@lotics/cli 0.41.0 → 0.43.0

package/dist/app_commands.js

@@ -434,12 +434,16 @@ export async function appDev(client, args) {
         port: args.port,
         vitePort: args.vitePort,
         client,
+        commentsEnabled: meta.capabilities?.comments,
     });
     await handle.ready;
     const url = `http://localhost:${handle.port}`;
     console.error(`\n  lotics app dev`);
     console.error(`  app:       ${app.name} (${meta.app_id})`);
     console.error(`  workspace: ${meta.workspace_id}`);
+    if (client.viewAsMemberId) {
+        console.error(`  view as:   ${client.viewAsMemberId} (is_current_member resolves to this member)`);
+    }
     console.error(`  vite:      http://localhost:${handle.vitePort}/`);
     console.error(`  open:      ${url}`);
     console.error(`  rpc:       ${client.baseUrl} (via Bearer API key)\n`);

package/dist/args.d.ts

@@ -22,6 +22,7 @@ export declare function parseArgs(argv: string[]): {
         as?: string;
         apiKey?: string;
         workspace?: string;
+        viewAs?: string;
         name?: string;
         timezone?: string;
         message?: string;

package/dist/args.js

@@ -18,6 +18,7 @@ export function parseArgs(argv) {
         as: undefined,
         apiKey: undefined,
         workspace: undefined,
+        viewAs: undefined,
         name: undefined,
         timezone: undefined,
         message: undefined,
@@ -55,6 +56,9 @@ export function parseArgs(argv) {
             case "-w":
                 flags.workspace = argv[++i];
                 break;
+            case "--view-as":
+                flags.viewAs = argv[++i];
+                break;
             case "--name":
                 flags.name = argv[++i];
                 break;

package/dist/args.test.js

@@ -45,6 +45,12 @@ describe("parseArgs", () => {
         const r = parseArgs(["run", "query_tables", "-w", "wsp_123"]);
         expect(r.flags.workspace).toBe("wsp_123");
     });
+    it("parses --view-as as a value flag", () => {
+        const r = parseArgs(["app", "dev", "--view-as", "mbr_abc"]);
+        expect(r.flags.viewAs).toBe("mbr_abc");
+        expect(r.command).toBe("app");
+        expect(r.subcommand).toBe("dev");
+    });
     it("parses --all as a boolean flag", () => {
         const r = parseArgs(["auth", "logout", "--all"]);
         expect(r.flags.all).toBe(true);

package/dist/cli.js

@@ -81,6 +81,9 @@ FLAGS
   --as <name>        Override upload filename
   --api-key <key>    One-off API key (overrides saved config + env)
   --workspace <id>   One-off workspace override (alias: -w)
+  --view-as <id>     Admin "View as": run every request as this member, so
+                     is_current_member / row-scoping resolve to them (also
+                     LOTICS_VIEW_AS env; admin key only; writes stay yours)
   --local            Pin the current directory (lotics org use / auth api-key)
   --all              (lotics auth logout) Remove every saved credential
   --version          Show version
@@ -279,7 +282,13 @@ function requireClient(flags) {
         console.error('Not authenticated. Run "lotics auth signup", "lotics auth api-key <key>", or set LOTICS_API_KEY.');
         process.exit(1);
     }
-    return { client: new LoticsClient({ apiKey: ctx.apiKey, workspaceId: ctx.workspaceId }), ctx };
+    // Admin "View as": flag wins over env. The server enforces admin-only; a
+    // non-admin key gets a clear 403 on the first request.
+    const viewAsMemberId = flags.viewAs ?? process.env.LOTICS_VIEW_AS;
+    return {
+        client: new LoticsClient({ apiKey: ctx.apiKey, workspaceId: ctx.workspaceId, viewAsMemberId }),
+        ctx,
+    };
 }
 const SOURCE_LABELS = {
     flag: "--api-key flag",
@@ -378,8 +387,9 @@ async function main() {
             const info = await client.whoami();
             const existing = loadGlobalConfig() ?? {};
             saveGlobalConfig({ ...existing, email: info.email });
+            const viewAs = flags.viewAs ?? process.env.LOTICS_VIEW_AS;
             if (flags.json) {
-                console.log(JSON.stringify({ ...info, workspace_id: ctx.workspaceId ?? null, source: ctx.source }, null, 2));
+                console.log(JSON.stringify({ ...info, workspace_id: ctx.workspaceId ?? null, source: ctx.source, view_as: viewAs ?? null }, null, 2));
             }
             else {
                 console.log(`Name:       ${info.name}`);
@@ -387,6 +397,8 @@ async function main() {
                 console.log(`Org:        ${info.organization_name} (${info.organization_id})`);
                 console.log(`Workspace:  ${ctx.workspaceId ?? "(none selected)"}`);
                 console.log(`Source:     ${SOURCE_LABELS[ctx.source]}`);
+                if (viewAs)
+                    console.log(`View as:    ${viewAs} (admin preview; requires an admin key)`);
             }
             return;
         }

