@lotics/app-sdk 0.120.3 → 0.122.0

package/AGENTS.md

@@ -20,7 +20,7 @@ This file is the index. The **exact type** of anything is its shipped declaratio
 | [docs/workflows.md](./docs/workflows.md) | **The workflow-BODY reference** — the JS subset a body may use, opaque `fld_*`/`opt_*` keys, every step form, the accepted sugar, helpers, record-write surfaces, the traps and the verify loop. |
 | [docs/recipes.md](./docs/recipes.md) | Task-shaped how-tos — returning a generated file, returning structured data, parameterized lookups, composable optional filters, cell decoding, testing an AI action without spending credits. |
 | [docs/files.md](./docs/files.md) | Files end to end — `useFileUpload` and its `fidelity` and a photo's `place`, `renameFile` (a new file over the same bytes), `useAttachments`/`useAttachmentPiles`, `readFiles` and presigned URLs (a bearer credential — never logged or persisted), workflow-generated files, naming a zip's entries, the delivery bounds. |
-| [docs/members_and_options.md](./docs/members_and_options.md) | People, select options and comments — `useMembers`, `useFieldOptions`, `useViewer`, `useWorkspaceTimezone`/`useWorkspaceCurrency`, `useAppContext`, the workspace's zone at the root, `useComments`, a record's activity (`useRecordActivity`). |
+| [docs/members_and_options.md](./docs/members_and_options.md) | People, select options and comments — `useMembers`, `useFieldOptions`, `useViewer`, `useWorkspaceTimezone`/`useWorkspaceCurrency`, `useAppContext`, the workspace's zone at the root, `useComments`, a record's activity and the undo of one change (`useRecordActivity`, `undoRecordChange`). |
 | [docs/navigation_and_state.md](./docs/navigation_and_state.md) | `AppRouter` (embedded/standalone URL model, the screens and `drawers` it reports to the host), `useUrlState` + `urlParam` codecs, `useRecents`, `useFolderPick`. |
 | [docs/ai.md](./docs/ai.md) | `useAgentRun` (structured vs free-text, streaming parts, the agent's ask-back), `askAi`, `useAiContext`, and what the member's own chat agent can do with the app while it is open. |
 | [docs/security.md](./docs/security.md) | **Read before shipping** — the owner-principal model, `is_current_member` scoping, write attribution, group gates, public-app bounds, why a per-input bound is a tenancy floor rather than an authorization check. |

package/dist/activity.d.ts

@@ -1,4 +1,4 @@
-import type { ActivityEntry } from "./shared_types.js";
+import type { ActivityEntry, ActivityUndoResult } from "./shared_types.js";
 export interface RecordActivityState {
     /** Newest first. */
     entries: ActivityEntry[];
@@ -6,7 +6,7 @@ export interface RecordActivityState {
     next: string | undefined;
     loading: boolean;
     error: string | null;
-    /** A signed-in member; standalone nothing is read and `entries` stays empty. */
+    /** A signed-in member of the app's organization; for anyone else nothing is read and `entries` stays empty. */
     available: boolean;
     refetch: () => void;
 }
@@ -25,3 +25,16 @@ export interface RecordActivityOptions {
  * ```
  */
 export declare function useRecordActivity(entity: string, record_id: string, options?: RecordActivityOptions): RecordActivityState;
+/**
+ * Put one change entry of the record's activity back, as the viewer's own save: each field the entry changed returns
+ * to what it held before it where the record still holds what the entry wrote. The answer names the fields put back
+ * (`reverted`) and those left as they stand (`kept`), each with its `reason` — `changed_since`, or `refused` where the
+ * table refused the write (a lock, a check) — and arrives once the record's reads are read anew. Refused for an entry
+ * whose `undoable` is false: the record's making, an undo, an entry already put back, and a viewer who may not write
+ * the record.
+ *
+ * ```tsx
+ * const { reverted, kept } = await undoRecordChange("job", recordId, entry.id);
+ * ```
+ */
+export declare function undoRecordChange(entity: string, record_id: string, entry_id: string): Promise<ActivityUndoResult>;

package/dist/{chunk-ABDSJ25E.js → chunk-MK4DBY6R.js}

@@ -1656,6 +1656,7 @@ function rpcStandalone(op, payload) {
     case "comments.counts":
       return rejectCommentsStandalone();
     case "activity.list":
+    case "activity.undo":
       return Promise.reject(new Error("A record's activity is available only in embedded apps \u2014 a signed-in member is required."));
     case "recording.start":
     case "recording.stop":

package/dist/index.d.ts

@@ -11,9 +11,9 @@ export type { ExportedFile } from "./shared_types.js";
 export type { AttachedFile, AttachmentPiles, AttachmentPilesOptions, AttachmentsOptions, AttachmentsState } from "./attachments.js";
 export { useComments, useCommentCounts } from "./comments.js";
 export type { AppComment, AppCommentAuthor, AppCommentFile, CommentsState, UseCommentsArgs, CommentCountsState, UseCommentCountsArgs, } from "./comments.js";
-export { useRecordActivity } from "./activity.js";
+export { undoRecordChange, useRecordActivity } from "./activity.js";
 export type { RecordActivityOptions, RecordActivityState } from "./activity.js";
-export type { ActivityActor, ActivityActorKind, ActivityChange, ActivityComment, ActivityEntry, ActivityValue, RecordActivityPage, } from "./shared_types.js";
+export type { ActivityActor, ActivityActorKind, ActivityChange, ActivityComment, ActivityEntry, ActivityUndoResult, ActivityValue, RecordActivityPage, UndoKeptReason, } from "./shared_types.js";
