@lowdefy/server-dev 0.0.0-experimental-20260720072521 → 0.0.0-experimental-20260720135014

package/lib/server/auth/createSystemContext.js

@@ -1,70 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import path from 'node:path';
-import { createSystemContext as buildSystemContext } from '@lowdefy/api';
-import { getSecretsFromEnv } from '@lowdefy/node-utils';
-import { v4 as uuid } from 'uuid';
-
-import agents from '../../../build/plugins/agents.js';
-import appMeta from '../../build/appMeta.js';
-import config from '../../build/config.js';
-import connections from '../../../build/plugins/connections.js';
-import createHandleError from '../log/createHandleError.js';
-import createLogger from '../log/createLogger.js';
-import fileCache from '../fileCache.js';
-import i18nConfig from '../../build/i18n.js';
-import loadDynamicJsMap from '../loadDynamicJsMap.js';
-import notifications from '../../../build/plugins/notifications.js';
-import operators from '../../../build/plugins/operators/server.js';
-import steps from '../../../build/plugins/steps.js';
-import websockets from '../../../build/plugins/websockets.js';
-
-const secrets = getSecretsFromEnv();
-
-// Builds a fresh system context per auth hook fire - the trusted internal
-// caller the BetterAuth engine uses to invoke hook endpoints. All fields are
-// startup singletons except the per-fire rid, logger, handleError, the
-// dynamic jsMap re-read (JIT rebuilds rewrite serverJsMap.js), and auth -
-// auth is threaded in by the caller (createHookDispatch) rather than
-// imported directly, since it comes from the same BetterAuth construction
-// that this factory is a dependency of (see createHookDispatch.js).
-function createSystemContext({ auth } = {}) {
-  const rid = uuid();
-  const buildDirectory = path.join(process.cwd(), 'build');
-  return buildSystemContext({
-    rid,
-    agents,
-    appMeta,
-    auth,
-    buildDirectory,
-    config,
-    configDirectory: process.env.LOWDEFY_DIRECTORY_CONFIG || process.cwd(),
-    connections,
-    createHandleError,
-    fileCache,
-    i18n: i18nConfig,
-    jsMap: loadDynamicJsMap(buildDirectory),
-    logger: createLogger({ rid }),
-    notifications,
-    operators,
-    secrets,
-    steps,
-    websockets,
-  });
-}
-
-export default createSystemContext;

package/lib/server/auth/getAuth.js

@@ -1,46 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { getBetterAuth } from '@lowdefy/api';
-import { getSecretsFromEnv } from '@lowdefy/node-utils';
-
-import adapters from '../../../build/plugins/auth/adapters.js';
-import appMeta from '../../build/appMeta.js';
-import authJson from '../../build/auth.js';
-import createSystemContext from './createSystemContext.js';
-import lowdefyConfig from '../../build/config.js';
-import providers from '../../../build/plugins/auth/providers.js';
-
-// Returns the BetterAuth instance (memoized in @lowdefy/api), or null when
-// auth is not configured. dev: true relaxes cookies for plain-http localhost
-// and derives a per-app cookie prefix so parallel dev apps do not collide.
-function getAuth({ logger }) {
-  if (authJson.configured !== true) {
-    return null;
-  }
-  return getBetterAuth({
-    appMeta,
-    authJson,
-    config: lowdefyConfig,
-    createSystemContext,
-    dev: true,
-    logger,
-    plugins: { adapters, providers },
-    secrets: getSecretsFromEnv(),
-  });
-}
-
-export default getAuth;

package/lib/server/auth/getHeadlessUser.js

@@ -1,39 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { HEADLESS_USER_COOKIE } from './headlessUser.js';
-
-// Mirrors the e2e user-injection pattern (server-e2e/lib/server/auth/getUser.js):
-// the headless renderer sets a base64-JSON user cookie on its own browser
-// context, so its /api/* fetches carry a pre-resolved caller while the
-// developer's real browser (no cookie) is unaffected. Returns the raw decoded
-// user, or null on miss - the caller floors the shape via normalizeInjectedCaller.
-function getHeadlessUser(c) {
-  const cookieHeader = c.req.header('cookie') ?? '';
-  const match = cookieHeader.match(new RegExp(`${HEADLESS_USER_COOKIE}=([^;]+)`));
-  if (!match) {
-    return null;
-  }
-
-  try {
-    const decoded = Buffer.from(decodeURIComponent(match[1]), 'base64').toString();
-    return JSON.parse(decoded);
-  } catch {
-    return null;
-  }
-}
-
-export default getHeadlessUser;

