself, or forging the header, could borrow another widget's scopes. Matched
+// case-insensitively against code (comments are blanked before matching).
+const SCOPE_MINT_PATTERNS = ["/widgets/scope-token", "x-widget-scopes"];
+
 // sc-4686 — the currency a price renders in when the HOST does not supply the
 // workspace's own (a host predating the workspace.currency slice, or a caller
 // that forgot to wire it). A rendering fallback so a price is never blank or
@@ -5118,32 +5124,33 @@ function sharedTranslationKey(key) {
   return `${SHARED_TRANSLATION_PREFIX}${key}`;
 }
 
-// The predefined set. Map of bare key -> { en } (English default only; the
-// tenant adds target-language values once in the Translations admin and every
-// widget inherits them). Adding/removing a key is a CONTRACT change (it grows
-// the dictionary every tenant gets), so the list lives with the contract and
-// the seeder reads it from here — never a second copy.
+// The predefined set. Map of bare key -> { en, sv }. Swedish is shipped by
+// hand because a lone word machine-translates to the wrong sense ("Cancel" ->
+// "Avboka"); other languages are translated in the Translations admin and
+// every widget inherits them. Adding/removing a key is a CONTRACT change (it
+// grows the dictionary every tenant gets), so the list lives with the contract
+// and the seeder reads it from here — never a second copy.
 const SHARED_TRANSLATION_KEYS = Object.freeze({
-  submit: { en: "Submit" },
-  cancel: { en: "Cancel" },
-  save: { en: "Save" },
-  delete: { en: "Delete" },
-  edit: { en: "Edit" },
-  close: { en: "Close" },
-  confirm: { en: "Confirm" },
-  back: { en: "Back" },
-  next: { en: "Next" },
-  previous: { en: "Previous" },
-  yes: { en: "Yes" },
-  no: { en: "No" },
-  ok: { en: "OK" },
-  loading: { en: "Loading…" },
-  search: { en: "Search" },
-  no_results: { en: "No results" },
-  required: { en: "Required" },
-  retry: { en: "Retry" },
-  add: { en: "Add" },
-  remove: { en: "Remove" },
+  submit: { en: "Submit", sv: "Skicka" },
+  cancel: { en: "Cancel", sv: "Avbryt" },
+  save: { en: "Save", sv: "Spara" },
+  delete: { en: "Delete", sv: "Ta bort" },
+  edit: { en: "Edit", sv: "Redigera" },
+  close: { en: "Close", sv: "Stäng" },
+  confirm: { en: "Confirm", sv: "Bekräfta" },
+  back: { en: "Back", sv: "Tillbaka" },
+  next: { en: "Next", sv: "Nästa" },
+  previous: { en: "Previous", sv: "Föregående" },
+  yes: { en: "Yes", sv: "Ja" },
+  no: { en: "No", sv: "Nej" },
+  ok: { en: "OK", sv: "OK" },
+  loading: { en: "Loading…", sv: "Laddar…" },
+  search: { en: "Search", sv: "Sök" },
+  no_results: { en: "No results", sv: "Inga resultat" },
+  required: { en: "Required", sv: "Obligatoriskt" },
+  retry: { en: "Retry", sv: "Försök igen" },
+  add: { en: "Add", sv: "Lägg till" },
+  remove: { en: "Remove", sv: "Ta bort" },
 });
 
 // True when `key` is one of the predefined shared keys — the discriminator
@@ -6556,7 +6563,12 @@ const CONTRACT = deepFreeze({
   // 1.222.0: stricter (sc-14479) — `self`, `top`, `parent`, `frames`,
   //    `opener`, `frameElement` and `.constructor` join bannedApis; `eval` and
   //    `Function` are refused as any reference, not only as a call.
-  version: "1.222.0",
+  // 1.223.0: stricter (sc-12906) — `scopeMintPatterns`; a widget that calls
+  //    the scope-header mint or sets `X-Widget-Scopes` is refused
+  //    (`no-scope-header-mint`).
+  // 1.224.0: additive (sc-14501) — every `sharedTranslationKeys` entry
+  //    ships a hand-written `sv` value beside `en`.
+  version: "1.224.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -6601,6 +6613,7 @@ const CONTRACT = deepFreeze({
   currencyFormats: CURRENCY_FORMATS,
   currencyFormatFallback: CURRENCY_FORMAT_FALLBACK,
   translationApiHosts: TRANSLATION_API_HOSTS,
+  scopeMintPatterns: SCOPE_MINT_PATTERNS,
 });
 
 function isHookAllowed(name) {

package/dist/linter.cjs

@@ -763,6 +763,36 @@ function _translationApiRules(source) {
   return findings;
 }
 
