@lowdefy/server-dev 0.0.0-experimental-20260720072521 → 0.0.0-experimental-20260720135014

package/src/routes/detached.js

@@ -1,51 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { runDetachedEndpoint } from '@lowdefy/api';
-
-import getPathSegments from '../lib/getPathSegments.js';
-
-// Target of a CallApi step with `detached: true`: the calling invocation
-// fire-and-forgets a POST here, so the endpoint runs in its OWN function
-// invocation with a fresh duration budget (chainable bounded work without a
-// queue). Transport auth is CRON_SECRET (fails closed), which proves the
-// request originated from the deployment. The run carries the DISPATCHER'S
-// identity (Decision 4): the request body carries a server-built principal
-// snapshot that runDetachedEndpoint rehydrates, so nested calls authorize
-// against the dispatcher, not a forced system context. Delivery is at-most-once
-// with no retry: targets must be idempotent.
-async function detachedHandler(c) {
-  if (c.req.method !== 'POST') {
-    throw new Error('Only POST requests are supported.');
-  }
-  const context = c.get('lowdefyContext');
-
-  // The secret gate stays first: an external POST without the secret is
-  // rejected before the body (and its principal assertion) is ever read.
-  const secret = process.env.CRON_SECRET;
-  if (!secret || c.req.header('authorization') !== `Bearer ${secret}`) {
-    context.logger.warn({ event: 'detached_unauthorized' });
-    return c.json({ error: 'Unauthorized' }, 401);
-  }
-
-  const endpointId = getPathSegments(c, '/api/detached/').join('/');
-  const { payload, principal } = await c.req.json();
-  context.logger.info({ event: 'call_detached_endpoint', endpointId });
-  const response = await runDetachedEndpoint(context, { endpointId, payload, principal });
-  return c.json(response);
-}
-
-export default detachedHandler;

package/src/routes/devInspect.js

@@ -1,94 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { serializer } from '@lowdefy/helpers';
-
-import { readCheckpoint } from '../../lib/docs/checkpointStore.js';
-import { loadMocks } from '../../lib/docs/devMockRegistry.js';
-import getPathSegments from '../lib/getPathSegments.js';
-import { listTabs, resolveTabRequest } from '../../lib/docs/tabChannel.js';
-
-// Origin/host check mirrors clientError.js — this endpoint accepts a POST
-// from Inspector.jsx (a same-origin dev-only browser component), not from
-// arbitrary agents, so it needs the same CSRF-style guard.
-function checkOrigin(c) {
-  const origin = c.req.header('origin');
-  if (!origin) {
-    return false;
-  }
-  try {
-    return new URL(origin).host === c.req.header('host');
-  } catch {
-    return false;
-  }
-}
-
-// Dev-only agent-state-xray: a human tab bootstrapping from a
-// `?_checkpoint=<name>` URL (client/Inspector.jsx) fetches this. It returns
-// the checkpoint's state part + manifest for the tab to inject client-side,
-// and — as a side effect — loads the checkpoint's recorded requests into
-// devMockRegistry server-side, so that tab's own requests (src/routes/
-// request.js) replay recorded data instead of hitting real connections.
-function handleCheckpointBootstrap(c, { name }) {
-  let checkpoint;
-  try {
-    checkpoint = readCheckpoint({ name });
-  } catch (error) {
-    return c.json({ error: error.message }, 404);
-  }
-  loadMocks({ pageId: checkpoint.checkpoint.pageId, mocks: checkpoint.requests });
-  return c.json(
-    serializer.serialize({
-      checkpoint: checkpoint.checkpoint,
-      state: checkpoint.state,
-      urlQuery: checkpoint.urlQuery,
-      input: checkpoint.input,
-      user: checkpoint.user,
-      global: checkpoint.global,
-    })
-  );
-}
-
-// GET lists connected tabs for diagnostics (or, under /checkpoint/<name>,
-// bootstraps a human tab from a state checkpoint); POST is the answer leg of
-// the SSE request/response round trip (Inspector.jsx posts back {requestId,
-// result} after handling an inspect-request/eval-request event).
-async function devInspectHandler(c) {
-  if (c.req.method === 'GET') {
-    const segments = getPathSegments(c, '/api/dev-inspect/');
-    if (segments[0] === 'checkpoint' && segments[1]) {
-      return handleCheckpointBootstrap(c, { name: segments[1] });
-    }
-    return c.json({ tabs: listTabs() });
-  }
-
-  if (c.req.method !== 'POST') {
-    throw new Error('Only GET and POST requests are supported.');
-  }
-
-  if (!checkOrigin(c)) {
-    return c.json({ error: 'Forbidden' }, 403);
-  }
-
-  const { requestId, result } = await c.req.json();
-  if (!requestId) {
-    return c.json({ error: 'Missing "requestId".' }, 400);
-  }
-  const resolved = resolveTabRequest({ requestId, result });
-  return c.json({ ok: resolved });
-}
-
-export default devInspectHandler;

package/src/routes/docs/checkpointsCreate.js

@@ -1,28 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import createConfigCheckpoint from '../../../lib/docs/createConfigCheckpoint.js';
-
-// Lets an agent snapshot the config directory before an experimental change,
-// so it can revert cleanly with POST /lowdefy-docs/checkpoints/revert if the
-// change doesn't work out.
-async function docsCheckpointsCreateHandler(c) {
-  const body = await c.req.json().catch(() => ({}));
-  const result = createConfigCheckpoint({ label: body.label });
-  return c.json(result);
-}
-
-export default docsCheckpointsCreateHandler;

package/src/routes/docs/checkpointsList.js

@@ -1,23 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import listConfigCheckpoints from '../../../lib/docs/listConfigCheckpoints.js';
-
-function docsCheckpointsListHandler(c) {
-  return c.json(listConfigCheckpoints());
-}
-
-export default docsCheckpointsListHandler;

package/src/routes/docs/content.js

@@ -1,31 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import getCoreDoc from '../../../lib/docs/getCoreDoc.js';
-
-function docsContentHandler(c) {
-  const slug = c.req.param('slug');
-  const doc = getCoreDoc({ slug });
-  if (doc === null) {
-    return c.json(
-      { error: `No doc found for slug "${slug}". Use GET /lowdefy-docs/search?q=... to find the right slug.` },
-      404
-    );
-  }
-  return c.text(doc.markdown, 200, { 'Content-Type': 'text/markdown; charset=utf-8' });
-}
-
-export default docsContentHandler;

package/src/routes/docs/evalOperator.js

@@ -1,46 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import evalOperator from '../../../lib/docs/evalOperator.js';
-
-async function docsEvalOperatorHandler(c) {
-  const body = await c.req.json().catch(() => ({}));
-  const { pageId, source } = body;
-  // "operator" is accepted as an alias for "expression" — agents commonly
-  // guess it as the body key for this endpoint.
-  const expression = body.expression ?? body.operator;
-  if (expression === undefined) {
-    return c.json(
-      {
-        error:
-          'POST /lowdefy-docs/eval-operator requires an "expression" in the JSON body — the operator expression to evaluate, e.g. {"pageId": "home", "expression": {"_state": "key"}}.',
-      },
-      400
-    );
-  }
-  // Derived from the incoming request rather than a config value — this is
-  // the origin an agent can actually reach the dev server on (host/port it
-  // just connected to), regardless of how the server is bound.
-  const origin = new URL(c.req.url).origin;
-
-  const result = await evalOperator({ origin, pageId, expression, source });
-  if (result.error) {
-    return c.json({ error: result.error, source: result.source }, 502);
-  }
-  return c.json(result);
-}
-
-export default docsEvalOperatorHandler;

package/src/routes/docs/examples.js

@@ -1,33 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import getExamples from '../../../lib/docs/getExamples.js';
-
-function docsExamplesHandler(c) {
-  const type = c.req.param('type');
-  const examples = getExamples({ type });
-  if (examples === null) {
-    return c.json(
-      {
-        error: `No examples shipped for block type "${type}". Use GET /lowdefy-docs/schema/blocks/${type} for its schema.`,
-      },
-      404
-    );
-  }
-  return c.json(examples);
-}
-
-export default docsExamplesHandler;

package/src/routes/docs/find.js

@@ -1,30 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import findConfig from '../../../lib/docs/findConfig.js';
-
-async function docsFindHandler(c) {
-  const id = c.req.param('id');
-  const pageId = c.req.query('pageId');
-  try {
-    const result = await findConfig({ id, pageId });
-    return c.json(result);
-  } catch (error) {
-    return c.json({ error: error.message }, 400);
-  }
-}
-
-export default docsFindHandler;

package/src/routes/docs/index.js

@@ -1,23 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import getOverview from '../../../lib/docs/getOverview.js';
-
-function docsIndexHandler(c) {
-  return c.text(getOverview(), 200, { 'Content-Type': 'text/markdown; charset=utf-8' });
-}
-
-export default docsIndexHandler;

package/src/routes/docs/inspectState.js

@@ -1,34 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import inspectState from '../../../lib/docs/inspectState.js';
-
-async function docsInspectStateHandler(c) {
-  const pageId = c.req.param('pageId');
-  const source = c.req.query('source');
-  // Derived from the incoming request rather than a config value — this is
-  // the origin an agent can actually reach the dev server on (host/port it
-  // just connected to), regardless of how the server is bound.
-  const origin = new URL(c.req.url).origin;
-
-  const result = await inspectState({ origin, pageId, source });
-  if (result.error) {
-    return c.json({ error: result.error, source: result.source }, 502);
-  }
-  return c.json(result);
-}
-
-export default docsInspectStateHandler;