package/lib/server/auth/headlessUser.js

@@ -1,30 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-// Shared between the headless renderer (getBrowser.js, which sets the cookie on
-// its browser context) and the dev caller resolver (getHeadlessUser.js, which
-// decodes it) so the cookie name and injected user shape live in one place.
-const HEADLESS_USER_COOKIE = 'lowdefy_headless_user';
-
-// BetterAuth's session user carries `id`, never `sub`. attributes is floored to
-// {} by normalizeInjectedCaller at injection, so it is not spelled out here.
-const headlessUser = {
-  id: 'lowdefy-headless',
-  name: 'Lowdefy Headless',
-  roles: [],
-};
-
-export { HEADLESS_USER_COOKIE, headlessUser };

package/lib/server/createLowdefyContext.js

@@ -1,133 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import path from 'node:path';
-import {
-  createApiContext,
-  normalizeInjectedCaller,
-  resolveAuthentication,
-  resolvePinnedOrganization,
-} from '@lowdefy/api';
-import { getSecretsFromEnv } from '@lowdefy/node-utils';
-import { v4 as uuid } from 'uuid';
-
-import agents from '../../build/plugins/agents.js';
-import appMeta from '../build/appMeta.js';
-import config from '../build/config.js';
-import connections from '../../build/plugins/connections.js';
-import createHandleError from './log/createHandleError.js';
-import createLogger from './log/createLogger.js';
-import fileCache from './fileCache.js';
-import getAuth from './auth/getAuth.js';
-import getHeadlessUser from './auth/getHeadlessUser.js';
-import getMockUser from './auth/getMockUser.js';
-import getStrategies from './auth/getStrategies.js';
-import i18nConfig from '../build/i18n.js';
-import loadDynamicJsMap from './loadDynamicJsMap.js';
-import logRequest from './log/logRequest.js';
-import notifications, {
-  interpolateProperties,
-  renderEmail,
-} from '../../build/plugins/notifications.js';
-import operators from '../../build/plugins/operators/server.js';
-import steps from '../../build/plugins/steps.js';
-import websockets from '../../build/plugins/websockets.js';
-
-const secrets = getSecretsFromEnv();
-
-// Builds the per-request lowdefy API context (connections, secrets,
-// operators, logger, resolved user, etc.). Factored out of the /api/*
-// middleware (src/middleware/apiContext.js) so run_request
-// (lib/docs/runRequest.js) can build an identical context outside the Hono
-// middleware chain, to call callRequest directly for agent-driven request
-// execution.
-async function createLowdefyContext({ c }) {
-  const buildDirectory = path.join(process.cwd(), 'build');
-  const jsMap = loadDynamicJsMap(buildDirectory);
-
-  const rid = uuid();
-  const context = {
-    rid,
-    agents,
-    appMeta,
-    buildDirectory,
-    configDirectory: process.env.LOWDEFY_DIRECTORY_CONFIG || process.cwd(),
-    config,
-    connections,
-    fileCache,
-    headers: c.req.header(),
-    // The deployment's own origin — detached endpoint calls loop back
-    // through it so the target runs in its own function invocation.
-    origin: new URL(c.req.url).origin,
-    i18n: i18nConfig,
-    interpolateProperties,
-    jsMap,
-    logger: createLogger({ rid }),
-    notifications,
-    operators,
-    renderEmail,
-    req: {
-      url: c.req.path,
-      method: c.req.method,
-      hostname: c.req.header('host'),
-    },
-    secrets,
-    steps,
-    websockets,
-  };
-  context.handleError = createHandleError({ context });
-  const mockUser = getMockUser();
-  const headlessUser = getHeadlessUser(c);
-  if (mockUser) {
-    // The mock user is a pre-resolved caller - it substitutes for the
-    // whole resolveAuthentication step and its roles are authoritative.
-    // No auth engine runs while dev.mockUser is active (see src/app.js),
-    // so mock mode never touches the auth database. normalizeInjectedCaller
-    // floors it to the resolved-caller shape.
-    context.auth = null;
-    context.user = normalizeInjectedCaller(mockUser);
-  } else if (headlessUser) {
-    // The headless renderer (docs/MCP screenshot and state tools) injects a
-    // user cookie on its own browser context (getBrowser.js), so its /api/*
-    // fetches carry a pre-resolved caller and auth-protected pages render.
-    // The developer's real browser has no cookie and resolves through the
-    // auth engine below, so it is unaffected.
-    context.auth = null;
-    context.user = normalizeInjectedCaller(headlessUser);
-  } else {
-    // Hoisted once per request - resolveAuthentication also needs it, and
-    // getBetterAuth memoizes the instance, but this keeps the auth engine
-    // construction to a single call site per request.
-    context.auth = getAuth({ logger: context.logger });
-    // The engine is constructed lazily on the first request, which would
-    // otherwise race the startup pinned-org ensure - await the memoized
-    // resolve so createApiContext reads a retained binding.
-    await resolvePinnedOrganization({ auth: context.auth, logger: context.logger });
-    if (!c.req.path.includes('/api/auth')) {
-      // resolveAuthentication is the single writer of context.user.
-      await resolveAuthentication(context, {
-        auth: context.auth,
-        headers: c.req.raw.headers,
-        strategies: getStrategies({ logger: context.logger }),
-      });
-    }
-  }
-  createApiContext(context);
-  logRequest({ context });
-  return context;
-}
-
-export default createLowdefyContext;

