@lowdefy/server-dev 0.0.0-experimental-20260720072521 → 0.0.0-experimental-20260720135014

package/src/routes/jitPage.js

@@ -1,99 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { getPageConfig } from '@lowdefy/api';
-
-import authJson from '../../lib/build/auth.js';
-import buildPageIfNeeded from '../../lib/server/jitPageBuilder.js';
-import getPathSegments from '../lib/getPathSegments.js';
-import lowdefyConfig from '../../lib/build/config.js';
-
-const basePath = lowdefyConfig.basePath ?? '';
-
-// JIT page build + config response. The response shapes are a frozen contract
-// with the dev client:
-//   200 { installing: true, packages }  — plugin install in progress, client polls
-//   500 { buildError: true, errors, message, source }  — build failed
-//   401 { redirect }  — logged-out navigation to a protected page
-//   404 'Page not found.'
-//   200 pageConfig (+ _warnings)
-async function jitPageHandler(c) {
-  const context = c.get('lowdefyContext');
-  const pageId = getPathSegments(c, '/api/page/').join('/');
-
-  let buildResult;
-  try {
-    buildResult = await buildPageIfNeeded({
-      pageId,
-      buildDirectory: context.buildDirectory,
-      configDirectory: context.configDirectory,
-    });
-  } catch (error) {
-    const rawErrors = error.buildErrors ?? [error];
-    const errors = [];
-    for (const err of rawErrors) {
-      await context.handleError(err);
-      errors.push({
-        type: err.name ?? 'Error',
-        message: err.message,
-        source: err.source ?? null,
-        stack: err.stack ?? null,
-      });
-    }
-    return c.json(
-      {
-        buildError: true,
-        errors,
-        // Keep top-level message/source for backward compatibility
-        message: error.message,
-        source: error.source ?? null,
-      },
-      500
-    );
-  }
-
-  if (buildResult && buildResult.installing) {
-    return c.json({
-      installing: true,
-      packages: buildResult.packages,
-    });
-  }
-
-  const result = await getPageConfig(context, { pageId, urlQuery: c.req.query() });
-  if (result.status === 'unauthenticated') {
-    // The client follows this redirect with a full page load, so the login
-    // page can return to the requested page after sign-in.
-    const callbackUrl = `${basePath}/${pageId}`;
-    return c.json(
-      {
-        redirect: `${basePath}${authJson.authPages.signIn}?callbackUrl=${encodeURIComponent(
-          callbackUrl
-        )}`,
-      },
-      401
-    );
-  }
-  if (result.status !== 'ok') {
-    return c.text('Page not found.', 404);
-  }
-  const pageConfig = result.pageConfig;
-  if (buildResult?.warnings?.length > 0) {
-    pageConfig._warnings = buildResult.warnings;
-  }
-  return c.json(pageConfig);
-}
-
-export default jitPageHandler;

package/src/routes/reload.js

@@ -1,81 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { randomUUID } from 'node:crypto';
-
-import chokidar from 'chokidar';
-import { streamSSE } from 'hono/streaming';
-
-import { registerTab, unregisterTab } from '../../lib/docs/tabChannel.js';
-
-// SSE endpoint — notifies the client when build/reload is written so it can
-// mutate the SWR cache and refetch config. Also doubles as the transport for
-// the agent-state-xray tab channel (lib/docs/tabChannel.js): a connection
-// that includes ?pageId=<id> is registered as an inspectable dev tab so an
-// agent can push it inspect-request/eval-request SSE events.
-//
-// pageId tracking design: Inspector.jsx (not Reload.jsx) owns this query
-// param, and re-opens its EventSource — new connection, new tab id — every
-// time the developer navigates to a different page. That keeps tabChannel's
-// view of "what page is this tab on" always correct without a separate
-// ping route: Reload.jsx's own connection never sends pageId, so it is never
-// registered as a tab and can't be mistaken for one by requestFromTab.
-async function reloadHandler(c) {
-  return streamSSE(c, async (stream) => {
-    const watcher = chokidar.watch(['./build/reload'], {
-      persistent: true,
-      ignoreInitial: true,
-    });
-
-    const pageId = c.req.query('pageId');
-    const tabId = pageId === undefined ? undefined : randomUUID();
-    if (tabId) {
-      registerTab({
-        id: tabId,
-        pageId,
-        send: (event, data) => stream.writeSSE({ event, data: JSON.stringify(data) }),
-      });
-    }
-
-    let open = true;
-    stream.onAbort(() => {
-      open = false;
-      watcher.close();
-      if (tabId) {
-        unregisterTab({ id: tabId });
-      }
-    });
-
-    const reload = () => {
-      stream.writeSSE({ event: 'reload', data: JSON.stringify({}) });
-    };
-    watcher.on('add', () => reload());
-    watcher.on('change', () => reload());
-    // Do not reload on unlink — cleanBuildDirectory deletes build/reload during
-    // skeleton rebuilds, which would send a premature SSE event before the new
-    // build artifacts are written. The real reload comes via add/change when
-    // reloadClients() creates the file after the build completes.
-
-    while (open) {
-      await stream.sleep(15000);
-      if (open) {
-        await stream.writeSSE({ event: 'ping', data: '' });
-      }
-    }
-  });
-}
-
-export default reloadHandler;

package/src/routes/request.js

@@ -1,66 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { callRequest } from '@lowdefy/api';
-import { serializer } from '@lowdefy/helpers';
-
-import getPathSegments from '../lib/getPathSegments.js';
-import { getMock } from '../../lib/docs/devMockRegistry.js';
-
-async function requestHandler(c) {
-  if (c.req.method !== 'POST') {
-    throw new Error('Only POST requests are supported.');
-  }
-  const context = c.get('lowdefyContext');
-  const segments = getPathSegments(c, '/api/request/');
-  if (segments.length < 2) {
-    return c.json({ error: 'Invalid request path' }, 400);
-  }
-  const requestId = segments[segments.length - 1];
-  const pageId = segments.slice(0, -1).join('/');
-  const { actionId, blockId, payload } = await c.req.json();
-
-  // Dev-only agent tooling: once a state checkpoint has been loaded
-  // (lib/docs/loadState.js), its recorded request/response pairs live in
-  // devMockRegistry keyed by (pageId, requestId). Short-circuit here, before
-  // ever touching the real connection, so a headless verification page, a
-  // human tester's browser tab, or an e2e test replays exactly what was
-  // recorded. The response shape mirrors @lowdefy/api's callRequest contract
-  // (see callRequestResolver.js / callRequest.js success shape, and
-  // middleware/errorHandler.js for the error shape) so the client's
-  // Requests.js can't tell the difference from a real request.
-  const mock = getMock({ pageId, requestId });
-  if (mock) {
-    context.logger.info({ event: 'dev_mock_request', pageId, requestId, blockId, actionId });
-    if (mock.error) {
-      const error = mock.error instanceof Error ? mock.error : new Error(mock.error);
-      const serialized = serializer.serialize(error);
-      if (serialized?.['~e']) {
-        delete serialized['~e'].received;
-        delete serialized['~e'].stack;
-        delete serialized['~e'].configKey;
-      }
-      return c.json(serialized, 500);
-    }
-    return c.json({ success: true, response: serializer.serialize(mock.response) });
-  }
-
-  context.logger.info({ event: 'call_request', pageId, requestId, blockId, actionId });
-  const response = await callRequest(context, { blockId, pageId, payload, requestId });
-  return c.json(response);
-}
-
-export default requestHandler;

