Skip to content

feat(apps): preview single-file data apps with app dev --file - #141

Open
redox wants to merge 1 commit into
mainfrom
su/add-dev-files
Open

redox wants to merge 1 commit into
mainfrom
su/add-dev-files

Conversation

@redox

@redox redox commented Oct 13, 2026

Copy link
Copy Markdown
Member

What

Adds altertable app dev --file index.tsx, which previews a single-file data app locally. This is the same index.tsx format that app publish and app validate already accept.

  • The CLI reads the literal defineDataApp({ scope }) from the file and refuses to start if it doesn't match the selected profile. The file goes through Bun.Transpiler first, so JSX, TypeScript and regex literals don't confuse the scope reader.
  • It installs a pinned @altertable/data-app runtime (the same version as the starter) under the config directory. Installation reuses the starter's frozen lockfile and is an offline no-op once installed.
  • The preview server bundles the file on demand, live-reloads when it changes, and sends SQL through the existing loopback lakehouse proxy. Profile credentials never reach the preview process.
  • /api/sql only accepts requests from the server's own origin (Origin and Sec-Fetch-Site checks), and every route except the static page checks the Host header to block DNS rebinding.
  • --dir and --file can't be combined. --port defaults to 25837 for --file.

Why

Single-file apps can be validated and published, but there was no way to iterate on one locally against the lakehouse before publishing.

Follow-up: the preview server and host page are generic and should eventually move into @altertable/data-app (next to serveLocalApp), leaving the CLI with a thin launcher.

Checklist

  • Tests added or updated
  • CHANGELOG.md updated
  • Breaking change noted in commit footer (BREAKING CHANGE: …) and changelog (not a breaking change)

./scripts/verify.sh passes locally. I also ran the preview server against the real @altertable/data-app 0.68.0 package: the page and bundle load, valid same-origin SQL goes through, a request without an Origin header gets 403, and an invalid query gets 400.

`altertable app dev --file index.tsx` previews a single-file data app
locally. The CLI reads the literal `defineDataApp` scope, refuses a
profile mismatch, installs a pinned `@altertable/data-app` runtime under
the config directory, and serves the file through the loopback lakehouse
proxy with live reload. The preview server only accepts SQL from its own
origin and host.

Co-authored-by: Cursor <cursoragent@cursor.com>
@redox

redox commented Oct 13, 2026

Copy link
Copy Markdown
Member Author

@francoischalifour it's a bit more code than I anticipated because with a single file we need to provide the runtime. But it works nicely!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants