@lotics/cli 0.88.0 → 0.89.1

package/dist/config.test.js

@@ -1,319 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
-import { loadConfig, saveConfig, deleteConfig, getConfigPath, loadGlobalConfig, resolveContext, resolveProfileByNameOrId, upsertProfile, removeProfile, setActiveOrg, setSelectedWorkspace, } from "./config.js";
-/**
- * Config resolution walks up from the current working directory: the first
- * ancestor with a `.lotics/config.json` wins, otherwise the global
- * `~/.lotics/config.json`. This lets a project or worktree pin its own
- * account/workspace and keeps resolution stable when commands run from a
- * subdirectory. Scope `"local"` targets the current directory exactly — used
- * to bootstrap a per-directory config before any local file exists.
- *
- * These tests pin both `os.homedir()` and `process.cwd()` to temp dirs so the
- * real home directory is never touched.
- */
-describe("config file resolution", () => {
-    let homeDir;
-    let projectDir;
-    let originalCwd;
-    beforeEach(() => {
-        originalCwd = process.cwd();
-        homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "lotics-home-"));
-        projectDir = fs.mkdtempSync(path.join(os.tmpdir(), "lotics-project-"));
-        vi.spyOn(os, "homedir").mockReturnValue(homeDir);
-        process.chdir(projectDir);
-    });
-    afterEach(() => {
-        process.chdir(originalCwd);
-        vi.restoreAllMocks();
-        fs.rmSync(homeDir, { recursive: true, force: true });
-        fs.rmSync(projectDir, { recursive: true, force: true });
-    });
-    const globalFile = () => path.join(homeDir, ".lotics", "config.json");
-    const localFile = (dir = projectDir) => path.join(dir, ".lotics", "config.json");
-    function write(file, data) {
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, JSON.stringify(data));
-    }
-    function read(file) {
-        return JSON.parse(fs.readFileSync(file, "utf-8"));
-    }
-    function chdirInto(...segments) {
-        const dir = path.join(projectDir, ...segments);
-        fs.mkdirSync(dir, { recursive: true });
-        process.chdir(dir);
-        return dir;
-    }
-    it("returns null when no config exists anywhere", () => {
-        expect(loadConfig()).toBeNull();
-    });
-    it("reads the global config when no local config exists", () => {
-        write(globalFile(), { active_org: "org_global" });
-        expect(loadConfig()?.active_org).toBe("org_global");
-        expect(getConfigPath()).toBe(globalFile());
-    });
-    it("prefers a .lotics/config.json in the current directory over the global one", () => {
-        write(globalFile(), { active_org: "org_global" });
-        write(localFile(), { active_org: "org_local" });
-        expect(loadConfig()?.active_org).toBe("org_local");
-        expect(getConfigPath()).toBe(localFile());
-    });
-    it("walks up to an ancestor's config when run from a subdirectory", () => {
-        write(localFile(), { active_org: "org_project_root" });
-        chdirInto("backend", "features");
-        expect(loadConfig()?.active_org).toBe("org_project_root");
-        expect(getConfigPath()).toBe(localFile());
-    });
-    it("auto saveConfig writes the resolved ancestor file, not the subdirectory", () => {
-        write(localFile(), { active_org: "org_old" });
-        const nested = chdirInto("sub");
-        saveConfig({ active_org: "org_new" });
-        expect(read(localFile()).active_org).toBe("org_new");
-        expect(fs.existsSync(localFile(nested))).toBe(false);
-    });
-    it("auto saveConfig writes the global config when no local config exists", () => {
-        saveConfig({ active_org: "org_new" });
-        expect(fs.existsSync(localFile())).toBe(false);
-        expect(read(globalFile()).active_org).toBe("org_new");
-    });
-    it("scope 'local' creates ./.lotics/config.json even when none existed", () => {
-        saveConfig({ active_org: "org_pinned" }, "local");
-        expect(read(localFile()).active_org).toBe("org_pinned");
-        expect(getConfigPath("local")).toBe(localFile());
-    });
-    it("saveConfig writes the credentials file owner-only (0600)", () => {
-        saveConfig({ active_org: "org_secret" }, "local");
-        expect(fs.statSync(localFile()).mode & 0o777).toBe(0o600);
-    });
-    it("saveConfig tightens an over-permissive pre-existing config file", () => {
-        write(localFile(), { active_org: "org_old" });
-        fs.chmodSync(localFile(), 0o644);
-        saveConfig({ active_org: "org_new" }, "local");
-        expect(fs.statSync(localFile()).mode & 0o777).toBe(0o600);
-    });
-    it("loadConfig('local') never inherits the global config", () => {
-        write(globalFile(), { active_org: "org_global" });
-        expect(loadConfig("local")).toBeNull();
-    });
-    it("loadConfig('local') ignores an ancestor's config — it reads the exact cwd only", () => {
-        write(localFile(), { active_org: "org_root" });
-        chdirInto("sub");
-        expect(loadConfig("local")).toBeNull();
-    });
-    it("deleteConfig removes the active local config, leaving the global one untouched", () => {
-        write(globalFile(), { active_org: "org_global" });
-        write(localFile(), { active_org: "org_local" });
-        deleteConfig();
-        expect(fs.existsSync(localFile())).toBe(false);
-        expect(fs.existsSync(globalFile())).toBe(true);
-    });
-});
-/**
- * The credential store holds many profiles (one per org) in the global config,
- * while a local pin or env var picks which is active. `resolveContext` is the
- * single chain that turns flags + env + files into the effective
- * (apiKey, workspaceId) — these tests pin home/cwd to temp dirs and scrub the
- * LOTICS_* env vars so the real environment is never read.
- */
-describe("profile store + resolveContext", () => {
-    let homeDir;
-    let projectDir;
-    let originalCwd;
-    const ENV_KEYS = ["LOTICS_API_KEY", "LOTICS_ORG", "LOTICS_WORKSPACE"];
-    let savedEnv;
-    beforeEach(() => {
-        originalCwd = process.cwd();
-        homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "lotics-home-"));
-        projectDir = fs.mkdtempSync(path.join(os.tmpdir(), "lotics-project-"));
-        vi.spyOn(os, "homedir").mockReturnValue(homeDir);
-        process.chdir(projectDir);
-        savedEnv = {};
-        for (const k of ENV_KEYS) {
-            savedEnv[k] = process.env[k];
-            delete process.env[k];
-        }
-    });
-    afterEach(() => {
-        process.chdir(originalCwd);
-        vi.restoreAllMocks();
-        for (const k of ENV_KEYS) {
-            if (savedEnv[k] === undefined)
-                delete process.env[k];
-            else
-                process.env[k] = savedEnv[k];
-        }
-        fs.rmSync(homeDir, { recursive: true, force: true });
-        fs.rmSync(projectDir, { recursive: true, force: true });
-    });
-    // Raw writers: accept any JSON shape so tests can simulate older on-disk
-    // formats (e.g. a pre-profiles inline key) the current type no longer models.
-    const globalConfigFile = () => path.join(homeDir, ".lotics", "config.json");
-    const writeGlobalRaw = (data) => {
-        fs.mkdirSync(path.dirname(globalConfigFile()), { recursive: true });
-        fs.writeFileSync(globalConfigFile(), JSON.stringify(data));
-    };
-    const writeLocalRaw = (data) => {
-        const file = path.join(projectDir, ".lotics", "config.json");
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, JSON.stringify(data));
-    };
-    const readGlobalRaw = () => JSON.parse(fs.readFileSync(globalConfigFile(), "utf-8"));
-    const profile = (orgName, key, ws) => ({
-        api_key: key,
-        org_name: orgName,
-        ...(ws ? { workspace_id: ws } : {}),
-    });
-    // --- resolveProfileByNameOrId ---
-    it("resolves a profile by exact org id", () => {
-        const profiles = { org_a: profile("Acme", "ltk_a") };
-        expect(resolveProfileByNameOrId(profiles, "org_a")?.[0]).toBe("org_a");
-    });
-    it("resolves a profile by case-insensitive org name", () => {
-        const profiles = { org_a: profile("Acme", "ltk_a") };
-        expect(resolveProfileByNameOrId(profiles, "acme")?.[0]).toBe("org_a");
-    });
-    it("returns null when no profile matches", () => {
-        expect(resolveProfileByNameOrId({ org_a: profile("Acme", "ltk_a") }, "nope")).toBeNull();
-    });
-    it("throws when an org name is ambiguous", () => {
-        const profiles = { org_a: profile("Dup", "ltk_a"), org_b: profile("Dup", "ltk_b") };
-        expect(() => resolveProfileByNameOrId(profiles, "Dup")).toThrow(/multiple/i);
-    });
-    // --- precedence chain ---
-    it("uses the --api-key flag above everything", () => {
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a") }, active_org: "org_a" });
-        const ctx = resolveContext({ apiKey: "ltk_flag", workspace: "wsp_flag" });
-        expect(ctx).toMatchObject({ apiKey: "ltk_flag", workspaceId: "wsp_flag", source: "flag" });
-    });
-    it("uses LOTICS_API_KEY above LOTICS_ORG and the files", () => {
-        process.env.LOTICS_API_KEY = "ltk_env";
-        process.env.LOTICS_WORKSPACE = "wsp_env";
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a") }, active_org: "org_a" });
-        const ctx = resolveContext({});
-        expect(ctx).toMatchObject({ apiKey: "ltk_env", workspaceId: "wsp_env", source: "env_key" });
-    });
-    it("resolves LOTICS_ORG (by name) against the global store", () => {
-        process.env.LOTICS_ORG = "Acme";
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a", "wsp_a") }, active_org: "org_a" });
-        const ctx = resolveContext({});
-        expect(ctx).toMatchObject({ apiKey: "ltk_a", orgId: "org_a", workspaceId: "wsp_a", source: "env_org" });
-    });
-    it("throws when LOTICS_ORG names no saved credential", () => {
-        process.env.LOTICS_ORG = "ghost";
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a") }, active_org: "org_a" });
-        expect(() => resolveContext({})).toThrow(/LOTICS_ORG/);
-    });
-    it("rejects a local config in the obsolete self-contained format (inline key)", () => {
-        // Must fail loud rather than silently fall through to the global active org,
-        // which would run this directory against the wrong organization.
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a") }, active_org: "org_a" });
-        writeLocalRaw({ api_key: "ltk_local", workspace_id: "wsp_local" });
-        expect(() => resolveContext({})).toThrow(/self-contained format/i);
-    });
-    it("resolves a local pointer's key from the global store", () => {
-        writeGlobalRaw({ profiles: { org_b: profile("Beta", "ltk_b", "wsp_b_default") }, active_org: "org_a" });
-        writeLocalRaw({ active_org: "org_b", workspace_id: "wsp_b_pinned" });
-        const ctx = resolveContext({});
-        expect(ctx).toMatchObject({
-            apiKey: "ltk_b",
-            orgId: "org_b",
-            workspaceId: "wsp_b_pinned",
-            source: "local_pointer",
-        });
-    });
-    it("fails loud when a local pin names an org with no saved credential", () => {
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a") }, active_org: "org_a" });
-        writeLocalRaw({ active_org: "org_missing" });
-        expect(() => resolveContext({})).toThrow(/no saved credential/i);
-    });
-    it("falls back to the global active profile when no override exists", () => {
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a", "wsp_a") }, active_org: "org_a" });
-        const ctx = resolveContext({});
-        expect(ctx).toMatchObject({ apiKey: "ltk_a", orgId: "org_a", workspaceId: "wsp_a", source: "global_profile" });
-    });
-    it("fails loud when the global active_org has no matching profile", () => {
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a") }, active_org: "org_gone" });
-        expect(() => resolveContext({})).toThrow(/no saved credential/i);
-    });
-    it("returns null for an old flat global config (no profiles) — re-auth required", () => {
-        writeGlobalRaw({ api_key: "ltk_legacy", workspace_id: "wsp_legacy" });
-        expect(resolveContext({})).toBeNull();
-    });
-    it("returns null when no credentials exist anywhere", () => {
-        expect(resolveContext({})).toBeNull();
-    });
