@lowdefy/server-dev 5.6.0 → 6.1.0

package/lib/server/createLowdefyContext.test.mjs

@@ -0,0 +1,117 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+import { jest } from '@jest/globals';
+import { projectCaughtError } from '@lowdefy/helpers';
+import { operatorsServer } from '@lowdefy/operators-js';
+
+const secret = 'planted-dev-secret';
+process.env.LOWDEFY_SECRET_TEST = secret;
+
+jest.unstable_mockModule('@lowdefy/api', () => ({ createApiContext: jest.fn() }));
+jest.unstable_mockModule('../build/appMeta.js', () => ({ default: {} }));
+jest.unstable_mockModule('../build/config.js', () => ({ default: {} }));
+jest.unstable_mockModule('../build/i18n.js', () => ({ default: {} }));
+jest.unstable_mockModule('./log/createHandleError.js', () => ({
+  default: jest.fn(() => jest.fn()),
+}));
+jest.unstable_mockModule('./log/createLogger.js', () => ({
+  default: jest.fn(() => ({ debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() })),
+}));
+jest.unstable_mockModule('./fileCache.js', () => ({ default: {} }));
+jest.unstable_mockModule('./auth/session.js', () => ({ default: jest.fn(async () => undefined) }));
+jest.unstable_mockModule('./auth/strategies.js', () => ({ default: jest.fn(async () => null) }));
+jest.unstable_mockModule('./log/logRequest.js', () => ({ default: jest.fn() }));
+
+// createLowdefyContext statically imports the app build's plugin artifacts,
+// which only exist in a built app (build/** is gitignored). Materialize the
+// minimal set it needs — same fixture strategy as auth/getDevSession.test.mjs
+// — so the import resolves; clean up only what this test created.
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const pluginsDir = path.resolve(dirname, '../../build/plugins');
+const fixtures = [
+  { file: 'agents.js', content: 'export default {};\n' },
+  { file: 'connections.js', content: 'export default {};\n' },
+  {
+    file: 'notifications.js',
+    content: 'export default {};\nexport const interpolateProperties = () => {};\nexport const renderEmail = () => {};\n',
+  },
+  { file: path.join('operators', 'server.js'), content: 'export default {};\n' },
+  { file: path.join('operators', 'serverJsMap.js'), content: 'export default {};\n' },
+  { file: 'websockets.js', content: 'export default {};\n' },
+].map(({ file, content }) => ({ absolutePath: path.join(pluginsDir, file), content }));
+
+const createdFixtures = [];
+fixtures.forEach(({ absolutePath, content }) => {
+  if (!fs.existsSync(absolutePath)) {
+    fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+    fs.writeFileSync(absolutePath, content);
+    createdFixtures.push(absolutePath);
+  }
+});
+
+// A checkout that has built an app already holds real artifacts here, which import plugins this
+// package does not depend on, so the stubs are also mocked over whatever is on disk.
+fixtures.forEach(({ absolutePath }) => {
+  jest.unstable_mockModule(absolutePath, () => ({
+    default: {},
+    interpolateProperties: () => {},
+    renderEmail: () => {},
+  }));
+});
+
+afterAll(() => {
+  createdFixtures.forEach((absolutePath) => fs.rmSync(absolutePath, { force: true }));
+});
+
+const { default: createLowdefyContext } = await import('./createLowdefyContext.js');
+
+function createHonoContext({ path: reqPath = '/api/request/foo' } = {}) {
+  return {
+    req: {
+      header: (name) => (name ? undefined : {}),
+      path: reqPath,
+      method: 'POST',
+      url: `http://localhost${reqPath}`,
+    },
+  };
+}
+
+test('createLowdefyContext sets mode to dev', async () => {
+  const context = await createLowdefyContext({ c: createHonoContext() });
+  expect(context.mode).toEqual('dev');
+});
+
+test('createLowdefyContext scrubSecrets redacts a planted secret', async () => {
+  const context = await createLowdefyContext({ c: createHonoContext() });
+  expect(context.scrubSecrets(`token ${secret} end`)).toEqual('token [REDACTED] end');
+});
+
+// controlTry builds the value `_error` reads from context.scrubSecrets, so a dev context has to
+// scrub a caught message the same way the production server does.
+test('_error on a dev context reads a caught message with a planted secret scrubbed', async () => {
+  const context = await createLowdefyContext({ c: createHonoContext() });
+  const error = projectCaughtError(new Error(`Connect failed with ${secret}.`), {
+    scrub: context.scrubSecrets,
+  });
+  expect(operatorsServer._error({ error, location: 'test', params: 'message' })).toEqual(
+    'Connect failed with [REDACTED].'
+  );
+});

package/lib/server/getPageJitEnrichment.test.mjs

@@ -0,0 +1,105 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { getPageJitEnrichment } from './jitPageBuilder.js';
+
+// A stub of cachedBuildContext. getPageJitEnrichment reads jsMap.client and
+// dynamicIconData off it; production omits buildContext so it defaults to the
+// module-private cachedBuildContext.
+function buildContext({ client = {}, dynamicIconData = {} } = {}) {
+  return { jsMap: { client, server: {} }, dynamicIconData };
+}
+
+test('getPageJitEnrichment scopes string-form, object-form, and args-nested _js hashes', () => {
+  const client = {
+    hashString: 'return args.x + 1;',
+    hashFn: 'return 2;',
+    hashNested: 'return 3;',
+    hashUnused: 'return 4;', // present in the map but not referenced by the page
+  };
+  const pageConfig = {
+    id: 'p',
+    blocks: [
+      { properties: { value: { _js: 'hashString' } } },
+      // object form; the args carry another _js node that must be descended into
+      { properties: { compute: { _js: { fn: 'hashFn', args: { seed: { _js: 'hashNested' } } } } } },
+      // referenced but absent from the client map — excluded, no crash
+      { properties: { missing: { _js: 'hashAbsent' } } },
+    ],
+  };
+
+  const { jsEntries } = getPageJitEnrichment({
+    pageConfig,
+    buildContext: buildContext({ client }),
+  });
+
+  expect(jsEntries).toContain("'hashString'");
+  expect(jsEntries).toContain("'hashFn'");
+  expect(jsEntries).toContain("'hashNested'");
+  expect(jsEntries).not.toContain("'hashUnused'");
+  expect(jsEntries).not.toContain("'hashAbsent'");
+});
+
+test('getPageJitEnrichment discovers an icon name that appears only inside a _js source', () => {
+  const client = {
+    // The icon name lives only in the function body, in double quotes — the
+    // served pageConfig has this replaced by the hash, so scanning the config
+    // alone would miss it. Only FiZap is a real dynamic icon.
+    hashIcon: 'return on ? "FiZap" : "FiZapOff";',
+  };
+  const pageConfig = {
+    id: 'p',
+    blocks: [{ properties: { icon: { _js: 'hashIcon' } } }],
+  };
+
+  const { dynamicIcons } = getPageJitEnrichment({
+    pageConfig,
+    buildContext: buildContext({ client, dynamicIconData: { FiZap: { tag: 'svg' } } }),
+  });
+
+  expect(dynamicIcons).toEqual({ FiZap: { tag: 'svg' } });
+});
+
+test('getPageJitEnrichment scopes icons referenced directly in the page config', () => {
+  const pageConfig = { id: 'p', blocks: [{ properties: { icon: 'FiStar' } }] };
+
+  const { dynamicIcons } = getPageJitEnrichment({
+    pageConfig,
+    buildContext: buildContext({
+      dynamicIconData: { FiStar: { tag: 'svg' }, FiOther: { tag: 'svg' } },
+    }),
+  });
+
+  expect(dynamicIcons).toEqual({ FiStar: { tag: 'svg' } });
+});
+
+test('getPageJitEnrichment returns {} when there is no build context', () => {
+  expect(getPageJitEnrichment({ pageConfig: { id: 'p' }, buildContext: null })).toEqual({});
+});
+
+test('getPageJitEnrichment omits both fields when the page has no dynamic _js or icons', () => {
+  const pageConfig = { id: 'p', blocks: [{ properties: { title: 'Hello' } }] };
+
+  const enrichment = getPageJitEnrichment({
+    pageConfig,
+    buildContext: buildContext({
+      client: { hashUnused: 'return 1;' },
+      dynamicIconData: { FiZap: {} },
+    }),
+  });
+
+  expect(enrichment).toEqual({ jsEntries: undefined, dynamicIcons: undefined });
+});

