What an app can reach, and what wraps it

What an app can reach, and what wraps it

Every platform capability a DataMagik app can use, the SDK call that reaches it, and the component that wraps it. Reach for the component first; drop to the call when you need something the component does not do.

Capability	Direct call	Component
Query data	dm.data.query	DmDataTable, DmCombobox, DmSelect
Write and import rows	dm.data.writeRow, dm.data.importRows	DmDataTable inline edit and CSV import
Run a script	dm.scripts.run	DmForm submit, DmButton with loading
Serial numbers	dm.serials.preview, .generate, .generateBatch	— call directly; see below
Printing	dm.print.submit, .status, dm.printers.list	— call directly; see below
Scanning	dm.scan() and the keyboard wedge	DmScannerInput
Photo and signature	dm.capture.upload, .write, .read, .url	DmPhotoCapture, DmSignaturePad
Navigation and app-to-app	dm.navigate, dm.emitOutput, dm.on	DmAppPanel, DmStepper
Shop-floor boards	dm.shopFloor.read, .meta	@datamagik/shop-floor-vue
Context	dm.init, dm.context	DmApp
Translation	dm.i18n()	every component, through DmApp

Capabilities with no component yet

Printing and serial numbers have SDK calls and no wrapper. DmPrinterPicker and DmSerialSeriesPicker were designed and are not built, so call dm.printers.list() and dm.serials.preview() and render the result with DmSelect.

This is said here rather than left out because a capability table with a gap in it is useful and one that quietly omits the gap is not: an author who reads "printing — DmPrinterPicker" and cannot import it concludes the documentation is wrong about everything else too.

What the sandbox blocks, and why

An app runs in an iframe with default-src 'none' and connect-src 'none', on an opaque origin. That is not a restriction to work around — it is what makes it safe to run a customer's own code inside the platform. Three consequences are worth knowing before they surprise you:

• You cannot fetch() anything. Every platform call goes through the bridge, which is what dm.* is. There is no allowlist to be added to.
• You cannot open the camera directly. The frame carries allow="camera" but not allow-same-origin, so getUserMedia is refused by the opaque origin regardless. dm.scan() asks the host, which uses the native scanner when the outer shell offers one.
• Fonts and stylesheets must ship in your bundle. font-src 'self' <assetSource> permits the bundle's own asset tree and nothing else — which is why @datamagik/ui self-hosts Archivo and IBM Plex rather than linking a CDN.