@trylight/app 0.1.7 → 0.1.8

package/dist/client.js

@@ -97,7 +97,7 @@ function tableClient(entity) {
                 mutationFn: ({ id, patch }) => update(id, patch),
                 onMutate: async ({ id, patch }) => {
                     await client.cancelQueries({ queryKey: keys.all });
-                    // As the server does: a value set here loses its old source; sources sent merge in.
+                    // A value set here loses its old source until the server answers with who set it; sources sent merge in.
                     const patched = (row) => row.id === id
                         ? {
                             ...row,

package/dist/server/entities.js

@@ -79,7 +79,9 @@ export function createEntitiesHandler(options) {
             const patch = await readBody(request, table.update);
             if (!patch.success)
                 return refuse(400, "invalid", z.prettifyError(patch.error));
-            return answer(() => update(db, table, actor, id, patch.data));
+            // The page's own address: behind the platform's proxy the request's host is an internal hop, Origin (checked above) is not.
+            const origin = request.headers.get("origin");
+            return answer(() => update(db, table, actor, origin === null ? url.origin : origin, id, patch.data));
         }
         if (id !== null && method === "DELETE")
             return answer(() => remove(db, table, actor, id));
@@ -160,15 +162,21 @@ async function create(db, table, actor, data) {
             .returning());
     });
 }
-async function update(db, table, actor, id, patch) {
+async function update(db, table, actor, 
+/** This app's own address: where a person's edit was said. */
+origin, id, patch) {
     return db.transaction(async (tx) => {
         await nameActor(tx, actor);
         const before = atMostOne(await tx.select().from(table.entity).where(eq(table.id, id)).for("update"));
         if (before === null)
             return null;
         const changed = Object.keys(patch).filter((key) => !isDeepStrictEqual(patch[key], before[key]));
-        // A value a person sets is no longer what its source said; sources sent are merged in.
-        const field_sources = { ...withoutSources(before.field_sources, changed), ...patch.field_sources };
+        // A sourced value a person sets is no longer what its source said: its source is now them. Sources sent are merged in.
+        const stored = storedSources.parse(before.field_sources);
+        const edited = changed
+            .filter((column) => column in stored)
+            .map((column) => [column, { url: origin, evidence: `Edited by ${actor.name}` }]);
+        const field_sources = { ...withoutSources(stored, changed), ...Object.fromEntries(edited), ...patch.field_sources };
         return exactlyOne(await tx
             .update(table.entity)
             .set({ ...patch, field_sources })
@@ -204,8 +212,7 @@ function exactlyOne(rows) {
 // What's stored may come from an agent's own write: read as it is, never refused here.
 const storedSources = z.record(z.string(), z.unknown());
 function withoutSources(stored, columns) {
-    const sources = storedSources.parse(stored);
-    return Object.fromEntries(Object.entries(sources).filter(([column]) => !columns.includes(column)));
+    return Object.fromEntries(Object.entries(stored).filter(([column]) => !columns.includes(column)));
 }
 function signedIn(session) {
     return session.user === null ? null : { id: session.user.id, name: session.user.name };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trylight/app",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "The Light SDK every v2 org app depends on: entities (Drizzle tables with a typed client), sign-in, contracts and in-app chat.",
   "license": "UNLICENSED",
   "type": "module",
@@ -10,7 +10,7 @@
   "repository": {
     "type": "git",
     "url": "https://github.com/shubh9/mii.git",
-    "directory": "packages/light-app"
+    "directory": "packages/app-sdk"
   },
   "packageManager": "pnpm@11.0.9",
   "files": [