@lotics/app-sdk 0.114.0 → 0.115.0

package/dist/index.js

@@ -23971,6 +23971,180 @@ function everyOptionMarked(nameOf2) {
   };
 }
 
+// ../shared/src/schemas/iam.ts
+var jsonSchemaSchema = zod_default.string();
+var organizationSchema = zod_default.object({
+  id: zod_default.string().describe("Unique identifier for the organization"),
+  name: zod_default.string().describe("Display name of the organization"),
+  slug: zod_default.string().nullable().describe("Slug for the organization")
+});
+var memberAccountTypeSchema = zod_default.enum(["self_managed", "admin_managed", "service"]).describe(
+  "How the account is credentialed. admin_managed means an admin chose the sign-in name and set the password; the account has NO email address at all, so nothing can be mailed to it until the member claims one they control. service means no credential exists at all \u2014 the membership is an integration's identity, reached only by an API key bound to it."
+);
+var ALL_ACCOUNT_TYPES = memberAccountTypeSchema.options;
+var memberSchema = zod_default.object({
+  member_id: zod_default.string().describe("Unique identifier for the member"),
+  organization_id: zod_default.string().describe("Organization ID the member belongs to"),
+  name: zod_default.string().describe("Display name of the member"),
+  email_address: zod_default.string().nullable().describe(
+    "What the member types to sign in: an email address for a self-managed member, an administrator-issued name (e.g. giamdoc.sunrise) for an admin-managed one. The latter is NOT an address and cannot receive mail \u2014 the field name predates the split. Null for a service identity, which holds no credential and signs in nowhere."
+  ),
+  role: zod_default.enum(["owner", "admin", "member"]).describe("Organization role"),
+  image: zod_default.string().nullable().optional().describe("URL to the member's profile picture"),
+  account_type: memberAccountTypeSchema,
+  archived: zod_default.boolean().optional().describe(
+    "True when this person has been removed from the organization. The membership survives removal so records naming them keep resolving; it grants nothing. Optional because an older server omits it \u2014 absent means active."
+  ),
+  joined_at: zod_default.string().optional().describe(
+    "ISO timestamp of when this membership began. Optional because an older server omits it \u2014 absent means not told, never 'joined at the epoch'."
+  )
+});
+var pendingInvitationSchema = zod_default.object({
+  invitation_id: zod_default.string().describe("Unique identifier for the pending invitation"),
+  organization_id: zod_default.string().describe("Organization the invitee will join on accept"),
+  email: zod_default.string().describe("Email the invitation was sent to"),
+  name: zod_default.string().nullable().describe("Admin-supplied display name (carried onto member.name on accept; invitee can override at accept time)"),
+  role: zod_default.enum(["owner", "admin", "member"]).describe("Role the invitee will receive on accept"),
+  expires_at: zod_default.string().describe("ISO timestamp when the invitation expires")
+});
+var ianaTimezoneSchema = zod_default.string().refine(
+  (tz) => {
+    try {
+      new Intl.DateTimeFormat("en-US", { timeZone: tz });
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  { message: "must be an IANA timezone name, e.g. Asia/Ho_Chi_Minh or America/New_York" }
+).describe("IANA timezone name (e.g., 'America/New_York', 'Asia/Ho_Chi_Minh')");
+var currencyCodeSchema = zod_default.string().trim().toUpperCase().regex(/^[A-Z]{3}$/, "must be an ISO 4217 currency code, e.g. VND, USD, EUR").describe("ISO 4217 currency code (e.g. 'VND', 'USD', 'EUR'). Upper-cased.");
+var workspaceSchema = zod_default.object({
+  id: zod_default.string().describe("Unique identifier for the workspace"),
+  name: zod_default.string().describe("Display name of the workspace"),
+  default_currency: zod_default.string().describe("Default currency code for the workspace"),
+  // Plain string on the way OUT, deliberately. This is a response schema, so
+  // validating here would make the server reject its own stored rows — and on
+  // the workspace LIST one bad row fails the entire array. The zone is enforced
+  // where it is written; a read is too late to do anything about it anyway.
+  timezone: zod_default.string().describe("IANA timezone name (e.g., 'America/New_York', 'Asia/Ho_Chi_Minh')"),
+  organization_id: zod_default.string().describe("Organization ID this workspace belongs to"),
+  created_at: zod_default.string().describe("Timestamp when workspace was created")
+});
+var memberGroupSchema = zod_default.object({
+  id: zod_default.string().describe("Unique identifier for the member group"),
+  name: zod_default.string().describe("Display name of the group"),
+  description: zod_default.string().optional().describe("Optional description of the group's purpose"),
+  member_ids: zod_default.array(zod_default.string()).describe("Array of member IDs in this group"),
+  invitation_ids: zod_default.array(zod_default.string()).describe("Array of pending invitation IDs pre-granted membership; migrated to member_ids on accept"),
+  organization_id: zod_default.string().describe("ID of the organization this group belongs to"),
+  created_at: zod_default.string().describe("Timestamp when group was created"),
+  created_by: zod_default.string().describe("Member ID of the user who created this group")
+});
+var principalGroupSchema = zod_default.object({
+  id: zod_default.string().describe("Unique identifier for the member group"),
+  name: zod_default.string().describe("Display name of the group"),
+  description: zod_default.string().optional().describe("Optional description of the group's purpose"),
+  member_count: zod_default.number().int().describe("Number of accepted members in the group"),
+  invitation_count: zod_default.number().int().describe("Number of pending invitations pre-granted membership")
+});
+var PUBLIC_PRINCIPAL_ID = "public";
+var principalSchema = zod_default.discriminatedUnion("type", [
+  zod_default.object({
+    type: zod_default.literal("member").describe("Principal type: individual member"),
+    id: zod_default.string().describe("Member ID")
+  }),
+  zod_default.object({
+    type: zod_default.literal("member_group").describe("Principal type: group of members"),
+    id: zod_default.string().describe("Member group ID")
+  }),
+  zod_default.object({
+    type: zod_default.literal("organization").describe("Principal type: all members in organization"),
+    id: zod_default.string().describe("Organization ID")
+  }),
+  zod_default.object({
+    type: zod_default.literal("public").describe("Principal type: anyone, including unauthenticated visitors"),
+    id: zod_default.literal(PUBLIC_PRINCIPAL_ID).describe("Always the `public` sentinel \u2014 no entity")
+  }),
+  // Pending invitation as principal: lets admins pre-grant group membership and
+  // resource access before the invitee accepts. Never resolved as a Subject —
+  // a pending invitee cannot authenticate, so these bindings stay dormant until
+  // accept-time migration rewrites them to type:"member".
+  zod_default.object({
+    type: zod_default.literal("invitation").describe("Principal type: pending invitation (not yet accepted)"),
+    id: zod_default.string().describe("Invitation ID")
+  })
+]);
+var subjectSchema = zod_default.discriminatedUnion("type", [
+  zod_default.object({
+    type: zod_default.literal("member").describe("Subject type: authenticated member"),
+    id: zod_default.string().describe("Member ID")
+  }),
+  zod_default.object({
+    type: zod_default.literal("public").describe("Subject type: unauthenticated visitor")
+  })
+]);
+var resourceTypeSchema = zod_default.enum(["table", "table_view", "app", "automation", "skill", "document_template", "instruction", "knowledge_doc", "connected_account"]);
+var RESOURCE_ROLE_ACTIONS = {
+  table: {
+    editor: ["read_data", "write_data"],
+    viewer: ["read_data"]
+  },
+  app: { manager: ["use", "manage"], user: ["use"] },
+  skill: { manager: ["use", "manage"], user: ["use"] },
+  document_template: { manager: ["use", "manage"], user: ["use"] },
+  instruction: { manager: ["use", "manage"], user: ["use"] },
+  knowledge_doc: { manager: ["use", "manage"], user: ["use"] },
+  connected_account: { manager: ["use", "manage"], user: ["use"] },
+  table_view: {},
+  automation: {}
+};
+function shareableRolesFor(type) {
+  return Object.keys(RESOURCE_ROLE_ACTIONS[type]);
+}
+var SHAREABLE_RESOURCE_TYPES = resourceTypeSchema.options.filter(
+  (type) => shareableRolesFor(type).length > 0
+);
+var accessPrincipalSchema = zod_default.discriminatedUnion("type", [
+  zod_default.object({
+    type: zod_default.literal("member").describe("Principal type: an individual member"),
+    id: zod_default.string().describe("Member ID")
+  }),
+  zod_default.object({
+    type: zod_default.literal("member_group").describe("Principal type: a member group"),
+    id: zod_default.string().describe("Group ID")
+  }),
+  zod_default.object({
+    type: zod_default.literal("organization").describe("Principal type: everyone in the organization"),
+    id: zod_default.string().describe("Organization ID")
+  })
+]);
+var resourceAccessSchema = zod_default.object({
+  resource_id: zod_default.string().describe("ID of the resource these principals can reach"),
+  principals: zod_default.array(accessPrincipalSchema).describe("Members, groups and the organization that have been granted access")
+});
+var contentResourceTypeSchema = zod_default.enum(["knowledge_doc", "document_template"]);
+var contentItemSchema = zod_default.object({
+  id: zod_default.string().describe("ID of the knowledge doc or template"),
+  name: zod_default.string().describe("Its name"),
+  owner_member_id: zod_default.string().nullable().describe("Member who owns it; null when nobody does"),
+  created_at: zod_default.string().describe("When it was created"),
+  updated_at: zod_default.string().nullable().describe("When a knowledge doc was last changed; null for a template"),
+  hidden_at: zod_default.string().nullable().describe("When a knowledge doc was hidden; null when it is in use, and for a template"),
+  template_type: zod_default.string().nullable().describe("A template's type (html, email, word, excel, pdf-form); null for a knowledge doc"),
+  can_open: zod_default.boolean().describe("Whether the caller may open it; false means it is not shared with them"),
+  principals: zod_default.array(accessPrincipalSchema).describe("Members, groups and the organization it has been shared with, besides its owner")
+});
+var resourceRoleBindingSchema = zod_default.object({
+  id: zod_default.string().describe("Unique identifier for the role binding"),
+  principal: principalSchema.describe(
+    "Who this role binding applies to (member, group, or organization)"
+  ),
+  resource_type: resourceTypeSchema.describe("Type of resource being accessed"),
+  resource_id: zod_default.string().describe("ID of the specific resource"),
+  role: zod_default.string().describe("Role name (e.g., 'viewer', 'editor', 'manager', 'user')")
+});
+
 // ../shared/src/diacritics.ts
 var COMBINING_MARKS = /[̀-ͯ]/g;
 function foldDiacritics(value) {
@@ -24831,7 +25005,7 @@ var tableFieldTypeConfigSchema = zod_default.discriminatedUnion("type", [
   zod_default.object({
     type: zod_default.literal("number"),
     format: numberFormatSchema.default("number"),
-    currency: zod_default.string().optional().describe("ISO 4217 code"),
+    currency: currencyCodeSchema.optional(),
     unit: zod_default.string().optional().describe(UNIT_DESCRIPTION),
     unit_field: zod_default.string().optional().describe(UNIT_FIELD_DESCRIPTION),
     currency_field: zod_default.string().optional().describe(CURRENCY_FIELD_DESCRIPTION),
@@ -24900,7 +25074,7 @@ var tableFieldTypeConfigSchema = zod_default.discriminatedUnion("type", [
   }),
   zod_default.object({
     type: zod_default.literal("formula"),
-    formula: formulaInputSchema
+    formula: formulaInputSchema.extend({ currency: currencyCodeSchema.optional() })
   }).superRefine((field, ctx) => figureIssue(["formula"])(field.formula, ctx)),
   // `button` is deliberately absent: button fields are legacy — this union
   // shapes CREATE input only, and new buttons can no longer be created
@@ -24972,173 +25146,6 @@ function projectCell(field, value) {
   }
 }
 
-// ../shared/src/walk_workflow_expression.ts
-var LINKED_CALL = "linked";
-var GRAMMAR_NAME_SHAPE = `${LINKED_CALL}(record["fld_link"])[0] fetches one linked row`;
-var RUNTIME_KEYS = /* @__PURE__ */ new Set([
-  "timezone",
-  "workflow_id",
-  "execution_id",
-  "workspace_id",
-  "organization_id",
-  "now",
-  "change_origin",
-  "execution_principal",
-  "triggered_by_member_id"
-]);
-var CURRENT_MEMBER_IN_ANY_GROUP = "current_member_in_any_group";
-var PARKED_RUNTIME_KEYS = /* @__PURE__ */ new Map([
-  [
-    "execution_principal",
-    `runtime.execution_principal is not readable \u2014 a workflow runs under the OWNER's authority, so it never answers "is the person who triggered this allowed?". Authorize the caller with ${CURRENT_MEMBER_IN_ANY_GROUP}(["grp_\u2026"]) or read runtime.triggered_by_member_id.`
-  ]
-]);
-var READABLE_RUNTIME_KEYS = Array.from(RUNTIME_KEYS).filter(
-  (key) => !PARKED_RUNTIME_KEYS.has(key)
-);
-var INLINE_HELPERS = [
-  "formatCurrency",
-  "randomNumber",
-  "randomAlphaNumeric",
-  "sample",
-  // Actor authorization predicate — resolves the triggering member's groups
-  // server-side (bound in the backend helper registry, not a pure shared
-  // helper).
-  CURRENT_MEMBER_IN_ANY_GROUP
-];
-var HELPERS = /* @__PURE__ */ new Set([
-  ...Object.keys(expression_array_exports),
-  ...Object.keys(expression_string_exports),
-  ...Object.keys(expression_math_exports),
-  ...Object.keys(expression_object_exports),
-  ...Object.keys(expression_type_exports),
-  ...Object.keys(getDateExpressionFunctions()),
-  ...INLINE_HELPERS
-]);
-function isHelper(name) {
-  return HELPERS.has(name);
-}
-var HELPER_MENU = [
-  `text \u2014 ${Object.keys(expression_string_exports).sort().join(", ")}`,
-  `number \u2014 ${Object.keys(expression_math_exports).sort().join(", ")}`,
-  `array \u2014 ${Object.keys(expression_array_exports).sort().join(", ")}`,
-  `object \u2014 ${Object.keys(expression_object_exports).sort().join(", ")}`,
-  `type/null \u2014 ${Object.keys(expression_type_exports).sort().join(", ")}`,
-  `date \u2014 ${Object.keys(getDateExpressionFunctions()).sort().join(", ")}`,
-  `other \u2014 ${[...INLINE_HELPERS].sort().join(", ")}`
-].join("; ");
-var AWAIT_IF_FORM = "Write the if form: let x = null; if (<condition>) { x = await tool({...}); }";
-var AWAIT_IN_OPTIONAL_CHAIN = `An await after \`?.\` runs only when the value before it is not null. ${AWAIT_IF_FORM}`;
-var CALLBACK_HELPERS = /* @__PURE__ */ new Set([
-  "filter",
-  "find",
-  "pluck",
-  "sortBy",
-  "sumBy",
-  "meanBy",
-  "minBy",
-  "maxBy",
-  "countBy",
-  "groupBy",
-  "uniqueBy",
-  "some",
-  "every",
-  "differenceBy",
-  "intersectionBy",
-  "reduce"
-]);
-var LAMBDA_POSITION_HINT = `Function expressions are not supported here. A lambda \u2014 either \`(x) => <expr>\` or \`function (x) { return <expr>; }\` \u2014 is legal only INLINE as a callback argument to ${[...CALLBACK_HELPERS].sort().join(" / ")}, e.g. pluck(rows, (r) => r.qty * r.price). To NAME reusable logic, declare it at the top level instead: \`function toLine(l = {}) { return { ... }; }\` \u2014 every parameter needs a default, and the body is inlined at each call site. Binding a lambda to a name (const f = (x) => ...) or calling one directly stays unsupported.`;
-var HELPER_ALIASES = /* @__PURE__ */ new Map([
-  ["String", "toString"],
-  ["Number", "toNumber"],
-  ["parseFloat", "toNumber"],
-  // faithful: toNumber IS parseFloat semantics
-  ["toUpperCase", "upper"],
-  ["toLowerCase", "lower"],
-  ["map", "pluck"],
-  // arr.map(x => …) ≡ pluck(arr, x => …)
-  ["toFixed", "formatNumber"]
-  // x.toFixed(2) ≡ formatNumber(x, 2)
-]);
-var REJECTED_HELPERS = /* @__PURE__ */ new Map([
-  [
-    "parseInt",
-    {
-      message: "parseInt is not supported \u2014 parse with toNumber(x), then apply floor(...), ceil(...), or round(...) to get a whole number. floor rounds down (toward negative infinity), so for negative values choose the rounding deliberately.",
-      construct: "parse_int"
-    }
-  ]
-]);
-var NAMESPACE_HELPERS = /* @__PURE__ */ new Map([
-  ["JSON", /* @__PURE__ */ new Map([["parse", "parseJson"], ["stringify", "toJson"]])],
-  ["Array", /* @__PURE__ */ new Map([["isArray", "isArray"]])],
-  ["Object", /* @__PURE__ */ new Map([["keys", "keys"], ["values", "values"], ["entries", "entries"]])],
-  ["Number", /* @__PURE__ */ new Map([["parseFloat", "toNumber"]])]
