@pancake-pos/app-cli 2026.1.4 → 2026.1.5

package/dist/cli.js

@@ -73,7 +73,7 @@ function targets(apiVersion) {
     "app.page",
     ...RESOURCES.flatMap((r) => [...locations, "index.column"].map((l) => `${r}.${l}`)),
     ...PRINT_RESOURCES.map((r) => `${r}.print-action`),
-    "customer.details.block"
+    ...CUSTOMER_LOCATIONS.map((l) => `customer.${l}`)
   ];
 }
 function validateManifest(manifest, files) {
@@ -181,7 +181,7 @@ function validateManifest(manifest, files) {
     } else if (target.endsWith(".print-action") && PRINT_RESOURCES.includes(target.slice(0, -".print-action".length))) {
       requiredString(e, "label", 40, path);
       file("module", true);
-    } else if (target.endsWith(".index.column") && RESOURCES.includes(target.slice(0, -".index.column".length))) {
+    } else if (target.endsWith(".index.column") && [...RESOURCES, "customer"].includes(target.slice(0, -".index.column".length))) {
       requiredString(e, "title", 30, path);
       file("module", true);
       if (e.format !== void 0 && !COLUMN_FORMATS.includes(e.format)) add("invalid_field", `${path}.format`, `format ph\u1EA3i l\xE0 ${COLUMN_FORMATS.join(", ")}`);
@@ -192,7 +192,8 @@ function validateManifest(manifest, files) {
       const dot = target.indexOf(".");
       const resource = target.slice(0, dot);
       const location = target.slice(dot + 1);
-      if (!RESOURCES.includes(resource)) return add("unknown_target", `${path}.target`, `Target ${target} kh\xF4ng t\u1ED3n t\u1EA1i`);
+      const customer = resource === "customer" && CUSTOMER_LOCATIONS.includes(location);
+      if (!RESOURCES.includes(resource) && !customer) return add("unknown_target", `${path}.target`, `Target ${target} kh\xF4ng t\u1ED3n t\u1EA1i`);
       if (ACTION_LOCATIONS.includes(location)) {
         requiredString(e, "label", 40, path);
         optionalString(e, "title", 60, path);
@@ -229,7 +230,7 @@ function validOrigin(origin) {
     return false;
   }
 }
-var API_VERSIONS, RESERVED_DOMAINS, RESOURCES, ACTION_LOCATIONS, DETAIL_LOCATIONS, PRESENTATIONS, METHODS, ACCESS_FIELDS, CONDITION_RESOURCES, UUID, PRINT_RESOURCES, COLUMN_FORMATS, COLUMN_ALIGNS, isString, isObject;
+var API_VERSIONS, RESERVED_DOMAINS, RESOURCES, ACTION_LOCATIONS, DETAIL_LOCATIONS, PRESENTATIONS, METHODS, ACCESS_FIELDS, CONDITION_RESOURCES, UUID, CUSTOMER_LOCATIONS, PRINT_RESOURCES, COLUMN_FORMATS, COLUMN_ALIGNS, isString, isObject;
 var init_manifest = __esm({
   "src/manifest.ts"() {
     "use strict";
@@ -252,6 +253,7 @@ var init_manifest = __esm({
       has_customer: ["order"]
     };
     UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    CUSTOMER_LOCATIONS = ["details.block", ...ACTION_LOCATIONS, "index.column"];
     PRINT_RESOURCES = ["order", "purchase", "export", "warehouse_transfer"];
     COLUMN_FORMATS = ["text", "number", "money", "date", "datetime"];
     COLUMN_ALIGNS = ["left", "center", "right"];
@@ -643,7 +645,7 @@ function createSiteHandler(options) {
     if (req.method !== "GET" && req.method !== "HEAD") return send(req, res, 405, { ...textHeaders, Allow: "GET, HEAD" }, "Method not allowed");
     const url = new URL(req.url ?? "/", "http://sandbox");
     const path = url.pathname;
-    if (path === "/_pos/health") return send(req, res, 200, textHeaders, "ok");
+    if (path === "/_pos/health") return send(req, res, 200, options.runtime.version ? { ...textHeaders, "X-Pos-Runtime": options.runtime.version } : textHeaders, "ok");
     if (options.rejectTopLevel && req.headers["sec-fetch-dest"] === "document") {
       return send(req, res, 403, textHeaders, "This app only runs inside Pancake POS");
     }
@@ -1145,7 +1147,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "2026.1.4" : JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+    CLI_VERSION = true ? "2026.1.5" : JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
   }
 });
 