package/lib/server/jitPageBuilder.js

@@ -16,10 +16,16 @@
 
 import fs from 'fs';
 import path from 'path';
-import { serializer } from '@lowdefy/helpers';
-import { buildPageJit, createContext, makeId } from '@lowdefy/build/dev';
+import { serializer, type } from '@lowdefy/helpers';
+import {
+  buildPageJit,
+  createContext,
+  generateClientJsModule,
+  hydrateDeferredRecords,
+  iconPackages,
+  makeId,
+} from '@lowdefy/build/dev';
 
-import compileCss from './compileCss.js';
 import createLogger from './log/createLogger.js';
 import PageCache from './pageCache.mjs';
 import readBuildApiArtifacts from './readBuildApiArtifacts.mjs';
@@ -36,10 +42,10 @@ let cachedRegistry = null;
 let cachedBuildContext = null;
 let lastInvalidationMtime = null;
 
-// Frozen snapshot of icon imports from the initial build (what's actually in the Next.js bundle).
+// Frozen snapshot of icon imports from the initial build (what's actually in the client bundle).
 // Module-level so it persists across context resets (skeleton rebuilds update iconImports.json
-// with newly discovered icons, but those aren't in the bundle until the next nextBuild).
-// Only resets when the server process restarts (which happens after every nextBuild).
+// with newly discovered icons, but those aren't in the bundle until a server restart).
+// Only resets when the server process restarts.
 let bundledIconImports = null;
 
 function readJsonFile(filePath) {
@@ -92,10 +98,10 @@ function getBuildContext(buildDirectory, configDirectory) {
   const keyMap = readJsonFile(path.join(buildDirectory, 'keyMap.json')) ?? {};
   const jsMap = readJsonFile(path.join(buildDirectory, 'jsMap.json')) ?? { client: {}, server: {} };
   const connectionIds = readJsonFile(path.join(buildDirectory, 'connectionIds.json')) ?? [];
+  const websocketIds = readJsonFile(path.join(buildDirectory, 'websocketIds.json')) ?? [];
 
   const customTypesMap = readJsonFile(path.join(buildDirectory, 'customTypesMap.json')) ?? {};
-  const customMessagesMap =
-    readJsonFile(path.join(buildDirectory, 'customMessagesMap.json')) ?? {};
+  const customMessagesMap = readJsonFile(path.join(buildDirectory, 'customMessagesMap.json')) ?? {};
 
   cachedBuildContext = createContext({
     customMessagesMap,
@@ -109,7 +115,7 @@ function getBuildContext(buildDirectory, configDirectory) {
     stage: 'dev',
   });
 
-  // Restore refMap, keyMap, jsMap, and connectionIds from skeleton build
+  // Restore refMap, keyMap, jsMap, connectionIds, and websocketIds from skeleton build
   Object.assign(cachedBuildContext.refMap, refMap);
   Object.assign(cachedBuildContext.keyMap, keyMap);
   cachedBuildContext.jsMap.client = jsMap.client ?? {};
@@ -117,6 +123,9 @@ function getBuildContext(buildDirectory, configDirectory) {
   for (const id of connectionIds) {
     cachedBuildContext.connectionIds.add(id);
   }
+  for (const id of websocketIds) {
+    cachedBuildContext.websocketIds.add(id);
+  }
 
   // Load installed packages snapshot from skeleton build for missing-package detection
   const installedPluginPackages =
@@ -129,15 +138,27 @@ function getBuildContext(buildDirectory, configDirectory) {
     Object.assign(cachedBuildContext.modules, modules);
   }
 
+  // Hydrate the deferred-record registry — module component bodies referenced
+  // by '~deferred' placeholders in modules.json live here. readJsonFile runs
+  // the marker-restoring reviver, so record-body ~r/~l markers survive.
+  const deferredRecords = readJsonFile(path.join(buildDirectory, 'deferredRecords.json'));
+  if (deferredRecords) {
+    hydrateDeferredRecords(cachedBuildContext, deferredRecords);
+  }
+
+  // Restore app metadata so JIT page builds resolve _app / _build.app against
+  // the same metadata the skeleton build computed.
+  cachedBuildContext.appMeta = readJsonFile(path.join(buildDirectory, 'appMeta.json')) ?? null;
+
   // Restore api endpoint configs so JIT CallAPI validation (validateCallApiRefs in
   // buildPageJit) can resolve endpointIds. Without this the dev context has no
   // components.api and every CallAPI action is flagged as a non-existent endpoint.
   cachedBuildContext.components = { api: readBuildApiArtifacts(buildDirectory) };
 
   // Use the frozen icon imports from the initial build for JIT detection.
-  // This represents what's actually in the Next.js bundle — not what shallowBuild
+  // This represents what's actually in the client bundle — not what shallowBuild
   // discovers on subsequent rebuilds (those icons aren't bundled yet).
-  // bundledIconImports is module-level and only resets on server restart (after nextBuild).
+  // bundledIconImports is module-level and only resets on server restart.
   if (!bundledIconImports) {
     bundledIconImports = readJsonFile(path.join(buildDirectory, 'iconImports.json')) ?? [];
   }
@@ -190,7 +211,18 @@ async function buildPageIfNeeded({ pageId, buildDirectory, configDirectory }) {
       return result;
     }
     pageCache.markCompiled(pageId);
-    await compileCss(buildDirectory);
+    // Touch the candidates file so Vite's CSS pipeline re-runs Tailwind for
+    // classes the JIT build discovered — globals.css imports it. This import
+    // is the ONLY recompile trigger: the tailwind .html scan inputs are
+    // excluded from Vite's watcher (their .html change events would force
+    // full browser reloads). Only touched when the build actually changed
+    // tailwind content, so unchanged rebuilds cause no CSS recompile.
+    if (result?._tailwindChanged) {
+      fs.writeFileSync(
+        path.join(buildDirectory, 'tailwind-candidates.css'),
+        `/* Generated by Lowdefy build — rewritten on page changes to trigger CSS recompilation */\n/* ${Date.now()} */\n`
+      );
+    }
     jitLogger.info(
       { spin: 'succeed', color: 'white' },
       `Built page "${pageId}" in ${formatDuration(Date.now() - startTime)}.`
@@ -201,4 +233,85 @@ async function buildPageIfNeeded({ pageId, buildDirectory, configDirectory }) {
   }
 }
 
+// Collect every client _js hash the page references. jsMapParser reduces a _js
+// operator to either { _js: "<hash>" } or { _js: { fn: "<hash>", args } }, and
+// keeps args verbatim — so a _js nested inside another's args survives as its
+// own node and must be descended into, or its hash is dropped and the client
+// throws "_js function not found".
+function collectJsHashes(node, hashes) {
+  if (type.isArray(node)) {
+    for (const item of node) collectJsHashes(item, hashes);
+    return;
+  }
+  if (!type.isObject(node)) return;
+  if (Object.prototype.hasOwnProperty.call(node, '_js')) {
+    const inner = node._js;
+    if (type.isString(inner)) {
+      hashes.add(inner);
+      return;
+    }
+    if (type.isObject(inner) && type.isString(inner.fn)) {
+      hashes.add(inner.fn);
+      collectJsHashes(inner.args, hashes);
+      return;
+    }
+    return;
+  }
+  for (const value of Object.values(node)) collectJsHashes(value, hashes);
+}
+
+// Icons are discovered by detectMissingIcons on the pre-parse page, so a name
+// appearing only inside a _js body is real but is a hash in the served config.
+// Reproduce that surface: scan the served config plus the page's own client _js
+// source strings, and keep only names present in dynamicIconData (which holds
+// only JIT-discovered icons — static ones are already in the client bundle).
+function scopeDynamicIcons({ pageConfig, scopedJsMap, dynamicIconData }) {
+  if (Object.keys(dynamicIconData).length === 0) return undefined;
+  const scanText = [JSON.stringify(pageConfig), ...Object.values(scopedJsMap)].join('\n');
+  const found = {};
+  for (const regex of Object.values(iconPackages)) {
+    for (const match of scanText.matchAll(regex)) {
+      const name = match[1];
+      if (dynamicIconData[name] && !found[name]) {
+        found[name] = dynamicIconData[name];
+      }
+    }
+  }
+  return Object.keys(found).length > 0 ? found : undefined;
+}
+
+// Scope this page's JIT-discovered enrichment out of the persistent build
+// context so jitPageHandler can fold it into the page-config response the client
+// already awaits — removing the two secondary fetches that stalled first paint.
+// buildContext defaults to the module-private cachedBuildContext (re-read on
+// every call, so it tracks invalidation resets); tests pass a stub.
+export function getPageJitEnrichment({ pageConfig, buildContext = cachedBuildContext }) {
+  // No build context (before the first build, or after an invalidation reset)
+  // means nothing JIT-discovered to fold — the page serves what the static
+  // client bundle already carries.
+  if (!buildContext) return {};
+
+  const clientJsMap = buildContext.jsMap.client ?? {};
+  const hashes = new Set();
+  collectJsHashes(pageConfig, hashes);
+
+  const scopedJsMap = {};
+  for (const hash of hashes) {
+    if (Object.prototype.hasOwnProperty.call(clientJsMap, hash)) {
+      scopedJsMap[hash] = clientJsMap[hash];
+    }
+  }
+
+  const jsEntries =
+    Object.keys(scopedJsMap).length > 0 ? generateClientJsModule(scopedJsMap) : undefined;
+
+  const dynamicIcons = scopeDynamicIcons({
+    pageConfig,
+    scopedJsMap,
+    dynamicIconData: buildContext.dynamicIconData ?? {},
+  });
+
+  return { jsEntries, dynamicIcons };
+}
+
 export default buildPageIfNeeded;