package/lib/server/loadDynamicJsMap.js

@@ -1,47 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import fs from 'node:fs';
-import path from 'node:path';
-
-import staticJsMap from '../../build/plugins/operators/serverJsMap.js';
-
-// Dynamic JS map loading for JIT-built pages — the build rewrites
-// serverJsMap.js when a JIT page discovers new _js operators.
-let cachedJsMapMtime = null;
-let cachedJsMap = staticJsMap;
-
-function loadDynamicJsMap(buildDirectory) {
-  const jsMapPath = path.join(buildDirectory, 'plugins', 'operators', 'serverJsMap.js');
-  try {
-    const stat = fs.statSync(jsMapPath);
-    if (cachedJsMapMtime && stat.mtimeMs === cachedJsMapMtime) {
-      return cachedJsMap;
-    }
-    cachedJsMapMtime = stat.mtimeMs;
-    // For server-side, we can read and eval the JS file
-    const content = fs.readFileSync(jsMapPath, 'utf8');
-    const fn = new Function('exports', content.replace('export default', 'exports.default ='));
-    const exports = {};
-    fn(exports);
-    cachedJsMap = { ...staticJsMap, ...(exports.default ?? {}) };
-    return cachedJsMap;
-  } catch {
-    return cachedJsMap;
-  }
-}
-
-export default loadDynamicJsMap;

package/manager/processes/lowdefyBuild.test.mjs

@@ -1,102 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { jest } from '@jest/globals';
-
-const mockShallowBuild = jest.fn();
-const mockSerializeBuildException = jest.fn((exception) => ({ message: exception.message }));
-const mockWriteBuildStatus = jest.fn();
-const mockCreateCustomPluginTypesMap = jest.fn().mockResolvedValue({});
-const mockCreateCustomPluginMessagesMap = jest.fn().mockResolvedValue({});
-
-jest.unstable_mockModule('@lowdefy/build/dev', () => ({
-  shallowBuild: mockShallowBuild,
-  serializeBuildException: mockSerializeBuildException,
-}));
-jest.unstable_mockModule('../utils/writeBuildStatus.mjs', () => ({
-  default: mockWriteBuildStatus,
-}));
-jest.unstable_mockModule('../utils/createCustomPluginTypesMap.mjs', () => ({
-  default: mockCreateCustomPluginTypesMap,
-}));
-jest.unstable_mockModule('../utils/createCustomPluginMessagesMap.mjs', () => ({
-  default: mockCreateCustomPluginMessagesMap,
-}));
-
-const { default: lowdefyBuild } = await import('./lowdefyBuild.mjs');
-
-function createContext() {
-  return {
-    directories: { build: '/app/build' },
-    logger: { info: jest.fn() },
-    options: { refResolver: undefined },
-  };
-}
-
-test('lowdefyBuild writes an ok buildStatus.json after a successful build', async () => {
-  const context = createContext();
-  const warning = { message: 'Deprecated feature used' };
-  mockShallowBuild.mockResolvedValue({
-    components: {},
-    pageRegistry: {},
-    context: { warnings: [warning] },
-  });
-
-  const build = lowdefyBuild(context);
-  await build();
-
-  expect(mockWriteBuildStatus).toHaveBeenCalledWith({
-    directories: context.directories,
-    status: 'ok',
-    errors: [],
-    warnings: [{ message: 'Deprecated feature used' }],
-  });
-  expect(mockSerializeBuildException).toHaveBeenCalledWith(warning, 0, [warning]);
-});
-
-test('lowdefyBuild writes an error buildStatus.json and rethrows when the build fails', async () => {
-  const context = createContext();
-  const buildError = new Error('Build failed with 1 error(s). See above for details.');
-  buildError.errors = [{ message: 'Bad config' }];
-  buildError.warnings = [{ message: 'Deprecated feature used' }];
-  mockShallowBuild.mockRejectedValue(buildError);
-
-  const build = lowdefyBuild(context);
-  await expect(build()).rejects.toBe(buildError);
-
-  expect(mockWriteBuildStatus).toHaveBeenCalledWith({
-    directories: context.directories,
-    status: 'error',
-    errors: [{ message: 'Bad config' }],
-    warnings: [{ message: 'Deprecated feature used' }],
-  });
-});
-
-test('lowdefyBuild falls back to the raw error message when the thrown error has no errors array', async () => {
-  const context = createContext();
-  const buildError = new Error('Build failed due to internal error. See above for details.');
-  mockShallowBuild.mockRejectedValue(buildError);
-
-  const build = lowdefyBuild(context);
-  await expect(build()).rejects.toBe(buildError);
-
-  expect(mockWriteBuildStatus).toHaveBeenCalledWith({
-    directories: context.directories,
-    status: 'error',
-    errors: [{ message: 'Build failed due to internal error. See above for details.' }],
-    warnings: [],
-  });
-});

package/manager/utils/formatNoticeBox.mjs

@@ -1,30 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-// Draws a rounded box around a title and body lines for CLI startup notices.
-// The border width is derived from the longest line so it's always aligned,
-// regardless of the content passed in. Returned with a leading newline so it
-// starts on its own line under the CLI logger's timestamp/symbol prefix.
-function formatNoticeBox({ title, lines }) {
-  const inner = Math.max(title.length + 1, ...lines.map((line) => line.length));
-  const pad = (line) => line + ' '.repeat(inner - line.length);
-  const top = `╭─ ${title} ${'─'.repeat(inner - title.length - 1)}╮`;
-  const bottom = `╰${'─'.repeat(inner + 2)}╯`;
-  const body = lines.map((line) => `│ ${pad(line)} │`);
-  return ['', top, ...body, bottom].join('\n');
-}
-
-export default formatNoticeBox;

package/manager/utils/writeBuildStatus.mjs

@@ -1,39 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import path from 'path';
-
-import { writeFileIfChanged } from '@lowdefy/node-utils';
-
-// Written after every dev build attempt (success or failure) so the Hono
-// process - a separate process from this manager, sharing only the build
-// directory - can serve current build errors/warnings to AI coding agents.
-// writeFileIfChanged creates the build directory if it does not exist, which
-// covers the case where the build attempt cleaned it before failing.
-async function writeBuildStatus({ directories, status, errors, warnings }) {
-  const buildStatus = {
-    status,
-    timestamp: new Date().toISOString(),
-    errors,
-    warnings,
-  };
-  await writeFileIfChanged(
-    path.join(directories.build, 'buildStatus.json'),
-    JSON.stringify(buildStatus)
-  );
-}
-
-export default writeBuildStatus;

package/manager/utils/writeBuildStatus.test.mjs

@@ -1,76 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-
-import writeBuildStatus from './writeBuildStatus.mjs';
-
-let buildDir;
-
-beforeEach(() => {
-  buildDir = fs.mkdtempSync(path.join(os.tmpdir(), 'lowdefy-build-status-test-'));
-});
-
-afterEach(() => {
-  fs.rmSync(buildDir, { recursive: true, force: true });
-});
-
-function readBuildStatus() {
-  return JSON.parse(fs.readFileSync(path.join(buildDir, 'buildStatus.json'), 'utf8'));
-}
-
-test('writeBuildStatus writes an ok status with a timestamp', async () => {
-  await writeBuildStatus({
-    directories: { build: buildDir },
-    status: 'ok',
-    errors: [],
-    warnings: [{ message: 'Deprecated feature used' }],
-  });
-
-  const buildStatus = readBuildStatus();
-  expect(buildStatus.status).toBe('ok');
-  expect(buildStatus.errors).toEqual([]);
-  expect(buildStatus.warnings).toEqual([{ message: 'Deprecated feature used' }]);
-  expect(new Date(buildStatus.timestamp).toString()).not.toBe('Invalid Date');
-});
-
-test('writeBuildStatus writes an error status with the errors array', async () => {
-  await writeBuildStatus({
-    directories: { build: buildDir },
-    status: 'error',
-    errors: [{ message: 'Bad config' }],
-    warnings: [],
-  });
-
-  const buildStatus = readBuildStatus();
-  expect(buildStatus.status).toBe('error');
-  expect(buildStatus.errors).toEqual([{ message: 'Bad config' }]);
-});
-
-test('writeBuildStatus creates the build directory when it does not exist', async () => {
-  const missingDir = path.join(buildDir, 'nested', 'build');
-
-  await writeBuildStatus({
-    directories: { build: missingDir },
-    status: 'error',
-    errors: [{ message: 'Bad config' }],
-    warnings: [],
-  });
-
-  expect(fs.existsSync(path.join(missingDir, 'buildStatus.json'))).toBe(true);
-});

package/postcss.config.cjs

@@ -1 +0,0 @@
-module.exports = { plugins: { '@tailwindcss/postcss': {} } };