@lotics/app-sdk 0.125.9 → 0.126.1

package/AGENTS.md

@@ -20,11 +20,11 @@ This file is the index. The **exact type** of anything is its shipped declaratio
 | [docs/workflows.md](./docs/workflows.md) | **The workflow-BODY reference** — the JS subset a body may use, opaque `fld_*`/`opt_*` keys, every step form, the accepted sugar, helpers, record-write surfaces, the traps and the verify loop. |
 | [docs/recipes.md](./docs/recipes.md) | Task-shaped how-tos — returning a generated file, returning structured data, parameterized lookups, composable optional filters, cell decoding, testing an AI action without spending credits. |
 | [docs/files.md](./docs/files.md) | Files end to end — `useFileUpload` and its `fidelity` and a photo's `place`, `renameFile` (a new file over the same bytes), `useAttachments`/`useAttachmentPiles`, `readFiles` and presigned URLs (a bearer credential — never logged or persisted), workflow-generated files, naming a zip's entries, the delivery bounds. |
-| [docs/members_and_options.md](./docs/members_and_options.md) | People, select options and comments — `useMembers`, `useFieldOptions`, `useViewer`, `useWorkspaceTimezone`/`useWorkspaceCurrency`, `useAppContext`, the workspace's zone at the root, `useComments`, a member's links to one record for a person with no seat (`useOutsideLinks`). |
+| [docs/members_and_options.md](./docs/members_and_options.md) | People and select options — `useMembers`, `useFieldOptions`, `useViewer`, `useWorkspaceTimezone`/`useWorkspaceCurrency`, `useAppContext`, the workspace's zone at the root, a member's links to one record for a person with no seat (`useOutsideLinks`). |
 | [docs/navigation_and_state.md](./docs/navigation_and_state.md) | `AppRouter` (embedded/standalone URL model, the screens and `drawers` it reports to the host), `useUrlState` + `urlParam` codecs, `useRecents`, `useFolderPick`. |
 | [docs/ai.md](./docs/ai.md) | `useAgentRun` (structured vs free-text, streaming parts, the agent's ask-back), `askAi`, `useAiContext`, and what the member's own chat agent can do with the app while it is open. |
 | [docs/security.md](./docs/security.md) | **Read before shipping** — the owner-principal model, `is_current_member` scoping, write attribution, group gates, public-app bounds, why a per-input bound is a tenancy floor rather than an authorization check. |
-| [docs/runtime.md](./docs/runtime.md) | `mount()` and the errors it reports to the host (`reportAppError`), the two transports, the API address a standalone bundle reads out of its own page (`<meta name="lotics-api-base">`), `rpc()` and `installRpcTransport` (a page that is never an app's answers every op itself), the mock harness (`fixture` + `?__mock=1` — queries, workflows and agents, a mocked agent's run played line by line), `openExternal`/`openApp`/`peekApp`/`downloadFile`, geofencing, the peer dependencies. |
+| [docs/runtime.md](./docs/runtime.md) | `mount()` and the errors it reports to the host (`reportAppError`), the two transports, the API address a standalone bundle reads out of its own page (`<meta name="lotics-api-base">`), `rpc()` and `installRpcTransport` (a page that is never an app's answers every op itself), the mock harness (`fixture` + `?__mock=1` — queries, workflows and agents, a mocked agent's run played line by line), `openExternal`/`downloadFile`, geofencing, the peer dependencies. |
 
 ## Non-negotiables (each detailed in its doc)
 

package/dist/{chunk-2KJSE73G.js → chunk-GACWCLEV.js}

@@ -154,6 +154,17 @@ function paramsEqual(a, b) {
   return true;
 }
 
+// ../shared/src/openable_url.ts
+var OPENABLE_PROTOCOLS = /* @__PURE__ */ new Set(["https:", "http:", "tel:", "mailto:"]);
+function openableUrl(url) {
+  if (!URL.canParse(url)) return void 0;
+  const parsed = new URL(url);
+  return OPENABLE_PROTOCOLS.has(parsed.protocol) ? parsed : void 0;
+}
+function openTarget(address) {
+  return address.protocol === "http:" || address.protocol === "https:" ? "_blank" : "_self";
+}
+
 // ../shared/src/app_host/api_base_meta.ts
 var API_BASE_META_NAME = "lotics-api-base";
 
@@ -1794,14 +1805,6 @@ function rpcStandalone(op, payload) {
       return standalonePredictionMiss(payload);
     case "openExternal":
       return standaloneOpenExternal(payload);
-    case "peekApp":
-      return Promise.reject(
-        new Error("peekApp needs the Lotics host: a standalone app has no sibling apps to open. Gate the control on isEmbedded().")
-      );
-    case "openApp":
-      return Promise.reject(
-        new Error("openApp needs the Lotics host: a standalone app has no sibling apps to open. Gate the control on isEmbedded().")
-      );
     case "askAi":
       return Promise.reject(new Error("askAi is only available when the app runs inside Lotics"));
     case "urlState.get":
@@ -1870,11 +1873,9 @@ async function standaloneMembers(p) {
 }
 function openValidatedUrl(url) {
   if (typeof url !== "string") throw new Error("openExternal requires a url string");
-  const parsed = new URL(url);
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    throw new Error(`openExternal: unsupported URL scheme "${parsed.protocol}"`);
-  }
-  window.open(parsed.href, "_blank", "noopener,noreferrer");
+  const address = openableUrl(url);
+  if (address === void 0) throw new Error(`openExternal: unsupported URL scheme "${url.split(":", 1)[0]}"`);
+  window.open(address.href, openTarget(address), "noopener,noreferrer");
 }
 async function standaloneOpenExternal(p) {
   openValidatedUrl(p.url);

package/dist/index.d.ts

@@ -25,7 +25,6 @@ export type { GeofenceZone, GeoCoords, GeofenceOutcome, GeofenceOptions } from "
 export { rpc, hostSpec, isEmbedded, installRpcTransport } from "./rpc.js";
 export type { RpcOp, RpcTransport, HostSpec, AiContextValue, AiContextRecordRef } from "./rpc.js";
 export { openExternal } from "./open_external.js";
-export { openApp, peekApp } from "./open_app.js";
 export { askAi, type AskAiArgs } from "./ask_ai.js";
 export { downloadFile } from "./download.js";
 export { renameFile } from "./rename_file.js";

package/dist/index.js

@@ -51,7 +51,7 @@ import {
   subtractDecimal,
   sumDecimal,
   urlParam
-} from "./chunk-2KJSE73G.js";
+} from "./chunk-GACWCLEV.js";
 
 // src/mount.tsx
 import { createRoot } from "react-dom/client";
@@ -8298,6 +8298,7 @@ var MEMBER_OF = "member_of";
 var CURRENT_MEMBER_STANDS_IN_FOR = "current_member_stands_in_for";
 var CURRENT_MEMBER_STANDS_IN_FOR_ANY_GROUP = "current_member_stands_in_for_any_group";
 var CHANGED_OUTSIDE = "changed_outside";
+var OPTION = "option";
 var INLINE_HELPERS = [
   "formatCurrency",
   "randomNumber",
@@ -8315,6 +8316,7 @@ var INLINE_HELPERS = [
   "row_rule_bypassed"
 ];
 var PARSED_ONLY_HELPERS = [CHANGED_OUTSIDE];
+var SAVE_RESOLVED_HELPERS = [OPTION];
 var HELPERS = /* @__PURE__ */ new Set([
   ...Object.keys(expression_array_exports),
   ...Object.keys(expression_string_exports),
@@ -8324,7 +8326,8 @@ var HELPERS = /* @__PURE__ */ new Set([
   ...Object.keys(jsFunctions),
   ...Object.keys(getDateExpressionFunctions()),
   ...INLINE_HELPERS,
-  ...PARSED_ONLY_HELPERS
+  ...PARSED_ONLY_HELPERS,
+  ...SAVE_RESOLVED_HELPERS
 ]);
 function isHelper(name) {
   return HELPERS.has(name);
@@ -10203,10 +10206,8 @@ function useAppContext() {
     insider: data !== void 0 && data.member_id !== null && data.group_ids !== void 0,
     groupIds: data?.group_ids ?? null,
     absences: data?.absences ?? null,
-    openableApps: data?.openable_apps ?? null,
     commentsEnabled: data?.comments_enabled ?? false,
     recordingEnabled: data?.recording_enabled === true,
-    peekAppEnabled: data?.peek_app_enabled === true,
     hostNamesApp: data?.host_names_app === true,
     timezone: data?.timezone,
     currency: data?.default_currency,
@@ -12781,6 +12782,41 @@ function pickedFirst(a, b) {
   return a.id < b.id ? 1 : a.id > b.id ? -1 : 0;
 }
 
+// ../shared/src/query_column_types.ts
+var QUERY_COLUMN_TYPES = [
+  "text",
+  "number",
+  "boolean",
+  "date",
+  "datetime",
+  "select",
+  "select_record_link",
+  "select_member",
+  "files",
+  "text_list",
+  "number_list",
+  "boolean_list",
+  "date_list",
+  "datetime_list",
+  "json"
+];
+var LIST_ELEMENT_COLUMN_TYPE = {
+  text_list: "text",
+  number_list: "number",
+  boolean_list: "boolean",
+  date_list: "date",
+  datetime_list: "datetime"
+};
+var SCALAR_LIST_COLUMN_TYPES = QUERY_COLUMN_TYPES.filter(
+  (type) => type in LIST_ELEMENT_COLUMN_TYPE
+);
+function listColumnTypeOf(element) {
+  return SCALAR_LIST_COLUMN_TYPES.find((type) => LIST_ELEMENT_COLUMN_TYPE[type] === element);
+}
+function isScalarListColumnType(type) {
+  return SCALAR_LIST_COLUMN_TYPES.some((one) => one === type);
+}
+
 // ../shared/src/field_column_type.ts
 function fieldTypeToColumnType(field) {
   switch (field.type) {
@@ -12817,6 +12853,10 @@ function fieldTypeToColumnType(field) {
     }
   }
 }
+function fieldValueColumnType(field) {
+  const type = fieldTypeToColumnType(field);
+  return isScalarListColumnType(type) ? LIST_ELEMENT_COLUMN_TYPE[type] : type;
+}
 function formulaOutputType(field) {
   switch (field.formula.output_type) {
     case "number":
@@ -12840,6 +12880,10 @@ function rollupColumnType(field) {
   return field.aggregate_field_format === "datetime" || field.aggregate_field_format === "datetime_range" ? "datetime" : "date";
 }
 function lookupOutputType(field) {
+  const element = lookupElementType(field);
+  return field.lookup_field_several === true ? listColumnTypeOf(element) ?? element : element;
+}
+function lookupElementType(field) {
   const t = field.lookup_field_type;
   if (!t) return "json";
   switch (t) {
@@ -12897,7 +12941,8 @@ function fieldValueInfo(field) {
         type: field.lookup_field_type ?? "text",
         ...field.lookup_field_type === "number" ? { notation: fieldNotation(field) } : { format: field.lookup_field_format },
         options: field.lookup_field_options,
-        autonumber: field.lookup_field_autonumber
+        autonumber: field.lookup_field_autonumber,
+        several: field.lookup_field_several
       };
     // The cell stores the composed DISPLAY string ("KH-001"), never the counter.
     case "autonumber":
@@ -12975,7 +13020,7 @@ function termsOf(cell, field) {
   const value = field.type === "lookup" && Array.isArray(cell) ? cell[0] : cell;
   if (fieldValueInfo(field).autonumber === true) return autonumberTerms(value);
   const options = effectiveSelectOptions(field);
-  return [options === null ? valueRank(value, fieldTypeToColumnType(field)) : optionRank(value, options)];
+  return [options === null ? valueRank(value, fieldValueColumnType(field)) : optionRank(value, options)];
 }
 function rankText(rank) {
   if (rank.by === "name") return folded(rank.value.name);
@@ -14643,14 +14688,6 @@ function openExternal(url) {
   return rpc("openExternal", { url });
 }
 
-// src/open_app.ts
-function openApp(appId, route = "/") {
-  return rpc("openApp", { app_id: appId, route });
-}
-function peekApp(appId, route = "/") {
-  return rpc("peekApp", { app_id: appId, route });
-}
-
 // src/ask_ai.ts
 function askAi(args) {
   const hasPayload = (args.prompt ?? "") !== "" || (args.file_ids?.length ?? 0) > 0 || (args.record_ids?.length ?? 0) > 0 || (args.context ?? "") !== "";
@@ -14821,9 +14858,7 @@ export {
   isWithinZone,
   mount,
   newRecordId,
-  openApp,
   openExternal,
-  peekApp,
   queryAll,
   readCreatedAt,
   readFiles,

package/dist/open_external.d.ts

@@ -1,6 +1,6 @@
 /**
  * Open a URL in a new tab — the sandboxed iframe drops a direct `window.open`.
- * Only `http`/`https`; anything else rejects.
+ * Only the web, `tel:` and `mailto:`; anything else rejects.
  *
  * ```tsx
  * import { openExternal } from "@lotics/app-sdk";

package/dist/router.d.ts

@@ -4,6 +4,10 @@ export interface NotFoundWords {
     message: (path: string) => string;
     firstScreen: string;
 }
+export declare function NotFoundScreen({ home, words }: {
+    home: string;
+    words: NotFoundWords;
+}): import("react").JSX.Element;
 export declare function AppRouter({ routes, notFound, drawers, }: {
     routes: RouteObject[];
     notFound?: NotFoundWords;

package/dist/router.js

@@ -2,7 +2,7 @@ import {
   isEmbedded,
   postHostNotification,
   setUrlParams
-} from "./chunk-2KJSE73G.js";
+} from "./chunk-GACWCLEV.js";
 
 // src/router.tsx
 import { useEffect } from "react";
@@ -22,10 +22,18 @@ function screenHref(loc) {
   const qs = search.toString();
   return loc.pathname + (qs ? `?${qs}` : "") + loc.hash;
 }
+function shapeStatedBy(route, pathname) {
+  const { handle } = route;
+  if (typeof handle !== "object" || handle === null || !("shape" in handle) || typeof handle.shape !== "function") return void 0;
+  const shape = Reflect.apply(handle.shape, handle, [pathname]);
+  return typeof shape === "string" ? shape : void 0;
+}
 function routePattern(matches, pathname) {
   const concrete = pathname.split("/").filter((segment) => segment !== "");
   let shape = [];
   for (const { route, params } of matches) {
+    const stated = shapeStatedBy(route, pathname);
+    if (stated !== void 0) return stated;
     const path = route.path ?? "";
     if (path.startsWith("/")) shape = [];
     for (const segment of path.split("/")) {
@@ -120,5 +128,6 @@ function AppRouter({
   ] });
 }
 export {
-  AppRouter
+  AppRouter,
+  NotFoundScreen
 };

package/dist/rpc.d.ts

@@ -1,20 +1,19 @@
 import type { AppAbsence } from "./shared_types.js";
-import type { SpecFile } from "./shared_types.js";
-import type { OpenableApp } from "./shared_types.js";
+import type { AppSpec } from "./shared_types.js";
 import type { AskUserChoiceOutput } from "./agent_stream.js";
 import { type UrlParams, type UrlParamsPatch } from "./url_params.js";
 /**
  * The app's RPC bridge. Bridged (`?lotics_host=` present): ops go over
  * postMessage and the host, holding the member's session, calls the API.
  * Standalone: the public `/v1/apps/{id}/*` endpoints are called directly, with
- * no credentials. The bridged wire must match `app_iframe_host.tsx`:
+ * no credentials. The bridged wire must match `app_frame.tsx`:
  *   app  → host: { id, op, payload }, the first also carrying `reportsDrawn: true` and `load` (`AppLoadTiming`) when
  *                the browser states any
  *   app  → host: { type: "drawn" }, once, after the first answer when no request has been in flight for two frames:
  *                the app's first screen has its data
  *   host → app:  { id, type: "result", data } | { id, type: "error", message }
  */
-export type RpcOp = "query" | "export" | "field_options" | "workflow" | "agentRuns" | "agentRun.get" | "agentRun.cancel" | "upload" | "file.rename" | "members" | "context" | "spec" | "write_model" | "prediction_miss" | "openExternal" | "openApp" | "peekApp" | "askAi" | "urlState.get" | "urlState.set" | "folder.get" | "folder.set" | "comments.list" | "comments.create" | "comments.update" | "comments.delete" | "comments.counts" | "recording.start" | "recording.stop" | "outsideLink.list" | "outsideLink.create" | "outsideLink.revoke";
+export type RpcOp = "query" | "export" | "field_options" | "workflow" | "agentRuns" | "agentRun.get" | "agentRun.cancel" | "upload" | "file.rename" | "members" | "context" | "spec" | "write_model" | "prediction_miss" | "openExternal" | "askAi" | "urlState.get" | "urlState.set" | "folder.get" | "folder.set" | "comments.list" | "comments.create" | "comments.update" | "comments.delete" | "comments.counts" | "recording.start" | "recording.stop" | "outsideLink.list" | "outsideLink.create" | "outsideLink.revoke";
 export interface AgentRunPayload {
     alias: string;
     session_id: string;
@@ -77,8 +76,6 @@ export interface AppContext {
     /** True only from a host with `recording.*`, for a signed-in member, on an
      *  instance that transcribes; absent reads as false. */
     recording_enabled?: boolean;
-    /** True only from a host that serves `peekApp`; absent reads as false. */
-    peek_app_enabled?: boolean;
     /** True only from a host whose own chrome names the app on screen; absent reads as false. */
     host_names_app?: boolean;
     /** This app's recordings the host still tracks, by alias. */
@@ -86,10 +83,6 @@ export interface AppContext {
     /** Who in the organization is away, or will be, and who stands in — absent from an older host and for a visitor from
      *  outside the organization. */
     absences?: AppAbsence[];
-    /** The apps of the workspace the viewer can open, each by its id and its name, the table its register lists
-     *  (`table_id`) and each of its logs (`logs`) where the host says — absent from an older host, for a visitor and until
-     *  the host has listed them. */
-    openable_apps?: OpenableApp[];
 }
 /** Whether a Lotics host embeds the app, rather than it standing alone on its own origin. */
 export declare function isEmbedded(): boolean;
@@ -102,7 +95,7 @@ export type RpcTransport = (op: RpcOp, payload: unknown) => Promise<unknown>;
  *  last install wins, and a page installs its own before it mounts. */
 export declare function installRpcTransport(transport: RpcTransport): void;
 /** What the host answers `spec`: the app's compiled spec itself, never the route's wrapper around it. */
-export type HostSpec = SpecFile;
+export type HostSpec = AppSpec;
 /** The app's spec, as the host hands it over the bridge. */
 export declare function hostSpec(): Promise<HostSpec>;
 export declare function rpc<T = unknown>(op: RpcOp, payload: unknown): Promise<T>;