-]);
-var METHOD_FORM_NAMES = /* @__PURE__ */ new Set([
-  // String.prototype
-  "trim",
-  "toUpperCase",
-  "toLowerCase",
-  "replace",
-  "replaceAll",
-  "split",
-  "substring",
-  "padStart",
-  "padEnd",
-  "startsWith",
-  "endsWith",
-  // String.prototype + Array.prototype
-  "includes",
-  "slice",
-  "at",
-  "concat",
-  // Array.prototype
-  "join",
-  "reverse",
-  "map",
-  "filter",
-  "find",
-  "some",
-  "every",
-  "reduce",
-  // Number.prototype / Object.prototype
-  "toFixed",
-  "toString"
-]);
-var METHOD_FORM_MENU = [...METHOD_FORM_NAMES].sort().join(", ");
-var PROPERTY_HELPERS = /* @__PURE__ */ new Map([["length", "length"]]);
-var HELPER_SPELLINGS = (() => {
-  const out = /* @__PURE__ */ new Map();
-  const add = (helper, spelling) => {
-    if (isHelper(helper) && !out.has(helper)) out.set(helper, spelling);
-  };
-  for (const name of METHOD_FORM_NAMES) add(HELPER_ALIASES.get(name) ?? name, { kind: "method", name });
-  for (const [name, helper] of PROPERTY_HELPERS) add(helper, { kind: "property", name });
-  for (const [namespace, members2] of NAMESPACE_HELPERS) {
-    for (const [member, helper] of members2) add(helper, { kind: "namespace", namespace, member });
-  }
-  for (const fn of Object.keys(expression_math_exports)) {
-    if (fn !== "random" && typeof Reflect.get(Math, fn) === "function") {
-      add(fn, { kind: "namespace", namespace: "Math", member: fn });
-    }
-  }
-  return out;
-})();
-var RESERVED_CALLABLE_NAMES = /* @__PURE__ */ new Set([
-  ...REJECTED_HELPERS.keys(),
-  ...NAMESPACE_HELPERS.keys(),
-  "Math",
-  "Boolean"
-]);
-var LINKED_ARITY = `${LINKED_CALL}(...) takes exactly one argument \u2014 the read of the link field, e.g. ${LINKED_CALL}(record["fld_link"])[0] for one row or ${LINKED_CALL}(record["fld_link"]) for every row.`;
-var LINKED_ARGUMENT_SHAPE = `The argument of ${LINKED_CALL}(...) must END on the link field, because that field is what it follows \u2014 ${LINKED_CALL}(record["fld_link"])[0]. A value that names no field (a binding, a literal, a helper result) cannot say which link to follow; read the field on it: ${LINKED_CALL}(ids["fld_link"]).`;
-var LINKED_OPTIONAL_RESULT = `${LINKED_CALL}(...) always returns an array, never null, so \`?.\` on its result can never fire. The argument takes a guard \u2014 ${LINKED_CALL}(record?.["fld_link"])[0] \u2014 and so does the fetched row, which is null where the linked record is deleted or unreadable: ${LINKED_CALL}(record["fld_link"])[0]?.["fld_x"].`;
-var LINKED_METHOD_FORM = `${LINKED_CALL} has no method form \u2014 write ${LINKED_CALL}(record["fld_link"])[0], with the link read as the argument.`;
-var LINKED_ON_NON_RECORD = `${LINKED_CALL}(...) follows a link field on a record, and this value is not one. Read the record first, then follow the link: ${LINKED_CALL}(record["fld_link"])[0].`;
-var LINKED_ON_CHANGES = `A change diff is not a record, so ${LINKED_CALL}(...) cannot follow a link off it. Read the post-state with ${LINKED_CALL}(record["fld_link"]) or the pre-state with ${LINKED_CALL}(prev_record["fld_link"]).`;
-var READ_ROOT_HINT = `A read starts from a name: a reserved identifier (record, prev_record, changes, runtime, trigger, index), a binding, or ${LINKED_CALL}(record["fld_link"]). Bind the value first \u2014 const x = <expression>; \u2014 then read x.y.`;
-
 // ../shared/src/schemas/workflow_expressions.ts
 var runtimeKeySchema = zod_default.enum([
   "timezone",
@@ -25148,15 +25155,6 @@ var runtimeKeySchema = zod_default.enum([
   "organization_id",
   "now",
   "change_origin",
-  // PARKED — accepted in stored ASTs, rejected for new saves at parse (see
-  // `PARKED_RUNTIME_KEYS` in walk_workflow_expression.ts). It is the OWNER's
-  // principal (a workflow runs under owner authority), so it can't answer the
-  // caller-authorization question anyone reads it for; the generated `.d.ts`
-  // omits it and the docs point at `current_member_in_any_group` /
-  // `runtime.triggered_by_member_id` instead. The entry stays so any stored
-  // AST keeps validating and executing — drop it only once a prod probe shows
-  // zero references (`workflows.steps_v2::text LIKE '%execution_principal%'`).
-  "execution_principal",
   "triggered_by_member_id"
 ]);
 var nestedExpressionSchema = zod_default.lazy(
@@ -25329,6 +25327,154 @@ var templatePartSchema = zod_default.lazy(
   ])
 );
 
+// ../shared/src/walk_workflow_expression.ts
+var LINKED_CALL = "linked";
+var GRAMMAR_NAME_SHAPE = `${LINKED_CALL}(record["fld_link"])[0] fetches one linked row`;
+var RUNTIME_KEYS = new Set(runtimeKeySchema.options);
+var CURRENT_MEMBER_IN_ANY_GROUP = "current_member_in_any_group";
+var INLINE_HELPERS = [
+  "formatCurrency",
+  "randomNumber",
+  "randomAlphaNumeric",
+  "sample",
+  // Actor authorization predicate — resolves the triggering member's groups
+  // server-side (bound in the backend helper registry, not a pure shared
+  // helper).
+  CURRENT_MEMBER_IN_ANY_GROUP
+];
+var HELPERS = /* @__PURE__ */ new Set([
+  ...Object.keys(expression_array_exports),
+  ...Object.keys(expression_string_exports),
+  ...Object.keys(expression_math_exports),
+  ...Object.keys(expression_object_exports),
+  ...Object.keys(expression_type_exports),
+  ...Object.keys(getDateExpressionFunctions()),
+  ...INLINE_HELPERS
+]);
+function isHelper(name) {
+  return HELPERS.has(name);
+}
+var HELPER_MENU = [
+  `text \u2014 ${Object.keys(expression_string_exports).sort().join(", ")}`,
+  `number \u2014 ${Object.keys(expression_math_exports).sort().join(", ")}`,
+  `array \u2014 ${Object.keys(expression_array_exports).sort().join(", ")}`,
+  `object \u2014 ${Object.keys(expression_object_exports).sort().join(", ")}`,
+  `type/null \u2014 ${Object.keys(expression_type_exports).sort().join(", ")}`,
+  `date \u2014 ${Object.keys(getDateExpressionFunctions()).sort().join(", ")}`,
+  `other \u2014 ${[...INLINE_HELPERS].sort().join(", ")}`
+].join("; ");
+var AWAIT_IF_FORM = "Write the if form: let x = null; if (<condition>) { x = await tool({...}); }";
+var AWAIT_IN_OPTIONAL_CHAIN = `An await after \`?.\` runs only when the value before it is not null. ${AWAIT_IF_FORM}`;
+var CALLBACK_HELPERS = /* @__PURE__ */ new Set([
+  "filter",
+  "find",
+  "pluck",
+  "sortBy",
+  "sumBy",
+  "meanBy",
+  "minBy",
+  "maxBy",
+  "countBy",
+  "groupBy",
+  "uniqueBy",
+  "some",
+  "every",
+  "differenceBy",
+  "intersectionBy",
+  "reduce"
+]);
+var LAMBDA_POSITION_HINT = `Function expressions are not supported here. A lambda \u2014 either \`(x) => <expr>\` or \`function (x) { return <expr>; }\` \u2014 is legal only INLINE as a callback argument to ${[...CALLBACK_HELPERS].sort().join(" / ")}, e.g. pluck(rows, (r) => r.qty * r.price). To NAME reusable logic, declare it at the top level instead: \`function toLine(l = {}) { return { ... }; }\` \u2014 every parameter needs a default, and the body is inlined at each call site. Binding a lambda to a name (const f = (x) => ...) or calling one directly stays unsupported.`;
+var HELPER_ALIASES = /* @__PURE__ */ new Map([
+  ["String", "toString"],
+  ["Number", "toNumber"],
+  ["parseFloat", "toNumber"],
+  // faithful: toNumber IS parseFloat semantics
+  ["toUpperCase", "upper"],
+  ["toLowerCase", "lower"],
+  ["map", "pluck"],
+  // arr.map(x => …) ≡ pluck(arr, x => …)
+  ["toFixed", "formatNumber"]
+  // x.toFixed(2) ≡ formatNumber(x, 2)
+]);
+var REJECTED_HELPERS = /* @__PURE__ */ new Map([
+  [
+    "parseInt",
+    {
+      message: "parseInt is not supported \u2014 parse with toNumber(x), then apply floor(...), ceil(...), or round(...) to get a whole number. floor rounds down (toward negative infinity), so for negative values choose the rounding deliberately.",
+      construct: "parse_int"
+    }
+  ]
+]);
+var NAMESPACE_HELPERS = /* @__PURE__ */ new Map([
+  ["JSON", /* @__PURE__ */ new Map([["parse", "parseJson"], ["stringify", "toJson"]])],
+  ["Array", /* @__PURE__ */ new Map([["isArray", "isArray"]])],
+  ["Object", /* @__PURE__ */ new Map([["keys", "keys"], ["values", "values"], ["entries", "entries"]])],
+  ["Number", /* @__PURE__ */ new Map([["parseFloat", "toNumber"]])]
+]);
+var METHOD_FORM_NAMES = /* @__PURE__ */ new Set([
+  // String.prototype
+  "trim",
+  "toUpperCase",
+  "toLowerCase",
+  "replace",
+  "replaceAll",
+  "split",
+  "substring",
+  "padStart",
+  "padEnd",
+  "startsWith",
+  "endsWith",
+  // String.prototype + Array.prototype
+  "includes",
+  "slice",
+  "at",
+  "concat",
+  // Array.prototype
+  "join",
