@lowdefy/build 5.6.0 → 6.1.0

package/dist/build/buildAuth/buildAuthStrategies.js

@@ -0,0 +1,117 @@
+/* eslint-disable no-param-reassign */ /*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+const strategyTypes = [
+    'apiKey',
+    'jwt'
+];
+// Prototype-pollution vectors rejected as claimMapping path segments.
+const reservedKeys = new Set([
+    '__proto__',
+    'constructor',
+    'prototype',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__'
+]);
+function setDefault(object, key, value) {
+    if (type.isNone(object[key])) {
+        object[key] = value;
+    }
+}
+function validateApiKeyStrategy({ strategy, configKey }) {
+    const properties = strategy.properties ?? {};
+    if (!type.isArray(properties.keys) || properties.keys.length === 0) {
+        throw new ConfigError(`Auth strategy "${strategy.id}" requires "properties.keys" to be a non-empty array of keys.`, {
+            configKey
+        });
+    }
+    properties.keys.forEach((key, index)=>{
+        if (type.isNone(key.value)) {
+            throw new ConfigError(`Auth strategy "${strategy.id}" key at index ${index} is missing "value". Reference the key with the _secret operator.`, {
+                configKey
+            });
+        }
+    });
+}
+function validateJwtStrategy({ strategy, configKey }) {
+    const properties = strategy.properties ?? {};
+    const hasSecret = !type.isNone(properties.secret);
+    const hasJwksUri = !type.isNone(properties.jwksUri);
+    if (hasSecret === hasJwksUri) {
+        throw new ConfigError(`Auth strategy "${strategy.id}" requires exactly one of "properties.secret" or "properties.jwksUri" to verify token signatures.`, {
+            configKey
+        });
+    }
+    // The algorithms allowlist restricts which signing algorithms are accepted,
+    // preventing "alg: none" and algorithm-confusion downgrade attacks.
+    if (!type.isArray(properties.algorithms) || properties.algorithms.length === 0) {
+        throw new ConfigError(`Auth strategy "${strategy.id}" requires "properties.algorithms" to be a non-empty array restricting the accepted signing algorithms.`, {
+            configKey
+        });
+    }
+    // claimMapping field names become object keys on the user and attributes
+    // objects the jwt verifier builds per request - gated here where the config
+    // location is available, so a pollution-vector key never reaches runtime.
+    Object.keys(properties.claimMapping ?? {}).forEach((field)=>{
+        const reservedSegment = field.split('.').find((segment)=>reservedKeys.has(segment));
+        if (!type.isNone(reservedSegment)) {
+            throw new ConfigError(`Auth strategy "${strategy.id}" claimMapping field "${field}" uses reserved name "${reservedSegment}".`, {
+                configKey
+            });
+        }
+    });
+}
+// Validates auth.strategies and writes per-entry defaults so the runtime
+// never falls back. Objects are mutated in place to preserve ~k markers.
+function buildAuthStrategies({ components }) {
+    const seenIds = {};
+    (components.auth.strategies ?? []).forEach((strategy)=>{
+        const configKey = strategy['~k'];
+        if (seenIds[strategy.id] === true) {
+            throw new ConfigError(`Duplicate auth strategy id "${strategy.id}".`, {
+                configKey
+            });
+        }
+        seenIds[strategy.id] = true;
+        if (!strategyTypes.includes(strategy.type)) {
+            throw new ConfigError(`Auth strategy "${strategy.id}" has unknown type "${strategy.type}". Valid types are: ${strategyTypes.join(', ')}.`, {
+                received: strategy.type,
+                configKey
+            });
+        }
+        if (strategy.type === 'apiKey') {
+            validateApiKeyStrategy({
+                strategy,
+                configKey
+            });
+        }
+        if (strategy.type === 'jwt') {
+            validateJwtStrategy({
+                strategy,
+                configKey
+            });
+        }
+        setDefault(strategy, 'roles', []);
+        setDefault(strategy, 'attributes', {});
+        if (strategy.type === 'apiKey') {
+            setDefault(strategy.properties, 'headerName', 'X-API-Key');
+        }
+    });
+    return components;
+}
+export default buildAuthStrategies;

package/dist/build/buildAuth/buildWebsocketAuth.js

@@ -0,0 +1,55 @@
+/* eslint-disable no-param-reassign */ /*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+import getProtectedWebsockets from './getProtectedWebsockets.js';
+import getWebsocketRoles from './getWebsocketRoles.js';
+import { isInPatternList } from './matchPattern.js';
+function buildWebsocketAuth({ components, context }) {
+    const protectedWebsockets = getProtectedWebsockets({
+        components
+    });
+    const websocketRoles = getWebsocketRoles({
+        components
+    });
+    let configPublicWebsockets = [];
+    if (type.isArray(components.auth.websockets.public)) {
+        configPublicWebsockets = components.auth.websockets.public;
+    }
+    (components.websockets || []).forEach((websocket)=>{
+        if (websocketRoles[websocket.id]) {
+            if (isInPatternList(websocket.id, configPublicWebsockets)) {
+                throw new ConfigError(`Websocket "${websocket.id}" is both protected by roles and public.`, {
+                    received: websocketRoles[websocket.id],
+                    configKey: websocket['~k']
+                });
+            }
+            websocket.auth = {
+                public: false,
+                roles: websocketRoles[websocket.id]
+            };
+        } else if (protectedWebsockets.includes(websocket.id)) {
+            websocket.auth = {
+                public: false
+            };
+        } else {
+            websocket.auth = {
+                public: true
+            };
+        }
+    });
+    return components;
+}
+export default buildWebsocketAuth;

package/dist/build/buildAuth/getProtectedWebsockets.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { isInPatternList } from './matchPattern.js';
+function getProtectedWebsockets({ components }) {
+    const websocketIds = (components.websockets ?? []).map((websocket)=>websocket.id);
+    let protectedWebsockets = [];
+    if (type.isArray(components.auth.websockets.public)) {
+        protectedWebsockets = websocketIds.filter((websocketId)=>!isInPatternList(websocketId, components.auth.websockets.public));
+    } else if (components.auth.websockets.protected === true) {
+        protectedWebsockets = websocketIds;
+    } else if (type.isArray(components.auth.websockets.protected)) {
+        protectedWebsockets = websocketIds.filter((websocketId)=>isInPatternList(websocketId, components.auth.websockets.protected));
+    }
+    return protectedWebsockets;
+}
+export default getProtectedWebsockets;

package/dist/build/buildAuth/getWebsocketRoles.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { matchesPattern } from './matchPattern.js';
+function getWebsocketRoles({ components }) {
+    const roles = components.auth.websockets.roles;
+    const websocketIds = (components.websockets ?? []).map((websocket)=>websocket.id);
+    const websocketRoles = {};
+    Object.keys(roles).forEach((roleName)=>{
+        roles[roleName].forEach((pattern)=>{
+            websocketIds.forEach((websocketId)=>{
+                if (matchesPattern(websocketId, pattern)) {
+                    if (!websocketRoles[websocketId]) {
+                        websocketRoles[websocketId] = new Set();
+                    }
+                    websocketRoles[websocketId].add(roleName);
+                }
+            });
+        });
+    });
+    Object.keys(websocketRoles).forEach((websocketId)=>{
+        websocketRoles[websocketId] = [
+            ...websocketRoles[websocketId]
+        ];
+    });
+    return websocketRoles;
+}
+export default getWebsocketRoles;

package/dist/build/buildAuth/validateAuthConfig.js

@@ -32,6 +32,12 @@ function validateAuthConfig({ components, context }) {
     if (type.isNone(components.auth.api.roles)) {
         components.auth.api.roles = {};
     }
+    if (type.isNone(components.auth.websockets)) {
+        components.auth.websockets = {};
+    }
+    if (type.isNone(components.auth.websockets.roles)) {
+        components.auth.websockets.roles = {};
+    }
     if (type.isNone(components.auth.authPages)) {
         components.auth.authPages = {};
     }
@@ -93,9 +99,15 @@ function validateAuthConfig({ components, context }) {
         context,
         entity: 'pages'
     });
-    // Validate NEXTAUTH_SECRET is set when auth providers are configured
-    if (components.auth.providers.length > 0 && type.isNone(process.env.NEXTAUTH_SECRET)) {
-        throw new ConfigError('Auth providers are configured but NEXTAUTH_SECRET environment variable is not set. ' + 'Set NEXTAUTH_SECRET to a secure random string (e.g., generate with `openssl rand -base64 32`).', {
+    validateMutualExclusivity({
+        components,
+        context,
+        entity: 'websockets'
+    });
+    // Validate AUTH_SECRET is set when auth providers are configured. Auth.js v5
+    // reads AUTH_SECRET; the v4 NEXTAUTH_SECRET variable is not supported.
+    if (components.auth.providers.length > 0 && type.isNone(process.env.AUTH_SECRET)) {
+        throw new ConfigError('Auth providers are configured but AUTH_SECRET environment variable is not set. ' + 'Set AUTH_SECRET to a secure random string (e.g., generate with `openssl rand -base64 32`).', {
             configKey: components.auth.providers['~k'] ?? components.auth['~k']
         });
     }