@@ -1246,6 +1248,8 @@ function isSaved(resource, record) {
 }
 function recordRef(resource, record) {
   switch (resource) {
+    case "customer":
+      return customerRef(record);
     case "order": {
       const systemId = orderSystemId(record) ?? 0;
       return { id: str(record.custom_id) ?? systemId, system_id: systemId, status: num(record.status), updated_at: str(record.updated_at) };
@@ -1374,11 +1378,12 @@ function hideOrderFields(data, hidden) {
   for (const field of hidden) delete draft[field];
   return { ...data, draft };
 }
-var RESOURCES2, MAX_SELECTION, num, str, idOf, ids, list, orderPrice, orderSystemId;
+var RESOURCES2, LIST_RESOURCES, MAX_SELECTION, num, str, idOf, ids, list, orderPrice, orderSystemId;
 var init_records = __esm({
   "../app-host/src/records.ts"() {
     "use strict";
     RESOURCES2 = ["order", "product", "purchase", "export", "warehouse_transfer"];
+    LIST_RESOURCES = [...RESOURCES2, "customer"];
     MAX_SELECTION = 500;
     num = (value, fallback = 0) => typeof value === "number" && Number.isFinite(value) ? value : Number(value) || fallback;
     str = (value) => value === void 0 || value === null || value === "" ? null : String(value);
@@ -1514,17 +1519,18 @@ function describeTarget(target, all = sections()) {
   const [resource, ...rest] = target.split(".");
   const location = target === "nav.item" || target === "app.page" ? target : rest.join(".");
   const plain = target === "nav.item" || target === "app.page";
-  const docHeading = plain ? target : target === "customer.details.block" ? `\`${target}\`` : `\`*.${location}\``;
-  const docs = all.filter((section) => section.page === "targets" && (section.heading === docHeading || section.heading.startsWith(`${docHeading} `)));
+  const customer = resource === "customer";
+  const headings = plain ? [target] : customer ? ["`customer.*`", ...location === "details.block" ? [] : [`\`*.${location}\``]] : [`\`*.${location}\``];
+  const docs = all.filter((section) => section.page === "targets" && headings.some((heading) => section.heading === heading || section.heading.startsWith(`${heading} `)));
   const listData = location === "print-action" || location === "index.column";
-  const data = target === "customer.details.block" ? "CustomerData ({ resource: 'customer', record: CustomerRef })" : DATA[location] ? `${DATA[location]}<'${resource}'>` : target === "app.page" ? "PageData ({ path, query })" : "none (no code)";
+  const data = customer && location.startsWith("details.") ? "CustomerData ({ resource: 'customer', record: CustomerRef })" : DATA[location] ? `${DATA[location]}<'${resource}'>` : target === "app.page" ? "PageData ({ path, query })" : "none (no code)";
   const result = location === "before_submit" ? "BeforeSubmitResult: `{ ok: true, changes?: { note?, add_tags? } }` or `{ ok: false, message }`" : location === "print-action" ? "PrintResult: `{ html, title? }` (POS strips scripts, then prints)" : location === "index.column" ? `ColumnResult: \`{ values: { [${resource === "order" ? "system_id" : "id"}]: string | number | null } }\`` : location.endsWith("action") ? "headless: `{ message?, refresh? }` or nothing; modal/fullscreen: render, call pos.close()" : "nothing (blocks and pages render themselves)";
-  const types = target === "customer.details.block" ? [typeBlock("CustomerRef", all)].filter(Boolean) : DATA[location] ? [typeBlock(`${pascal(resource)}Ref`, all), location === "index.action" || location.endsWith("selection-action") || location === "after_save" || listData ? null : typeBlock(`${pascal(resource)}Draft`, all)].filter(Boolean) : [];
+  const types = customer ? [typeBlock("CustomerRef", all)].filter(Boolean) : DATA[location] ? [typeBlock(`${pascal(resource)}Ref`, all), location === "index.action" || location.endsWith("selection-action") || location === "after_save" || listData ? null : typeBlock(`${pascal(resource)}Draft`, all)].filter(Boolean) : [];
   return [
     `# ${target}`,
     `- Context data (\`pos.data\` and the module argument): \`${data}\``,
     `- Returns: ${result}`,
-    `- Manifest fields: ${target === "customer.details.block" ? "`module` (required), `should_render`. No `conditions`." : MANIFEST[location] ?? ""}`,
+    `- Manifest fields: ${target === "customer.details.block" ? "`module` (required), `should_render`. No `conditions`." : `${MANIFEST[location] ?? ""}${customer ? " No `conditions` for customer targets." : ""}`}`,
     ...types.length ? ["", "```ts", ...types, "```"] : [],
     "",
     "## Example",
@@ -1684,20 +1690,12 @@ ${hit.text.slice(0, 4e3)}`).join("\n\n---\n\n") };
       async run(args) {
         const target = String(args.target ?? "");
         if (target === "app.page") return ok({ target, data: { path: "/", query: {} } });
-        if (target === "customer.details.block") {
-          const id = args.record_id === void 0 ? void 0 : String(args.record_id);
-          const response = id ? await get(`customers/${encodeURIComponent(id)}`) : await get(`customers?page_size=1&page_number=1`);
-          const record2 = id ? response.data ?? response : itemsOf(response)[0];
-          if (!record2 || typeof record2 !== "object") return fail("The shop has no customers the signed-in user can read");
-          return ok({ target, data: customerData(record2) });
-        }
         const [resource, ...rest] = target.split(".");
         const location = rest.join(".");
-        if (!RESOURCES2.includes(resource) || !targets(API_VERSION2).includes(target)) return fail(`Unknown target ${target}`);
+        if (!LIST_RESOURCES.includes(resource) || !targets(API_VERSION2).includes(target)) return fail(`Unknown target ${target}`);
         const record = await sampleRecord(resource, args.record_id === void 0 ? void 0 : String(args.record_id));
         if (!record) return fail(`The shop has no ${resource} records the signed-in user can read`);
-        const r = resource;
-        const data = location === "index.action" ? indexData(r, record) : location === "index.selection-action" || location === "print-action" || location === "index.column" ? selectionData(r, [record]) : location === "after_save" ? afterSaveInput(r, record, "edit") : detailsData(r, record);
+        const data = location === "index.action" ? indexData(resource, record) : location === "index.selection-action" || location === "print-action" || location === "index.column" ? selectionData(resource, [record]) : resource === "customer" ? customerData(record) : location === "after_save" ? afterSaveInput(resource, record, "edit") : detailsData(resource, record);
         const hidden = readManifest(ctx.root).access?.hidden_order_fields;
         return ok({ target, data: "draft" in data ? hideOrderFields(data, hidden) : data });
       }
@@ -1883,7 +1881,8 @@ var init_tools = __esm({
       product: "products",
       purchase: "purchases",
       export: "export",
-      warehouse_transfer: "transfers"
+      warehouse_transfer: "transfers",
+      customer: "customers"
     };
     META_PATHS = {
       order: { warehouses: "warehouses", tags: "orders/tags", order_sources: "order_source" },

package/docs/llms-full.txt

@@ -171,7 +171,7 @@ Details: [Data access](/developers/apps/en/data-access).
 |---|---|
 | PoC | Sandbox, app tokens, order detail block, order action menu item, iframe page, a sample app written by AI |
 | Phase 1 | Upload, versions, rollback, visibility permissions, audit, rate limits, component catalog v1, SDK, CLI |
-| Phase 2 | Available: `before_submit` hook (block saves, set the note and tags), Worker UI pages (`render: "worker"`), app print templates (orders, purchases, exports, transfers), list columns, customer blocks. Not yet: per-app webhooks and service keys, app storage |
+| Phase 2 | Available: `before_submit` hook (block saves, set the note and tags), Worker UI pages (`render: "worker"`), app print templates (orders, purchases, exports, transfers), list columns, customer boxes, actions and columns. Not yet: per-app webhooks and service keys, app storage |
 | Phase 3 | Consider the mobile app, install one app across shops of the same owner |
 
 ---
@@ -1158,6 +1158,8 @@ Apply to `*.details.block`.
 | Target | Field | Description |
 |---|---|---|
 | `customer.details.block` | `module` (required), `should_render` | As for blocks; no `conditions`. |
+| `customer.details.action`, `customer.index.action`, `customer.index.selection-action` | As for actions | No `conditions`. |
+| `customer.index.column` | As for `<resource>.index.column` | `values` is keyed by the customer's `id`. |
 | `<resource>.print-action` | `label` (required) | Template name in the "Print template" picker, up to 40 characters. |
 | `<resource>.print-action` | `module` (required) | Module returning `{ html, title? }`. |
 | `<resource>.index.column` | `title` (required) | Column title, up to 30 characters. |
@@ -1166,7 +1168,7 @@ Apply to `*.details.block`.
 | `<resource>.index.column` | `align` | `left`, `center`, `right`. |
 | `<resource>.index.column` | `width` | Column width in px, 60–400, default 140. |
 
-See [Extension points](/developers/apps/en/targets#customer-details-block) for the context data and return values.
+See [Extension points](/developers/apps/en/targets#customer) for the context data and return values.
 
 ### Hook fields
 
@@ -1261,7 +1263,7 @@ Targets attached to a POS record are named `<resource>.<location>`, for example
 | `<resource>.after_save` | After a record is created/updated on the detail form | hook, headless |
 | `<resource>.index.column` | A column in the list | hook, headless |
 | `<resource>.print-action` | A print template in the "Print template" picker (except `product`) | headless, returns HTML |
-| `customer.details.block` | A box in the customer profile | Worker UI |
+| `customer.<location>` | Customer profile and list: `details.block`, `details.action`, `index.action`, `index.selection-action`, `index.column` | See [`customer.*`](#customer) |
 
 `<resource>` is one of `order`, `product`, `purchase`, `export`, `warehouse_transfer`. Products have no `print-action` because they only print barcodes.
 
@@ -1345,6 +1347,7 @@ Example `pos.data` in `purchase.details.action`:
 | `purchase` | `record.id` | `purchase_id`, `purchase_ids` |
 | `export` | `record.id` | `export_id`, `export_ids` |
 | `warehouse_transfer` | `record.id` | `warehouse_transfer_id`, `warehouse_transfer_ids` |
+| `customer` | `record.id` | `customer_id`, `customer_ids` |
 
 ### Types per resource
 
@@ -1663,9 +1666,19 @@ export default defineExtension('order.before_submit', async (data) => {
 
 `*.before_submit` and `*.after_save` only run when the user saves on the detail form in POS web. They do **not** run for changes made elsewhere: the status menu on list rows, bulk updates, Excel import, the Open API, the mobile app or marketplace sync. Rules that must always hold belong on the server.
 
-## `customer.details.block`
+## `customer.*`
 
-A box in the customer profile, in the right column below Notes and Addresses. The profile has this box wherever it opens: the Customers page, the order form and other screens.
+Customers have boxes, actions and columns like the other resources, but **no** `before_submit`, `after_save` (the profile saves each field as soon as it changes; there is no shared Save button) and no print templates.
+
+| Target | Location | Context data |
+|---|---|---|
+| `customer.details.block` | A box in the customer profile, right column below Notes and Addresses | `CustomerData` |
+| `customer.details.action` | An "Apps" button at the top of the customer profile, shown only when an app adds an action here | `CustomerData` |
+| `customer.index.action` | The "⋯" menu at the end of each customer list row, shown only when an app adds an action here | `IndexData<'customer'>` |
+| `customer.index.selection-action` | An "Apps" button on the action bar when several customers are selected | `SelectionData<'customer'>` |
+| `customer.index.column` | A column in the customer list; `values` is keyed by the customer's `id` | `ColumnData<'customer'>` |
+
+The profile has the box and the actions wherever it opens: the Customers page, the order form and other screens. When the customer list is filtered to deleted customers, app actions and columns are hidden.
 
 ```ts
 type CustomerRef = {
@@ -1678,12 +1691,14 @@ type CustomerRef = {
   updated_at: string | null;
 };
 
-type CustomerData = { resource: 'customer'; record: CustomerRef };
+type CustomerData = { resource: 'customer'; record: CustomerRef };   // same shape as IndexData<'customer'>
 ```
 
-- Manifest: `module` (required), `should_render`. No `conditions`.
-- When the customer is edited in the profile, POS emits `data-change` with the new data.
-- As with `*.details.block`, the worker starts when the box scrolls into view; POS shows a placeholder meanwhile.
+- Manifest: the same fields as the target at the same location for other resources (`*.details.action`, `*.details.block`, `*.index.column`…). Customer targets have **no** `conditions`; use `should_render` to hide by data.
+- `refresh` of a headless action and `pos.refresh()` reload the customer list page being viewed; a profile opened from the list gets the new data. A profile opened from the order form or other screens does not reload yet.
+- `navigate` adds `customer_id` or `customer_ids` to the query.
+- When the customer is edited in the profile, the box receives `data-change` with the new data.
+- As with `*.details.block`, the box's worker starts when the box scrolls into view; POS shows a placeholder meanwhile.
 
 ## `*.print-action`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pancake-pos/app-cli",
-  "version": "2026.1.4",
+  "version": "2026.1.5",
   "description": "pos-app command for Pancake POS apps: login, dev, check, build, deploy, versions and an MCP server for AI tools",
   "license": "UNLICENSED",
   "type": "module",
@@ -24,6 +24,6 @@
     "esbuild": "^0.28.2",
     "eslint": "^10.12.0",
     "fflate": "^0.8.3",
-    "@pancake-pos/eslint-plugin": "2026.1.4"
+    "@pancake-pos/eslint-plugin": "2026.1.5"
   }
 }

package/runtime/frame.js

@@ -37,5 +37,5 @@ window.addEventListener("message", (event) => {
     else if (data?.t === "kill") kill(data.instance);
   };
 });
-window.parent.postMessage({ t: "frame-ready", protocol: PROTOCOL_VERSION, runtime: "2026.1.4" }, "*");
+window.parent.postMessage({ t: "frame-ready", protocol: PROTOCOL_VERSION, runtime: "2026.1.5" }, "*");
 //# sourceMappingURL=frame.js.map