@lowdefy/client 0.0.0-experimental-20260720072521 → 0.0.0-experimental-20260720135014

package/dist/Client.js

@@ -24,29 +24,7 @@ const Client = ({ auth, Components, config: rawConfig, jsMap, lowdefy, resetCont
     reset: false,
     setReset: ()=>undefined
 }, router, stage, types, window })=>{
-    // Memoize on the fetched config objects, not the per-render wrapper — the
-    // engine memoizes dynamic page contexts by config object identity, so the
-    // deserialized config must be stable across re-renders and only change when
-    // a new page fetch delivers new config.
-    const config = React.useMemo(()=>serializer.deserialize(rawConfig), [
-        rawConfig.pageConfig,
-        rawConfig.rootConfig
-    ]);
-    // Dynamic pages rebuild their engine context per fetch — remount the page
-    // tree with the rebuilt context instead of reconciling mounted blocks
-    // against it, which React can silently drop. Static pages keep their
-    // context and tree across navigations, so their key stays stable.
-    const buildRef = React.useRef({
-        config: null,
-        build: 0
-    });
-    if (buildRef.current.config !== config) {
-        buildRef.current = {
-            config,
-            build: buildRef.current.build + 1
-        };
-    }
-    const contextKey = config.pageConfig.dynamic === true ? `${config.pageConfig.id}:${buildRef.current.build}` : config.pageConfig.id;
+    const config = serializer.deserialize(rawConfig);
     initLowdefyContext({
         auth,
         Components,
@@ -73,7 +51,7 @@ const Client = ({ auth, Components, config: rawConfig, jsMap, lowdefy, resetCont
             }
         }
     }), /*#__PURE__*/ React.createElement(Context, {
-        key: contextKey,
+        key: config.pageConfig.id,
         config: config.pageConfig,
         jsMap: jsMap,
         lowdefy: lowdefy,

package/dist/Context.js

@@ -26,15 +26,6 @@ const ShortcutEffect = ({ context })=>{
     ]);
     return null;
 };
-const WebSocketsEffect = ({ context })=>{
-    useEffect(()=>{
-        context._internal.WebSockets.subscribeAll();
-        return ()=>context._internal.WebSockets.unsubscribeAll();
-    }, [
-        context
-    ]);
-    return null;
-};
 const Context = ({ children, config, jsMap, lowdefy, resetContext })=>{
     const context = getContext({
         config,
@@ -62,8 +53,6 @@ const Context = ({ children, config, jsMap, lowdefy, resetContext })=>{
         if (loadingOnInit) return '';
         return /*#__PURE__*/ React.createElement(React.Fragment, null, /*#__PURE__*/ React.createElement(ShortcutEffect, {
             context: context
-        }), /*#__PURE__*/ React.createElement(WebSocketsEffect, {
-            context: context
         }), children(context));
     });
 };

package/dist/auth/createAuthMethods.js

@@ -15,13 +15,12 @@
 */ import { type, urlQuery as urlQueryFn } from '@lowdefy/helpers';
 function getCallbackUrl({ lowdefy, callbackUrl = {} }) {
     const { home, pageId, urlQuery, url } = callbackUrl;
-    const targets = [
-        home,
-        pageId,
-        url
-    ].filter((target)=>target);
-    if (targets.length > 1) {
-        throw new Error(`Invalid callbackUrl: To avoid ambiguity, only one of 'home', 'pageId' or 'url' can be defined.`);
+    if ([
+        !home,
+        !pageId,
+        !url
+    ].filter((v)=>!v).length > 1) {
+        throw new Error(`Invalid Link: To avoid ambiguity, only one of 'home', 'pageId' or 'url' can be defined.`);
     }
     const query = type.isNone(urlQuery) ? '' : `${urlQueryFn.stringify(urlQuery)}`;
     if (home === true) {
@@ -35,442 +34,37 @@ function getCallbackUrl({ lowdefy, callbackUrl = {} }) {
     }
     return undefined;
 }
-// The action's callbackUrl param wins; otherwise honor the callbackUrl query
-// param set by the unauthenticated page redirect, so login returns to the
-// page the user asked for. Only relative paths are accepted from the query
-// to avoid open redirects.
-function resolveCallbackURL({ lowdefy, callbackUrl }) {
-    const explicit = getCallbackUrl({
-        lowdefy,
-        callbackUrl
-    });
-    if (!type.isNone(explicit)) {
-        if (explicit.startsWith('/')) {
-            return `${lowdefy.basePath ?? ''}${explicit}`;
-        }
-        return explicit;
-    }
-    const window = lowdefy._internal?.globals?.window;
-    const fromQuery = new URLSearchParams(window?.location?.search ?? '').get('callbackUrl');
-    if (type.isString(fromQuery) && fromQuery.startsWith('/')) {
-        return fromQuery;
-    }
-    return undefined;
-}
-// Maps the captchaToken action param onto the BetterAuth client's per-call
-// fetch options as the x-captcha-response header - the header the captcha
-// middleware reads. One helper so no auth method implements its own header
-// plumbing; the token never rides in the request body. Tokens are single-use
-// and short-lived: a failed submit consumes the token, so retry chains reset
-// the Captcha block for a fresh one.
-function captchaFetchOptions(captchaToken) {
-    if (type.isNone(captchaToken)) {
-        return {};
-    }
-    return {
-        fetchOptions: {
-            headers: {
-                'x-captcha-response': captchaToken
-            }
-        }
-    };
-}
-// BetterAuth client calls resolve with { data, error } instead of throwing -
-// rethrow so action onError chains fire on failed sign-in attempts.
-async function unwrap(promise) {
-    const { data, error } = await promise;
-    if (error) {
-        const authError = new Error(error.message ?? error.statusText ?? 'Authentication failed.');
-        authError.code = error.code;
-        authError.status = error.status;
-        throw authError;
-    }
-    return data;
-}
 function createAuthMethods(lowdefy, auth) {
-    // login and logout are Lowdefy functions that handle action params;
-    // the auth object provides the BetterAuth client methods.
-    async function login({ callbackUrl, captchaToken, email, magicLink, password, phoneNumber, providerId, ...rest } = {}) {
-        const callbackURL = resolveCallbackURL({
-            lowdefy,
-            callbackUrl
-        });
-        const captchaOptions = captchaFetchOptions(captchaToken);
-        const providers = auth.authConfig?.providers ?? [];
-        if (type.isNone(providerId) && type.isNone(email) && type.isNone(phoneNumber) && providers.length === 1) {
-            providerId = providers[0].id;
-        }
-        if (!type.isNone(providerId)) {
-            const provider = providers.find((configured)=>configured.id === providerId);
-            if (type.isNone(provider)) {
-                throw new Error(`Login provider "${providerId}" is not a configured auth provider.`);
-            }
-            if (provider.type === 'GenericOAuth') {
-                return unwrap(auth.signInOauth2({
-                    providerId,
-                    callbackURL,
-                    ...rest,
-                    ...captchaOptions
-                }));
-            }
-            return unwrap(auth.signInSocial({
-                provider: provider.type.toLowerCase(),
-                callbackURL,
-                ...rest,
-                ...captchaOptions
-            }));
-        }
-        if (magicLink === true) {
-            if (!type.isString(email)) {
-                throw new Error('Login with magicLink requires an "email" param.');
-            }
-            return unwrap(auth.signInMagicLink({
-                email,
-                callbackURL,
-                ...rest,
-                ...captchaOptions
-            }));
-        }
-        if (!type.isNone(phoneNumber)) {
-            if (!type.isString(password)) {
-                throw new Error('Login with phoneNumber requires a "password" param.');
-            }
-            const data = await unwrap(auth.signInPhoneNumber({
-                phoneNumber,
-                password,
-                ...rest,
-                ...captchaOptions
-            }));
-            if (data?.twoFactorRedirect) {
-                return data;
-            }
-            const window = lowdefy._internal?.globals?.window;
-            if (callbackURL && window) {
-                window.location.assign(callbackURL);
-            }
-            return data;
+    // login and logout are Lowdefy function that handle action params
+    // signIn and signOut are the next-auth methods
+    function login({ authUrl, callbackUrl, providerId, ...rest } = {}) {
+        if (type.isNone(providerId) && auth.authConfig?.providers.length === 1) {
+            providerId = auth.authConfig.providers[0].id;
         }
-        if (!type.isNone(email) || !type.isNone(password)) {
-            const data = await unwrap(auth.signInEmail({
-                email,
-                password,
-                ...rest,
-                ...captchaOptions
-            }));
-            // A 2FA-enrolled user gets a challenge, not a session - do not navigate
-            // as if signed in. The login page reads the outcome via _actions and
-            // routes to the app's challenge page, where TwoFactorVerify completes
-            // the session.
-            if (data?.twoFactorRedirect) {
-                return data;
-            }
-            const window = lowdefy._internal?.globals?.window;
-            if (callbackURL && window) {
-                window.location.assign(callbackURL);
-            }
-            return data;
-        }
-        throw new Error('Login requires a "providerId", "email" and "password", "phoneNumber" and "password", or "magicLink: true" param.');
-    }
-    // Creates an email/password account (BetterAuth's one signup endpoint).
-    // Social, magic-link and passkey have no separate signup - the account is
-    // created on first sign-in via login - so SignUp is email/password only.
-    async function signUp({ callbackUrl, captchaToken, email, name, password, ...rest } = {}) {
-        const callbackURL = resolveCallbackURL({
-            lowdefy,
-            callbackUrl
-        });
-        const data = await unwrap(auth.signUpEmail({
-            email,
-            password,
-            name,
-            callbackURL,
+        return auth.signIn(providerId, {
             ...rest,
-            ...captchaFetchOptions(captchaToken)
-        }));
-        // With requireEmailVerification the response carries no session - do not
-        // navigate; the page shows a "verify your email" message instead.
-        const window = lowdefy._internal?.globals?.window;
-        if (data?.token && callbackURL && window) {
-            window.location.assign(callbackURL);
-        }
-        return data;
-    }
-    async function logout({ callbackUrl } = {}) {
-        const callbackURL = getCallbackUrl({
-            lowdefy,
-            callbackUrl
+            callbackUrl: getCallbackUrl({
+                lowdefy,
+                callbackUrl
+            })
+        }, authUrl?.urlQuery);
+    }
+    function logout({ callbackUrl, redirect } = {}) {
+        return auth.signOut({
+            callbackUrl: getCallbackUrl({
+                lowdefy,
+                callbackUrl
+            }),
+            redirect
         });
-        const window = lowdefy._internal?.globals?.window;
-        const willNavigate = Boolean(callbackURL && window);
-        if (willNavigate && auth.suppressSignOutReload) {
-            // The sign-out reload in the session provider would race the callback
-            // navigation - suppress it for this sign-out.
-            auth.suppressSignOutReload();
-        }
-        const data = await unwrap(auth.signOut());
-        if (willNavigate) {
-            // Prefix basePath only onto app-relative callbacks - absolute URLs
-            // (external logout landing pages) navigate as given.
-            const target = callbackURL.startsWith('/') ? `${lowdefy.basePath ?? ''}${callbackURL}` : callbackURL;
-            window.location.assign(target);
-        }
-        return data;
-    }
-    // Switches the session's active organization - the session-scoped org
-    // switch. Roles and attributes resolve from the new active member row
-    // server-side; chain UpdateSession after to re-sync the client.
-    async function setActiveOrganization({ organizationId, organizationSlug } = {}) {
-        if (type.isNone(organizationId) && type.isNone(organizationSlug)) {
-            throw new Error('SetActiveOrganization requires an "organizationId" or "organizationSlug" param.');
-        }
-        return unwrap(auth.setActiveOrganization({
-            organizationId,
-            organizationSlug
-        }));
-    }
-    // Impersonates a user for the session's remaining lifetime. Authorization
-    // is BetterAuth's own admin access control, enforced server-side against
-    // the caller's role - this method adds no gate of its own. Chain
-    // UpdateSession after to re-sync the client with the impersonated user.
-    async function impersonateUser({ userId } = {}) {
-        if (!type.isString(userId)) {
-            throw new Error('ImpersonateUser requires a "userId" param.');
-        }
-        return unwrap(auth.impersonateUser({
-            userId
-        }));
-    }
-    // Ends impersonation and restores the original session. Chain
-    // UpdateSession after to re-sync the client with the original user.
-    async function stopImpersonating() {
-        return unwrap(auth.stopImpersonating());
     }
-    // Bypasses the cookie cache (a live re-resolve), so role, attribute or
-    // session changes surface immediately instead of after cookieCache.maxAge.
-    // Roles and merged attributes come from the server-resolved caller - the
-    // active member row read the base session does not carry.
     async function updateSession() {
-        await unwrap(auth.getSession({
-            disableCookieCache: true
-        }));
-        const { user } = await auth.getResolvedUser();
-        if (auth.updateResolvedUser) {
-            auth.updateResolvedUser(user ?? null);
-        }
-        lowdefy.user = user ?? null;
-    }
-    // Accepts an organization invitation. BetterAuth's endpoint enforces the
-    // session-email to invitation-email match - no re-check here.
-    async function acceptInvitation({ invitationId } = {}) {
-        if (!type.isString(invitationId)) {
-            throw new Error('AcceptInvitation requires an "invitationId" param.');
-        }
-        return unwrap(auth.acceptInvitation({
-            invitationId
-        }));
-    }
-    async function changePassword({ currentPassword, newPassword, revokeOtherSessions } = {}) {
-        if (!type.isString(currentPassword) || !type.isString(newPassword)) {
-            throw new Error('ChangePassword requires "currentPassword" and "newPassword" params.');
-        }
-        return unwrap(auth.changePassword({
-            currentPassword,
-            newPassword,
-            revokeOtherSessions
-        }));
-    }
-    async function passkeyDelete({ passkeyId } = {}) {
-        if (!type.isString(passkeyId)) {
-            throw new Error('PasskeyDelete requires a "passkeyId" param.');
-        }
-        return unwrap(auth.deletePasskey({
-            id: passkeyId
-        }));
-    }
-    // The BetterAuth client method runs the whole WebAuthn browser ceremony
-    // itself - it fetches the registration options, prompts the authenticator
-    // and verifies the result - so the ceremony runs inside the action.
-    async function passkeyRegister(params = {}) {
-        return unwrap(auth.addPasskey(params));
-    }
-    // Passkey sign-in: the BetterAuth client method runs the whole WebAuthn
-    // assertion ceremony itself (options fetch, navigator.credentials.get(),
-    // verification), so the ceremony runs inside the action. verify-authentication
-    // creates the session, so on success navigate to callbackUrl like login's
-    // email path. A successful assertion is terminal - passkey never returns a
-    // two-factor challenge - so there is no twoFactorRedirect branch.
-    async function passkeySignIn({ callbackUrl } = {}) {
-        const callbackURL = resolveCallbackURL({
-            lowdefy,
-            callbackUrl
-        });
-        const data = await unwrap(auth.signInPasskey());
-        const window = lowdefy._internal?.globals?.window;
-        if (callbackURL && window) {
-            window.location.assign(callbackURL);
-        }
-        return data;
-    }
-    // Dispatches by parameter, matching login: a phoneNumber param requests the
-    // reset code over SMS (the "phone.passwordReset.send" hook), otherwise
-    // email carries the reset link.
-    async function requestPasswordReset({ captchaToken, email, phoneNumber, redirectTo, ...rest } = {}) {
-        const captchaOptions = captchaFetchOptions(captchaToken);
-        if (type.isString(phoneNumber)) {
-            return unwrap(auth.phoneNumberRequestPasswordReset({
-                phoneNumber,
-                ...rest,
-                ...captchaOptions
-            }));
-        }
-        if (!type.isString(email)) {
-            throw new Error('RequestPasswordReset requires an "email" or "phoneNumber" param.');
-        }
-        return unwrap(auth.requestPasswordReset({
-            email,
-            redirectTo,
-            ...rest,
-            ...captchaOptions
-        }));
-    }
-    // Dispatches by parameter: a phoneNumber param resets with the SMS otp,
-    // otherwise token carries the emailed reset link's token.
-    async function resetPassword({ newPassword, otp, phoneNumber, token, ...rest } = {}) {
-        if (!type.isString(newPassword)) {
-            throw new Error('ResetPassword requires a "newPassword" param.');
-        }
-        if (type.isString(phoneNumber)) {
-            if (!type.isString(otp)) {
-                throw new Error('ResetPassword with phoneNumber requires an "otp" param.');
-            }
-            return unwrap(auth.phoneNumberResetPassword({
-                phoneNumber,
-                otp,
-                newPassword,
-                ...rest
-            }));
-        }
-        return unwrap(auth.resetPassword({
-            newPassword,
-            token,
-            ...rest
-        }));
-    }
-    // Revokes every session except the current one - the only session revoke
-    // exposed to config; per-session revoke would put session tokens in
-    // config reach.
-    async function revokeOtherSessions() {
-        return unwrap(auth.revokeOtherSessions());
-    }
-    // Resends the verification email for an unverified account - an unverified
-    // user holds no session, so this is a public call. The callbackUrl is
-    // where the emailed verification link lands after verifying, matching the
-    // signUp param of the same name.
-    async function sendVerificationEmail({ callbackUrl, captchaToken, email, ...rest } = {}) {
-        if (!type.isString(email)) {
-            throw new Error('SendVerificationEmail requires an "email" param.');
-        }
-        const callbackURL = resolveCallbackURL({
-            lowdefy,
-            callbackUrl
-        });
-        return unwrap(auth.sendVerificationEmail({
-            email,
-            callbackURL,
-            ...rest,
-            ...captchaFetchOptions(captchaToken)
-        }));
-    }
-    // Sends a sign-in/verification OTP over SMS through the app's
-    // "phone.otp.send" hook binding.
-    async function phoneNumberSendOtp({ captchaToken, phoneNumber, ...rest } = {}) {
-        if (!type.isString(phoneNumber)) {
-            throw new Error('PhoneNumberSendOtp requires a "phoneNumber" param.');
-        }
-        return unwrap(auth.phoneNumberSendOtp({
-            phoneNumber,
-            ...rest,
-            ...captchaFetchOptions(captchaToken)
-        }));
-    }
-    // The OTP sign-in: on success BetterAuth sets the session cookie (and
-    // creates the account under signUpOnVerification). Like TwoFactorVerify and
-    // unlike login it does not auto-navigate - verify serves sign-in, sign-up
-    // and phone-change confirmation, and only the app knows which page follows.
-    async function phoneNumberVerify({ code, phoneNumber, ...rest } = {}) {
-        if (!type.isString(phoneNumber) || !type.isString(code)) {
-            throw new Error('PhoneNumberVerify requires "phoneNumber" and "code" params.');
-        }
-        return unwrap(auth.phoneNumberVerify({
-            phoneNumber,
-            code,
-            ...rest
-        }));
-    }
-    async function twoFactorDisable({ password, ...rest } = {}) {
-        if (!type.isString(password)) {
-            throw new Error('TwoFactorDisable requires a "password" param.');
-        }
-        return unwrap(auth.twoFactorDisable({
-            password,
-            ...rest
-        }));
-    }
-    // Returns the totpURI and backup codes the page must render once - the
-    // action response is the only carrier (readable via _actions in the same
-    // event chain); no side-channel state.
-    async function twoFactorEnable({ password, ...rest } = {}) {
-        if (!type.isString(password)) {
-            throw new Error('TwoFactorEnable requires a "password" param.');
-        }
-        return unwrap(auth.twoFactorEnable({
-            password,
-            ...rest
-        }));
-    }
-    // Serves both enrolment confirmation and the sign-in challenge, dispatching
-    // by parameter (matching login): a backupCode param verifies a backup code,
-    // otherwise code verifies TOTP. The sign-in challenge verify sets the
-    // session cookie itself - navigation after is the app's business.
-    async function twoFactorVerify({ backupCode, code, trustDevice, ...rest } = {}) {
-        if (type.isString(backupCode)) {
-            return unwrap(auth.twoFactorVerifyBackupCode({
-                code: backupCode,
-                trustDevice,
-                ...rest
-            }));
-        }
-        if (type.isString(code)) {
-            return unwrap(auth.twoFactorVerifyTotp({
-                code,
-                trustDevice,
-                ...rest
-            }));
-        }
-        throw new Error('TwoFactorVerify requires a "code" or "backupCode" param.');
+        const session = await auth.getSession();
+        lowdefy.user = session?.user ?? null;
     }
     return {
-        acceptInvitation,
-        changePassword,
-        impersonateUser,
         login,
         logout,
-        passkeyDelete,
-        passkeyRegister,
-        passkeySignIn,
-        phoneNumberSendOtp,
-        phoneNumberVerify,
-        requestPasswordReset,
-        resetPassword,
-        revokeOtherSessions,
-        sendVerificationEmail,
-        setActiveOrganization,
-        signUp,
-        stopImpersonating,
-        twoFactorDisable,
-        twoFactorEnable,
-        twoFactorVerify,
         updateSession
     };
 }

