@lua-ai-global/app-client

The page side of a Lua web app. It runs inside the iframe that Lua Workspace or the admin console opens on the app's own origin, and gives the page:

• A session. The shell puts a single-use handoff code in the URL fragment; the client exchanges it with Lua's auth service, keeps the token in memory (never in cookies or storage) and renews it before it expires.
• The bridge. It tells the shell when it is ready (lua:ready), takes the shell's theme, locale and path (lua:init), and asks for a new session when one cannot be renewed (lua:auth:expired). Messages go only to, and are only accepted from, the shell origins the Lua gateway lists.
• Route calls. lua.api(method, path, body?) calls one of the app's routes as the signed-in person. A 401 renews the session once and retries.

import { lua } from "@lua-ai-global/app-client";

lua.onInit((init) => document.documentElement.classList.toggle("dark", init.theme === "dark"));
const { message } = await lua.api<{ message: string }>("GET", "/hello");

lua apps new <name> (lua-cli) adds this package to a new app's web/ project. Under lua apps dev the bootstrap says dev: true: there is no handoff and the CLI's dev server runs routes as the developer.

Develop

pnpm --filter @lua-ai-global/app-client test    # vitest
pnpm --filter @lua-ai-global/app-client build   # tsup → dist/