@lotics/cli 0.33.0 → 0.34.0

package/dist/dev/wrapper_page.d.ts

@@ -3,10 +3,12 @@
  *
  * The wrapper page is served at http://localhost:<port>/ and embeds the
  * project's Vite dev server in an iframe with the same
- * sandbox="allow-scripts allow-same-origin" attribute production uses —
- * safe because the Vite iframe is cross-origin to this wrapper (different
- * port), so the app gets its own real origin (and Web Storage) without
- * being able to reach the wrapper. The iframe sends postMessage RPCs to
+ * sandbox="allow-scripts allow-same-origin allow-downloads" attribute
+ * production uses — safe because the Vite iframe is cross-origin to this
+ * wrapper (different port), so the app gets its own real origin (and Web
+ * Storage) without being able to reach the wrapper. `allow-downloads` lets
+ * apps trigger file downloads (generated xlsx / pdf etc.) — Chrome blocks
+ * every download path from sandboxed iframes without it. The iframe sends postMessage RPCs to
  * this wrapper, which forwards them to the local /_rpc endpoint, which
  * dispatches to api.lotics.ai with the CLI's API key.
  *

package/dist/dev/wrapper_page.js

@@ -3,10 +3,12 @@
  *
  * The wrapper page is served at http://localhost:<port>/ and embeds the
  * project's Vite dev server in an iframe with the same
- * sandbox="allow-scripts allow-same-origin" attribute production uses —
- * safe because the Vite iframe is cross-origin to this wrapper (different
- * port), so the app gets its own real origin (and Web Storage) without
- * being able to reach the wrapper. The iframe sends postMessage RPCs to
+ * sandbox="allow-scripts allow-same-origin allow-downloads" attribute
+ * production uses — safe because the Vite iframe is cross-origin to this
+ * wrapper (different port), so the app gets its own real origin (and Web
+ * Storage) without being able to reach the wrapper. `allow-downloads` lets
+ * apps trigger file downloads (generated xlsx / pdf etc.) — Chrome blocks
+ * every download path from sandboxed iframes without it. The iframe sends postMessage RPCs to
  * this wrapper, which forwards them to the local /_rpc endpoint, which
  * dispatches to api.lotics.ai with the CLI's API key.
  *
@@ -58,7 +60,7 @@ export function buildWrapperPage(args) {
     <span>workspace <code>${escapeHtml(workspace_id)}</code></span>
     <span>RPC → <code>${escapeHtml(api_url)}</code></span>
   </header>
-  <iframe id="app" sandbox="allow-scripts allow-same-origin" allow="clipboard-write"></iframe>
+  <iframe id="app" sandbox="allow-scripts allow-same-origin allow-downloads" allow="clipboard-write"></iframe>
   <script>
     (function () {
       const APP_ID = ${JSON.stringify(app_id)};

package/dist/src/cli.js

@@ -31678,7 +31678,7 @@ import { tmpdir } from "node:os";
 
 // src/starter_template.ts
 var STARTER_FALLBACK_UI_VERSION = "1.8.0";
-var STARTER_FALLBACK_SDK_VERSION = "0.9.0";
+var STARTER_FALLBACK_SDK_VERSION = "0.11.0";
 function buildStarterTemplate(args) {
   const uiVersion = args.ui_version ?? `^${STARTER_FALLBACK_UI_VERSION}`;
   const sdkVersion = args.sdk_version ?? `^${STARTER_FALLBACK_SDK_VERSION}`;
@@ -32217,7 +32217,7 @@ function buildWrapperPage(args) {
     <span>workspace <code>${escapeHtml2(workspace_id)}</code></span>
     <span>RPC \u2192 <code>${escapeHtml2(api_url)}</code></span>
   </header>
-  <iframe id="app" sandbox="allow-scripts allow-same-origin" allow="clipboard-write"></iframe>
+  <iframe id="app" sandbox="allow-scripts allow-same-origin allow-downloads" allow="clipboard-write"></iframe>
   <script>
     (function () {
       const APP_ID = ${JSON.stringify(app_id)};

package/dist/starter_template.d.ts

@@ -40,7 +40,7 @@ export interface StarterFile {
  * fall back here when the lookup fails.
  */
 export declare const STARTER_FALLBACK_UI_VERSION = "1.8.0";
-export declare const STARTER_FALLBACK_SDK_VERSION = "0.9.0";
+export declare const STARTER_FALLBACK_SDK_VERSION = "0.11.0";
 export declare function buildStarterTemplate(args: {
     app_name: string;
     app_id: string;

package/dist/starter_template.js

@@ -36,7 +36,7 @@
  * fall back here when the lookup fails.
  */
 export const STARTER_FALLBACK_UI_VERSION = "1.8.0";
-export const STARTER_FALLBACK_SDK_VERSION = "0.9.0";
+export const STARTER_FALLBACK_SDK_VERSION = "0.11.0";
 export function buildStarterTemplate(args) {
     const uiVersion = args.ui_version ?? `^${STARTER_FALLBACK_UI_VERSION}`;
     const sdkVersion = args.sdk_version ?? `^${STARTER_FALLBACK_SDK_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {