@lowdefy/client 6.0.0 → 7.0.0

package/dist/initLowdefyContext.js

@@ -12,25 +12,52 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { translate } from '@lowdefy/helpers';
+*/ import React from 'react';
+import { registerHtmlEnhancements } from '@lowdefy/block-utils';
+import { rememberPath, resolveTarget } from '@lowdefy/engine';
+import { translate, type } from '@lowdefy/helpers';
 import createCallAPI from './createCallAPI.js';
 import createAuthMethods from './auth/createAuthMethods.js';
 import createCallRequest from './createCallRequest.js';
 import createWebSocketClient from './websocket/createWebSocketClient.js';
 import createIcon from './createIcon.js';
 import createShortcutBadge from './createShortcutBadge.js';
+import createStorage from './storage/createStorage.js';
 import createLinkComponent from './createLinkComponent.js';
 import createHandleError from './createHandleError.js';
+import getActiveLocale from './getActiveLocale.js';
 import { createBrowserLogger } from '@lowdefy/logger/browser';
+import setLowdefyUser from './setLowdefyUser.js';
 import setupLink from './setupLink.js';
-function initLowdefyContext({ auth, Components, config, lowdefy, router, stage, types, window }) {
+import { createUrl } from './adapters/url.js';
+// loadAllIcons (production server only) loads every icon the app bundles into
+// types.icons; a page loads only its own icons, so a name that arrives at
+// runtime may need it. Dev and e2e bundle every icon.
+//
+// matchedPath and pathParams are the server's match of the shown page: the
+// path it was matched on (no basePath, no leading "/") and the values it
+// carries.
+function initLowdefyContext({ auth, Components, config, loadAllIcons, lowdefy, matchedPath, pathParams, router, stage, types, window }) {
+    // The path memory lasts the session. A dev config reload clears initialised
+    // to rebuild the page contexts, but the paths this tab followed still name
+    // the same pages, and the page response it fetches next rewrites its own.
+    if (type.isUndefined(lowdefy.pathMemory)) {
+        lowdefy.pathMemory = new Map();
+    }
     if (!lowdefy._internal?.initialised) {
         lowdefy._internal = {
             actions: types.actions,
             blockComponents: types.blocks,
             blockMetas: types.blockMetas ?? {},
+            // The last caller stamp a response carried (recordCallerStamp). It names
+            // the session, not the page context, so it outlives a dev config reload,
+            // and the dev server records the first page config's before this runs.
+            callerStamp: lowdefy._internal?.callerStamp ?? null,
             components: {
-                Icon: createIcon(types.icons),
+                Icon: createIcon({
+                    icons: types.icons,
+                    loadAllIcons
+                }),
                 ShortcutBadge: createShortcutBadge(lowdefy)
             },
             displayMessage: ({ content })=>{
@@ -54,12 +81,21 @@ function initLowdefyContext({ auth, Components, config, lowdefy, router, stage,
             router
         };
         lowdefy.apiResponses = {};
+        // Rebuilt with the page contexts, so a dev config reload runs the app events again.
+        lowdefy.appContext = null;
         lowdefy.basePath = router.basePath;
         lowdefy.contexts = {};
         lowdefy.inputs = {};
+        lowdefy.pageInstances = {};
         lowdefy.lowdefyApp = config.rootConfig.lowdefyApp;
         lowdefy.lowdefyGlobal = config.rootConfig.lowdefyGlobal;
         lowdefy.theme = config.rootConfig.theme ?? {};
+        lowdefy._internal.storage = createStorage({
+            basePath: lowdefy.basePath,
+            getUserId: ()=>lowdefy.user?.id ?? null,
+            slug: lowdefy.lowdefyApp?.slug,
+            window
+        });
         lowdefy._internal.callAPI = createCallAPI(lowdefy);
         lowdefy._internal.auth = createAuthMethods(lowdefy, auth);
         lowdefy._internal.callRequest = createCallRequest(lowdefy);
@@ -74,14 +110,77 @@ function initLowdefyContext({ auth, Components, config, lowdefy, router, stage,
         lowdefy._internal.logger = createBrowserLogger();
         lowdefy._internal.handleError = createHandleError(lowdefy);
         lowdefy._internal.components.handleError = lowdefy._internal.handleError;
+        // HtmlComponent (block-utils) gives data-* attributes meaning in every
+        // sanitised HTML string. The overlay pulls in antd Tooltip and Popover, so
+        // it loads the first time HTML needs one. Links build hrefs with createUrl,
+        // the one place basePath is applied, and navigate like the Link action. A
+        // page link's pathname comes from resolveTarget, as the Link action's does.
+        registerHtmlEnhancements({
+            createHref: ({ pathname, query })=>createUrl({
+                    basePath: lowdefy.basePath,
+                    pathname,
+                    query
+                }),
+            createPageHref: ({ pageId, pathParams, urlQuery })=>{
+                const target = resolveTarget({
+                    lowdefy,
+                    target: {
+                        pageId,
+                        pathParams,
+                        urlQuery
+                    }
+                });
+                return createUrl({
+                    basePath: lowdefy.basePath,
+                    pathname: target.pathname,
+                    query: target.query
+                });
+            },
+            getLocale: ()=>getActiveLocale(window),
+            // The overlay is lazy, so the app's Icon is bound in when it loads.
+            HtmlOverlay: /*#__PURE__*/ React.lazy(async ()=>{
+                const { default: HtmlOverlay } = await import('./HtmlOverlay.js');
+                const Icon = lowdefy._internal.components.Icon;
+                function HtmlOverlayWithIcon(props) {
+                    return /*#__PURE__*/ React.createElement(HtmlOverlay, {
+                        ...props,
+                        Icon: Icon
+                    });
+                }
+                return {
+                    default: HtmlOverlayWithIcon
+                };
+            }),
+            Icon: lowdefy._internal.components.Icon,
+            icons: types.icons,
+            link: lowdefy._internal.link,
+            loadAllIcons,
+            translate: lowdefy._internal.translate
+        });
         if (stage === 'dev' || stage === 'e2e') {
             window.lowdefy = lowdefy;
         }
     }
     lowdefy.home = config.rootConfig.home || {};
+    lowdefy.linkPaths = config.pageConfig.linkPaths;
     lowdefy.menus = config.rootConfig.menus;
     lowdefy.pageId = config.pageConfig.pageId;
-    lowdefy.user = auth?.session?.user ?? null;
+    lowdefy.pagePaths = config.rootConfig.pagePaths;
+    setLowdefyUser({
+        lowdefy,
+        user: auth?.user
+    });
+    // Runs on every render, so it sees the person signed in on load and any later change.
+    lowdefy._internal.storage.clearUserStorageOnOwnerChange();
+    // The shown page's path joins the path memory before its context is built,
+    // so the first load's page is known before any plugin reads the memory.
+    rememberPath({
+        lowdefy,
+        path: matchedPath,
+        pageId: config.pageConfig.pageId,
+        pathParams,
+        pattern: config.pageConfig.path
+    });
     return lowdefy;
 }
 export default initLowdefyContext;

package/dist/isOtherCaller.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { callerHash, type } from '@lowdefy/helpers';
+// True when the server answered as another caller than the one this page
+// renders: stamp is the response's parsed x-lowdefy-caller header (see the
+// server's stampCaller and parseCallerStamp), user the rendered caller.
+function isOtherCaller({ stamp, user }) {
+    // A response with no header was not answered by a route that resolved a
+    // caller (it failed before, or came from a proxy), so it claims no caller.
+    if (type.isNone(stamp)) {
+        return false;
+    }
+    return stamp.caller !== callerHash({
+        user
+    });
+}
+export default isOtherCaller;

package/dist/recordCallerStamp.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { parseCallerStamp, type } from '@lowdefy/helpers';
+// Keeps the last caller stamp a response carried (see the server's stampCaller)
+// on lowdefy._internal.callerStamp, as { caller, session, roles, memberships }:
+// who the server last answered as, in full. A response with no header claims
+// no caller and leaves the last stamp in place.
+function recordCallerStamp({ lowdefy, serverCaller }) {
+    const stamp = parseCallerStamp(serverCaller);
+    if (type.isNone(stamp)) {
+        return;
+    }
+    // The dev server fetches the first page config before the page context exists
+    // (initLowdefyContext), which carries this stamp over when it builds
+    // _internal.
+    lowdefy._internal = lowdefy._internal ?? {};
+    lowdefy._internal.callerStamp = stamp;
+}
+export default recordCallerStamp;