package/dist/build/buildEnvironments.js

@@ -0,0 +1,261 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError, ConfigWarning } from '@lowdefy/errors';
+import checkEnvironmentGuards from '@lowdefy/node-utils/checkEnvironmentGuards.js';
+import getEnvironmentNames from '../utils/getEnvironmentNames.js';
+import validateEnvironmentGuards from './validateEnvironmentGuards.js';
+// Environment names become a path segment (/api/cron-forward/<environment>/<endpointId>).
+const environmentNamePattern = /^[A-Za-z0-9\-_]+$/;
+// Features an environment can switch off with `<feature>.enabled: false`. Logging has no switch.
+const switchableFeatures = [
+    'cron',
+    'email',
+    'sentry'
+];
+function isAbsoluteHttpUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:';
+    } catch  {
+        return false;
+    }
+}
+function validateEmailFilter({ name, filter, configKey }) {
+    const where = `config.environments.${name}.email.filter`;
+    if (!type.isObject(filter)) {
+        throw new ConfigError(`App "${where}" should be an object.`, {
+            received: filter,
+            configKey
+        });
+    }
+    const { replaceAddress, allowlist, regex } = filter;
+    if (!type.isNone(replaceAddress) && (!type.isString(replaceAddress) || replaceAddress === '')) {
+        throw new ConfigError(`App "${where}.replaceAddress" should be a non-empty string.`, {
+            received: replaceAddress,
+            configKey
+        });
+    }
+    if (!type.isNone(allowlist) && (!type.isArray(allowlist) || !allowlist.every((domain)=>type.isString(domain)))) {
+        throw new ConfigError(`App "${where}.allowlist" should be an array of strings.`, {
+            received: allowlist,
+            configKey
+        });
+    }
+    if (!type.isNone(regex)) {
+        if (!type.isString(regex)) {
+            throw new ConfigError(`App "${where}.regex" should be a string.`, {
+                received: regex,
+                configKey
+            });
+        }
+        // Compiled here so a broken pattern fails the build, not every mail request in the environment.
+        try {
+            new RegExp(regex);
+        } catch (error) {
+            throw new ConfigError(`App "${where}.regex" is not a valid regular expression: ${error.message}`, {
+                configKey
+            });
+        }
+    }
+}
+function validateEnvironment({ name, environment, configKey }) {
+    if (name === 'default') {
+        throw new ConfigError('Environment name "default" is reserved: it names the value every other environment inherits.', {
+            configKey
+        });
+    }
+    if (!environmentNamePattern.test(name)) {
+        throw new ConfigError(`Environment name "${name}" is invalid. Environment names must only contain A-Z, a-z, 0-9, "-" and "_".`, {
+            configKey
+        });
+    }
+    if (!type.isObject(environment)) {
+        throw new ConfigError(`App "config.environments.${name}" should be an object.`, {
+            received: environment,
+            configKey
+        });
+    }
+    const key = environment['~k'] ?? configKey;
+    const { url, cron, email, sentry } = environment;
+    if (!type.isUndefined(url) && (!type.isString(url) || !isAbsoluteHttpUrl(url))) {
+        throw new ConfigError(`App "config.environments.${name}.url" should be an absolute http(s) URL, e.g. "https://staging.example.com".`, {
+            received: url,
+            configKey: key
+        });
+    }
+    if (!type.isUndefined(cron)) {
+        if (!type.isObject(cron)) {
+            throw new ConfigError(`App "config.environments.${name}.cron" should be an object.`, {
+                received: cron,
+                configKey: key
+            });
+        }
+        if (!type.isUndefined(cron.secret)) {
+            if (!type.isString(cron.secret) || cron.secret === '') {
+                throw new ConfigError(`App "config.environments.${name}.cron.secret" should be the name of the Lowdefy secret holding the environment's CRON_SECRET.`, {
+                    received: cron.secret,
+                    configKey: cron['~k'] ?? key
+                });
+            }
+            if (type.isUndefined(url)) {
+                throw new ConfigError(`Environment "${name}" has a cron.secret but no url. Crons are forwarded to an environment's url, so set the environment's deployment origin.`, {
+                    configKey: key
+                });
+            }
+        }
+    }
+    if (!type.isUndefined(sentry) && !type.isObject(sentry)) {
+        throw new ConfigError(`App "config.environments.${name}.sentry" should be an object.`, {
+            received: sentry,
+            configKey: key
+        });
+    }
+    switchableFeatures.forEach((feature)=>{
+        const enabled = environment[feature]?.enabled;
+        if (!type.isUndefined(enabled) && !type.isBoolean(enabled)) {
+            throw new ConfigError(`App "config.environments.${name}.${feature}.enabled" should be a boolean.`, {
+                received: enabled,
+                configKey: environment[feature]['~k'] ?? key
+            });
+        }
+    });
+    validateEnvironmentGuards({
+        name,
+        guards: environment.guards,
+        configKey: key
+    });
+    if (!type.isUndefined(email)) {
+        if (!type.isObject(email)) {
+            throw new ConfigError(`App "config.environments.${name}.email" should be an object.`, {
+                received: email,
+                configKey: key
+            });
+        }
+        if (!type.isUndefined(email.filter)) {
+            validateEmailFilter({
+                name,
+                filter: email.filter,
+                configKey: email['~k'] ?? key
+            });
+        }
+    }
+}
+// LOWDEFY_ENVIRONMENT wins over config.environment: the variable is set per deployment, while a
+// literal in config is shared by every deployment and would force them all into one environment.
+function getCurrentEnvironmentName({ config }) {
+    if (!type.isNone(config.environment)) {
+        if (!type.isString(config.environment) || config.environment === '') {
+            throw new ConfigError('App "config.environment" should be a non-empty string.', {
+                received: config.environment,
+                configKey: config['~k']
+            });
+        }
+    }
+    const fromEnv = process.env.LOWDEFY_ENVIRONMENT?.trim();
+    if (!type.isNone(fromEnv) && fromEnv !== '') return fromEnv;
+    return config.environment ?? undefined;
+}
+// Resolves the deployment environments once for the whole build. After this step:
+//   - config.environments holds every declared environment ({ url, cron, email }), validated;
+//   - config.environment names the environment this build is for (the LOWDEFY_ENVIRONMENT
+//     variable, else config.environment), and must be declared when environments are.
+// Everything environment-specific (cron registration and forwarding, notification links, the auth
+// base URL, the email delivery filter, the Sentry environment) reads the current environment from
+// there instead of from its own environment variable. buildLogger, which runs next, applies the
+// Sentry settings.
+function buildEnvironments({ components, context }) {
+    const config = components.config;
+    const configKey = config['~k'];
+    const current = getCurrentEnvironmentName({
+        config
+    });
+    // config.cron.environments (6.0) is replaced by config.environments. Fail with the migration
+    // rather than run two shapes side by side.
+    if (!type.isUndefined(config.cron)) {
+        throw new ConfigError('App "config.cron" is replaced by "config.environments". Declare the deployment environments under "config.environments": give every environment its "url", move each "secret" to "cron.secret" and "enabled" to "cron.enabled", and set LOWDEFY_ENVIRONMENT on each deployment.', {
+            configKey: config.cron?.['~k'] ?? configKey
+        });
+    }
+    const environments = config.environments;
+    if (!type.isUndefined(environments)) {
+        if (!type.isObject(environments)) {
+            throw new ConfigError('App "config.environments" should be an object.', {
+                received: environments,
+                configKey
+            });
+        }
+        const envKey = environments['~k'] ?? configKey;
+        const names = getEnvironmentNames(environments);
+        if (names.length === 0) {
+            throw new ConfigError('App "config.environments" declares no environments.', {
+                configKey: envKey
+            });
+        }
+        names.forEach((name)=>validateEnvironment({
+                name,
+                environment: environments[name],
+                configKey: envKey
+            }));
+        if (!type.isUndefined(current) && !names.includes(current)) {
+            throw new ConfigError(`The current environment "${current}" (LOWDEFY_ENVIRONMENT) is not declared in "config.environments". Declared environments: ${names.join(', ')}.`, {
+                configKey: envKey
+            });
+        }
+        // Without a current environment every environment setting fails open: no email filter, no
+        // forwarded crons, no guards. That is an error in a prod build, and a warning on the dev server.
+        if (type.isUndefined(current)) {
+            context.handleWarning(new ConfigWarning(`App "config.environments" is declared but no current environment is set. Set LOWDEFY_ENVIRONMENT to the environment this deployment is (${names.join(', ')}): until then no environment setting (url, cron, email filter, guards) applies and only the "default" schedules are registered.`, {
+                configKey: envKey,
+                prodError: true
+            }));
+        }
+    }
+    // The current environment's guards are checked against this build's variables and kept for the
+    // production server, which checks them again at startup; other environments' guards are dropped.
+    if (!type.isUndefined(environments)) {
+        if (!type.isUndefined(current)) {
+            checkEnvironmentGuards({
+                name: current,
+                guards: environments[current].guards,
+                configKey: environments[current]['~k'] ?? configKey
+            });
+        }
+        getEnvironmentNames(environments).filter((name)=>name !== current).forEach((name)=>{
+            delete environments[name].guards;
+        });
+    }
+    if (type.isUndefined(current)) {
+        delete config.environment;
+        return;
+    }
+    config.environment = current;
+    const settings = config.environments?.[current] ?? {};
+    // The dev server is the local app, not the deployment the environment's url names, so the url is
+    // dropped: auth and notification links stay on the request origin even when a local .env names a
+    // deployed environment.
+    if (context.stage === 'dev') {
+        delete settings.url;
+    }
+    const disabled = switchableFeatures.filter((feature)=>settings[feature]?.enabled === false);
+    // App metadata is the deploy identity the server stamps on every log line and the client reads
+    // with _app, so the environment and the features it switches off travel with it — the browser
+    // has no other view of config.environments.
+    if (type.isObject(components.appMeta)) {
+        components.appMeta.environment = current;
+        components.appMeta.disabled = disabled;
+    }
+}
+export default buildEnvironments;

package/dist/build/buildImports/buildImportsDev.js

@@ -27,9 +27,12 @@ function getPluginPackages({ components }) {
     getPackages(components.types.auth.callbacks);
     getPackages(components.types.auth.events);
     getPackages(components.types.auth.providers);
+    getPackages(components.types.auth.strategies);
     getPackages(components.types.blocks);
     getPackages(components.types.connections);
+    getPackages(components.types.notifications);
     getPackages(components.types.requests);
+    getPackages(components.types.websockets);
     getPackages(components.types.operators.client);
     getPackages(components.types.operators.server);
     return pluginPackages;
@@ -74,6 +77,10 @@ function buildImportsDev({ components, context }) {
             providers: buildImportClassDev({
                 pluginPackages,
                 map: context.typesMap.auth.providers
+            }),
+            strategies: buildImportClassDev({
+                pluginPackages,
+                map: context.typesMap.auth.strategies
             })
         },
         blocks,
@@ -87,10 +94,18 @@ function buildImportsDev({ components, context }) {
             context,
             defaults: defaultIconsDev
         }),
+        notifications: buildImportClassDev({
+            pluginPackages,
+            map: context.typesMap.notifications
+        }),
         requests: buildImportClassDev({
             pluginPackages,
             map: context.typesMap.requests
         }),
+        websockets: buildImportClassDev({
+            pluginPackages,
+            map: context.typesMap.websockets
+        }),
         operators: {
             client: buildImportClassDev({
                 pluginPackages,

package/dist/build/buildImports/buildImportsProd.js

@@ -30,7 +30,8 @@ function buildImportsProd({ components, context }) {
             adapters: buildImportClassProd(components.types.auth.adapters),
             callbacks: buildImportClassProd(components.types.auth.callbacks),
             events: buildImportClassProd(components.types.auth.events),
-            providers: buildImportClassProd(components.types.auth.providers)
+            providers: buildImportClassProd(components.types.auth.providers),
+            strategies: buildImportClassProd(components.types.auth.strategies)
         },
         blocks,
         connections: buildImportClassProd(components.types.connections),
@@ -40,7 +41,9 @@ function buildImportsProd({ components, context }) {
             context,
             defaults: defaultIconsProd
         }),
+        notifications: buildImportClassProd(components.types.notifications),
         requests: buildImportClassProd(components.types.requests),
+        websockets: buildImportClassProd(components.types.websockets),
         operators: {
             client: buildImportClassProd(components.types.operators.client),
             server: buildImportClassProd(components.types.operators.server)

package/dist/build/buildJs/generateClientJsModule.js

@@ -0,0 +1,27 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import generateJsFile from './generateJsFile.js';
+// Single definition of the client _js function prototype. Both the full build
+// (writeJs) and the dev server's per-page fold (getPageJitEnrichment) generate
+// client jsMap module text through here, so the destructured argument list has
+// exactly one source of truth.
+const CLIENT_JS_FUNCTION_PROTOTYPE = `{ actions, args, event, input, location, lowdefyApp, lowdefyGlobal, request, state, urlQuery, user }`;
+function generateClientJsModule(map) {
+    return generateJsFile({
+        map,
+        functionPrototype: CLIENT_JS_FUNCTION_PROTOTYPE
+    });
+}
+export default generateClientJsModule;

package/dist/build/buildJs/writeJs.js

@@ -12,12 +12,10 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import generateJsFile from './generateJsFile.js';
+*/ import generateClientJsModule from './generateClientJsModule.js';
+import generateJsFile from './generateJsFile.js';
 async function writeJs({ context }) {
-    await context.writeBuildArtifact('plugins/operators/clientJsMap.js', generateJsFile({
-        map: context.jsMap.client,
-        functionPrototype: `{ actions, args, event, input, location, lowdefyApp, lowdefyGlobal, request, state, urlQuery, user }`
-    }));
+    await context.writeBuildArtifact('plugins/operators/clientJsMap.js', generateClientJsModule(context.jsMap.client));
     await context.writeBuildArtifact('plugins/operators/serverJsMap.js', generateJsFile({
         map: context.jsMap.server,
         functionPrototype: `{ args, item, lowdefyApp, payload, secret, state, step, user }`