@lowdefy/server-dev 0.0.0-experimental-20260720072521 → 0.0.0-experimental-20260721080548

package/.eslintrc.yaml

@@ -0,0 +1 @@
+extends: 'plugin:@next/next/core-web-vitals'

package/lib/build/app.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/app.json'), 'utf8'));
+import raw from '../../build/app.json';
 
 export default serializer.deserialize(raw);

package/lib/build/appMeta.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/appMeta.json'), 'utf8'));
+import raw from '../../build/appMeta.json';
 
 export default serializer.deserialize(raw);

package/lib/build/auth.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/auth.json'), 'utf8'));
+import raw from '../../build/auth.json';
 
 export default serializer.deserialize(raw);

package/lib/build/config.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/config.json'), 'utf8'));
+import raw from '../../build/config.json';
 
 export default serializer.deserialize(raw);

package/lib/build/i18n.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/i18n.json'), 'utf8'));
+import raw from '../../build/i18n.json';
 
 export default serializer.deserialize(raw);

package/lib/build/logger.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/logger.json'), 'utf8'));
+import raw from '../../build/logger.json';
 
 export default serializer.deserialize(raw);

package/lib/build/theme.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/theme.json'), 'utf8'));
+import raw from '../../build/theme.json';
 
 export default serializer.deserialize(raw);

package/lib/client/App.js

@@ -0,0 +1,80 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import React, { Suspense } from 'react';
+
+import { useRouter } from 'next/router';
+
+import Head from 'next/head';
+import Link from 'next/link';
+
+import BuildingPage from './BuildingPage.js';
+import Reload from './Reload.js';
+import Page from './Page.js';
+import setPageId from './setPageId.js';
+import { getReloadVersion } from './utils/useMutateCache.js';
+import useRootConfig from './utils/useRootConfig.js';
+
+import actions from '../../build/plugins/actions.js';
+import blockMetas from '../../build/plugins/blockMetas.json';
+import blocks from '../../build/plugins/blocks.js';
+import icons from '../../build/plugins/icons.js';
+import operators from '../../build/plugins/operators/client.js';
+import staticJsMap from '../../build/plugins/operators/clientJsMap.js';
+
+const App = ({ auth, lowdefy }) => {
+  const router = useRouter();
+  const { data: rootConfig } = useRootConfig(router.basePath);
+
+  if (rootConfig?.theme) {
+    lowdefy.theme = rootConfig.theme;
+  }
+
+  const { redirect, pageId } = setPageId(router, rootConfig);
+  if (redirect) {
+    router.push(`/${pageId}`);
+    return '';
+  }
+  return (
+    <Reload basePath={router.basePath} lowdefy={lowdefy}>
+      {(resetContext) => (
+        <Suspense key={`${pageId}_${getReloadVersion()}`} fallback={<BuildingPage />}>
+          <Page
+            auth={auth}
+            Components={{ Head, Link }}
+            config={{
+              rootConfig,
+            }}
+            jsMap={staticJsMap}
+            lowdefy={lowdefy}
+            pageId={pageId}
+            resetContext={resetContext}
+            router={router}
+            types={{
+              actions,
+              blockMetas,
+              blocks,
+              icons,
+              operators,
+            }}
+          />
+        </Suspense>
+      )}
+    </Reload>
+  );
+};
+
+export default App;

package/{client/Page.jsx → lib/client/Page.js}

@@ -18,10 +18,10 @@ import React, { useEffect, useRef } from 'react';
 import { GenIcon } from 'react-icons/lib';
 import Client from '@lowdefy/client';
 
-import BuildErrorPage from '../lib/client/BuildErrorPage.jsx';
-import InstallingPluginsPage from '../lib/client/InstallingPluginsPage.jsx';
-import RestartingPage from '../lib/client/RestartingPage.jsx';
-import usePageConfig from '../lib/client/utils/usePageConfig.js';
+import BuildErrorPage from './BuildErrorPage.js';
+import InstallingPluginsPage from './InstallingPluginsPage.js';
+import RestartingPage from './RestartingPage.js';
+import usePageConfig from './utils/usePageConfig.js';
 
 const Page = ({
   auth,
@@ -48,7 +48,7 @@ const Page = ({
   }, [pageConfig?._warnings, lowdefy]);
 
   if (!pageConfig) {
-    router.replace({ pathname: '/404' });
+    router.replace(`/404`);
     return '';
   }
   if (pageConfig.buildError) {

package/{client/Reload.jsx → lib/client/Reload.js}

@@ -16,12 +16,9 @@
 
 import React, { useEffect, useState } from 'react';
 
-import useMutateCache from '../lib/client/utils/useMutateCache.js';
-import waitForRestartedServer from '../lib/client/utils/waitForRestartedServer.js';
+import useMutateCache from './utils/useMutateCache.js';
+import waitForRestartedServer from './utils/waitForRestartedServer.js';
 
-// SSE listener — config rebuilds notify via /api/reload. Tailwind CSS updates
-// arrive through Vite HMR now (globals.css is in the dev module graph), so
-// the old tailwind-jit.css link cache-bust is gone.
 const Reload = ({ children, basePath, lowdefy }) => {
   const [reset, setReset] = useState(false);
   const [restarting, setRestarting] = useState(false);
@@ -37,6 +34,11 @@ const Reload = ({ children, basePath, lowdefy }) => {
         if (lowdefy._internal?.initialised) {
           lowdefy._internal.initialised = false;
         }
+        // Refresh JIT CSS link to pick up newly compiled Tailwind classes
+        const cssLink = document.getElementById('tailwind-jit-css');
+        if (cssLink) {
+          cssLink.href = `${basePath}/tailwind-jit.css?v=${Date.now()}`;
+        }
         setReset(true);
         console.log('Reloaded config.');
       }, 600);

package/lib/client/auth/{Auth.jsx → Auth.js}

@@ -13,25 +13,18 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+/* eslint-disable react/jsx-props-no-spreading */
 
 import React from 'react';
-import AuthConfigured from './AuthConfigured.jsx';
+import AuthConfigured from './AuthConfigured.js';
 import AuthNotConfigured from './AuthNotConfigured.js';
 
-import { serializer } from '@lowdefy/helpers';
+import authConfig from '../../build/auth.js';
 
-// Client code imports the build JSON directly — Vite handles JSON imports;
-// the lib/build/*.js wrappers are server-only (they read from disk).
-// Deserialize to restore arrays from their ~arr build markers (providers
-// must be a real array for provider lookups in createAuthMethods).
-import rawAuthConfig from '../../../build/auth.json';
-
-const authConfig = serializer.deserialize(rawAuthConfig);
-
-function Auth({ children, user }) {
+function Auth({ children, session }) {
   if (authConfig.configured === true) {
     return (
-      <AuthConfigured serverUser={user} authConfig={authConfig}>
+      <AuthConfigured serverSession={session} authConfig={authConfig}>
         {(auth) => children(auth)}
       </AuthConfigured>
     );

package/lib/client/auth/AuthConfigured.js

@@ -0,0 +1,61 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+/* eslint-disable react/jsx-props-no-spreading */
+
+import React, { useEffect, useRef } from 'react';
+import { getSession, SessionProvider, signIn, signOut, useSession } from 'next-auth/react';
+
+import lowdefyConfig from '../../build/config.js';
+
+function Session({ children }) {
+  const wasAuthenticated = useRef(false);
+  const { data: session, status } = useSession();
+  wasAuthenticated.current = wasAuthenticated.current || status === 'authenticated';
+
+  useEffect(() => {
+    if (wasAuthenticated.current && status === 'unauthenticated') {
+      window.location.reload();
+    }
+  }, [status]);
+
+  // If session is passed to SessionProvider from getServerSideProps
+  // we won't have a loading state here.
+  // But 404 uses getStaticProps so we have this for 404.
+  if (status === 'loading') {
+    return '';
+  }
+  return children(session);
+}
+
+function AuthConfigured({ authConfig, children, serverSession }) {
+  const auth = { authConfig, getSession, signIn, signOut };
+  let basePath = lowdefyConfig.basePath;
+  if (basePath) {
+    basePath = `${basePath}/api/auth`;
+  }
+  return (
+    <SessionProvider session={serverSession} basePath={basePath}>
+      <Session>
+        {(session) => {
+          auth.session = session;
+          return children(auth);
+        }}
+      </Session>
+    </SessionProvider>
+  );
+}
+
+export default AuthConfigured;

package/lib/client/auth/AuthNotConfigured.js

@@ -13,6 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+/* eslint-disable react/jsx-props-no-spreading */
 
