@lotics/app-sdk 0.77.4 → 0.79.0

package/dist/src/analytics.d.ts

@@ -1,7 +1 @@
-/**
- * Capture an app event. Buffers until PostHog is ready, then emits directly;
- * no-ops permanently once tracking is known to be off, so the hooks can call it
- * unconditionally.
- */
-export declare function captureAppEvent(event: string, props?: Record<string, unknown>): void;
 export declare function bootstrapAnalytics(): Promise<void>;

package/dist/src/analytics.js

@@ -9,12 +9,20 @@
  * values — and Điều 3.2 of the service contract warrants that our telemetry
  * carries no record or document content. The flags below are what enforce
  * that; the project-level setting is NOT a backstop, since it is server-side
- * and fails open when the config fetch fails. The SDK emits explicit events
- * for genuine user actions only: `app_opened`, `app_file_uploaded`, and
- * `app_comment_*`. System signals — data-read mechanics (a `useQuery` refetch)
- * and workflow/agent run outcomes — are not events: the backend already logs
- * and persists every run (`workflow_executions`, `app_agent_runs`), so a client
- * event would be redundant system telemetry, not a gesture.
+ * and fails open when the config fetch fails.
+ *
+ * **What earns an event:** who KNOWS the fact. An effect the platform performs
+ * or persists is the platform's — a comment, an upload, a workflow or agent run
+ * all leave rows, and a client copy would duplicate one AND keep arriving from
+ * apps pinned to an old SDK long after the code is deleted. A FAILURE is not a
+ * gesture either; it is system telemetry, and this bundle has no log sink to
+ * carry it, so it is not an event here by default.
+ *
+ * That leaves exactly one: `app_opened`. Apps are a separate origin the
+ * product's own analytics cannot see, and the app-host gate log records gate
+ * DECISIONS rather than routine serves, so nothing else counts an app being
+ * used. Everything a run does is already in `app_agent_runs` — including a
+ * user's Stop, which stamps `cancel_requested_at`.
  *
  * Every event is tagged with app identity and rolls up under the existing
  * `organization` group; embedded apps `identify` the member the host passes
@@ -33,34 +41,6 @@ import { hasMockFlag } from "./mock.js";
 const POSTHOG_KEY = "phc_N1nyqSRdo9XMK3DODxrxX2Y9jG3dppybruOuMznbz62";
 const POSTHOG_HOST = "https://us.i.posthog.com";
 const APP_HOST_SUFFIX = ".lotics.app";
-let loaded = false;
-let disabled = false;
-/**
- * Events fired before init completes (a hook can settle during the `context`
- * round-trip). Drained on init; capped so a never-initializing session can't
- * grow it unbounded.
- */
-const preInitQueue = [];
-const MAX_QUEUE = 100;
-function disable() {
-    disabled = true;
-    preInitQueue.length = 0;
-}
-/**
- * Capture an app event. Buffers until PostHog is ready, then emits directly;
- * no-ops permanently once tracking is known to be off, so the hooks can call it
- * unconditionally.
- */
-export function captureAppEvent(event, props) {
-    if (disabled)
-        return;
-    if (loaded) {
-        posthog.capture(event, props);
-        return;
-    }
-    if (preInitQueue.length < MAX_QUEUE)
-        preInitQueue.push({ event, props });
-}
 function onDeployedAppHost() {
     try {
         return window.location.hostname.endsWith(APP_HOST_SUFFIX);
@@ -73,17 +53,14 @@ export async function bootstrapAnalytics() {
     // Only the deployed app host tracks: a design-time/screenshot load
     // (?__mock=1) and `lotics app dev` (localhost) emit nothing. This replaces
     // the old "no key off-prod" gate now that the key is hardcoded.
-    if (hasMockFlag() || !onDeployedAppHost()) {
-        disable();
+    if (hasMockFlag() || !onDeployedAppHost())
         return;
-    }
     let ctx;
     try {
         ctx = await rpc("context", {});
     }
     catch {
         // Best-effort: a context-resolution failure must never break the app.
-        disable();
         return;
     }
     posthog.init(POSTHOG_KEY, {
@@ -113,9 +90,12 @@ export async function bootstrapAnalytics() {
         // Tag + capture from `loaded` (once PostHog has initialized) — the robust
         // point to register super-properties and emit the first event.
         loaded: (ph) => {
+            // Ids only. A super-property rides every event and every `$exception`
+            // the session sends, and an app's NAME is the customer's own words —
+            // routinely a counterparty — which Điều 3.2 keeps out of telemetry. The
+            // id resolves to the name for anyone entitled to it.
             ph.register({
                 app_id: ctx.app_id,
-                app_name: ctx.app_name,
                 workspace_id: ctx.workspace_id,
                 organization_id: ctx.organization_id,
             });
@@ -127,10 +107,7 @@ export async function bootstrapAnalytics() {
             // visitors stay anonymous (member_id null).
             if (ctx.member_id)
                 ph.identify(ctx.member_id);
-            loaded = true;
             ph.capture("app_opened");
-            for (const e of preInitQueue.splice(0))
-                ph.capture(e.event, e.props);
         },
     });
 }

package/dist/src/comments.js

@@ -25,7 +25,6 @@
 import { useCallback } from "react";
 import useSWR from "swr";
 import { rpc } from "./rpc.js";
-import { captureAppEvent } from "./analytics.js";
 import { useAppContext } from "./viewer.js";
 /** The reduced storage shape the update endpoint accepts for `files`. */
 function toStorageFiles(files) {
@@ -101,7 +100,6 @@ export function useComments(args) {
             revalidate: false,
             populateCache: true,
         });
-        captureAppEvent("app_comment_created", { has_files: fileIds.length > 0 });
     }, [available, memberId, record_id, swr]);
     const updateComment = useCallback(async (id, input) => {
         if (!available)
@@ -129,7 +127,6 @@ export function useComments(args) {
             revalidate: false,
             populateCache: true,
         });
-        captureAppEvent("app_comment_updated", {});
     }, [available, record_id, swr]);
     const deleteComment = useCallback(async (id) => {
         if (!available)
@@ -145,7 +142,6 @@ export function useComments(args) {
             revalidate: false,
             populateCache: true,
         });
-        captureAppEvent("app_comment_deleted", {});
     }, [available, record_id, swr]);
     return {
         comments,

package/dist/src/hooks.js

@@ -22,7 +22,6 @@ import useSWRInfinite from "swr/infinite";
 import { rpc, rpcAgentRun, rpcAgentRunContinue, postHostNotification, subscribeHostRefetch, } from "./rpc.js";
 import { initialAgentRunState, reduceAgentChunk, parseSseChunks, adoptSettledRun, pendingInteractiveCall, buildChoiceOutput, applyInteractiveAnswer, landingOf, proseOf, ABORTED, } from "./agent_stream.js";
 import { getMockRows, hasMockFlag } from "./mock.js";
-import { captureAppEvent } from "./analytics.js";
 export { buildChoiceOutput } from "./agent_stream.js";
 export function useWorkflow(alias) {
     return useCallback((inputs) => rpc("workflow", { alias, inputs: inputs ?? {} }), [alias]);
@@ -288,7 +287,6 @@ export function useFileUpload() {
         setError(null);
         try {
             const uploaded = await rpc("upload", { file, fidelity });
-            captureAppEvent("app_file_uploaded", { mime_type: file.type, fidelity });
             return uploaded;
         }
         catch (err) {
@@ -601,14 +599,6 @@ export function useAgentRun(alias) {
                         error: "The run was interrupted and its result could not be confirmed. Run it again.",
                     };
                 safeSetState(acc);
-                // Fleet visibility: how often edges cut agent SSE streams. One
-                // event per truncation, with whether the row rescued the result.
-                captureAppEvent("app_agent_stream_truncated", {
-                    kind: "clean_end",
-                    recovered: settled != null,
-                    settled_status: settled?.status ?? null,
-                    has_output: acc.output !== undefined,
-                });
             }
             return landingOf(acc);
         })
@@ -635,16 +625,6 @@ export function useAgentRun(alias) {
                     acc = adoptGuarded(acc, settled);
                     safeSetState(acc);
                 }
-                // The same fleet-visibility beacon as the clean-end path — a dropped
-                // connection is the OTHER way a stream dies mid-run, and it was
-                // previously invisible (the beacon fired only on clean-end
-                // truncations, undercounting every network-error cut).
-                captureAppEvent("app_agent_stream_truncated", {
-                    kind: "connection_error",
-                    recovered: settled != null,
-                    settled_status: settled?.status ?? null,
-                    has_output: acc.output !== undefined,
-                });
                 if (settled)
                     return landingOf(acc);
             }
@@ -663,7 +643,6 @@ export function useAgentRun(alias) {
         // in-flight promise makes a double-click resolve with the first run's
         // result; `replace: true` is the explicit opt-in to abort-and-restart.
         if (inflightRef.current && !opts.replace) {
-            captureAppEvent("app_agent_run_deduped", { alias });
             return inflightRef.current;
         }
         handleRef.current?.abort();
@@ -710,6 +689,10 @@ export function useAgentRun(alias) {
     const abort = useCallback(() => handleRef.current?.abort(), []);
     const cancel = useCallback(() => {
         // Stop server-side too (saves tokens on an unwanted run), then locally.
+        // No analytics event here: the cancel RPC stamps `app_agent_runs
+        // .cancel_requested_at`, which is what separates a user's Stop from the
+        // unmount/tab-close that `abort` also serves — a client event would only
+        // duplicate a column, and would go stale the moment an app pins an old SDK.
         const runId = runIdRef.current;
         if (runId)
             void rpc("agentRun.cancel", { run_id: runId }).catch(() => { });

package/dist/src/members.d.ts

@@ -18,10 +18,24 @@
  * not tell which. That is why no register row ever rendered an avatar — the
  * data was absent and nothing said so.
  *
- * The private fields share ONE boundary, not three: an authenticated member of
- * the app's own org sees `email`, `image` and `groups`; an anonymous visitor to
- * a public app sees `id` and `name`. Absent ≠ empty — `image: null` means the
- * member has no photo, `image` MISSING means you were never told.
+ * It happened a second time, and the fix is the same: the roster returned
+ * neither `groups` nor `role` long after a resolved cell carried both, so an
+ * app reading `m.groups` off `useMembers()` got `undefined` and drew nothing.
+ * Read a field here and you may read it on either door.
+ *
+ * The private fields share ONE boundary, not four: an authenticated member of
+ * the app's own org sees `email`, `image`, `groups` and `role`; an anonymous
+ * visitor to a public app sees `id` and `name` (plus `archived`, which is not
+ * private — see the field). Absent ≠ empty — `image: null` means the member has
+ * no photo, `image` MISSING means you were never told, and `groups: []` means
+ * they are on no team while a missing `groups` means the same "not told". Never
+ * collapse the two: one is a fact about a colleague, the other is a fact about
+ * your own permissions.
+ *
+ * The one field the doors legitimately differ on is `archived`, and it is a
+ * difference of ROW SET rather than of shape: a resolved cell must keep naming
+ * whoever handled a record two years ago, while the roster answers "who may I
+ * assign?" and never offers a departed member at all.
  */
 export interface ResolvedMember {
     id: string;
@@ -40,6 +54,47 @@ export interface ResolvedMember {
      *  department field; a member group is what an org uses to say Sale, Kế toán,
      *  CSKH. `[]` when the member is in none. Omitted on public-app responses. */
     groups?: string[];
+    /**
+     * The member's ORGANIZATION role. Omitted on public-app responses, and also
+     * when the id did not resolve — there is no member to have a level.
+     *
+     * It arrives RAW, and it is your job to translate it: the platform ships no
+     * display word for it, because a server that picked one would leak English
+     * into every localized app. Map it yourself (`admin` → "Quản trị viên") next
+     * to the rest of your vocabulary.
+     *
+     * It is a PERMISSION level and not a job title. Everyone who reads "Admin"
+     * beside a name on a sales register will read it as rank; if the question
+     * your screen answers is "who is this person in the company", the answer is
+     * `groups`, not this.
+     */
+    role?: "owner" | "admin" | "member";
+    /**
+     * ISO timestamp of when this person joined the organization. Omitted on
+     * public-app responses, and when the id did not resolve — there is no
+     * membership to have begun.
+     *
+     * Render it at whatever precision your question needs; `@lotics/ui`'s
+     * `MemberProfileCard` shows month and year, because "is this the new person?"
+     * does not want a day.
+     */
+    joined?: string;
+    /**
+     * `true` when this person has LEFT the organization — omitted otherwise,
+     * never `false`, because it rides every cell of every row and current staff
+     * are the overwhelming case.
+     *
+     * It arrives on both audiences: a departed colleague reading as a current
+     * assignee is wrong on a public app too, and it discloses less than the name
+     * already beside it. Feed it to `inactive` on `MemberChip` /
+     * `MemberProfileCard` so a record that still names them reads as history
+     * rather than as a live assignment.
+     *
+     * You will not see it on the `useMembers` roster, and that is correct rather
+     * than missing: the roster answers "who may I ASSIGN?" and departed members
+     * are not candidates, so it never returns one.
+     */
+    archived?: true;
 }
 /**
  * Parse a `useQuery` cell value into `ResolvedMember[]`. Returns `[]` for

package/dist/src/members.js

@@ -41,6 +41,21 @@ export function readMembers(value) {
                 ? obj.groups.filter((g) => typeof g === "string")
                 : [];
         }
+        // A CLOSED enum, so an unrecognized value is dropped rather than passed
+        // through: the field's whole worth is that a caller can switch on it, and a
+        // server that grew a fourth role must not have apps rendering the raw word
+        // in a UI that has no translation for it.
+        if (obj.role === "owner" || obj.role === "admin" || obj.role === "member")
+            m.role = obj.role;
+        // A non-empty STRING or nothing: an empty date is not a date, and letting
+        // "" through would render an empty labelled row rather than no row.
+        if (typeof obj.joined === "string" && obj.joined !== "")
+            m.joined = obj.joined;
+        // The server sends this ONLY for a departed member and only as `true`, so
+        // the truthy test is the whole contract — there is no `false` to carry, and
+        // inventing one would put the key on every current member's cell.
+        if (obj.archived === true)
+            m.archived = true;
         out.push(m);
     }
     return out;

package/docs/ai.md

@@ -57,8 +57,8 @@ await recognize.run({ image_file_id: fileId }, { sessionId });
 
 | Member | Type | What it is |
 |---|---|---|
-| `run` | `(input, { sessionId, replace? }) => Promise<AgentRunLanding<TOutput>>` | Start a run. Streams progress into the hook's state and resolves with **how the leg ended** — `{kind:"settled", output?, text}`, `{kind:"parked"}`, `{kind:"failed", error}` or `{kind:"aborted"}`. Switch on `kind`; do NOT read the hook's state to tell them apart, because it has not committed when the promise resolves (that race closed dialogs over live, answerable runs). A run failure is DATA here, so no try/catch is needed for it. **Single-flight:** while a run is in flight, calling it again returns the in-flight run's promise — an accidental double-press joins the first run instead of billing a second one (each dedup emits the `app_agent_run_deduped` analytics event). Pass `replace: true` to deliberately abort-and-restart; the replaced run still executes and bills server-side |
-| `cancel` | `() => void` | Stop the run **server-side** (saves tokens) and locally. Wire a user-facing Stop button to this |
+| `run` | `(input, { sessionId, replace? }) => Promise<AgentRunLanding<TOutput>>` | Start a run. Streams progress into the hook's state and resolves with **how the leg ended** — `{kind:"settled", output?, text}`, `{kind:"parked"}`, `{kind:"failed", error}` or `{kind:"aborted"}`. Switch on `kind`; do NOT read the hook's state to tell them apart, because it has not committed when the promise resolves (that race closed dialogs over live, answerable runs). A run failure is DATA here, so no try/catch is needed for it. **Single-flight:** while a run is in flight, calling it again returns the in-flight run's promise — an accidental double-press joins the first run instead of billing a second one. Pass `replace: true` to deliberately abort-and-restart; the replaced run still executes and bills server-side |
+| `cancel` | `() => void` | Stop the run **server-side** (saves tokens) and locally. Wire a user-facing Stop button to this. The platform stamps `app_agent_runs.cancel_requested_at`, which is what distinguishes a user Stop from the unmount that `abort` also serves — so there is no client analytics event for it |
 | `abort` | `() => void` | Stop listening **locally only** — the run keeps executing server-side and its result is still persisted. This is the unmount path (the hook calls it automatically on unmount) |
 | `status` | `"idle" \| "streaming" \| "awaiting_input" \| "completed" \| "error"` | Whole-run state. `awaiting_input` = the run is PARKED on a question the agent asked (see the ask-back section below). `abort`/`cancel` reset it to `"idle"` (and clear the partial transcript) |
 | `pendingChoice` | `PendingChoice \| null` | The agent's pending question(s) — non-null exactly while `status` is `awaiting_input`. `questions` maps 1:1 onto `@lotics/ui`'s `ClarifyWizard` (`{question, options: {label, description}[], allow_custom}`) |
@@ -184,7 +184,7 @@ The run's lifetime is decoupled from the stream: the server drives it to complet
 - **The connection drops with an error** → the hook polls the persisted run to completion (every 2.5 s) and resolves with the settled result instead of surfacing a network error.
 - **The stream ends cleanly WITHOUT a `finish` frame** — an edge/proxy can close a long SSE gracefully mid-run, which looks like completion but swallowed the trailing frames (including the structured result). The hook detects the missing `finish` and polls the row the same way.
 
-Both truncation shapes emit the `app_agent_stream_truncated` analytics event (`kind: "connection_error" | "clean_end"`, with whether the row rescued the result), so edge-cut frequency is visible fleet-wide.
+Either way the run itself is unaffected — it keeps executing server-side and settles in `app_agent_runs`, which is where its outcome is read.
 
 **Anonymous runs poll with a capability token, handled for you.** On a publicly-shared app a visitor has no member identity, so the server cannot authorize their poll by ownership — `triggered_by_member_id` is null by design. Instead the run response carries a per-run token (`x-app-agent-run-token`); the SDK stores it against that run id and replays it on the poll, on `cancel`, and on `answerChoice`. It is transport-level, like the password-session token — never surfaced to app code, and never issued for a member run (identity already authorizes those). Nothing to wire: an app calls `useAgentRun` the same way on both. The token is bound to ONE run, so it cannot read another visitor's, and it is why a dropped connection on a public app recovers rather than losing the answer.
 

package/docs/members_and_options.md

@@ -108,13 +108,13 @@ cell's own `{ key, label }`, which renders as a neutral badge. Never hand-map op
 ## Member cells (`readMembers`)
 
 A `select_member` column's storage shape is a bare array of member ids. The server rewrites every
-projected `select_member` cell to `Array<{ id, name, email?, image?, groups? }>` — **the same shape
-`useMembers` returns**, so a member is a member wherever you got them from:
+projected `select_member` cell to `Array<{ id, name, email?, image?, groups?, role?, joined?, archived? }>` —
+**the same shape `useMembers` returns**, so a member is a member wherever you got them from:
 
-- **`email`, `image` and `groups` share ONE gate.** All three are present only for authenticated
-  members of the app's own organization. Anonymous visitors to a public app — and members of *other*
-  orgs viewing a publicly shared app — get `{ id, name }` only. A face and a team are org-internal
-  exactly as an address is.
+- **`email`, `image`, `groups`, `role` and `joined` share ONE gate.** All five are present only for
+  authenticated members of the app's own organization. Anonymous visitors to a public app — and
+  members of *other* orgs viewing a publicly shared app — get `{ id, name }` only. A face, a team
+  and a permission level are org-internal exactly as an address is.
 - **Absent is not null.** A missing `image` key means you were not told; `image: null` means the
   member genuinely has no photo. Same for `groups`: absent vs `[]`. Rendering the two the same way
   turns a permission boundary into a missing-data bug.
@@ -122,6 +122,18 @@ projected `select_member` cell to `Array<{ id, name, email?, image?, groups? }>`
   cookie-authenticated proxy, so an unsigned URL would not load inside an app iframe at all.
 - **`groups` is the platform's "department".** There is no department field; a member group is what
   an org uses to say Sale, Kế toán, CSKH. `[]` when the member is in none.
+- **`role` arrives RAW (`owner` / `admin` / `member`) and you translate it.** The platform ships no
+  display word, because a server that picked one would leak English into every localized app — map
+  it next to the rest of your vocabulary. It is a PERMISSION level, not a job title: everyone reads
+  "Admin" beside a name as rank. If the question your screen asks is "who is this person in the
+  company", the answer is `groups`.
+- **`joined` is an ISO timestamp of when the membership began.** Render it at whatever precision
+  your question needs — `@lotics/ui`'s `MemberProfileCard` shows month and year, because "is this
+  the new person?" does not want a day. Absent on a public response, and on an id that did not
+  resolve: there is no membership to have begun.
+- **`archived: true` marks someone who has LEFT** — omitted otherwise, never `false`. It is the one
+  field that is NOT gated (a departed colleague reading as a current assignee is wrong on a public
+  app too). Feed it to `inactive` on `MemberChip` / `MemberProfileCard`.
 - **An id that no longer resolves** (removed member, id outside the org) comes back with
   `name: null` — an explicit missing state, never an empty string. Render a placeholder.
 - Only ids already present in the projected rows are resolved — a member cell never exposes the
@@ -139,7 +151,10 @@ const { members, loading, error } = useMembers({ group: "grp_fulfillment" });
 <MemberSelect members={members} value={assignee} onValueChange={setAssignee} />
 ```
 
-Each member is the same `ResolvedMember` a cell carries — `{ id, name, email, image, groups }`.
+Each member is the same `ResolvedMember` a cell carries — `{ id, name, email, image, groups, role, joined }`.
+The one field it never carries is `archived`, and that is the answer rather than a gap: this roster
+answers "who may I ASSIGN?", and a departed member is not a candidate, so it never returns one. A
+resolved CELL is the display door and keeps naming them.
 `image` is the avatar URL (a presigned URL valid 24 hours, or the member's external OAuth photo) and
 may be `null`. `name` may be null/empty for members without a display name — fall back to `email`. On failure the hook does not throw: it
 resolves `{ members: [], loading: false, error }`.
@@ -311,7 +326,7 @@ The SDK never imports `@lotics/ui` — the app owns the (thin) data→UI adapter
 | Surface | Embedded (signed-in member) | Standalone / public (anonymous) |
 | --- | --- | --- |
 | `readSelect` cell enrichment | ✓ | ✓ |
-| `readMembers` cell enrichment | ✓ (email + image + groups, same-org) | ✓ name-only |
+| `readMembers` cell enrichment | ✓ (email + image + groups + role + joined, same-org) | ✓ name-only (+ `archived`) |
 | `useFieldOptions` | ✓ | ✓ |
 | `useMembers` | ✓ (same-org + declaration gates) | ✗ errors |
 | `useViewer` | member id (view-as target) | `null` |

package/docs/runtime.md

@@ -344,37 +344,29 @@ await checkIn({ latitude: r.coords.latitude, longitude: r.coords.longitude });
 ## Automatic analytics (PostHog)
 
 `mount()` boots a PostHog instance per app — apps are a separate cross-origin
-bundle, invisible to the product's own analytics. **No per-app wiring**: don't
-install `posthog-js` or call any analytics API from app code.
-
-- **Explicit events only — user gestures.** Autocapture, pageviews, and session
-  replay are off (autocapture is disabled at the project level — a client flag
-  could not re-enable it). System signals are deliberately not events: data
-  reads (`useQuery` fetches) and workflow/agent run outcomes. The backend
-  already logs and persists every run (`workflow_executions`, `app_agent_runs`).
-- Events the SDK emits automatically:
-
-| Event | Fired when | Properties |
-|---|---|---|
-| `app_opened` | analytics finished initializing after `mount()` | — |
-| `app_file_uploaded` | a `useFileUpload` upload succeeds | `mime_type` |
-| `app_comment_created` | a comment is created via `useComments` | `has_files` |
-| `app_comment_updated` / `app_comment_deleted` | comment edit/delete succeeds | — |
-
-- Every event carries the app identity as super-properties (`app_id`,
-  `app_name`, `workspace_id`, `organization_id`) and rolls up under the
-  `organization` group. Embedded apps `identify` the signed-in member — app and
+bundle, invisible to the product's own analytics. It is entirely automatic:
+don't install `posthog-js` or call any analytics API from app code, and there is
+no hook for app-defined events. If a bespoke funnel matters, request the surface
+as a platform change.
+
+The SDK emits one event, `app_opened`, once PostHog finishes initializing.
+Everything an app *does* is already recorded by the platform — a comment, an
+upload, a workflow or agent run each leave a row, and a run's outcome, including
+a user's Stop (`cancel_requested_at`), lands in `app_agent_runs`.
+
+- Autocapture, pageviews, dead clicks, and session replay are all off, set at
+  init rather than relied on project-wide: the server-side setting fails open,
+  and an app screen renders the customer's own records.
+- `app_opened` carries the app identity as super-properties — `app_id`,
+  `workspace_id`, `organization_id`, ids only, since a name is the customer's
+  own words — and rolls up under the `organization` group. Embedded apps `identify` the signed-in member — app and
   product events share one person; standalone visitors stay anonymous.
 - Uncaught exceptions are captured (PostHog error tracking) in addition to
-  `mount()`'s visible banner.
+  `mount()`'s visible banner — the app's one error channel.
 - **Tracking is gated to the deployed app host** (`*.lotics.app`). `lotics app
   dev` (localhost) and any `?__mock=1` load emit nothing. Best-effort
-  throughout: a failed init or a failed `context` resolution disables tracking
-  and never breaks the app. Events fired before init completes are buffered
-  (bounded) and drained on init.
-- **Limitation:** there is no public API for custom app events — the capture
-  function is internal to the SDK. If a bespoke funnel matters, request the
-  surface as a platform change.
+  throughout: a failed init or a failed `context` resolution leaves the app
+  fully working and untracked.
 - **Limitation:** PostHog's default bot/user-agent filter applies — headless
   browsers (e.g. Playwright) are never tracked, so analytics cannot be verified
   through headless automation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/app-sdk",
-  "version": "0.77.4",
+  "version": "0.79.0",
   "description": "Runtime SDK for Lotics custom-code apps — typed hooks, postMessage bridge, mount entry point",
   "type": "module",
   "exports": {