@lotics/cli 0.44.1 → 0.45.0

package/dist/client.d.ts

@@ -218,6 +218,17 @@ export declare class LoticsClient {
             thumbnail_url?: string;
         };
     }>;
+    appGetRecordComments(app_id: string, record_id: string): Promise<unknown[]>;
+    appCreateRecordComment(app_id: string, record_id: string, body: {
+        content: string;
+        file_ids?: string[];
+    }): Promise<unknown>;
+    appUpdateRecordComment(app_id: string, record_id: string, comment_id: string, body: {
+        content: string;
+        files?: unknown[];
+    }): Promise<unknown>;
+    appDeleteRecordComment(app_id: string, record_id: string, comment_id: string): Promise<void>;
+    appGetTableCommentCounts(app_id: string, table_id: string): Promise<Record<string, number>>;
     deployAppVersion(args: {
         app_id: string;
         source_archive: Buffer;

package/dist/client.js

@@ -208,6 +208,24 @@ export class LoticsClient {
     async appCompleteFileUpload(app_id, body) {
         return this.request("POST", `/v1/apps/${encodeURIComponent(app_id)}/files/complete`, body);
     }
+    // App-scoped record comments — the `lotics app dev` loop forwards the iframe's
+    // `comments.*` ops to these (production routes them through the iframe host).
+    // App authority + tenant floor are enforced server-side; these are thin.
+    async appGetRecordComments(app_id, record_id) {
+        return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments`);
+    }
+    async appCreateRecordComment(app_id, record_id, body) {
+        return this.request("POST", `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments`, body);
+    }
+    async appUpdateRecordComment(app_id, record_id, comment_id, body) {
+        return this.request("PATCH", `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments/${encodeURIComponent(comment_id)}`, body);
+    }
+    async appDeleteRecordComment(app_id, record_id, comment_id) {
+        await this.request("DELETE", `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments/${encodeURIComponent(comment_id)}`);
+    }
+    async appGetTableCommentCounts(app_id, table_id) {
+        return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/tables/${encodeURIComponent(table_id)}/comment-counts`);
+    }
     async deployAppVersion(args) {
         const formData = new FormData();
         // Wrap Buffers as Uint8Array views so the Blob constructor accepts them

package/dist/dev/rpc_handler.d.ts

@@ -6,7 +6,7 @@
  * { message }. Same shape as the production iframe-host's error path.
  */
 import { LoticsClient } from "../client.js";
-export type RpcOp = "query" | "workflow" | "members" | "context" | "upload_url" | "upload_complete";
+export type RpcOp = "query" | "workflow" | "members" | "context" | "upload_url" | "upload_complete" | "comments.list" | "comments.create" | "comments.update" | "comments.delete" | "comments.counts";
 export interface RpcRequest {
     app_id: string;
     op: RpcOp;

package/dist/dev/rpc_handler.js

@@ -12,6 +12,11 @@ const SUPPORTED_OPS = new Set([
     "context",
     "upload_url",
     "upload_complete",
+    "comments.list",
+    "comments.create",
+    "comments.update",
+    "comments.delete",
+    "comments.counts",
 ]);
 export async function dispatchRpc(client, body, opts) {
     if (!body || typeof body.app_id !== "string" || typeof body.op !== "string") {
@@ -86,6 +91,57 @@ export async function dispatchRpc(client, body, opts) {
                 filename: p.filename,
             });
         }
+        // Comment ops mirror the production iframe-host's `handleCommentRpc` return
+        // shapes so the SDK hooks behave identically in dev. App authority + the
+        // `comments` capability + tenant floor are enforced server-side.
+        case "comments.list": {
+            const p = body.payload;
+            if (!p || typeof p.record_id !== "string") {
+                throw new Error("comments.list payload must include record_id");
+            }
+            const comments = await client.appGetRecordComments(body.app_id, p.record_id);
+            return { comments };
+        }
+        case "comments.create": {
+            const p = body.payload;
+            if (!p || typeof p.record_id !== "string" || typeof p.content !== "string") {
+                throw new Error("comments.create payload must include record_id and content");
+            }
+            const created = await client.appCreateRecordComment(body.app_id, p.record_id, {
+                content: p.content,
+                file_ids: p.file_ids,
+            });
+            return { comments: created ? [created] : [] };
+        }
+        case "comments.update": {
+            const p = body.payload;
+            if (!p ||
+                typeof p.record_id !== "string" ||
+                typeof p.comment_id !== "string" ||
+                typeof p.content !== "string") {
+                throw new Error("comments.update payload must include record_id, comment_id, content");
+            }
+            const comment = await client.appUpdateRecordComment(body.app_id, p.record_id, p.comment_id, {
+                content: p.content,
+                files: p.files,
+            });
+            return { comment };
+        }
+        case "comments.delete": {
+            const p = body.payload;
+            if (!p || typeof p.record_id !== "string" || typeof p.comment_id !== "string") {
+                throw new Error("comments.delete payload must include record_id and comment_id");
+            }
+            await client.appDeleteRecordComment(body.app_id, p.record_id, p.comment_id);
+            return undefined;
+        }
+        case "comments.counts": {
+            const p = body.payload;
+            if (!p || typeof p.table_id !== "string") {
+                throw new Error("comments.counts payload must include table_id");
+            }
+            return client.appGetTableCommentCounts(body.app_id, p.table_id);
+        }
         default: {
             // Unreachable — SUPPORTED_OPS gates above.
             throw new Error(`Unhandled RPC op: ${body.op}`);

package/dist/dev/rpc_handler.test.js

@@ -26,3 +26,33 @@ describe("dispatchRpc — context op", () => {
         await expect(dispatchRpc(client, { app_id: "app_x", op: "bogus", payload: {} })).rejects.toThrow(/Unknown RPC op/);
     });
 });
+describe("dispatchRpc — comment ops", () => {
+    it("comments.list forwards to appGetRecordComments, wrapped as { comments }", async () => {
+        const comments = [{ id: "cmt_1", content: "hi" }];
+        const client = mockClient({ appGetRecordComments: async () => comments });
+        const result = await dispatchRpc(client, {
+            app_id: "app_x",
+            op: "comments.list",
+            payload: { record_id: "rec_1" },
+        });
+        expect(result).toEqual({ comments });
+    });
+    it("comments.counts forwards to appGetTableCommentCounts (counts, no content)", async () => {
+        const counts = { rec_1: 2, rec_2: 1 };
+        const client = mockClient({ appGetTableCommentCounts: async () => counts });
+        const result = await dispatchRpc(client, {
+            app_id: "app_x",
+            op: "comments.counts",
+            payload: { table_id: "tbl_1" },
+        });
+        expect(result).toEqual(counts);
+    });
+    it("requires the right payload per comment op", async () => {
+        const client = mockClient({
+            appGetRecordComments: async () => [],
+            appGetTableCommentCounts: async () => ({}),
+        });
+        await expect(dispatchRpc(client, { app_id: "app_x", op: "comments.list", payload: {} })).rejects.toThrow(/record_id/);
+        await expect(dispatchRpc(client, { app_id: "app_x", op: "comments.counts", payload: {} })).rejects.toThrow(/table_id/);
+    });
+});

package/dist/src/cli.js

@@ -29801,6 +29801,41 @@ var LoticsClient = class {
       body
     );
   }
+  // App-scoped record comments — the `lotics app dev` loop forwards the iframe's
+  // `comments.*` ops to these (production routes them through the iframe host).
+  // App authority + tenant floor are enforced server-side; these are thin.
+  async appGetRecordComments(app_id, record_id) {
+    return this.request(
+      "GET",
+      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments`
+    );
+  }
+  async appCreateRecordComment(app_id, record_id, body) {
+    return this.request(
+      "POST",
+      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments`,
+      body
+    );
+  }
+  async appUpdateRecordComment(app_id, record_id, comment_id, body) {
+    return this.request(
+      "PATCH",
+      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments/${encodeURIComponent(comment_id)}`,
+      body
+    );
+  }
+  async appDeleteRecordComment(app_id, record_id, comment_id) {
+    await this.request(
+      "DELETE",
+      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments/${encodeURIComponent(comment_id)}`
+    );
+  }
+  async appGetTableCommentCounts(app_id, table_id) {
+    return this.request(
+      "GET",
+      `/v1/apps/${encodeURIComponent(app_id)}/tables/${encodeURIComponent(table_id)}/comment-counts`
+    );
+  }
   async deployAppVersion(args) {
     const formData = new FormData();
     formData.append(
@@ -30179,7 +30214,7 @@ import { spawn as spawn2 } from "node:child_process";
 import { tmpdir } from "node:os";
 
 // src/starter_template.ts
-var STARTER_FALLBACK_UI_VERSION = "2.0.0";
+var STARTER_FALLBACK_UI_VERSION = "2.3.0";
 var STARTER_FALLBACK_SDK_VERSION = "0.11.0";
 var STARTER_REACT_NATIVE_VERSION = "0.85.3";
 function buildStarterTemplate(args) {
@@ -30322,14 +30357,34 @@ export default defineConfig({
     dedupe: ["react", "react-dom", "react-native-web"],
   },
   optimizeDeps: {
-    // Force-prebundle react-native-web: it does \`import normalizeColor from
-    // "@react-native/normalize-colors"\` (a nested CJS module). Un-prebundled,
-    // Vite's dev server serves that as ESM with no default export \u2192 "does not
-    // provide an export named 'default'" and a blank iframe the moment a
-    // colour-touching RN-Web component (DatePicker, Picker) mounts under
-    // \`lotics app dev\`. Prebundling folds its CJS deps into one interop'd chunk.
-    // The rollup build handles the interop on its own, so this is dev-only.
-    include: ["react-native-web"],
+    // \`recharts\` (used by @lotics/ui chart_* + sparkline) imports
+    // \`es-toolkit/compat/get\` as a default-export CJS module. Vite's dev
+    // server treats \`compat/*\` as ESM and won't synthesize a default,
+    // so \`import get from "es-toolkit/compat/get"\` fails to resolve.
+    // Pre-bundling forces Vite to convert it to an ESM shim with a default
+    // export. Production build (rollup) handles it correctly without this.
+    //
+    // react-native-web itself is force-prebundled (folds its core CJS deps like
+    // @react-native/normalize-colors into one interop'd chunk), and the deep
+    // subpaths it reaches via *default* imports (e.g. @react-native-picker's web
+    // <select> build) are each pre-bundled into an ESM shim \u2014 Vite's dev optimizer
+    // otherwise serves them without a synthesized default export ("does not
+    // provide an export named 'default'"), blanking the iframe. (Production/rollup
+    // resolves the interop already, so this is dev-only.)
+    include: [
+      "recharts", "es-toolkit", "es-toolkit/compat",
+      "react-native-web", "@react-native/normalize-colors",
+      "inline-style-prefixer/lib/createPrefixer",
+      "inline-style-prefixer/lib/plugins/crossFade",
+      "inline-style-prefixer/lib/plugins/imageSet",
+      "inline-style-prefixer/lib/plugins/logical",
+      "inline-style-prefixer/lib/plugins/position",
+      "inline-style-prefixer/lib/plugins/sizing",
+      "inline-style-prefixer/lib/plugins/transition",
+      "postcss-value-parser", "fbjs/lib/invariant", "fbjs/lib/warning",
+      "styleq", "styleq/transform-localize-style",
+      "react", "react-dom", "react-dom/client", "nullthrows",
+    ],
     // The dep optimizer pre-bundles deps with a SEPARATE esbuild pass that
     // top-level \`define\` doesn't always reach, so a pre-bundled RN dep can
     // still hit \`__DEV__ is not defined\` under \`lotics app dev\`. Define it
@@ -30671,7 +30726,12 @@ var SUPPORTED_OPS = /* @__PURE__ */ new Set([
   "members",
   "context",
   "upload_url",
-  "upload_complete"
+  "upload_complete",
+  "comments.list",
+  "comments.create",
+  "comments.update",
+  "comments.delete",
+  "comments.counts"
 ]);
 async function dispatchRpc(client, body, opts) {
   if (!body || typeof body.app_id !== "string" || typeof body.op !== "string") {
@@ -30738,6 +30798,54 @@ async function dispatchRpc(client, body, opts) {
         filename: p.filename
       });
     }
+    // Comment ops mirror the production iframe-host's `handleCommentRpc` return
+    // shapes so the SDK hooks behave identically in dev. App authority + the
+    // `comments` capability + tenant floor are enforced server-side.
+    case "comments.list": {
+      const p = body.payload;
+      if (!p || typeof p.record_id !== "string") {
+        throw new Error("comments.list payload must include record_id");
+      }
+      const comments = await client.appGetRecordComments(body.app_id, p.record_id);
+      return { comments };
+    }
+    case "comments.create": {
+      const p = body.payload;
+      if (!p || typeof p.record_id !== "string" || typeof p.content !== "string") {
+        throw new Error("comments.create payload must include record_id and content");
+      }
+      const created = await client.appCreateRecordComment(body.app_id, p.record_id, {
+        content: p.content,
+        file_ids: p.file_ids
+      });
+      return { comments: created ? [created] : [] };
+    }
+    case "comments.update": {
+      const p = body.payload;
+      if (!p || typeof p.record_id !== "string" || typeof p.comment_id !== "string" || typeof p.content !== "string") {
+        throw new Error("comments.update payload must include record_id, comment_id, content");
+      }
+      const comment = await client.appUpdateRecordComment(body.app_id, p.record_id, p.comment_id, {
+        content: p.content,
+        files: p.files
+      });
+      return { comment };
+    }
+    case "comments.delete": {
+      const p = body.payload;
+      if (!p || typeof p.record_id !== "string" || typeof p.comment_id !== "string") {
+        throw new Error("comments.delete payload must include record_id and comment_id");
+      }
+      await client.appDeleteRecordComment(body.app_id, p.record_id, p.comment_id);
+      return void 0;
+    }
+    case "comments.counts": {
+      const p = body.payload;
+      if (!p || typeof p.table_id !== "string") {
+        throw new Error("comments.counts payload must include table_id");
+      }
+      return client.appGetTableCommentCounts(body.app_id, p.table_id);
+    }
     default: {
       throw new Error(`Unhandled RPC op: ${body.op}`);
     }
@@ -39228,7 +39336,7 @@ var drawingParser = new XMLParser({
   processEntities: false,
   isArray: (tagName) => tagName === "xdr:twoCellAnchor" || tagName === "xdr:oneCellAnchor" || tagName === "Relationship"
 });
-function parseSheet(sheetXml, sheetRelsXml, styles, sharedStrings, theme, indexedColors, zipEntries, date1904) {
+function parseSheet(sheetXml, sheetRelsXml, styles, sharedStrings, theme, indexedColors, zipEntries, date1904, maxRows = MAX_ROWS_PER_SHEET) {
   const doc = xmlParser4.parse(sheetXml);
   const worksheet = doc?.["worksheet"];
   if (!worksheet) return emptySheet("Sheet");
@@ -39246,7 +39354,7 @@ function parseSheet(sheetXml, sheetRelsXml, styles, sharedStrings, theme, indexe
     maxCol,
     maxContentWidth,
     rowOutlineLevels
-  } = parseSheetData(worksheet, styles, sharedStrings, hyperlinkMap, defaultRowHeight, date1904);
+  } = parseSheetData(worksheet, styles, sharedStrings, hyperlinkMap, defaultRowHeight, date1904, maxRows);
   const colCount = Math.max(parsedCols.length > 0 ? parsedCols[parsedCols.length - 1].max : 0, maxCol);
   const columns = buildColumns(parsedCols, colHidden, maxContentWidth, colCount, defaultColWidth);
   const mergedCells = parseMergedCells(worksheet);
@@ -39428,7 +39536,7 @@ function buildColumns(colDefs, colHidden, maxContentWidth, colCount, _defaultCol
   }
   return columns;
 }
-function parseSheetData(worksheet, styles, sharedStrings, hyperlinkMap, defaultRowHeight, date1904) {
+function parseSheetData(worksheet, styles, sharedStrings, hyperlinkMap, defaultRowHeight, date1904, maxRows) {
   const sheetData = worksheet["sheetData"];
   if (!sheetData) {
     return {
@@ -39464,9 +39572,9 @@ function parseSheetData(worksheet, styles, sharedStrings, hyperlinkMap, defaultR
     if (outlineLevel > 0) {
       rowOutlineLevels.set(rowIndex, outlineLevel);
     }
-    if (rowEl["@_hidden"] === "1" || rowEl["@_hidden"] === "true") continue;
+    const rowHidden = rowEl["@_hidden"] === "1" || rowEl["@_hidden"] === "true";
     rowCount++;
-    if (rowCount > MAX_ROWS_PER_SHEET) continue;
+    if (rowCount > maxRows) continue;
     const height = rowEl["@_ht"] ? parseFloat(rowEl["@_ht"]) : defaultRowHeight;
     const cellArr = rowEl["c"];
     const cells = [];
@@ -39476,7 +39584,7 @@ function parseSheetData(worksheet, styles, sharedStrings, hyperlinkMap, defaultR
         if (parsed) {
           cells.push(parsed);
           if (parsed.column > maxCol) maxCol = parsed.column;
-          if (rowCount <= 200) {
+          if (rowCount <= 200 && !rowHidden) {
             const currentMax = maxContentWidth.get(parsed.column) ?? 0;
             if (parsed.value.length > currentMax) {
               maxContentWidth.set(parsed.column, parsed.value.length);
@@ -39489,13 +39597,13 @@ function parseSheetData(worksheet, styles, sharedStrings, hyperlinkMap, defaultR
       index: rowIndex,
       height,
       cells,
-      hidden: false
+      hidden: rowHidden
     });
   }
   return {
     rows,
     totalRowCount,
-    truncated: rowCount > MAX_ROWS_PER_SHEET,
+    truncated: rowCount > maxRows,
     maxCol,
     maxContentWidth,
     rowOutlineLevels
@@ -39537,10 +39645,12 @@ function parseCell(cellEl, styles, sharedStrings, hyperlinkMap, date1904) {
   if (fEl !== void 0 && fEl !== null) {
     if (typeof fEl === "object") {
       const fObj = fEl;
-      formula = fObj["#text"];
+      const text = fObj["#text"];
+      formula = text == null ? void 0 : String(text);
       if (fObj["@_t"] === "array") {
         isArrayFormula = true;
-        arrayRange = fObj["@_ref"];
+        const ref2 = fObj["@_ref"];
+        arrayRange = ref2 == null ? void 0 : String(ref2);
         if (formula?.startsWith("{") && formula.endsWith("}")) {
           formula = formula.slice(1, -1);
         }
@@ -41109,11 +41219,11 @@ function ensureVmlArray(val) {
 }
 
 // ../xlsx/src/excel_parser.ts
-function parseExcelBuffer(arrayBuffer) {
+function parseExcelBuffer(arrayBuffer, options) {
   const zip = unzipXlsx(arrayBuffer);
-  return parseExcelFromZip(zip);
+  return parseExcelFromZip(zip, options);
 }
-function parseExcelFromZip(zip) {
+function parseExcelFromZip(zip, options) {
   const themeEntry = findEntry(zip, "xl/theme/theme1.xml");
   const theme = themeEntry ? parseTheme(decodeUtf8(themeEntry)) : { colors: defaultThemeColors(), majorFont: "Calibri", minorFont: "Calibri" };
   const stylesEntry = findEntry(zip, "xl/styles.xml");
@@ -41175,7 +41285,8 @@ function parseExcelFromZip(zip) {
       theme,
       styles.indexedColors,
       zip,
-      workbookInfo.date1904
+      workbookInfo.date1904,
+      options?.maxRowsPerSheet
     );
     parsed.name = sheetInfo.name;
     if (isHidden) parsed.hidden = true;

package/dist/starter_template.d.ts

@@ -39,7 +39,7 @@ export interface StarterFile {
  * scaffolds resolve the live version via `fetchLatestNpmVersion` and only
  * fall back here when the lookup fails.
  */
-export declare const STARTER_FALLBACK_UI_VERSION = "2.0.0";
+export declare const STARTER_FALLBACK_UI_VERSION = "2.3.0";
 export declare const STARTER_FALLBACK_SDK_VERSION = "0.11.0";
 /**
  * react-native pin for scaffolded apps. Matches the monorepo frontend's pin so

package/dist/starter_template.js

@@ -35,7 +35,7 @@
  * scaffolds resolve the live version via `fetchLatestNpmVersion` and only
  * fall back here when the lookup fails.
  */
-export const STARTER_FALLBACK_UI_VERSION = "2.0.0";
+export const STARTER_FALLBACK_UI_VERSION = "2.3.0";
 export const STARTER_FALLBACK_SDK_VERSION = "0.11.0";
 /**
  * react-native pin for scaffolded apps. Matches the monorepo frontend's pin so
@@ -184,14 +184,34 @@ export default defineConfig({
     dedupe: ["react", "react-dom", "react-native-web"],
   },
   optimizeDeps: {
-    // Force-prebundle react-native-web: it does \`import normalizeColor from
-    // "@react-native/normalize-colors"\` (a nested CJS module). Un-prebundled,
-    // Vite's dev server serves that as ESM with no default export → "does not
-    // provide an export named 'default'" and a blank iframe the moment a
-    // colour-touching RN-Web component (DatePicker, Picker) mounts under
-    // \`lotics app dev\`. Prebundling folds its CJS deps into one interop'd chunk.
-    // The rollup build handles the interop on its own, so this is dev-only.
-    include: ["react-native-web"],
+    // \`recharts\` (used by @lotics/ui chart_* + sparkline) imports
+    // \`es-toolkit/compat/get\` as a default-export CJS module. Vite's dev
+    // server treats \`compat/*\` as ESM and won't synthesize a default,
+    // so \`import get from "es-toolkit/compat/get"\` fails to resolve.
+    // Pre-bundling forces Vite to convert it to an ESM shim with a default
+    // export. Production build (rollup) handles it correctly without this.
+    //
+    // react-native-web itself is force-prebundled (folds its core CJS deps like
+    // @react-native/normalize-colors into one interop'd chunk), and the deep
+    // subpaths it reaches via *default* imports (e.g. @react-native-picker's web
+    // <select> build) are each pre-bundled into an ESM shim — Vite's dev optimizer
+    // otherwise serves them without a synthesized default export ("does not
+    // provide an export named 'default'"), blanking the iframe. (Production/rollup
+    // resolves the interop already, so this is dev-only.)
+    include: [
+      "recharts", "es-toolkit", "es-toolkit/compat",
+      "react-native-web", "@react-native/normalize-colors",
+      "inline-style-prefixer/lib/createPrefixer",
+      "inline-style-prefixer/lib/plugins/crossFade",
+      "inline-style-prefixer/lib/plugins/imageSet",
+      "inline-style-prefixer/lib/plugins/logical",
+      "inline-style-prefixer/lib/plugins/position",
+      "inline-style-prefixer/lib/plugins/sizing",
+      "inline-style-prefixer/lib/plugins/transition",
+      "postcss-value-parser", "fbjs/lib/invariant", "fbjs/lib/warning",
+      "styleq", "styleq/transform-localize-style",
+      "react", "react-dom", "react-dom/client", "nullthrows",
+    ],
     // The dep optimizer pre-bundles deps with a SEPARATE esbuild pass that
     // top-level \`define\` doesn't always reach, so a pre-bundled RN dep can
     // still hit \`__DEV__ is not defined\` under \`lotics app dev\`. Define it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.44.1",
+  "version": "0.45.0",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {