@lowdefy/server-dev 5.6.0 → 6.0.0

package/lib/docs/stateCheckpoints.test.mjs

@@ -0,0 +1,366 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { jest } from '@jest/globals';
+
+// checkpointStore.js reads LOWDEFY_DIRECTORY_CONFIG for where to store
+// checkpoints, and lib/build/config.js (imported transitively by
+// loadState.js -> getBrowser.js) reads build/config.json from
+// process.cwd() at import time — one fixture dir serves both, mirroring
+// screenshotPage.test.mjs / configCheckpoints.test.mjs.
+const originalCwd = process.cwd();
+const previousConfigDirectory = process.env.LOWDEFY_DIRECTORY_CONFIG;
+const fixtureDir = fs.mkdtempSync(path.join(os.tmpdir(), 'lowdefy-state-checkpoints-test-'));
+fs.mkdirSync(path.join(fixtureDir, 'build'), { recursive: true });
+fs.writeFileSync(path.join(fixtureDir, 'build', 'config.json'), JSON.stringify({ basePath: '' }));
+process.chdir(fixtureDir);
+process.env.LOWDEFY_DIRECTORY_CONFIG = fixtureDir;
+
+// A real headless load needs an installed browser, which jest can't rely on —
+// loadState's registry-only mode (the only mode under test here) never
+// calls getBrowser(), but chromium is mocked anyway so importing
+// getBrowser.js can never accidentally launch a real browser.
+jest.unstable_mockModule('playwright-core', () => ({
+  chromium: { launch: jest.fn().mockRejectedValue(new Error("Executable doesn't exist")) },
+}));
+
+const mockInspectState = jest.fn();
+jest.unstable_mockModule('./inspectState.js', () => ({
+  default: mockInspectState,
+}));
+
+const {
+  checkpointExists,
+  getStateCheckpointsRoot,
+  listStateCheckpoints,
+  readCheckpoint,
+  writeCheckpoint,
+} = await import('./checkpointStore.js');
+const { clearMocks, getMock, listMocks, loadMocks } = await import('./devMockRegistry.js');
+const { default: checkpointToMocks } = await import('./checkpointToMocks.js');
+const { default: snapshotState } = await import('./snapshotState.js');
+const { default: loadState } = await import('./loadState.js');
+
+afterAll(() => {
+  process.chdir(originalCwd);
+  fs.rmSync(fixtureDir, { recursive: true, force: true });
+  if (previousConfigDirectory === undefined) {
+    delete process.env.LOWDEFY_DIRECTORY_CONFIG;
+  } else {
+    process.env.LOWDEFY_DIRECTORY_CONFIG = previousConfigDirectory;
+  }
+});
+
+afterEach(() => {
+  clearMocks();
+});
+
+function buildSnapshot(overrides = {}) {
+  return {
+    pageId: 'home',
+    url: 'http://localhost:3111/home',
+    state: { count: 1 },
+    urlQuery: '?a=1',
+    input: { fromInput: true },
+    user: { id: 'u1' },
+    global: { g: 1 },
+    requests: {
+      req1: [{ payload: { a: 1 }, response: { ok: true }, error: null, responseTime: 12 }],
+    },
+    apiResponses: {
+      ep1: { payload: {}, response: { v: 1 } },
+    },
+    ...overrides,
+  };
+}
+
+describe('checkpointStore', () => {
+  test('writeCheckpoint writes a manifest and per-part files, including per-request/api files on disk', () => {
+    const snapshot = buildSnapshot();
+    const { dir, parts } = writeCheckpoint({ name: 'cp-roundtrip', snapshot, notes: 'a note' });
+
+    expect(dir).toBe(path.join(getStateCheckpointsRoot(), 'cp-roundtrip'));
+    expect(parts.sort()).toEqual(
+      [
+        'checkpoint.json',
+        'state.json',
+        'urlQuery.json',
+        'inputs.json',
+        'user.json',
+        'global.json',
+        'requests/req1.json',
+        'api/ep1.json',
+      ].sort()
+    );
+    expect(fs.existsSync(path.join(dir, 'requests', 'req1.json'))).toBe(true);
+    expect(fs.existsSync(path.join(dir, 'api', 'ep1.json'))).toBe(true);
+
+    const result = readCheckpoint({ name: 'cp-roundtrip' });
+    expect(result.checkpoint.pageId).toBe('home');
+    expect(result.checkpoint.url).toBe('http://localhost:3111/home');
+    expect(result.checkpoint.notes).toBe('a note');
+    expect(typeof result.checkpoint.capturedAt).toBe('string');
+    expect(result.state).toEqual({ count: 1 });
+    expect(result.urlQuery).toBe('?a=1');
+    expect(result.input).toEqual({ fromInput: true });
+    expect(result.user).toEqual({ id: 'u1' });
+    expect(result.global).toEqual({ g: 1 });
+    expect(result.requests).toEqual({
+      req1: { payload: { a: 1 }, response: { ok: true }, error: null, responseTime: 12 },
+    });
+    expect(result.api).toEqual({
+      ep1: { payload: {}, response: { v: 1 }, error: undefined, responseTime: undefined },
+    });
+  });
+
+  test('writeCheckpoint throws an actionable error for an invalid checkpoint name', () => {
+    expect(() => writeCheckpoint({ name: 'bad name!', snapshot: buildSnapshot() })).toThrow(
+      /invalid/
+    );
+  });
+
+  test('writeCheckpoint refuses to overwrite an existing checkpoint unless overwrite: true', () => {
+    writeCheckpoint({ name: 'cp-overwrite', snapshot: buildSnapshot() });
+
+    expect(() => writeCheckpoint({ name: 'cp-overwrite', snapshot: buildSnapshot() })).toThrow(
+      'Checkpoint "cp-overwrite" already exists. Pass overwrite: true to replace it.'
+    );
+
+    const fewerRequests = buildSnapshot({ requests: {}, apiResponses: {} });
+    const { dir } = writeCheckpoint({
+      name: 'cp-overwrite',
+      snapshot: fewerRequests,
+      overwrite: true,
+    });
+    // Overwriting replaces the whole folder, so stale per-request files from
+    // the first write must not linger.
+    expect(fs.existsSync(path.join(dir, 'requests', 'req1.json'))).toBe(false);
+  });
+
+  test('readCheckpoint throws when the checkpoint does not exist', () => {
+    expect(() => readCheckpoint({ name: 'does-not-exist' })).toThrow(
+      'Checkpoint "does-not-exist" not found.'
+    );
+  });
+
+  test('readCheckpoint is tolerant of missing parts', () => {
+    const dir = path.join(getStateCheckpointsRoot(), 'cp-partial');
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'checkpoint.json'), JSON.stringify({ pageId: 'home' }));
+    // Deliberately no state.json/urlQuery.json/etc, no requests/ dir.
+
+    const result = readCheckpoint({ name: 'cp-partial' });
+    expect(result.state).toEqual({});
+    expect(result.urlQuery).toBe('');
+    expect(result.input).toEqual({});
+    expect(result.user).toBe(null);
+    expect(result.global).toEqual({});
+    expect(result.requests).toEqual({});
+    expect(result.api).toEqual({});
+  });
+
+  test('checkpointExists reflects whether a checkpoint folder exists', () => {
+    writeCheckpoint({ name: 'cp-exists', snapshot: buildSnapshot() });
+    expect(checkpointExists({ name: 'cp-exists' })).toBe(true);
+    expect(checkpointExists({ name: 'cp-does-not-exist' })).toBe(false);
+  });
+
+  test('listStateCheckpoints lists checkpoints with requestCount, most recent first', async () => {
+    writeCheckpoint({ name: 'cp-list-a', snapshot: buildSnapshot() });
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    writeCheckpoint({
+      name: 'cp-list-b',
+      snapshot: buildSnapshot({ requests: {}, apiResponses: {} }),
+    });
+
+    const checkpoints = listStateCheckpoints();
+    const a = checkpoints.find((checkpoint) => checkpoint.name === 'cp-list-a');
+    const b = checkpoints.find((checkpoint) => checkpoint.name === 'cp-list-b');
+    expect(a.requestCount).toBe(1);
+    expect(b.requestCount).toBe(0);
+    expect(checkpoints.indexOf(b)).toBeLessThan(checkpoints.indexOf(a));
+  });
+});
+
+describe('devMockRegistry', () => {
+  test('loadMocks + getMock replay a recorded response by pageId/requestId', () => {
+    loadMocks({ pageId: 'home', mocks: { req1: { response: { ok: true }, error: null } } });
+    expect(getMock({ pageId: 'home', requestId: 'req1' })).toEqual({
+      pageId: 'home',
+      requestId: 'req1',
+      response: { ok: true },
+      error: null,
+    });
+    expect(getMock({ pageId: 'other', requestId: 'req1' })).toBeUndefined();
+  });
+
+  test('listMocks reports whether each entry has a response or an error', () => {
+    loadMocks({
+      pageId: 'home',
+      mocks: {
+        req1: { response: { ok: true } },
+        req2: { error: new Error('boom') },
+      },
+    });
+    const mocks = listMocks().sort((m1, m2) => m1.requestId.localeCompare(m2.requestId));
+    expect(mocks).toEqual([
+      { pageId: 'home', requestId: 'req1', hasResponse: true, hasError: false },
+      { pageId: 'home', requestId: 'req2', hasResponse: false, hasError: true },
+    ]);
+  });
+
+  test('clearMocks removes all recorded mocks', () => {
+    loadMocks({ pageId: 'home', mocks: { req1: { response: { ok: true } } } });
+    clearMocks();
+    expect(listMocks()).toEqual([]);
+    expect(getMock({ pageId: 'home', requestId: 'req1' })).toBeUndefined();
+  });
+});
+
+describe('checkpointToMocks', () => {
+  test('converts a checkpoint into the loadStaticMocks input shape', () => {
+    writeCheckpoint({
+      name: 'cp-to-mocks',
+      snapshot: buildSnapshot({
+        requests: {
+          req1: [{ response: { ok: true } }],
+          req2: [{ error: new Error('request failed') }],
+        },
+        apiResponses: {
+          ep1: [{ response: { v: 1 } }],
+        },
+      }),
+    });
+
+    const result = checkpointToMocks({ name: 'cp-to-mocks' });
+
+    expect(result.requests.sort((a, b) => a.requestId.localeCompare(b.requestId))).toEqual([
+      { requestId: 'req1', pageId: 'home', response: { ok: true } },
+      { requestId: 'req2', pageId: 'home', error: 'request failed' },
+    ]);
+    expect(result.api).toEqual([{ endpointId: 'ep1', response: { v: 1 } }]);
+    expect(result.yaml).toEqual(expect.any(String));
+    expect(result.yaml).toContain('requestId: req1');
+    expect(result.yaml).toContain('endpointId: ep1');
+  });
+
+  test('returns an error when the checkpoint does not exist', () => {
+    expect(checkpointToMocks({ name: 'does-not-exist' })).toEqual({
+      error: 'Checkpoint "does-not-exist" not found.',
+    });
+  });
+});
+
+describe('snapshotState', () => {
+  test('snapshots inspectState output into a checkpoint and returns its location', async () => {
+    mockInspectState.mockResolvedValue({
+      pageId: 'home',
+      state: { count: 2 },
+      requests: {},
+      urlQuery: '',
+      source: 'headless',
+    });
+
+    const result = await snapshotState({
+      origin: 'http://localhost:3111',
+      pageId: 'home',
+      name: 'cp-snapshot',
+    });
+
+    expect(result.error).toBeUndefined();
+    expect(result.name).toBe('cp-snapshot');
+    expect(result.source).toBe('headless');
+    expect(result.parts).toContain('state.json');
+
+    const stored = readCheckpoint({ name: 'cp-snapshot' });
+    expect(stored.state).toEqual({ count: 2 });
+    expect(stored.checkpoint.url).toBe('http://localhost:3111/home');
+  });
+
+  test('returns the inspectState error instead of writing a checkpoint', async () => {
+    mockInspectState.mockResolvedValue({ error: 'No live context for page "home".' });
+
+    const result = await snapshotState({
+      origin: 'http://localhost:3111',
+      pageId: 'home',
+      name: 'cp-snapshot-error',
+    });
+
+    expect(result).toEqual({ error: 'No live context for page "home".' });
+    expect(checkpointExists({ name: 'cp-snapshot-error' })).toBe(false);
+  });
+
+  test('validates required fields before calling inspectState', async () => {
+    const result = await snapshotState({ origin: 'http://localhost:3111', name: 'cp-x' });
+    expect(result.error).toMatch(/requires a "pageId" string/);
+    expect(mockInspectState).not.toHaveBeenCalled();
+  });
+});
+
+describe('loadState', () => {
+  test('registry-only mode loads recorded requests into devMockRegistry and returns a bootstrap URL', async () => {
+    writeCheckpoint({
+      name: 'cp-load-registry',
+      snapshot: buildSnapshot({ urlQuery: '?a=1' }),
+    });
+
+    const result = await loadState({
+      origin: 'http://localhost:3111',
+      name: 'cp-load-registry',
+      mode: 'registry-only',
+    });
+
+    expect(result.error).toBeUndefined();
+    expect(result.url).toBe('http://localhost:3111/home?a=1&_checkpoint=cp-load-registry');
+    expect(result.instructions).toMatch(/Open this URL/);
+    expect(getMock({ pageId: 'home', requestId: 'req1' })).toEqual({
+      pageId: 'home',
+      requestId: 'req1',
+      response: { ok: true },
+      error: null,
+    });
+  });
+
+  test('returns an error when the checkpoint does not exist', async () => {
+    const result = await loadState({
+      origin: 'http://localhost:3111',
+      name: 'does-not-exist',
+      mode: 'registry-only',
+    });
+    expect(result).toEqual({ error: 'Checkpoint "does-not-exist" not found.' });
+  });
+
+  test('rejects a user in registry-only mode as invalid input', async () => {
+    writeCheckpoint({
+      name: 'cp-load-registry-user',
+      snapshot: buildSnapshot({ urlQuery: '' }),
+    });
+
+    const result = await loadState({
+      origin: 'http://localhost:3111',
+      name: 'cp-load-registry-user',
+      mode: 'registry-only',
+      user: { roles: ['admin'] },
+    });
+
+    expect(result.invalidInput).toBe(true);
+    expect(result.error).toMatch(/cannot apply "user" in "registry-only" mode/);
+    expect(result.url).toBeUndefined();
+  });
+});

package/lib/docs/tabAvailable.js

@@ -0,0 +1,28 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+import { listTabs } from './tabChannel.js';
+
+// Shared by inspectState.js and evalOperator.js to decide, when no explicit
+// `source` is requested, whether a live browser tab exists to prefer over a
+// fresh headless one.
+function tabAvailable({ pageId }) {
+  return listTabs().some((tab) => type.isNone(pageId) || tab.pageId === pageId);
+}
+
+export default tabAvailable;

package/lib/docs/tabChannel.js

@@ -0,0 +1,119 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { randomUUID } from 'node:crypto';
+
+import { type } from '@lowdefy/helpers';
+
+// Live channel between the dev server and a developer's real browser tab —
+// lets an agent read `window.lowdefy` state / evaluate operators against it.
+// Two module-level registries, mirroring the pendingContexts pattern in
+// src/websocket/devWebSocket.js:
+//   - tabs: connected SSE streams, one per open browser tab, keyed by tab id.
+//   - pendingRequests: in-flight request/response correlations, keyed by
+//     requestId, resolved either by resolveTabRequest (POST from the tab) or
+//     by the request's own timeout.
+const tabs = new Map();
+const pendingRequests = new Map();
+
+function registerTab({ id, pageId, send }) {
+  if (type.isNone(id) || !type.isString(id)) {
+    throw new Error(`registerTab requires an "id" string. Received ${JSON.stringify(id)}.`);
+  }
+  if (!type.isFunction(send)) {
+    throw new Error('registerTab requires a "send" function.');
+  }
+  tabs.set(id, { id, pageId: pageId ?? null, send, connectedAt: new Date() });
+}
+
+function updateTabPage({ id, pageId }) {
+  const tab = tabs.get(id);
+  if (type.isNone(tab)) {
+    // The tab may have disconnected between the client sending the ping and
+    // it arriving — nothing to update, and not worth failing the request.
+    return;
+  }
+  tab.pageId = pageId ?? null;
+}
+
+function unregisterTab({ id }) {
+  tabs.delete(id);
+}
+
+function listTabs() {
+  return Array.from(tabs.values()).map(({ id, pageId, connectedAt }) => ({
+    id,
+    pageId,
+    connectedAt,
+  }));
+}
+
+// Most recently connected tab wins — Map preserves insertion order, and
+// re-registering a tab id (reconnect) deletes then re-sets it, so the last
+// entry is always the most recent connection.
+function findTab({ pageId }) {
+  const candidates = Array.from(tabs.values()).filter(
+    (tab) => type.isNone(pageId) || tab.pageId === pageId
+  );
+  if (candidates.length === 0) {
+    return undefined;
+  }
+  return candidates[candidates.length - 1];
+}
+
+function requestFromTab({ pageId, event, payload = {}, timeout = 5000 }) {
+  if (type.isNone(event) || !type.isString(event)) {
+    throw new Error(
+      `requestFromTab requires an "event" string. Received ${JSON.stringify(event)}.`
+    );
+  }
+  const tab = findTab({ pageId });
+  if (type.isNone(tab)) {
+    const location = type.isNone(pageId) ? 'any page' : `page "${pageId}"`;
+    return Promise.resolve({
+      error: `No browser tab connected on ${location}. Ask the developer to open the page, or use source: "headless".`,
+    });
+  }
+
+  const requestId = randomUUID();
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      pendingRequests.delete(requestId);
+      resolve({ error: `Timed out waiting ${timeout}ms for a response from the browser tab.` });
+    }, timeout);
+
+    pendingRequests.set(requestId, (result) => {
+      clearTimeout(timer);
+      pendingRequests.delete(requestId);
+      resolve(result);
+    });
+
+    tab.send(event, { requestId, ...payload });
+  });
+}
+
+function resolveTabRequest({ requestId, result }) {
+  const resolver = pendingRequests.get(requestId);
+  if (type.isNone(resolver)) {
+    // Answer arrived after the request already timed out (or for an unknown
+    // requestId) — nothing left to resolve.
+    return false;
+  }
+  resolver(result);
+  return true;
+}
+
+export { listTabs, registerTab, requestFromTab, resolveTabRequest, unregisterTab, updateTabPage };