-    it("lets --workspace / LOTICS_WORKSPACE override the resolved workspace", () => {
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a", "wsp_default") }, active_org: "org_a" });
-        expect(resolveContext({ workspace: "wsp_override" })?.workspaceId).toBe("wsp_override");
-        process.env.LOTICS_WORKSPACE = "wsp_env";
-        expect(resolveContext({})?.workspaceId).toBe("wsp_env");
-    });
-    // --- mutators ---
-    it("upsertProfile adds a profile and preserves the active pointer + the rest", () => {
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a") }, active_org: "org_a", email: "me@x.io" });
-        upsertProfile("org_b", { api_key: "ltk_b", org_name: "Beta", workspace_id: "wsp_b" });
-        const g = loadGlobalConfig();
-        expect(Object.keys(g.profiles)).toEqual(["org_a", "org_b"]);
-        expect(g.active_org).toBe("org_a"); // unchanged — the command sets active, not upsert
-        expect(g.email).toBe("me@x.io");
-    });
-    it("upsertProfile self-heals an old flat-key file by dropping stray top-level fields", () => {
-        writeGlobalRaw({ api_key: "ltk_legacy", workspace_id: "wsp_legacy", email: "me@x.io" });
-        upsertProfile("org_a", { api_key: "ltk_a", org_name: "Acme" });
-        const raw = readGlobalRaw();
-        expect(raw.api_key).toBeUndefined();
-        expect(raw.workspace_id).toBeUndefined();
-        expect(raw.email).toBe("me@x.io");
-        expect(raw.profiles.org_a.api_key).toBe("ltk_a");
-    });
-    it("upsertProfile keeps the remembered workspace when none is supplied", () => {
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a", "wsp_a") }, active_org: "org_a" });
-        upsertProfile("org_a", { api_key: "ltk_a2", org_name: "Acme" });
-        expect(loadGlobalConfig().profiles.org_a.workspace_id).toBe("wsp_a");
-    });
-    it("removeProfile deletes a profile and moves the active pointer", () => {
-        writeGlobalRaw({
-            profiles: { org_a: profile("Acme", "ltk_a"), org_b: profile("Beta", "ltk_b") },
-            active_org: "org_a",
-        });
-        removeProfile("org_a");
-        const g = loadGlobalConfig();
-        expect(g.profiles.org_a).toBeUndefined();
-        expect(g.active_org).toBe("org_b");
-    });
-    it("setActiveOrg('global') changes only the global default", () => {
-        writeGlobalRaw({
-            profiles: { org_a: profile("Acme", "ltk_a"), org_b: profile("Beta", "ltk_b") },
-            active_org: "org_a",
-        });
-        setActiveOrg("org_b", "global");
-        expect(loadGlobalConfig().active_org).toBe("org_b");
-        expect(fs.existsSync(path.join(projectDir, ".lotics", "config.json"))).toBe(false);
-    });
-    it("setActiveOrg('local') writes a pointer into the current directory only", () => {
-        writeGlobalRaw({ profiles: { org_b: profile("Beta", "ltk_b") }, active_org: "org_a" });
-        setActiveOrg("org_b", "local");
-        expect(loadConfig("local").active_org).toBe("org_b");
-        expect(loadGlobalConfig().active_org).toBe("org_a"); // global untouched
-    });
-    it("setSelectedWorkspace writes to the active global profile", () => {
-        writeGlobalRaw({ profiles: { org_a: profile("Acme", "ltk_a") }, active_org: "org_a" });
-        const result = setSelectedWorkspace("wsp_new");
-        expect(result).toEqual({ scope: "global", orgId: "org_a" });
-        expect(loadGlobalConfig().profiles.org_a.workspace_id).toBe("wsp_new");
-    });
-    it("setSelectedWorkspace writes to a local pin when present", () => {
-        writeGlobalRaw({ profiles: { org_b: profile("Beta", "ltk_b") }, active_org: "org_a" });
-        writeLocalRaw({ active_org: "org_b" });
-        const result = setSelectedWorkspace("wsp_pinned");
-        expect(result).toMatchObject({ scope: "local", orgId: "org_b" });
-        expect(loadConfig("local").workspace_id).toBe("wsp_pinned");
-        expect(loadGlobalConfig().profiles.org_b.workspace_id).toBeUndefined();
-    });
-    it("setSelectedWorkspace returns null when there is nowhere to persist it", () => {
-        // No local pin, no active global profile (e.g. creds came from --api-key).
