@colixsystems/widget-sdk 0.77.0 → 0.79.0

package/README.md

@@ -22,9 +22,11 @@ The data layer lives in **four separate domain-client packages**, each instantia
 | **CORE** | `useUser()` | `{ id, email, displayName, roles, groupIds }` | `ctx.user` (host-built context, **camelCase** — not a wire payload; `id` null when anonymous) — no scope |
 | **CORE** | `useNavigation()` | `{ goTo, goBack, push, replace, back, currentRoute }` | `ctx.navigation` — no scope (external URLs use the `Linking` primitive) |
 | **CORE** | `useRouteParams()` | `{ [paramKey]: value }` | `ctx.navigation.currentRoute.params` — no scope. The nav params the previous page passed via `goTo(pageId, params)`; the flat accessor for master→detail (read `recordId` on a detail page). Empty object when none. |
+| **CORE** | `usePageContext()` | `{ params, records }` | `ctx.pageContext` — no scope. The page's DECLARED parameters, resolved once by the host: `params` are coerced to their declared types, `records` holds the row already fetched for each `record` param (read it instead of fetching again). Both empty when the page declares none. |
 | **CORE** | `useWidgetEvent(name)` | `(payload?) => void` | `ctx.events.emit` — no scope |
 | **CORE** | `useChildRenderer()` | `{ renderNode(node) }` | `ctx.renderer` — no scope (prefer the `WidgetTree` component) |
 | **CORE** | `useFill()` | `boolean` | `ctx.fill` — no scope. `true` when the host sized this widget to fill its page-grid tile's reserved height (containers + media fill by default; the author can override per tile). Media-style widgets switch to a `flex: 1` / `height: "100%"` layout; others ignore it. Defaults `false`. |
+| **CORE** | `useSectionEmpty(isEmpty)` | `void` | `ctx.section.reportEmpty` — no scope. Declares that the widget has NO content to show, so the host drops its layout slot instead of reserving space (and its parent's `gap`) for it. Returning `null` is not enough: the host wraps every widget in an entrance element, so a widget rendering nothing still leaves an empty box the parent stack gaps around. For a CONDITIONALLY ABSENT section (a per-record child collection with no rows for this record), never to suppress a genuine empty state. Stays mounted while collapsed, so passing `false` brings it back. Authoring surfaces never collapse. No-op on a host that doesn't implement it. |
 | **CORE** | `useRefresh(handler)` | `void` | `ctx.refresh.subscribe` — no scope. Subscribes the handler to the page-level refresh tick (pull-to-refresh on mobile). Handler may return a Promise — the host waits for `allSettled` before clearing the spinner. The three datastore hooks auto-subscribe their own `refetch`; widgets only call this directly to re-run non-datastore work. No-op on a host that doesn't implement refresh. |
 | **CORE** | `useClipboard()` | `{ copy, paste, hasContent }` | platform clipboard (web `navigator.clipboard` / native `expo-clipboard`); rejects with `ClipboardError` — no scope |
 | **CORE** | `useToast()` | `{ showToast }` | `ctx.toast.showToast` (falls back to a CustomEvent / console) — no scope |
@@ -45,6 +47,7 @@ The data layer lives in **four separate domain-client packages**, each instantia
 | **FILESTORE** (`ctx.filestore`) | `usePdfExport({ spaceType, folderId? })` | `{ exportToPdf, exporting, error, lastExported }` | `ctx.filestore.files.exportPdf` — `files.write:*`. `exportToPdf(html, { fileName?, folderId? })` renders the HTML to a PDF server-side and saves it as a file (`application/pdf`); same server-side renderer on web + native. |
 | **PAYMENTS** (`ctx.payments`) | `usePayments()` | `{ requestPayment, getPayment }` | `ctx.payments.*` — `payments.charge:appUser` |
 | **NOTIFICATIONS** (`ctx.notifications`) | `useSendNotification()` | `{ send, sending, error }` | `ctx.notifications.send` — `notifications.send:appUser`. `send({ recipient_user_id, title, body, link?, payload? })` notifies one app user in the same workspace; call from an event handler (never render); rejects with `NotificationError`. |
+| **IDENTIFICATION** (`ctx.identification`) | `useIdentification({ provider?, purpose?, pollIntervalMs? })` | `{ available, status, qr, autoStartToken, message, identity, identificationId, start, refresh, cancel, reset, … }` | `ctx.identification.*` — no scope (the visitor is deliberately NOT signed in). Gate the UI on `available`; `start()` opens the order and the hook polls to completion. `identity` carries `personal_number_masked` + a stable `subject_hash` — never a raw personal number. |
 
 All list calls return the `{ data, meta }` envelope; the read hooks unwrap `res.data` for you. There is no `useWorkspace()` or `useLogger()` hook — read the theme via `useTheme()` and the locale via `useI18n()`; the host logger lives on `ctx.logger` (`{ debug, info, warn, error }`).
 
@@ -56,6 +59,20 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 `v0.77.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
 
+### What's new in 0.78.0
+
+**New `useIdentification()` hook — identify a visitor who is NOT signed in (REQ-IDENT, sc-4313).** A new IDENTIFICATION hook reading a newly-injected `ctx.identification` slice (the new `@colixsystems/identification-client`, constructed by both the web Player and the native Expo export). Returns `{ available, availabilityLoading, status, qr, autoStartToken, message, identity, identificationId, loading, error, start, refresh, cancel, reset }`.
+
+It exists to **prove presence and keep the result** — an attestation on a record, a consent line, an identity check before a submit. It creates **no account and no session**: to sign someone *in* use the app's login, to attach BankID to an existing account use `useBankIdLink()`, and to e-sign a file's bytes use `useFileSignature()`.
+
+**BankID is the first provider**, and the API is provider-abstracted — a future provider becomes available without a widget change (`options.provider` defaults to `"bankid"`).
+
+Gate the UI on `available`: when it is `false` the provider is not configured on the deployment and no QR can ever complete, so render nothing rather than a dead button. `start()` opens an order and **the hook polls it to completion for you** (`pollIntervalMs`, default `1000`; pass `0` to drive `refresh()` yourself), clearing its timer on unmount — a widget renders state instead of owning a loop. Render `qr` with the `Image` primitive and show `message` (a display-ready instruction); `autoStartToken` opens the provider app on the same device.
+
+**No raw personal number is reachable from a widget.** On completion `identity` is `{ provider, name, given_name, surname, personal_number_masked, subject_hash, identified_at }` — `personal_number_masked` is `"19900101-****"` and `subject_hash` is stable for the same person, so a returning visitor is recognisable without the number. The full value stays server-side behind a studio-admin endpoint, so it can never end up in page JSON or a datastore column by accident. Write the masked string (and `identificationId`, to trace the proof) into your column.
+
+`options.purpose` is a short audit label ("attest", "age_check"), capped at 120 characters. Orders expire five minutes after `start()`. It needs **no manifest scope** and **no `requestedScopes` entry** — requiring one would defeat a flow whose whole point is an anonymous visitor. Rejections surface as a structured `IdentificationError` (new named export) with a stable `.code` (`NOT_CONFIGURED` / `UNKNOWN_PROVIDER` / `NOT_FOUND` / `RATE_LIMITED` / `UNAVAILABLE` / `INTERNAL`). `CONTRACT.version` → `1.52.0`. Additive — one new hook, one new context slice, one new error class, one new client package; no existing export changed signature.
+
 ### What's new in 0.77.0
 
 **`ui.group` is a layout hint, not a visibility rule (sc-4176).** 0.75.0 gave `"Basics"` a reserved meaning: Agent Mode's in-preview edit panel rendered only that group and pointed the author at the Builder for the rest. That withheld styling from an author already editing the widget in front of them, so the reserved behaviour is **retired**.
@@ -285,6 +302,8 @@ useEffect(() => {
 
 ### What's new in 0.41.0
 
+**New `useSectionEmpty(isEmpty)` hook + optional `ctx.section` slice (sc-4416).** A widget can now tell the host it has no content to show, and the host removes its layout slot rather than reserving space for it. This closes a gap that `null` alone could not: the host wraps every widget node in an entrance element, so a widget that rendered nothing still left an empty box its parent stack put `gap` around — a dead band of whitespace exactly where the content would have been. It matters most for a per-record child collection (a policy detail page whose quiz section only exists for policies that have questions): the widget owns the rows, so only the widget can say, and `visibleWhen` cannot reach it because "has related rows" is not a field the record carries. The widget stays MOUNTED while collapsed, so when rows arrive it reports `false` and the section returns on its own — no measurement, no second pass. The slot (`ctx.section.reportEmpty`) is optional and deliberately omitted on authoring surfaces: on the Studio canvas and in the Agent Mode edit preview an empty widget must stay visible and selectable, or an absent section could never be edited. Additive — `CONTRACT.version` bumped to the next minor for a new hook plus a new optional context slice.
+
 **New `useRefresh(handler)` hook + page-level refresh signal (sc-1179).** Pull-to-refresh on the mobile web Player + the native Expo export's `RefreshControl` now fans a page-level refresh tick out to every widget on the page. The three datastore hooks — `useDatastoreQuery`, `useDatastoreRecord`, `useAsset` — auto-subscribe their own `refetch`, so a widget built on those hooks gets refreshed for free. Widgets that need to re-run other work (a third-party `fetch`, a derived calculation) call `useRefresh(async () => { … })` directly. The handler may return a Promise — the host waits on `Promise.allSettled` of every subscriber before clearing the spinner. The slot (`ctx.refresh.subscribe`) is optional on the WidgetContext: a host that does not implement refresh (the Studio canvas preview) simply omits it and the hook collapses to a no-op. Additive — `CONTRACT.version` bumped to the next minor since the contract grew a new hook + a new (optional) context slice.
 
 ### What's new in 0.40.2
@@ -522,6 +541,7 @@ The "split-implementation + vetted package list" pivot.
 ### What's new in 0.11.0
 
 - **`useNavigation()` is wired.** Returns the host-provided navigation surface `{ goTo, goBack, push, replace, back, currentRoute }` for internal page-to-page navigation. Missing methods degrade to no-ops on the Studio canvas preview. Additive.
+- **`usePageContext()` reads the page's DECLARED parameters.** When a page declares parameters (Page Settings → Parameters), the host resolves them ONCE before any widget renders and fetches each `record` parameter's row for the whole page. `params` holds the values coerced to their declared types (a `number` parameter is a number, not the string `useRouteParams()` returns); `records` maps each `record` parameter to its already-loaded row — read it rather than issuing the same request from every widget. A required parameter that is absent, malformed, or whose record does not resolve never reaches the widget: the host renders one page-level state instead. Both bags are empty on a page that declares nothing, so fall back to `useRouteParams()` for a page you do not control. Additive (v0.77.0).
 - **`useRouteParams()` reads the nav params.** Returns `currentRoute.params` — the bag a `goTo(pageId, params)` carried to this page. The flat accessor for master→detail: navigate with `goTo(detailPageId, { recordId: row.id })`, then read `const { recordId } = useRouteParams()`. It is an OBJECT — read a param off it, never call it. Empty object when the page was opened without params. Additive (v0.61.0).
 - **`Linking` primitive re-exported.** `Linking.openURL(url)` opens an external URL with the OS handler — web (`react-native-web`) maps to `window.open` / `location.href`; native hands off to the system. Use this for external URLs; use `useNavigation().goTo(pageId)` for internal pages.
 
@@ -595,7 +615,7 @@ import { defineWidget, validateManifest, useDatastoreQuery, Text, View } from "@
 
 - `defineWidget({ manifest, component })` — validates the manifest and produces a widget module the host can register.
 - `validateManifest(m)` / `validatePropertySchema(s)` / `validateProps(schema, props)` — shape validation; no third-party deps.
-- `useDatastoreQuery`, `useDatastoreRecord`, `useDatastoreSchema`, `useDatastoreMutation`, `useDirectory`, `useUsers`, `useGroups`, `useRecordPermissions`, `useAsset`, `useWidgetEvent`, `usePayments`, `useSendNotification`, `useTheme`, `useI18n`, `useUser`, `useNavigation`, `useRouteParams`, `useChildRenderer`, `useClipboard`, `useToast` — hooks that read from the host-provided `WidgetContext` (or, for `useClipboard`, the platform clipboard API directly). `useDirectory(query?)` returns `{ users, loading, error, refetch }` (each user `{ id, name, role }`) and requires the `directory.read:users` scope. `useUsers(query?)` returns `{ users, loading, error, refetch, invite, deactivate, reactivate, remove }` and requires `users.read:*` (mutations also need `users.write:*`); rejections are a `DirectoryError`. `useGroups(query?)` returns `{ groups, loading, error, refetch, create, remove, addMember, removeMember }` and requires `groups.read:*` (mutations also need `groups.write:*`). `usePayments()` returns `{ requestPayment, getPayment }` and requires the `payments.charge:appUser` scope; `requestPayment(...)` rejects with a `PaymentError`. `useSendNotification()` returns `{ send, sending, error }` and requires the `notifications.send:appUser` scope; `send({ recipient_user_id, title, body, link?, payload? })` notifies one app user in the same workspace (cross-workspace `recipient_user_id` is rejected), must be called from an event handler rather than render, and rejects with a `NotificationError`. `useUser()` returns the active end-user identity `{ id, email, displayName, roles, groupIds }` (camelCase — the host-built context object, not a wire payload; `id` is `null` for anonymous / preview). `useNavigation()` returns `{ goTo, goBack, push, replace, back, currentRoute }` for internal page navigation — for external URLs use the `Linking` primitive (`Linking.openURL(url)`). `useRouteParams()` returns the current route's params object (`currentRoute.params`) — the flat master→detail accessor; read a param off it (e.g. `recordId`), never call it. `useDatastoreRecord(tableId, recordId)` returns `{ data, loading, error, refetch }` for a single record (data is one row or null). `useDatastoreSchema(tableId)` returns `{ schema, loading, error, refetch }` where `schema` is `{ id, name, columns: [{ id, name, data_type, required, relation_type, target_table_id, is_identification }] }` (structure only, no row data; snake_case verbatim) — use it to resolve a stored `columnId` to its column type at runtime; requires the `datastore.read:<table>` scope. `useAsset(fileId)` returns `{ url, file, loading, error, refetch }` — the `url` is an absolute URL composed against the host's API base. `useChildRenderer()` returns `{ renderNode(node) }` — container widgets call it to render arbitrary child page-tree nodes (prefer the `WidgetTree` component for the common case).
+- `useDatastoreQuery`, `useDatastoreRecord`, `useDatastoreSchema`, `useDatastoreMutation`, `useDirectory`, `useUsers`, `useGroups`, `useRecordPermissions`, `useAsset`, `useWidgetEvent`, `usePayments`, `useSendNotification`, `useTheme`, `useI18n`, `useUser`, `useNavigation`, `useRouteParams`, `usePageContext`, `useChildRenderer`, `useClipboard`, `useToast` — hooks that read from the host-provided `WidgetContext` (or, for `useClipboard`, the platform clipboard API directly). `useDirectory(query?)` returns `{ users, loading, error, refetch }` (each user `{ id, name, role }`) and requires the `directory.read:users` scope. `useUsers(query?)` returns `{ users, loading, error, refetch, invite, deactivate, reactivate, remove }` and requires `users.read:*` (mutations also need `users.write:*`); rejections are a `DirectoryError`. `useGroups(query?)` returns `{ groups, loading, error, refetch, create, remove, addMember, removeMember }` and requires `groups.read:*` (mutations also need `groups.write:*`). `usePayments()` returns `{ requestPayment, getPayment }` and requires the `payments.charge:appUser` scope; `requestPayment(...)` rejects with a `PaymentError`. `useSendNotification()` returns `{ send, sending, error }` and requires the `notifications.send:appUser` scope; `send({ recipient_user_id, title, body, link?, payload? })` notifies one app user in the same workspace (cross-workspace `recipient_user_id` is rejected), must be called from an event handler rather than render, and rejects with a `NotificationError`. `useUser()` returns the active end-user identity `{ id, email, displayName, roles, groupIds }` (camelCase — the host-built context object, not a wire payload; `id` is `null` for anonymous / preview). `useNavigation()` returns `{ goTo, goBack, push, replace, back, currentRoute }` for internal page navigation — for external URLs use the `Linking` primitive (`Linking.openURL(url)`). `useRouteParams()` returns the current route's params object (`currentRoute.params`) — the flat master→detail accessor; read a param off it (e.g. `recordId`), never call it. `useDatastoreRecord(tableId, recordId)` returns `{ data, loading, error, refetch }` for a single record (data is one row or null). `useDatastoreSchema(tableId)` returns `{ schema, loading, error, refetch }` where `schema` is `{ id, name, columns: [{ id, name, data_type, required, relation_type, target_table_id, is_identification }] }` (structure only, no row data; snake_case verbatim) — use it to resolve a stored `columnId` to its column type at runtime; requires the `datastore.read:<table>` scope. `useAsset(fileId)` returns `{ url, file, loading, error, refetch }` — the `url` is an absolute URL composed against the host's API base. `useChildRenderer()` returns `{ renderNode(node) }` — container widgets call it to render arbitrary child page-tree nodes (prefer the `WidgetTree` component for the common case).
 - `WidgetTree({ node })` — component that renders an author-authored child node through the host's renderer; used by Tabs / Card / custom containers to host arbitrary child widgets.
 - `Text`, `View`, `Pressable`, `Image`, `ScrollView`, `TextInput`, `FlatList`, `SectionList`, `ActivityIndicator`, `Switch`, `StyleSheet`, `Linking`, `Icon`, `DateTimePicker` — re-exported from `react-native` (the RN primitives) or implemented in the SDK (`Icon` wraps `lucide-react-native`; `DateTimePicker` wraps `@react-native-community/datetimepicker` on native and renders `<input type="date|time|datetime-local">` directly on web because the RN library has no react-native-web mapping). The web build aliases `react-native` to `react-native-web` so the RN-re-exported primitives render in the browser without any per-platform code; the exported Expo app's Metro bundler resolves the real `react-native` library. `Linking` is a static API (`Linking.openURL(url)`) — use it for external URLs, and use `useNavigation().goTo(pageId)` for internal page navigation. See https://reactnative.dev/docs/ for per-component props.
 - `WidgetContextProvider` — React context provider that the host (Studio, Player, exported app) wraps widgets with.
@@ -613,7 +633,7 @@ A widget that works but looks unfinished is only half done. `useTheme()` is the
 - **Tint the supporting cast.** `colors.primarySoft` is a tint of the workspace accent over the surface and `colors.onPrimarySoft` is guaranteed readable on it (WCAG AA, on light and dark themes alike). Use the pair for chips, secondary buttons, progress tracks, icon badges and selected rows. One saturated accent moment surrounded by several pale echoes of the same hue is what reads as designed — a row of grey-outlined buttons reads as a form. Never hand-mix a tint with `rgba(...)` or a translucent overlay.
 - **Spend one gradient.** `<Gradient colors={[theme.colors.primary, theme.colors.primaryStrong]} angle={160} style={…}>` is a `View` that paints a gradient behind its children, so it replaces the `View` you'd otherwise give a flat `backgroundColor`. `angle` is CSS degrees (0 = to top, 90 = to right, default 180); text on it uses `colors.onPrimary`. Exactly **one** per widget — on the focal element — and never behind body text. Both hosts render it identically (web paints CSS, native uses `expo-linear-gradient`), so there is no per-platform branching to write; don't import `expo-linear-gradient` yourself and don't write a `backgroundImage` string.
 - **Size to your container — measure it, don't stretch into it.** The same widget sits in a full-width desktop section (~1400px), a half-width grid cell (~700px) and a phone (~360px), so layout built only from `flex: 1` stretches to fill whatever it is handed — a month calendar ends up with 200px day cells and swallows the page. Measure your own width with `onLayout={(e) => setWidth(e.nativeEvent.layout.width)}` on the root `View` (a React Native primitive, so it behaves identically on both hosts), render nothing size-dependent while `width === 0`, and compute every threshold from the measured value: a widget gets no declared breakpoint prop, but it can always measure. **Cap a repeating cell** rather than giving a grid `flex: 1` — `const cell = Math.max(32, Math.min(Math.floor((usable - gap * (columns - 1)) / columns), 64));`, with a calendar day cell topping out at 56–72px on `aspectRatio: 1`, and the grid given its exact computed width plus `alignSelf: 'center'` when the cap leaves slack. **Split two co-equal surfaces above ~720px measured width** (`flexDirection: width >= 720 ? 'row' : 'column'`, each half `{ flex: 1, minWidth: 0 }`) — a picker beside the form it feeds on a wide canvas, stacked in reading order below it. Never hardcode a width, never put `flex: 1` / `height: '100%'` on a content widget's root, and don't read the screen with `Dimensions` — the screen is not the widget.
-- **Compose forms — pair fields into rows, don't stack one per row.** Put short, related fields side by side (first + last name, city + postal code, expiry + CVC): a row of `{ flexDirection: 'row', flexWrap: 'wrap', gap: theme.spacing.md }` with each field cell `{ flexGrow: 1, flexBasis: 160 }` splits the width on a wide card and wraps to stacked on a narrow phone — the right recipe for field pairs because it needs no measurement (a fixed-width column overflows a phone; when a layout needs a real column count instead of wrapping, measure your width as above). Keep wide fields (email, address, notes) full-width, cap it at two–three per row, group a long form into labelled sections, and label every input above it (not placeholder-only).
+- **Compose forms — pair fields into rows, don't stack one per row.** Put short, related fields side by side (first + last name, city + postal code, expiry + CVC): a row of `{ flexDirection: 'row', flexWrap: 'wrap', gap: theme.spacing.md }` with each field cell `{ flexGrow: 1, flexBasis: 160 }` splits the width on a wide card and wraps to stacked on a narrow phone — the right recipe for field pairs because it needs no measurement (a fixed-width column overflows a phone; when a layout needs a real column count instead of wrapping, measure your width as above). Keep wide fields (email, address, notes) full-width, cap it at two–three per row, group a long form into labelled sections, and label every input above it (not placeholder-only). Give a `multiline` field BOTH a floor and a ceiling (`{ minHeight: 150, maxHeight: 260 }`) so a long value scrolls inside the box instead of growing past its card, and keep the Save / Cancel row in normal flow below the fields, never positioned over them.
 - **Respond to touch.** Give every `Pressable` a pressed state via the function-style `style={({ pressed }) => [base, pressed && { opacity: 0.7 }]}`.
 - **Drag and drop — show what is being dragged.** A drag where the item stays put reads as broken. Three things change the moment a drag starts: the **drag proxy** (the item lifts and follows the finger — `...theme.elevation.lg`, `{ scale: 1.03 }`, `opacity: 0.9`; for a tall or full-width item drag a compact `primarySoft` pill with its icon + one line of label instead), the **source placeholder** (the vacated slot keeps its height as a quiet `colors.surfaceMuted` block so the list doesn't collapse), and the **drop target** (one slot at a time highlighted with `primarySoft` or a 2px `colors.primary` border). Always animate the release — settle into the new slot, or `Animated.spring(pan, { toValue: { x: 0, y: 0 }, useNativeDriver: false })` back to the origin on cancel. Build it with `Animated` + `PanResponder` from `react-native` (the only mechanism that behaves identically on both hosts) — never HTML5 drag events (`draggable` / `onDragStart` / `dataTransfer` are web-only, and `document` / `window` are banned) — and start the drag from a `GripVertical` grip handle whenever the row is also tappable or sits in a `ScrollView`.
 - **Use icons for clarity.** Pair a `lucide-react-native` icon with its label at a consistent size, coloured from the theme. The label never repeats the icon as a character — with a `Plus` icon the button says "Add item", never "+ Add item" (that renders a doubled plus).

