@lotics/cli 0.88.0 → 0.89.1

package/dist/dev/rpc_handler.js

@@ -1,166 +0,0 @@
-/**
- * Stateless dispatcher: takes a parsed RPC envelope from the wrapper page
- * and routes to the matching LoticsClient method.
- *
- * Errors are thrown — the HTTP server caller serializes them to a 500 with
- * { message }. Same shape as the production iframe-host's error path.
- */
-const SUPPORTED_OPS = new Set([
-    "query",
-    "field_options",
-    "workflow",
-    "members",
-    "context",
-    "binding",
-    "upload_url",
-    "upload_complete",
-    "comments.list",
-    "comments.create",
-    "comments.update",
-    "comments.delete",
-    "comments.counts",
-]);
-export async function dispatchRpc(client, body, opts) {
-    if (!body || typeof body.app_id !== "string" || typeof body.op !== "string") {
-        throw new Error("RPC envelope must include app_id and op");
-    }
-    if (!SUPPORTED_OPS.has(body.op)) {
-        throw new Error(`Unknown RPC op: ${body.op}`);
-    }
-    switch (body.op) {
-        case "context": {
-            // In production the iframe host supplies the context; here we resolve the
-            // effective viewer from the CLI key (the view-as target when the client
-            // carries `x-view-as-member-id`, else the key's owner), so `useViewer`
-            // and `is_current_member` agree in the dev loop. The installation's
-            // stored config is fetched live for the same parity: `useConfig()` must
-            // render the same values in the dev loop as in production, including
-            // edits made in the product mid-session (fresh on every app load, no
-            // dev-server restart).
-            const [who, app] = await Promise.all([client.whoami(), client.getApp(body.app_id)]);
-            return {
-                member_id: who.member_id,
-                comments_enabled: opts?.commentsEnabled ?? false,
-                config: app.config ?? {},
-            };
-        }
-        case "query": {
-            const p = body.payload;
-            if (!p || typeof p.alias !== "string") {
-                throw new Error("query payload must include `alias`");
-            }
-            return client.appQuery(body.app_id, {
-                alias: p.alias,
-                params: p.params,
-                limit: p.limit,
-                offset: p.offset,
-                sort: p.sort,
-                filter: p.filter,
-                count: p.count,
-            });
-        }
-        case "field_options": {
-            const p = body.payload;
-            if (!p || typeof p.alias !== "string") {
-                throw new Error("field_options payload must include `alias`");
-            }
-            return client.appFieldOptions(body.app_id, p.alias);
-        }
-        case "workflow": {
-            const p = body.payload;
-            if (!p || typeof p.alias !== "string") {
-                throw new Error("workflow payload must include `alias`");
-            }
-            return client.appWorkflow(body.app_id, p.alias, p.inputs);
-        }
-        case "members": {
-            const p = body.payload;
-            return client.appMembers(body.app_id, p?.group);
-        }
-        case "binding":
-            return client.appBinding(body.app_id);
-        case "upload_url": {
-            const p = body.payload;
-            if (!p ||
-                typeof p.filename !== "string" ||
-                typeof p.mime_type !== "string" ||
-                typeof p.file_size !== "number") {
-                throw new Error("upload_url payload must include filename, mime_type, file_size");
-            }
-            return client.appRequestFileUpload(body.app_id, {
-                filename: p.filename,
-                mime_type: p.mime_type,
-                file_size: p.file_size,
-            });
-        }
-        case "upload_complete": {
-            const p = body.payload;
-            if (!p ||
-                typeof p.file_id !== "string" ||
-                typeof p.file_storage_key !== "string" ||
-                typeof p.filename !== "string") {
-                throw new Error("upload_complete payload must include file_id, file_storage_key, filename");
-            }
-            return client.appCompleteFileUpload(body.app_id, {
-                file_id: p.file_id,
-                file_storage_key: p.file_storage_key,
-                filename: p.filename,
-            });
-        }
-        // Comment ops mirror the production iframe-host's `handleCommentRpc` return
-        // shapes so the SDK hooks behave identically in dev. App authority + the
-        // `comments` capability + tenant floor are enforced server-side.
-        case "comments.list": {
-            const p = body.payload;
-            if (!p || typeof p.record_id !== "string") {
-                throw new Error("comments.list payload must include record_id");
-            }
-            const comments = await client.appGetRecordComments(body.app_id, p.record_id);
-            return { comments };
-        }
-        case "comments.create": {
-            const p = body.payload;
-            if (!p || typeof p.record_id !== "string" || typeof p.content !== "string") {
-                throw new Error("comments.create payload must include record_id and content");
-            }
-            const created = await client.appCreateRecordComment(body.app_id, p.record_id, {
-                content: p.content,
-                file_ids: p.file_ids,
-            });
-            return { comments: created ? [created] : [] };
-        }
-        case "comments.update": {
-            const p = body.payload;
-            if (!p ||
-                typeof p.record_id !== "string" ||
-                typeof p.comment_id !== "string" ||
-                typeof p.content !== "string") {
-                throw new Error("comments.update payload must include record_id, comment_id, content");
-            }
-            const comment = await client.appUpdateRecordComment(body.app_id, p.record_id, p.comment_id, {
-                content: p.content,
-                files: p.files,
-            });
-            return { comment };
-        }
-        case "comments.delete": {
-            const p = body.payload;
-            if (!p || typeof p.record_id !== "string" || typeof p.comment_id !== "string") {
-                throw new Error("comments.delete payload must include record_id and comment_id");
-            }
-            await client.appDeleteRecordComment(body.app_id, p.record_id, p.comment_id);
-            return undefined;
-        }
-        case "comments.counts": {
-            const p = body.payload;
-            if (!p || typeof p.table_id !== "string") {
-                throw new Error("comments.counts payload must include table_id");
-            }
-            return client.appGetTableCommentCounts(body.app_id, p.table_id);
-        }
-        default: {
-            // Unreachable — SUPPORTED_OPS gates above.
-            throw new Error(`Unhandled RPC op: ${body.op}`);
-        }
-    }
-}

package/dist/dev/rpc_handler.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/dev/rpc_handler.test.js

@@ -1,107 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { dispatchRpc } from "./rpc_handler.js";
-import { serializeRpcResult } from "./server.js";
-function mockClient(over) {
-    return over;
-}
-const WHOAMI = {
-    member_id: "mbr_viewer",
-    email: "v@test.local",
-    name: "Viewer",
-    organization_id: "org_1",
-    organization_name: "Org",
-};
-describe("dispatchRpc — context op", () => {
-    it("resolves the viewer from whoami and the installation's stored config from the live app row", async () => {
-        const client = mockClient({
-            whoami: async () => WHOAMI,
-            getApp: async () => ({
-                id: "app_x",
-                name: "App X",
-                workspace_id: "wsp_1",
-                current_version_id: null,
-                config: { page_size: 50 },
-            }),
-        });
-        const result = await dispatchRpc(client, { app_id: "app_x", op: "context", payload: {} }, { commentsEnabled: true });
-        expect(result).toEqual({ member_id: "mbr_viewer", comments_enabled: true, config: { page_size: 50 } });
-    });
-    it("defaults comments_enabled to false and config to empty for a bespoke app", async () => {
-        const client = mockClient({
-            whoami: async () => WHOAMI,
-            getApp: async () => ({
-                id: "app_x",
-                name: "App X",
-                workspace_id: "wsp_1",
-                current_version_id: null,
-                config: null,
-            }),
-        });
-        const result = await dispatchRpc(client, { app_id: "app_x", op: "context", payload: {} });
-        expect(result).toEqual({ member_id: "mbr_viewer", comments_enabled: false, config: {} });
-    });
-    it("rejects an op that isn't supported", async () => {
-        const client = mockClient({});
-        await expect(dispatchRpc(client, { app_id: "app_x", op: "bogus", payload: {} })).rejects.toThrow(/Unknown RPC op/);
-    });
-});
-describe("dispatchRpc — field_options op", () => {
-    it("forwards the alias to appFieldOptions and returns its { fields } shape", async () => {
-        const fields = {
-            status: {
-                label: "Status",
-                options: [{ key: "opt_open", label: "Open", color: "blue" }],
-            },
-        };
-        const client = mockClient({ appFieldOptions: async () => ({ fields }) });
-        const result = await dispatchRpc(client, {
-            app_id: "app_x",
-            op: "field_options",
-            payload: { alias: "records" },
-        });
-        expect(result).toEqual({ fields });
-    });
-    it("requires an alias in the payload", async () => {
-        const client = mockClient({ appFieldOptions: async () => ({ fields: {} }) });
-        await expect(dispatchRpc(client, { app_id: "app_x", op: "field_options", payload: {} })).rejects.toThrow(/alias/);
-    });
-});
-describe("dispatchRpc — comment ops", () => {
-    it("comments.list forwards to appGetRecordComments, wrapped as { comments }", async () => {
-        const comments = [{ id: "cmt_1", content: "hi" }];
-        const client = mockClient({ appGetRecordComments: async () => comments });
-        const result = await dispatchRpc(client, {
-            app_id: "app_x",
-            op: "comments.list",
-            payload: { record_id: "rec_1" },
-        });
-        expect(result).toEqual({ comments });
-    });
-    it("comments.counts forwards to appGetTableCommentCounts (counts, no content)", async () => {
-        const counts = { rec_1: 2, rec_2: 1 };
-        const client = mockClient({ appGetTableCommentCounts: async () => counts });
-        const result = await dispatchRpc(client, {
-            app_id: "app_x",
-            op: "comments.counts",
-            payload: { table_id: "tbl_1" },
-        });
-        expect(result).toEqual(counts);
-    });
-    it("requires the right payload per comment op", async () => {
-        const client = mockClient({
-            appGetRecordComments: async () => [],
-            appGetTableCommentCounts: async () => ({}),
-        });
-        await expect(dispatchRpc(client, { app_id: "app_x", op: "comments.list", payload: {} })).rejects.toThrow(/record_id/);
-        await expect(dispatchRpc(client, { app_id: "app_x", op: "comments.counts", payload: {} })).rejects.toThrow(/table_id/);
-    });
-});
-describe("serializeRpcResult — every RPC response body is valid JSON", () => {
-    it("serializes a void result (comments.delete) as null, never an empty body", () => {
-        expect(serializeRpcResult(undefined)).toBe("null");
-        expect(JSON.parse(serializeRpcResult(undefined))).toBeNull();
-    });
-    it("passes object results through", () => {
-        expect(JSON.parse(serializeRpcResult({ comments: [] }))).toEqual({ comments: [] });
-    });
-});

package/dist/dev/server.d.ts

@@ -1,75 +0,0 @@
-/**
- * `lotics app dev` orchestrator.
- *
- * Two child processes managed in one Node lifecycle:
- *   1. Vite dev server (npx vite --port <vite-port>) — child_process.spawn,
- *      stdio inherited so Vite's own logging surfaces to the developer.
- *   2. node:http server on <port> serving:
- *        GET  /               → wrapper HTML (cached: no)
- *        POST /_rpc           → JSON in, dispatched via rpc_handler, JSON out
- *        POST /_agent_run     → SSE, piped from the run
- *        PUT  /_upload/:id    → file bytes in  (relayed to storage)
- *        GET  /_file/:token   → file bytes out (relayed from storage)
- *        *                    → 404
- *
- * SIGINT (Ctrl-C) → kill Vite child, close HTTP server, exit 0.
- *
- * Why the byte relays exist: dev runs against the PROD bucket (there is no dev
- * bucket), whose CORS allowlist holds the real app origins (`https://*.lotics.app`),
- * not `http://localhost:<port>`. So a browser transfer straight to/from the presigned
- * URL is blocked before it leaves the page — no upload could complete, and no preview
- * engine (PDF/Word/Excel all FETCH the bytes) could read a file. Relaying through THIS
- * server fixes both: Node has no same-origin policy, and the one cross-origin hop that
- * remains (the app iframe reading from us) is OUR response to allow.
- *
- * Neither relay ever takes a destination from the client: the page sends a `file_id`
- * or an opaque token, and the server transfers only to/from a URL IT minted or observed
- * for that id. No client-controlled target ⇒ no SSRF surface, nothing to allowlist.
- *
- * Production is untouched — it transfers direct-to-storage, keeping every byte off the
- * API server.
- */
-import { type ChildProcess } from "node:child_process";
-import { LoticsClient } from "../client.js";
-export interface DevServerArgs {
-    projectDir: string;
-    app_id: string;
-    app_name: string;
-    workspace_id: string;
-    /** API URL the CLI is configured against — shown in the header banner. */
-    api_url: string;
-    /** Preferred wrapper port. If taken, auto-picks a free one. */
-    port?: number;
-    /** Preferred Vite port. If taken, auto-picks a free one. */
-    vitePort?: number;
-    client: LoticsClient;
-    /** From `package.json#lotics.capabilities.comments` — fed to the `context` op
-     *  so `useComments` reflects the manifest in the dev loop. */
-    commentsEnabled?: boolean;
-}
-export interface DevServerHandle {
-    port: number;
-    vitePort: number;
-    /** Resolves when both Vite + HTTP server are listening. */
-    ready: Promise<void>;
-    /** Stops Vite + HTTP server. Safe to call multiple times. */
-    stop: () => Promise<void>;
-}
-/**
- * Serialize an RPC result for the HTTP response body. Ops with no return
- * value (e.g. comments.delete) resolve `undefined` — in production they
- * travel over postMessage where undefined structured-clones fine, but
- * `JSON.stringify(undefined)` is not a string, so the body would be EMPTY
- * and the wrapper's `JSON.parse` throws "Unexpected end of JSON input".
- * Serialize those as `null`.
- */
-export declare function serializeRpcResult(result: unknown): string;
-export declare function startDevServer(args: DevServerArgs): Promise<DevServerHandle>;
-/** Used by the CLI command for cross-platform `open <url>`. Best-effort —
- *  if the platform opener isn't installed (common in WSL, headless CI, some
- *  Linux minimal images), we log a note and keep the dev server running so
- *  the developer can copy/paste the URL manually. */
-export declare function openBrowser(url: string): void;
-declare global {
-    type _UnusedChildProcess = ChildProcess;
-}