@lotics/app-sdk 0.11.0 → 0.12.0

package/dist/src/index.d.ts

@@ -13,7 +13,6 @@ export { mount } from "./mount.js";
 export type { MountOptions } from "./mount.js";
 export { useWorkflow, useQuery, useFileUpload } from "./hooks.js";
 export type { UploadedFile } from "./hooks.js";
-export { downloadFileFromUrl } from "./download.js";
 export { rpc } from "./rpc.js";
 export type { RpcOp } from "./rpc.js";
 export { readMembers } from "./members.js";

package/dist/src/index.js

@@ -11,6 +11,5 @@
  */
 export { mount } from "./mount.js";
 export { useWorkflow, useQuery, useFileUpload } from "./hooks.js";
-export { downloadFileFromUrl } from "./download.js";
 export { rpc } from "./rpc.js";
 export { readMembers } from "./members.js";

package/dist/src/rpc.js

@@ -1,8 +1,25 @@
 import { promptForPassword } from "./password_gate.js";
 import { runUploadPipeline } from "./upload/pipeline.js";
-/** The embedding Lotics host's origin — present iff the app is bridged. */
-const hostOrigin = new URLSearchParams(window.location.search).get("lotics_host");
+/**
+ * The embedding Lotics host's origin — present iff the app is bridged.
+ *
+ * Lazy + memoized so the module's top level doesn't touch `window`. The SDK
+ * gets imported by `frontend/lib/download.ts`, which Jest pulls in at module
+ * evaluation time before its jsdom environment finishes setting up
+ * `window.location` — eager reads crash every test suite that transitively
+ * imports the SDK.
+ *
+ * `undefined` = not yet computed; `string | null` = computed result.
+ */
+let hostOriginCache;
+function getHostOrigin() {
+    if (hostOriginCache === undefined) {
+        hostOriginCache = new URLSearchParams(window.location.search).get("lotics_host");
+    }
+    return hostOriginCache;
+}
 export function rpc(op, payload) {
+    const hostOrigin = getHostOrigin();
     return hostOrigin
         ? rpcBridged(op, payload, hostOrigin)
         : rpcStandalone(op, payload);
@@ -16,7 +33,7 @@ function ensureListener() {
     listenerInstalled = true;
     window.addEventListener("message", (event) => {
         // Accept only messages from the parent window, at the host origin.
-        if (event.source !== window.parent || event.origin !== hostOrigin)
+        if (event.source !== window.parent || event.origin !== getHostOrigin())
             return;
         const msg = event.data;
         if (!msg || typeof msg.id !== "number")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/app-sdk",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Runtime SDK for Lotics custom-code apps — typed hooks, postMessage bridge, mount entry point",
   "type": "module",
   "exports": {

package/dist/src/download.d.ts

@@ -1 +0,0 @@
-export declare function downloadFileFromUrl(url: string, filename: string): Promise<void>;

package/dist/src/download.js

@@ -1,30 +0,0 @@
-// File download primitive for Lotics custom-code apps. Uses fetch+blob+anchor
-// because the app runs inside a sandboxed iframe — `window.open(url, "_blank")`
-// is silently dropped without `allow-popups`, and direct anchor navigation
-// without the `download` attribute doesn't trigger a save dialog for inline
-// MIME types (HTML, JSON, PDFs, etc.).
-//
-// `cache: "no-store"` matches the frontend convention — avoids CORS cache
-// collisions where a prior <img> load cached the response without an
-// `Access-Control-Allow-Origin` header, breaking subsequent fetches.
-export async function downloadFileFromUrl(url, filename) {
-    if (!url)
-        throw new Error("downloadFileFromUrl: empty url");
-    const response = await fetch(url, { cache: "no-store" });
-    if (!response.ok) {
-        throw new Error(`File download failed: ${response.status} ${response.statusText}`);
-    }
-    const blob = await response.blob();
-    const blobUrl = URL.createObjectURL(blob);
-    try {
-        const link = document.createElement("a");
-        link.href = blobUrl;
-        link.download = filename;
-        document.body.appendChild(link);
-        link.click();
-        link.remove();
-    }
-    finally {
-        URL.revokeObjectURL(blobUrl);
-    }
-}