package/dist/client.d.ts

@@ -22,6 +22,11 @@ export type AppQueryFilter = AppQueryFilterCondition | AppQueryFilterGroup;
 export interface LoticsClientOptions {
     apiKey: string;
     workspaceId?: string;
+    /** Admin "View as": when set, every request carries `x-view-as-member-id`, so
+     *  the backend evaluates IAM scoping (and `is_current_member`) as this member.
+     *  Admin-only — the server rejects a non-admin key. Writes stay attributed to
+     *  the key's owner. */
+    viewAsMemberId?: string;
 }
 export interface WorkspaceInfo {
     id: string;
@@ -56,6 +61,9 @@ export declare const API_BASE_URL: string;
 export declare class LoticsClient {
     private apiKey;
     private workspaceId;
+    /** The active "View as" target member id, if any. Read-only after
+     *  construction — surfaced so `lotics app dev` can show it in the banner. */
+    readonly viewAsMemberId: string | undefined;
     /** API URL the client is configured against. Read-only after construction.
      *  Surfaced for callers that need to display or log it (e.g., `lotics app dev`
      *  shows it in the banner). */
@@ -65,6 +73,7 @@ export declare class LoticsClient {
     private buildHeaders;
     private request;
     whoami(): Promise<{
+        member_id: string;
         email: string;
         name: string;
         organization_id: string;

package/dist/client.js

@@ -49,6 +49,9 @@ export const API_BASE_URL = process.env.LOTICS_API_URL ?? "https://api.lotics.ai
 export class LoticsClient {
     apiKey;
     workspaceId;
+    /** The active "View as" target member id, if any. Read-only after
+     *  construction — surfaced so `lotics app dev` can show it in the banner. */
+    viewAsMemberId;
     /** API URL the client is configured against. Read-only after construction.
      *  Surfaced for callers that need to display or log it (e.g., `lotics app dev`
      *  shows it in the banner). */
@@ -56,6 +59,7 @@ export class LoticsClient {
     constructor(options) {
         this.apiKey = options.apiKey;
         this.workspaceId = options.workspaceId;
+        this.viewAsMemberId = options.viewAsMemberId;
         this.baseUrl = API_BASE_URL;
     }
     async throwResponseError(response) {
@@ -77,6 +81,9 @@ export class LoticsClient {
         if (this.workspaceId) {
             headers["x-workspace-id"] = this.workspaceId;
         }
+        if (this.viewAsMemberId) {
+            headers["x-view-as-member-id"] = this.viewAsMemberId;
+        }
         return headers;
     }
     async request(method, path, body) {

package/dist/dev/rpc_handler.d.ts

@@ -6,10 +6,16 @@
  * { message }. Same shape as the production iframe-host's error path.
  */
 import { LoticsClient } from "../client.js";
-export type RpcOp = "query" | "workflow" | "members" | "upload_url" | "upload_complete";
+export type RpcOp = "query" | "workflow" | "members" | "context" | "upload_url" | "upload_complete";
 export interface RpcRequest {
     app_id: string;
     op: RpcOp;
     payload: unknown;
 }
-export declare function dispatchRpc(client: LoticsClient, body: RpcRequest): Promise<unknown>;
+/** Per-app facts the dev server knows from the local manifest that the
+ *  production iframe-host supplies from the embedding context. */
+export interface DispatchOptions {
+    /** From `package.json#lotics.capabilities.comments`. */
+    commentsEnabled?: boolean;
+}
+export declare function dispatchRpc(client: LoticsClient, body: RpcRequest, opts?: DispatchOptions): Promise<unknown>;