+  "reverse",
+  "map",
+  "filter",
+  "find",
+  "some",
+  "every",
+  "reduce",
+  // Number.prototype / Object.prototype
+  "toFixed",
+  "toString"
+]);
+var METHOD_FORM_MENU = [...METHOD_FORM_NAMES].sort().join(", ");
+var PROPERTY_HELPERS = /* @__PURE__ */ new Map([["length", "length"]]);
+var HELPER_SPELLINGS = (() => {
+  const out = /* @__PURE__ */ new Map();
+  const add = (helper, spelling) => {
+    if (isHelper(helper) && !out.has(helper)) out.set(helper, spelling);
+  };
+  for (const name of METHOD_FORM_NAMES) add(HELPER_ALIASES.get(name) ?? name, { kind: "method", name });
+  for (const [name, helper] of PROPERTY_HELPERS) add(helper, { kind: "property", name });
+  for (const [namespace, members2] of NAMESPACE_HELPERS) {
+    for (const [member, helper] of members2) add(helper, { kind: "namespace", namespace, member });
+  }
+  for (const fn of Object.keys(expression_math_exports)) {
+    if (fn !== "random" && typeof Reflect.get(Math, fn) === "function") {
+      add(fn, { kind: "namespace", namespace: "Math", member: fn });
+    }
+  }
+  return out;
+})();
+var RESERVED_CALLABLE_NAMES = /* @__PURE__ */ new Set([
+  ...REJECTED_HELPERS.keys(),
+  ...NAMESPACE_HELPERS.keys(),
+  "Math",
+  "Boolean"
+]);
+var LINKED_ARITY = `${LINKED_CALL}(...) takes exactly one argument \u2014 the read of the link field, e.g. ${LINKED_CALL}(record["fld_link"])[0] for one row or ${LINKED_CALL}(record["fld_link"]) for every row.`;
+var LINKED_ARGUMENT_SHAPE = `The argument of ${LINKED_CALL}(...) must END on the link field, because that field is what it follows \u2014 ${LINKED_CALL}(record["fld_link"])[0]. A value that names no field (a binding, a literal, a helper result) cannot say which link to follow; read the field on it: ${LINKED_CALL}(ids["fld_link"]).`;
+var LINKED_OPTIONAL_RESULT = `${LINKED_CALL}(...) always returns an array, never null, so \`?.\` on its result can never fire. The argument takes a guard \u2014 ${LINKED_CALL}(record?.["fld_link"])[0] \u2014 and so does the fetched row, which is null where the linked record is deleted or unreadable: ${LINKED_CALL}(record["fld_link"])[0]?.["fld_x"].`;
+var LINKED_METHOD_FORM = `${LINKED_CALL} has no method form \u2014 write ${LINKED_CALL}(record["fld_link"])[0], with the link read as the argument.`;
+var LINKED_ON_NON_RECORD = `${LINKED_CALL}(...) follows a link field on a record, and this value is not one. Read the record first, then follow the link: ${LINKED_CALL}(record["fld_link"])[0].`;
+var LINKED_ON_CHANGES = `A change diff is not a record, so ${LINKED_CALL}(...) cannot follow a link off it. Read the post-state with ${LINKED_CALL}(record["fld_link"]) or the pre-state with ${LINKED_CALL}(prev_record["fld_link"]).`;
+var READ_ROOT_HINT = `A read starts from a name: a reserved identifier (record, prev_record, changes, runtime, trigger, index), a binding, or ${LINKED_CALL}(record["fld_link"]). Bind the value first \u2014 const x = <expression>; \u2014 then read x.y.`;
+
 // ../shared/src/chat_models.ts
 var MODEL_TIERS = ["haiku", "sonnet", "opus"];
 var TIER_MODELS = {
@@ -26976,36 +27122,46 @@ var WorkflowEvalError = class extends Error {
   detail;
 };
 var WorkflowTimeBudgetError = class extends Error {
-  constructor(subject, budgetMs) {
-    super(`${subject} exceeded its time budget of ${budgetMs / 1e3}s.`);
+  /** `waitedFor`: what the run's deadline passed waiting on, when that was not the run's own work. */
+  constructor(subject, budgetMs, waitedFor) {
+    super(`${subject} exceeded its time budget of ${budgetMs / 1e3}s${waitedFor === void 0 ? "" : ` waiting for ${waitedFor}`}.`);
     this.name = "WorkflowTimeBudgetError";
   }
 };
 var WorkflowExpressionBudgetError = class extends Error {
-  constructor(exceeded) {
-    super(
-      exceeded === "nodes" ? `Expression evaluated more than ${MAX_EVALUATION_NODES} nodes. A callback nested in another runs once per pair of elements.` : `The run built more than ${MAX_RUN_BUILT_BYTES / 1024 / 1024}MB of arrays, objects and text. Build long text with join() rather than a fold of +.`
-    );
-    this.exceeded = exceeded;
+  constructor(budget) {