package/src/routes/usage.js

@@ -1,46 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import fs from 'node:fs';
-import path from 'node:path';
-
-const packageJson = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
-
-async function usageHandler(c) {
-  if (c.req.method !== 'POST') {
-    throw new Error('Only POST requests are supported.');
-  }
-  const context = c.get('lowdefyContext');
-  const { user, machine } = await c.req.json();
-  const host = c.req.header('host');
-  context.logger.info({ event: 'log_usage', user, machine });
-
-  const timestamp = Date.now();
-
-  return c.json({
-    offline: false,
-    data: {
-      gitSha: context.appMeta.gitSha,
-      host,
-      machine,
-      timestamp,
-      user,
-      version: packageJson.version,
-    },
-  });
-}
-
-export default usageHandler;

package/src/routes/user.js

@@ -1,27 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-// The resolved caller for the client - the same resolveAuthentication output
-// the first page load embeds. The base session carries neither roles (read
-// live from the active member row) nor the merged attributes bag, so the
-// client re-syncs from here (UpdateSession) after a session change such as
-// SetActiveOrganization.
-async function userHandler(c) {
-  const context = c.get('lowdefyContext');
-  return c.json({ user: context.user ?? null });
-}
-
-export default userHandler;

package/src/routes/websocket.js

@@ -1,33 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { setPendingWebSocketContext } from '../websocket/devWebSocket.js';
-
-// In dev, Vite owns the HTTP server, so websocket upgrades can't flow through
-// @hono/node-server. The Vite plugin (see vite.config.js) fetches this route
-// with the upgrade request's headers to run the full middleware chain (auth
-// session, apiContext), and this handler hands the built context back to the
-// upgrade handler through a pending-context exchange keyed by request id.
-function websocketHandler(c) {
-  const rid = c.req.header('x-lowdefy-websocket-rid');
-  if (!rid) {
-    return c.json({ message: 'WebSocket upgrade required.' }, 400);
-  }
-  setPendingWebSocketContext(rid, c.get('lowdefyContext'));
-  return c.json({ ok: true });
-}
-
-export default websocketHandler;

package/src/websocket/devWebSocket.js

@@ -1,78 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { randomUUID } from 'node:crypto';
-import { createChannelRegistry, createWebSocketConnection } from '@lowdefy/api';
-
-import app from '../app.js';
-
-// One registry per dev server process, shared by all websocket connections.
-const registry = createChannelRegistry();
-
-// Contexts built by the /api/websocket route (full middleware chain) are
-// handed to the upgrade handler through this exchange, keyed by request id.
-const pendingContexts = new Map();
-
-function setPendingWebSocketContext(rid, context) {
-  pendingContexts.set(rid, context);
-}
-
-function takePendingWebSocketContext(rid) {
-  const context = pendingContexts.get(rid);
-  pendingContexts.delete(rid);
-  return context;
-}
-
-// Called by the Vite plugin on an HTTP upgrade for /api/websocket. Runs the
-// dev Hono app for the upgrade request (auth session + apiContext), then
-// completes the websocket handshake and wires the connection to the registry.
-async function handleWebSocketUpgrade({ request, socket, head, wss }) {
-  const rid = randomUUID();
-  const headers = new Headers();
-  Object.entries(request.headers).forEach(([key, value]) => {
-    if (value) {
-      headers.set(key, Array.isArray(value) ? value[0] : value);
-    }
-  });
-  headers.set('x-lowdefy-websocket-rid', rid);
-
-  const url = `http://${request.headers.host ?? 'localhost'}${request.url}`;
-  const response = await app.fetch(new Request(url, { headers }));
-  const context = takePendingWebSocketContext(rid);
-
-  if (!context || response.status !== 200) {
-    socket.end('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
-    return;
-  }
-
-  wss.handleUpgrade(request, socket, head, (ws) => {
-    const connection = createWebSocketConnection(context, {
-      registry,
-      send: (message) => ws.send(message),
-    });
-    ws.on('message', (data) => {
-      connection.handleMessage(data.toString());
-    });
-    ws.on('close', () => {
-      connection.close();
-    });
-    ws.on('error', (error) => {
-      context.logger.debug({ event: 'ws_error' }, String(error?.message ?? error));
-    });
-  });
-}
-
-export { handleWebSocketUpgrade, setPendingWebSocketContext };

package/vite.config.js

@@ -1,111 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import fs from 'node:fs';
-import { defineConfig } from 'vite';
-import react from '@vitejs/plugin-react';
-import devServer from '@hono/vite-dev-server';
-import { WebSocketServer } from 'ws';
-
-// basePath from the Lowdefy build — assets and routes are served under it.
-let basePath = '';
-try {
-  const config = JSON.parse(fs.readFileSync('./build/config.json', 'utf8'));
-  basePath = config.basePath ?? '';
-} catch (e) {
-  // No build yet — default base.
-}
-
-// Vite owns the HTTP server in dev, so /api/websocket upgrades are handled
-// here instead of @hono/node-server. The upgrade handler module is loaded
-// through Vite's SSR graph so it shares the Hono app and @lowdefy/api module
-// instances with the dev server routes. Vite's own HMR websocket uses a
-// different path and is untouched.
-function lowdefyWebSocket() {
-  return {
-    name: 'lowdefy-websocket',
-    configureServer(server) {
-      const wss = new WebSocketServer({ noServer: true, maxPayload: 256 * 1024 });
-      server.httpServer?.on('upgrade', async (request, socket, head) => {
-        const { pathname } = new URL(request.url ?? '/', 'http://localhost');
-        if (pathname !== `${basePath}/api/websocket`) {
-          return;
-        }
-        try {
-          const { handleWebSocketUpgrade } = await server.ssrLoadModule(
-            './src/websocket/devWebSocket.js'
-          );
-          await handleWebSocketUpgrade({ request, socket, head, wss });
-        } catch (error) {
-          console.error(error);
-          socket.destroy();
-        }
-      });
-    },
-  };
-}
-
-export default defineConfig(({ mode }) => ({
-  base: `${basePath}/`,
-  plugins: [
-    react(),
-    lowdefyWebSocket(),
-    devServer({
-      entry: './src/app.js',
-      // Vite serves these itself; everything else routes to the Hono app.
-      exclude: [
-        /^\/client\/.+/,
-        /^\/lib\/.+/,
-        /^\/build\/.+/,
-        /^\/@.+$/,
-        /^\/node_modules\/.*/,
-        /\?t=\d+$/,
-        /^\/favicon\.ico$/,
-      ],
-    }),
-  ],
-  define: {
-    // Vite does not replace process.env.NODE_ENV inside dependencies —
-    // plugin and client code branch on it.
-    'process.env.NODE_ENV': JSON.stringify(mode === 'production' ? 'production' : 'development'),
-  },
-  optimizeDeps: {
-    // There is no index.html in the root (the Hono app renders HTML), so the
-    // dependency scanner has nothing to crawl and would discover client deps
-    // lazily at first request — ending in a mid-session "optimized
-    // dependencies changed" full reload. The client entry reaches every
-    // plugin import statically (main.jsx → App → Routing → build/plugins/*),
-    // so a startup crawl discovers the full set. Linked workspace plugins are
-    // intentionally not pre-bundled (Vite default) so local plugin edits stay
-    // live.
-    entries: ['client/main.jsx'],
-  },
-  resolve: {
-    // linked plugin packages (pnpm link: / workspace) must share one React.
-    dedupe: ['react', 'react-dom'],
-  },
-  server: {
-    watch: {
-      // Tailwind scan inputs are rewritten by JIT page builds, and Vite
-      // full-reloads the browser on any watched .html change — killing
-      // in-flight requests on every first page visit. CSS recompilation does
-      // not need these events: globals.css imports build/tailwind-candidates.css,
-      // which the JIT builder touches whenever tailwind content changes (the
-      // sole recompile trigger — see writeGlobalsCss in @lowdefy/build).
-      ignored: ['**/lowdefy-build/tailwind/**'],
-    },
-  },
-}));