@colixsystems/widget-sdk 0.64.0 → 0.66.0

package/README.md

@@ -53,7 +53,26 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.64.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.66.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.66.0
+
+**New linter rule `image-percent-height`, and `appstudio-widget lint` finally prints warnings (sc-3493).**
+
+- **`image-percent-height` (severity `warning`, non-blocking).** An `<Image>` / `<ImageBackground>` sized with a literal percentage `height` — `style={{ width: "100%", height: "47%" }}` — is flagged. React Native / Yoga resolves a percentage height against the **parent's** height, so under a content-sized parent it collapses to 0: the `uri` still fetches, but the image is invisible on both the web Player and the native Expo export, with nothing in the console to trace. Author fix: size it with `aspectRatio` (`{ width: "100%", aspectRatio: 1 }`) or a numeric pixel height. It is a **warning**, not an error, precisely because `height: "100%"` *is* correct inside a parent with a definite height (a fixed-height hero) and a text scan cannot tell the two apart — so the rule informs without rejecting a valid widget. Scope is the literal inline form only; a height threaded through a variable or a `StyleSheet` object is beyond an AST-free scan, and the guidance in the `useFilestoreFile` note below remains the primary guard. Comments are not scanned, so documenting the anti-pattern is safe.
+- **The CLI no longer swallows warnings.** `runLint` reported `clean` and dropped every `severity: "warning"` finding whenever there were no errors, which made the existing `no-host-api-url` warning (and this new one) invisible to anyone using `appstudio-widget lint`. It now prints an `N error(s), M warning(s)` header and one line per finding tagged `error` / `warning`. **Exit codes are unchanged:** `0` when there are no error-severity findings (warnings included), `1` otherwise — so a warning still never blocks a build. `clean` is printed only when there are genuinely zero findings.
+
+`CONTRACT` is unchanged (no new field), and no export changed signature.
+
+### What's new in 0.65.0
+
+**Every file record carries `url`, and hand-built file URLs are linted (sc-3589 follow-up).** Two fixes for the same real-world failure: a `FILE` column's image silently not rendering.
+
+- **`url` is now on every file record**, aliasing the absolutized `presigned_url`. The wire field is `presigned_url`, so the intuitive `file.url` read was `undefined` — and because the usual guard is `if (!file.url) return null`, the widget rendered *nothing*, with no error to trace. The alias is added in the filestore client's one shared normalizer, so it applies to `useFilestoreFile(id)` **and every row of `useFilestoreFiles`** — a gallery can render `files.map(f => f.url)` directly. `presigned_url` is unchanged and still present. Requires `@colixsystems/filestore-client` ≥ 0.7.0.
+- **Prefer the top-level `url`:** `const { url } = useFilestoreFile(id)`. The returned `file` is `null` until the fetch resolves (and stays null for an empty `FILE` cell), so `const { file } = …; file.url` throws on the first render. `file.url` is correct only *after* you null-check `file`.
+- **`no-host-api-url` now flags hand-built host paths.** The needles were only `/api/v1`, `/uploads/` and `Authorization: Bearer`, so `` `/api/files/${id}` `` — a route that does not exist — passed clean and shipped. The rule now matches `/api/files/` anywhere (so the origin-prefixed `` `${location.origin}/api/files/${id}` `` is caught too) plus a *quoted* relative `/api/` path for invented prefixes generally. Two deliberate carve-outs: **comments are not scanned**, so documenting the rule in a comment is safe; and an absolute third-party URL that merely contains `/api/` (`https://api.example.com/api/x`) never matches. If a third-party call genuinely needs a *relative* `/api/…` path against an axios `baseURL`, add `// appstudio-lint-ignore no-host-api-url` on that line or the line above.
+
+**Never build a file URL from an id.** Filestore bytes are only reachable through a server-signed token URL, so a client-composed path can never work — always go through `useFilestoreFile`. `CONTRACT.version` → `1.44.0`. Both changes additive; no export changed signature.
 
 ### What's new in 0.64.0
 
@@ -234,8 +253,8 @@ Also: `useFileSignatures(fileIds)` is now **self-scoped** (the caller's own sign
 ### What's new in 0.30.0
 
 **Filestore browsing + BankID file signing for widgets (REQ-FS / REQ-SIGN).** Three new hooks read a newly-injected `ctx.filestore` (the `@colixsystems/filestore-client`, now constructed by both the web and native hosts):
-- `useFilestoreFiles({ spaceType, folderId?, q?, type? })` → `{ files, loading, error, refetch }` — browses the end-user's Filestore space. The hook resolves `owner_id` from the host context (tenant for a project space, the app user for a personal space), so the widget only picks the space.
-- `useFilestoreFile(fileId)` → `{ file, url, loading, error, refetch }` — resolves ONE file id to a displayable `url` (its `presigned_url`, absolutized for web + native) via `ctx.filestore.files.get(id)`. A datastore `FILE` column holds — and reads back as — that **bare file-id string**; it is NOT hydrated into an object the way a `RELATION` (`{ id, label }`) or `USER` (`{ id, name }`) column is, so pass the value straight to the hook (no `{ id }` / `{ url }` unwrapping guard). Empty / deleted / not-found ids resolve to `url: null` so a display widget shows a fallback. Requires `files.read:*`.
+- `useFilestoreFiles({ spaceType, folderId?, q?, type? })` → `{ files, loading, error, refetch }` — browses the end-user's Filestore space. The hook resolves `owner_id` from the host context (tenant for a project space, the app user for a personal space), so the widget only picks the space. Every row carries a ready-to-render `url` (its absolutized `presigned_url`), so a gallery renders `files.map(f => f.url)` directly — no per-row `useFilestoreFile` call.
+- `useFilestoreFile(fileId)` → `{ file, url, loading, error, refetch }` — resolves ONE file id to a displayable `url` (its `presigned_url`, absolutized for web + native) via `ctx.filestore.files.get(id)`. **Read the top-level `url`** — the returned `file` is `null` until the fetch resolves (and for an empty id), so `file.url` throws on the first render; it is correct only after a null check. **Never compose a file URL yourself** — the bytes are served only from a server-signed token URL, so a hand-built path like `/api/files/<id>` can never resolve (the linter's `no-host-api-url` rule flags it, including the `${location.origin}/api/files/…` form). A datastore `FILE` column holds — and reads back as — that **bare file-id string**; it is NOT hydrated into an object the way a `RELATION` (`{ id, label }`) or `USER` (`{ id, name }`) column is, so pass the value straight to the hook (no `{ id }` / `{ url }` unwrapping guard). Empty / deleted / not-found ids resolve to `url: null` so a display widget shows a fallback. When you render `url` in an `<Image>` that fills its container, size it with `aspectRatio` (e.g. `{ width: "100%", aspectRatio: 1 }`) or pixels — never a percentage `height`, which React Native collapses to 0 against a content-sized parent, so the image loads but is invisible. Requires `files.read:*`.
 - `useFilestoreFolders({ spaceType, parentFolderId?, q?, enabled? })` → `{ folders, loading, error, refetch }` — the folder-navigation companion to `useFilestoreFiles`; pass `enabled:false` to suspend fetching.
 - `useFilestoreUpload({ spaceType, folderId? })` → `{ upload, uploading, error, lastUploaded }` — POSTs a multipart upload to `ctx.filestore.files.upload`. Resolves `owner_id` from the host context (like the read hooks) so the widget only picks the space + destination folder. Pair with the `<FilePicker>` primitive for the visible trigger. Requires the `files.write:*` scope.
 - `useFileSignature(fileId)` → `{ status, qr, signerName, verdict, initiate, refresh, cancel, verify, … }` — drives a BankID signing flow for a file (the backend hashes the bytes server-side, binds the digest into the signature, and verifies the proof offline).
@@ -489,8 +508,9 @@ A widget that works but looks unfinished is only half done. `useTheme()` is the
 - **Build a hierarchy.** A clear title (large, bold, `colors.onSurface`), body text, and muted captions in `colors.onSurfaceMuted` — three weights, not one flat size. Reserve `colors.primary` (with `colors.onPrimary` for text on it) for the single most important action or metric.
 - **Set the theme font on every `Text`.** React Native `Text` does not inherit `fontFamily` from a parent, so a text element that omits it falls back to the system font and ignores the workspace's configured font. Put `theme.typography.fontFamily` on every text style (a shared `StyleSheet` built from `theme` keeps it in one place) and size text with `theme.typography.sizes`.
 - **Contain and elevate.** Wrap a logical unit in a surface: `colors.surface` + padding + `radii.md` + a `colors.border` hairline or a subtle shadow. Use the status roles (`danger / success / warning / info`) for state.
+- **Compose forms — pair fields into rows, don't stack one per row.** Put short, related fields side by side (first + last name, city + postal code, expiry + CVC): a row of `{ flexDirection: 'row', flexWrap: 'wrap', gap: theme.spacing.md }` with each field cell `{ flexGrow: 1, flexBasis: 160 }` splits the width on a wide card and wraps to stacked on a narrow phone — the native-safe way to go multi-column (widgets have no breakpoint hook, so never hard-code fixed columns). Keep wide fields (email, address, notes) full-width, cap it at two–three per row, group a long form into labelled sections, and label every input above it (not placeholder-only).
 - **Respond to touch.** Give every `Pressable` a pressed state via the function-style `style={({ pressed }) => [base, pressed && { opacity: 0.7 }]}`.
-- **Use icons for clarity.** Pair a `lucide-react-native` icon with its label at a consistent size, coloured from the theme.
+- **Use icons for clarity.** Pair a `lucide-react-native` icon with its label at a consistent size, coloured from the theme. The label never repeats the icon as a character — with a `Plus` icon the button says "Add item", never "+ Add item" (that renders a doubled plus).
 - **Use imagery deliberately.** Render pictures with the `Image` primitive (`source` takes a URL or `{ uri }`); resolve workspace assets via `useAsset()`. Give every image a sized, `radii`-clipped container so it never renders as a raw rectangle, and never hardcode a credentialed image URL — expose an `image`-type property instead.
 - **Design the empty, loading, and error states.** A blank box on a fresh install reads as broken — show a short helper line when a list is empty, a calm loading line, and a single human sentence in `colors.danger` on error.
 

package/dist/cli.js

@@ -60,15 +60,25 @@ function runLint(rest) {
     exit(1);
   }
   const { ok, findings } = lintSource(source);
-  if (ok) {
+  if (findings.length === 0) {
     stdout.write(`${filePath}: clean\n`);
     exit(0);
   }
-  stderr.write(`${filePath}: ${findings.length} finding(s)\n`);
+  // sc-3493 — a warning-severity finding used to be swallowed: `ok` stays true
+  // for warnings, so the CLI printed "clean" and dropped them. A warning nobody
+  // sees is pointless. Report every finding; only errors change the exit code.
+  const errors = findings.filter((f) => f.severity !== "warning").length;
+  const stream = ok ? stdout : stderr;
+  stream.write(
+    `${filePath}: ${errors} error(s), ${findings.length - errors} warning(s)\n`,
+  );
   for (const f of findings) {
-    stderr.write(`  [${f.rule}] line ${f.line}: ${f.label}\n    ${f.snippet}\n`);
+    const severity = f.severity === "warning" ? "warning" : "error";
+    stream.write(
+      `  ${severity} [${f.rule}] line ${f.line}: ${f.label}\n    ${f.snippet}\n`,
+    );
   }
-  exit(1);
+  exit(ok ? 0 : 1);
 }
 
 async function runDev(rest) {

package/dist/contract.cjs

@@ -211,10 +211,14 @@ const HOOKS = [
     name: "useFilestoreFiles",
     signature: "useFilestoreFiles({ spaceType, folderId?, q?, type? })",
     description:
-      "Browse the end-user's Filestore files in a project or personal space. " +
-      "The hook resolves owner_id from the host context (tenant for project, " +
-      "app user for personal) — the widget only chooses the space. Reads " +
-      "ctx.filestore.files.list and unwraps { data, meta } to the files array.",
+      "Browse the end-user's Filestore files in a project, personal, or public " +
+      "space. The hook resolves owner_id from the host context (tenant for " +
+      "project/public, app user for personal) — the widget only chooses the " +
+      "space. A public space is world-readable: its files render even for " +
+      "logged-out Player visitors. Reads ctx.filestore.files.list and unwraps " +
+      "{ data, meta } to the files array. Every row carries a ready-to-render " +
+      "`url` (its absolutized presigned_url, aliased by the filestore client) " +
+      "so a gallery renders `files.map(f => f.url)` directly.",
     returnShape: {
       files: "FilestoreFile[]",
       loading: "boolean",
@@ -236,7 +240,12 @@ const HOOKS = [
       "absolutized by the client so it loads on web AND native. An empty id " +
       "collapses to { file: null, url: null } with no round-trip; a deleted / " +
       "not-found id degrades the same way (url stays null, error carries the " +
-      "wire error) so a display widget shows its fallback instead of crashing.",
+      "wire error) so a display widget shows its fallback instead of crashing. " +
+      "READ THE TOP-LEVEL `url`: `file` is null until the fetch resolves (and " +
+      "stays null for an empty id), so `file.url` throws on the first render. " +
+      "Every file record the client returns does carry the same `url` alias, " +
+      "so `file.url` is correct once you have null-checked `file`. " +
+      "NEVER build a file URL by hand from an id — no route serves one.",
     returnShape: {
       file: "FilestoreFile | null",
       url: "string | null",
@@ -295,10 +304,10 @@ const HOOKS = [
     name: "useFilestoreFolders",
     signature: "useFilestoreFolders({ spaceType, parentFolderId?, q?, enabled? })",
     description:
-      "Browse the end-user's Filestore folders in a project or personal space, " +
-      "mirroring useFilestoreFiles for subfolder navigation. The hook resolves " +
-      "owner_id from the host context; pass enabled:false to suspend fetching. " +
-      "Reads ctx.filestore.folders.list and unwraps { data, meta } to the array.",
+      "Browse the end-user's Filestore folders in a project, personal, or public " +
+      "space, mirroring useFilestoreFiles for subfolder navigation. The hook " +
+      "resolves owner_id from the host context; pass enabled:false to suspend " +
+      "fetching. Reads ctx.filestore.folders.list and unwraps { data, meta } to the array.",
     returnShape: {
       folders: "FilestoreFolder[]",
       loading: "boolean",
@@ -1090,7 +1099,7 @@ const WIDGET_CONTEXT_SHAPE = {
   },
   filestore: {
     description:
-      "Injected @colixsystems/filestore-client instance — the end-user file archive (project / personal spaces) + BankID file signing. " +
+      "Injected @colixsystems/filestore-client instance — the end-user file archive (project / personal / public spaces) + BankID file signing. " +
       "{ files: { list(query) -> Promise<{ data, meta }>, get(id), upload(formData), update(id, body), remove(id), preview(id) }, " +
       "folders: { list, create, update, remove }, shares: { ... }, trash: { ... }, " +
       "signatures: { initiate(fileId), status(id), cancel(id), verify(id) }, objectUrl(token), fetchObject(token) }. " +
@@ -1209,12 +1218,11 @@ const BUNDLE_EXPORT_CONTRACT = [
 // REQ-WSDK-PLATFORM (docs/design/req-widget-sdk-cross-platform-primitives.md
 // §3.5, §8): `fetch` and `XMLHttpRequest` are NOT banned. Widgets may call
 // third-party APIs directly. Same-origin requests to the host's own
-// `/api/*` surface are rejected at runtime by the WidgetContextProvider's
-// network gate (`no host-api access from widgets`) — the JWT token is
-// never shared with widget code, so the call would 401 anyway; the runtime
-// gate makes the failure mode "blocked" instead of "401 noise". A soft
-// linter warning (`no-host-api-url`) flags obvious host-URL substrings at
-// submission so authors learn the rule statically.
+// `/api/*` surface just fail: widget code never receives the JWT, so they
+// 401 (and an invented route like `/api/files/<id>` 404s). There is no
+// runtime gate — the soft linter warning (`no-host-api-url`) is the only
+// thing that catches it, which is why it flags relative `/api/` literals
+// too, not just the real `/api/v1` prefix.
 const BANNED_APIS = [
   { identifier: "eval", reason: "Arbitrary code evaluation." },
   {
@@ -1305,7 +1313,7 @@ const VETTED_IMPORTS = [
     platforms: ["web", "native"],
     category: "network",
     description:
-      "HTTP client for third-party APIs. Calls to the host's /api/* surface are blocked at runtime — widgets get no JWT token, so use SDK hooks for workspace data.",
+      "HTTP client for third-party APIs. Calls to the host's own /api/* surface do not work — a widget is never given a JWT, so they 401 (and an invented path matches no route at all); use SDK hooks for workspace data.",
   },
   {
     specifier: "date-fns",
@@ -1513,6 +1521,18 @@ const HOST_API_URL_PATTERNS = [
   "/api/v1",
   "/uploads/",
   "Authorization: Bearer",
+  // sc-3589 follow-up — the invented file route, matched ANYWHERE in a literal
+  // so the origin-prefixed spelling (`${location.origin}/api/files/<id>`) is
+  // caught as well as the bare relative one. No route serves this path.
+  "/api/files/",
+  // A QUOTED relative path into the host API — a broader net for invented
+  // prefixes generally. Quote-anchored so an absolute third-party URL that
+  // merely contains "/api/" (https://api.example.com/api/x) does not match.
+  // Comments are blanked before matching, and a legitimate third-party
+  // relative path can opt out with the `appstudio-lint-ignore` directive.
+  '"/api/',
+  "'/api/",
+  "`/api/",
 ];
 
 function deepFreeze(value) {
@@ -1926,7 +1946,21 @@ const CONTRACT = deepFreeze({
   //    Previously it hardcoded `color: inherit` / an unset scheme (web) and an
   //    uncoloured trigger (native), rendering dark-on-dark. No prop changed —
   //    behavioural fix, additive.
-  version: "1.43.0",
+  // 1.44.0 (sc-3589 follow-up) — two FILE-display fixes. (a) The filestore
+  //    client's `withDisplayableUrl` normalizer now aliases the absolutized presigned_url as `url` on
+  //    EVERY file record, so `file.url` works for `useFilestoreFile` AND every
+  //    row of `useFilestoreFiles`. The wire field is `presigned_url`; reading
+  //    the wrong name returned undefined silently, rendering nothing with no
+  //    error. Aliased in the one shared normalizer, not per hook, so the
+  //    single-file and list shapes cannot diverge. `file` is still null while
+  //    loading — the top-level `url` remains the read to prefer.
+  //    (b) `hostApiUrlPatterns` gains `/api/files/` (matched anywhere, so the
+  //    origin-prefixed spelling is caught) plus quote-anchored `/api/` needles
+  //    for invented prefixes generally. The rule now blanks COMMENTS before
+  //    matching, so a comment quoting the bad path is not a finding, and a
+  //    legitimate third-party relative path can opt out with an
+  //    `appstudio-lint-ignore no-host-api-url` comment. Additive.
+  version: "1.44.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/contract.js

@@ -211,10 +211,14 @@ const HOOKS = [
     name: "useFilestoreFiles",
     signature: "useFilestoreFiles({ spaceType, folderId?, q?, type? })",
     description:
-      "Browse the end-user's Filestore files in a project or personal space. " +
-      "The hook resolves owner_id from the host context (tenant for project, " +
-      "app user for personal) — the widget only chooses the space. Reads " +
-      "ctx.filestore.files.list and unwraps { data, meta } to the files array.",
+      "Browse the end-user's Filestore files in a project, personal, or public " +
+      "space. The hook resolves owner_id from the host context (tenant for " +
+      "project/public, app user for personal) — the widget only chooses the " +
+      "space. A public space is world-readable: its files render even for " +
+      "logged-out Player visitors. Reads ctx.filestore.files.list and unwraps " +
+      "{ data, meta } to the files array. Every row carries a ready-to-render " +
+      "`url` (its absolutized presigned_url, aliased by the filestore client) " +
+      "so a gallery renders `files.map(f => f.url)` directly.",
     returnShape: {
       files: "FilestoreFile[]",
       loading: "boolean",
@@ -236,7 +240,12 @@ const HOOKS = [
       "absolutized by the client so it loads on web AND native. An empty id " +
       "collapses to { file: null, url: null } with no round-trip; a deleted / " +
       "not-found id degrades the same way (url stays null, error carries the " +
-      "wire error) so a display widget shows its fallback instead of crashing.",
+      "wire error) so a display widget shows its fallback instead of crashing. " +
+      "READ THE TOP-LEVEL `url`: `file` is null until the fetch resolves (and " +
+      "stays null for an empty id), so `file.url` throws on the first render. " +
+      "Every file record the client returns does carry the same `url` alias, " +
+      "so `file.url` is correct once you have null-checked `file`. " +
+      "NEVER build a file URL by hand from an id — no route serves one.",
     returnShape: {
       file: "FilestoreFile | null",
       url: "string | null",
@@ -295,10 +304,10 @@ const HOOKS = [
     name: "useFilestoreFolders",
     signature: "useFilestoreFolders({ spaceType, parentFolderId?, q?, enabled? })",
     description:
-      "Browse the end-user's Filestore folders in a project or personal space, " +
-      "mirroring useFilestoreFiles for subfolder navigation. The hook resolves " +
-      "owner_id from the host context; pass enabled:false to suspend fetching. " +
-      "Reads ctx.filestore.folders.list and unwraps { data, meta } to the array.",
+      "Browse the end-user's Filestore folders in a project, personal, or public " +
+      "space, mirroring useFilestoreFiles for subfolder navigation. The hook " +
+      "resolves owner_id from the host context; pass enabled:false to suspend " +
+      "fetching. Reads ctx.filestore.folders.list and unwraps { data, meta } to the array.",
     returnShape: {
       folders: "FilestoreFolder[]",
       loading: "boolean",
@@ -1090,7 +1099,7 @@ const WIDGET_CONTEXT_SHAPE = {
   },
   filestore: {
     description:
-      "Injected @colixsystems/filestore-client instance — the end-user file archive (project / personal spaces) + BankID file signing. " +
+      "Injected @colixsystems/filestore-client instance — the end-user file archive (project / personal / public spaces) + BankID file signing. " +
       "{ files: { list(query) -> Promise<{ data, meta }>, get(id), upload(formData), update(id, body), remove(id), preview(id) }, " +
       "folders: { list, create, update, remove }, shares: { ... }, trash: { ... }, " +
       "signatures: { initiate(fileId), status(id), cancel(id), verify(id) }, objectUrl(token), fetchObject(token) }. " +
@@ -1209,12 +1218,11 @@ const BUNDLE_EXPORT_CONTRACT = [
 // REQ-WSDK-PLATFORM (docs/design/req-widget-sdk-cross-platform-primitives.md
 // §3.5, §8): `fetch` and `XMLHttpRequest` are NOT banned. Widgets may call
 // third-party APIs directly. Same-origin requests to the host's own
-// `/api/*` surface are rejected at runtime by the WidgetContextProvider's
-// network gate (`no host-api access from widgets`) — the JWT token is
-// never shared with widget code, so the call would 401 anyway; the runtime
-// gate makes the failure mode "blocked" instead of "401 noise". A soft
-// linter warning (`no-host-api-url`) flags obvious host-URL substrings at
-// submission so authors learn the rule statically.
+// `/api/*` surface just fail: widget code never receives the JWT, so they
+// 401 (and an invented route like `/api/files/<id>` 404s). There is no
+// runtime gate — the soft linter warning (`no-host-api-url`) is the only
+// thing that catches it, which is why it flags relative `/api/` literals
+// too, not just the real `/api/v1` prefix.
 const BANNED_APIS = [
   { identifier: "eval", reason: "Arbitrary code evaluation." },
   {
@@ -1305,7 +1313,7 @@ const VETTED_IMPORTS = [
     platforms: ["web", "native"],
     category: "network",
     description:
-      "HTTP client for third-party APIs. Calls to the host's /api/* surface are blocked at runtime — widgets get no JWT token, so use SDK hooks for workspace data.",
+      "HTTP client for third-party APIs. Calls to the host's own /api/* surface do not work — a widget is never given a JWT, so they 401 (and an invented path matches no route at all); use SDK hooks for workspace data.",
   },
   {
     specifier: "date-fns",
@@ -1513,6 +1521,18 @@ const HOST_API_URL_PATTERNS = [
   "/api/v1",
   "/uploads/",
   "Authorization: Bearer",
+  // sc-3589 follow-up — the invented file route, matched ANYWHERE in a literal
+  // so the origin-prefixed spelling (`${location.origin}/api/files/<id>`) is
+  // caught as well as the bare relative one. No route serves this path.
+  "/api/files/",
+  // A QUOTED relative path into the host API — a broader net for invented
+  // prefixes generally. Quote-anchored so an absolute third-party URL that
+  // merely contains "/api/" (https://api.example.com/api/x) does not match.
+  // Comments are blanked before matching, and a legitimate third-party
+  // relative path can opt out with the `appstudio-lint-ignore` directive.
+  '"/api/',
+  "'/api/",
+  "`/api/",
 ];
 
 function deepFreeze(value) {
@@ -1926,7 +1946,21 @@ const CONTRACT = deepFreeze({
   //    Previously it hardcoded `color: inherit` / an unset scheme (web) and an
   //    uncoloured trigger (native), rendering dark-on-dark. No prop changed —
   //    behavioural fix, additive.
-  version: "1.43.0",
+  // 1.44.0 (sc-3589 follow-up) — two FILE-display fixes. (a) The filestore
+  //    client's `withDisplayableUrl` normalizer now aliases the absolutized presigned_url as `url` on
+  //    EVERY file record, so `file.url` works for `useFilestoreFile` AND every
+  //    row of `useFilestoreFiles`. The wire field is `presigned_url`; reading
+  //    the wrong name returned undefined silently, rendering nothing with no
+  //    error. Aliased in the one shared normalizer, not per hook, so the
+  //    single-file and list shapes cannot diverge. `file` is still null while
+  //    loading — the top-level `url` remains the read to prefer.
+  //    (b) `hostApiUrlPatterns` gains `/api/files/` (matched anywhere, so the
+  //    origin-prefixed spelling is caught) plus quote-anchored `/api/` needles
+  //    for invented prefixes generally. The rule now blanks COMMENTS before
+  //    matching, so a comment quoting the bad path is not a finding, and a
+  //    legitimate third-party relative path can opt out with an
+  //    `appstudio-lint-ignore no-host-api-url` comment. Additive.
+  version: "1.44.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/hooks.js

@@ -1449,8 +1449,10 @@ export function useAssetsByTag(tag, options) {
  * ==========================================================================*/
 
 // Resolve the owner_id a filestore query needs from the host context: a PROJECT
-// space is owned by the tenant (ctx.workspace.id); a PERSONAL space is owned by
-// the signed-in app user (ctx.user.id). The widget only chooses the space.
+// or PUBLIC space is owned by the tenant (ctx.workspace.id); a PERSONAL space is
+// owned by the signed-in app user (ctx.user.id). The widget only chooses the
+// space. PUBLIC is world-readable, so its files resolve even when there is no
+// signed-in user (ctx.workspace.id is set for a logged-out Player visitor too).
 function _filestoreOwnerId(ctx, spaceType) {
   const space = String(spaceType || "project").toUpperCase();
   if (space === "PERSONAL") return (ctx.user && ctx.user.id) || null;
@@ -1546,7 +1548,8 @@ export function useFilestoreFiles(options) {
  * An empty / null id collapses to `{ file: null, url: null }` with no network
  * round-trip; a deleted or not-found id degrades the same way (`url` stays
  * null and `error` carries the wire error) so a display widget shows its
- * fallback instead of crashing.
+ * fallback instead of crashing. Read the top-level `url` — `file` is null
+ * until the fetch resolves, so `file.url` throws on the first render.
  */
 export function useFilestoreFile(fileId) {
   const ctx = useWidgetContextOrThrow("useFilestoreFile");

package/dist/linter.cjs

@@ -69,7 +69,7 @@ const CONTRACT_RULES = CONTRACT.bannedApis.map((b) =>
 // left intact: real code lives there and must still be scanned (`${window}`
 // is a genuine escape). Backslash escapes inside strings/templates are
 // consumed so an escaped quote (`"\""`) doesn't end the literal early.
-function _stripNonCode(source) {
+function _stripNonCode(source, { keepStrings = false } = {}) {
   let out = "";
   const n = source.length;
   let mode = "code"; // code | line | block | sq | dq | tmpl
@@ -84,6 +84,10 @@ function _stripNonCode(source) {
   const blank = (ch) => {
     out += ch === "\n" || ch === "\r" ? ch : " ";
   };
+  // String / template CONTENT: blanked for the banned-identifier scan
+  // (prose must not trip `no-window`), kept for the host-API-URL scan,
+  // whose whole job is to find a URL literal.
+  const str = keepStrings ? keep : blank;
   let i = 0;
   while (i < n) {
     const ch = source[i];
@@ -101,15 +105,15 @@ function _stripNonCode(source) {
         i += 2;
       } else if (ch === "'") {
         mode = "sq";
-        blank(ch);
+        str(ch);
         i += 1;
       } else if (ch === '"') {
         mode = "dq";
-        blank(ch);
+        str(ch);
         i += 1;
       } else if (ch === "`") {
         mode = "tmpl";
-        blank(ch);
+        str(ch);
         i += 1;
       } else if (ch === "{") {
         braceDepth += 1;
@@ -123,7 +127,7 @@ function _stripNonCode(source) {
         ) {
           tmplStack.pop();
           mode = "tmpl";
-          blank(ch);
+          str(ch);
         } else {
           keep(ch);
         }
@@ -153,12 +157,12 @@ function _stripNonCode(source) {
     } else if (mode === "sq" || mode === "dq") {
       const quote = mode === "sq" ? "'" : '"';
       if (ch === "\\") {
-        blank(ch);
-        if (i + 1 < n) blank(nx);
+        str(ch);
+        if (i + 1 < n) str(nx);
         i += 2;
       } else if (ch === quote) {
         mode = "code";
-        blank(ch);
+        str(ch);
         i += 1;
       } else if (ch === "\n") {
         // A bare newline terminates an unterminated string in JS; bail back
@@ -167,18 +171,18 @@ function _stripNonCode(source) {
         keep(ch);
         i += 1;
       } else {
-        blank(ch);
+        str(ch);
         i += 1;
       }
     } else {
       // mode === "tmpl"
       if (ch === "\\") {
-        blank(ch);
-        if (i + 1 < n) blank(nx);
+        str(ch);
+        if (i + 1 < n) str(nx);
         i += 2;
       } else if (ch === "`") {
         mode = "code";
-        blank(ch);
+        str(ch);
         i += 1;
       } else if (ch === "$" && nx === "{") {
         // Enter an expression hole. Remember the brace depth the template
@@ -190,7 +194,7 @@ function _stripNonCode(source) {
         keep(nx);
         i += 2;
       } else {
-        blank(ch);
+        str(ch);
         i += 1;
       }
     }
@@ -332,11 +336,37 @@ function _importRules(source, manifest) {
   return findings;
 }
 
+// Explicit opt-out. A widget legitimately calling a THIRD-PARTY API with a
+// relative path against an `axios` baseURL cannot avoid the substring match,
+// and post-sc-3589 an unavoidable finding burns AI repair turns on correct
+// code. The directive may sit on the offending line or the line above it.
+const HOST_API_URL_IGNORE = "appstudio-lint-ignore no-host-api-url";
+
+function _hostApiUrlIgnoredLines(source) {
+  const ignored = new Set();
+  const lines = source.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i];
+    if (!line.includes(HOST_API_URL_IGNORE)) continue;
+    ignored.add(i + 1);
+    // A directive on its OWN line also exempts the line below it. A TRAILING
+    // comment exempts only its own line — otherwise it would silently cover
+    // the next statement, which may be a genuine hand-built host URL.
+    if (/^\s*(\/\/|\/\*|\*)/.test(line)) ignored.add(i + 2);
+  }
+  return ignored;
+}
+
 function _hostApiUrlRules(source) {
   const findings = [];
   const patterns = CONTRACT.hostApiUrlPatterns || [];
-  const lines = source.split(/\r?\n/);
+  const ignored = _hostApiUrlIgnoredLines(source);
+  // Comments are blanked first: a comment or JSDoc line quoting
+  // `/api/files/<id>` — exactly the text the docs tell authors NOT to write —
+  // must not become a blocking publish check.
+  const lines = _stripNonCode(source, { keepStrings: true }).split(/\r?\n/);
   for (let i = 0; i < lines.length; i += 1) {
+    if (ignored.has(i + 1)) continue;
     const line = lines[i];
     for (const needle of patterns) {
       if (line.includes(needle)) {
@@ -344,9 +374,14 @@ function _hostApiUrlRules(source) {
           rule: "no-host-api-url",
           severity: "warning",
           label:
-            `source contains "${needle}" — calls to the AppStudio host API ` +
-            `are blocked at runtime (widgets get no JWT token). Use SDK ` +
-            `hooks for workspace data; \`axios\`/\`fetch\` for third-party APIs.`,
+            `source contains "${needle}" — a widget cannot reach the ` +
+            `AppStudio host API: it is never given a JWT, so the call 401s, ` +
+            `and an invented path like /api/files/<id> matches no route at ` +
+            `all. Read workspace data through SDK hooks (a stored file via ` +
+            `useFilestoreFile(id).url — never a URL you build yourself). ` +
+            `\`axios\`/\`fetch\` remain fine for THIRD-PARTY APIs; if one ` +
+            `genuinely needs a relative /api path, add the comment ` +
+            `"${HOST_API_URL_IGNORE}" on or above the line.`,
           line: i + 1,
           snippet: line.trim().slice(0, 200),
         });
@@ -634,6 +669,64 @@ function _reactInScopeRules(source) {
   return findings;
 }
 
+// sc-3466 / sc-3493 — percentage height on an <Image> collapses to 0 against a
+// content-sized parent, so the image loads but renders invisible on both hosts.
+// `severity: "warning"`: the same value is correct under a definite-height
+// parent, which this AST-free scan cannot see. Mirror of linter.js.
+const _IMAGE_TAG_RE = /<(Image|ImageBackground)\b/g;
+const _PERCENT_HEIGHT_RE =
+  /(^|[{,;\s])height\s*:\s*(["'])\s*\d+(?:\.\d+)?\s*%\s*\2/g;
+
+function _jsxOpenTagEnd(source, from) {
+  let depth = 0;
+  let quote = "";
+  for (let i = from; i < source.length; i += 1) {
+    const ch = source[i];
+    if (quote) {
+      if (ch === "\\") i += 1;
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (ch === "{") depth += 1;
+    else if (ch === "}") depth -= 1;
+    else if (ch === ">" && depth <= 0) return i;
+  }
+  return source.length;
+}
+
+function _imagePercentHeightRules(source) {
+  const findings = [];
+  const code = _stripNonCode(source, { keepStrings: true });
+  const sourceLines = source.split(/\r?\n/);
+  _IMAGE_TAG_RE.lastIndex = 0;
+  let tag;
+  while ((tag = _IMAGE_TAG_RE.exec(code))) {
+    const end = _jsxOpenTagEnd(code, tag.index + tag[0].length);
+    const attrs = code.slice(tag.index, end);
+    _PERCENT_HEIGHT_RE.lastIndex = 0;
+    const hit = _PERCENT_HEIGHT_RE.exec(attrs);
+    if (!hit) continue;
+    const line = code.slice(0, tag.index + hit.index).split(/\r?\n/).length;
+    findings.push({
+      rule: "image-percent-height",
+      severity: "warning",
+      label:
+        `<${tag[1]}> sizes its height with a percentage — React Native ` +
+        `resolves that against the PARENT's height, and a content-sized ` +
+        `parent has none, so it collapses to 0: the image loads but is ` +
+        `invisible on BOTH the web Player and the native Expo export. Size ` +
+        `it with aspectRatio (e.g. { width: "100%", aspectRatio: 1 }) or a ` +
+        `numeric pixel height. Warning only — a percentage height is correct ` +
+        `when the parent has a definite height (e.g. a fixed-height hero).`,
+      line,
+      snippet: (sourceLines[line - 1] || "").trim().slice(0, 200),
+    });
+    _IMAGE_TAG_RE.lastIndex = end;
+  }
+  return findings;
+}
+
 // Narrow a split-impl widget's manifest to the platform a single bundle file
 // ships to, so `import-platform-mismatch` lints each file against what it
 // actually targets. Mirror of linter.js.
@@ -694,6 +787,7 @@ function lintSource(source, options) {
   findings.push(..._hostApiUrlRules(source));
   findings.push(..._lucideIconRules(source));
   findings.push(..._reactInScopeRules(source));
+  findings.push(..._imagePercentHeightRules(source));
   findings.push(
     ..._scopeRules(source, options && options.manifest).map((f) => ({
       ...f,

package/dist/linter.js

@@ -70,7 +70,7 @@ const CONTRACT_RULES = CONTRACT.bannedApis.map((b) =>
 // left intact: real code lives there and must still be scanned (`${window}`
 // is a genuine escape). Backslash escapes inside strings/templates are
 // consumed so an escaped quote (`"\""`) doesn't end the literal early.
-function _stripNonCode(source) {
+function _stripNonCode(source, { keepStrings = false } = {}) {
   let out = "";
   const n = source.length;
   let mode = "code"; // code | line | block | sq | dq | tmpl
@@ -85,6 +85,10 @@ function _stripNonCode(source) {
   const blank = (ch) => {
     out += ch === "\n" || ch === "\r" ? ch : " ";
   };
+  // String / template CONTENT: blanked for the banned-identifier scan
+  // (prose must not trip `no-window`), kept for the host-API-URL scan,
+  // whose whole job is to find a URL literal.
+  const str = keepStrings ? keep : blank;
   let i = 0;
   while (i < n) {
     const ch = source[i];
@@ -102,15 +106,15 @@ function _stripNonCode(source) {
         i += 2;
       } else if (ch === "'") {
         mode = "sq";
-        blank(ch);
+        str(ch);
         i += 1;
       } else if (ch === '"') {
         mode = "dq";
-        blank(ch);
+        str(ch);
         i += 1;
       } else if (ch === "`") {
         mode = "tmpl";
-        blank(ch);
+        str(ch);
         i += 1;
       } else if (ch === "{") {
         braceDepth += 1;
@@ -124,7 +128,7 @@ function _stripNonCode(source) {
         ) {
           tmplStack.pop();
           mode = "tmpl";
-          blank(ch);
+          str(ch);
         } else {
           keep(ch);
         }
@@ -154,12 +158,12 @@ function _stripNonCode(source) {
     } else if (mode === "sq" || mode === "dq") {
       const quote = mode === "sq" ? "'" : '"';
       if (ch === "\\") {
-        blank(ch);
-        if (i + 1 < n) blank(nx);
+        str(ch);
+        if (i + 1 < n) str(nx);
         i += 2;
       } else if (ch === quote) {
         mode = "code";
-        blank(ch);
+        str(ch);
         i += 1;
       } else if (ch === "\n") {
         // A bare newline terminates an unterminated string in JS; bail back
@@ -168,18 +172,18 @@ function _stripNonCode(source) {
         keep(ch);
         i += 1;
       } else {
-        blank(ch);
+        str(ch);
         i += 1;
       }
     } else {
       // mode === "tmpl"
       if (ch === "\\") {
-        blank(ch);
-        if (i + 1 < n) blank(nx);
+        str(ch);
+        if (i + 1 < n) str(nx);
         i += 2;
       } else if (ch === "`") {
         mode = "code";
-        blank(ch);
+        str(ch);
         i += 1;
       } else if (ch === "$" && nx === "{") {
         // Enter an expression hole. Remember the brace depth the template
@@ -191,7 +195,7 @@ function _stripNonCode(source) {
         keep(nx);
         i += 2;
       } else {
-        blank(ch);
+        str(ch);
         i += 1;
       }
     }
@@ -204,10 +208,10 @@ function _stripNonCode(source) {
 //
 // REQ-WSDK-PLATFORM: `no-axios-import` is GONE. axios is on the vetted
 // import list now (`CONTRACT.vettedImports`) — widgets may call third-party
-// APIs directly. Calls to the host's own /api/* surface are blocked at
-// runtime by the WidgetContextProvider's network gate; the soft
-// `no-host-api-url` rule below flags obvious host-URL substrings so
-// authors learn the rule statically.
+// APIs directly. Calls to the host's own /api/* surface are not gated at
+// runtime — they simply 401 (widget code never gets the JWT), so the soft
+// `no-host-api-url` rule below is the only thing that catches them, and it
+// flags relative `/api/` literals as well as the real `/api/v1` prefix.
 const EXTRA_RULES = [
   {
     id: "no-auth-store-import",
@@ -369,14 +373,43 @@ function _importRules(source, manifest) {
 }
 
 // REQ-WSDK-PLATFORM §3.5: soft warning when source contains host-API URL
-// substrings. NOT a hard block — false positives are possible (a widget
-// that happens to call a third-party API also located at `/api`). The
-// marketplace review queue surfaces the warning for a human pass.
+// substrings. `severity: "warning"` so a HUMAN-authored submission still
+// publishes and the marketplace review queue flags it for a human pass.
+// sc-3589 — an AI-agent widget has no such review queue, so its publish loop
+// treats every finding (this one included) as a blocking check that drives a
+// repair turn; a lone unrepaired one still publishes with a warning.
+// False positives are possible: the needles are plain substring matches.
+// Explicit opt-out. A widget legitimately calling a THIRD-PARTY API with a
+// relative path against an `axios` baseURL cannot avoid the substring match,
+// and post-sc-3589 an unavoidable finding burns AI repair turns on correct
+// code. The directive may sit on the offending line or the line above it.
+const HOST_API_URL_IGNORE = "appstudio-lint-ignore no-host-api-url";
+
+function _hostApiUrlIgnoredLines(source) {
+  const ignored = new Set();
+  const lines = source.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i];
+    if (!line.includes(HOST_API_URL_IGNORE)) continue;
+    ignored.add(i + 1);
+    // A directive on its OWN line also exempts the line below it. A TRAILING
+    // comment exempts only its own line — otherwise it would silently cover
+    // the next statement, which may be a genuine hand-built host URL.
+    if (/^\s*(\/\/|\/\*|\*)/.test(line)) ignored.add(i + 2);
+  }
+  return ignored;
+}
+
 function _hostApiUrlRules(source) {
   const findings = [];
   const patterns = CONTRACT.hostApiUrlPatterns || [];
-  const lines = source.split(/\r?\n/);
+  const ignored = _hostApiUrlIgnoredLines(source);
+  // Comments are blanked first: a comment or JSDoc line quoting
+  // `/api/files/<id>` — exactly the text the docs tell authors NOT to write —
+  // must not become a blocking publish check.
+  const lines = _stripNonCode(source, { keepStrings: true }).split(/\r?\n/);
   for (let i = 0; i < lines.length; i += 1) {
+    if (ignored.has(i + 1)) continue;
     const line = lines[i];
     for (const needle of patterns) {
       if (line.includes(needle)) {
@@ -384,9 +417,14 @@ function _hostApiUrlRules(source) {
           rule: "no-host-api-url",
           severity: "warning",
           label:
-            `source contains "${needle}" — calls to the AppStudio host API ` +
-            `are blocked at runtime (widgets get no JWT token). Use SDK ` +
-            `hooks for workspace data; \`axios\`/\`fetch\` for third-party APIs.`,
+            `source contains "${needle}" — a widget cannot reach the ` +
+            `AppStudio host API: it is never given a JWT, so the call 401s, ` +
+            `and an invented path like /api/files/<id> matches no route at ` +
+            `all. Read workspace data through SDK hooks (a stored file via ` +
+            `useFilestoreFile(id).url — never a URL you build yourself). ` +
+            `\`axios\`/\`fetch\` remain fine for THIRD-PARTY APIs; if one ` +
+            `genuinely needs a relative /api path, add the comment ` +
+            `"${HOST_API_URL_IGNORE}" on or above the line.`,
           line: i + 1,
           snippet: line.trim().slice(0, 200),
         });
@@ -723,6 +761,82 @@ function _reactInScopeRules(source) {
   return findings;
 }
 
+// sc-3466 / sc-3493 — percentage height on an <Image> collapses to 0.
+// React Native / Yoga resolves a percentage `height` against the PARENT's
+// height; a content-sized parent has none, so the value resolves to 0 and the
+// image fetches its uri but renders invisible on BOTH the web Player and the
+// native Expo export. sc-3466 taught the rule to the AI widget agent's
+// DEFAULT_SYSTEM_PROMPT, which remains the primary guard — this is the
+// mechanical belt-and-braces catch for a model (or a human author) that
+// ignores it.
+//
+// `severity: "warning"` deliberately: `height: "100%"` IS correct inside a
+// parent with a definite height (a fixed-height hero), which the AST-free scan
+// cannot see, so a blocking rule would reject valid widgets.
+//
+// Scope is the literal inline form only. A height threaded through a variable
+// or a StyleSheet object stays out of reach of a text scan.
+const _IMAGE_TAG_RE = /<(Image|ImageBackground)\b/g;
+const _PERCENT_HEIGHT_RE =
+  /(^|[{,;\s])height\s*:\s*(["'])\s*\d+(?:\.\d+)?\s*%\s*\2/g;
+
+// Index of the `>` closing the JSX opening tag that starts at `from`. Braces
+// and string literals are skipped so a `>` inside `onPress={() => …}` or an
+// attribute string can't end the tag early.
+function _jsxOpenTagEnd(source, from) {
+  let depth = 0;
+  let quote = "";
+  for (let i = from; i < source.length; i += 1) {
+    const ch = source[i];
+    if (quote) {
+      if (ch === "\\") i += 1;
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (ch === "{") depth += 1;
+    else if (ch === "}") depth -= 1;
+    else if (ch === ">" && depth <= 0) return i;
+  }
+  return source.length;
+}
+
+function _imagePercentHeightRules(source) {
+  const findings = [];
+  // Comments are blanked (string contents kept) so a commented-out example —
+  // including the one in this rule's own docs — is never flagged.
+  const code = _stripNonCode(source, { keepStrings: true });
+  const sourceLines = source.split(/\r?\n/);
+  _IMAGE_TAG_RE.lastIndex = 0;
+  let tag;
+  while ((tag = _IMAGE_TAG_RE.exec(code))) {
+    const end = _jsxOpenTagEnd(code, tag.index + tag[0].length);
+    const attrs = code.slice(tag.index, end);
+    _PERCENT_HEIGHT_RE.lastIndex = 0;
+    const hit = _PERCENT_HEIGHT_RE.exec(attrs);
+    if (!hit) continue;
+    const line = code.slice(0, tag.index + hit.index).split(/\r?\n/).length;
+    findings.push({
+      rule: "image-percent-height",
+      severity: "warning",
+      label:
+        `<${tag[1]}> sizes its height with a percentage — React Native ` +
+        `resolves that against the PARENT's height, and a content-sized ` +
+        `parent has none, so it collapses to 0: the image loads but is ` +
+        `invisible on BOTH the web Player and the native Expo export. Size ` +
+        `it with aspectRatio (e.g. { width: "100%", aspectRatio: 1 }) or a ` +
+        `numeric pixel height. Warning only — a percentage height is correct ` +
+        `when the parent has a definite height (e.g. a fixed-height hero).`,
+      line,
+      snippet: (sourceLines[line - 1] || "").trim().slice(0, 200),
+    });
+    // One finding per <Image>; a second percentage height on the same tag is
+    // the same defect.
+    _IMAGE_TAG_RE.lastIndex = end;
+  }
+  return findings;
+}
+
 /**
  * Narrow a split-impl widget's manifest to the platform a single bundle file
  * ships to, so `import-platform-mismatch` lints each file against what it
@@ -790,6 +904,8 @@ export function lintSource(source, options) {
   findings.push(..._lucideIconRules(source));
   // sc-2353 — widget source must be self-contained (reference React ⇒ import it).
   findings.push(..._reactInScopeRules(source));
+  // sc-3493 — soft warning: percentage height on an <Image> collapses to 0.
+  findings.push(..._imagePercentHeightRules(source));
   // REQ-USERMGMT / REQ-ACL-SYS M3 — scope-aware rules. Run after the
   // line-by-line scan so banned-identifier findings stay first in the
   // output.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.64.0",
+  "version": "0.66.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "type": "module",
   "main": "./dist/index.js",
@@ -48,7 +48,7 @@
   ],
   "scripts": {
     "build": "node scripts/build.js",
-    "test": "node --test src/__tests__/contract.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-subscription.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js"
+    "test": "node --test src/__tests__/contract.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-subscription.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js"
   },
   "engines": {
     "node": ">=18"