@lotics/app-sdk 0.123.11 → 0.124.0

package/docs/members_and_options.md

@@ -261,7 +261,7 @@ host did not say (a visitor from outside the organization, an older host). Both
 context, read once as the app opens. Display only: the workflow body re-checks who may act
 (`current_member_stands_in_for(...)`).
 
-`openableApps` lists the workspace's apps the viewer can open, each by its `id` and its `name` — what a
+`openableApps` lists the workspace's apps the viewer can open, each by its `id` and its `name`, and `table_id`, the table its register lists, where the host says — what a
 way through to a sibling app (`openApp`, `peekApp`) is offered by. `null` where the host did not say (standalone, a
 render, an older host, or a page that had not listed its apps when the app opened). Display only: the
 app opened checks the viewer itself.
@@ -301,7 +301,7 @@ Opt in on the app — a JSON app states it in its model; a custom-code app sets
 version:
 
 ```jsonc
-// update_app
+// set_app
 { "app_id": "app_…", "capabilities": { "comments": true } }
 ```
 
@@ -378,65 +378,17 @@ table's id: read it off a row of the query that renders the badges (`rows[0]?.__
 rather than pasting a `tbl_` id, which a copy of the app cannot carry. Pass `undefined` while no
 row is on screen — no request is sent and `counts` is `{}`.
 
-## Record activity: `useRecordActivity`, `undoRecordChange`
+## Outside links: `useOutsideLinks`
 
-Who changed which of a record's fields, and who commented on it — one entry per save
-(`dist/activity.d.ts`). For a JSON app: `entity` is the alias the app's spec names the record's
-entity under.
-
-```tsx
-const { entries, next, loading, error, available, refetch } = useRecordActivity("job", recordId);
-// The page past it, mounted where the reader asks for more:
-const older = useRecordActivity("job", recordId, { after: next });
-// One change entry put back, as the viewer's own save:
-const { reverted, kept } = await undoRecordChange("job", recordId, entry.id);
-```
-
-- **Authority: the app's own read of the record.** The server reaches the record through the
-  entity's read of one row — the read the record screen draws it with — so a row that read does not
-  reach (the reader's scope, another workspace's) answers not found. Only the fields that read draws
-  appear: a field the app does not read never does, and an edit of one neither shows nor splits an
-  entry. A field taken out of the app while its table keeps it stays hidden; a field gone from its
-  table appears where the version serving when it was written read it, marked `removed`. Comments
-  appear only where the app declares `comments`.
-- **Members of the app's organization only** — the trail names its people. For a public visitor,
-  a member of another organization, and standalone, `available` is `false` and nothing is asked.
-- **One entry per save.** Edits by one actor on one record less than ten minutes apart read as one
-  entry: each field from its value before the first edit to its value after the last, a field edited
-  back to where it began dropped (and an entry left with nothing). A comment, another actor or a
-  longer pause starts another entry, and the save that made the record is an entry alone (`created`):
-  its maker's edits after it, however soon, are entries of their own. `at` is the entry's first
-  write, `until` its last.
-- **An entry** (`ActivityEntry`) is `kind: "change"` with `changes`, or `kind: "comment"` with
-  `comment: { id, body, mentions }`. A change entry also says `undoable` — the viewer may put it
-  back — `undone: { by, at }` once someone has, and `undo: true` where it is itself the save that
-  put an earlier one back. `actor`: `{ kind, id, name, image? }` — `member` (a person),
-  `agent` (an AI acting for a member: the chat, an app's agent, an MCP client — named by that
-  member), `workflow` (a workflow on its own, named by the workflow) or `import` (a script over the
-  API or the CLI, named by the member whose key ran it). `name` is empty where nothing resolves it.
-- **A change** (`ActivityChange`): `{ field_id, label, removed?, before, after }`. `field_id` is a
-  spec field's `id`; `label` the app's label today, else — a removed field — its label when written.
-  Values are drawn as the record's read draws them, so the cell readers apply: a select
-  `[{ key, label }]` (`readSelect`; each option's label as it was when written), a member field
-  `[{ id, name, image? }]`, a link `[{ id, display }]` (`readLinks`), files presigned (`readFiles`),
-  `null` for empty.
-- **`undoRecordChange(entity, record_id, entry_id)`** puts one change entry back: each field it
-  changed that the app reads returns to what it held before the entry, where the record still holds
-  what the entry wrote. It answers `{ reverted, kept }`: the fields put back (`{ field_id, label }`),
-  and those left as they stand with a `reason` — `changed_since` (someone changed it since) or
-  `refused` (the table refused the write: a lock, a check). A field already holding what it held
-  before is in neither. The write is the viewer's own save: they hold `write_data` on the table as
-  the call arrives, on a row their own row rule covers, and the record's lock, the table's checks
-  and its write rules answer as for any save of theirs. `undoable` is `false`, and the call
-  refused, for the entry that made the record, an entry that is an undo, one already put back, a
-  viewer who may not write the record, and a JSON app that saves no record of the entity (an undo is
-  a save); a record in the trash is refused until it is restored.
-  The undo is an entry of its own; the answer arrives once the record's reads are read anew.
-- **Pages**: newest first, about thirty entries each; `next` is where the trail goes on —
-  `undefined` at its end. A page may hold fewer entries and still say `next` where the trail it read
-  held little the reader may see.
-- **Freshness:** read again when a push or this app's own write names the entity's reads, when a
-  comment is written or deleted through `useComments`, on focus, and on `refetch()`.
+`useOutsideLinks(recordId)` (`dist/outside_link.d.ts`) → `{ links, loading, error, available, create, revoke }` — a
+member's links to one record, for the record screen of an app whose model states an `Outside` (the person with no seat
+who opens a link; see the model reference). `available` is true for a signed-in member of the app's organization; for
+anyone else nothing is asked and `links` stays empty. Pass `null` where the record draws no Outside: nothing is
+asked either, and `create` and `revoke` throw `OutsideLinkRecordError`. `links` holds the record's title and, per link, who it is for, when
+it closes, whether it was opened and why a closed one closed; the secret is never in it. `create(outside)` and
+`revoke(link)` ask the **host**, which draws its own dialog (who the link is for and for how long; a confirmation),
+makes or withdraws the link and shows the address itself, so the frame never sees or sends a secret. `create` resolves
+to the link made, or `null` when the member backed out; `revoke` to whether it did. Both read the list again.
 
 ## Where each hook works
 
@@ -449,5 +401,3 @@ const { reverted, kept } = await undoRecordChange("job", recordId, entry.id);
 | `useViewer` | member id (view-as target) | `null` |
 | `useWorkspaceTimezone` / `useWorkspaceCurrency` | ✓ | ✓ |
 | `useComments` / `useCommentCounts` | ✓ when capability declared | ✗ `available: false` |
-| `useRecordActivity` | ✓ the app's organization's members | ✗ `available: false`, nothing asked |
-| `undoRecordChange` | ✓ a member holding the table's write, on a row they may write | ✗ rejects |

package/docs/mutations.md

@@ -441,7 +441,8 @@ Row-level query results carry a `__source_locked` addressing column automaticall
 project/filter/sort/join but not grouping, where rows stop being records).
 `readLocked(row)` — pass the **whole row**, not a cell — returns `true` for a locked record,
 `false` when the flag is absent (`dist/row.d.ts`). Use it to render a locked state and to
-switch the save path.
+switch the save path. `readLockedBy(row)` names who can change it — its table's approvers, else
+the organization's admins — for a member of the app's organization; `[]` for anyone else.
 
