@lotics/app-sdk 0.120.2 → 0.121.0

package/docs/security.md

@@ -103,6 +103,7 @@ A publicly-shared app (its own origin, or its public link) is reachable by **any
 | Agent runs (`useAgentRun`) | **No** — rejected: agent runs require an authenticated member, and each member's run history is private to them (a guessed session id cannot read another member's thread) |
 | Comments (`useComments`) | **No** — members-only |
 | Record activity (`useRecordActivity`) | **No** — the app's organization's members only |
+| Undo of a record's change (`undoRecordChange`) | **No** — a member of the app's organization holding `write_data` on the record's table, on a row their own row rule covers |
 | Member roster (`useMembers`) | **No** — same-org members only (below) |
 
 **Warning — `is_current_member` on a public app resolves to the app owner.** An anonymous request has no viewer to bind, so both `is_current_member` and `current_member in_any_group` fall back to the owner's identity and the owner's groups. A "my items" query shows every anonymous visitor the *owner's* items, and a manager-only read template gated on a group the owner belongs to **passes for every anonymous visitor**. Never rely on viewer-bound predicates in a public app.

package/docs/workflows.md

@@ -384,15 +384,15 @@ body does not look like what you typed.
 | `x.length` (dot only) | `length(x)` — strings and arrays. `x["length"]` still reads a field |
 | `String(x)`, `Number(x)`, `parseFloat(x)`, `+x` | `toString(x)` / `toNumber(x)` |
 | `x.toUpperCase()`, `x.toLowerCase()` | `upper(x)`, `lower(x)` |
-| `x.toFixed(2)` | `formatNumber(x, 2)` |
-| `Math.round/min/max/abs/floor/ceil/pow/sqrt(…)` | the like-named helper |
+| `x.toFixed(2)` | `formatNumber(x, 2)` — rounds the decimal, a half away from zero: `1.005` is `"1.01"` |
+| `Math.round/min/max/abs/floor/ceil/pow/sqrt(…)` | the like-named helper. `round` rounds the decimal, a half away from zero: `round(-2.5)` is `-3` |
 | `Math.max(...arr)` / `Math.min(...arr)` | `max(arr)` / `min(arr)` |
 | `JSON.parse`, `JSON.stringify` | `parseJson`, `toJson` |
 | `Array.isArray`, `Object.keys/values/entries` | `isArray`, `keys`/`values`/`entries` |
 | `arr.at(i)` | `at(arr, i)` — negative counts from the end |
 | `arr.filter(Boolean)` | `compact(arr)` — drops every falsy element |
 | `[...a, b]` | `concat(a, [b])` |
-| `{ ...a, b: 1 }` | `merge(a, { b: 1 })` — later sources win, as in JS |
+| `{ ...a, b: 1 }` | `merge(merge({}, a), { b: 1 })` — later sources win, as in JS — and reads back as the spread, typed as you wrote it |
 | `{ table_id }` | `{ table_id: table_id }` — in expressions **and** tool inputs |
 | `undefined` | `null` |
 | `xs.push(a, b);` | `xs = concat(xs, [a, b])` — statement form |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/app-sdk",
-  "version": "0.120.2",
+  "version": "0.121.0",
   "description": "The SDK a Lotics custom-code app reads and writes through — typed hooks over the host bridge, cell readers, mount() and AppRouter",
   "type": "module",
   "exports": {