-        expect(setSelectedWorkspace("wsp_x")).toBeNull();
-    });
-});

package/dist/dev/file_relay.d.ts

@@ -1,39 +0,0 @@
-/**
- * Dev-only GET relay: the read half of the same problem `upload_relay.ts` solves.
- *
- * The server presigns every file cell an app query returns (`url` / `thumbnail_url` /
- * `preview_url` on each file object), and those URLs point at the PROD bucket, whose
- * CORS admits `https://*.lotics.app` and not `http://localhost:<port>`. Displaying
- * such a URL is fine — `<img>` and `<video>` loads are not CORS-gated, and neither is
- * the top-level navigation `openExternal` performs. But **fetching the bytes** is, and
- * that is exactly what every preview engine does (PDF, Word, Excel all read the file
- * into memory), so file preview could never work in `lotics app dev`.
- *
- * So the dev server hands the app same-origin URLs and fetches the bytes itself.
- *
- * The security property is the one that governs the upload relay: the app never names
- * a destination. It receives an opaque token, and the relay reads ONLY from a URL the
- * server itself observed the API return for that token. No client-controlled target,
- * nothing to allowlist, no SSRF surface.
- *
- * Production is untouched: it serves presigned URLs straight from storage.
- */
-export interface FileRelay {
-    /**
-     * Deep-copy an RPC result with every presigned file URL swapped for one served by
-     * this dev server. Immutable: the input is never mutated. Anything that isn't a
-     * presigned URL on a file object passes through byte-identical.
-     */
-    rewrite(result: unknown): unknown;
-    /** The URL this token stands for — `null` if unknown or expired. */
-    destinationFor(token: string): string | null;
-    /** Live tokens — for tests. */
-    size(): number;
-}
-/**
- * `wrapperOrigin` — e.g. `http://localhost:5174`. The URL must be ABSOLUTE: these
- * URLs are consumed inside the app **iframe**, which is served from Vite's origin, so
- * a relative `/_file/…` would resolve against Vite and 404. (The upload relay's URL is
- * consumed by the wrapper page itself, where relative is correct.)
- */
-export declare function createFileRelay(wrapperOrigin: string, now?: () => number): FileRelay;

package/dist/dev/file_relay.js

@@ -1,87 +0,0 @@
-/**
- * Dev-only GET relay: the read half of the same problem `upload_relay.ts` solves.
- *
- * The server presigns every file cell an app query returns (`url` / `thumbnail_url` /
- * `preview_url` on each file object), and those URLs point at the PROD bucket, whose
- * CORS admits `https://*.lotics.app` and not `http://localhost:<port>`. Displaying
- * such a URL is fine — `<img>` and `<video>` loads are not CORS-gated, and neither is
- * the top-level navigation `openExternal` performs. But **fetching the bytes** is, and
- * that is exactly what every preview engine does (PDF, Word, Excel all read the file
- * into memory), so file preview could never work in `lotics app dev`.
- *
- * So the dev server hands the app same-origin URLs and fetches the bytes itself.
- *
- * The security property is the one that governs the upload relay: the app never names
- * a destination. It receives an opaque token, and the relay reads ONLY from a URL the
- * server itself observed the API return for that token. No client-controlled target,
- * nothing to allowlist, no SSRF surface.
- *
- * Production is untouched: it serves presigned URLs straight from storage.
- */
-import { createHash } from "node:crypto";
-/** Presigned GETs live ~24h; a token outlives its URL by nothing. */
-const TTL_MS = 24 * 60 * 60 * 1000;
-/** A long dev session re-queries constantly; each query re-presigns. Bound the table. */
-const MAX_ENTRIES = 5000;
-/**
- * The keys the backend presigns on a file object (`file_url_resolver.ts`). Only these,
- * and only on something that is actually a file, get rewritten — a record's own text
- * cell holding a link (a public app URL, say) must keep pointing where it points.
- */
-const PRESIGNED_KEYS = new Set(["url", "thumbnail_url", "preview_url"]);
-const isFileObject = (o) => typeof o.filename === "string" && typeof o.mime_type === "string";
-const isRemoteUrl = (v) => typeof v === "string" && /^https?:\/\//i.test(v);
-/**
- * `wrapperOrigin` — e.g. `http://localhost:5174`. The URL must be ABSOLUTE: these
- * URLs are consumed inside the app **iframe**, which is served from Vite's origin, so
- * a relative `/_file/…` would resolve against Vite and 404. (The upload relay's URL is
- * consumed by the wrapper page itself, where relative is correct.)
- */
-export function createFileRelay(wrapperOrigin, now = Date.now) {
-    const seen = new Map();
-    // A stable token per URL: the same file re-queried doesn't mint a new entry, so the
-    // table tracks distinct presigns, not query volume. (Truncated — this is a lookup
-    // key in a localhost-only process, not a secret.)
-    const tokenFor = (url) => createHash("sha256").update(url).digest("hex").slice(0, 24);
-    const remember = (url) => {
-        const token = tokenFor(url);
-        seen.set(token, { url, at: now() });
-        if (seen.size > MAX_ENTRIES) {
-            // Insertion-ordered: drop the oldest.
-            const oldest = seen.keys().next();
-            if (!oldest.done)
-                seen.delete(oldest.value);
-        }
-        return token;
-    };
-    const walk = (node) => {
-        if (Array.isArray(node))
-            return node.map(walk);
-        if (!node || typeof node !== "object")
-            return node;
-        const obj = node;
-        const file = isFileObject(obj);
-        const out = {};
-        for (const [key, value] of Object.entries(obj)) {
-            out[key] =
-                file && PRESIGNED_KEYS.has(key) && isRemoteUrl(value)
-                    ? `${wrapperOrigin}/_file/${remember(value)}`
-                    : walk(value);
-        }
-        return out;
-    };
-    return {
-        rewrite: (result) => walk(result),
-        destinationFor(token) {
-            const entry = seen.get(token);
-            if (!entry)
-                return null;
-            if (now() - entry.at > TTL_MS) {
-                seen.delete(token);
-                return null;
-            }
-            return entry.url;
-        },
-        size: () => seen.size,
-    };
-}

package/dist/dev/file_relay.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/dev/file_relay.test.js

@@ -1,87 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { createFileRelay } from "./file_relay.js";
-const ORIGIN = "http://localhost:5174";
-const PRESIGNED = "https://production.r2.cloudflarestorage.com/org/files/fil_a/photo.jpg?X-Amz-Signature=abc";
-const THUMB = "https://production.r2.cloudflarestorage.com/org/files/fil_a/thumb.jpg?X-Amz-Signature=def";
-const fileCell = {
-    id: "fil_a",
-    filename: "photo.jpg",
-    mime_type: "image/jpeg",
-    url: PRESIGNED,
-    thumbnail_url: THUMB,
-};
-/** A query result, shaped like the real thing: rows, each with a files cell. */
-const queryResult = { rows: [{ id: "rec_1", giay_to: [fileCell] }] };
-describe("file relay — the app reads bytes from us, not from storage", () => {
-    it("rewrites every presigned URL on a file cell to an absolute URL on the dev server", () => {
-        const relay = createFileRelay(ORIGIN);
-        const out = relay.rewrite(queryResult);
-        const cell = out.rows[0].giay_to[0];
-        // ABSOLUTE: the app runs in the Vite-origin iframe, so a relative path would
-        // resolve against Vite and 404.
-        expect(cell.url).toMatch(/^http:\/\/localhost:5174\/_file\/[a-f0-9]{24}$/);
-        expect(cell.thumbnail_url).toMatch(/^http:\/\/localhost:5174\/_file\/[a-f0-9]{24}$/);
-        expect(cell.url).not.toBe(cell.thumbnail_url);
-    });
-    it("reads back the exact storage URL the token stands for", () => {
-        const relay = createFileRelay(ORIGIN);
-        const out = relay.rewrite(queryResult);
-        const token = out.rows[0].giay_to[0].url.split("/_file/")[1];
-        expect(relay.destinationFor(token)).toBe(PRESIGNED);
-    });
-    it("leaves the rest of the payload byte-identical and never mutates the input", () => {
-        const relay = createFileRelay(ORIGIN);
-        const out = relay.rewrite(queryResult);
-        expect(out.rows[0].id).toBe("rec_1");
-        expect(out.rows[0].giay_to[0].filename).toBe("photo.jpg");
-        expect(fileCell.url).toBe(PRESIGNED); // input untouched
-    });
-});
-describe("file relay — it rewrites file URLs, not every URL it sees", () => {
-    it("does NOT touch a link that lives in a record's own text cell", () => {
-        // The customer's "Link tự khai" field holds a real URL the user clicks. Relaying it
-        // would send them to the dev server instead of the site.
-        const relay = createFileRelay(ORIGIN);
-        const row = { id: "rec_1", link_tu_khai: "https://dang-ky-noxh.lotics.app?kh=KH-2026-919" };
-        const out = relay.rewrite({ rows: [row] });
-        expect(out.rows[0].link_tu_khai).toBe("https://dang-ky-noxh.lotics.app?kh=KH-2026-919");
-        expect(relay.size()).toBe(0);
-    });
-    it("does NOT touch a `url` key on something that isn't a file", () => {
-        const relay = createFileRelay(ORIGIN);
-        const out = relay.rewrite({ webhook: { url: "https://example.com/hook" } });
-        expect(out.webhook.url).toBe("https://example.com/hook");
-        expect(relay.size()).toBe(0);
-    });
-    it("reaches file cells wherever they are nested — a workflow's generated files, too", () => {
-        const relay = createFileRelay(ORIGIN);
-        const out = relay.rewrite({
-            data: { status: "ok" },
-            files: [{ id: "fil_z", filename: "don.docx", mime_type: "application/vnd...", url: PRESIGNED }],
-        });
-        expect(out.files[0].url).toContain("/_file/");
-    });
-});
-describe("file relay — it reads ONLY what it handed out", () => {
-    it("refuses a token it never minted", () => {
-        const relay = createFileRelay(ORIGIN);
-        expect(relay.destinationFor("deadbeefdeadbeefdeadbeef")).toBeNull();
-    });
-    it("refuses a token whose presign has aged out", () => {
-        let clock = 0;
-        const relay = createFileRelay(ORIGIN, () => clock);
-        const out = relay.rewrite(queryResult);
-        const token = out.rows[0].giay_to[0].url.split("/_file/")[1];
-        clock += 25 * 60 * 60 * 1000; // presigned GETs live ~24h
-        expect(relay.destinationFor(token)).toBeNull();
-    });
-});
-describe("file relay — a long dev session re-queries constantly", () => {
-    it("mints one stable token per URL rather than growing on every query", () => {
-        const relay = createFileRelay(ORIGIN);
-        const a = relay.rewrite(queryResult);
-        const b = relay.rewrite(queryResult);
-        expect(b.rows[0].giay_to[0].url).toBe(a.rows[0].giay_to[0].url);
-        expect(relay.size()).toBe(2); // the file and its thumbnail — not four
-    });
-});

package/dist/dev/rpc_handler.d.ts

@@ -1,21 +0,0 @@
-/**
- * Stateless dispatcher: takes a parsed RPC envelope from the wrapper page
- * and routes to the matching LoticsClient method.
- *
- * Errors are thrown — the HTTP server caller serializes them to a 500 with
- * { message }. Same shape as the production iframe-host's error path.
- */
-import { LoticsClient } from "../client.js";
-export type RpcOp = "query" | "field_options" | "workflow" | "members" | "context" | "binding" | "upload_url" | "upload_complete" | "comments.list" | "comments.create" | "comments.update" | "comments.delete" | "comments.counts";
-export interface RpcRequest {
-    app_id: string;
-    op: RpcOp;
-    payload: unknown;
-}
-/** Per-app facts the dev server knows from the local manifest that the
- *  production iframe-host supplies from the embedding context. */
-export interface DispatchOptions {
-    /** From `package.json#lotics.capabilities.comments`. */
-    commentsEnabled?: boolean;
-}
-export declare function dispatchRpc(client: LoticsClient, body: RpcRequest, opts?: DispatchOptions): Promise<unknown>;