package/dist/contract.cjs

@@ -358,6 +358,29 @@ const HOOKS = [
     requiredContextSlice: ["refresh.subscribe"],
     scopes: null,
   },
+  {
+    name: "useSectionEmpty",
+    signature: "useSectionEmpty(isEmpty)",
+    description:
+      "Declare that this widget currently has NO content to show, so the host " +
+      "removes its layout slot instead of reserving space for it. Returning " +
+      "null is NOT enough on its own: the host wraps every widget node in an " +
+      "entrance wrapper, so a widget that renders nothing still leaves an " +
+      "empty box its parent stack puts `gap` around — a dead band of " +
+      "whitespace where the content would have been. Only the widget has the " +
+      "rows, so only the widget can say. Use it for a CONDITIONALLY ABSENT " +
+      "section (a per-record child collection with no rows for the record " +
+      "being viewed), never to suppress a genuine empty state a user is " +
+      "expected to fill. The widget stays mounted while collapsed, so passing " +
+      "false later brings the section back. Authoring surfaces (Studio canvas, " +
+      "Agent Mode edit preview) never collapse, so an absent section stays " +
+      "editable. Safe on a host that does not implement it — a no-op there.",
+    returnShape: {
+      "(returns)": "void",
+    },
+    requiredContextSlice: ["section.reportEmpty"],
+    scopes: null,
+  },
   {
     name: "useNavigation",
     signature: "useNavigation()",
@@ -382,6 +405,18 @@ const HOOKS = [
     requiredContextSlice: ["navigation"],
     scopes: null,
   },
+  {
+    name: "usePageContext",
+    signature: "usePageContext()",
+    returnShape: {
+      params:
+        "the page's DECLARED parameters, coerced to their declared types (a number param is a number here, not the string useRouteParams() returns). Empty when the page declares none.",
+      records:
+        "<paramName> → the row the HOST already fetched for a `record` parameter. Read it instead of fetching the same record again; empty when the page declares none.",
+    },
+    requiredContextSlice: ["pageContext"],
+    scopes: null,
+  },
   {
     name: "useDatastoreRecord",
     signature: "useDatastoreRecord(tableId, recordId)",
@@ -834,6 +869,55 @@ const HOOKS = [
     requiredContextSlice: ["directory.bankid"],
     scopes: null,
   },
+  // REQ-IDENT (sc-4313) — identify a visitor who is NOT signed in and keep the
+  // result. Anonymous by design (no widget scope, no session). Mirror of contract.js.
+  {
+    name: "useIdentification",
+    signature: "useIdentification(options?)",
+    description:
+      "Identify a visitor who is NOT signed in via the injected " +
+      "identification-client at ctx.identification.{available,start,get,cancel}. " +
+      "Returns { available, availabilityLoading, status, qr, autoStartToken, " +
+      "message, identity, identificationId, loading, error, start, refresh, " +
+      "cancel, reset }. USE IT TO PROVE PRESENCE AND KEEP THE RESULT — an " +
+      "attestation on a record, a consent line, an identity check before a " +
+      "submit. It creates NO account and NO session: to sign someone IN use the " +
+      "app's login, to attach BankID to an existing account use useBankIdLink(), " +
+      "to e-sign a file use useFileSignature(). On mount it reads provider " +
+      "availability; `available` is false when identification can't be used here " +
+      "(provider not configured) — render nothing rather than a dead button. " +
+      "start() opens an order (status 'pending' + qr, a PNG data-URL to render " +
+      "with the Image primitive) and the hook then POLLS to completion itself " +
+      "(pollIntervalMs, default 1000; pass 0 to drive refresh() yourself); " +
+      "cancel() aborts; reset() clears the flow. autoStartToken opens the " +
+      "provider app on the SAME device (bankid:///?autostarttoken=<token>" +
+      "&redirect=null). On complete, `identity` is { provider, name, given_name, " +
+      "surname, personal_number_masked, subject_hash, identified_at } — there is " +
+      "NO raw personal number by design: write personal_number_masked " +
+      "(\"19900101-****\") and, if you need to trace the proof, identificationId. " +
+      "subject_hash is stable per person so a returning visitor is recognisable " +
+      "without the number. `options.purpose` is a short audit label capped at 120 " +
+      "chars. Orders expire 5 minutes after start(). No requestedScopes entry needed.",
+    returnShape: {
+      available: "boolean  // false → don't offer the flow",
+      availabilityLoading: "boolean",
+      status: "'pending' | 'complete' | 'failed' | 'cancelled' | null",
+      qr: "string | null  // PNG data-URL of the animated QR",
+      autoStartToken: "string | null  // same-device deeplink token",
+      message: "string | null  // display-ready instruction for this step",
+      identity:
+        "{ provider, name, given_name, surname, personal_number_masked, subject_hash, identified_at } | null",
+      identificationId: "string | null  // store alongside an attestation",
+      loading: "boolean",
+      error: "IdentificationError | null",
+      start: "() => Promise<{ identification_id, status, qr, auto_start_token, expires_at }>",
+      refresh: "() => Promise<void>",
+      cancel: "() => Promise<void>",
+      reset: "() => void",
+    },
+    requiredContextSlice: ["identification"],
+    scopes: null,
+  },
   // REQ-ACL-06 / REQ-ACL-RELINHERIT-05 — per-record VirtualPermission
   // management for a single record. Mirror of contract.js.
   {
@@ -1306,6 +1390,16 @@ const WIDGET_CONTEXT_SHAPE = {
     required: true,
     fields: { push: "function", replace: "function", back: "function" },
   },
+  pageContext: {
+    description:
+      "REQ-NAV-05 — the PAGE's resolved parameters. " +
+      "{ params: { <name>: value }, records: { <name>: Record|null } }. " +
+      "`params` are the page's DECLARED parameters coerced to their declared types (a number param is a number, not the string useRouteParams() returns). " +
+      "`records` holds the row the HOST already fetched for each `record` parameter — read it instead of fetching the same record again. " +
+      "Both bags are empty on a page that declares no parameters. Backs usePageContext().",
+    required: true,
+    fields: { params: "object", records: "object" },
+  },
   datastore: {
     description:
       "Injected @colixsystems/datastore-client instance. " +
@@ -1367,6 +1461,21 @@ const WIDGET_CONTEXT_SHAPE = {
     required: false,
     fields: { subscribe: "function" },
   },
+  // sc-4416 — widget -> host emptiness signal. The widget owns the knowledge
+  // (it has the rows); the host owns the spacing (the slot and its gap).
+  // Optional so an AUTHORING host can omit it on purpose: with no slice the
+  // hook is a no-op and an empty widget stays visible and selectable on the
+  // Studio canvas and in the Agent Mode edit preview.
+  section: {
+    description:
+      "Optional layout-slot slot. { reportEmpty(isEmpty) }. Called by the " +
+      "widget when it has no content to show; the host then drops the node's " +
+      "layout slot so its parent stack puts no gap around it. Backs " +
+      "useSectionEmpty(). Omitted on authoring surfaces, where an empty " +
+      "widget must stay visible.",
+    required: false,
+    fields: { reportEmpty: "function" },
+  },
   events: {
     description: "{ emit(name, payload) }.",
     required: true,
@@ -1385,6 +1494,13 @@ const WIDGET_CONTEXT_SHAPE = {
     required: true,
     fields: { send: "function" },
   },
+  // REQ-IDENT (sc-4313) — backs useIdentification(). Mirror of contract.js.
+  identification: {
+    description:
+      "Injected @colixsystems/identification-client instance (REQ-IDENT). { available() -> Promise<{ available, providers }>, start(body) -> Promise<order>, get(id) -> Promise<state>, cancel(id) -> Promise<state> }. Backs useIdentification(); no widget scope and no signed-in user required — identifying a NOT-signed-in visitor is the point, so the endpoints are anonymous. Bodies and rows are snake_case verbatim. A completed identification exposes name + personal_number_masked + a stable subject_hash; the RAW personal number is never reachable from a widget (it lives behind a studio-admin endpoint).",
+    required: true,
+    fields: { available: "function", start: "function", get: "function", cancel: "function" },
+  },
   // REQ-WSDK-DOMAIN-CLIENTS — the AppUser administration, AppUserGroup
   // administration, and per-record VirtualPermission facades that used to
   // live here (`users`, `groups`, `recordPermissions`) were folded into the
@@ -2290,7 +2406,7 @@ const CONTRACT = deepFreeze({
   //    public endpoint instead, which skips the cache, the metering and the
   //    workspace's provider. Publishing the host list here keeps the linter,
   //    the Developer guide and the agent prompt reading one source.
-  version: "1.51.0",
+  version: "1.53.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/contract.js

@@ -358,6 +358,29 @@ const HOOKS = [
     requiredContextSlice: ["refresh.subscribe"],
     scopes: null,
   },
+  {
+    name: "useSectionEmpty",
+    signature: "useSectionEmpty(isEmpty)",
+    description:
+      "Declare that this widget currently has NO content to show, so the host " +
+      "removes its layout slot instead of reserving space for it. Returning " +
+      "null is NOT enough on its own: the host wraps every widget node in an " +
+      "entrance wrapper, so a widget that renders nothing still leaves an " +
+      "empty box its parent stack puts `gap` around — a dead band of " +
+      "whitespace where the content would have been. Only the widget has the " +
+      "rows, so only the widget can say. Use it for a CONDITIONALLY ABSENT " +
+      "section (a per-record child collection with no rows for the record " +
+      "being viewed), never to suppress a genuine empty state a user is " +
+      "expected to fill. The widget stays mounted while collapsed, so passing " +
+      "false later brings the section back. Authoring surfaces (Studio canvas, " +
+      "Agent Mode edit preview) never collapse, so an absent section stays " +
+      "editable. Safe on a host that does not implement it — a no-op there.",
+    returnShape: {
+      "(returns)": "void",
+    },
+    requiredContextSlice: ["section.reportEmpty"],
+    scopes: null,
+  },
   {
     name: "useNavigation",
     signature: "useNavigation()",
@@ -382,6 +405,18 @@ const HOOKS = [
     requiredContextSlice: ["navigation"],
     scopes: null,
   },
+  {
+    name: "usePageContext",
+    signature: "usePageContext()",
+    returnShape: {
+      params:
+        "the page's DECLARED parameters, coerced to their declared types (a number param is a number here, not the string useRouteParams() returns). Empty when the page declares none.",
+      records:
+        "<paramName> → the row the HOST already fetched for a `record` parameter. Read it instead of fetching the same record again; empty when the page declares none.",
+    },
+    requiredContextSlice: ["pageContext"],
+    scopes: null,
+  },
   {
     name: "useDatastoreRecord",
     signature: "useDatastoreRecord(tableId, recordId)",
@@ -834,6 +869,55 @@ const HOOKS = [
     requiredContextSlice: ["directory.bankid"],
     scopes: null,
   },
+  // REQ-IDENT (sc-4313) — identify a visitor who is NOT signed in and keep the
+  // result. Anonymous by design (no widget scope, no session). Mirror of contract.cjs.
+  {
+    name: "useIdentification",
+    signature: "useIdentification(options?)",
+    description:
+      "Identify a visitor who is NOT signed in via the injected " +
+      "identification-client at ctx.identification.{available,start,get,cancel}. " +
+      "Returns { available, availabilityLoading, status, qr, autoStartToken, " +
+      "message, identity, identificationId, loading, error, start, refresh, " +
+      "cancel, reset }. USE IT TO PROVE PRESENCE AND KEEP THE RESULT — an " +
+      "attestation on a record, a consent line, an identity check before a " +
+      "submit. It creates NO account and NO session: to sign someone IN use the " +
+      "app's login, to attach BankID to an existing account use useBankIdLink(), " +
+      "to e-sign a file use useFileSignature(). On mount it reads provider " +
+      "availability; `available` is false when identification can't be used here " +
+      "(provider not configured) — render nothing rather than a dead button. " +
+      "start() opens an order (status 'pending' + qr, a PNG data-URL to render " +
+      "with the Image primitive) and the hook then POLLS to completion itself " +
+      "(pollIntervalMs, default 1000; pass 0 to drive refresh() yourself); " +
+      "cancel() aborts; reset() clears the flow. autoStartToken opens the " +
+      "provider app on the SAME device (bankid:///?autostarttoken=<token>" +
+      "&redirect=null). On complete, `identity` is { provider, name, given_name, " +
+      "surname, personal_number_masked, subject_hash, identified_at } — there is " +
+      "NO raw personal number by design: write personal_number_masked " +
+      "(\"19900101-****\") and, if you need to trace the proof, identificationId. " +
+      "subject_hash is stable per person so a returning visitor is recognisable " +
+      "without the number. `options.purpose` is a short audit label capped at 120 " +
+      "chars. Orders expire 5 minutes after start(). No requestedScopes entry needed.",
+    returnShape: {
+      available: "boolean  // false → don't offer the flow",
+      availabilityLoading: "boolean",
+      status: "'pending' | 'complete' | 'failed' | 'cancelled' | null",
+      qr: "string | null  // PNG data-URL of the animated QR",
+      autoStartToken: "string | null  // same-device deeplink token",
+      message: "string | null  // display-ready instruction for this step",
+      identity:
+        "{ provider, name, given_name, surname, personal_number_masked, subject_hash, identified_at } | null",
+      identificationId: "string | null  // store alongside an attestation",
+      loading: "boolean",
+      error: "IdentificationError | null",
+      start: "() => Promise<{ identification_id, status, qr, auto_start_token, expires_at }>",
+      refresh: "() => Promise<void>",
+      cancel: "() => Promise<void>",
+      reset: "() => void",
+    },
+    requiredContextSlice: ["identification"],
+    scopes: null,
+  },
   // REQ-ACL-06 / REQ-ACL-RELINHERIT-05 — per-record VirtualPermission
   // management for a single record. Mirror of contract.js.
   {
@@ -1306,6 +1390,16 @@ const WIDGET_CONTEXT_SHAPE = {
     required: true,
     fields: { push: "function", replace: "function", back: "function" },
   },
+  pageContext: {
+    description:
+      "REQ-NAV-05 — the PAGE's resolved parameters. " +
+      "{ params: { <name>: value }, records: { <name>: Record|null } }. " +
+      "`params` are the page's DECLARED parameters coerced to their declared types (a number param is a number, not the string useRouteParams() returns). " +
+      "`records` holds the row the HOST already fetched for each `record` parameter — read it instead of fetching the same record again. " +
+      "Both bags are empty on a page that declares no parameters. Backs usePageContext().",
+    required: true,
+    fields: { params: "object", records: "object" },
+  },
   datastore: {
     description:
       "Injected @colixsystems/datastore-client instance. " +
@@ -1367,6 +1461,21 @@ const WIDGET_CONTEXT_SHAPE = {
     required: false,
     fields: { subscribe: "function" },
   },
+  // sc-4416 — widget -> host emptiness signal. The widget owns the knowledge
+  // (it has the rows); the host owns the spacing (the slot and its gap).
+  // Optional so an AUTHORING host can omit it on purpose: with no slice the
+  // hook is a no-op and an empty widget stays visible and selectable on the
+  // Studio canvas and in the Agent Mode edit preview.
+  section: {
+    description:
+      "Optional layout-slot slot. { reportEmpty(isEmpty) }. Called by the " +
+      "widget when it has no content to show; the host then drops the node's " +
+      "layout slot so its parent stack puts no gap around it. Backs " +
+      "useSectionEmpty(). Omitted on authoring surfaces, where an empty " +
+      "widget must stay visible.",
+    required: false,
+    fields: { reportEmpty: "function" },
+  },
   events: {
     description: "{ emit(name, payload) }.",
     required: true,
@@ -1385,6 +1494,13 @@ const WIDGET_CONTEXT_SHAPE = {
     required: true,
     fields: { send: "function" },
   },
+  // REQ-IDENT (sc-4313) — backs useIdentification(). Mirror of contract.cjs.
+  identification: {
+    description:
+      "Injected @colixsystems/identification-client instance (REQ-IDENT). { available() -> Promise<{ available, providers }>, start(body) -> Promise<order>, get(id) -> Promise<state>, cancel(id) -> Promise<state> }. Backs useIdentification(); no widget scope and no signed-in user required — identifying a NOT-signed-in visitor is the point, so the endpoints are anonymous. Bodies and rows are snake_case verbatim. A completed identification exposes name + personal_number_masked + a stable subject_hash; the RAW personal number is never reachable from a widget (it lives behind a studio-admin endpoint).",
+    required: true,
+    fields: { available: "function", start: "function", get: "function", cancel: "function" },
+  },
   // REQ-WSDK-DOMAIN-CLIENTS — the AppUser administration, AppUserGroup
   // administration, and per-record VirtualPermission facades that used to
   // live here (`users`, `groups`, `recordPermissions`) were folded into the
@@ -2290,7 +2406,7 @@ const CONTRACT = deepFreeze({
   //    public endpoint instead, which skips the cache, the metering and the
   //    workspace's provider. Publishing the host list here keeps the linter,
   //    the Developer guide and the agent prompt reading one source.
-  version: "1.51.0",
+  version: "1.53.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/hooks.js

@@ -242,6 +242,53 @@ export function useRefresh(handler) {
   }, []);
 }
 
+/**
+ * sc-4416 — declare that this widget currently has NO content to show, so the
+ * host removes its layout slot instead of reserving space for it.
+ *
+ *   const { data: rows } = useDatastoreQuery(props.tableId, query);
+ *   useSectionEmpty(rows.length === 0);
+ *   if (rows.length === 0) return null;
+ *
+ * Returning `null` is not enough on its own. The host wraps every widget node
+ * in an element (the mount-time entrance wrapper), so a widget that renders
+ * nothing still leaves an empty box that its parent stack puts `gap` around —
+ * a dead band of whitespace exactly where the content would have been. This
+ * hook is how the widget tells the host to collapse that slot; nothing else
+ * can know, because only the widget has the rows.
+ *
+ * Reach for it whenever a section is CONDITIONALLY ABSENT — a per-record child
+ * collection with no rows for the record being viewed (a policy with no quiz
+ * questions), a panel that only applies to some states. Do NOT use it to hide
+ * a genuine empty state: a list the user is expected to fill should still say
+ * "Nothing here yet" so the page does not look broken.
+ *
+ * The widget stays MOUNTED while collapsed, so when rows do arrive it simply
+ * calls `useSectionEmpty(false)` on the next render and the section reappears.
+ * Call it unconditionally (it is a hook) and let the argument carry the state.
+ *
+ * Authoring surfaces never collapse — the Studio canvas and the Agent Mode
+ * edit preview keep an empty widget visible and selectable, or an absent
+ * section could not be edited. Safe to call on a host that does not implement
+ * it: the hook collapses to a no-op.
+ */
+export function useSectionEmpty(isEmpty) {
+  const ctx = useWidgetContextOrThrow("useSectionEmpty");
+  const report = ctx.section && ctx.section.reportEmpty;
+  const reportRef = useRef(report);
+  reportRef.current = report;
+  const empty = isEmpty === true;
+  useEffect(() => {
+    const fn = reportRef.current;
+    if (typeof fn !== "function") return undefined;
+    fn(empty);
+    // No cleanup on change — releasing the collapse before re-declaring it
+    // would flash the reserved slot back in between the two renders. The host
+    // drops its per-node state when the node unmounts.
+    return undefined;
+  }, [empty]);
+}
+
 /**
  * Returns the host-provided navigation surface:
  *   `{ goTo, goBack, push, replace, back, currentRoute }`.
@@ -261,6 +308,13 @@ export function useNavigation() {
 }
 
 const EMPTY_PARAMS = Object.freeze({});
+// Stable references so `useEffect([params])` / `[records]` don't re-fire every
+// render on a page that declares no parameters.
+const EMPTY_PAGE_RECORDS = Object.freeze({});
+const EMPTY_PAGE_CONTEXT = Object.freeze({
+  params: EMPTY_PARAMS,
+  records: EMPTY_PAGE_RECORDS,
+});
 
 /**
  * Returns the current route's navigation params — the bag a `goTo(pageId, params)`
@@ -281,6 +335,35 @@ export function useRouteParams() {
   return route.params || EMPTY_PARAMS;
 }
 
+/**
+ * REQ-NAV-05 — the PAGE's resolved context: `{ params, records }`.
+ *
+ * When the page declares typed parameters (Page Settings → Parameters), the
+ * host resolves them ONCE before any widget renders: `params` holds the values
+ * coerced to their declared types (a `number` param is a number here, not the
+ * "42" string `useRouteParams()` returns), and `records` maps each `record`
+ * param to the row the host already fetched. Read the row from `records`
+ * instead of fetching it again — that duplicate fetch per widget is exactly
+ * what this hook exists to remove:
+ *
+ *   const { records } = usePageContext();
+ *   const policy = records.policy_id;   // already loaded, no request
+ *
+ * A required parameter that is absent, malformed, or whose record does not
+ * resolve never reaches the widget — the host renders one page-level state
+ * instead. Both bags are empty on a page that declares nothing and on the
+ * Studio canvas, so a widget can always read them; fall back to
+ * `useRouteParams()` for a page you do not control.
+ */
+export function usePageContext() {
+  const ctx = useWidgetContextOrThrow("usePageContext");
+  const page = ctx.pageContext || EMPTY_PAGE_CONTEXT;
+  return {
+    params: page.params || EMPTY_PARAMS,
+    records: page.records || EMPTY_PAGE_RECORDS,
+  };
+}
+
 /**
  * Returns { t, locale }. `t(key, fallback)` resolves `{{t:key}}` against
  * the host's translation table and falls back to `fallback ?? key` when
@@ -3025,6 +3108,273 @@ export function useBankIdLink() {
   };
 }
 
+/* ============================================================================
+ * IDENTIFICATION CLIENT — ctx.identification
+ * (@colixsystems/identification-client)
+ *
+ * available, start, get, cancel. Covers: useIdentification.
+ * ==========================================================================*/
+
+/**
+ * Structured error thrown by `useIdentification` callbacks. Carries a stable
+ * `code` so widgets can branch without parsing message strings.
+ *
+ * `code` is one of:
+ *   - "NOT_CONFIGURED"  — the provider is not set up on this deployment
+ *   - "UNKNOWN_PROVIDER"— the requested provider does not exist
+ *   - "NOT_FOUND"       — no such identification in this workspace
+ *   - "RATE_LIMITED"    — too many starts; back off and retry
+ *   - "UNAVAILABLE"     — the provider itself failed. Retryable
+ *   - "INTERNAL"        — anything else
+ */
+export class IdentificationError extends Error {
+  constructor(code, message, opts) {
+    super(message);
+    this.name = "IdentificationError";
+    this.code = code;
+    if (opts && opts.cause) this.cause = opts.cause;
+  }
+}
+
+function toIdentificationError(err) {
+  if (err instanceof IdentificationError) return err;
+  // The injected client already throws typed errors carrying .code / .status;
+  // fall back to the axios-ish shape the other hooks normalise.
+  const status =
+    (err && typeof err.status === "number" ? err.status : null) ??
+    (err && err.response && typeof err.response.status === "number"
+      ? err.response.status
+      : null);
+  const bodyCode =
+    (err && typeof err.code === "string" ? err.code : null) ||
+    (err && err.response && err.response.data && err.response.data.code);
+  let code = "INTERNAL";
+  if (bodyCode === "IDENTIFICATION_NOT_CONFIGURED") code = "NOT_CONFIGURED";
+  else if (bodyCode === "UNKNOWN_PROVIDER") code = "UNKNOWN_PROVIDER";
+  else if (bodyCode === "IDENTIFICATION_UNAVAILABLE") code = "UNAVAILABLE";
+  else if (bodyCode === "RATE_LIMITED" || status === 429) code = "RATE_LIMITED";
+  else if (status === 404) code = "NOT_FOUND";
+  else if (status === 409) code = "NOT_CONFIGURED";
+  else if (status === 502) code = "UNAVAILABLE";
+  const message =
+    (err && typeof err.message === "string" && err.message) ||
+    "Identification failed";
+  return new IdentificationError(code, message, { cause: err });
+}
+
+/**
+ * Identify a visitor who is NOT signed in (REQ-IDENT). Returns
+ * `{ available, availabilityLoading, status, qr, autoStartToken, message,
+ * identity, identificationId, loading, error, start, refresh, cancel, reset }`.
+ *
+ * `start()` opens an order and the hook then POLLS it for you until it is
+ * terminal, clearing the timer on unmount — so a widget renders state rather
+ * than running a loop. `refresh()` polls once by hand (set `pollIntervalMs: 0`
+ * to own the cadence yourself); `cancel()` aborts; `reset()` clears the flow so
+ * the visitor can start over. Reads
+ * `ctx.identification.{available,start,get,cancel}`.
+ *
+ * WHAT THIS IS FOR — proving a real person holding a credential was present, so
+ * the app can KEEP that: an attestation on a record, a consent line, an identity
+ * check before a submit. It creates NO account and NO session. To sign someone
+ * IN with BankID use the app's login; to attach BankID to an existing account
+ * use `useBankIdLink()`; to e-sign a file's bytes use `useFileSignature()`.
+ *
+ * RENDER THE FLOW LIKE THIS. Gate on `available` first — when it is false the
+ * provider is not configured and no QR can ever complete, so show nothing (or an
+ * explanatory line) rather than a dead button. While `status === "pending"`,
+ * render `qr` with the `Image` primitive and show `message` (a display-ready,
+ * localised instruction such as "Enter your security code in the BankID app").
+ * On the SAME device, `autoStartToken` opens the provider app directly —
+ * `bankid:///?autostarttoken=<token>&redirect=null`.
+ *
+ * ON COMPLETION you get `identity`:
+ *   `{ provider, name, given_name, surname, personal_number_masked,
+ *      subject_hash, identified_at }`
+ * There is deliberately NO raw personal number: `personal_number_masked` is
+ * `"19900101-****"` and `subject_hash` is stable for the same person, so you can
+ * recognise a returning visitor without ever holding the number. Write the
+ * masked string (and `identificationId`, if you want to trace the proof) into
+ * your datastore column — never try to reconstruct the full number.
+ *
+ * `purpose` is a short audit label ("attest", "age_check"), capped at 120 chars
+ * server-side. Orders expire five minutes after `start()`.
+ */
+export function useIdentification(options) {
+  const ctx = useWidgetContextOrThrow("useIdentification");
+  if (
+    !ctx.identification ||
+    typeof ctx.identification.start !== "function"
+  ) {
+    throw new Error(
+      "useIdentification: host did not inject an identification client (ctx.identification)",
+    );
+  }
+  const apiRef = useRef(ctx.identification);
+  apiRef.current = ctx.identification;
+
+  const opts = options || {};
+  const provider = opts.provider || "bankid";
+  const purpose = opts.purpose;
+  const pollIntervalMs =
+    typeof opts.pollIntervalMs === "number" ? opts.pollIntervalMs : 1000;
+
+  const [available, setAvailable] = useState(false);
+  const [availabilityLoading, setAvailabilityLoading] = useState(true);
+  const [status, setStatus] = useState(null); // null | pending | complete | failed | cancelled
+  const [qr, setQr] = useState(null);
+  const [autoStartToken, setAutoStartToken] = useState(null);
+  const [message, setMessage] = useState(null);
+  const [identity, setIdentity] = useState(null);
+  const [identificationId, setIdentificationId] = useState(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState(null);
+
+  const idRef = useRef(null);
+  // Guards every async setState: a flow that resolves after unmount (or after a
+  // reset) must not write into a dead render.
+  const aliveRef = useRef(true);
+  useEffect(() => {
+    aliveRef.current = true;
+    return () => {
+      aliveRef.current = false;
+    };
+  }, []);
+
+  useEffect(() => {
+    let cancelled = false;
+    (async () => {
+      try {
+        const res = await apiRef.current.available();
+        if (cancelled) return;
+        setAvailable(Boolean(res && res.available));
+      } catch {
+        if (cancelled) return;
+        // Availability is a pre-flight nicety, not the flow — a failure here
+        // means "don't offer it", not an error the widget must render.
+        setAvailable(false);
+      } finally {
+        if (!cancelled) setAvailabilityLoading(false);
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  const _applyState = useCallback((res) => {
+    if (!res) return null;
+    if (res.status != null) setStatus(res.status);
+    if (res.qr !== undefined) setQr(res.qr || null);
+    if (res.message !== undefined) setMessage(res.message || null);
+    if (res.identity !== undefined) setIdentity(res.identity || null);
+    return res;
+  }, []);
+
+  const refresh = useCallback(async () => {
+    const id = idRef.current;
+    if (!id) return null;
+    try {
+      const res = await apiRef.current.get(id);
+      if (!aliveRef.current || idRef.current !== id) return res;
+      return _applyState(res);
+    } catch (err) {
+      if (!aliveRef.current || idRef.current !== id) return null;
+      const e = toIdentificationError(err);
+      // A transient provider blip is already retried inside the client, so an
+      // error surfacing here ends the flow rather than spinning forever.
+      setError(e);
+      setStatus("failed");
+      setMessage(e.message);
+      return null;
+    }
+  }, [_applyState]);
+
+  // Poll while the order is pending. Cleared on terminal state and on unmount.
+  useEffect(() => {
+    if (status !== "pending" || pollIntervalMs <= 0) return undefined;
+    const timer = setInterval(() => {
+      refresh();
+    }, pollIntervalMs);
+    return () => clearInterval(timer);
+  }, [status, pollIntervalMs, refresh]);
+
+  const start = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+    setIdentity(null);
+    try {
+      const res = await apiRef.current.start({ provider, purpose });
+      const newId = res && res.identification_id ? res.identification_id : null;
+      idRef.current = newId;
+      if (!aliveRef.current) return res;
+      setIdentificationId(newId);
+      setStatus(res && res.status ? res.status : "pending");
+      setQr(res && res.qr ? res.qr : null);
+      setAutoStartToken(res && res.auto_start_token ? res.auto_start_token : null);
+      setMessage(null);
+      setLoading(false);
+      return res;
+    } catch (err) {
+      const e = toIdentificationError(err);
+      if (aliveRef.current) {
+        setError(e);
+        setStatus("failed");
+        setMessage(e.message);
+        setLoading(false);
+      }
+      throw e;
+    }
+  }, [provider, purpose]);
+
+  const cancel = useCallback(async () => {
+    const id = idRef.current;
+    idRef.current = null;
+    if (aliveRef.current) {
+      setStatus(null);
+      setQr(null);
+      setAutoStartToken(null);
+      setMessage(null);
+    }
+    if (id) {
+      try {
+        await apiRef.current.cancel(id);
+      } catch {
+        // Best-effort — the order may have already expired or completed.
+      }
+    }
+  }, []);
+
+  const reset = useCallback(() => {
+    idRef.current = null;
+    setStatus(null);
+    setQr(null);
+    setAutoStartToken(null);
+    setMessage(null);
+    setIdentity(null);
+    setIdentificationId(null);
+    setError(null);
+    setLoading(false);
+  }, []);
+
+  return {
+    available,
+    availabilityLoading,
+    status,
+    qr,
+    autoStartToken,
+    message,
+    identity,
+    identificationId,
+    loading,
+    error,
+    start,
+    refresh,
+    cancel,
+    reset,
+  };
+}
+
 /* ============================================================================
  * PAYMENTS CLIENT — ctx.payments (@colixsystems/payments-client)
  *

package/dist/index.d.ts

@@ -445,6 +445,59 @@ export interface PaymentsClient {
   getPayment(paymentId: string): Promise<PaymentResult>;
 }
 
+/**
+ * A verified person a completed identification resolved to (REQ-IDENT).
+ *
+ * There is deliberately NO raw personal number: the full value stays
+ * server-side. `personal_number_masked` is e.g. `"19900101-****"`, and
+ * `subject_hash` is stable for the same person so a returning visitor can be
+ * recognised without it.
+ */
+export interface Identity {
+  provider: string;
+  name: string | null;
+  given_name: string | null;
+  surname: string | null;
+  personal_number_masked: string | null;
+  subject_hash: string | null;
+  identified_at: string | null;
+}
+
+/**
+ * Structural shape of the injected `@colixsystems/identification-client`
+ * (`ctx.identification`, REQ-IDENT). Backs `useIdentification`. Identifies a
+ * visitor who is NOT signed in; creates no account and no session.
+ */
+export interface IdentificationClient {
+  available(): Promise<{
+    available: boolean;
+    providers: Array<{ provider: string; available: boolean }>;
+  }>;
+  start(body?: { provider?: string; purpose?: string }): Promise<{
+    identification_id: string;
+    provider: string;
+    purpose: string | null;
+    status: "pending";
+    auto_start_token: string | null;
+    qr: string | null;
+    expires_at: string;
+  }>;
+  get(identificationId: string): Promise<{
+    identification_id: string;
+    provider: string;
+    purpose: string | null;
+    status: "pending" | "complete" | "failed" | "cancelled";
+    hint_code?: string | null;
+    message?: string | null;
+    qr?: string | null;
+    identity?: Identity;
+  }>;
+  cancel(identificationId: string): Promise<{
+    identification_id: string;
+    status: "pending" | "complete" | "failed" | "cancelled";
+  }>;
+}
+
 /**
  * Structural shape of the injected `@colixsystems/notifications-client`
  * (`ctx.notifications`, sc-890). Backs `useSendNotification`. `send` POSTs the
@@ -497,6 +550,8 @@ export interface WidgetContext<TProps = unknown> {
   payments: PaymentsClient;
   /** Injected @colixsystems/notifications-client; backs useSendNotification. */
   notifications: NotificationsClient;
+  /** Injected @colixsystems/identification-client; backs useIdentification. */
+  identification: IdentificationClient;
   /** Host child-node renderer; backs WidgetTree / useChildRenderer. */
   renderer: { renderNode(node: unknown): unknown };
   events: { emit(eventName: string, payload?: unknown): void };
@@ -1001,6 +1056,20 @@ export function useNavigation(): {
  */
 export function useRouteParams(): Record<string, unknown>;
 
+/**
+ * REQ-NAV-05 — the PAGE's resolved context. When the page declares typed
+ * parameters, the host resolves them ONCE before any widget renders: `params`
+ * holds the values coerced to their declared types (a `number` parameter is a
+ * number here, not the string `useRouteParams()` returns), and `records` maps
+ * each `record` parameter to the row the host already fetched — read it instead
+ * of fetching the same record again. Both bags are empty on a page that
+ * declares nothing.
+ */
+export function usePageContext(): {
+  params: Record<string, unknown>;
+  records: Record<string, Record<string, unknown> | null>;
+};
+
 /**
  * Static API for external URLs. `openURL(url)` opens a URL with the OS
  * handler (web: react-native-web maps to `window.open` / `location.href`;
@@ -1027,6 +1096,20 @@ export function useRefresh(
   handler: () => void | Promise<unknown>,
 ): void;
 
+/**
+ * sc-4416 — declare that this widget currently has NO content to show, so the
+ * host removes its layout slot rather than reserving space for it.
+ *
+ * Returning `null` alone is not enough: the host wraps every widget node in an
+ * entrance wrapper, so a widget rendering nothing still leaves an empty box
+ * that its parent stack puts `gap` around. Use it for a CONDITIONALLY ABSENT
+ * section (a per-record child collection with no rows for this record), never
+ * to suppress a genuine empty state. The widget stays mounted while collapsed,
+ * so passing `false` later brings the section back. Authoring surfaces never
+ * collapse. Safe on a host that does not implement it — a no-op there.
+ */
+export function useSectionEmpty(isEmpty: boolean): void;
+
 /** Pass-through options for `useGeolocation().getCurrentPosition(...)`. */
 export interface GeolocationOptions {
   enableHighAccuracy?: boolean;
@@ -1299,6 +1382,76 @@ export interface BankIdLinkApi {
  */
 export function useBankIdLink(): BankIdLinkApi;
 
+// ----------------------------------------------------- useIdentification
+//
+// REQ-IDENT — identify a visitor who is NOT signed in and keep the result.
+// Reads the injected identification-client at `ctx.identification`. Anonymous by
+// design — no requestedScopes entry and no session needed.
+
+/** Stable machine codes on an IdentificationError. */
+export type IdentificationErrorCode =
+  | "NOT_CONFIGURED"
+  | "UNKNOWN_PROVIDER"
+  | "NOT_FOUND"
+  | "RATE_LIMITED"
+  | "UNAVAILABLE"
+  | "INTERNAL";
+
+export class IdentificationError extends Error {
+  code: IdentificationErrorCode;
+  cause?: unknown;
+}
+
+export interface UseIdentificationOptions {
+  /** Provider to identify with. Defaults to "bankid". */
+  provider?: string;
+  /** Short audit label ("attest", "age_check"). Capped at 120 chars server-side. */
+  purpose?: string;
+  /** Poll cadence while pending, in ms. Defaults to 1000; 0 disables auto-polling. */
+  pollIntervalMs?: number;
+}
+
+export interface IdentificationApi {
+  /** Whether identification can be used here (provider configured + enabled). Gate the UI on this. */
+  available: boolean;
+  availabilityLoading: boolean;
+  /** The active order's state, or null when no order is in flight. */
+  status: "pending" | "complete" | "failed" | "cancelled" | null;
+  /** PNG data-URL of the animated QR while pending (render with the Image primitive). */
+  qr: string | null;
+  /** Same-device deeplink token: `bankid:///?autostarttoken=<token>&redirect=null`. */
+  autoStartToken: string | null;
+  /** Display-ready instruction for the current step. */
+  message: string | null;
+  /** The verified person, set once status is "complete". */
+  identity: Identity | null;
+  /** The order id — store it alongside an attestation to trace back to the proof. */
+  identificationId: string | null;
+  loading: boolean;
+  error: IdentificationError | null;
+  /** Open an order -> sets status "pending" + qr, then polls to completion. */
+  start(): Promise<unknown>;
+  /** Poll the open order once by hand (for pollIntervalMs: 0). */
+  refresh(): Promise<unknown>;
+  /** Abort the in-flight order. */
+  cancel(): Promise<void>;
+  /** Clear the flow so the visitor can start over. */
+  reset(): void;
+}
+
+/**
+ * Identify a visitor who is NOT signed in, so the app can keep the result (an
+ * attestation on a record, a consent line, a pre-submit identity check). Polls
+ * the order for you while pending and clears the timer on unmount.
+ *
+ * Creates no account and no session — to sign someone IN use the app's login, to
+ * attach BankID to an existing account use `useBankIdLink()`, and to e-sign a
+ * file use `useFileSignature()`. Hide the affordance when `available` is false.
+ */
+export function useIdentification(
+  options?: UseIdentificationOptions,
+): IdentificationApi;
+
 // ----------------------------------------------------- useRecordPermissions
 //
 // REQ-ACL-06 / REQ-ACL-RELINHERIT-05 — per-record VirtualPermission

package/dist/index.js

@@ -31,6 +31,8 @@ export {
   useUsers,
   useGroups,
   useBankIdLink,
+  useIdentification,
+  IdentificationError,
   useRecordPermissions,
   useDatastoreSubscription,
   useWidgetEvent,
@@ -45,8 +47,10 @@ export {
   useFill,
   useNavigation,
   useRouteParams,
+  usePageContext,
   useChildRenderer,
   useRefresh,
+  useSectionEmpty,
   useGeolocation,
   GeolocationError,
   WidgetTree,

package/dist/index.native.js

@@ -31,6 +31,8 @@ export {
   useUsers,
   useGroups,
   useBankIdLink,
+  useIdentification,
+  IdentificationError,
   useRecordPermissions,
   useDatastoreSubscription,
   useWidgetEvent,
@@ -45,8 +47,10 @@ export {
   useFill,
   useNavigation,
   useRouteParams,
+  usePageContext,
   useChildRenderer,
   useRefresh,
+  useSectionEmpty,
   useGeolocation,
   GeolocationError,
   WidgetTree,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.77.0",
+  "version": "0.79.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "type": "module",
   "main": "./dist/index.js",
@@ -48,7 +48,7 @@
   ],
   "scripts": {
     "build": "node scripts/build.js",
-    "test": "node --test src/__tests__/contract.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/theme-components-parity.test.js src/__tests__/theme-depth-tokens.test.js"
+    "test": "node --test src/__tests__/contract.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/theme-components-parity.test.js src/__tests__/theme-depth-tokens.test.js"
   },
   "engines": {
     "node": ">=18"