 export { useAppContext, useViewer, useWorkspaceCurrency, useWorkspaceTimezone } from "./viewer.js";
 export type { AppAbsence } from "./shared_types.js";
 export { useRecording, useRecordings } from "./recording.js";

package/dist/index.js

@@ -40,7 +40,7 @@ import {
   sumDecimal,
   tiersAscend,
   urlParam
-} from "./chunk-ABDSJ25E.js";
+} from "./chunk-MK4DBY6R.js";
 
 // src/mount.tsx
 import { createRoot } from "react-dom/client";
@@ -611,6 +611,14 @@ function readNow(aliases) {
 function refetchReads(aliases) {
   for (const slot of readNow(aliases)) void ask(slot, true);
 }
+async function readsAnswered(aliases) {
+  await Promise.all(
+    readNow(aliases).map(async (slot) => {
+      await ask(slot, true);
+      while (slot.inflight !== null) await slot.inflight;
+    })
+  );
+}
 function askInOnePaint(read2) {
   if (read2.length === 0) return;
   const paint = { waiting: new Set(read2), held: [], drawn: false, cap: setTimeout(() => draw(paint), PAINT_CAP_MS) };
@@ -1840,13 +1848,16 @@ async function callEach(arr, cb) {
   let next = 0;
   let failed = false;
   const work = async () => {
-    while (!failed && next < arr.length) {
+    while (next < arr.length && !failed) {
       const i = next;
       next += 1;
-      results[i] = await Promise.resolve().then(() => cb(arr[i], i)).catch((error51) => {
+      try {
+        const result = cb(arr[i], i);
+        results[i] = result instanceof Promise ? await result : result;
+      } catch (error51) {
         failed = true;
         throw error51;
-      });
+      }
     }
   };
   const extra = arr.length > 1 ? cb.workers?.claim(arr.length - 1) ?? 0 : 0;
@@ -2039,7 +2050,8 @@ function find(arr, fieldOrCb, value) {
 }
 async function findByCallback(arr, cb) {
   for (let i = 0; i < arr.length; i++) {
-    if (await cb(arr[i], i)) return arr[i];
+    const hit = cb(arr[i], i);
+    if (hit instanceof Promise ? await hit : hit) return arr[i];
   }
   return void 0;
 }
@@ -2275,7 +2287,8 @@ function some(arr, fieldOrCb, value) {
     assertCallbackInput("some", arr);
     return (async () => {
       for (let i = 0; i < arr.length; i++) {
-        if (await fieldOrCb(arr[i], i)) return true;
+        const hit = fieldOrCb(arr[i], i);
+        if (hit instanceof Promise ? await hit : hit) return true;
       }
       return false;
     })();
@@ -2295,7 +2308,8 @@ function every(arr, fieldOrCb, value) {
     assertCallbackInput("every", arr);
     return (async () => {
       for (let i = 0; i < arr.length; i++) {
-        if (!await fieldOrCb(arr[i], i)) return false;
+        const hit = fieldOrCb(arr[i], i);
+        if (!(hit instanceof Promise ? await hit : hit)) return false;
       }
       return true;
     })();
@@ -2390,7 +2404,8 @@ async function reduce(arr, callback, initial) {
   assertCallbackInput("reduce", arr);
   let acc = initial;
   for (let i = 0; i < arr.length; i++) {
-    acc = await callback(acc, arr[i], i);
+    const next = callback(acc, arr[i], i);
+    acc = next instanceof Promise ? await next : next;
   }
   return acc;
 }
@@ -6113,11 +6128,9 @@ var HELPER_COST = {
   typeOf: "reads"
 };
 function helperCost(name) {
-  return isHelperName(name) ? HELPER_COST[name] : "builds";
-}
-function isHelperName(name) {
-  return Object.prototype.hasOwnProperty.call(HELPER_COST, name);
+  return HELPER_COST_BY_NAME.get(name) ?? "builds";
 }
+var HELPER_COST_BY_NAME = new Map(Object.entries(HELPER_COST));
 function createTimezoneAwareFunctions(defaultTimezone) {
   return {
     // Number functions
@@ -26395,6 +26408,9 @@ var appQueryDeclarationSchema = zod_default.object({
   ),
   templates: zod_default.record(zod_default.string().regex(APP_ALIAS_REGEX), appExportTemplateSchema).optional().describe(
     "Document templates an export of this query's rows may fill, by the name the export asks for. An export names one of these or none; a template it does not declare is refused."
+  ),
+  screen_only: zod_default.literal(true).optional().describe(
+    "The query feeds one control of the app's screen and answers no question a person asks. It runs like any other; a catalog of what an agent may ask leaves it out."
   )
 });
 var appAgentWritesSchema = zod_default.object({
@@ -26736,6 +26752,15 @@ var TOOL_INPUT_SEMANTICS = {
     // same position `query_records.field_keys` holds.
     return_fields: { kind: "field_key_refs", table_from: "table_id" }
   },
+  import_rows: {
+    table_id: { kind: "table_ref", rows: "change" },
+    match: { kind: "field_key_refs", table_from: "table_id" },
+    // Each row's `values` are keyed by field, a link cell possibly `{ lookup }`; the tool resolves both at execute.
+    rows: { kind: "dynamic" },
+    create: { kind: "scalar" },
+    // `fields` is keyed by field; the tool resolves it at execute.
+    conflicts: { kind: "dynamic" }
+  },
   delete_records: {
     // THE ONE CALL THAT TAKES ROWS. Every column of the row goes with it, so
     // nothing field-keyed can carry the fact and it rides the table position —
@@ -26771,6 +26796,22 @@ var TOOL_INPUT_SEMANTICS = {
     changes: { kind: "dynamic" },
     reason: { kind: "text" }
   },
+  // The record names its own table; an entry's id and a cursor are the trail's.
+  get_record_activity: {
+    record_id: { kind: "record_ref" },
+    after: { kind: "scalar" }
+  },
+  undo_record_change: {
+    record_id: { kind: "record_ref" },
+    entry_id: { kind: "scalar" }
+  },
+  // `table_id` names the table whose rows the undo changes, moves to the trash and brings back; a run's id is the
+  // trail's.
+  undo_record_changes: {
+    table_id: { kind: "table_ref", rows: "remove" },
+    record_ids: { kind: "record_refs" },
+    workflow_execution_id: { kind: "scalar" }
+  },
   // ─── Query surfaces ────────────────────────────────────────────────────
   query_records: {
     table_id: { kind: "table_ref", rows: "none" },
@@ -27340,7 +27381,11 @@ function resolveLambdaItemFrame(frames, name) {
   }
   return void 0;
 }
+function lambdaItemAnchor(ctx, name) {
+  return resolveLambdaItemFrame(ctx.lambda_items, name)?.anchor ?? null;
+}
 function readRecordAnchor(source, path, ctx) {
+  if (source.from === "lambda_param") return lambdaItemAnchor(ctx, source.name);
   return anchorForRead(source, path, ctx, /* @__PURE__ */ new Set());
 }
 function anchorForRead(source, path, ctx, seen) {
@@ -27350,7 +27395,7 @@ function anchorForRead(source, path, ctx, seen) {
     case "foreach_item":
       return resolveNamedForeachFrame(ctx.foreach_items, source.name)?.anchor ?? null;
     case "lambda_param":
-      return resolveLambdaItemFrame(ctx.lambda_items, source.name)?.anchor ?? null;
+      return lambdaItemAnchor(ctx, source.name);
     case "trigger_record":
       return rootAnchor(ctx.trigger_record);
     case "trigger_record_prev":
@@ -27661,7 +27706,7 @@ function assertCheap(budget, ...values2) {
 function charge(ctx, bytes) {
   const budget = ctx.evaluation_budget;
   assertUnsettled(budget);
-  if (Date.now() > ctx.run_budget.deadline_ms) throw new WorkflowTimeBudgetError(ctx.run_budget.subject, ctx.run_budget.budget_ms);
+  if (readsClock(ctx) && Date.now() > ctx.run_budget.deadline_ms) throw new WorkflowTimeBudgetError(ctx.run_budget.subject, ctx.run_budget.budget_ms);
   if (budget.bounded && budget.built + bytes > MAX_IN_PLACE_BYTES) throw new ExpressionNotCheapError();
   budget.built += bytes;
   chargeBuilt(ctx.run_budget, bytes);
@@ -27680,8 +27725,8 @@ function callbackWorkers() {
   };
 }
 function evaluateWorkflowExpression(expr2, ctx, options = {}) {
-  const budget = { workers: callbackWorkers(), bounded: options.bounded === true, built: 0, settled: false };
-  return evaluateExpression(expr2, { ...ctx, evaluation_budget: budget }).finally(() => {
+  const budget = { workers: callbackWorkers(), bounded: options.bounded === true, built: 0, clock_checks: 0, helpers: /* @__PURE__ */ new Map(), settled: false };
+  return evaluateRoot(expr2, { ...ctx, evaluation_budget: budget, anchor_context: evalAnchorContext(ctx) }).finally(() => {
     budget.settled = true;
   }).then((answer) => {
     if (budget.bounded && expandedSize(answer, MAX_IN_PLACE_BYTES) > MAX_IN_PLACE_BYTES) throw new ExpressionNotCheapError();
@@ -27691,8 +27736,19 @@ function evaluateWorkflowExpression(expr2, ctx, options = {}) {
     throw error51;
   });
 }
-async function evaluateExpression(expr2, ctx) {
+async function evaluateRoot(expr2, ctx) {
   for (let pause = checkClock(ctx); pause !== null; pause = checkClock(ctx)) await pause;
+  return evaluateExpression(expr2, ctx);
+}
+function failBeside(error51, started) {
+  void Promise.allSettled(started);
+  throw error51;
+}
+async function startBeside(expr2, ctx) {
+  return evaluateExpression(expr2, ctx);
+}
+function evaluateExpression(expr2, ctx) {
+  assertUnsettled(ctx.evaluation_budget);
   switch (expr2.kind) {
     case "lit":
       return expr2.value;
@@ -27705,31 +27761,75 @@ async function evaluateExpression(expr2, ctx) {
     case "unary":
       return evaluateUnary(expr2.op, expr2.arg, ctx);
     case "ternary": {
-      const cond = await evaluateExpression(expr2.cond, ctx);
-      return cond ? evaluateExpression(expr2.then, ctx) : evaluateExpression(expr2.else, ctx);
+      const cond = evaluateExpression(expr2.cond, ctx);
+      return cond instanceof Promise ? branchAfter(cond, expr2.then, expr2.else, ctx) : evaluateExpression(cond ? expr2.then : expr2.else, ctx);
     }
     case "template":
       return evaluateTemplate(expr2.parts, ctx);
     case "lambda":
       return evaluateLambda(expr2.params, expr2.body, ctx, []);
-    case "array_literal": {
-      const elements = await Promise.all(expr2.elements.map((el) => evaluateExpression(el, ctx)));
-      charge(ctx, builtSize(elements));
-      return elements;
-    }
-    case "object_literal": {
-      const out = {};
-      for (const entry of expr2.entries) defineOwn(out, entry.key, await evaluateExpression(entry.value, ctx));
-      charge(ctx, builtSize(out));
-      return out;
-    }
+    case "array_literal":
+      return evaluateArrayLiteral(expr2.elements, ctx);
+    case "object_literal":
+      return fillObjectLiteral({}, expr2.entries, 0, ctx);
     default:
       return assertNever(expr2);
   }
 }
+async function branchAfter(cond, then, otherwise, ctx) {
+  return evaluateExpression(await cond ? then : otherwise, ctx);
+}
+function evaluateArrayLiteral(elements, ctx) {
+  const values2 = [];
+  let pending = false;
+  try {
+    for (const element of elements) {
+      const value = evaluateExpression(element, ctx);
+      if (value instanceof Promise) pending = true;
+      values2.push(value);
+    }
+  } catch (error51) {
+    return failBeside(error51, values2);
+  }
+  return pending ? chargeAfter(values2, ctx) : chargedArray(values2, ctx);
+}
+async function chargeAfter(values2, ctx) {
+  return chargedArray(await Promise.all(values2), ctx);
+}
+function chargedArray(elements, ctx) {
+  charge(ctx, builtSize(elements));
+  return elements;
+}
+function fillObjectLiteral(out, entries3, from, ctx) {
+  for (let at2 = from; at2 < entries3.length; at2++) {
+    const entry = entries3[at2];
+    const value = evaluateExpression(entry.value, ctx);
+    if (value instanceof Promise) return fillObjectAfter(out, entries3, at2, value, ctx);
+    defineOwn(out, entry.key, value);
+  }
+  charge(ctx, builtSize(out));
+  return out;
+}
+async function fillObjectAfter(out, entries3, at2, value, ctx) {
+  defineOwn(out, entries3[at2].key, await value);
+  return fillObjectLiteral(out, entries3, at2 + 1, ctx);
+}
 function checkClock(ctx) {
   assertUnsettled(ctx.evaluation_budget);
-  return runClock(ctx.run_budget);
+  return readsClock(ctx) ? runClock(ctx.run_budget) : null;
+}
+var ISOLATED_CLOCK_STRIDE = 16;
+function readsClock(ctx) {
+  if (ctx.run_budget.host === "shared") return true;
+  const budget = ctx.evaluation_budget;
+  budget.clock_checks += 1;
+  if (budget.clock_checks % ISOLATED_CLOCK_STRIDE !== 1) return false;
+  if (budget.clock_checks === 1) {
+    queueMicrotask(() => {
+      budget.clock_checks = 0;
+    });
+  }
+  return true;
 }
 function assertUnsettled(budget) {
   if (budget.settled) {
@@ -27739,21 +27839,19 @@ function assertUnsettled(budget) {
   }
 }
 function evaluateLambda(params, body, ctx, items) {
-  const call = async (...args) => {
-    const frame2 = {};
-    for (let i = 0; i < params.length; i++) defineOwn(frame2, params[i], args[i]);
-    const stack = ctx.lambda_params ?? [];
-    const newStack = [...stack, frame2];
-    const innerCtx = {
-      ...ctx,
-      lambda_params: newStack,
-      // The VALUE frame and the ANCHOR frames are pushed together: a body that
-      // can read the item must read it through the same table the save layer
-      // typed it with, and a parameter that is not the item must shadow an
-      // outer one of the same name in both stacks alike.
-      lambda_items: items.length === 0 ? ctx.lambda_items : [...ctx.lambda_items ?? [], ...items]
-    };
-    return evaluateExpression(body, innerCtx);
+  const lambdaItems = items.length === 0 ? ctx.lambda_items : [...ctx.lambda_items ?? [], ...items];
+  const bodyCtx = {
+    ...ctx,
+    lambda_items: lambdaItems,
+    anchor_context: { ...ctx.anchor_context, lambda_items: lambdaItems ?? [] }
+  };
+  const stack = ctx.lambda_params ?? [];
+  const call = (...args) => {
+    const pause = checkClock(bodyCtx);
+    if (pause !== null) return pause.then(() => call(...args));
+    const frame2 = /* @__PURE__ */ Object.create(null);
+    for (let i = 0; i < params.length; i++) frame2[params[i]] = args[i];
+    return evaluateExpression(body, { ...bodyCtx, lambda_params: [...stack, frame2] });
   };
   return Object.assign(call, { workers: ctx.evaluation_budget.workers });
 }
@@ -27773,9 +27871,6 @@ function evalAnchorContext(ctx) {
     trigger_changes: ctx.trigger_table
   };
 }
-function resolveReadAnchor(source, path, ctx) {
-  return readRecordAnchor(source, path, evalAnchorContext(ctx));
-}
 function resolveReadRoot(source, ctx) {
   switch (source.from) {
     case "trigger":
@@ -27885,29 +27980,37 @@ function resolveForeachFrame(ctx, name, at2) {
     { kind: "read", at: at2, extra: { name } }
   );
 }
-async function evaluateRead(source, path, coerce, ctx) {
-  let current = source.from === "value" ? await evaluateExpression(source.expr, ctx) : resolveReadRoot(source, ctx);
-  const anchor = resolveReadAnchor(source, path, ctx);
-  let currentTable = null;
-  let prevFieldForSegment;
-  let terminalField;
-  for (let i = 0; i < path.length; i++) {
+function evaluateRead(source, path, coerce, ctx) {
+  const root = source.from === "value" ? evaluateExpression(source.expr, ctx) : resolveReadRoot(source, ctx);
+  return root instanceof Promise ? readAfter(root, source, path, coerce, ctx) : walkPath(path, coerce, ctx, readRecordAnchor(source, path, ctx.anchor_context), 0, root, null, void 0, void 0);
+}
+async function readAfter(root, source, path, coerce, ctx) {
+  const value = await root;
+  return walkPath(path, coerce, ctx, readRecordAnchor(source, path, ctx.anchor_context), 0, value, null, void 0, void 0);
+}
+function walkPath(path, coerce, ctx, anchor, from, start, startTable, startField, startTerminal) {
+  let current = start;
+  let table = startTable;
+  let prevField = startField;
+  let terminalField = startTerminal;
+  for (let i = from; i < path.length; i++) {
     const segment = path[i];
     const isLast = i === path.length - 1;
-    if (anchor && i === anchor.envelopeLen) currentTable ??= anchor.table;
+    if (anchor && i === anchor.envelopeLen) table ??= anchor.table;
     const carried = carriedTable(current, ctx);
-    if (carried?.at === "self") currentTable = carried.table;
-    const fieldForSegment = (segment.at === "field" || segment.at === "key") && currentTable ? findField(currentTable, segment.key) : void 0;
+    if (carried?.at === "self") table = carried.table;
+    const field = (segment.at === "field" || segment.at === "key") && table ? findField(table, segment.key) : void 0;
     if (isLast) {
-      terminalField = fieldForSegment ?? (segment.at === "key" && (segment.key === "next_value" || segment.key === "prev_value") ? prevFieldForSegment : void 0);
+      terminalField = field ?? (segment.at === "key" && (segment.key === "next_value" || segment.key === "prev_value") ? prevField : void 0);
     }
-    current = await walkSegment(current, segment, ctx);
-    currentTable = advanceTable(segment, currentTable, ctx);
-    if (carried?.at === "data" && isKeyNamed(segment, "data")) currentTable = carried.table;
-    prevFieldForSegment = fieldForSegment;
-    if (current === void 0 || current === null) {
-      return current;
+    const walked = walkSegment(current, segment, ctx);
+    if (walked instanceof Promise) {
+      return walkPending({ path, coerce, ctx, anchor, table, carried, field, terminal_field: terminalField }, i, walked);
     }
+    table = tableAfter(segment, table, carried, ctx);
+    prevField = field;
+    current = walked;
+    if (current === void 0 || current === null) return current;
   }
   if (terminalField && isScalarWrappedField(terminalField)) {
     current = unwrapScalarField(current);
@@ -27917,6 +28020,17 @@ async function evaluateRead(source, path, coerce, ctx) {
   }
   return current;
 }
+async function walkPending(read2, at2, walked) {
+  const { path, coerce, ctx, anchor, carried, field, terminal_field: terminalField } = read2;
+  const current = await walked;
+  if (current === void 0 || current === null) return current;
+  const table = tableAfter(path[at2], read2.table, carried, ctx);
+  return walkPath(path, coerce, ctx, anchor, at2 + 1, current, table, field, terminalField);
+}
+function tableAfter(segment, table, carried, ctx) {
+  const advanced = advanceTable(segment, table, ctx);
+  return carried?.at === "data" && isKeyNamed(segment, "data") ? carried.table : advanced;
+}
 function isScalarWrappedField(field) {
   if (field.type === "formula") return field.formula.options !== void 0;
   return (field.type === "select" || field.type === "select_member") && field.multi !== true;
@@ -28022,7 +28136,7 @@ function advanceTable(segment, currentTable, ctx) {
 function findField(table, fieldKey) {
   return table.fields.find((f) => f.key === fieldKey);
 }
-async function walkSegment(value, segment, ctx) {
+function walkSegment(value, segment, ctx) {
   switch (segment.at) {
     case "key":
     case "field": {
@@ -28043,12 +28157,14 @@ async function walkSegment(value, segment, ctx) {
     case "index": {
       if (value === null || value === void 0) return void 0;
       if (Array.isArray(value) || typeof value === "string") {
-        const idx = typeof segment.index === "number" ? segment.index : await resolveIndexExpression(segment.index, ctx, "array index");
-        return value[idx];
+        if (typeof segment.index === "number") return value[segment.index];
+        const idx = resolveIndexExpression(segment.index, ctx, "array index");
+        return idx instanceof Promise ? idx.then((at2) => value[at2]) : value[idx];
       }
       if (typeof value === "object") {
-        const key = typeof segment.index === "number" ? String(segment.index) : await resolveObjectKeyExpression(segment.index, ctx);
-        return ownMember(value, key);
+        if (typeof segment.index === "number") return ownMember(value, String(segment.index));
+        const key = resolveObjectKeyExpression(segment.index, ctx);
+        return key instanceof Promise ? key.then((named) => ownMember(value, named)) : ownMember(value, key);
       }
       throw new WorkflowEvalError(
         `Cannot index ${typeof value} \u2014 only an array or an object can be read by index.`,
@@ -28059,8 +28175,11 @@ async function walkSegment(value, segment, ctx) {
       return walkLinked(value, segment, ctx);
   }
 }
-async function resolveObjectKeyExpression(expr2, ctx) {
-  const value = await evaluateExpression(expr2, ctx);
+function resolveObjectKeyExpression(expr2, ctx) {
+  const value = evaluateExpression(expr2, ctx);
+  return value instanceof Promise ? value.then(objectKey) : objectKey(value);
+}
+function objectKey(value) {
   if (typeof value === "string") return value;
   if (typeof value === "number" && Number.isFinite(value)) return String(value);
   throw new WorkflowEvalError(
@@ -28072,8 +28191,11 @@ async function resolveObjectKeyExpression(expr2, ctx) {
   );
 }
 var VALUE_PREVIEW_LENGTH = 120;
-async function resolveIndexExpression(expr2, ctx, context) {
-  const value = await evaluateExpression(expr2, ctx);
+function resolveIndexExpression(expr2, ctx, context) {
+  const value = evaluateExpression(expr2, ctx);
+  return value instanceof Promise ? value.then((settled) => arrayIndex(settled, context)) : arrayIndex(value, context);
+}
+function arrayIndex(value, context) {
   if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
     throw new WorkflowEvalError(
       `Computed ${context} must evaluate to a non-negative integer, got ${describeValue(value)}`,
@@ -28145,46 +28267,77 @@ async function fetchRecordsBounded(ids, reading, ctx) {
   }
   return results;
 }
-async function evaluateCall(fn, args, ctx) {
+function evaluateCall(fn, args, ctx) {
+  const pause = checkClock(ctx);
+  if (pause !== null) return pause.then(() => evaluateCall(fn, args, ctx));
+  const helper = resolveHelper(fn, ctx);
+  const values2 = [];
+  let pending = false;
+  try {
+    for (const arg of args) {
+      const value = arg.kind === "lambda" ? evaluateLambda(arg.params, arg.body, ctx, callbackItemFrames(fn, args, arg.params, ctx.anchor_context)) : evaluateExpression(arg, ctx);
+      if (value instanceof Promise) pending = true;
+      values2.push(value);
+    }
+  } catch (error51) {
+    return failBeside(error51, values2);
+  }
+  return pending ? callAfter(helper, values2, ctx) : callHelper(helper, values2, ctx);
+}
+function resolveHelper(fn, ctx) {
+  const known = ctx.evaluation_budget.helpers.get(fn);
+  if (known !== void 0) return known;
   if (!Object.prototype.hasOwnProperty.call(ctx.helpers, fn)) {
     throw new WorkflowEvalError(`Unknown helper function "${fn}"`, {
       kind: "call",
       extra: { fn }
     });
   }
-  const helper = ctx.helpers[fn];
-  const anchors = args.some((arg) => arg.kind === "lambda") ? evalAnchorContext(ctx) : null;
-  const evaluatedArgs = await Promise.all(
-    args.map(
-      (arg) => arg.kind === "lambda" && anchors !== null ? evaluateLambda(arg.params, arg.body, ctx, callbackItemFrames(fn, args, arg.params, anchors)) : evaluateExpression(arg, ctx)
-    )
-  );
+  const resolved = { call: ctx.helpers[fn], cost: helperCost(fn) };
+  ctx.evaluation_budget.helpers.set(fn, resolved);
+  return resolved;
+}
+async function callAfter(helper, pending, ctx) {
+  const values2 = await Promise.all(pending);
   for (let pause = checkClock(ctx); pause !== null; pause = checkClock(ctx)) await pause;
-  const cost = helperCost(fn);
-  if (cost === "parses") charge(ctx, parsedSize(evaluatedArgs[0]));
-  const answer = await helper(...evaluatedArgs);
+  return callHelper(helper, values2, ctx);
+}
+function callHelper({ call, cost }, values2, ctx) {
+  if (cost === "parses") charge(ctx, parsedSize(values2[0]));
+  const answer = Reflect.apply(call, void 0, values2);
+  return answer instanceof Promise ? chargeAnswerAfter(cost, answer, values2, ctx) : chargeAnswer(cost, answer, values2, ctx);
+}
+async function chargeAnswerAfter(cost, answer, values2, ctx) {
+  return chargeAnswer(cost, await answer, values2, ctx);
+}
+function chargeAnswer(cost, answer, values2, ctx) {
   if (cost !== "builds" && cost !== "nested") return answer;
-  const handedBack = evaluatedArgs.indexOf(answer);
-  if (handedBack !== -1) return evaluatedArgs[handedBack];
-  charge(ctx, builtSize(answer) + (cost === "nested" ? builtSize(evaluatedArgs[0]) : 0));
+  const handedBack = values2.indexOf(answer);
+  if (handedBack !== -1) return values2[handedBack];
+  charge(ctx, builtSize(answer) + (cost === "nested" ? builtSize(values2[0]) : 0));
   return answer;
 }
-async function evaluateBinary(op, leftExpr, rightExpr, ctx) {
-  if (op === "and") {
-    const left2 = await evaluateExpression(leftExpr, ctx);
-    if (!left2) return left2;
-    return evaluateExpression(rightExpr, ctx);
-  }
-  if (op === "or") {
-    const left2 = await evaluateExpression(leftExpr, ctx);
-    if (left2) return left2;
-    return evaluateExpression(rightExpr, ctx);
-  }
-  const [left, right] = await Promise.all([
-    evaluateExpression(leftExpr, ctx),
-    evaluateExpression(rightExpr, ctx)
-  ]);
+function evaluateBinary(op, leftExpr, rightExpr, ctx) {
+  if (op === "and" || op === "or") {
+    const first2 = evaluateExpression(leftExpr, ctx);
+    return first2 instanceof Promise ? shortCircuitAfter(first2, op, rightExpr, ctx) : shortCircuit(op, first2, rightExpr, ctx);
+  }
+  const left = evaluateExpression(leftExpr, ctx);
+  const right = left instanceof Promise ? startBeside(rightExpr, ctx) : evaluateExpression(rightExpr, ctx);
+  return left instanceof Promise || right instanceof Promise ? binaryAfter(op, left, right, ctx) : applyBinary(op, left, right, ctx);
+}
+function shortCircuit(op, left, rightExpr, ctx) {
+  return (op === "and" ? !left : left) ? left : evaluateExpression(rightExpr, ctx);
+}
+async function shortCircuitAfter(left, op, rightExpr, ctx) {
+  return shortCircuit(op, await left, rightExpr, ctx);
+}
+async function binaryAfter(op, left, right, ctx) {
+  const [leftValue, rightValue] = await Promise.all([left, right]);
   for (let pause = checkClock(ctx); pause !== null; pause = checkClock(ctx)) await pause;
+  return applyBinary(op, leftValue, rightValue, ctx);
+}
+function applyBinary(op, left, right, ctx) {
   switch (op) {
     case "eq":
     case "neq":
@@ -28291,8 +28444,14 @@ function describeValue(value) {
   }
   return value.length > 0 && length2 <= VALUE_PREVIEW_LENGTH ? `array ${value.join(",")}` : "array";
 }
-async function evaluateUnary(op, argExpr, ctx) {
-  const value = await evaluateExpression(argExpr, ctx);
+function evaluateUnary(op, argExpr, ctx) {
+  const value = evaluateExpression(argExpr, ctx);
+  return value instanceof Promise ? unaryAfter(op, value) : applyUnary(op, value);
+}
+async function unaryAfter(op, value) {
+  return applyUnary(op, await value);
+}
+function applyUnary(op, value) {
   switch (op) {
     case "not":
       return !value;
@@ -28306,11 +28465,26 @@ async function evaluateUnary(op, argExpr, ctx) {
       return -value;
   }
 }
-async function evaluateTemplate(parts, ctx) {
-  const evaluated2 = await Promise.all(
-    parts.map((part) => part.t === "text" ? part.s : evaluateExpression(part.e, ctx))
-  );
+function evaluateTemplate(parts, ctx) {
+  const evaluated2 = [];
+  let pending = false;
+  try {
+    for (const part of parts) {
+      const value = part.t === "text" ? part.s : evaluateExpression(part.e, ctx);
+      if (value instanceof Promise) pending = true;
+      evaluated2.push(value);
+    }
+  } catch (error51) {
+    return failBeside(error51, evaluated2);
+  }
+  return pending ? templateAfter(evaluated2, ctx) : writeTemplate(evaluated2, ctx);
+}
+async function templateAfter(pending, ctx) {
+  const evaluated2 = await Promise.all(pending);
   for (let pause = checkClock(ctx); pause !== null; pause = checkClock(ctx)) await pause;
+  return writeTemplate(evaluated2, ctx);
+}
+function writeTemplate(evaluated2, ctx) {
   assertCheap(ctx.evaluation_budget, ...evaluated2);
   assertTextWithin("template", ...evaluated2);
   const text2 = evaluated2.map(stringifyForTemplate).join("");
@@ -29032,6 +29206,7 @@ function useAppContext() {
   const { data, error: error51, refetch } = useKey(APP_CONTEXT_KEY, readContext, { focus: false, arrival: false });
   return {
     memberId: data?.member_id ?? null,
+    insider: data !== void 0 && data.member_id !== null && data.group_ids !== void 0,
     groupIds: data?.group_ids ?? null,
     absences: data?.absences ?? null,
     openableApps: data?.openable_apps ?? null,
@@ -32717,8 +32892,7 @@ function oneQueryAlias(entity) {
 var NO_ENTRIES = [];
 function useRecordActivity(entity, record_id, options = {}) {
   const { after } = options;
-  const { memberId, resolved } = useAppContext();
-  const available = memberId !== null;
+  const { insider: available, resolved } = useAppContext();
   const page = useKey(
     available ? JSON.stringify(["activity", entity, record_id, after ?? null]) : null,
     () => rpc("activity.list", { entity, record_id, ...after === void 0 ? {} : { after } }),
@@ -32734,6 +32908,12 @@ function useRecordActivity(entity, record_id, options = {}) {
     refetch: page.refetch
   };
 }
+async function undoRecordChange(entity, record_id, entry_id) {
+  const result = await rpc("activity.undo", { entity, record_id, entry_id });
+  refetchReads([listQueryAlias(entity)]);
+  await readsAnswered([oneQueryAlias(entity)]);
+  return result;
+}
 
 // src/recording.ts
 import { useCallback as useCallback7, useMemo as useMemo4, useSyncExternalStore as useSyncExternalStore3 } from "react";
@@ -33077,6 +33257,7 @@ export {
   requestGeofencedLocation,
   row,
   rpc,
+  undoRecordChange,
   urlParam,
   useAgentRun,
   useAgentRuns,

package/dist/router.js

@@ -2,7 +2,7 @@ import {
   isEmbedded,
   postHostNotification,
   setUrlParams
-} from "./chunk-ABDSJ25E.js";
+} from "./chunk-MK4DBY6R.js";
 
 // src/router.tsx
 import { useEffect } from "react";

package/dist/rpc.d.ts

@@ -9,7 +9,7 @@ import { type UrlParams, type UrlParamsPatch } from "./url_params.js";
  *   app  → host: { id, op, payload }
  *   host → app:  { id, type: "result", data } | { id, type: "error", message }
  */
-export type RpcOp = "query" | "export" | "field_options" | "workflow" | "agentRuns" | "agentRun.get" | "agentRun.cancel" | "upload" | "file.rename" | "members" | "context" | "write_model" | "prediction_miss" | "openExternal" | "openApp" | "askAi" | "urlState.get" | "urlState.set" | "folder.get" | "folder.set" | "comments.list" | "comments.create" | "comments.update" | "comments.delete" | "comments.counts" | "activity.list" | "recording.start" | "recording.stop";
+export type RpcOp = "query" | "export" | "field_options" | "workflow" | "agentRuns" | "agentRun.get" | "agentRun.cancel" | "upload" | "file.rename" | "members" | "context" | "write_model" | "prediction_miss" | "openExternal" | "openApp" | "askAi" | "urlState.get" | "urlState.set" | "folder.get" | "folder.set" | "comments.list" | "comments.create" | "comments.update" | "comments.delete" | "comments.counts" | "activity.list" | "activity.undo" | "recording.start" | "recording.stop";
 export interface AgentRunPayload {
     alias: string;
     session_id: string;

package/dist/shared_types.d.ts

@@ -3,7 +3,8 @@
  * `scripts/build_sdk.mjs`, because that package is private and ships in no
  * tarball. Written at every build, never edited.
  */
-export type ActivityEntry = { changes: { field_id: string; label: string; before: string | number | boolean | { key: string; label: string; }[] | { id: string; display: string; }[] | { id: string; name: string | null; image?: string | undefined; }[] | { id: string; filename: string; mime_type: string; file_storage_key?: string | undefined; url?: string | undefined; thumbnail_url?: string | undefined; preview_url?: string | undefined; size?: number | null | undefined; created_at?: string | undefined; document_template_id?: string | undefined; }[] | null; after: string | number | boolean | { key: string; label: string; }[] | { id: string; display: string; }[] | { id: string; name: string | null; image?: string | undefined; }[] | { id: string; filename: string; mime_type: string; file_storage_key?: string | undefined; url?: string | undefined; thumbnail_url?: string | undefined; preview_url?: string | undefined; size?: number | null | undefined; created_at?: string | undefined; document_template_id?: string | undefined; }[] | null; removed?: true | undefined; }[]; id: string; actor: { kind: "member" | "agent" | "workflow" | "import"; id: string; name: string; image?: string | undefined; }; at: string; until: string; kind: "change"; created?: true | undefined; } | { comment: { id: string; body: string; mentions: { id: string; name: string; }[]; files?: { id: string; filename: string; mime_type: string; file_storage_key?: string | undefined; url?: string | undefined; thumbnail_url?: string | undefined; preview_url?: string | undefined; size?: number | null | undefined; created_at?: string | undefined; document_template_id?: string | undefined; }[] | undefined; }; id: string; actor: { kind: "member" | "agent" | "workflow" | "import"; id: string; name: string; image?: string | undefined; }; at: string; until: string; kind: "comment"; };
+export type ActivityEntry = { undoable: boolean; changes: { field_id: string; label: string; before: string | number | boolean | { key: string; label: string; }[] | { id: string; display: string; }[] | { id: string; name: string | null; image?: string | undefined; }[] | { id: string; filename: string; mime_type: string; file_storage_key?: string | undefined; url?: string | undefined; thumbnail_url?: string | undefined; preview_url?: string | undefined; size?: number | null | undefined; created_at?: string | undefined; document_template_id?: string | undefined; }[] | null; after: string | number | boolean | { key: string; label: string; }[] | { id: string; display: string; }[] | { id: string; name: string | null; image?: string | undefined; }[] | { id: string; filename: string; mime_type: string; file_storage_key?: string | undefined; url?: string | undefined; thumbnail_url?: string | undefined; preview_url?: string | undefined; size?: number | null | undefined; created_at?: string | undefined; document_template_id?: string | undefined; }[] | null; removed?: true | undefined; }[]; id: string; actor: { kind: "member" | "agent" | "workflow" | "import"; id: string; name: string; image?: string | undefined; }; at: string; until: string; kind: "change"; created?: true | undefined; undo?: true | undefined; undone?: { by: { kind: "member" | "agent" | "workflow" | "import"; id: string; name: string; image?: string | undefined; }; at: string; } | undefined; } | { comment: { id: string; body: string; mentions: { id: string; name: string; }[]; files?: { id: string; filename: string; mime_type: string; file_storage_key?: string | undefined; url?: string | undefined; thumbnail_url?: string | undefined; preview_url?: string | undefined; size?: number | null | undefined; created_at?: string | undefined; document_template_id?: string | undefined; }[] | undefined; }; id: string; actor: { kind: "member" | "agent" | "workflow" | "import"; id: string; name: string; image?: string | undefined; }; at: string; until: string; kind: "comment"; };
+export type ActivityUndoResult = { reverted: { field_id: string; label: string; }[]; kept: { field_id: string; label: string; reason: "changed_since" | "refused"; }[]; };
 export type AppAbsence = { member: { id: string; name: string; }; stand_in: { id: string; name: string; }; starts_on: string; ends_on: string; group_ids: string[]; };
 /** The file an app export made, as a link to download it: no workspace file, so no id, and kept a day. */
 export type ExportedFile = {

package/dist/store.d.ts

@@ -4,6 +4,8 @@ export type Fetcher<T> = (askedAt: number, current: T | undefined) => Promise<T>
 export declare function tick(): number;
 /** Ask again every key reading one of `aliases` — every query key where none is named; an unmounted one on its next mount. */
 export declare function refetchReads(aliases: readonly string[] | undefined): void;
+/** `refetchReads`, settled once every key a screen reads now holds an answer asked after this call — or its refusal. */
+export declare function readsAnswered(aliases: readonly string[]): Promise<void>;
 /** The host's push, naming the aliases whose tables moved: each key reading one asked again (`refetchReads`), in one
  *  paint. */
 export declare function refetchPushed(aliases: readonly string[]): void;

package/dist/viewer.d.ts

@@ -10,6 +10,8 @@ export declare function readContext(): Promise<AppContext>;
  */
 export declare function useAppContext(): {
     memberId: string | null;
+    /** The viewer is a signed-in member of the app's organization: the host named them and told their groups. */
+    insider: boolean;
     /** The viewer's member groups, by id; `null` where the host did not say. */
     groupIds: readonly string[] | null;
     /** Who in the organization is away, or will be, and who stands in; `null` where the host did not say. */

package/docs/members_and_options.md

@@ -373,7 +373,7 @@ table's id: read it off a row of the query that renders the badges (`rows[0]?.__
 rather than pasting a `tbl_` id, which a copy of the app cannot carry. Pass `undefined` while no
 row is on screen — no request is sent and `counts` is `{}`.
 
-## Record activity: `useRecordActivity`
+## Record activity: `useRecordActivity`, `undoRecordChange`
 
 Who changed which of a record's fields, and who commented on it — one entry per save
 (`dist/activity.d.ts`). For a JSON app: `entity` is the alias the app's spec names the record's
@@ -383,6 +383,8 @@ entity under.
 const { entries, next, loading, error, available, refetch } = useRecordActivity("job", recordId);
 // The page past it, mounted where the reader asks for more:
 const older = useRecordActivity("job", recordId, { after: next });
+// One change entry put back, as the viewer's own save:
+const { reverted, kept } = await undoRecordChange("job", recordId, entry.id);
 ```
 
 - **Authority: the app's own read of the record.** The server reaches the record through the
@@ -392,8 +394,8 @@ const older = useRecordActivity("job", recordId, { after: next });
   entry. A field taken out of the app while its table keeps it stays hidden; a field gone from its
   table appears where the version serving when it was written read it, marked `removed`. Comments
   appear only where the app declares `comments`.
-- **Members of the app's organization only** — the trail names its people. Standalone, `available`
-  is `false` and nothing is read.
+- **Members of the app's organization only** — the trail names its people. For a public visitor,
+  a member of another organization, and standalone, `available` is `false` and nothing is asked.
 - **One entry per save.** Edits by one actor on one record less than ten minutes apart read as one
   entry: each field from its value before the first edit to its value after the last, a field edited
   back to where it began dropped (and an entry left with nothing). A comment, another actor or a
@@ -401,7 +403,9 @@ const older = useRecordActivity("job", recordId, { after: next });
   its maker's edits after it, however soon, are entries of their own. `at` is the entry's first
   write, `until` its last.
 - **An entry** (`ActivityEntry`) is `kind: "change"` with `changes`, or `kind: "comment"` with
-  `comment: { id, body, mentions }`. `actor`: `{ kind, id, name, image? }` — `member` (a person),
+  `comment: { id, body, mentions }`. A change entry also says `undoable` — the viewer may put it
+  back — `undone: { by, at }` once someone has, and `undo: true` where it is itself the save that
+  put an earlier one back. `actor`: `{ kind, id, name, image? }` — `member` (a person),
   `agent` (an AI acting for a member: the chat, an app's agent, an MCP client — named by that
   member), `workflow` (a workflow on its own, named by the workflow) or `import` (a script over the
   API or the CLI, named by the member whose key ran it). `name` is empty where nothing resolves it.
@@ -411,6 +415,17 @@ const older = useRecordActivity("job", recordId, { after: next });
   `[{ key, label }]` (`readSelect`; each option's label as it was when written), a member field
   `[{ id, name, image? }]`, a link `[{ id, display }]` (`readLinks`), files presigned (`readFiles`),
   `null` for empty.
+- **`undoRecordChange(entity, record_id, entry_id)`** puts one change entry back: each field it
+  changed that the app reads returns to what it held before the entry, where the record still holds
+  what the entry wrote. It answers `{ reverted, kept }`: the fields put back (`{ field_id, label }`),
+  and those left as they stand with a `reason` — `changed_since` (someone changed it since) or
+  `refused` (the table refused the write: a lock, a check). A field already holding what it held
+  before is in neither. The write is the viewer's own save: they hold `write_data` on the table as
+  the call arrives, on a row their own row rule covers, and the record's lock, the table's checks
+  and its write rules answer as for any save of theirs. `undoable` is `false`, and the call
+  refused, for the entry that made the record, an entry that is an undo, one already put back, and
+  a viewer who may not write the record.
+  The undo is an entry of its own; the answer arrives once the record's reads are read anew.
 - **Pages**: newest first, about thirty entries each; `next` is where the trail goes on —
   `undefined` at its end. A page may hold fewer entries and still say `next` where the trail it read
   held little the reader may see.
@@ -428,4 +443,5 @@ const older = useRecordActivity("job", recordId, { after: next });
 | `useViewer` | member id (view-as target) | `null` |
 | `useWorkspaceTimezone` / `useWorkspaceCurrency` | ✓ | ✓ |
 | `useComments` / `useCommentCounts` | ✓ when capability declared | ✗ `available: false` |
-| `useRecordActivity` | ✓ the app's organization's members | ✗ `available: false` |
+| `useRecordActivity` | ✓ the app's organization's members | ✗ `available: false`, nothing asked |
+| `undoRecordChange` | ✓ a member holding the table's write, on a row they may write | ✗ rejects |

package/docs/runtime.md

@@ -210,6 +210,7 @@ surfaces:
 |---|---|---|
 | `query`, `field_options`, `workflow`, `members`, `context`, `upload`, `urlState.get/set`, `openExternal` | yes | yes |
 | `comments.*` | yes | rejects — `"Comments are available only in embedded apps — a signed-in member is required."` |
+| `activity.list`, `activity.undo` | yes, for a member of the app's organization; `activity.undo` for one who may write the record. A host that does not carry the op answers `"Unknown RPC op: activity.undo"` | rejects — `"A record's activity is available only in embedded apps — a signed-in member is required."` |
 | `agentRun` (streaming, internal to `useAgentRun`) | yes | yes |
 | `agentRun.get`, `agentRun.cancel` | yes | yes |
 | `agentRuns` (session history) | **no** — the product host doesn't implement it either (`"Unknown RPC op: agentRuns"`) | rejects — a standalone caller is anonymous, and a history is its member's (`"App agent runs require an authenticated member …"`) |

package/docs/security.md

@@ -103,6 +103,7 @@ A publicly-shared app (its own origin, or its public link) is reachable by **any
 | Agent runs (`useAgentRun`) | **No** — rejected: agent runs require an authenticated member, and each member's run history is private to them (a guessed session id cannot read another member's thread) |
 | Comments (`useComments`) | **No** — members-only |
 | Record activity (`useRecordActivity`) | **No** — the app's organization's members only |
+| Undo of a record's change (`undoRecordChange`) | **No** — a member of the app's organization holding `write_data` on the record's table, on a row their own row rule covers |
 | Member roster (`useMembers`) | **No** — same-org members only (below) |
 
 **Warning — `is_current_member` on a public app resolves to the app owner.** An anonymous request has no viewer to bind, so both `is_current_member` and `current_member in_any_group` fall back to the owner's identity and the owner's groups. A "my items" query shows every anonymous visitor the *owner's* items, and a manager-only read template gated on a group the owner belongs to **passes for every anonymous visitor**. Never rely on viewer-bound predicates in a public app.

package/docs/workflows.md

@@ -392,7 +392,7 @@ body does not look like what you typed.
 | `arr.at(i)` | `at(arr, i)` — negative counts from the end |
 | `arr.filter(Boolean)` | `compact(arr)` — drops every falsy element |
 | `[...a, b]` | `concat(a, [b])` |
-| `{ ...a, b: 1 }` | `merge(a, { b: 1 })` — later sources win, as in JS |
+| `{ ...a, b: 1 }` | `merge(merge({}, a), { b: 1 })` — later sources win, as in JS — and reads back as the spread, typed as you wrote it |
 | `{ table_id }` | `{ table_id: table_id }` — in expressions **and** tool inputs |
 | `undefined` | `null` |
 | `xs.push(a, b);` | `xs = concat(xs, [a, b])` — statement form |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/app-sdk",
-  "version": "0.120.3",
+  "version": "0.122.0",
   "description": "The SDK a Lotics custom-code app reads and writes through — typed hooks over the host bridge, cell readers, mount() and AppRouter",
   "type": "module",
   "exports": {