workpeg 0.97.0__tar.gz → 0.97.2__tar.gz

{workpeg-0.97.0/src/workpeg.egg-info → workpeg-0.97.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: workpeg
-Version: 0.97.0
+Version: 0.97.2
 Summary: Workpeg function runtime and SDK
 Author-email: Workpeg <support@workpeg.com>
 License: MIT

{workpeg-0.97.0 → workpeg-0.97.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "workpeg"
-version = "0.97.0"
+version = "0.97.2"
 description = "Workpeg function runtime and SDK"
 readme = "README.md"
 requires-python = ">=3.10"

{workpeg-0.97.0 → workpeg-0.97.2}/src/workpeg/ui/app.py

@@ -712,6 +712,26 @@ class _Workpeg:
         """
         return self._unavailable("get_tables")
 
+    def first_business(self) -> Any:
+        """Resolve the signed-in user's primary business — its ``uuid`` string,
+        or ``""`` when the user has none.
+
+        Meant for a bare ``/`` landing that redirects into a business::
+
+            class Landing(App):
+                async def on_mount(self):
+                    biz = await workpeg.first_business()
+                    if biz:
+                        navigate("/b/" + biz)
+
+        The businesses list is a *session* endpoint the ``workpeg.*`` allowlist
+        excludes (only tables, rows and the CDN are reachable), so — unlike
+        ``workpeg.get`` — the runtime resolves this one credentialed and
+        allowlist-exempt, the same chrome path :class:`Authenticated` uses for
+        ``/v1/users/me/``. Compiles to ``wpFirstBusiness``; never runs in Python.
+        """
+        return self._unavailable("first_business")
+
     # ``*_protected`` variants additionally send the session cookie
     # (``credentials: "include"``) — the authenticated request, for endpoints
     # behind a login (the recreation of the React ``fetchProtected`` helper)::
@@ -755,9 +775,9 @@ class _Cookie:
                 if biz:
                     navigate(f"/{biz}")
                 else:
-                    rows = await workpeg.get_protected("/v1/businesses/")
-                    if rows:
-                        navigate(f"/{rows[0]['uuid']}")
+                    first = await workpeg.first_business()
+                    if first:
+                        navigate(f"/{first}")
 
     They compile to the runtime's cookie helpers (name/value percent-encoded, so
     neither can inject extra cookie attributes); never executed in Python.

{workpeg-0.97.0 → workpeg-0.97.2}/src/workpeg/ui/compiler/ast_parser.py

@@ -74,6 +74,15 @@ _WORKPEG_TABLE_HELPERS = {
     "delete_row": (2, 2, "workpeg.delete_row(table_uuid, row_id)"),
 }
 
+# Curated session/chrome helpers on workpeg.* — no URL, no arbitrary reach.
+# ``first_business`` resolves the signed-in user's primary business uuid: the
+# businesses list is a session endpoint the peg allowlist excludes, so the
+# runtime fetches it credentialed (like Authenticated's /v1/users/me/) rather
+# than through workpeg.get. For the bare "/" landing → redirect to /b/<uuid>.
+_WORKPEG_SESSION_HELPERS = {
+    "first_business": (0, 0, "workpeg.first_business()"),
+}
+
 
 def _is_workpeg_host(url: str) -> bool:
     """True when *url* targets a Workpeg-owned host — ``workpeg`` as the
@@ -4107,8 +4116,9 @@ class ASTParser:
         # Tables & Rows helpers (get_tables, add_row, …) take no URL — the
         # business id is read from the page URL at runtime, and the runtime
         # builds the endpoint path from the args.
-        if method in _WORKPEG_TABLE_HELPERS:
-            lo, hi, usage = _WORKPEG_TABLE_HELPERS[method]
+        if method in _WORKPEG_TABLE_HELPERS or method in _WORKPEG_SESSION_HELPERS:
+            lo, hi, usage = (_WORKPEG_TABLE_HELPERS.get(method)
+                             or _WORKPEG_SESSION_HELPERS[method])
             # get_rows windows large tables server-side; the two keywords are
             # the standard way to fetch from an unbounded table. The response
             # stays a bare array either way (no pagination envelope).

