@lotics/cli 0.44.2 → 0.45.1

package/dist/client.d.ts

@@ -218,6 +218,17 @@ export declare class LoticsClient {
             thumbnail_url?: string;
         };
     }>;
+    appGetRecordComments(app_id: string, record_id: string): Promise<unknown[]>;
+    appCreateRecordComment(app_id: string, record_id: string, body: {
+        content: string;
+        file_ids?: string[];
+    }): Promise<unknown>;
+    appUpdateRecordComment(app_id: string, record_id: string, comment_id: string, body: {
+        content: string;
+        files?: unknown[];
+    }): Promise<unknown>;
+    appDeleteRecordComment(app_id: string, record_id: string, comment_id: string): Promise<void>;
+    appGetTableCommentCounts(app_id: string, table_id: string): Promise<Record<string, number>>;
     deployAppVersion(args: {
         app_id: string;
         source_archive: Buffer;

package/dist/client.js

@@ -208,6 +208,24 @@ export class LoticsClient {
     async appCompleteFileUpload(app_id, body) {
         return this.request("POST", `/v1/apps/${encodeURIComponent(app_id)}/files/complete`, body);
     }
+    // App-scoped record comments — the `lotics app dev` loop forwards the iframe's
+    // `comments.*` ops to these (production routes them through the iframe host).
+    // App authority + tenant floor are enforced server-side; these are thin.
+    async appGetRecordComments(app_id, record_id) {
+        return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments`);
+    }
+    async appCreateRecordComment(app_id, record_id, body) {
+        return this.request("POST", `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments`, body);
+    }
+    async appUpdateRecordComment(app_id, record_id, comment_id, body) {
+        return this.request("PATCH", `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments/${encodeURIComponent(comment_id)}`, body);
+    }
+    async appDeleteRecordComment(app_id, record_id, comment_id) {
+        await this.request("DELETE", `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments/${encodeURIComponent(comment_id)}`);
+    }
+    async appGetTableCommentCounts(app_id, table_id) {
+        return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/tables/${encodeURIComponent(table_id)}/comment-counts`);
+    }
     async deployAppVersion(args) {
         const formData = new FormData();
         // Wrap Buffers as Uint8Array views so the Blob constructor accepts them

package/dist/dev/rpc_handler.d.ts

@@ -6,7 +6,7 @@
  * { message }. Same shape as the production iframe-host's error path.
  */
 import { LoticsClient } from "../client.js";
-export type RpcOp = "query" | "workflow" | "members" | "context" | "upload_url" | "upload_complete";
+export type RpcOp = "query" | "workflow" | "members" | "context" | "upload_url" | "upload_complete" | "comments.list" | "comments.create" | "comments.update" | "comments.delete" | "comments.counts";
 export interface RpcRequest {
     app_id: string;
     op: RpcOp;

package/dist/dev/rpc_handler.js

@@ -12,6 +12,11 @@ const SUPPORTED_OPS = new Set([
     "context",
     "upload_url",
     "upload_complete",
+    "comments.list",
+    "comments.create",
+    "comments.update",
+    "comments.delete",
+    "comments.counts",
 ]);
 export async function dispatchRpc(client, body, opts) {
     if (!body || typeof body.app_id !== "string" || typeof body.op !== "string") {
@@ -86,6 +91,57 @@ export async function dispatchRpc(client, body, opts) {
                 filename: p.filename,
             });
         }
+        // Comment ops mirror the production iframe-host's `handleCommentRpc` return
+        // shapes so the SDK hooks behave identically in dev. App authority + the
+        // `comments` capability + tenant floor are enforced server-side.
+        case "comments.list": {
+            const p = body.payload;
+            if (!p || typeof p.record_id !== "string") {
+                throw new Error("comments.list payload must include record_id");
+            }
+            const comments = await client.appGetRecordComments(body.app_id, p.record_id);
+            return { comments };
+        }
+        case "comments.create": {
+            const p = body.payload;
+            if (!p || typeof p.record_id !== "string" || typeof p.content !== "string") {
+                throw new Error("comments.create payload must include record_id and content");
+            }
+            const created = await client.appCreateRecordComment(body.app_id, p.record_id, {
+                content: p.content,
+                file_ids: p.file_ids,
+            });
+            return { comments: created ? [created] : [] };
+        }
+        case "comments.update": {
+            const p = body.payload;
+            if (!p ||
+                typeof p.record_id !== "string" ||
+                typeof p.comment_id !== "string" ||
+                typeof p.content !== "string") {
+                throw new Error("comments.update payload must include record_id, comment_id, content");
+            }
+            const comment = await client.appUpdateRecordComment(body.app_id, p.record_id, p.comment_id, {
+                content: p.content,
+                files: p.files,
+            });
+            return { comment };
+        }
+        case "comments.delete": {
+            const p = body.payload;
+            if (!p || typeof p.record_id !== "string" || typeof p.comment_id !== "string") {
+                throw new Error("comments.delete payload must include record_id and comment_id");
+            }
+            await client.appDeleteRecordComment(body.app_id, p.record_id, p.comment_id);
+            return undefined;
+        }
+        case "comments.counts": {
+            const p = body.payload;
+            if (!p || typeof p.table_id !== "string") {
+                throw new Error("comments.counts payload must include table_id");
+            }
+            return client.appGetTableCommentCounts(body.app_id, p.table_id);
+        }
         default: {
             // Unreachable — SUPPORTED_OPS gates above.
             throw new Error(`Unhandled RPC op: ${body.op}`);

package/dist/dev/rpc_handler.test.js

@@ -1,5 +1,6 @@
 import { describe, it, expect } from "vitest";
 import { dispatchRpc } from "./rpc_handler.js";
+import { serializeRpcResult } from "./server.js";
 function mockClient(over) {
     return over;
 }
@@ -26,3 +27,42 @@ describe("dispatchRpc — context op", () => {
         await expect(dispatchRpc(client, { app_id: "app_x", op: "bogus", payload: {} })).rejects.toThrow(/Unknown RPC op/);
     });
 });
+describe("dispatchRpc — comment ops", () => {
+    it("comments.list forwards to appGetRecordComments, wrapped as { comments }", async () => {
+        const comments = [{ id: "cmt_1", content: "hi" }];
+        const client = mockClient({ appGetRecordComments: async () => comments });
+        const result = await dispatchRpc(client, {
+            app_id: "app_x",
+            op: "comments.list",
+            payload: { record_id: "rec_1" },
+        });
+        expect(result).toEqual({ comments });
+    });
+    it("comments.counts forwards to appGetTableCommentCounts (counts, no content)", async () => {
+        const counts = { rec_1: 2, rec_2: 1 };
+        const client = mockClient({ appGetTableCommentCounts: async () => counts });
+        const result = await dispatchRpc(client, {
+            app_id: "app_x",
+            op: "comments.counts",
+            payload: { table_id: "tbl_1" },
+        });
+        expect(result).toEqual(counts);
+    });
+    it("requires the right payload per comment op", async () => {
+        const client = mockClient({
+            appGetRecordComments: async () => [],
+            appGetTableCommentCounts: async () => ({}),
+        });
+        await expect(dispatchRpc(client, { app_id: "app_x", op: "comments.list", payload: {} })).rejects.toThrow(/record_id/);
+        await expect(dispatchRpc(client, { app_id: "app_x", op: "comments.counts", payload: {} })).rejects.toThrow(/table_id/);
+    });
+});
+describe("serializeRpcResult — every RPC response body is valid JSON", () => {
+    it("serializes a void result (comments.delete) as null, never an empty body", () => {
+        expect(serializeRpcResult(undefined)).toBe("null");
+        expect(JSON.parse(serializeRpcResult(undefined))).toBeNull();
+    });
+    it("passes object results through", () => {
+        expect(JSON.parse(serializeRpcResult({ comments: [] }))).toEqual({ comments: [] });
+    });
+});

package/dist/dev/server.d.ts

@@ -37,6 +37,15 @@ export interface DevServerHandle {
     /** Stops Vite + HTTP server. Safe to call multiple times. */
     stop: () => Promise<void>;
 }
+/**
+ * Serialize an RPC result for the HTTP response body. Ops with no return
+ * value (e.g. comments.delete) resolve `undefined` — in production they
+ * travel over postMessage where undefined structured-clones fine, but
+ * `JSON.stringify(undefined)` is not a string, so the body would be EMPTY
+ * and the wrapper's `JSON.parse` throws "Unexpected end of JSON input".
+ * Serialize those as `null`.
+ */
+export declare function serializeRpcResult(result: unknown): string;
 export declare function startDevServer(args: DevServerArgs): Promise<DevServerHandle>;
 /** Used by the CLI command for cross-platform `open <url>`. Best-effort —
  *  if the platform opener isn't installed (common in WSL, headless CI, some