 function authNotConfigured() {
   throw new Error('Auth not configured.');
@@ -21,30 +22,9 @@ function authNotConfigured() {
 function AuthNotConfigured({ authConfig, children }) {
   const auth = {
     authConfig,
-    user: null,
-    acceptInvitation: authNotConfigured,
-    addPasskey: authNotConfigured,
-    changePassword: authNotConfigured,
-    deletePasskey: authNotConfigured,
-    getResolvedUser: authNotConfigured,
     getSession: authNotConfigured,
-    impersonateUser: authNotConfigured,
-    requestPasswordReset: authNotConfigured,
-    resetPassword: authNotConfigured,
-    revokeOtherSessions: authNotConfigured,
-    sendVerificationEmail: authNotConfigured,
-    setActiveOrganization: authNotConfigured,
-    signInEmail: authNotConfigured,
-    signInMagicLink: authNotConfigured,
-    signInOauth2: authNotConfigured,
-    signInSocial: authNotConfigured,
+    signIn: authNotConfigured,
     signOut: authNotConfigured,
-    signUpEmail: authNotConfigured,
-    stopImpersonating: authNotConfigured,
-    twoFactorDisable: authNotConfigured,
-    twoFactorEnable: authNotConfigured,
-    twoFactorVerifyBackupCode: authNotConfigured,
-    twoFactorVerifyTotp: authNotConfigured,
   };
 
   return children(auth);

package/lib/client/setPageId.js

@@ -14,19 +14,18 @@
   limitations under the License.
 */
 
-// location comes from the custom router (@lowdefy/client/adapters):
-// { pageId, pathname, search }. pageId is null at the root path.
-function setPageId(location, rootConfig) {
-  if (location.pageId === '404') {
+function setPageId(router, rootConfig) {
+  if (router.pathname === `/404`) {
     return { redirect: false, pageId: '404' };
   }
-  if (!location.pageId) {
+  const segments = router.query.pageId;
+  if (!segments || segments.length === 0) {
     if (rootConfig.home.configured === false) {
       return { redirect: true, pageId: rootConfig.home.pageId };
     }
     return { redirect: false, pageId: rootConfig.home.pageId };
   }
-  return { redirect: false, pageId: location.pageId };
+  return { redirect: false, pageId: segments.join('/') };
 }
 
 export default setPageId;

package/lib/client/utils/useMutateCache.js

@@ -16,25 +16,12 @@
 
 import { useSWRConfig } from 'swr';
 
-// Module-level counters that bust usePageConfig SWR keys: reloadVersion moves
-// on config reloads (all pages), navVersion on client-side navigations
-// (dynamic pages only — server-resolved content must re-resolve per
-// navigation, never serve from the SWR cache).
 let reloadVersion = 0;
-let navVersion = 0;
 
 function getReloadVersion() {
   return reloadVersion;
 }
 
-function bumpNavVersion() {
-  navVersion += 1;
-}
-
-function getNavVersion() {
-  return navVersion;
-}
-
 function useMutateCache(basePath) {
   const { mutate } = useSWRConfig();
   return () => {
@@ -47,5 +34,5 @@ function useMutateCache(basePath) {
   };
 }
 
-export { bumpNavVersion, getNavVersion, getReloadVersion };
+export { getReloadVersion };
 export default useMutateCache;

package/lib/client/utils/usePageConfig.js

@@ -13,12 +13,7 @@
 
 import useSWR from 'swr';
 
-import { getNavVersion, getReloadVersion } from './useMutateCache.js';
-
-// URLs whose config is server-resolved per request — learned from the fetched
-// config's dynamic flag, so the first visit caches like a static page and
-// every later navigation refetches.
-const dynamicUrls = new Set();
+import { getReloadVersion } from './useMutateCache.js';
 
 function parseJsModule(text) {
   const fn = new Function('exports', text.replace('export default', 'exports.default ='));
@@ -54,13 +49,6 @@ async function fetchPageConfig(url) {
   if (res.status === 404) {
     return null;
   }
-  if (res.status === 401) {
-    // Logged-out navigation to a protected page - full load to the login
-    // page so it can return here after sign-in.
-    const { redirect } = await res.json();
-    window.location.assign(redirect ?? '/404');
-    return new Promise(() => {});
-  }
   const data = await res.json();
   if (data?.buildError) {
     return data;
@@ -83,31 +71,23 @@ async function fetchPageConfig(url) {
   data._jsEntries = jsEntries;
   data._dynamicIcons = dynamicIcons;
 
-  if (data?.dynamic === true) {
-    dynamicUrls.add(url);
+  // Bust CSS cache so the browser picks up newly compiled Tailwind classes
+  const cssLink = document.getElementById('tailwind-jit-css');
+  if (cssLink) {
+    cssLink.href = `${basePath}/tailwind-jit.css?v=${Date.now()}`;
   }
 
   return data;
 }
 
 function usePageConfig(pageId, basePath) {
-  // Forward the current query string so server-side Dynamic block resolution
-  // sees the same urlQuery as an initial HTML load. Including it in the SWR
-  // key also caches dynamic pages per query string.
-  const url = `${basePath}/api/page/${pageId}${window.location.search}`;
+  const url = `${basePath}/api/page/${pageId}`;
   // Include reloadVersion in the SWR key so that after a config reload,
-  // previously cached page data is not reused. Dynamic pages also key on the
-  // navigation version — server-resolved content must re-resolve on every
-  // navigation, never serve from the SWR cache. The fetcher receives
-  // [url, ...versions] but only uses url — the versions just bust the cache.
-  const navVersion = dynamicUrls.has(url) ? getNavVersion() : 0;
-  const { data } = useSWR(
-    [url, getReloadVersion(), navVersion],
-    ([fetchUrl]) => fetchPageConfig(fetchUrl),
-    {
-      suspense: true,
-    }
-  );
+  // previously cached page data is not reused. The fetcher receives
+  // [url, version] but only uses url — the version just busts the cache.
+  const { data } = useSWR([url, getReloadVersion()], ([fetchUrl]) => fetchPageConfig(fetchUrl), {
+    suspense: true,
+  });
   return { data };
 }
 

package/lib/server/apiWrapper.js

@@ -0,0 +1,116 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+import fs from 'fs';
+import path from 'path';
+import { createApiContext } from '@lowdefy/api';
+import { getSecretsFromEnv } from '@lowdefy/node-utils';
+import { serializer } from '@lowdefy/helpers';
+import { v4 as uuid } from 'uuid';
+
+import agents from '../../build/plugins/agents.js';
+import appMeta from '../build/appMeta.js';
+import config from '../build/config.js';
+import i18nConfig from '../build/i18n.js';
+import connections from '../../build/plugins/connections.js';
+import createLogger from './log/createLogger.js';
+import fileCache from './fileCache.js';
+import getServerSession from './auth/getServerSession.js';
+import createHandleError from './log/createHandleError.js';
+import logRequest from './log/logRequest.js';
+import operators from '../../build/plugins/operators/server.js';
+import staticJsMap from '../../build/plugins/operators/serverJsMap.js';
+import getAuthOptions from './auth/getAuthOptions.js';
+
+const secrets = getSecretsFromEnv();
+
+// Dynamic JS map loading for JIT-built pages
+let cachedJsMapMtime = null;
+let cachedJsMap = staticJsMap;
+
+function loadDynamicJsMap(buildDirectory) {
+  const jsMapPath = path.join(buildDirectory, 'plugins', 'operators', 'serverJsMap.js');
+  try {
+    const stat = fs.statSync(jsMapPath);
+    if (cachedJsMapMtime && stat.mtimeMs === cachedJsMapMtime) {
+      return cachedJsMap;
+    }
+    cachedJsMapMtime = stat.mtimeMs;
+    // For server-side, we can read and eval the JS file
+    const content = fs.readFileSync(jsMapPath, 'utf8');
+    const fn = new Function('exports', content.replace('export default', 'exports.default ='));
+    const exports = {};
+    fn(exports);
+    cachedJsMap = { ...staticJsMap, ...(exports.default ?? {}) };
+    return cachedJsMap;
+  } catch {
+    return cachedJsMap;
+  }
+}
+
+function apiWrapper(handler) {
+  return async function wrappedHandler(req, res) {
+    const buildDirectory = path.join(process.cwd(), 'build');
+    const jsMap = loadDynamicJsMap(buildDirectory);
+
+    const context = {
+      // Important to give absolute path so Next can trace build files
+      rid: uuid(),
+      agents,
+      appMeta,
+      buildDirectory,
+      configDirectory: process.env.LOWDEFY_DIRECTORY_CONFIG || process.cwd(),
+      config,
+      connections,
+      fileCache,
+      headers: req?.headers,
+      i18n: i18nConfig,
+      jsMap,
+      handleError: async (err) => {
+        console.error(err);
+      },
+      logger: console,
+      operators,
+      req,
+      res,
+      secrets,
+    };
+    try {
+      context.logger = createLogger();
+      context.handleError = createHandleError({ context });
+      context.authOptions = getAuthOptions(context);
+      if (!req.url.startsWith('/api/auth')) {
+        context.session = await getServerSession(context);
+      }
+      createApiContext(context);
+      logRequest({ context });
+      // Await here so that if handler throws it is caught.
+      const response = await handler({ context, req, res });
+      // TODO: Log response time?
+      return response;
+    } catch (error) {
+      await context.handleError(error);
+      const serialized = serializer.serialize(error);
+      if (serialized?.['~e']) {
+        delete serialized['~e'].received;
+        delete serialized['~e'].stack;
+        delete serialized['~e'].configKey;
+      }
+      res.status(500).json(serialized);
+    }
+  };
+}
+
+export default apiWrapper;