+    super(budgetMessage(budget));
+    this.budget = budget;
     this.name = "WorkflowExpressionBudgetError";
   }
-  exceeded;
+  budget;
 };
-var MAX_EVALUATION_NODES = 2e7;
+function budgetMessage(budget) {
+  switch (budget.exceeded) {
+    case "bytes":
+      return `The run built more than ${MAX_RUN_BUILT_BYTES / 1024 / 1024}MB of arrays, objects and text.`;
+    case "heap":
+      return `The expression used more than ${budget.heap_mb}MB of memory.`;
+    case "compute":
+      return `The expression computed for more than ${budget.compute_ms / 1e3}s.`;
+  }
+}
 var SLOT_BYTES = 8;
 var CHAR_BYTES = 2;
+var OBJECT_BYTES = 56;
 var EVALUATION_SLICE_MS = 20;
 var turn = {
   slice_started_ms: performance.now(),
   pause: null
 };
-function startRunBudget(subject, budgetMs) {
-  return { deadline_ms: Date.now() + budgetMs, budget_ms: budgetMs, subject, built_bytes: 0 };
+function startRunBudget(subject, budgetMs, path) {
+  return { host: "shared", deadline_ms: Date.now() + budgetMs, budget_ms: budgetMs, subject, path, built_bytes: 0 };
 }
 function runClock(run2) {
   if (Date.now() > run2.deadline_ms) {
     throw new WorkflowTimeBudgetError(run2.subject, run2.budget_ms);
   }
+  if (run2.host === "isolated") return null;
   if (turn.pause === null && performance.now() - turn.slice_started_ms >= EVALUATION_SLICE_MS) {
     turn.pause = new Promise((resolve) => setTimeout(resolve, 0)).then(() => {
       turn.pause = null;
@@ -27015,15 +27171,16 @@ function runClock(run2) {
   return turn.pause;
 }
 function chargeBuilt(run2, bytes) {
+  if (run2.host === "isolated") return;
   run2.built_bytes += bytes;
   if (run2.built_bytes > MAX_RUN_BUILT_BYTES) {
-    throw new WorkflowExpressionBudgetError("bytes");
+    throw new WorkflowExpressionBudgetError({ exceeded: "bytes" });
   }
 }
 function builtSize(value) {
   if (typeof value === "string") return value.length * CHAR_BYTES;
-  if (Array.isArray(value)) return value.length * SLOT_BYTES;
-  if (typeof value === "object" && value !== null) return Object.keys(value).length * SLOT_BYTES;
+  if (Array.isArray(value)) return OBJECT_BYTES + value.length * SLOT_BYTES;
+  if (typeof value === "object" && value !== null) return OBJECT_BYTES + Object.keys(value).length * SLOT_BYTES;
   return 0;
 }
 var PARSED_NODE_BYTES = 40;
@@ -27053,13 +27210,13 @@ function callbackWorkers() {
   };
 }
 function evaluateWorkflowExpression(expr2, ctx) {
-  const budget = { nodes: 0, workers: callbackWorkers(), settled: false };
+  const budget = { workers: callbackWorkers(), settled: false };
   return evaluateExpression(expr2, { ...ctx, evaluation_budget: budget }).finally(() => {
     budget.settled = true;
   });
 }
 async function evaluateExpression(expr2, ctx) {
-  for (let pause = spendNode(ctx); pause !== null; pause = checkClock(ctx)) await pause;
+  for (let pause = checkClock(ctx); pause !== null; pause = checkClock(ctx)) await pause;
   switch (expr2.kind) {
     case "lit":
       return expr2.value;
@@ -27096,15 +27253,6 @@ async function evaluateExpression(expr2, ctx) {
       return assertNever(expr2);
   }
 }
-function spendNode(ctx) {
-  const budget = ctx.evaluation_budget;
-  assertUnsettled(budget);
-  budget.nodes += 1;
-  if (budget.nodes > MAX_EVALUATION_NODES) {
-    throw new WorkflowExpressionBudgetError("nodes");
-  }
-  return runClock(ctx.run_budget);
-}
 function checkClock(ctx) {
   assertUnsettled(ctx.evaluation_budget);
   return runClock(ctx.run_budget);
@@ -28096,9 +28244,6 @@ function clientRuntime(input) {
     },
     get change_origin() {
       return unread("change_origin");
-    },
-    get execution_principal() {
-      return unread("execution_principal");
     }
   };
 }
@@ -28131,7 +28276,7 @@ async function predictWorkflowEffects(input) {
     trigger_table: null,
     member_lookup: async () => unread("member display"),
     lexical_bindings: [{}],
-    run_budget: startRunBudget("Write prediction", PREDICTION_BUDGET_MS)
+    run_budget: startRunBudget("Write prediction", PREDICTION_BUDGET_MS, "write")
   };
   const walk = { ctx, effects: [], written, input, unsure: false, aligned: true };
   try {

package/docs/mutations.md

@@ -397,9 +397,8 @@ Why a full-form snapshot save is a bug, not a style choice — three independent
    moment *any* field is touched — there is no value-equality pass (deep equality over stored
    shapes would be a silent lock bypass). A snapshot touches every field, so it turns every
    save against a locked record into a total rejection even when nothing changed.
-2. **`before_update` table workflows fire on the write.** Tables can carry `before_update`
-   workflows (autofills, validations, side effects). They run on every write that touches the
-   record — a snapshot save fires them for fields the user never edited.
+2. **A table's checks and `after_update` workflows run on the write.** They run on every
+   write that touches the record — a snapshot save runs them for fields the user never edited.
 3. **Snapshots clobber concurrent edits.** An update writes exactly the fields present in the
    payload; unsent fields keep their current value. A diff therefore coexists with a
    colleague's concurrent edit to a *different* field — a snapshot overwrites it with the

package/docs/workflows.md

@@ -344,8 +344,8 @@ try {
 
 `e` is shaped `{ message, type, step_id?, detail? }`. Caught: tool errors and expression errors
 thrown inside the body. **Not caught:** `validate` failures — a check that throws included — and
-`return` (control flow), the run's own bounds (its time, its step count, and the node and 512 MB
-bounds in *Traps*), and errors from steps that run on *resume* after a `wait` inside the body —
+`return` (control flow), the run's own bounds (its time, its step count, and the compute and
+memory bounds in *Traps*), and errors from steps that run on *resume* after a `wait` inside the body —
 the wrapper spans one execution pass. There is no `finally`: put always-run steps after the `try`,
 always-on-failure steps in the `catch`.
 
@@ -611,7 +611,7 @@ key preserves. So passing a possibly-null read straight through is safe. Use
 `set_skip_null` is what turns a bag of optional workflow inputs into a diff-write without a guard
 per field; naming the same field in both `set` and `set_skip_null` is an error. A call whose
 surfaces all resolve to nothing — an all-dropped `set_skip_null`, an op object with no entries —
-is a no-op: no records touched, no `before_update` hooks. So a conditionally-built op object needs
+is a no-op: no records touched, no table check asked. So a conditionally-built op object needs
 no guard around the call. Why diffs and not snapshots, plus locked records and the
 `request_locked_record_change` path: [mutations](./mutations.md#diff-before-update--send-only-what-changed).
 
@@ -791,9 +791,6 @@ The rules that are easy to get wrong because the failing code looks correct.
   init/update included. Resume re-enters *after* the whole loop, so a wait inside would run
   iteration 0 and silently skip every remaining iteration and its mutations. Move the wait out,
   or split the loop into separately triggered runs.
-- **Waits and `agent` steps are disallowed in `before_*` table workflows.** Those run inside the
-  mutation pipeline and must complete synchronously; an LLM loop cannot return an accept/reject
-  verdict in time.
 - **String contexts coerce to display text.** A read inside a template or a string-typed argument
   renders the *label*; everywhere else it is the raw key. So
   `` `Status: ${record["fld_status"]}` `` prints "Done" while
@@ -827,11 +824,14 @@ The rules that are easy to get wrong because the failing code looks correct.
   takes an array of at most 100,000. `join`, `replaceAll`, `padStart`, `padEnd`, `toString`,
   `toJson` and a template string write at most 10,000,000 characters; `randomNumber` /
   `randomAlphaNumeric` take a length of at most 1,000. Past one of those the call throws an
-  expression error, which `try`/`catch` catches, and so does a step whose result would take what
-  the run keeps past 67,108,864 characters of JSON. One evaluation runs at most 20,000,000 nodes —
-  a callback nested in another runs once per pair of elements — and the run's expressions build at
-  most 512 MB of arrays, objects and text in all, every temporary counted: past either, the run
-  fails whatever catches it. Build long text with `join`, never a fold of `+`.
+  expression error, which `try`/`catch` catches, and so does an expression whose value would write
+  more than 67,108,864 characters of JSON, or a step whose result would take what the run keeps
+  past that. One evaluation computes for at most 6 seconds — waiting on a linked row, a member's
+  name or `current_member_in_any_group` does not count — and uses at most 256 MB of memory (512 MB
+  on a private instance with 4 GB or more). The values a run's expressions answer come to at most
+  512 MB in all, counted each time one is answered, a text at every place the value holds it.
+  Past any of these, the run fails whatever catches it. A callback nested in another runs once
+  per pair of elements.
 
 ## The bright line
 
@@ -860,8 +860,7 @@ genuinely recursive.
 `set_app_workflow` with `verify_only: true` gives the verdict a save would, and writes nothing. The
 server runs every check a save runs — the subset parse, the type pass against the alias's
 declared inputs, tool and kwarg resolution, field, option, table and group resolution, `switch`
-case validation, the literal `formatDate` probe, waits in loops, the `before_*` restrictions,
-table reach, the `field_key` rule and the published-API guard. **Green means the save will take
+case validation, the literal `formatDate` probe, waits in loops, table reach, the `field_key` rule and the published-API guard. **Green means the save will take
 it, red means real** — do not push through a red check. Lint comes back as warnings, which do not
 fail it.
 
@@ -900,7 +899,7 @@ check's message joined with `"; "`, and one `field_errors` entry per failing che
 iterations of a `while` / `do_while` / `c_for`, 10 000 steps, 50 live reads, and 20 seconds — and
 tripping any of them appends an entry naming the bound and ending "the plan below is incomplete",
 then stops. It also stops, with an entry saying why, where the live run would fail: at a
-`validate` check that throws, an evaluation past the run's node or 512 MB bound (*Traps*), or a
+`validate` check that throws, an evaluation past the run's compute or memory bounds (*Traps*), or a
 return too long to write.
 So read `evaluation_errors` before reading `planned_calls`: an entry there may be a
 truncated plan rather than a bug in your body. A `foreach` is deliberately NOT capped at 1 000 —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/app-sdk",
-  "version": "0.114.0",
+  "version": "0.115.0",
   "description": "The SDK a Lotics custom-code app reads and writes through \u2014 typed hooks over the host bridge, cell readers, mount() and AppRouter",
   "type": "module",
   "exports": {