package/lib/docs/tabChannel.test.mjs

@@ -0,0 +1,130 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+
+const { listTabs, registerTab, requestFromTab, resolveTabRequest, unregisterTab, updateTabPage } =
+  await import('./tabChannel.js');
+
+// tabChannel keeps its registries at module scope, so clear connected tabs
+// between tests to keep them independent.
+afterEach(() => {
+  listTabs().forEach((tab) => unregisterTab({ id: tab.id }));
+});
+
+test('registerTab adds a tab visible via listTabs', () => {
+  registerTab({ id: 'tab-1', pageId: 'home', send: jest.fn() });
+  const tabs = listTabs();
+  expect(tabs).toHaveLength(1);
+  expect(tabs[0]).toMatchObject({ id: 'tab-1', pageId: 'home' });
+  expect(tabs[0].connectedAt).toBeInstanceOf(Date);
+});
+
+test('registerTab throws when id is missing', () => {
+  expect(() => registerTab({ pageId: 'home', send: jest.fn() })).toThrow('registerTab requires');
+});
+
+test('registerTab throws when send is not a function', () => {
+  expect(() => registerTab({ id: 'tab-1', pageId: 'home' })).toThrow(
+    'registerTab requires a "send" function'
+  );
+});
+
+test('unregisterTab removes a tab from the registry', () => {
+  registerTab({ id: 'tab-1', pageId: 'home', send: jest.fn() });
+  unregisterTab({ id: 'tab-1' });
+  expect(listTabs()).toHaveLength(0);
+});
+
+test('updateTabPage changes the pageId of a registered tab', () => {
+  registerTab({ id: 'tab-1', pageId: 'home', send: jest.fn() });
+  updateTabPage({ id: 'tab-1', pageId: 'about' });
+  expect(listTabs()[0].pageId).toEqual('about');
+});
+
+test('updateTabPage on an unknown tab id does not throw', () => {
+  expect(() => updateTabPage({ id: 'missing', pageId: 'about' })).not.toThrow();
+});
+
+test('requestFromTab sends the event to the matching tab and resolves via resolveTabRequest', async () => {
+  const send = jest.fn();
+  registerTab({ id: 'tab-1', pageId: 'home', send });
+  const promise = requestFromTab({ pageId: 'home', event: 'inspect-request' });
+
+  expect(send).toHaveBeenCalledTimes(1);
+  const [event, payload] = send.mock.calls[0];
+  expect(event).toEqual('inspect-request');
+  expect(payload.requestId).toEqual(expect.any(String));
+
+  const resolved = resolveTabRequest({ requestId: payload.requestId, result: 'snapshot' });
+  expect(resolved).toBe(true);
+  await expect(promise).resolves.toEqual('snapshot');
+});
+
+test('requestFromTab targets the tab registered for the given pageId', async () => {
+  const sendHome = jest.fn();
+  const sendAbout = jest.fn();
+  registerTab({ id: 'tab-home', pageId: 'home', send: sendHome });
+  registerTab({ id: 'tab-about', pageId: 'about', send: sendAbout });
+
+  const promise = requestFromTab({ pageId: 'about', event: 'eval-request' });
+  expect(sendAbout).toHaveBeenCalledTimes(1);
+  expect(sendHome).not.toHaveBeenCalled();
+
+  const requestId = sendAbout.mock.calls[0][1].requestId;
+  resolveTabRequest({ requestId, result: { value: '1' } });