package/src/routes/docs/loadState.js

@@ -1,38 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import loadState from '../../../lib/docs/loadState.js';
-
-// Loads a state checkpoint back into the running app. mode: 'headless'
-// (default) drives a headless page and injects state directly for an agent
-// to verify; mode: 'registry-only' just loads the recorded requests into
-// devMockRegistry and returns a URL for a human to open in a real browser
-// tab (client/Inspector.jsx does the state injection there).
-async function docsLoadStateHandler(c) {
-  const { name, mode } = await c.req.json();
-  // Derived from the incoming request rather than a config value — this is
-  // the origin an agent can actually reach the dev server on (host/port it
-  // just connected to), regardless of how the server is bound.
-  const origin = new URL(c.req.url).origin;
-
-  const result = await loadState({ origin, name, mode });
-  if (result.error) {
-    return c.json({ error: result.error }, 502);
-  }
-  return c.json(result);
-}
-
-export default docsLoadStateHandler;

package/src/routes/docs/mcp.js

@@ -1,30 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { StreamableHTTPTransport } from '@hono/mcp';
-
-import createDocsMcpServer from '../../../lib/docs/createDocsMcpServer.js';
-
-// Stateless per-request server: docs tools read build artifacts fresh on
-// every call, so there is no session state worth keeping between requests.
-async function mcpHandler(c) {
-  const server = createDocsMcpServer({ origin: new URL(c.req.url).origin, honoContext: c });
-  const transport = new StreamableHTTPTransport();
-  await server.connect(transport);
-  return transport.handleRequest(c);
-}
-
-export default mcpHandler;

package/src/routes/docs/pageConfig.js

@@ -1,36 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import getPageConfig from '../../../lib/docs/getPageConfig.js';
-
-// 404 when the pageId isn't registered at all. 200 with { buildError, errors }
-// when the pageId is registered but its JIT build failed — agents need the
-// errors in the body, not just a failing status code.
-async function docsPageConfigHandler(c) {
-  const pageId = c.req.param('pageId');
-  const result = await getPageConfig({ pageId });
-  if (result === null) {
-    return c.json(
-      {
-        error: `No page found for pageId "${pageId}". Check the pageId in your lowdefy.yaml pages config.`,
-      },
-      404
-    );
-  }
-  return c.json(result);
-}
-
-export default docsPageConfigHandler;

package/src/routes/docs/pluginDoc.js

@@ -1,33 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import getPluginDoc from '../../../lib/docs/getPluginDoc.js';
-
-function docsPluginDocHandler(c) {
-  const packageName = c.req.param('package');
-  const doc = getPluginDoc({ packageName });
-  if (doc === null) {
-    return c.json(
-      {
-        error: `Package "${packageName}" ships no markdown docs. See GET /lowdefy-docs/plugins for its types.`,
-      },
-      404
-    );
-  }
-  return c.text(doc.markdown, 200, { 'Content-Type': 'text/markdown; charset=utf-8' });
-}
-
-export default docsPluginDocHandler;

package/src/routes/docs/plugins.js

@@ -1,23 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import listPlugins from '../../../lib/docs/listPlugins.js';
-
-function docsPluginsHandler(c) {
-  return c.json(listPlugins());
-}
-
-export default docsPluginsHandler;

package/src/routes/docs/runRequest.js

@@ -1,34 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import runRequest from '../../../lib/docs/runRequest.js';
-
-// Refusals and request errors are returned as 200 data (see runRequest.js) —
-// only malformed input (missing pageId/requestId) is a 400.
-async function docsRunRequestHandler(c) {
-  // Parse the body from a clone: runRequest builds a Lowdefy context whose
-  // resolveAuthentication reads c.req.raw (headers) to resolve the caller,
-  // so leave the original request body intact and read our own copy here.
-  const { pageId, requestId, payload } = await c.req.raw.clone().json();
-  try {
-    const result = await runRequest({ pageId, requestId, payload, honoContext: c });
-    return c.json(result);
-  } catch (error) {
-    return c.json({ error: error.message }, 400);
-  }
-}
-
-export default docsRunRequestHandler;

package/src/routes/docs/schema.js

@@ -1,37 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import getSchema from '../../../lib/docs/getSchema.js';
-
-function docsSchemaHandler(c) {
-  const kind = c.req.param('kind');
-  const type = c.req.param('type');
-  let schema;
-  try {
-    schema = getSchema({ kind, type });
-  } catch (error) {
-    return c.json({ error: error.message }, 400);
-  }
-  if (schema === null) {
-    return c.json(
-      { error: `No schema found for ${kind} type "${type}". See GET /lowdefy-docs/${kind} for available types.` },
-      404
-    );
-  }
-  return c.json(schema);
-}
-
-export default docsSchemaHandler;