package/dist/dev/rpc_handler.js

@@ -9,10 +9,11 @@ const SUPPORTED_OPS = new Set([
     "query",
     "workflow",
     "members",
+    "context",
     "upload_url",
     "upload_complete",
 ]);
-export async function dispatchRpc(client, body) {
+export async function dispatchRpc(client, body, opts) {
     if (!body || typeof body.app_id !== "string" || typeof body.op !== "string") {
         throw new Error("RPC envelope must include app_id and op");
     }
@@ -20,6 +21,17 @@ export async function dispatchRpc(client, body) {
         throw new Error(`Unknown RPC op: ${body.op}`);
     }
     switch (body.op) {
+        case "context": {
+            // In production the iframe host supplies the context; here we resolve the
+            // effective viewer from the CLI key (the view-as target when the client
+            // carries `x-view-as-member-id`, else the key's owner), so `useViewer`
+            // and `is_current_member` agree in the dev loop.
+            const who = await client.whoami();
+            return {
+                member_id: who.member_id,
+                comments_enabled: opts?.commentsEnabled ?? false,
+            };
+        }
         case "query": {
             const p = body.payload;
             if (!p || typeof p.alias !== "string") {

package/dist/dev/rpc_handler.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/dev/rpc_handler.test.js

@@ -0,0 +1,28 @@
+import { describe, it, expect } from "vitest";
+import { dispatchRpc } from "./rpc_handler.js";
+function mockClient(over) {
+    return over;
+}
+const WHOAMI = {
+    member_id: "mbr_viewer",
+    email: "v@test.local",
+    name: "Viewer",
+    organization_id: "org_1",
+    organization_name: "Org",
+};
+describe("dispatchRpc — context op", () => {
+    it("resolves the viewer member_id from whoami + manifest comments_enabled", async () => {
+        const client = mockClient({ whoami: async () => WHOAMI });
+        const result = await dispatchRpc(client, { app_id: "app_x", op: "context", payload: {} }, { commentsEnabled: true });
+        expect(result).toEqual({ member_id: "mbr_viewer", comments_enabled: true });
+    });
+    it("defaults comments_enabled to false when the manifest declares none", async () => {
+        const client = mockClient({ whoami: async () => WHOAMI });
+        const result = await dispatchRpc(client, { app_id: "app_x", op: "context", payload: {} });
+        expect(result).toEqual({ member_id: "mbr_viewer", comments_enabled: false });
+    });
+    it("rejects an op that isn't supported", async () => {
+        const client = mockClient({});
+        await expect(dispatchRpc(client, { app_id: "app_x", op: "bogus", payload: {} })).rejects.toThrow(/Unknown RPC op/);
+    });
+});

package/dist/dev/server.d.ts

@@ -25,6 +25,9 @@ export interface DevServerArgs {
     /** Preferred Vite port. If taken, auto-picks a free one. */
     vitePort?: number;
     client: LoticsClient;
+    /** From `package.json#lotics.capabilities.comments` — fed to the `context` op
+     *  so `useComments` reflects the manifest in the dev loop. */
+    commentsEnabled?: boolean;
 }
 export interface DevServerHandle {
     port: number;

package/dist/dev/server.js

@@ -91,7 +91,7 @@ export async function startDevServer(args) {
                     app_id: body.app_id,
                     op: body.op,
                     payload: body.payload,
-                });
+                }, { commentsEnabled: args.commentsEnabled });
                 const ms = Date.now() - startedAt;
                 process.stderr.write(`[rpc] ${body.op} ${ms}ms\n`);
                 res.writeHead(200, { "Content-Type": "application/json" });

package/dist/dev/wrapper_page.d.ts

@@ -8,7 +8,9 @@
  * wrapper (different port), so the app gets its own real origin (and Web
  * Storage) without being able to reach the wrapper. `allow-downloads` lets
  * apps trigger file downloads (generated xlsx / pdf etc.) — Chrome blocks
- * every download path from sandboxed iframes without it. The iframe sends postMessage RPCs to
+ * every download path from sandboxed iframes without it. `allow="...; geolocation"`
+ * delegates the host's location permission to the app so geofenced actions can
+ * read the device position — matching production. The iframe sends postMessage RPCs to
  * this wrapper, which forwards them to the local /_rpc endpoint, which
  * dispatches to api.lotics.ai with the CLI's API key.
  *