{workpeg-0.97.0 → workpeg-0.97.2}/src/workpeg/ui/create.py

@@ -52,9 +52,9 @@ class Landing(App):
         if cached:
             navigate("/b/" + cached)
         else:
-            businesses = await workpeg.get_protected("/v1/businesses/")
-            if businesses:
-                navigate("/b/" + businesses[0]["uuid"])
+            biz = await workpeg.first_business()
+            if biz:
+                navigate("/b/" + biz)
 
     def build(self):
         return Authenticated(

{workpeg-0.97.0 → workpeg-0.97.2}/src/workpeg/ui/runtime/ai.js

@@ -2922,7 +2922,7 @@
     R + " .wpai-tok-number{color:#b5730a}",
     R + " .wpai-tok-fn{color:#3f7bd6}",
     R + " .wpai-tok-const{color:#c0663a}",
-    R + " .chat-message__bubble a{color:var(--color-brand-secondary,var(--color-brand-primary));text-decoration:underline}",
+    R + " .chat-message__bubble a{color:var(--color-text-link);text-decoration:underline}",
     R + " .chat-message__actions{display:flex;align-items:center;gap:4px;margin-top:4px;opacity:0;transition:opacity .15s ease}",
     R + " .chat-message--ai:hover .chat-message__actions{opacity:1}",
     R + " .chat-message--ai.wpai-streaming .chat-message__actions{opacity:0}",

{workpeg-0.97.0 → workpeg-0.97.2}/src/workpeg/ui/runtime/scaffold.js

@@ -409,12 +409,26 @@
     return row;
   }
 
+  // A full-screen "Signing out…" cover, shown the instant Log out is clicked so
+  // the DELETE round-trip + redirect never reads as an unresponsive pause. It
+  // stays until the redirect navigates away, so there's nothing to remove.
+  function showLogoutOverlay() {
+    if (typeof document === "undefined" || !document.body) return;
+    if (document.getElementById("wps-logout-overlay")) return;   // idempotent
+    var ov = el("div", "wps-logout-overlay", { attrs: {
+      id: "wps-logout-overlay", role: "status", "aria-label": "Signing out" } });
+    ov.appendChild(el("div", "wps-spin"));
+    ov.appendChild(el("div", "wps-logout-label", { text: "Signing out…" }));
+    document.body.appendChild(ov);
+  }
+
   // Log out — mirrors space's handlelogOut: DELETE the token (the server drops
   // the HttpOnly access/refresh cookies), wipe the readable auth cookies, then
   // bounce to the accounts login (the same redirect the auth gate uses). A
   // direct credentialed fetch — the workpeg.* client's allowlist (tables /
   // rows / CDN) intentionally won't reach /users/token/.
   function logout() {
+    showLogoutOverlay();    // immediate feedback before the async pause
     var api = String(WP().apiBase || "https://api.workpeg.com")
       .replace(/\/+$/, "");
     var finish = function () {
@@ -904,6 +918,14 @@
     "border-top-color:var(--color-text-tertiary);",
     "animation:wps-spin 0.8s linear infinite}",
     "@keyframes wps-spin{to{transform:rotate(360deg)}}",
+    /* the "Signing out…" cover — an instant full-screen loader on Log out */
+    ".wps-logout-overlay{position:fixed;inset:0;z-index:2147483000;",
+    "display:flex;flex-direction:column;align-items:center;",
+    "justify-content:center;gap:14px;background:var(--color-bg-default);",
+    "animation:wps-logout-fade 0.12s ease}",
+    ".wps-logout-overlay .wps-spin{width:28px;height:28px;border-width:3px}",
+    ".wps-logout-label{color:var(--color-text-secondary);font-size:14px}",
+    "@keyframes wps-logout-fade{from{opacity:0}to{opacity:1}}",
 
     /* the user / business switcher */
     ".wps-user{display:flex;align-items:center;width:100%;",

{workpeg-0.97.0 → workpeg-0.97.2}/src/workpeg/ui/runtime/workpeg-runtime.js

@@ -270,6 +270,22 @@
     return Workpeg.wpRequest("DELETE", url, data, true);
   };
 
+  // The signed-in user's businesses is a session/chrome endpoint — the peg
+  // client's allowlist deliberately excludes it (as it does /v1/users/me/), so
+  // it's resolved HERE, credentialed and allowlist-exempt (a raw Workpeg._request,
+  // not wpRequest), exactly like Authenticated's /v1/users/me/ check. It's the
+  // one businesses call the chrome doesn't already own — the bare "/" landing,
+  // which runs before scaffold.js mounts. Returns the first business's uuid ("" if
+  // the user has none), for a redirect to /b/<uuid>.
+  Workpeg.wpFirstBusiness = function () {
+    var url = Workpeg.apiBase.replace(/\/+$/, "") + "/v1/businesses/";
+    return Workpeg._ensureFreshSession().then(function () {
+      return Workpeg._request("GET", url, undefined, {}, true);
+    }).then(function (list) {
+      return (list && list[0] && list[0].uuid) || "";
+    });
+  };
+
   // The active business id, read from the URL. Pages live under "/b/<id>/...",
   // so the id is the path segment right after a leading "b" ("" if the page
   // isn't business-scoped).

{workpeg-0.97.0 → workpeg-0.97.2/src/workpeg.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: workpeg
-Version: 0.97.0
+Version: 0.97.2
 Summary: Workpeg function runtime and SDK
 Author-email: Workpeg <support@workpeg.com>
 License: MIT