@lotics/app-sdk 0.124.8 → 0.124.10

package/dist/{chunk-YONY7UPS.js → chunk-BNJZBF6D.js}

@@ -193,7 +193,7 @@ function searchWords(value) {
   return (typeof value === "string" ? [value] : value).map((word) => word.trim()).filter((word) => foldSearchText(word).trim() !== "");
 }
 
-// ../../node_modules/nanoid/index.browser.js
+// ../shared/node_modules/nanoid/index.browser.js
 var random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
 var customRandom = (alphabet, defaultSize, getRandom) => {
   let safeByteCutoff = 256 - 256 % alphabet.length;
@@ -204,7 +204,7 @@ var customRandom = (alphabet, defaultSize, getRandom) => {
       let id = "";
       while (true) {
         let bytes = getRandom(size);
-        let j = size;
+        let j = size |= 0;
         while (j--) {
           id += alphabet[bytes[j] & mask];
           if (id.length >= size) return id;
@@ -212,10 +212,10 @@ var customRandom = (alphabet, defaultSize, getRandom) => {
       }
     };
   }
-  let step = Math.ceil(1.6 * 256 * defaultSize / safeByteCutoff);
   return (size = defaultSize) => {
     if (!size) return "";
     let id = "";
+    let step = Math.ceil(1.6 * 256 * size / safeByteCutoff);
     while (true) {
       let bytes = getRandom(step);
       let j = step;

package/dist/index.js

@@ -49,7 +49,7 @@ import {
   subtractDecimal,
   sumDecimal,
   urlParam
-} from "./chunk-YONY7UPS.js";
+} from "./chunk-BNJZBF6D.js";
 
 // src/mount.tsx
 import { createRoot } from "react-dom/client";
@@ -2724,36 +2724,64 @@ function isUsableLocale(locale) {
   }
 }
 