+// sc-12906 — no-scope-header-mint.
+//
+// The host mints each widget's `X-Widget-Scopes` header from the widget's own
+// installation. A bundle runs in the host's JS realm, so one that calls the
+// mint itself, or sets the header, could borrow another widget's scopes. The
+// server refuses a built-in nobody placed; this catches the attempt at publish.
+// An error with no opt-out: no correct widget touches either.
+function _scopeMintRules(source) {
+  const findings = [];
+  const needles = CONTRACT.scopeMintPatterns || [];
+  const lines = _stripNonCode(source, { keepStrings: true }).split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const lowered = lines[i].toLowerCase();
+    const needle = needles.find((n) => lowered.includes(n));
+    if (!needle) continue;
+    findings.push({
+      rule: "no-scope-header-mint",
+      severity: "error",
+      label:
+        `source references "${needle}" — the host attaches each widget's ` +
+        `permission header itself. Never call that endpoint or set that ` +
+        `header; declare the scopes your hooks need in ` +
+        `manifest.requestedScopes.`,
+      line: i + 1,
+      snippet: lines[i].trim().slice(0, 200),
+    });
+  }
+  return findings;
+}
+
 // REQ-USERMGMT / REQ-ACL-SYS M3 — scope-required-for-user-mutation. See
 // linter.js for the rationale comment. The two files must stay in
 // lockstep (the contract test asserts behaviour-equivalence).
@@ -2460,6 +2490,7 @@ function lintSource(source, options) {
   // sc-6970 — soft warning: HTML markup spliced into a content string.
   findings.push(..._htmlInContentRules(source));
   findings.push(..._translationApiRules(source));
+  findings.push(..._scopeMintRules(source));
   findings.push(..._handBuiltPageUrlRules(source));
   findings.push(..._lucideIconRules(source));
   findings.push(..._bundledAssetRules(source, options && options.assetFiles));

package/dist/linter.js

@@ -695,6 +695,36 @@ function _translationApiRules(source) {
   return findings;
 }
 
+// sc-12906 — no-scope-header-mint.
+//
+// The host mints each widget's `X-Widget-Scopes` header from the widget's own
+// installation. A bundle runs in the host's JS realm, so one that calls the
+// mint itself, or sets the header, could borrow another widget's scopes. The
+// server refuses a built-in nobody placed; this catches the attempt at publish.
+// An error with no opt-out: no correct widget touches either.
+function _scopeMintRules(source) {
+  const findings = [];
+  const needles = CONTRACT.scopeMintPatterns || [];
+  const lines = _stripNonCode(source, { keepStrings: true }).split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const lowered = lines[i].toLowerCase();
+    const needle = needles.find((n) => lowered.includes(n));
+    if (!needle) continue;
+    findings.push({
+      rule: "no-scope-header-mint",
+      severity: "error",
+      label:
+        `source references "${needle}" — the host attaches each widget's ` +
+        `permission header itself. Never call that endpoint or set that ` +
+        `header; declare the scopes your hooks need in ` +
+        `manifest.requestedScopes.`,
+      line: i + 1,
+      snippet: lines[i].trim().slice(0, 200),
+    });
+  }
+  return findings;
+}
+
 // REQ-USERMGMT / REQ-ACL-SYS M3 — scope-required-for-user-mutation.
 //
 // A widget that calls `useUsers().invite()` / `.deactivate()` /
@@ -2520,6 +2550,7 @@ export function lintSource(source, options) {
   // sc-6970 — soft warning: HTML markup spliced into a content string.
   findings.push(..._htmlInContentRules(source));
   findings.push(..._translationApiRules(source));
+  findings.push(..._scopeMintRules(source));
   findings.push(..._handBuiltPageUrlRules(source));
   findings.push(..._lucideIconRules(source));
   findings.push(..._bundledAssetRules(source, options && options.assetFiles));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.272.0",
+  "version": "0.274.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "homepage": "https://github.com/Colix-AB/AppStudio",
   "type": "module",

package/src/contract.js

@@ -4953,6 +4953,12 @@ const TRANSLATION_API_HOSTS = [
   "lingvanex.com",
 ];
 