package/dist/dev/server.js

@@ -18,6 +18,17 @@ import { dispatchRpc } from "./rpc_handler.js";
 import { buildWrapperPage } from "./wrapper_page.js";
 const DEFAULT_PORT = 5174;
 const DEFAULT_VITE_PORT = 5173;
+/**
+ * Serialize an RPC result for the HTTP response body. Ops with no return
+ * value (e.g. comments.delete) resolve `undefined` — in production they
+ * travel over postMessage where undefined structured-clones fine, but
+ * `JSON.stringify(undefined)` is not a string, so the body would be EMPTY
+ * and the wrapper's `JSON.parse` throws "Unexpected end of JSON input".
+ * Serialize those as `null`.
+ */
+export function serializeRpcResult(result) {
+    return JSON.stringify(result ?? null);
+}
 export async function startDevServer(args) {
     const wrapperPort = await pickPort(args.port ?? DEFAULT_PORT);
     const vitePort = await pickPort(args.vitePort ?? DEFAULT_VITE_PORT, wrapperPort);
@@ -95,7 +106,7 @@ export async function startDevServer(args) {
                 const ms = Date.now() - startedAt;
                 process.stderr.write(`[rpc] ${body.op} ${ms}ms\n`);
                 res.writeHead(200, { "Content-Type": "application/json" });
-                res.end(JSON.stringify(result));
+                res.end(serializeRpcResult(result));
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);

package/dist/src/cli.js

@@ -29801,6 +29801,41 @@ var LoticsClient = class {
       body
     );
   }
+  // App-scoped record comments — the `lotics app dev` loop forwards the iframe's
+  // `comments.*` ops to these (production routes them through the iframe host).
+  // App authority + tenant floor are enforced server-side; these are thin.
+  async appGetRecordComments(app_id, record_id) {
+    return this.request(
+      "GET",
+      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments`
+    );
+  }
+  async appCreateRecordComment(app_id, record_id, body) {
+    return this.request(
+      "POST",
+      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments`,
+      body
+    );
+  }
+  async appUpdateRecordComment(app_id, record_id, comment_id, body) {
+    return this.request(
+      "PATCH",
+      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments/${encodeURIComponent(comment_id)}`,
+      body
+    );
+  }
+  async appDeleteRecordComment(app_id, record_id, comment_id) {
+    await this.request(
+      "DELETE",
+      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments/${encodeURIComponent(comment_id)}`
+    );
+  }
+  async appGetTableCommentCounts(app_id, table_id) {
+    return this.request(
+      "GET",
+      `/v1/apps/${encodeURIComponent(app_id)}/tables/${encodeURIComponent(table_id)}/comment-counts`
+    );
+  }
   async deployAppVersion(args) {
     const formData = new FormData();
     formData.append(
@@ -30179,7 +30214,7 @@ import { spawn as spawn2 } from "node:child_process";
 import { tmpdir } from "node:os";
 
 // src/starter_template.ts
-var STARTER_FALLBACK_UI_VERSION = "1.8.0";
+var STARTER_FALLBACK_UI_VERSION = "2.3.0";
 var STARTER_FALLBACK_SDK_VERSION = "0.11.0";
 var STARTER_REACT_NATIVE_VERSION = "0.85.3";
 function buildStarterTemplate(args) {
@@ -30691,7 +30726,12 @@ var SUPPORTED_OPS = /* @__PURE__ */ new Set([
   "members",
   "context",
   "upload_url",
-  "upload_complete"
+  "upload_complete",
+  "comments.list",
+  "comments.create",
+  "comments.update",
+  "comments.delete",
+  "comments.counts"
 ]);
 async function dispatchRpc(client, body, opts) {
   if (!body || typeof body.app_id !== "string" || typeof body.op !== "string") {
@@ -30758,6 +30798,54 @@ async function dispatchRpc(client, body, opts) {
         filename: p.filename
       });
     }
+    // Comment ops mirror the production iframe-host's `handleCommentRpc` return
+    // shapes so the SDK hooks behave identically in dev. App authority + the
+    // `comments` capability + tenant floor are enforced server-side.
+    case "comments.list": {
+      const p = body.payload;
+      if (!p || typeof p.record_id !== "string") {
+        throw new Error("comments.list payload must include record_id");
+      }
+      const comments = await client.appGetRecordComments(body.app_id, p.record_id);
+      return { comments };
+    }
+    case "comments.create": {
+      const p = body.payload;
+      if (!p || typeof p.record_id !== "string" || typeof p.content !== "string") {
+        throw new Error("comments.create payload must include record_id and content");
+      }
+      const created = await client.appCreateRecordComment(body.app_id, p.record_id, {
+        content: p.content,
+        file_ids: p.file_ids
+      });
+      return { comments: created ? [created] : [] };
+    }
+    case "comments.update": {
+      const p = body.payload;
+      if (!p || typeof p.record_id !== "string" || typeof p.comment_id !== "string" || typeof p.content !== "string") {
+        throw new Error("comments.update payload must include record_id, comment_id, content");
+      }
+      const comment = await client.appUpdateRecordComment(body.app_id, p.record_id, p.comment_id, {
+        content: p.content,
+        files: p.files
+      });
+      return { comment };
+    }
+    case "comments.delete": {
+      const p = body.payload;
+      if (!p || typeof p.record_id !== "string" || typeof p.comment_id !== "string") {
+        throw new Error("comments.delete payload must include record_id and comment_id");
+      }
+      await client.appDeleteRecordComment(body.app_id, p.record_id, p.comment_id);
+      return void 0;
+    }
+    case "comments.counts": {
+      const p = body.payload;
+      if (!p || typeof p.table_id !== "string") {
+        throw new Error("comments.counts payload must include table_id");
+      }
+      return client.appGetTableCommentCounts(body.app_id, p.table_id);
+    }
     default: {
       throw new Error(`Unhandled RPC op: ${body.op}`);
     }
@@ -30944,6 +31032,9 @@ function escapeHtml2(s) {
 // src/dev/server.ts
 var DEFAULT_PORT = 5174;
 var DEFAULT_VITE_PORT = 5173;
+function serializeRpcResult(result) {
+  return JSON.stringify(result ?? null);
+}
 async function startDevServer(args) {
   const wrapperPort = await pickPort(args.port ?? DEFAULT_PORT);
   const vitePort = await pickPort(args.vitePort ?? DEFAULT_VITE_PORT, wrapperPort);
@@ -31011,7 +31102,7 @@ async function startDevServer(args) {
         process.stderr.write(`[rpc] ${body.op} ${ms}ms
 `);
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(result));
+        res.end(serializeRpcResult(result));
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : String(err2);
         process.stderr.write(`[rpc] ERROR ${message}
@@ -39484,7 +39575,7 @@ function parseSheetData(worksheet, styles, sharedStrings, hyperlinkMap, defaultR
     if (outlineLevel > 0) {
       rowOutlineLevels.set(rowIndex, outlineLevel);
     }
-    if (rowEl["@_hidden"] === "1" || rowEl["@_hidden"] === "true") continue;
+    const rowHidden = rowEl["@_hidden"] === "1" || rowEl["@_hidden"] === "true";
     rowCount++;
     if (rowCount > maxRows) continue;
     const height = rowEl["@_ht"] ? parseFloat(rowEl["@_ht"]) : defaultRowHeight;
@@ -39496,7 +39587,7 @@ function parseSheetData(worksheet, styles, sharedStrings, hyperlinkMap, defaultR
         if (parsed) {
           cells.push(parsed);
           if (parsed.column > maxCol) maxCol = parsed.column;
-          if (rowCount <= 200) {
+          if (rowCount <= 200 && !rowHidden) {
             const currentMax = maxContentWidth.get(parsed.column) ?? 0;
             if (parsed.value.length > currentMax) {
               maxContentWidth.set(parsed.column, parsed.value.length);
@@ -39509,7 +39600,7 @@ function parseSheetData(worksheet, styles, sharedStrings, hyperlinkMap, defaultR
       index: rowIndex,
       height,
       cells,
-      hidden: false
+      hidden: rowHidden
     });
   }
   return {

package/dist/starter_template.d.ts

@@ -39,7 +39,7 @@ export interface StarterFile {
  * scaffolds resolve the live version via `fetchLatestNpmVersion` and only
  * fall back here when the lookup fails.
  */
-export declare const STARTER_FALLBACK_UI_VERSION = "1.8.0";
+export declare const STARTER_FALLBACK_UI_VERSION = "2.3.0";
 export declare const STARTER_FALLBACK_SDK_VERSION = "0.11.0";
 /**
  * react-native pin for scaffolded apps. Matches the monorepo frontend's pin so

package/dist/starter_template.js

@@ -35,7 +35,7 @@
  * scaffolds resolve the live version via `fetchLatestNpmVersion` and only
  * fall back here when the lookup fails.
  */
-export const STARTER_FALLBACK_UI_VERSION = "1.8.0";
+export const STARTER_FALLBACK_UI_VERSION = "2.3.0";
 export const STARTER_FALLBACK_SDK_VERSION = "0.11.0";
 /**
  * react-native pin for scaffolded apps. Matches the monorepo frontend's pin so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.44.2",
+  "version": "0.45.1",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {
@@ -41,4 +41,4 @@
     "url": "https://github.com/lotics/lotics.git",
     "directory": "packages/sdk"
   }
-}
+}