package/dist/renderIconNodes.js

@@ -0,0 +1,46 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import React from 'react';
+const shapeTags = new Set([
+    'circle',
+    'ellipse',
+    'line',
+    'path',
+    'polygon',
+    'polyline',
+    'rect'
+]);
+// lucide-react applies vector-effect only to the top-level nodes it renders
+// itself; icon data goes in as children, so shapes at every depth get it here.
+function renderIconNodes({ node, nonScalingStroke }) {
+    return node.map(([tag, attrs, children], index)=>{
+        const props = nonScalingStroke && shapeTags.has(tag) ? {
+            vectorEffect: 'non-scaling-stroke',
+            ...attrs,
+            key: index
+        } : {
+            ...attrs,
+            key: index
+        };
+        if (!children) {
+            return /*#__PURE__*/ React.createElement(tag, props);
+        }
+        return /*#__PURE__*/ React.createElement(tag, props, renderIconNodes({
+            node: children,
+            nonScalingStroke
+        }));
+    });
+}
+export default renderIconNodes;

package/dist/request.js

@@ -12,19 +12,87 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { serializer, translate } from '@lowdefy/helpers';
-async function request({ url, method = 'GET', body }) {
+*/ import { decodeServerError } from '@lowdefy/engine';
+import { expectedErrorNames, lowdefyErrorTypes } from '@lowdefy/errors';
+import { translate, type } from '@lowdefy/helpers';
+import recordCallerStamp from './recordCallerStamp.js';
+import shouldReloadForAuthError from './shouldReloadForAuthError.js';
+import shouldReloadForBuild from './shouldReloadForBuild.js';
+import shouldReloadForCaller from './shouldReloadForCaller.js';
+// buildId is the build this bundle was made from. The production server
+// refuses a call from another build with a 409 before running anything, since
+// an old page's payload can be the wrong shape for the new build's request and
+// still be written. The tab then reloads once onto the current build. The
+// promise never settles: the page is unloading, and a rejection would run the
+// action's catch actions and report the refusal as an error. Only the
+// production client carries a build id; the server lets a call naming none
+// through (dev and e2e pages, third-party webhooks).
+//
+// lowdefy.user is the caller the page renders. The tab also reloads when the
+// server answered as another caller or with other roles, or refused the
+// rendered caller in a way that means the page itself is no longer theirs
+// (shouldReloadForCaller, shouldReloadForAuthError), so it never shows one
+// caller's data to another. Otherwise the response's caller stamp is kept as
+// the last one seen (recordCallerStamp).
+// reloadOnAuthorizationError is set for page requests, which share the page's
+// auth, and not for endpoints, which carry their own.
+async function request({ buildId, url, method = 'GET', body, reloadOnAuthorizationError = false, lowdefy }) {
+    // Read per call: the rendered caller changes with the session.
+    const { user } = lowdefy;
+    const headers = {
+        'Content-Type': 'application/json'
+    };
+    if (!type.isNone(buildId)) {
+        headers['x-lowdefy-build'] = buildId;
+    }
     const res = await fetch(url, {
         method,
-        headers: {
-            'Content-Type': 'application/json'
-        },
+        headers,
         body: JSON.stringify(body)
     });
+    const serverCaller = res.headers.get('x-lowdefy-caller');
+    if (shouldReloadForCaller({
+        serverCaller,
+        user,
+        window
+    })) {
+        window.location.reload();
+        return new Promise(()=>{});
+    }
+    recordCallerStamp({
+        lowdefy,
+        serverCaller
+    });
     if (!res.ok) {
         const body = await res.json();
+        if (res.status === 409 && shouldReloadForBuild({
+            bundleBuildId: buildId,
+            serverBuildId: body?.buildId,
+            window
+        })) {
+            window.location.reload();
+            return new Promise(()=>{});
+        }
         if (body?.['~e']) {
-            throw serializer.deserialize(body);
+            throw decodeServerError(body);
+        }
+        // The server answers an expected outcome (an auth gate's 401 or 403, a
+        // UserError's 400) itself, as { name, message } with no serialized error.
+        // Rebuilding its class keeps the name the engine, handleError and the dev
+        // tools tell an expected outcome from a fault by.
+        if (expectedErrorNames.has(body?.name)) {
+            const ExpectedError = lowdefyErrorTypes[body.name];
+            const error = new ExpectedError(body.message);
+            if (shouldReloadForAuthError({
+                error,
+                reloadOnAuthorizationError,
+                user,
+                window
+            })) {
+                window.location.reload();
+                return new Promise(()=>{});
+            }
+            throw error;
         }
         throw new Error(body.message || translate({
             key: 'client.requestError'

package/dist/setLowdefyUser.js

@@ -0,0 +1,32 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+// Sets the caller the app renders. CallAPI results (lowdefy.apiResponses, read
+// by _api) are app-level, so they are kept per organization as page contexts
+// are (see the engine's getContext): when the caller's organization changes,
+// the results fetched under the previous one are dropped, so none is read
+// under another organization. Results fetched with no organization hold no
+// organization's data and are kept when the caller gains one. A call still in
+// flight writes into the dropped object. Author global state is left alone.
+function setLowdefyUser({ lowdefy, user }) {
+    const organizationId = user?.organization_id ?? null;
+    const resultsOrganizationId = lowdefy._internal.apiResponsesOrganizationId;
+    if (!type.isNone(resultsOrganizationId) && resultsOrganizationId !== organizationId) {
+        lowdefy.apiResponses = {};
+    }
+    lowdefy._internal.apiResponsesOrganizationId = organizationId;
+    lowdefy.user = user ?? null;
+}
+export default setLowdefyUser;

package/dist/setupLink.js

@@ -13,12 +13,27 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { createLink } from '@lowdefy/engine';
+import { ConfigError } from '@lowdefy/errors';
 import { createUrl } from './adapters/url.js';
 function setupLink(lowdefy) {
     const { router } = lowdefy._internal;
     const { window } = lowdefy._internal.globals;
     const backLink = ()=>router.back();
     const disabledLink = ()=>{};
+    // window.open returns null when the browser blocks the popup - tell the user
+    // rather than throwing a TypeError on the null handle.
+    const openNewTab = (target)=>{
+        const handle = window.open(target, '_blank');
+        if (!handle) {
+            lowdefy._internal.displayMessage({
+                content: lowdefy._internal.translate('client.popupBlocked'),
+                status: 'info',
+                duration: 10
+            });
+            return;
+        }
+        return handle.focus();
+    };
     // `href` wins over `url`, and is used verbatim — the same precedence the anchor
     // renderer applies (createLinkComponent.js). createLink only ever sets one of
     // them, and it gives `url` a protocol before we see it while leaving `href`
@@ -29,16 +44,7 @@ function setupLink(lowdefy) {
     const newOriginLink = ({ href, url, query, newTab })=>{
         const target = href ?? `${url}${query ? `?${query}` : ''}`;
         if (newTab) {
-            const handle = window.open(target, '_blank');
-            if (!handle) {
-                lowdefy._internal.displayMessage({
-                    content: lowdefy._internal.translate('client.popupBlocked'),
-                    status: 'info',
-                    duration: 10
-                });
-                return;
-            }
-            return handle.focus();
+            return openNewTab(target);
         }
         return window.location.assign(target);
     };
@@ -47,11 +53,11 @@ function setupLink(lowdefy) {
     // let a same-page Link reflect state into the url without moving the page.
     const sameOriginLink = ({ newTab, pathname, query, replace, scroll, setInput })=>{
         if (newTab) {
-            return window.open(`${window.location.origin}${createUrl({
+            return openNewTab(`${window.location.origin}${createUrl({
                 basePath: lowdefy.basePath,
                 pathname,
                 query
-            })}`, '_blank').focus();
+            })}`);
         }
         setInput();
         const navigate = replace ? router.replace : router.push;
@@ -62,7 +68,7 @@ function setupLink(lowdefy) {
         });
     };
     const noLink = ()=>{
-        throw new Error(`Invalid Link.`);
+        throw new ConfigError('Invalid Link: no target resolved.');
     };
     return createLink({
         backLink,

package/dist/shouldReloadForAuthError.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import claimCallerReload from './claimCallerReload.js';
+// True when an auth refusal means the page shows a caller the server no longer
+// admits, so it must reload and let the server render the page again. A 401
+// while a user is rendered means the session ended; with no user it is an
+// ordinary refusal on a public page and is thrown, so it cannot loop. A
+// request's 403 reloads too: page requests share their page's auth, so the
+// caller lost the page. An endpoint's 403 does not, since endpoints carry their
+// own roles and a refusal is an ordinary outcome there. A two-factor enrolment
+// refusal never reloads. Matched by name: plugins bundle their own
+// @lowdefy/errors copy.
+function shouldReloadForAuthError({ error, reloadOnAuthorizationError, user, window }) {
+    if (error.name === 'AuthenticationError' && !type.isNone(user)) {
+        return claimCallerReload({
+            window
+        });
+    }
+    if (error.name === 'AuthorizationError' && reloadOnAuthorizationError === true) {
+        return claimCallerReload({
+            window
+        });
+    }
+    return false;
+}
+export default shouldReloadForAuthError;

package/dist/shouldReloadForBuild.js

@@ -0,0 +1,44 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+// sessionStorage key holding the server build this tab last reloaded for.
+const RELOADED_FOR_BUILD_KEY = 'lowdefy.reloadedForBuild';
+// True when the server answered from a different build than the bundle this
+// tab is running, so the tab must do a full load to pick up the current
+// bundle. Without this a page config from the new build can reference _js
+// functions the old bundle never shipped, and the old page's requests can
+// name requests, endpoints or auth routes the new build renamed or removed.
+//
+// A tab reloads at most once per server build: if the freshly loaded bundle
+// still disagrees with the server (a rolling deploy answering from mixed
+// versions, a proxy caching old HTML), reloading again would loop forever.
+// The old-config-on-old-bundle throw is the lesser failure in that case.
+function shouldReloadForBuild({ bundleBuildId, serverBuildId, window }) {
+    if (type.isNone(serverBuildId) || serverBuildId === bundleBuildId) {
+        return false;
+    }
+    try {
+        if (window.sessionStorage.getItem(RELOADED_FOR_BUILD_KEY) === serverBuildId) {
+            return false;
+        }
+        window.sessionStorage.setItem(RELOADED_FOR_BUILD_KEY, serverBuildId);
+    } catch (error) {
+        // Browsers with storage disabled throw on sessionStorage access. Without
+        // the once-per-build record the loop guard cannot work, so do not reload.
+        return false;
+    }
+    return true;
+}
+export default shouldReloadForBuild;

package/dist/shouldReloadForCaller.js

@@ -0,0 +1,50 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { AuthenticationError } from '@lowdefy/errors';
+import { parseCallerStamp } from '@lowdefy/helpers';
+import claimCallerReload from './claimCallerReload.js';
+import hasOtherRoles from './hasOtherRoles.js';
+import isOtherCaller from './isOtherCaller.js';
+// True when the page must reload because the server answered as another caller
+// than the page renders - another person signed in, or the organization was
+// switched, in another tab - or answered the same caller with other roles, so
+// the page never shows two callers' data or access the person no longer holds.
+// serverCaller is the response's x-lowdefy-caller header. A changed session or
+// membership list with the same person, organization and roles does not reload.
+// A second difference within the reload interval throws instead of reloading
+// again (see claimCallerReload).
+function shouldReloadForCaller({ serverCaller, user, window }) {
+    const stamp = parseCallerStamp(serverCaller);
+    const otherCaller = isOtherCaller({
+        stamp,
+        user
+    });
+    if (!otherCaller && !hasOtherRoles({
+        stamp,
+        user
+    })) {
+        return false;
+    }
+    if (claimCallerReload({
+        window
+    })) {
+        return true;
+    }
+    if (otherCaller) {
+        throw new AuthenticationError('The server answered as a different user or organization than this page shows. Reload the page.');
+    }
+    throw new AuthenticationError('The server answered with different roles than this page shows. Reload the page.');
+}
+export default shouldReloadForCaller;

package/dist/storage/clearUserStorage.js

@@ -0,0 +1,36 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import listUserStorageKeys from './listUserStorageKeys.js';
+// Removes every user key of this app not owned by keepUserId (all of them when keepUserId is
+// null), and the session storage Lowdefy writes for the person browsing. Device preferences and
+// the build reload markers stay.
+function clearUserStorage({ basePath, keepUserId, slug, window }) {
+    try {
+        listUserStorageKeys({
+            basePath,
+            slug,
+            storage: window.localStorage
+        }).filter(({ userId })=>type.isNone(keepUserId) || userId !== keepUserId).forEach(({ key })=>window.localStorage.removeItem(key));
+    } catch  {
+    // Storage the browser blocks holds nothing to clear.
+    }
+    try {
+        window.sessionStorage.removeItem('lowdefy_scroll');
+    } catch  {
+    // Storage the browser blocks holds nothing to clear.
+    }
+}
+export default clearUserStorage;