package/dist/block/Block.js

@@ -19,7 +19,7 @@ import MountEvents from '../MountEvents.js';
 const Block = ({ block, Blocks, context, lowdefy, parentLoading })=>{
     const [updates, setUpdate] = useState(0);
     const loggedErrorsRef = useRef(new Set());
-    context._internal.updaters[block.id] = ()=>setUpdate(updates + 1);
+    lowdefy._internal.updaters[block.id] = ()=>setUpdate(updates + 1);
     const handleError = (error)=>{
         if (lowdefy._internal.handleError) {
             lowdefy._internal.handleError(error);

package/dist/initLowdefyContext.js

@@ -16,7 +16,6 @@
 import createCallAPI from './createCallAPI.js';
 import createAuthMethods from './auth/createAuthMethods.js';
 import createCallRequest from './createCallRequest.js';
-import createWebSocketClient from './websocket/createWebSocketClient.js';
 import createIcon from './createIcon.js';
 import createShortcutBadge from './createShortcutBadge.js';
 import createLinkComponent from './createLinkComponent.js';
@@ -51,7 +50,8 @@ function initLowdefyContext({ auth, Components, config, lowdefy, router, stage,
                 },
                 dispatch: ()=>undefined
             },
-            router
+            router,
+            updaters: {}
         };
         lowdefy.apiResponses = {};
         lowdefy.basePath = router.basePath;
@@ -63,7 +63,6 @@ function initLowdefyContext({ auth, Components, config, lowdefy, router, stage,
         lowdefy._internal.callAPI = createCallAPI(lowdefy);
         lowdefy._internal.auth = createAuthMethods(lowdefy, auth);
         lowdefy._internal.callRequest = createCallRequest(lowdefy);
-        lowdefy._internal.websocketClient = createWebSocketClient(lowdefy);
         lowdefy._internal.components.Link = createLinkComponent(lowdefy, Components.Link);
         lowdefy._internal.link = setupLink(lowdefy);
         lowdefy._internal.translate = (key, values)=>translate({
@@ -71,6 +70,7 @@ function initLowdefyContext({ auth, Components, config, lowdefy, router, stage,
                 values,
                 i18n: lowdefy.i18n
             });
+        lowdefy._internal.updateBlock = (blockId)=>lowdefy._internal.updaters[blockId] && lowdefy._internal.updaters[blockId]();
         lowdefy._internal.logger = createBrowserLogger();
         lowdefy._internal.handleError = createHandleError(lowdefy);
         lowdefy._internal.components.handleError = lowdefy._internal.handleError;
@@ -81,7 +81,7 @@ function initLowdefyContext({ auth, Components, config, lowdefy, router, stage,
     lowdefy.home = config.rootConfig.home || {};
     lowdefy.menus = config.rootConfig.menus;
     lowdefy.pageId = config.pageConfig.pageId;
-    lowdefy.user = auth?.user ?? null;
+    lowdefy.user = auth?.session?.user ?? null;
     return lowdefy;
 }
 export default initLowdefyContext;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/client",
-  "version": "0.0.0-experimental-20260720072521",
+  "version": "0.0.0-experimental-20260720135014",
   "license": "Apache-2.0",
   "description": "Lowdefy Client",
   "homepage": "https://lowdefy.com",
@@ -35,26 +35,26 @@
   "dependencies": {
     "@ant-design/icons": "6.1.0",
     "antd": "6.3.1",
-    "@lowdefy/block-utils": "0.0.0-experimental-20260720072521",
-    "@lowdefy/engine": "0.0.0-experimental-20260720072521",
-    "@lowdefy/errors": "0.0.0-experimental-20260720072521",
-    "@lowdefy/helpers": "0.0.0-experimental-20260720072521",
-    "@lowdefy/layout": "0.0.0-experimental-20260720072521",
-    "@lowdefy/logger": "0.0.0-experimental-20260720072521",
-    "dayjs": "1.11.20",
+    "@lowdefy/block-utils": "0.0.0-experimental-20260720135014",
+    "@lowdefy/engine": "0.0.0-experimental-20260720135014",
+    "@lowdefy/errors": "0.0.0-experimental-20260720135014",
+    "@lowdefy/helpers": "0.0.0-experimental-20260720135014",
+    "@lowdefy/layout": "0.0.0-experimental-20260720135014",
+    "@lowdefy/logger": "0.0.0-experimental-20260720135014",
+    "dayjs": "1.11.19",
     "react": "18.2.0",
     "react-dom": "18.2.0",
     "tinykeys": "^3.0.0"
   },
   "devDependencies": {
     "@jest/globals": "28.1.3",
-    "@lowdefy/jest-yaml-transform": "0.0.0-experimental-20260720072521",
-    "@swc/cli": "0.8.1",
-    "@swc/core": "1.15.32",
+    "@lowdefy/jest-yaml-transform": "0.0.0-experimental-20260720135014",
+    "@swc/cli": "0.8.0",
+    "@swc/core": "1.15.18",
     "@swc/jest": "0.2.39",
     "@testing-library/dom": "8.19.1",
     "@testing-library/react": "13.4.0",
-    "@testing-library/user-event": "14.6.1",
+    "@testing-library/user-event": "14.4.3",
     "copyfiles": "2.4.1",
     "jest": "28.1.3",
     "jest-environment-jsdom": "28.1.3",

package/dist/adapters/Head.js

@@ -1,32 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/ import React, { useEffect } from 'react';
-// Replaces next/head for the single use in @lowdefy/client's Head.js:
-// <Component><title>{properties.title}</title></Component>.
-// Extracts the title text and sets document.title; renders nothing.
-function Head({ children }) {
-    useEffect(()=>{
-        React.Children.forEach(children, (child)=>{
-            if (child?.type === 'title') {
-                const text = React.Children.toArray(child.props.children).join('');
-                if (text) {
-                    document.title = text;
-                }
-            }
-        });
-    });
-    return null;
-}
-export default Head;

package/dist/adapters/Link.js

@@ -1,63 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/ import React from 'react';
-import { type } from '@lowdefy/helpers';
-import { createUrl } from './url.js';
-// Replaces next/link for the contract used by @lowdefy/client's
-// createLinkComponent: href as { pathname, query } or string, replace,
-// scroll, onClick fired before navigation. Modified clicks (new tab,
-// middle click, download) fall through to native browser handling.
-function createLinkComponent({ router }) {
-    function Link({ children, href, onClick, replace, scroll, ...props }) {
-        const hrefObject = type.isString(href) ? {
-            pathname: href
-        } : href ?? {};
-        const { pathname, query } = hrefObject;
-        const url = createUrl({
-            basePath: router.basePath,
-            pathname,
-            query
-        });
-        function handleClick(event) {
-            if (onClick) {
-                onClick(event);
-            }
-            if (event.defaultPrevented || event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey || props.target === '_blank') {
-                return;
-            }
-            event.preventDefault();
-            if (replace) {
-                router.replace({
-                    pathname,
-                    query,
-                    scroll
-                });
-            } else {
-                router.push({
-                    pathname,
-                    query,
-                    scroll
-                });
-            }
-        }
-        return /*#__PURE__*/ React.createElement("a", {
-            ...props,
-            href: url,
-            onClick: handleClick
-        }, children);
-    }
-    return Link;
-}
-export default createLinkComponent;

package/dist/adapters/createRouter.js

@@ -1,115 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/ import { createUrl, parsePageId } from './url.js';
-// History-API router backing the @lowdefy/client router contract:
-// push({ pathname, query }), back(), basePath — plus subscribe() for the
-// page component and sessionStorage-backed scroll restoration.
-function createRouter({ basePath = '', window }) {
-    const listeners = new Set();
-    let entryKey = window.history.state?.lowdefyKey ?? `k${Date.now().toString(36)}`;
-    if ('scrollRestoration' in window.history) {
-        window.history.scrollRestoration = 'manual';
-    }
-    if (!window.history.state?.lowdefyKey) {
-        window.history.replaceState({
-            lowdefyKey: entryKey
-        }, '', window.location.href);
-    }
-    function readScrollPositions() {
-        try {
-            return JSON.parse(window.sessionStorage.getItem('lowdefy_scroll') ?? '{}');
-        } catch (e) {
-            return {};
-        }
-    }
-    function saveScrollPosition() {
-        try {
-            const positions = readScrollPositions();
-            positions[entryKey] = {
-                x: window.scrollX,
-                y: window.scrollY
-            };
-            window.sessionStorage.setItem('lowdefy_scroll', JSON.stringify(positions));
-        } catch (e) {
-        // sessionStorage unavailable (private mode) — scroll restoration degrades gracefully.
-        }
-    }
-    function restoreScrollPosition() {
-        const position = readScrollPositions()[entryKey];
-        window.requestAnimationFrame(()=>{
-            window.scrollTo(position?.x ?? 0, position?.y ?? 0);
-        });
-    }
-    function getLocation() {
-        return {
-            pageId: parsePageId(window.location.href, basePath),
-            pathname: window.location.pathname,
-            search: window.location.search
-        };
-    }
-    function notify() {
-        const location = getLocation();
-        listeners.forEach((listener)=>listener(location));
-    }
-    function navigate({ forceReload, pathname, query, replace = false, scroll = true }) {
-        const url = createUrl({
-            basePath,
-            pathname,
-            query
-        });
-        if (forceReload) {
-            window.location.assign(url);
-            return;
-        }
-        saveScrollPosition();
-        entryKey = `k${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
-        if (replace) {
-            window.history.replaceState({
-                lowdefyKey: entryKey
-            }, '', url);
-        } else {
-            window.history.pushState({
-                lowdefyKey: entryKey
-            }, '', url);
-        }
-        notify();
-        if (scroll) {
-            window.requestAnimationFrame(()=>{
-                window.scrollTo(0, 0);
-            });
-        }
-    }
-    window.addEventListener('popstate', (event)=>{
-        saveScrollPosition();
-        entryKey = event.state?.lowdefyKey ?? `k${Date.now().toString(36)}`;
-        notify();
-        restoreScrollPosition();
-    });
-    return {
-        basePath,
-        back: ()=>window.history.back(),
-        getLocation,
-        push: async (args)=>navigate(args),
-        replace: async (args)=>navigate({
-                ...args,
-                replace: true
-            }),
-        subscribe: (listener)=>{
-            listeners.add(listener);
-            return ()=>listeners.delete(listener);
-        }
-    };
-}
-export default createRouter;

package/dist/adapters/url.js

@@ -1,35 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/ import { type } from '@lowdefy/helpers';
-function serializeQuery(query) {
-    if (type.isNone(query) || query === '') {
-        return '';
-    }
-    if (type.isString(query)) {
-        return query;
-    }
-    return new URLSearchParams(query).toString();
-}
-function createUrl({ basePath = '', pathname, query }) {
-    const serializedQuery = serializeQuery(query);
-    return `${basePath}${pathname}${serializedQuery ? `?${serializedQuery}` : ''}`;
-}
-function parsePageId(url, basePath = '') {
-    const pathname = new URL(url, 'http://localhost').pathname;
-    const stripped = basePath && pathname.startsWith(basePath) ? pathname.slice(basePath.length) : pathname;
-    const pageId = stripped.replace(/^\//, '').replace(/\/$/, '');
-    return pageId === '' ? null : pageId;
-}
-export { createUrl, parsePageId, serializeQuery };

package/dist/websocket/createWebSocketClient.js

@@ -1,273 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/ const ACK_TIMEOUT_MS = 10 * 1000;
-const IDLE_CLOSE_GRACE_MS = 5 * 1000;
-const RECONNECT_BASE_MS = 500;
-const RECONNECT_CAP_MS = 15 * 1000;
-// One websocket per browser tab, shared by all channels, created lazily on
-// the first subscribe or publish. Connections are ephemeral in production
-// (serverless platforms close them at function max duration), so reconnect
-// with backoff and resubscribe is the steady state, not an edge case.
-function createWebSocketClient(lowdefy) {
-    const { window } = lowdefy._internal.globals;
-    // websocketId → { payload, handlers }
-    const subscriptions = new Map();
-    // websocketId → { resolve, reject, timer } for pending subscribe acks
-    const pendingSubscribes = new Map();
-    // requestId → { resolve, reject, timer } for pending publish acks
-    const pendingPublishes = new Map();
-    // Frames queued while the socket is (re)connecting.
-    const sendQueue = [];
-    let socket = null;
-    let openPromise = null;
-    let reconnectAttempt = 0;
-    let reconnectTimer = null;
-    let idleTimer = null;
-    let closedByClient = false;
-    let publishCounter = 0;
-    function url() {
-        const { location } = window;
-        const scheme = location.protocol === 'https:' ? 'wss' : 'ws';
-        return `${scheme}://${location.host}${lowdefy.basePath ?? ''}/api/websocket`;
-    }
-    function clearIdleTimer() {
-        if (idleTimer) {
-            clearTimeout(idleTimer);
-            idleTimer = null;
-        }
-    }
-    function scheduleIdleClose() {
-        clearIdleTimer();
-        if (subscriptions.size > 0) {
-            return;
-        }
-        // Grace period so rapid page navigation doesn't thrash connections.
-        idleTimer = setTimeout(()=>{
-            if (subscriptions.size === 0 && socket) {
-                closedByClient = true;
-                socket.close();
-                socket = null;
-                openPromise = null;
-            }
-        }, IDLE_CLOSE_GRACE_MS);
-    }
-    function send(frame) {
-        const message = JSON.stringify(frame);
-        if (socket && socket.readyState === window.WebSocket.OPEN) {
-            socket.send(message);
-            return;
-        }
-        sendQueue.push(message);
-        connect();
-    }
-    function flushQueue() {
-        while(sendQueue.length > 0 && socket && socket.readyState === window.WebSocket.OPEN){
-            socket.send(sendQueue.shift());
-        }
-    }
-    function resubscribeAll() {
-        subscriptions.forEach(({ payload }, websocketId)=>{
-            socket.send(JSON.stringify({
-                type: 'subscribe',
-                websocketId,
-                payload
-            }));
-        });
-    }
-    function handleFrame(frame) {
-        const { message, payload, requestId, websocketId } = frame;
-        const subscription = subscriptions.get(websocketId);
-        switch(frame.type){
-            case 'message':
-                subscription?.handlers.onMessage(payload);
-                return;
-            case 'subscribed':
-                {
-                    const pending = pendingSubscribes.get(websocketId);
-                    if (pending) {
-                        clearTimeout(pending.timer);
-                        pendingSubscribes.delete(websocketId);
-                        pending.resolve();
-                    }
-                    subscription?.handlers.onConnected();
-                    return;
-                }
-            case 'unsubscribed':
-                return;
-            case 'published':
-                {
-                    const pending = pendingPublishes.get(requestId);
-                    if (pending) {
-                        clearTimeout(pending.timer);
-                        pendingPublishes.delete(requestId);
-                        pending.resolve();
-                    }
-                    return;
-                }
-            case 'error':
-                {
-                    const error = new Error(message ?? 'WebSocket error.');
-                    if (requestId && pendingPublishes.has(requestId)) {
-                        const pending = pendingPublishes.get(requestId);
-                        clearTimeout(pending.timer);
-                        pendingPublishes.delete(requestId);
-                        pending.reject(error);
-                        return;
-                    }
-                    if (websocketId && pendingSubscribes.has(websocketId)) {
-                        const pending = pendingSubscribes.get(websocketId);
-                        clearTimeout(pending.timer);
-                        pendingSubscribes.delete(websocketId);
-                        subscriptions.delete(websocketId);
-                        pending.reject(error);
-                        return;
-                    }
-                    if (subscription) {
-                        subscription.handlers.onError(error.message);
-                        return;
-                    }
-                    lowdefy._internal.logger.warn(error);
-                    return;
-                }
-            default:
-        }
-    }
-    function handleClose() {
-        socket = null;
-        openPromise = null;
-        subscriptions.forEach(({ handlers })=>{
-            handlers.onDisconnected();
-        });
-        if (closedByClient) {
-            closedByClient = false;
-            return;
-        }
-        if (subscriptions.size === 0 && sendQueue.length === 0) {
-            return;
-        }
-        // Capped exponential backoff with full jitter.
-        const base = Math.min(RECONNECT_BASE_MS * 2 ** reconnectAttempt, RECONNECT_CAP_MS);
-        const delay = Math.random() * base;
-        reconnectAttempt += 1;
-        reconnectTimer = setTimeout(()=>{
-            reconnectTimer = null;
-            connect();
-        }, delay);
-    }
-    function connect() {
-        if (openPromise) {
-            return openPromise;
-        }
-        clearIdleTimer();
-        openPromise = new Promise((resolve, reject)=>{
-            const ws = new window.WebSocket(url());
-            ws.onopen = ()=>{
-                socket = ws;
-                reconnectAttempt = 0;
-                resubscribeAll();
-                flushQueue();
-                resolve();
-            };
-            ws.onmessage = (event)=>{
-                let frame;
-                try {
-                    frame = JSON.parse(event.data);
-                } catch (e) {
-                    return;
-                }
-                handleFrame(frame);
-            };
-            ws.onclose = ()=>{
-                if (socket !== ws) {
-                    // Never opened — treat as a failed connect and retry.
-                    openPromise = null;
-                    reject(new Error('WebSocket connection failed.'));
-                }
-                handleClose();
-            };
-            ws.onerror = ()=>{
-            // onclose always follows onerror — reconnect is handled there.
-            };
-        });
-        // Connection errors surface through subscribe/publish ack timeouts.
-        openPromise.catch(()=>{});
-        return openPromise;
-    }
-    function subscribe({ handlers, payload, websocketId }) {
-        clearIdleTimer();
-        subscriptions.set(websocketId, {
-            handlers,
-            payload
-        });
-        return new Promise((resolve, reject)=>{
-            const timer = setTimeout(()=>{
-                pendingSubscribes.delete(websocketId);
-                subscriptions.delete(websocketId);
-                reject(new Error(`Subscribe to "${websocketId}" timed out.`));
-            }, ACK_TIMEOUT_MS);
-            pendingSubscribes.set(websocketId, {
-                resolve,
-                reject,
-                timer
-            });
-            send({
-                type: 'subscribe',
-                websocketId,
-                payload
-            });
-        });
-    }
-    function unsubscribe({ websocketId }) {
-        if (!subscriptions.has(websocketId)) {
-            return;
-        }
-        subscriptions.delete(websocketId);
-        if (socket && socket.readyState === window.WebSocket.OPEN) {
-            socket.send(JSON.stringify({
-                type: 'unsubscribe',
-                websocketId
-            }));
-        }
-        scheduleIdleClose();
-    }
-    function publish({ payload, websocketId }) {
-        publishCounter += 1;
-        const requestId = `p${publishCounter}`;
-        return new Promise((resolve, reject)=>{
-            const timer = setTimeout(()=>{
-                pendingPublishes.delete(requestId);
-                reject(new Error(`Publish to "${websocketId}" timed out.`));
-            }, ACK_TIMEOUT_MS);
-            pendingPublishes.set(requestId, {
-                resolve,
-                reject,
-                timer
-            });
-            send({
-                type: 'publish',
-                websocketId,
-                requestId,
-                payload
-            });
-        });
-    }
-    return {
-        connect,
-        publish,
-        subscribe,
-        unsubscribe
-    };
-}
-export default createWebSocketClient;