+// sc-12906: the host mints a widget's `X-Widget-Scopes` header, never the
+// widget. Bundles share the host's JS realm, so a widget calling the mint
+// itself, or forging the header, could borrow another widget's scopes. Matched
+// case-insensitively against code (comments are blanked before matching).
+const SCOPE_MINT_PATTERNS = ["/widgets/scope-token", "x-widget-scopes"];
+
 // sc-4686 — the currency a price renders in when the HOST does not supply the
 // workspace's own (a host predating the workspace.currency slice, or a caller
 // that forgot to wire it). A rendering fallback so a price is never blank or
@@ -5118,32 +5124,33 @@ function sharedTranslationKey(key) {
   return `${SHARED_TRANSLATION_PREFIX}${key}`;
 }
 
-// The predefined set. Map of bare key -> { en } (English default only; the
-// tenant adds target-language values once in the Translations admin and every
-// widget inherits them). Adding/removing a key is a CONTRACT change (it grows
-// the dictionary every tenant gets), so the list lives with the contract and
-// the seeder reads it from here — never a second copy.
+// The predefined set. Map of bare key -> { en, sv }. Swedish is shipped by
+// hand because a lone word machine-translates to the wrong sense ("Cancel" ->
+// "Avboka"); other languages are translated in the Translations admin and
+// every widget inherits them. Adding/removing a key is a CONTRACT change (it
+// grows the dictionary every tenant gets), so the list lives with the contract
+// and the seeder reads it from here — never a second copy.
 const SHARED_TRANSLATION_KEYS = Object.freeze({
-  submit: { en: "Submit" },
-  cancel: { en: "Cancel" },
-  save: { en: "Save" },
-  delete: { en: "Delete" },
-  edit: { en: "Edit" },
-  close: { en: "Close" },
-  confirm: { en: "Confirm" },
-  back: { en: "Back" },
-  next: { en: "Next" },
-  previous: { en: "Previous" },
-  yes: { en: "Yes" },
-  no: { en: "No" },
-  ok: { en: "OK" },
-  loading: { en: "Loading…" },
-  search: { en: "Search" },
-  no_results: { en: "No results" },
-  required: { en: "Required" },
-  retry: { en: "Retry" },
-  add: { en: "Add" },
-  remove: { en: "Remove" },
+  submit: { en: "Submit", sv: "Skicka" },
+  cancel: { en: "Cancel", sv: "Avbryt" },
+  save: { en: "Save", sv: "Spara" },
+  delete: { en: "Delete", sv: "Ta bort" },
+  edit: { en: "Edit", sv: "Redigera" },
+  close: { en: "Close", sv: "Stäng" },
+  confirm: { en: "Confirm", sv: "Bekräfta" },
+  back: { en: "Back", sv: "Tillbaka" },
+  next: { en: "Next", sv: "Nästa" },
+  previous: { en: "Previous", sv: "Föregående" },
+  yes: { en: "Yes", sv: "Ja" },
+  no: { en: "No", sv: "Nej" },
+  ok: { en: "OK", sv: "OK" },
+  loading: { en: "Loading…", sv: "Laddar…" },
+  search: { en: "Search", sv: "Sök" },
+  no_results: { en: "No results", sv: "Inga resultat" },
+  required: { en: "Required", sv: "Obligatoriskt" },
+  retry: { en: "Retry", sv: "Försök igen" },
+  add: { en: "Add", sv: "Lägg till" },
+  remove: { en: "Remove", sv: "Ta bort" },
 });
 
 // True when `key` is one of the predefined shared keys — the discriminator
@@ -6556,7 +6563,12 @@ const CONTRACT = deepFreeze({
   // 1.222.0: stricter (sc-14479) — `self`, `top`, `parent`, `frames`,
   //    `opener`, `frameElement` and `.constructor` join bannedApis; `eval` and
   //    `Function` are refused as any reference, not only as a call.
-  version: "1.222.0",
+  // 1.223.0: stricter (sc-12906) — `scopeMintPatterns`; a widget that calls
+  //    the scope-header mint or sets `X-Widget-Scopes` is refused
+  //    (`no-scope-header-mint`).
+  // 1.224.0: additive (sc-14501) — every `sharedTranslationKeys` entry
+  //    ships a hand-written `sv` value beside `en`.
+  version: "1.224.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -6601,6 +6613,7 @@ const CONTRACT = deepFreeze({
   currencyFormats: CURRENCY_FORMATS,
   currencyFormatFallback: CURRENCY_FORMAT_FALLBACK,
   translationApiHosts: TRANSLATION_API_HOSTS,
+  scopeMintPatterns: SCOPE_MINT_PATTERNS,
 });
 
 function isHookAllowed(name) {