 ### What a write against a locked record does
 
@@ -459,8 +460,8 @@ return({ status: "success", message: "Updated." });
 ```
 
 `update_records` has no bypass flag — a locked record's values change only through the
-approval flow below (or an admin explicitly unlocking the record first; `unlock_records` is
-admin-gated, so don't build an unlock→edit→relock workflow around the approval flow — the
+approval flow below (or the table's owner or an admin explicitly unlocking the record first; `unlock_records` is
+owner- or admin-gated — in an app's run, judged as the member who pressed, never the app's owner — so don't build an unlock→edit→relock workflow around the approval flow — the
 lock exists to route changes through review).
 
 ### The change-request path: `request_locked_record_change`

package/docs/recipes.md

@@ -119,7 +119,7 @@ the wrong half is *plausible and wrong* rather than broken.
 
 Two **separate** layers; set both.
 
-**Launcher chrome** — `lotics run update_app '{"app_id":"…","icon":"truck","theme":{"color":"blue"}}'`.
+**Launcher chrome** — `lotics run set_app '{"app_id":"…","body":{"icon":"truck","color":"blue"}}'`.
 `icon` is any Lucide name (the full library, validated at write time — a wrong name is rejected, not
 silently boxed). Don't guess the kebab spelling:
 
@@ -127,9 +127,9 @@ silently boxed). Don't guess the kebab spelling:
 lotics run search_app_icons '{"query":"shipping"}'   → ["truck","ship","package",…]
 ```
 
-`theme.color` is a named palette colour: `red orange amber yellow lime green emerald teal cyan sky
-blue indigo violet purple fuchsia pink rose slate gray zinc neutral stone`. `null` clears either.
-`update_app` sets both.
+`color` is a named palette colour: `red orange amber yellow lime green emerald teal cyan sky
+blue indigo violet purple fuchsia pink rose slate gray zinc neutral stone`. `null` in `body` clears
+either. `set_app` sets both.
 
 **In-app palette** — the app's own `src/theme.ts`, exact hex. This is what the app *renders* with;
 the launcher colour does not feed it. Pick the named colour closest to your brand hex.

package/docs/runtime.md

@@ -219,7 +219,6 @@ surfaces:
 |---|---|---|
 | `query`, `field_options`, `workflow`, `members`, `context`, `upload`, `urlState.get/set`, `openExternal` | yes | yes |
 | `comments.*` | yes | rejects — `"Comments are available only in embedded apps — a signed-in member is required."` |
-| `activity.list`, `activity.undo` | yes, for a member of the app's organization; `activity.undo` for one who may write the record. A host that does not carry the op answers `"Unknown RPC op: activity.undo"` | rejects — `"A record's activity is available only in embedded apps — a signed-in member is required."` |
 | `agentRun` (streaming, internal to `useAgentRun`) | yes | yes |
 | `agentRun.get`, `agentRun.cancel` | yes | yes |
 | `agentRuns` (session history) | **no** — the product host doesn't implement it either (`"Unknown RPC op: agentRuns"`) | rejects — a standalone caller is anonymous, and a history is its member's (`"App agent runs require an authenticated member …"`) |
@@ -275,6 +274,11 @@ semantics are documented:
 | `urlState.get` / `urlState.set` | — / `{ params }` | `UrlParams` / `void` | [navigation & state](./navigation_and_state.md) |
 | `comments.list/create/update/delete/counts` | comment ops | comment payloads | [members & options](./members_and_options.md) |
 | `recording.start` / `recording.stop` | `{ alias, inputs }` / `{ alias }` | `{ started }` / `void` | [mutations](./mutations.md#recording-into-a-workflow-userecording) |
+| `outsideLink.list/create/revoke` | `{ record_id }` / `{ record_id, outside }` / `{ record_id, link_id }` | links / link or `null` / `{ id }` or `null` | [members & options](./members_and_options.md#outside-links-useoutsidelinks) |
+
+`installRpcTransport(transport)` answers every op itself, for a page that is never an app's (the page a person with no
+seat opens from a link to one record); the last install wins and a page installs its own before it mounts. An app never
+calls it.
 
 The **streaming** agent-run op is *not* reachable through `rpc()` — its
 response is a chunk stream, not a single value; it's internal to `useAgentRun`.

package/docs/security.md

@@ -10,7 +10,6 @@ Every data operation an app performs — queries, workflows, agent runs — exec
 | Workflows (`useWorkflow`) | App owner | Yes — `runtime.triggered_by_member_id` in the workflow body (`null` for anonymous) |
 | Agent runs (`useAgentRun`) | App owner | Yes — requires an authenticated member; runs are private to that member |
 | Comments (`useComments`) | App authority for **access**; the **author** is always the real member | Always — members-only, anonymous callers are rejected |
-| Record activity (`useRecordActivity`) | The app's own read of the record — the entity's read of one row, and only the fields it draws | Always — the app's organization's members only |
 
 Consequences of owner authority:
 
@@ -102,8 +101,6 @@ A publicly-shared app (its own origin, or its public link) is reachable by **any
 | Query/workflow file outputs | Yes — file cells and workflow-produced files return direct presigned URLs (24-hour TTL) that anonymous viewers can fetch; see [files](./files.md) |
 | Agent runs (`useAgentRun`) | **No** — rejected: agent runs require an authenticated member, and each member's run history is private to them (a guessed session id cannot read another member's thread) |
 | Comments (`useComments`) | **No** — members-only |
-| Record activity (`useRecordActivity`) | **No** — the app's organization's members only |
-| Undo of a record's change (`undoRecordChange`) | **No** — a member of the app's organization holding `write_data` on the record's table, on a row their own row rule covers, in an app that saves records of that entity |
 | Member roster (`useMembers`) | **No** — same-org members only (below) |
 
 **Warning — `is_current_member` on a public app resolves to the app owner.** An anonymous request has no viewer to bind, so both `is_current_member` and `current_member in_any_group` fall back to the owner's identity and the owner's groups. A "my items" query shows every anonymous visitor the *owner's* items, and a manager-only read template gated on a group the owner belongs to **passes for every anonymous visitor**. Never rely on viewer-bound predicates in a public app.

package/docs/workflows.md

@@ -34,8 +34,7 @@ if (order.data["fld_status"] == "opt_open") { … }
 A body is the app's, stored on the server and bound to an alias: `set_app_workflow` takes the
 alias, the body's `source`, and the alias's `inputs` (leave `outputs` off to let the body's
 `return({ data })` derive it). The server verifies the body and the write lands live, as a new
-version of the app; `get_app_workflow` reads it back, and `rollback_app` returns the app to a
-version before it. Input declaration vocabulary and validation:
+version of the app; `get_app_workflow` reads it back, and an earlier body is restored by writing it again. Input declaration vocabulary and validation:
 [mutations](./mutations.md#declaring-workflow-inputs).
 
 An app workflow body carries **no trigger declaration** — the binding supplies the trigger
@@ -138,7 +137,7 @@ The body is a sequence of statements, each of which maps 1:1 onto a stored step.
 | Pause | `await wait({ duration_in_minutes: 5 });` |
 | Pause for an event | `await wait_for_event({ event_type: "payment" \| "webhook", event_ref, timeout_in_minutes? });` |
 | Pause for a decision | `const a = await wait_for_approval({ approvers, prompt, timeout_in_minutes? });` |
-| LLM reasoning | `const x = await agent({ instructions, input, tools, model?, output });` |
+| LLM reasoning | `const x = await agent({ instructions, input, model?, output });` |
 | Run a declared agent | `const x = await app_agent({ alias, input, wait? });` |
 | Guard | `validate({ checks: [{ fail_when, field_key?, message }, …] });` |
 | End the run | `return({ status, message, field_errors?, data? });` |
@@ -283,7 +282,6 @@ const order = await get_record({ table_id: "tbl_orders", record_id: i.order_id }
 const summary = await agent({
   instructions: "Summarize the order in one sentence for an internal digest.",
   input: { code: order.data["fld_order_code"], total: order.data["fld_total"] },
-  tools: [],
   output: { mode: "text" },
 });
 ```
@@ -293,13 +291,14 @@ name" when broken:
 
 - **Only `input` sees the workflow.** It must be an **object literal**; its field values are
   ordinary expressions and are the *only* workflow data the agent receives. `instructions` is a
-  static string literal and `tools` a literal array of tool names — neither may read a binding,
-  so do not interpolate a record into `instructions`; move it into `input`.
+  static string literal and may not read a binding, so do not interpolate a record into
+  `instructions`; move it into `input`. An agent step calls no tool and states no `tools`: the
+  workflow's own steps write, send and notify with what it returns.
 - **Only the bound name comes back.** In `{ mode: "text" }` the result *is* the string — use it
   directly. In `{ mode: "object", schema }` the `schema` is itself a top-level object declaration
   (`{ type: "object", fields: { total: { type: "number" }, … } }`, the same vocabulary as an
   alias's `outputs`); read the declared fields as `x.field`, and a name not in `schema` does not
-  exist. The agent's own tool calls and reasoning are not readable.
+  exist. The agent's reasoning is not readable.
 
 `model` is an optional pin — omit it to follow the platform default. The step is atomic (no wait
 or approval inside it).
@@ -494,12 +493,12 @@ full menu by category, so a miss is one informed retry.
 
 | Category | Helpers |
 |---|---|
-| **Type / null** | `isNull`, `isNotNull`, `isEmpty`, `isString`, `isNumber`, `isBoolean`, `isArray`, `isObject`, `coalesce`, `toNumber`, `toString`, `typeOf`, `parseJson`, `toJson` |
+| **Type / null** | `isNull`, `isNotNull`, `isEmpty`, `isString`, `isNumber`, `isBoolean`, `isArray`, `isObject`, `coalesce`, `toNumber`, `toFigure`, `toString`, `typeOf`, `parseJson`, `toJson` |
 | **Array** | `size`, `first`, `requireFirst`, `last`, `nth`, `at`, `slice`, `includes`, `filter`, `find`, `some`, `every`, `pluck`, `sortBy`, `groupBy`, `countBy`, `unique`, `uniqueBy`, `compact`, `flatten`, `reverse`, `concat`, `difference`, `differenceBy`, `intersection`, `intersectionBy`, `list`, `range`, `reduce` |
 | **Number** | `sum`, `sumBy`, `mean`, `meanBy`, `min`, `max`, `minBy`, `maxBy`, `round`, `ceil`, `floor`, `abs`, `mod`, `pow`, `sqrt`, `clamp`, `percentage` |
-| **String** | `upper`, `lower`, `capitalize`, `trim`, `contains`, `startsWith`, `endsWith`, `replace`, `replaceAll`, `substring`, `length`, `split`, `join`, `padStart`, `padEnd`, `formatNumber(value, decimals)` (fixed-decimal, ungrouped), `formatDecimal(value, decimals, locale)` (grouped for a reader — `formatDecimal(151000, 0, "vi-VN")` → `151.000`), `numberToWords(x, lang?)` (`"vi"` or `"en"`) |
+| **String** | `upper`, `lower`, `capitalize`, `trim`, `contains`, `startsWith`, `endsWith`, `replace`, `replaceAll`, `substring`, `length`, `split`, `join`, `padStart`, `padEnd`, `uuidFrom(text)` (the same UUID for the same text), `formatNumber(value, decimals)` (fixed-decimal, ungrouped), `formatDecimal(value, decimals, locale)` (grouped for a reader — `formatDecimal(151000, 0, "vi-VN")` → `151.000`), `numberToWords(x, lang?)` (`"vi"` or `"en"`) |
 | **Object** | `keys`, `values`, `entries`, `get`, `pick`, `omit`, `merge`, `nonNullKeys` |
-| **Date** | `now`, `formatDate`, `parseDate`, `addDays`, `subDays`, `addHours`, `subHours`, `addMinutes`, `subMinutes`, `startOfDay`, `endOfDay`, `differenceInCalendarDays`, `differenceInHours`, `differenceInMinutes`, `isBefore`, `isAfter`, `isSameDay`, `isToday`, `isWithinRange` |
+| **Date** | `now`, `formatDate`, `parseDate`, `addDays`, `subDays`, `addHours`, `subHours`, `addMinutes`, `subMinutes`, `startOfDay`, `endOfDay`, `differenceInCalendarDays`, `differenceInHours`, `differenceInMinutes`, `isBefore`, `isAfter`, `isSameDay`, `isToday`, `isWithinRange`, `meetsBounds` |
 | **Other** | `formatCurrency(amount, locale, currency)`, `randomNumber(len)`, `randomAlphaNumeric(len)`, `sample(items)`, `current_member_in_any_group(["grp_…"])`, `current_member_stands_in_for([memberId])`, `current_member_stands_in_for_any_group(["grp_…"])` |
 
 **Emptiness on a record cell.** `isNull` is the strict check — true only for `null`/`undefined`.
@@ -752,7 +751,7 @@ existed only to feed it, which is usually where the round trips were hiding.
 
 ### Measuring, if you do
 
-`query_workflow_executions` records `started_at` / `completed_at` per run, the server's own
+`query_workflow_executions` and `get_workflow_execution` give `started_at` / `completed_at` per run, the server's own
 duration. **Run-to-run variance is large** (a second, minutes apart), so compare medians of several
 interleaved runs, never one before/after pair.
 
@@ -849,41 +848,15 @@ fix-stating messages before you see them.
 
 `check` and `set` prove parse, types, name resolution, structure, and lint — **none of them
 evaluates an expression**. A body that saves clean can still take the wrong branch, hand a tool a filter it
-rejects, or read a path that is null on real data. The rehearsal for that is `dry_run_workflow`
-(`lotics run dry_run_workflow '<json>'`): pass the `source`, `trigger_type: "app_workflow"`,
-`table_id: null`, the input **values** as `trigger_payload`, and the declared schema as
-`app_workflow_inputs`. It walks the real step tree with the production expression evaluator and
-hands back `planned_calls` (every tool call in order, with its fully-resolved input),
-`return_value`, `validation_failures`, `evaluation_errors`, and `tool_input_errors` — inputs the
-target tool would reject, which can only surface once the values are computed. Loops run for real,
-every iteration, so a fold or a per-row fan-out is rehearsed at its true size. **Write tools are
-recorded, never dispatched**, and nothing is persisted.
-
-**Add `live_reads: true` whenever the body READS.** By default the read-only tools
-(`query_records`, `get_record`, `aggregate_records`) return stubs — an empty result set, a blank
-record — so any branch gated on stored data takes the empty path. With `live_reads: true` those
-three dispatch against the real workspace under YOUR authority while writes stay recorded-only. (A
-table-triggered body gets this from `record_id` + `table_id`; an app workflow has no trigger
-record, so it asks directly.) Do this before the first live run of anything that writes.
-
-**`return_value` is what the CALLER receives**, not a summary of it: `{ status, message }` always,
-plus `data` when the body returns one and `field_errors` when it returns those — the same map a
-form reads. A `validate` step that fails produces the same shape the live run does: every failing
-check's message joined with `"; "`, and one `field_errors` entry per failing check that names a
-`field_key`.
-
-**A rehearsal can stop early, and it says so in `evaluation_errors`.** Four bounds apply — 1 000
-iterations of a `while` / `do_while` / `c_for`, 10 000 steps, 50 live reads, and 20 seconds — and
-tripping any of them appends an entry naming the bound and ending "the plan below is incomplete",
-then stops. It also stops, with an entry saying why, where the live run would fail: at a
-`validate` check that throws, an evaluation past the run's compute or memory bounds (*Traps*), or a
-return too long to write.
-So read `evaluation_errors` before reading `planned_calls`: an entry there may be a
-truncated plan rather than a bug in your body. A `foreach` is deliberately NOT capped at 1 000 —
-its length is known before the first iteration, so the rehearsal walks every item and instead
-refuses, up front, exactly the lists a live run refuses (over 10 000 items). The 50-live-read bound
-is the one `live_reads: true` makes reachable: a loop body that reads issues one real query per
-iteration.
+rejects, or read a path that is null on real data. The rehearsal for that is `set_app_workflow` with
+`verify_only: true` and a `record_id` (the row an Act would run on) or `preview_inputs` (the values of a
+workflow that takes inputs and no row): the draft is walked by the engine an Act's preview uses, under the
+app's authority, with the production expression evaluator. Reads are real; writes and service sends are
+said, not made, and a document a step renders is made as a paper no listing shows. It answers `preview`
+(the calls the run would make, each with its fully-resolved input, and the reads it made) and `returned`
+(`{ status, message }` always, plus `data` and `field_errors` when the body returns them — what the caller
+receives). A draft it cannot rehearse — a step that reads what a call before it answers, a wait, a bound the
+walk reaches — answers `preview.available: false` and the reason. Nothing is written.
 
 ## A workflow that receives a recording
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/app-sdk",
-  "version": "0.123.11",
+  "version": "0.124.0",
   "description": "The SDK a Lotics custom-code app reads and writes through — typed hooks over the host bridge, cell readers, mount() and AppRouter",
   "type": "module",
   "exports": {

package/dist/activity.d.ts

@@ -1,40 +0,0 @@
-import type { ActivityEntry, ActivityUndoResult } from "./shared_types.js";
-export interface RecordActivityState {
-    /** Newest first. */
-    entries: ActivityEntry[];
-    /** Where the trail goes on — pass it as `after` to read the page past this one; `undefined` at its end. */
-    next: string | undefined;
-    loading: boolean;
-    error: string | null;
-    /** A signed-in member of the app's organization; for anyone else nothing is read and `entries` stays empty. */
-    available: boolean;
-    refetch: () => void;
-}
-export interface RecordActivityOptions {
-    /** A page's `next`: read the page past it. Absent, the newest page. */
-    after?: string;
-}
-/**
- * One page of the record's activity. `entity` is the alias the app's spec names the record's entity under; `record_id`
- * a real id. Read again when a push or this app's own write names the entity's reads, and when a comment is written.
- *
- * ```tsx
- * const { entries, next } = useRecordActivity("job", recordId);
- * // The page past it, mounted where the reader asks for more:
- * const older = useRecordActivity("job", recordId, { after: next });
- * ```
- */
-export declare function useRecordActivity(entity: string, record_id: string, options?: RecordActivityOptions): RecordActivityState;
-/**
- * Put one change entry of the record's activity back, as the viewer's own save: each field the entry changed returns
- * to what it held before it where the record still holds what the entry wrote. The answer names the fields put back
- * (`reverted`) and those left as they stand (`kept`), each with its `reason` — `changed_since`, or `refused` where the
- * table refused the write (a lock, a check) — and arrives once the record's reads are read anew. Refused for an entry
- * whose `undoable` is false: the record's making, an undo, an entry already put back, and a viewer who may not write
- * the record.
- *
- * ```tsx
- * const { reverted, kept } = await undoRecordChange("job", recordId, entry.id);
- * ```
- */
-export declare function undoRecordChange(entity: string, record_id: string, entry_id: string): Promise<ActivityUndoResult>;