+  await expect(promise).resolves.toEqual({ value: '1' });
+});
+
+test('requestFromTab picks the most recently registered tab when pageId is omitted', async () => {
+  registerTab({ id: 'tab-1', pageId: 'home', send: jest.fn() });
+  const sendLatest = jest.fn();
+  registerTab({ id: 'tab-2', pageId: 'about', send: sendLatest });
+
+  const promise = requestFromTab({ event: 'inspect-request' });
+  expect(sendLatest).toHaveBeenCalledTimes(1);
+
+  const requestId = sendLatest.mock.calls[0][1].requestId;
+  resolveTabRequest({ requestId, result: 'ok' });
+  await expect(promise).resolves.toEqual('ok');
+});
+
+test('requestFromTab resolves with an error when no tab matches the pageId', async () => {
+  registerTab({ id: 'tab-1', pageId: 'home', send: jest.fn() });
+  const response = await requestFromTab({ pageId: 'missing-page', event: 'inspect-request' });
+  expect(response.error).toContain('No browser tab connected');
+});
+
+test('requestFromTab resolves with a timeout error when no response arrives in time', async () => {
+  registerTab({ id: 'tab-1', pageId: 'home', send: jest.fn() });
+  const response = await requestFromTab({ pageId: 'home', event: 'inspect-request', timeout: 10 });
+  expect(response.error).toContain('Timed out');
+});
+
+test('resolveTabRequest returns false for an unknown requestId', () => {
+  expect(resolveTabRequest({ requestId: 'unknown', result: 'x' })).toBe(false);
+});
+
+test('resolveTabRequest returns false when called again for an already-settled requestId', async () => {
+  const send = jest.fn();
+  registerTab({ id: 'tab-1', pageId: 'home', send });
+  const promise = requestFromTab({ pageId: 'home', event: 'inspect-request' });
+  const requestId = send.mock.calls[0][1].requestId;
+
+  expect(resolveTabRequest({ requestId, result: 'first' })).toBe(true);
+  await promise;
+  expect(resolveTabRequest({ requestId, result: 'second' })).toBe(false);
+});

package/lib/server/auth/{getAuthOptions.js → getAuthConfig.js}

@@ -14,22 +14,25 @@
   limitations under the License.
 */
 
-import { getNextAuthConfig } from '@lowdefy/api';
+import { getAuthConfig as getApiAuthConfig } from '@lowdefy/api';
 import { getSecretsFromEnv } from '@lowdefy/node-utils';
 
 import adapters from '../../../build/plugins/auth/adapters.js';
+import appMeta from '../../build/appMeta.js';
 import authJson from '../../build/auth.js';
 import callbacks from '../../../build/plugins/auth/callbacks.js';
 import events from '../../../build/plugins/auth/events.js';
 import providers from '../../../build/plugins/auth/providers.js';
 
-function getAuthOptions({ logger }) {
-  return getNextAuthConfig({
+function getAuthConfig({ logger }) {
+  return getApiAuthConfig({
+    appMeta,
     authJson,
+    dev: true,
     logger,
     plugins: { adapters, callbacks, events, providers },
     secrets: getSecretsFromEnv(),
   });
 }
 
-export default getAuthOptions;
+export default getAuthConfig;