+// ../../node_modules/@noble/hashes/_u64.js
+var fromNumH = (n) => n / 2 ** 32 | 0;
+var fromNumL = (n) => n >>> 0;
+function setU64FromNum(view, byteOffset, n, isLE) {
+  const h = fromNumH(n);
+  const l = fromNumL(n);
+  view.setUint32(byteOffset, isLE ? l : h, isLE);
+  view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+}
+
 // ../../node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
+var atitle = (title) => title ? `"${title}" ` : "";
+function anumber(n, title = "") {
+  if (typeof n !== "number")
+    throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+  return n;
+}
 function abytes(value, length2, title = "") {
+  if (isBytes(value) && (length2 === void 0 || value.length === length2))
+    return value;
+  if (length2 !== void 0)
+    anumber(length2, "length");
   const bytes = isBytes(value);
-  const len = value?.length;
-  const needsLen = length2 !== void 0;
-  if (!bytes || needsLen && len !== length2) {
-    const prefix = title && `"${title}" `;
-    const ofLen = needsLen ? ` of length ${length2}` : "";
-    const got = bytes ? `length=${len}` : `type=${typeof value}`;
-    const message2 = prefix + "expected Uint8Array" + ofLen + ", got " + got;
-    if (!bytes)
-      throw new TypeError(message2);
-    throw new RangeError(message2);
-  }
-  return value;
-}
+  const ofLen = length2 !== void 0 ? ` of length ${length2}` : "";
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+  const message2 = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+  if (!bytes)
+    throw new TypeError(message2);
+  throw new RangeError(message2);
+}
+var aobject = (value, label) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+};
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
-    throw new Error("Hash instance has been destroyed");
+    throw new Error("hash was destroyed");
   if (checkFinished && instance.finished)
-    throw new Error("Hash#digest() has already been called");
+    throw new Error("digest() was already called");
 }
 function aoutput(out, instance) {
-  abytes(out, void 0, "digestInto() output");
+  abytes(out, void 0, "output");
   const min3 = instance.outputLen;
-  if (out.length < min3) {
-    throw new RangeError('"digestInto() output" expected to be of length >=' + min3);
+  if (!(out.length >= min3)) {
+    throw new RangeError('"output" expected length >= ' + min3);
   }
 }
 function clean(...arrays) {
@@ -2782,15 +2810,8 @@ function bytesToHex(bytes) {
   }
   return hex;
 }
-var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
 function asciiToBase16(ch) {
-  if (ch >= asciis._0 && ch <= asciis._9)
-    return ch - asciis._0;
-  if (ch >= asciis.A && ch <= asciis.F)
-    return ch - (asciis.A - 10);
-  if (ch >= asciis.a && ch <= asciis.f)
-    return ch - (asciis.a - 10);
-  return;
+  return ch >= 48 && ch <= 57 ? ch - 48 : ch >= 65 && ch <= 70 ? ch - (65 - 10) : ch >= 97 && ch <= 102 ? ch - (97 - 10) : void 0;
 }
 function hexToBytes(hex) {
   if (typeof hex !== "string")
@@ -2823,7 +2844,12 @@ function hexToBytes(hex) {
 function utf8ToBytes(str) {
   if (typeof str !== "string")
     throw new TypeError("string expected");
-  return new Uint8Array(new TextEncoder().encode(str));
+  const encoded = new TextEncoder().encode(str);
+  try {
+    return new Uint8Array(encoded);
+  } finally {
+    clean(encoded);
+  }
 }
 function concatBytes(...arrays) {
   let sum2 = 0;
@@ -2840,7 +2866,17 @@ function concatBytes(...arrays) {
   }
   return res;
 }
+function checkOpts(defaults, opts, title = "opts") {
+  aopts(defaults, "defaults");
+  if (opts !== void 0)
+    aopts(opts, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts);
+  return merged;
+}
 function createHasher(hashCons, info = {}) {
+  if (typeof hashCons !== "function")
+    throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+  info = checkOpts({}, info, "info");
   const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
   const tmp = hashCons(void 0);
   hashC.outputLen = tmp.outputLen;
@@ -2884,24 +2920,28 @@ var HashMD = class {
     abytes(data);
     const { view, buffer, blockLen } = this;
     const len = data.length;
+    let processed = false;
     for (let pos = 0; pos < len; ) {
       const take = Math.min(blockLen - this.pos, len - pos);
       if (take === blockLen) {
         const dataView = createView(data);
         for (; blockLen <= len - pos; pos += blockLen)
           this.process(dataView, pos);
+        processed = true;
         continue;
       }
-      buffer.set(data.subarray(pos, pos + take), this.pos);
+      buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
       this.pos += take;
       pos += take;
       if (this.pos === blockLen) {
         this.process(view, 0);
         this.pos = 0;
+        processed = true;
       }
     }
     this.length += data.length;
-    this.roundClean();
+    if (processed)
+      this.roundClean();
     return this;
   }
   digestInto(out) {
@@ -2911,23 +2951,20 @@ var HashMD = class {
     const { buffer, view, blockLen, isLE } = this;
     let { pos } = this;
     buffer[pos++] = 128;
-    clean(this.buffer.subarray(pos));
+    buffer.fill(0, pos);
     if (this.padOffset > blockLen - pos) {
       this.process(view, 0);
-      pos = 0;
+      buffer.fill(0);
     }
-    for (let i = pos; i < blockLen; i++)
-      buffer[i] = 0;
-    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+    setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
     this.process(view, 0);
-    const oview = createView(out);
+    this.roundClean();
+    const oview = out === buffer ? view : createView(out);
     const len = this.outputLen;
-    if (len % 4)
-      throw new Error("_sha2: outputLen must be aligned to 32bit");
     const outLen = len / 4;
     const state = this.get();
-    if (outLen > state.length)
-      throw new Error("_sha2: outputLen bigger than state");
+    if (len % 4 || outLen > state.length)
+      throw new Error("invalid outputLen");
     for (let i = 0; i < outLen; i++)
       oview.setUint32(4 * i, state[i], isLE);
   }
@@ -2938,15 +2975,13 @@ var HashMD = class {
     this.destroy();
     return res;
   }
-  _cloneInto(to) {
-    to ||= new this.constructor();
-    to.set(...this.get());
-    const { blockLen, buffer, length: length2, finished, destroyed, pos } = this;
+  _cloneIntoMeta(to) {
+    const { buffer, length: length2, finished, destroyed, pos } = this;
     to.destroyed = destroyed;
     to.finished = finished;
     to.length = length2;
     to.pos = pos;
-    if (length2 % blockLen)
+    if (pos)
       to.buffer.set(buffer);
     return to;
   }
@@ -2984,6 +3019,10 @@ var _SHA1 = class extends HashMD {
     this.D = D | 0;
     this.E = E | 0;
   }
+  _cloneInto(to) {
+    (to ||= new this.constructor()).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
   process(view, offset) {
     for (let i = 0; i < 16; i++, offset += 4)
       SHA1_W[i] = view.getUint32(offset, false);
@@ -5832,8 +5871,7 @@ var TZDateMini = class _TZDateMini extends Date {
         this.setTime(+args[0]);
       } else {
         this.setTime(+new Date(...args));
-        adjustToSystemTZ(this, NaN);
-        syncToInternal(this);
+        adjustToSystemTZ(this, args);
       }
     }
   }
@@ -5851,7 +5889,7 @@ var TZDateMini = class _TZDateMini extends Date {
   }
   //#endregion
   //#region time
-  setTime(time) {
+  setTime(_time) {
     Date.prototype.setTime.apply(this, arguments);
     syncToInternal(this);
     return +this;
@@ -5887,49 +5925,79 @@ Object.getOwnPropertyNames(Date.prototype).forEach((method) => {
 });
 function syncToInternal(date2) {
   date2.internal.setTime(+date2);
-  date2.internal.setUTCSeconds(date2.internal.getUTCSeconds() - Math.round(-tzOffset(date2.timeZone, date2) * 60));
+  date2.internal.setUTCSeconds(date2.internal.getUTCSeconds() - // Round after converting minutes to seconds to avoid fractional offset
+  // precision errors from historical offsets.
+  Math.round(-tzOffset(date2.timeZone, date2) * 60));
 }
 function syncFromInternal(date2) {
   Date.prototype.setFullYear.call(date2, date2.internal.getUTCFullYear(), date2.internal.getUTCMonth(), date2.internal.getUTCDate());
   Date.prototype.setHours.call(date2, date2.internal.getUTCHours(), date2.internal.getUTCMinutes(), date2.internal.getUTCSeconds(), date2.internal.getUTCMilliseconds());
   adjustToSystemTZ(date2);
 }
-function adjustToSystemTZ(date2) {
-  const baseOffset = tzOffset(date2.timeZone, date2);
-  const offset = baseOffset > 0 ? Math.floor(baseOffset) : Math.ceil(baseOffset);
+function adjustToSystemTZ(date2, constructorArgs) {
+  const expectedInternalTime = Array.isArray(constructorArgs) ? constructorArgsToInternalTime(constructorArgs) : +date2.internal;
+  const offsetWithSeconds = tzOffset(date2.timeZone, date2);
+  const offset = offsetWithSeconds > 0 ? Math.floor(offsetWithSeconds) : Math.ceil(offsetWithSeconds);
   const prevHour = /* @__PURE__ */ new Date(+date2);
   prevHour.setUTCHours(prevHour.getUTCHours() - 1);
   const systemOffset = -(/* @__PURE__ */ new Date(+date2)).getTimezoneOffset();
   const prevHourSystemOffset = -(/* @__PURE__ */ new Date(+prevHour)).getTimezoneOffset();
   const systemDSTChange = systemOffset - prevHourSystemOffset;
-  const dstShift = Date.prototype.getHours.apply(date2) !== date2.internal.getUTCHours();
-  if (systemDSTChange && dstShift) date2.internal.setUTCMinutes(date2.internal.getUTCMinutes() + systemDSTChange);
-  const offsetDiff = systemOffset - offset;
-  if (offsetDiff) Date.prototype.setUTCMinutes.call(date2, Date.prototype.getUTCMinutes.call(date2) + offsetDiff);
+  let systemOffsetForDiff = systemOffset;
+  if (systemDSTChange && systemOffset !== offset) {
+    const systemHour = Date.prototype.getHours.apply(date2);
+    const expectedHour = Array.isArray(constructorArgs) ? constructorArgs[3] || 0 : date2.internal.getUTCHours();
+    if (systemHour !== expectedHour) {
+      const testDate = /* @__PURE__ */ new Date(+date2);
+      const testOffsetDiff = systemOffset - offset;
+      if (testOffsetDiff) testDate.setUTCMinutes(testDate.getUTCMinutes() + testOffsetDiff);
+      const testOffsetWithSeconds = tzOffset(date2.timeZone, testDate);
+      const testOffset = testOffsetWithSeconds > 0 ? Math.floor(testOffsetWithSeconds) : Math.ceil(testOffsetWithSeconds);
+      if (testOffset === offset) systemOffsetForDiff = prevHourSystemOffset;
+    }
+  }
+  const offsetDiff = systemOffsetForDiff - offset;
+  if (offsetDiff)
+    Date.prototype.setUTCMinutes.call(date2, Date.prototype.getUTCMinutes.call(date2) + offsetDiff);
   const systemDate = /* @__PURE__ */ new Date(+date2);
   systemDate.setUTCSeconds(0);
   const systemSecondsOffset = systemOffset > 0 ? systemDate.getSeconds() : (systemDate.getSeconds() - 60) % 60;
   const secondsOffset = Math.round(-(tzOffset(date2.timeZone, date2) * 60)) % 60;
-  if (secondsOffset || systemSecondsOffset) {
-    date2.internal.setUTCSeconds(date2.internal.getUTCSeconds() + secondsOffset);
+  if (secondsOffset || systemSecondsOffset)
     Date.prototype.setUTCSeconds.call(date2, Date.prototype.getUTCSeconds.call(date2) + secondsOffset + systemSecondsOffset);
-  }
-  const postBaseOffset = tzOffset(date2.timeZone, date2);
-  const postOffset = postBaseOffset > 0 ? Math.floor(postBaseOffset) : Math.ceil(postBaseOffset);
+  const postOffsetWithSeconds = tzOffset(date2.timeZone, date2);
+  const postOffset = postOffsetWithSeconds > 0 ? Math.floor(postOffsetWithSeconds) : Math.ceil(postOffsetWithSeconds);
   const postSystemOffset = -(/* @__PURE__ */ new Date(+date2)).getTimezoneOffset();
   const postOffsetDiff = postSystemOffset - postOffset;
   const offsetChanged = postOffset !== offset;
   const postDiff = postOffsetDiff - offsetDiff;
-  if (offsetChanged && postDiff) {
+  const targetDSTShift = postOffset - offset;
+  const postOffsetCandidate = expectedInternalTime - postOffset * 60 * 1e3;
+  const normalizedTargetDSTGap = targetDSTShift > 0 && targetInternalTime(date2) - expectedInternalTime === targetDSTShift * 60 * 1e3 && targetInternalTime(date2, postOffsetCandidate) !== expectedInternalTime;
+  if (offsetChanged && postDiff && !normalizedTargetDSTGap) {
     Date.prototype.setUTCMinutes.call(date2, Date.prototype.getUTCMinutes.call(date2) + postDiff);
-    const newBaseOffset = tzOffset(date2.timeZone, date2);
-    const newOffset = newBaseOffset > 0 ? Math.floor(newBaseOffset) : Math.ceil(newBaseOffset);
+    const newOffsetWithSeconds = tzOffset(date2.timeZone, date2);
+    const newOffset = newOffsetWithSeconds > 0 ? Math.floor(newOffsetWithSeconds) : Math.ceil(newOffsetWithSeconds);
     const offsetChange = postOffset - newOffset;
-    if (offsetChange) {
-      date2.internal.setUTCMinutes(date2.internal.getUTCMinutes() + offsetChange);
+    if (offsetChange && postDiff < 0) {
       Date.prototype.setUTCMinutes.call(date2, Date.prototype.getUTCMinutes.call(date2) + offsetChange);
     }
   }
+  syncToInternal(date2);
+  const expectedTime = constructorArgs ? expectedInternalTime : expectedInternalTime + secondsOffset * 1e3;
+  const drift = expectedTime - +date2.internal;
+  if (drift && Math.abs(drift) < 30 * 60 * 1e3) {
+    Date.prototype.setTime.call(date2, +date2 + drift);
+    syncToInternal(date2);
+  }
+}
+function constructorArgsToInternalTime(args) {
+  return Date.UTC(args[0], args.length > 1 ? args[1] : 0, args.length > 2 ? args[2] : 1, ...args.slice(3));
+}
+function targetInternalTime(date2, time) {
+  const internal = new Date(time ?? +date2);
+  internal.setUTCSeconds(internal.getUTCSeconds() - Math.round(-tzOffset(date2.timeZone, internal) * 60));
+  return +internal;
 }
 
 // ../../node_modules/@date-fns/tz/date/index.js
@@ -7613,7 +7681,11 @@ var TOOL_INPUT_SEMANTICS = {
     // Each entry's {field, op, value} carries a field-key position, but the
     // field is a sibling-dependent runtime value, not a single `table_from`
     // kind — the tool's own resolveSurgicalKeys validates it at execute time.
-    field_edits: { kind: "dynamic" }
+    field_edits: { kind: "dynamic" },
+    // The lock the call leaves, the deleted records it brings back, and the approval it files for a locked one: none holds a field key.
+    locked: { kind: "scalar" },
+    restore: { kind: "scalar" },
+    request_change: { kind: "scalar" }
   },
   create_records: {
     table_id: { kind: "table_ref", rows: "change" },
@@ -7674,21 +7746,11 @@ var TOOL_INPUT_SEMANTICS = {
     as_member: { kind: "scalar" },
     removal: { kind: "table_field_array" }
   },
-  restore_records: {
-    table_id: { kind: "table_ref", rows: "change" },
-    record_ids: { kind: "record_refs" },
-    filters: { kind: "filter_tree", table_from: "table_id" }
-  },
   lock_records: {
     table_id: { kind: "table_ref", rows: "change" },
     record_ids: { kind: "record_refs" },
     filters: { kind: "filter_tree", table_from: "table_id" }
   },
-  unlock_records: {
-    table_id: { kind: "table_ref", rows: "change" },
-    record_ids: { kind: "record_refs" },
-    filters: { kind: "filter_tree", table_from: "table_id" }
-  },
   request_locked_record_change: {
     table_id: { kind: "table_ref", rows: "none" },
     record_id: { kind: "record_ref" },
@@ -7697,18 +7759,6 @@ var TOOL_INPUT_SEMANTICS = {
     changes: { kind: "dynamic" },
     reason: { kind: "text" }
   },
-  // The record names its own table; an entry's id is the trail's.
-  undo_record_change: {
-    record_id: { kind: "record_ref" },
-    entry_id: { kind: "scalar" }
-  },
-  // `table_id` names the table whose rows the undo changes, moves to the trash and brings back; a run's id is the
-  // trail's.
-  undo_record_changes: {
-    table_id: { kind: "table_ref", rows: "remove" },
-    record_ids: { kind: "record_refs" },
-    workflow_execution_id: { kind: "scalar" }
-  },
   // ─── Query surfaces ────────────────────────────────────────────────────
   query_records: {
     table_id: { kind: "table_ref", rows: "none" },
@@ -7724,6 +7774,10 @@ var TOOL_INPUT_SEMANTICS = {
     archived_only: { kind: "scalar" },
     include_timestamps: { kind: "scalar" },
     as_member: { kind: "scalar" },
+    comments: { kind: "scalar" },
+    record_ids: { kind: "record_refs" },
+    // Nested {field_key, operation} shapes and a group_by key: resolved at execute time, as the aggregate tool did.
+    aggregate: { kind: "dynamic" },
     // Each entry pairs its OWN table_id with its OWN filter tree, so the table a
     // filter resolves against is per-element rather than a sibling kwarg — no
     // top-level kind can say that. Opaque to the save-time walker, which is the
@@ -7775,7 +7829,8 @@ var TOOL_INPUT_SEMANTICS = {
     // Keys on the record's own table, which `table_id` names when supplied and
     // the record resolves otherwise — the same position it holds on a query.
     field_keys: { kind: "field_key_refs", table_from: "table_id" },
-    as_member: { kind: "scalar" }
+    as_member: { kind: "scalar" },
+    comments: { kind: "scalar" }
   },
   // ─── Buttons (table-scoped field with action) ─────────────────────────
   press_button: {
@@ -9682,7 +9737,8 @@ async function tableOf(walk, input) {
 async function predictUpdate(walk, input) {
   const table = await tableOf(walk, input);
   const ids = input.record_ids === void 0 ? null : asIds(await attempt(walk, input.record_ids));
-  if (table === null || ids === null || input.filters !== void 0 || input.rows !== void 0 || input.field_edits !== void 0) {
+  const serverDecided = input.restore !== void 0 || input.locked !== void 0 || input.request_change !== void 0;
+  if (table === null || ids === null || serverDecided || input.filters !== void 0 || input.rows !== void 0 || input.field_edits !== void 0) {
     note(walk, { kind: "unknown", table_id: table });
     return;
   }

package/dist/router.d.ts

@@ -4,7 +4,7 @@ export interface NotFoundWords {
     message: (path: string) => string;
     firstScreen: string;
 }
-export declare function AppRouter({ routes, notFound, drawers }: {
+export declare function AppRouter({ routes, notFound, drawers, }: {
     routes: RouteObject[];
     notFound?: NotFoundWords;
     /** The query keys a drawer opens at, the one drawn lowest first: each open counts as a screen over the path's. */

package/dist/router.js

@@ -2,7 +2,7 @@ import {
   isEmbedded,
   postHostNotification,
   setUrlParams
-} from "./chunk-YONY7UPS.js";
+} from "./chunk-BNJZBF6D.js";
 
 // src/router.tsx
 import { useEffect } from "react";

package/docs/ai.md

@@ -13,7 +13,7 @@ Don't run a structured extraction through `askAi` (the result is stranded in a c
 
 ## Declared agents — what `useAgentRun` runs
 
-`useAgentRun` runs an agent already bound to the app; none can be added or changed any more, and `remove_app_binding` with `kind: "agent"` unbinds one. A new job for an agent is a declared Query or Workflow node of the app, which an outside agent runs with `run_app_query` and `run_app_workflow`. `.lotics/app_agents.d.ts`, generated from the app's live bindings by `lotics app create --custom` and `lotics app deploy`, types `useAgentRun("<alias>")` by the agent's input and output shapes.
+`useAgentRun` runs an agent already bound to the app; none can be added, changed or removed any more. A new job for an agent is a declared Query or Workflow node of the app, which an outside agent runs with `run_app_query` and `run_app_workflow`. `.lotics/app_agents.d.ts`, generated from the app's live bindings by `lotics app deploy` and `lotics app pull`, types `useAgentRun("<alias>")` by the agent's input and output shapes.
 
 ---
 

package/docs/data_fetching.md

@@ -11,8 +11,8 @@ alias** (bound with `set_app_queries`) and fills the template's declared `{{para
 value holes; the server holds the canonical AST and runs it under the **app owner's** authority
 ([./security.md](./security.md)). The generated `.lotics/app_queries.d.ts` augments `AppQueries`,
 so params are typed per the binding; an alias it does not carry is accepted as a plain string,
-untyped. It is written from the app's live bindings by `lotics app create --custom` and
-`lotics app deploy`. Every hook reads through the SDK's own cache, over the host RPC bridge.
+untyped. It is written from the app's live bindings by `lotics app deploy` and
+`lotics app pull`. Every hook reads through the SDK's own cache, over the host RPC bridge.
 
 ## Choosing a read
 

package/docs/members_and_options.md

@@ -194,10 +194,10 @@ three gates are observable as an `error` on the hook:
    resolves to `{ members: [] }`.
 
 Name the group by the `grp_…` id the workflow input's `group` declares — the binding below, set
-with `set_app_workflow`:
+with `set_workflow`:
 
 ```jsonc
-// set_app_workflow — the declaration that unlocks useMembers
+// the header of a set_workflow source — the declaration that unlocks useMembers
 {
   "alias": "assignOrder",
   "inputs": {

package/docs/mutations.md

@@ -24,7 +24,7 @@ const result = await createOrder({ customer_id, quantity: 3 });
   against the alias's declared input schema, and executes the workflow under the **app
   owner's** authority (never the viewer's — see [security](./security.md) for attribution,
   privilege gates, and public-app semantics).
-- Binding is server-side and live: `set_app_workflow` binds an alias as a new version of the app,
+- Binding is server-side and live: `set_workflow` binds an alias as a new version of the app,
   and a deploy never touches it. The declaration also types `useWorkflow` (below).
 - Invoking an alias that is not bound resolves with `status: "error"` and a message naming
   the missing binding.
@@ -41,7 +41,7 @@ render: one callable per alias, each run exactly as `useWorkflow`'s.
 
 Typing comes from `.lotics/app_workflows.d.ts`, which augments the SDK's `AppWorkflows` and
 `AppWorkflowResults` interfaces from the app's bound declarations. The declarations are generated from the app's live bindings into `.lotics/` by
-`lotics app create --custom` and `lotics app deploy`. The result:
+`lotics app deploy` and `lotics app pull`. The result:
 
 | Declaration | Call-site type |
 |---|---|
@@ -170,7 +170,7 @@ envelope's grammar — `message` is required, `field_errors` never reaches the a
 
 - **Typed for free — persisted at `set`.** The alias's `outputs` schema is derived at save
   time from the inferred type of the body's `return({ data })`. When the binding declares
-  **no** `outputs`, `set_app_workflow` stores the derived schema as the alias's `outputs`. An
+  **no** `outputs`, `set_workflow` stores the derived schema as the alias's `outputs`. An
   **explicitly declared** `outputs` is authoritative and never overwritten;
   declare one only to narrow beyond what's inferred. A shape the checker can't pin down degrades
   to untyped `json`, never to a wrong schema.
@@ -214,7 +214,7 @@ if (r.status === "success" && r.data) {
 An alias's declaration is `{ inputs?, outputs?, workflow_id? }` — `workflow_id` is the server's
 half, stamped by the first bind, so an alias an author has only just written carries none.
 `inputs` maps each input name to a typed declaration; it is authored beside the body and
-travels with it (`set_app_workflow` takes both), and the schema the body was verified against is
+travels with it (`set_workflow` takes both), and the schema the body was verified against is
 canonical. It drives three things at once: compile-time typing of the `useWorkflow` payload,
 compile-time typing of `trigger.app_workflow.inputs.*` inside the body, and runtime payload
 validation at the execute boundary.
@@ -283,7 +283,7 @@ When the alias declares `inputs`, the server validates the payload before the wo
   added after authoring is accepted, a removed one rejected
   (`select input "<path>" value "<v>" is not one of its current options (<label>=<value>, …)`) with no
   redeploy. A `field` that doesn't exist or names a non-select field is rejected at bind time
-  (`set_app_workflow`) with
+  (`set_workflow`) with
   `select input references field "<key>", which does not exist in this workspace` /
   `… which is a <type> field, not a select`. Prefer `field` for any select backed by a real
   field; keep `options` for a fixed enum the app owns. Populate pickers from `useFieldOptions`
@@ -460,7 +460,7 @@ return({ status: "success", message: "Updated." });
 ```
 
 `update_records` has no bypass flag — a locked record's values change only through the
-approval flow below (or the table's owner or an admin explicitly unlocking the record first; `unlock_records` is
+approval flow below (or the table's owner or an admin explicitly unlocking the record first; `update_records` with `locked: false` is
 owner- or admin-gated — in an app's run, judged as the member who pressed, never the app's owner — so don't build an unlock→edit→relock workflow around the approval flow — the
 lock exists to route changes through review).
 
@@ -553,7 +553,7 @@ What the steps cannot tell before they run is never guessed:
   looks for a row to reuse draws nothing until the server says which it did. A `catch` block and a
   `while` or counted `for` loop wait too.
 - A pause (`wait`, `wait_for_event`, `wait_for_approval`): every write after it waits for the answer.
-- A step that changes rows it cannot draw — `lock_records`, `restore_records`, a pressed button, an
+- A step that changes rows it cannot draw — `lock_records`, `update_records` with `restore` or `locked`, a pressed button, an
   agent whose tools can change rows, a `create_records` matching on a field, a filtered update or
   delete: every read over the tables it may touch (every read, where it names none) is `pending`
   until the answer lands.

package/docs/recipes.md

@@ -121,11 +121,7 @@ Two **separate** layers; set both.
 
 **Launcher chrome** — `lotics run set_app '{"app_id":"…","body":{"icon":"truck","color":"blue"}}'`.
 `icon` is any Lucide name (the full library, validated at write time — a wrong name is rejected, not
-silently boxed). Don't guess the kebab spelling:
-
-```
-lotics run search_app_icons '{"query":"shipping"}'   → ["truck","ship","package",…]
-```
+silently boxed). Don't guess the kebab spelling: a wrong name is refused with the nearest Lucide names.
 
 `color` is a named palette colour: `red orange amber yellow lime green emerald teal cyan sky
 blue indigo violet purple fuchsia pink rose slate gray zinc neutral stone`. `null` in `body` clears

package/docs/runtime.md

@@ -18,7 +18,7 @@ mount(<App />);
 `dist/mount.d.ts`) is called **once** from the app's entry file. It:
 
 1. **Registers the mock fixture**, if `options.fixture` was passed (below).
-2. **Finds or creates `#root`.** Uses the `<div id="root">` from the scaffold's
+2. **Finds or creates `#root`.** Uses the `<div id="root">` from the app's
    `index.html`; if the bundler didn't ship one, it creates and appends it.
 3. **Installs visible error handlers.** `window` `error` and
    `unhandledrejection` listeners render a fixed red monospace banner (message +

package/docs/workflows.md

@@ -1,6 +1,6 @@
 # Workflows — the body-authoring reference
 
-The grammar of a **workflow body**: what `set_app_workflow` takes as an alias's `source`, the
+The grammar of a **workflow body**: what `set_workflow` takes as a `source` bound to an app's alias, the
 JS subset that is accepted, and the rules that decide whether a body saves.
 [mutations](./mutations.md) owns the *call* side; this document owns everything between the
 braces.
@@ -17,7 +17,7 @@ engine, no `eval`, no sandbox. Four consequences shape everything below:
 - **A successful save may still return `warnings[]`** — advisory lint that does not block.
   Read them; they are the failures that only show up in production.
 - **One canonical form per concept.** Several JS spellings are accepted and *lowered* to one
-  stored form. The stored tree renders back to source when it is read (`get_app_workflow`), so a
+  stored form. The stored tree renders back to source when it is read (`get_workflow`), so a
   read body shows the canonical spelling, not the sugar you typed (see *Round-tripping* below).
 - **Opaque keys, never display names.** Fields are `fld_*`, select options are `opt_*`, tables
   are `tbl_*`, groups are `grp_*`. A display name is rejected at save with an error pointing at
@@ -31,10 +31,10 @@ if (order.data["fld_status"] == "opt_open") { … }
 
 ## Where a body lives
 
-A body is the app's, stored on the server and bound to an alias: `set_app_workflow` takes the
-alias, the body's `source`, and the alias's `inputs` (leave `outputs` off to let the body's
-`return({ data })` derive it). The server verifies the body and the write lands live, as a new
-version of the app; `get_app_workflow` reads it back, and an earlier body is restored by writing it again. Input declaration vocabulary and validation:
+A body is the app's, stored on the server and bound to an alias: `set_workflow` takes a
+`source` whose `on({ type: "app", app_id, alias, inputs?, outputs? })` header names the alias and its `inputs`
+(leave `outputs` off to let the body's `return({ data })` derive it), then the body. The server verifies the body and the write lands live, as a new
+version of the app; `get_workflow` reads it back, and an earlier body is restored by writing it again. Input declaration vocabulary and validation:
 [mutations](./mutations.md#declaring-workflow-inputs).
 
 An app workflow body carries **no trigger declaration** — the binding supplies the trigger
@@ -250,7 +250,7 @@ only the dialog. What it may name depends on who renders the refusal:
 
 An app workflow whose alias declares no inputs leaves input-shaped keys unchecked, so a body can
 be written before its declaration. A key outside its row is refused when the body is SAVED — by
-`set_app_workflow`, by an agent binding one — and by a `verify_only` call before that. `return({ field_errors })` keys are not checked.
+`set_workflow`, by an agent binding one — and by a `dry_run` call before that. `return({ field_errors })` keys are not checked.
 
 ### `wait_for_approval` — the one wait worth binding
 
@@ -460,7 +460,7 @@ A single-expression helper, **top level only**, inlined at every call site.
   value: `lineTotal({ qty: 1, price: 2 })` is rejected because inlining would splice a path onto
   an object literal. Bind it first (`const l = { … };` then `lineTotal(l)`), or pass a row.
 
-**A declared `function` does not survive a read.** Inlining erases it: `get_app_workflow` returns
+**A declared `function` does not survive a read.** Inlining erases it: `get_workflow` returns
 the body repeated at each call site and no `function` at all. Reach for one when the *saved* logic
 is what matters, and expect to re-extract it if you edit the source read back.
 
@@ -834,7 +834,7 @@ genuinely recursive.
 
 ## The check loop
 
-`set_app_workflow` with `verify_only: true` gives the verdict a save would, and writes nothing. The
+`set_workflow` with `dry_run: true` gives the verdict a save would, and writes nothing. The
 server runs every check a save runs — the subset parse, the type pass against the alias's
 declared inputs, tool and kwarg resolution, field, option, table and group resolution, `switch`
 case validation, the literal `formatDate` probe, waits in loops, table reach, the `field_key` rule and the published-API guard. **Green means the save will take
@@ -849,8 +849,8 @@ fix-stating messages before you see them.
 
 `check` and `set` prove parse, types, name resolution, structure, and lint — **none of them
 evaluates an expression**. A body that saves clean can still take the wrong branch, hand a tool a filter it
-rejects, or read a path that is null on real data. The rehearsal for that is `set_app_workflow` with
-`verify_only: true` and a `record_id` (the row an Act would run on) or `preview_inputs` (the values of a
+rejects, or read a path that is null on real data. The rehearsal for that is `set_workflow` with
+`dry_run: true` and a `record_id` (the row an Act would run on) or `preview_inputs` (the values of a
 workflow that takes inputs and no row): the draft is walked by the engine an Act's preview uses, under the
 app's authority, with the production expression evaluator. Reads are real; writes and service sends are
 said, not made, and a document a step renders is made as a paper no listing shows. It answers `preview`
@@ -865,7 +865,7 @@ A workflow that files a recording ([mutations](./mutations.md#recording-into-a-w
 declares the platform's `recording` input in exactly this shape, beside its own inputs:
 
 ```jsonc
-// set_app_workflow { "alias": "log_visit", "inputs": … }
+// the header of a set_workflow source: on({ type: "app", app_id, alias: "log_visit", inputs: … })
 "inputs": {
   "site": { "type": "record_link", "table_id": "tbl_sites" },
   "recording": { "type": "object", "fields": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/app-sdk",
-  "version": "0.124.8",
+  "version": "0.124.10",
   "description": "The SDK a Lotics custom-code app reads and writes through — typed hooks over the host bridge, cell readers, mount() and AppRouter",
   "type": "module",
   "exports": {
@@ -26,11 +26,11 @@
     "build": "tsgo -p tsconfig.build.json && node scripts/build_sdk.mjs",
     "lint": "oxlint",
     "test": "vitest run",
-    "typecheck": "tsgo --noEmit",
+    "typecheck": "tsrs --noEmit",
     "prepack": "npm run build"
   },
   "dependencies": {
-    "ai": "^7.0.30"
+    "ai": "^7.0.152"
   },
   "peerDependencies": {
     "react": "^19.2.0",
@@ -39,17 +39,19 @@
   },
   "devDependencies": {
     "@lotics/shared": "*",
-    "@testing-library/react": "^16.3.0",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "~19.2.2",
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "^24.19.2",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "~19.3.0",
+    "@typescript/native-preview": "^7.0.0-dev.20260707.2",
     "@vitejs/plugin-react": "^6.1.2",
-    "esbuild": "^0.28.1",
-    "jsdom": "^30.1.2",
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0",
-    "react-router": "^7.18.2",
+    "esbuild": "^0.28.2",
+    "jsdom": "^30.1.3",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
+    "react-router": "^8.5.0",
     "typescript": "~6.0.3",
-    "vite": "^8.3.4"
+    "vite": "^8.3.5"
   },
   "engines": {
     "node": ">=18"