package/dist/dev/wrapper_page.js

@@ -8,7 +8,9 @@
  * wrapper (different port), so the app gets its own real origin (and Web
  * Storage) without being able to reach the wrapper. `allow-downloads` lets
  * apps trigger file downloads (generated xlsx / pdf etc.) — Chrome blocks
- * every download path from sandboxed iframes without it. The iframe sends postMessage RPCs to
+ * every download path from sandboxed iframes without it. `allow="...; geolocation"`
+ * delegates the host's location permission to the app so geofenced actions can
+ * read the device position — matching production. The iframe sends postMessage RPCs to
  * this wrapper, which forwards them to the local /_rpc endpoint, which
  * dispatches to api.lotics.ai with the CLI's API key.
  *
@@ -60,7 +62,7 @@ export function buildWrapperPage(args) {
     <span>workspace <code>${escapeHtml(workspace_id)}</code></span>
     <span>RPC → <code>${escapeHtml(api_url)}</code></span>
   </header>
-  <iframe id="app" sandbox="allow-scripts allow-same-origin allow-downloads" allow="clipboard-write"></iframe>
+  <iframe id="app" sandbox="allow-scripts allow-same-origin allow-downloads" allow="clipboard-write; geolocation"></iframe>
   <script>
     (function () {
       const APP_ID = ${JSON.stringify(app_id)};

package/dist/src/cli.js

@@ -29625,6 +29625,9 @@ var API_BASE_URL = process.env.LOTICS_API_URL ?? "https://api.lotics.ai";
 var LoticsClient = class {
   apiKey;
   workspaceId;
+  /** The active "View as" target member id, if any. Read-only after
+   *  construction — surfaced so `lotics app dev` can show it in the banner. */
+  viewAsMemberId;
   /** API URL the client is configured against. Read-only after construction.
    *  Surfaced for callers that need to display or log it (e.g., `lotics app dev`
    *  shows it in the banner). */
@@ -29632,6 +29635,7 @@ var LoticsClient = class {
   constructor(options) {
     this.apiKey = options.apiKey;
     this.workspaceId = options.workspaceId;
+    this.viewAsMemberId = options.viewAsMemberId;
     this.baseUrl = API_BASE_URL;
   }
   async throwResponseError(response) {
@@ -29652,6 +29656,9 @@ var LoticsClient = class {
     if (this.workspaceId) {
       headers["x-workspace-id"] = this.workspaceId;
     }
+    if (this.viewAsMemberId) {
+      headers["x-view-as-member-id"] = this.viewAsMemberId;
+    }
     return headers;
   }
   async request(method, path7, body) {
@@ -30642,10 +30649,11 @@ var SUPPORTED_OPS = /* @__PURE__ */ new Set([
   "query",
   "workflow",
   "members",
+  "context",
   "upload_url",
   "upload_complete"
 ]);
-async function dispatchRpc(client, body) {
+async function dispatchRpc(client, body, opts) {
   if (!body || typeof body.app_id !== "string" || typeof body.op !== "string") {
     throw new Error("RPC envelope must include app_id and op");
   }
@@ -30653,6 +30661,13 @@ async function dispatchRpc(client, body) {
     throw new Error(`Unknown RPC op: ${body.op}`);
   }
   switch (body.op) {
+    case "context": {
+      const who = await client.whoami();
+      return {
+        member_id: who.member_id,
+        comments_enabled: opts?.commentsEnabled ?? false
+      };
+    }
     case "query": {
       const p = body.payload;
       if (!p || typeof p.alias !== "string") {
@@ -30751,7 +30766,7 @@ function buildWrapperPage(args) {
     <span>workspace <code>${escapeHtml2(workspace_id)}</code></span>
     <span>RPC \u2192 <code>${escapeHtml2(api_url)}</code></span>
   </header>
-  <iframe id="app" sandbox="allow-scripts allow-same-origin allow-downloads" allow="clipboard-write"></iframe>
+  <iframe id="app" sandbox="allow-scripts allow-same-origin allow-downloads" allow="clipboard-write; geolocation"></iframe>
   <script>
     (function () {
       const APP_ID = ${JSON.stringify(app_id)};
@@ -30943,11 +30958,15 @@ async function startDevServer(args) {
       try {
         const body = await readJson(req);
         const startedAt = Date.now();
-        const result = await dispatchRpc(args.client, {
-          app_id: body.app_id,
-          op: body.op,
-          payload: body.payload
-        });
+        const result = await dispatchRpc(
+          args.client,
+          {
+            app_id: body.app_id,
+            op: body.op,
+            payload: body.payload
+          },
+          { commentsEnabled: args.commentsEnabled }
+        );
         const ms = Date.now() - startedAt;
         process.stderr.write(`[rpc] ${body.op} ${ms}ms
 `);
@@ -31469,7 +31488,8 @@ async function appDev(client, args) {
     api_url: client.baseUrl,
     port: args.port,
     vitePort: args.vitePort,
-    client
+    client,
+    commentsEnabled: meta.capabilities?.comments
   });
   await handle.ready;
   const url = `http://localhost:${handle.port}`;
@@ -31477,6 +31497,9 @@ async function appDev(client, args) {
   lotics app dev`);
   console.error(`  app:       ${app.name} (${meta.app_id})`);
   console.error(`  workspace: ${meta.workspace_id}`);
+  if (client.viewAsMemberId) {
+    console.error(`  view as:   ${client.viewAsMemberId} (is_current_member resolves to this member)`);
+  }
   console.error(`  vite:      http://localhost:${handle.vitePort}/`);
   console.error(`  open:      ${url}`);
   console.error(`  rpc:       ${client.baseUrl} (via Bearer API key)
@@ -31506,6 +31529,7 @@ function parseArgs(argv) {
     as: void 0,
     apiKey: void 0,
     workspace: void 0,
+    viewAs: void 0,
     name: void 0,
     timezone: void 0,
     message: void 0,
@@ -31543,6 +31567,9 @@ function parseArgs(argv) {
       case "-w":
         flags.workspace = argv[++i];
         break;
+      case "--view-as":
+        flags.viewAs = argv[++i];
+        break;
       case "--name":
         flags.name = argv[++i];
         break;
@@ -47363,6 +47390,9 @@ FLAGS
   --as <name>        Override upload filename
   --api-key <key>    One-off API key (overrides saved config + env)
   --workspace <id>   One-off workspace override (alias: -w)
+  --view-as <id>     Admin "View as": run every request as this member, so
+                     is_current_member / row-scoping resolve to them (also
+                     LOTICS_VIEW_AS env; admin key only; writes stay yours)
   --local            Pin the current directory (lotics org use / auth api-key)
   --all              (lotics auth logout) Remove every saved credential
   --version          Show version
@@ -47545,7 +47575,11 @@ function requireClient(flags) {
     console.error('Not authenticated. Run "lotics auth signup", "lotics auth api-key <key>", or set LOTICS_API_KEY.');
     process.exit(1);
   }
-  return { client: new LoticsClient({ apiKey: ctx.apiKey, workspaceId: ctx.workspaceId }), ctx };
+  const viewAsMemberId = flags.viewAs ?? process.env.LOTICS_VIEW_AS;
+  return {
+    client: new LoticsClient({ apiKey: ctx.apiKey, workspaceId: ctx.workspaceId, viewAsMemberId }),
+    ctx
+  };
 }
 var SOURCE_LABELS = {
   flag: "--api-key flag",
@@ -47635,14 +47669,16 @@ async function main() {
       const info = await client2.whoami();
       const existing = loadGlobalConfig() ?? {};
       saveGlobalConfig({ ...existing, email: info.email });
+      const viewAs = flags.viewAs ?? process.env.LOTICS_VIEW_AS;
       if (flags.json) {
-        console.log(JSON.stringify({ ...info, workspace_id: ctx2.workspaceId ?? null, source: ctx2.source }, null, 2));
+        console.log(JSON.stringify({ ...info, workspace_id: ctx2.workspaceId ?? null, source: ctx2.source, view_as: viewAs ?? null }, null, 2));
       } else {
         console.log(`Name:       ${info.name}`);
         console.log(`Email:      ${info.email}`);
         console.log(`Org:        ${info.organization_name} (${info.organization_id})`);
         console.log(`Workspace:  ${ctx2.workspaceId ?? "(none selected)"}`);
         console.log(`Source:     ${SOURCE_LABELS[ctx2.source]}`);
+        if (viewAs) console.log(`View as:    ${viewAs} (admin preview; requires an admin key)`);
       }
       return;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {