@colixsystems/widget-sdk 0.92.0 → 0.94.0

package/README.md

@@ -49,6 +49,7 @@ The data layer lives in **four separate domain-client packages**, each instantia
 | **DIRECTORY** (`ctx.directory`) | `useDirectory(query?)` | `{ users, loading, error, refetch }` | `directory.users.list` — `directory.read:users` |
 | **DIRECTORY** | `useUsers(query?)` | `{ users, loading, error, refetch, invite, deactivate, reactivate, remove }` | `directory.users.*` — `users.read:*` (edits also `users.write:*`; `remove()` also `users.delete:*`) |
 | **DIRECTORY** | `useGroups(query?)` | `{ groups, loading, error, refetch, create, remove, addMember, removeMember }` | `directory.groups.*` — `groups.read:*` (mutations also `groups.write:*`) |
+| **DIRECTORY** | `useInvites(query?)` | `{ invites, loading, error, refetch, resend, revoke }` | `directory.invites.*` — `users.write:*` + the SystemAcl `users.write` capability (the whole invite surface, list included). `query` is `{ status?, limit?, offset? }` with `status` ∈ `pending \| accepted \| revoked \| expired \| all` (endpoint default `all`). |
 | **DIRECTORY** | `useBankIdLink()` | `{ linked, available, status, qr, message, startLink, refresh, cancel, unlink, refetchStatus, … }` | `directory.bankid.*` — no scope (JWT-gated self-service) |
 | **FILESTORE** (`ctx.filestore`) | `usePdfExport({ spaceType, folderId? })` | `{ exportToPdf, exporting, error, lastExported }` | `ctx.filestore.files.exportPdf` — `files.write:*`. `exportToPdf(html, { fileName?, folderId? })` renders the HTML to a PDF server-side and saves it as a file (`application/pdf`); same server-side renderer on web + native. |
 | **PAYMENTS** (`ctx.payments`) | `usePayments()` | `{ requestPayment, getPayment }` | `ctx.payments.*` — `payments.charge:appUser`. Rejects with `PaymentError { code, message, retryable }`; when `retryable` is `false` show `message` and drop the retry. Charges are accepted ONLY in the currency the workspace sells in — omit `currency` and the platform applies it (a disagreeing literal is a publish-blocking `payment-currency` finding). |
@@ -65,6 +66,16 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 `v0.91.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
 
+### What's new in 0.93.0 (contract 1.66.0)
+
+**BREAKING: a widget no longer declares server-side actions.** `manifest.actions` is removed from the contract and **refused** by `validateManifest` — an author who declares it now fails the publish with a message naming the replacement, rather than shipping a widget that quietly carries no automation.
+
+- **Why.** `actions` made a widget two products in one package: a React component that renders, and a script that never renders at all — different runtime, different lifecycle, different review concerns, one manifest. Automation is now its own marketplace deliverable, an **Action** (`@colixsystems/action-sdk`), with its own manifest, starter kit, developer guide, submit button and platform-admin review. A workspace installs and configures it separately from any widget.
+- **What to do instead.** Move the script into an Action manifest (`appstudio-action lint` / `pack`), publish it, and let the workspace install it. Its `propertySchema` is filled in by the **installing operator** rather than a page author, and the values reach the script as the `properties` global.
+- **Removed from the contract**: the `actions` manifest field. `CONTRACT.actionTriggerTypes` / `actionScriptGlobals` / `actionScriptMaxBytes` remain exported for now but describe a surface no widget field uses — the action-sdk owns that vocabulary.
+- **Existing installs are unaffected.** A tenant Action row materialised from a widget manifest keeps running, keeps its bindings and keeps its run history; the platform migrated those rows onto the Action that ships the automation. What is gone is the ability to declare a NEW one on a widget.
+- **No parity impact.** Actions never ran in the rendered app, so nothing about the Player or the export changes.
+
 ### What's new in 0.92.0 (contract 1.65.0)
 
 **New `useInterpretDraft(tableId)` hook — turn one sentence into DRAFT record values.** A new DATASTORE hook reading a new `interpret` method on the existing `ctx.datastore` slice (`@colixsystems/datastore-client` 0.13.0). Returns `{ interpret, interpreting, error, result, available }`. Call `interpret(text, { fields, timeZone })` **imperatively** from an event handler — never on mount or in a render loop — and it resolves to `{ values, unresolved }`, where `values` is keyed by column NAME (the same shape `useDatastoreMutation().create` takes) and `unresolved` names the fields the sentence did not state.
@@ -866,6 +877,42 @@ The matching manifest declares the scopes:
 
 The host rejects calls whose scope is not declared in the manifest (the SDK linter catches this statically too). Declaring a write scope is also a consent prompt the Studio admin sees at install time — the wider the scope set, the more careful the admin is about granting the install.
 
+## Listing pending invitations from a widget
+
+`useInvites(query?)` lists the workspace's invites and resends / revokes them:
+
+```jsx
+import { useInvites, View, Text, Pressable } from '@colixsystems/widget-sdk';
+
+// Manifest: requestedScopes: ['users.read:*', 'users.write:*']
+function PendingInvites() {
+  const { invites, loading, error, resend, revoke } = useInvites({ status: 'pending' });
+  if (loading) return null;
+  if (error) return <Text>{error.message}</Text>;   // code === 'FORBIDDEN' when the capability is missing
+  return (
+    <View>
+      {invites.map((i) => (
+        <View key={i.id}>
+          <Text>{i.email} · {i.status}</Text>
+          <Pressable onPress={() => resend(i.id).catch(() => {})}><Text>Resend</Text></Pressable>
+          <Pressable onPress={() => revoke(i.id).catch(() => {})}><Text>Revoke</Text></Pressable>
+        </View>
+      ))}
+    </View>
+  );
+}
+```
+
+Rows are snake_case: `{ id, email, name, group_ids, status, expires_at, accepted_at,
+revoked_at, created_at }`. Trust the server-computed `status` rather than comparing
+`expires_at` against the device clock.
+
+**The gate is `users.write`, not `users.read`.** A pending invite exposes the email of
+someone who is not a member yet, so the backend gates the entire invite surface —
+listing included — on the `users.write` capability plus a signed `users.write:*`
+scope. The `invites.read:*` / `invites.write:*` scope names mint but no route
+enforces them, so declaring only those yields `FORBIDDEN`. Both mutations refetch
+the list on success.
 ## Managing per-record permissions from a widget
 
 `useRecordPermissions(tableId, recordId)` is the in-app surface for sharing a single record with another user or group. The chat widget uses it to invite members into a channel — the channel record's per-record grants ARE the membership list (messages inherit those grants). The hook also covers project-workspace, document-sharing, and team-roster widgets that grant access record-by-record.

package/dist/contract.cjs

@@ -1023,6 +1023,44 @@ const HOOKS = [
     requiredContextSlice: ["directory.groups"],
     scopes: ["groups.read:*"],
   },
+  // sc-5097 — pending AppUser invite administration. Returns
+  // `{ invites, loading, error, refetch, resend, revoke }`. Reads need
+  // `invites.read:*`; resend/revoke need `invites.write:*` plus the
+  // caller's `users.write` SystemAcl capability.
+  {
+    name: "useInvites",
+    signature: "useInvites(query?)",
+    description:
+      "Pending AppUser invite administration via the injected " +
+      "directory-client at ctx.directory.invites.{list,resend,revoke}. " +
+      "Returns { invites, loading, error, refetch, resend, revoke }. list " +
+      "returns the { data, meta } envelope verbatim — the hook unwraps " +
+      "res.data; rows are snake_case (email, status, expires_at, …) and " +
+      "status is the server-computed pending/accepted/revoked/expired " +
+      "value. query is { status?, limit?, offset? } passed verbatim; the " +
+      "endpoint defaults to status 'all', so pass { status: 'pending' } " +
+      "for the usual outstanding-invite list. The WHOLE invite surface — " +
+      "list included — is gated on users.write:* plus the users.write " +
+      "SystemAcl capability, because a pending invite exposes the email of " +
+      "someone who is not a member yet; a users.read-only caller cannot see " +
+      "it. (invites.read:* / invites.write:* mint but gate nothing today.) " +
+      "Without the capability every call rejects with DirectoryError code " +
+      "FORBIDDEN — surface that, do not hide the tab. Both mutations " +
+      "refetch on success.",
+    returnShape: {
+      invites:
+        "Array<{ id, email, name, group_ids, status, expires_at, accepted_at, revoked_at, created_at }>  // snake_case rows; unwrapped from { data, meta }",
+      loading: "boolean",
+      error: "DirectoryError | null  // { code, message, retryable }",
+      refetch: "() => Promise<void>",
+      resend:
+        "(inviteId) => Promise<Invite>  // refetches; rejects with DirectoryError",
+      revoke:
+        "(inviteId) => Promise<void>  // refetches; rejects with DirectoryError",
+    },
+    requiredContextSlice: ["directory.invites"],
+    scopes: ["users.write:*"],
+  },
   // REQ-BANKID-AUTH — link / unlink a BankID identity to the signed-in
   // app-user. Self-service + JWT-gated (no widget scope). Mirror of contract.js.
   {
@@ -1590,17 +1628,6 @@ const MANIFEST_SCHEMA = {
     description:
       "Optional. Tables the widget needs, seeded into the workspace at install time. Authors wire them into the widget's `tableRef` properties via the Properties Panel — the SDK does not auto-bind. Limits: 8 tables, 24 columns per table. RELATION columns address siblings by `targetSuffix` (must be declared earlier in the array). Tables persist across uninstalls.",
   },
-  actions: {
-    type: "object[]",
-    required: false,
-    description:
-      "Optional. Server-side actions the widget declares. Each runs in the shared isolated-vm action runner (cron- or record-triggered) — NEVER in the rendered app. Operators enable them per tenant from the Properties Panel; the action materialises DISABLED until they bind an integration API key (and, for record_* triggers, a target table) in the Actions admin page. Each entry: { key (stable, unique within the manifest), name, description?, triggerTypes (a non-empty array of unique values from " +
-      ACTION_TRIGGER_TYPES.join(", ") +
-      "; combine them so one script serves several events — the script's `triggerType` global names the event that actually fired), scheduleCron? (required iff triggerTypes contains 'schedule'; node-cron syntax), timeoutMs? (100–300000), scriptSource (≤200 KiB; runs against " +
-      ACTION_SCRIPT_GLOBALS.join(", ") +
-      " — NOT the React surface, so SDK imports/hooks are unavailable) }. Do NOT include triggerTableId or apiKeyId — those are tenant-local and bound after install.",
-    default: [],
-  },
   translations: {
     type: "object",
     required: false,
@@ -1688,9 +1715,9 @@ const WIDGET_CONTEXT_SHAPE = {
       "groups: { list(query?) -> Promise<{ data, meta }>, create(body), remove(id), addMember(groupId, userId), removeMember(groupId, userId), listMine() }, " +
       "invites: { list(), revoke(id), resend(id) }, " +
       "bankid: { status() -> { linked, available }, startLink() -> { order_ref, qr, ... }, collect(orderRef), cancel(orderRef), unlink() } }. " +
-      "users backs useDirectory() + useUsers(); groups backs useGroups(); bankid backs useBankIdLink() (REQ-BANKID-AUTH — self-service account linking, JWT-gated, no widget scope). List methods return the { data, meta } envelope verbatim (hooks unwrap res.data); rows/bodies are snake_case. Reads gated by directory.read:users / users.read:* / groups.read:*; mutations by users.write:* / groups.write:* (destructive user removal by users.delete:*).",
+      "users backs useDirectory() + useUsers(); groups backs useGroups(); invites backs useInvites() (list/resend/revoke pending invites, gated by users.write:* + the users.write capability); bankid backs useBankIdLink() (REQ-BANKID-AUTH — self-service account linking, JWT-gated, no widget scope). List methods return the { data, meta } envelope verbatim (hooks unwrap res.data); rows/bodies are snake_case. Reads gated by directory.read:users / users.read:* / groups.read:*; mutations by users.write:* / groups.write:* (destructive user removal by users.delete:*).",
     required: true,
-    fields: { users: "object", groups: "object", bankid: "object" },
+    fields: { users: "object", groups: "object", invites: "object", bankid: "object" },
   },
   assets: {
     description:
@@ -2891,7 +2918,11 @@ const CONTRACT = deepFreeze({
   //    published widget keeps validating. The script's `triggerType` global
   //    now names the trigger that actually FIRED the run ('manual' and 'app'
   //    included), which is what makes a multi-trigger script able to branch.
-  version: "1.65.0",
+  // 1.66.0: BREAKING — `actions` is removed from the manifest contract and
+  // REFUSED by the validator (sc-4879). Server-side automation ships as its own
+  // marketplace deliverable (`@colixsystems/action-sdk`), which a workspace
+  // installs and configures separately. A widget renders; it does not automate.
+  version: "1.66.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/contract.js

@@ -1023,6 +1023,44 @@ const HOOKS = [
     requiredContextSlice: ["directory.groups"],
     scopes: ["groups.read:*"],
   },
+  // sc-5097 — pending AppUser invite administration. Returns
+  // `{ invites, loading, error, refetch, resend, revoke }`. Reads need
+  // `invites.read:*`; resend/revoke need `invites.write:*` plus the
+  // caller's `users.write` SystemAcl capability.
+  {
+    name: "useInvites",
+    signature: "useInvites(query?)",
+    description:
+      "Pending AppUser invite administration via the injected " +
+      "directory-client at ctx.directory.invites.{list,resend,revoke}. " +
+      "Returns { invites, loading, error, refetch, resend, revoke }. list " +
+      "returns the { data, meta } envelope verbatim — the hook unwraps " +
+      "res.data; rows are snake_case (email, status, expires_at, …) and " +
+      "status is the server-computed pending/accepted/revoked/expired " +
+      "value. query is { status?, limit?, offset? } passed verbatim; the " +
+      "endpoint defaults to status 'all', so pass { status: 'pending' } " +
+      "for the usual outstanding-invite list. The WHOLE invite surface — " +
+      "list included — is gated on users.write:* plus the users.write " +
+      "SystemAcl capability, because a pending invite exposes the email of " +
+      "someone who is not a member yet; a users.read-only caller cannot see " +
+      "it. (invites.read:* / invites.write:* mint but gate nothing today.) " +
+      "Without the capability every call rejects with DirectoryError code " +
+      "FORBIDDEN — surface that, do not hide the tab. Both mutations " +
+      "refetch on success.",
+    returnShape: {
+      invites:
+        "Array<{ id, email, name, group_ids, status, expires_at, accepted_at, revoked_at, created_at }>  // snake_case rows; unwrapped from { data, meta }",
+      loading: "boolean",
+      error: "DirectoryError | null  // { code, message, retryable }",
+      refetch: "() => Promise<void>",
+      resend:
+        "(inviteId) => Promise<Invite>  // refetches; rejects with DirectoryError",
+      revoke:
+        "(inviteId) => Promise<void>  // refetches; rejects with DirectoryError",
+    },
+    requiredContextSlice: ["directory.invites"],
+    scopes: ["users.write:*"],
+  },
   // REQ-BANKID-AUTH — link / unlink a BankID identity to the signed-in
   // app-user. Self-service + JWT-gated (no widget scope). Mirror of contract.cjs.
   {
@@ -1590,17 +1628,6 @@ const MANIFEST_SCHEMA = {
     description:
       "Optional. Tables the widget needs, seeded into the workspace at install time. Authors wire them into the widget's `tableRef` properties via the Properties Panel — the SDK does not auto-bind. Limits: 8 tables, 24 columns per table. RELATION columns address siblings by `targetSuffix` (must be declared earlier in the array). Tables persist across uninstalls.",
   },
-  actions: {
-    type: "object[]",
-    required: false,
-    description:
-      "Optional. Server-side actions the widget declares. Each runs in the shared isolated-vm action runner (cron- or record-triggered) — NEVER in the rendered app. Operators enable them per tenant from the Properties Panel; the action materialises DISABLED until they bind an integration API key (and, for record_* triggers, a target table) in the Actions admin page. Each entry: { key (stable, unique within the manifest), name, description?, triggerTypes (a non-empty array of unique values from " +
-      ACTION_TRIGGER_TYPES.join(", ") +
-      "; combine them so one script serves several events — the script's `triggerType` global names the event that actually fired), scheduleCron? (required iff triggerTypes contains 'schedule'; node-cron syntax), timeoutMs? (100–300000), scriptSource (≤200 KiB; runs against " +
-      ACTION_SCRIPT_GLOBALS.join(", ") +
-      " — NOT the React surface, so SDK imports/hooks are unavailable) }. Do NOT include triggerTableId or apiKeyId — those are tenant-local and bound after install.",
-    default: [],
-  },
   translations: {
     type: "object",
     required: false,
@@ -1688,9 +1715,9 @@ const WIDGET_CONTEXT_SHAPE = {
       "groups: { list(query?) -> Promise<{ data, meta }>, create(body), remove(id), addMember(groupId, userId), removeMember(groupId, userId), listMine() }, " +
       "invites: { list(), revoke(id), resend(id) }, " +
       "bankid: { status() -> { linked, available }, startLink() -> { order_ref, qr, ... }, collect(orderRef), cancel(orderRef), unlink() } }. " +
-      "users backs useDirectory() + useUsers(); groups backs useGroups(); bankid backs useBankIdLink() (REQ-BANKID-AUTH — self-service account linking, JWT-gated, no widget scope). List methods return the { data, meta } envelope verbatim (hooks unwrap res.data); rows/bodies are snake_case. Reads gated by directory.read:users / users.read:* / groups.read:*; mutations by users.write:* / groups.write:* (destructive user removal by users.delete:*).",
+      "users backs useDirectory() + useUsers(); groups backs useGroups(); invites backs useInvites() (list/resend/revoke pending invites, gated by users.write:* + the users.write capability); bankid backs useBankIdLink() (REQ-BANKID-AUTH — self-service account linking, JWT-gated, no widget scope). List methods return the { data, meta } envelope verbatim (hooks unwrap res.data); rows/bodies are snake_case. Reads gated by directory.read:users / users.read:* / groups.read:*; mutations by users.write:* / groups.write:* (destructive user removal by users.delete:*).",
     required: true,
-    fields: { users: "object", groups: "object", bankid: "object" },
+    fields: { users: "object", groups: "object", invites: "object", bankid: "object" },
   },
   assets: {
     description:
@@ -2891,7 +2918,11 @@ const CONTRACT = deepFreeze({
   //    published widget keeps validating. The script's `triggerType` global
   //    now names the trigger that actually FIRED the run ('manual' and 'app'
   //    included), which is what makes a multi-trigger script able to branch.
-  version: "1.65.0",
+  // 1.66.0: BREAKING — `actions` is removed from the manifest contract and
+  // REFUSED by the validator (sc-4879). Server-side automation ships as its own
+  // marketplace deliverable (`@colixsystems/action-sdk`), which a workspace
+  // installs and configures separately. A widget renders; it does not automate.
+  version: "1.66.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/hooks.js

@@ -3467,6 +3467,118 @@ export function useGroups(query) {
   return { groups, loading, error, refetch, create, remove, addMember, removeMember };
 }
 
+/**
+ * sc-5097 — pending AppUser invite administration.
+ *
+ * Returns `{ invites, loading, error, refetch, resend, revoke }`. Reads the
+ * injected `@colixsystems/directory-client` at
+ * `ctx.directory.invites.{list, resend, revoke}` — `list` resolves to the
+ * `{ data, meta }` envelope VERBATIM, so we unwrap `res.data` (default `[]`).
+ *
+ * Rows are snake_case exactly as the backend projects them: `{ id, tenant_id,
+ * email, name, group_ids, status, expires_at, accepted_at, revoked_at,
+ * created_at, invited_by_studio_user_id }`. `status` is the server-computed
+ * lifecycle value (`"pending" | "accepted" | "revoked" | "expired"`) — prefer
+ * it over re-deriving expiry on the client, whose clock may disagree.
+ *
+ * `query` is an optional `{ status?, limit?, offset? }` passed through
+ * verbatim; `status` accepts `"pending" | "accepted" | "revoked" | "expired" |
+ * "all"` and the endpoint defaults to `"all"`, so pass `{ status: "pending" }`
+ * for the usual "who hasn't accepted yet" list.
+ *
+ * The WHOLE invite surface — list included — is gated on the `users.write`
+ * capability plus a signed `users.write:*` scope: a pending invite exposes
+ * the email of someone who is not a member yet, so a `users.read`-only
+ * caller cannot see it. The `invites.read:*` / `invites.write:*` scope names
+ * mint but gate nothing today, so declaring them alone yields FORBIDDEN.
+ * Every call rejects with a `DirectoryError` carrying `code: "FORBIDDEN"`
+ * when the capability is missing — surface it rather than hiding the tab.
+ */
+export function useInvites(query) {
+  const ctx = useWidgetContextOrThrow("useInvites");
+  if (
+    !ctx.directory ||
+    !ctx.directory.invites ||
+    typeof ctx.directory.invites.list !== "function"
+  ) {
+    throw new Error(
+      "useInvites: host did not inject a directory client (ctx.directory.invites)",
+    );
+  }
+  const [invites, setInvites] = useState([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(null);
+
+  const queryRef = useRef(query);
+  const invitesRef = useRef(ctx.directory.invites);
+  queryRef.current = query;
+  invitesRef.current = ctx.directory.invites;
+
+  const runRef = useRef(0);
+
+  const doFetch = useCallback(async () => {
+    const myRun = ++runRef.current;
+    setLoading(true);
+    setError(null);
+    try {
+      const res = await invitesRef.current.list(queryRef.current);
+      // Directory invites.list returns the { data, meta } envelope verbatim.
+      const rows = res && Array.isArray(res.data) ? res.data : [];
+      if (runRef.current !== myRun) return;
+      setInvites(rows);
+      setLoading(false);
+    } catch (err) {
+      if (runRef.current !== myRun) return;
+      setError(toDirectoryError(err));
+      setLoading(false);
+    }
+  }, []);
+
+  const queryKey = (() => {
+    try {
+      return JSON.stringify(query);
+    } catch (_e) {
+      return null;
+    }
+  })();
+  useEffect(() => {
+    doFetch();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [queryKey]);
+
+  const refetch = useCallback(async () => {
+    await doFetch();
+  }, [doFetch]);
+
+  // Both mutations re-list on success: revoking drops the row and resending
+  // moves `expires_at`, so a stale list would show the operator the old state.
+  const resend = useCallback(
+    async (inviteId) => {
+      try {
+        const row = await invitesRef.current.resend(inviteId);
+        await doFetch();
+        return row;
+      } catch (err) {
+        throw toDirectoryError(err);
+      }
+    },
+    [doFetch],
+  );
+  const revoke = useCallback(
+    async (inviteId) => {
+      try {
+        await invitesRef.current.revoke(inviteId);
+        await doFetch();
+      } catch (err) {
+        throw toDirectoryError(err);
+      }
+    },
+    [doFetch],
+  );
+
+  return { invites, loading, error, refetch, resend, revoke };
+}
+
 /**
  * REQ-BANKID-AUTH — link / unlink a BankID identity to the signed-in app-user,
  * and read whether BankID is available + already linked. Returns

package/dist/index.d.ts

@@ -1523,12 +1523,26 @@ export interface InviteArgs {
   group_ids?: string[];
 }
 
+export type AppUserInviteStatus =
+  | "pending"
+  | "accepted"
+  | "revoked"
+  | "expired";
+
 export interface AppUserInviteRow {
   id: string;
   email: string;
-  status: string;
+  /** Server-computed lifecycle value — prefer it over re-deriving expiry. */
+  status: AppUserInviteStatus;
+  name?: string;
+  group_ids?: string[];
   invited_at?: string;
   expires_at?: string;
+  accepted_at?: string | null;
+  revoked_at?: string | null;
+  created_at?: string;
+  tenant_id?: string;
+  invited_by_studio_user_id?: string | null;
 }
 
 export interface UsersApi {
@@ -1585,6 +1599,40 @@ export interface GroupsApi {
  */
 export function useGroups(query?: GroupsQuery): GroupsApi;
 
+// --------------------------------------------------------------- useInvites
+//
+// sc-5097 — pending AppUser invite administration.
+
+export interface InvitesQuery {
+  /** Defaults to "all" server-side; pass "pending" for outstanding invites. */
+  status?: AppUserInviteStatus | "all";
+  limit?: number;
+  offset?: number;
+}
+
+export interface InvitesApi {
+  invites: AppUserInviteRow[];
+  loading: boolean;
+  error: DirectoryError | null;
+  refetch(): Promise<void>;
+  /** Re-send the invitation email. Refetches on success. */
+  resend(inviteId: string): Promise<AppUserInviteRow>;
+  /** Cancel a pending invitation. Refetches on success. */
+  revoke(inviteId: string): Promise<void>;
+}
+
+/**
+ * Pending AppUser invite administration through the injected directory-client
+ * at `ctx.directory.invites.{list,resend,revoke}`.
+ *
+ * The WHOLE surface — listing included — requires the `users.write:*` scope
+ * AND the SystemAcl `users.write` capability, because a pending invite exposes
+ * the email of someone who is not a member yet. The `invites.read:*` /
+ * `invites.write:*` scope names mint but no route enforces them, so declaring
+ * only those yields a `FORBIDDEN` DirectoryError.
+ */
+export function useInvites(query?: InvitesQuery): InvitesApi;
+
 // ----------------------------------------------------- useBankIdLink
 //
 // REQ-BANKID-AUTH — link / unlink a BankID identity to the signed-in app-user.

package/dist/index.js

@@ -31,6 +31,7 @@ export {
   useDirectory,
   useUsers,
   useGroups,
+  useInvites,
   useBankIdLink,
   useIdentification,
   IdentificationError,

package/dist/index.native.js

@@ -31,6 +31,7 @@ export {
   useDirectory,
   useUsers,
   useGroups,
+  useInvites,
   useBankIdLink,
   useIdentification,
   IdentificationError,

package/dist/linter.cjs

@@ -447,6 +447,7 @@ function _scopeRules(source, manifest) {
   );
   const usesUsersHook = /\buseUsers\s*\(/.test(source);
   const usesGroupsHook = /\buseGroups\s*\(/.test(source);
+  const usesInvitesHook = /\buseInvites\s*\(/.test(source);
 
   if (usesUsersHook) {
     const reads = declared.has("users.read:*") || declared.has("users.read");
@@ -473,6 +474,22 @@ function _scopeRules(source, manifest) {
     }
   }
 
+  // sc-5097 — the whole invite surface (list, resend, revoke) is gated on
+  // the "users.write" capability, and the scope gate accepts only a signed
+  // scope matching that key. `invites.*` scopes mint but gate nothing.
+  if (usesInvitesHook) {
+    const writes =
+      declared.has("users.write:*") || declared.has("users.write");
+    if (!writes) {
+      findings.push({
+        rule: "scope-required-for-useInvites",
+        label:
+          "useInvites() requires `users.write:*` in manifest.requestedScopes",
+        line: 0,
+        snippet: "",
+      });
+    }
+  }
   const lines = source.split(/\r?\n/);
   let firedUsersWrite = false;
   let firedUsersDelete = false;

package/dist/linter.js

@@ -522,6 +522,7 @@ function _scopeRules(source, manifest) {
   );
   const usesUsersHook = /\buseUsers\s*\(/.test(source);
   const usesGroupsHook = /\buseGroups\s*\(/.test(source);
+  const usesInvitesHook = /\buseInvites\s*\(/.test(source);
 
   if (usesUsersHook) {
     const reads = declared.has("users.read:*") || declared.has("users.read");
@@ -547,6 +548,22 @@ function _scopeRules(source, manifest) {
     }
   }
 
+  // sc-5097 — the whole invite surface (list, resend, revoke) is gated on
+  // the "users.write" capability, and the scope gate accepts only a signed
+  // scope matching that key. `invites.*` scopes mint but gate nothing.
+  if (usesInvitesHook) {
+    const writes =
+      declared.has("users.write:*") || declared.has("users.write");
+    if (!writes) {
+      findings.push({
+        rule: "scope-required-for-useInvites",
+        label:
+          "useInvites() requires `users.write:*` in manifest.requestedScopes",
+        line: 0,
+        snippet: "",
+      });
+    }
+  }
   const lines = source.split(/\r?\n/);
   let firedUsersWrite = false;
   let firedUsersDelete = false;

package/dist/manifest.cjs

@@ -4,7 +4,7 @@
 // re-exports the same functions defined here so there is exactly one
 // implementation.
 
-const { CONTRACT, normaliseActionTriggerTypes } = require("./contract.cjs");
+const { CONTRACT } = require("./contract.cjs");
 
 const PAYLOAD_VALUE_TYPES = CONTRACT.payloadValueTypes;
 
@@ -39,20 +39,6 @@ const VALID_CATEGORIES = new Set([
 ]);
 const VALID_PLATFORMS = new Set(["web", "native"]);
 
-// REQ-WIDGET-ACTION — structural validation for manifest-declared server
-// actions. Mirrors the backend action.service caps; the runner re-validates
-// the cron expression (node-cron) and binds the tenant-local API key + table
-// at enable time, so we only check shape + size here (cross-env: no Buffer).
-const VALID_ACTION_TRIGGERS = new Set([
-  "schedule",
-  "record_created",
-  "record_updated",
-  "record_deleted",
-]);
-const ACTION_SCRIPT_MAX_BYTES = 200 * 1024;
-const ACTION_TIMEOUT_MIN_MS = 100;
-const ACTION_TIMEOUT_MAX_MS = 5 * 60 * 1000;
-
 // REQ-L10N-WIDGET — caps + patterns for manifest-declared translations.
 // The relative key pattern is deliberately tighter than the dictionary's
 // own KEY_RE: once the host namespaces it (`widget.<id>.<key>`) the result
@@ -133,54 +119,22 @@ function validateManifestTranslations(translations, manifestId, errors) {
   }
 }
 
-function validateManifestActions(actions, errors) {
-  if (!Array.isArray(actions)) {
-    errors.push("manifest.actions must be an array (omit it or use [] for none)");
-    return;
-  }
-  const seenKeys = new Set();
-  for (const a of actions) {
-    if (a === null || typeof a !== "object") {
-      errors.push("manifest.actions entries must be objects");
-      break;
-    }
-    if (!isNonEmptyString(a.key)) {
-      errors.push("manifest.actions[].key must be a non-empty string");
-    } else if (seenKeys.has(a.key)) {
-      errors.push(`manifest.actions[].key "${a.key}" is duplicated`);
-    } else {
-      seenKeys.add(a.key);
-    }
-    pushIf(errors, isNonEmptyString(a.name), "manifest.actions[].name must be a non-empty string");
-    const triggerTypes = normaliseActionTriggerTypes(a);
-    if (triggerTypes === null) {
-      errors.push(
-        `manifest.actions[].triggerTypes must be a non-empty array of unique values from ${[...VALID_ACTION_TRIGGERS].join(", ")}`,
-      );
-    } else if (triggerTypes.includes("schedule")) {
-      pushIf(
-        errors,
-        isNonEmptyString(a.scheduleCron),
-        "manifest.actions[].scheduleCron is required when triggerTypes contains 'schedule'",
-      );
-    }
-    if (!isNonEmptyString(a.scriptSource)) {
-      errors.push("manifest.actions[].scriptSource must be a non-empty string");
-    } else if (utf8ByteLength(a.scriptSource) > ACTION_SCRIPT_MAX_BYTES) {
-      errors.push("manifest.actions[].scriptSource exceeds 200 KiB");
-    }
-    if (a.timeoutMs !== undefined) {
-      const t = Number(a.timeoutMs);
-      if (!Number.isFinite(t) || t < ACTION_TIMEOUT_MIN_MS || t > ACTION_TIMEOUT_MAX_MS) {
-        errors.push("manifest.actions[].timeoutMs must be between 100 and 300000");
-      }
-    }
-    if (a.triggerTableId !== undefined || a.apiKeyId !== undefined) {
-      errors.push(
-        "manifest.actions[] must not include triggerTableId or apiKeyId — those are tenant-local and bound after install",
-      );
-    }
-  }
+// REQ-MKT-ACTION (sc-4879): a widget no longer declares server-side actions.
+//
+// `manifest.actions` was how an automation shipped before Actions existed as
+// their own marketplace deliverable — a widget was two products in one package,
+// a component that renders and a script that never renders at all. It is now
+// REFUSED rather than ignored: an author who declares it believes the
+// automation will ship, and silence would publish that misunderstanding.
+//
+// The replacement is a marketplace Action (`@colixsystems/action-sdk`), which
+// the workspace installs and configures on its own.
+function validateManifestActions(_actions, errors) {
+  errors.push(
+    "manifest.actions is no longer supported — ship the automation as a " +
+      "marketplace Action (@colixsystems/action-sdk) instead of declaring it " +
+      "on a widget",
+  );
 }
 
 function canonicalCategory(c) {
@@ -355,7 +309,7 @@ function validateManifest(m) {
     }
   }
 
-  // `actions` is optional (additive in SDK 1.8.0) — only validate when present.
+  // Present at all is now an error (sc-4879) — see validateManifestActions.
   if (manifest.actions !== undefined) {
     validateManifestActions(manifest.actions, errors);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.92.0",
+  "version": "0.94.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "type": "module",
   "main": "./dist/index.js",
@@ -48,7 +48,7 @@
   ],
   "scripts": {
     "build": "node scripts/build.js",
-    "test": "node --test src/__tests__/contract.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/theme-components-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/toast-host.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js"
+    "test": "node --test src/__tests__/contract.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-invites.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/theme-components-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/toast-host.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js"
   },
   "engines": {
     "node": ">=18"