package/lib/server/log/createHandleError.test.mjs

@@ -0,0 +1,126 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+import { ConfigError, LowdefyInternalError } from '@lowdefy/errors';
+
+import createHandleError from './createHandleError.js';
+
+// This sink is the sole writer of `error.handled`. Two callers read the flag and
+// neither can set it for itself: runRoutine's catch guards on `!error.handled` to
+// avoid logging a nested error twice, and the browser's handleError skips the
+// round-trip to /api/client-error when it is set. runRoutine deliberately gave up
+// its own assignment on the strength of this function, so the tests below pin the
+// assignment and — more importantly — its position ahead of everything that can
+// throw.
+
+const keyMap = { key_1: { key: 'root.pages[0:home]', '~r': 'ref_1', '~l': 5 } };
+const refMap = { ref_1: { path: 'pages/home.yaml' } };
+
+function testContext({ logger, readConfigFile, configDirectory } = {}) {
+  return {
+    configDirectory,
+    logger: logger ?? { error: jest.fn() },
+    readConfigFile:
+      readConfigFile ??
+      jest.fn(async (path) => {
+        if (path === 'keyMap.json') return keyMap;
+        if (path === 'refMap.json') return refMap;
+        return null;
+      }),
+  };
+}
+
+beforeEach(() => {
+  console.error = jest.fn();
+});
+
+test('handleError marks the error handled and resolves its location', async () => {
+  const context = testContext();
+  const handleError = createHandleError({ context });
+  const error = new ConfigError('Bad config.', { configKey: 'key_1' });
+
+  await handleError(error);
+
+  expect(error.handled).toBe(true);
+  expect(error.source).toBe('pages/home.yaml:5');
+  expect(error.config).toBe('root.pages[0:home]');
+  expect(context.logger.error).toHaveBeenCalledWith(error);
+});
+
+test('handleError marks a LowdefyInternalError handled even though it never gets a source', async () => {
+  // The Decision 7 case. Location resolution is deliberately skipped for an
+  // internal error, so `source` stays undefined - which is why the client's
+  // already-logged gate reads `handled` and not `source`. Keyed on source, this
+  // error was POSTed back to /api/client-error and logged a second time.
+  const context = testContext();
+  const handleError = createHandleError({ context });
+  const error = new LowdefyInternalError('Unexpected condition.');
+
+  await handleError(error);
+
+  expect(error.handled).toBe(true);
+  expect(error.source).toBeUndefined();
+  expect(context.readConfigFile).not.toHaveBeenCalled();
+  expect(context.logger.error).toHaveBeenCalledWith(error);
+});
+
+test('handleError marks the error handled before it logs, so a throwing logger cannot skip the flag', async () => {
+  const logger = {
+    error: jest.fn(() => {
+      throw new Error('Log drain unreachable.');
+    }),
+  };
+  const context = testContext({ logger });
+  const handleError = createHandleError({ context });
+  const error = new ConfigError('Bad config.', { configKey: 'key_1' });
+
+  await handleError(error);
+
+  // The sink swallows its own failure - reaching it is what makes the error
+  // already-logged, so the flag must survive the log call failing. Were it set
+  // after the log, this error would cross the wire unflagged and be logged a
+  // second time from the browser.
+  expect(error.handled).toBe(true);
+  expect(logger.error).toHaveBeenCalled();
+  expect(console.error).toHaveBeenCalled();
+});
+
+test('handleError marks the error handled when location resolution rejects', async () => {
+  const readConfigFile = jest.fn(async () => {
+    throw new Error('keyMap.json unreadable.');
+  });
+  const context = testContext({ readConfigFile });
+  const handleError = createHandleError({ context });
+  const error = new ConfigError('Bad config.', { configKey: 'key_1' });
+
+  await handleError(error);
+
+  expect(error.handled).toBe(true);
+  // ConfigError's constructor initialises source to null; resolution failing
+  // leaves it there rather than assigning.
+  expect(error.source).toBeNull();
+});
+
+test('handleError marks a plain Error handled', async () => {
+  const context = testContext();
+  const handleError = createHandleError({ context });
+  const error = new Error('Something broke.');
+
+  await handleError(error);
+
+  expect(error.handled).toBe(true);
+});

package/lib/server/log/createLogger.test.mjs

@@ -0,0 +1,62 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+import { createNodeLogger } from '@lowdefy/logger/node';
+import { serializer } from '@lowdefy/helpers';
+
+const secret = 'planted-dev-secret-value';
+
+const lines = [];
+const destination = {
+  write(line) {
+    lines.push(line);
+  },
+};
+
+// The CLI's dev terminal is parsed from this logger's output, so it must keep the full default
+// serialization; route the real logger to memory to read the exact emitted line.
+jest.unstable_mockModule('@lowdefy/logger/node', () => ({
+  createNodeLogger: (options) => createNodeLogger({ ...options, destination }),
+}));
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+
+const { default: createLogger } = await import('./createLogger.js');
+
+function createAxiosError() {
+  const error = new Error(`Request failed for key ${secret}`);
+  error.name = 'AxiosError';
+  error.code = 'ERR_BAD_REQUEST';
+  error.config = {
+    auth: { username: 'svc-user', password: 'planted-config-password' },
+    params: { api_key: 'planted-config-param' },
+    headers: { Authorization: 'Bearer planted-config-header' },
+  };
+  return error;
+}
+
+test('dev logger writes an axios error with full default serialization and no scrub', () => {
+  const error = createAxiosError();
+  createLogger().error({ err: error }, error.message);
+  expect(lines).toHaveLength(1);
+  const { err, msg } = JSON.parse(lines[0]);
+  expect(err).toEqual(JSON.parse(JSON.stringify(serializer.serialize(error)['~e'])));
+  expect(err.config.auth.password).toBe('planted-config-password');
+  expect(err.config.params.api_key).toBe('planted-config-param');
+  expect(err.config.headers.Authorization).toBe('Bearer planted-config-header');
+  expect(msg).toBe(`Request failed for key ${secret}`);
+});

package/lib/server/scrubSecrets.js

@@ -0,0 +1,23 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { createSecretScrubber, getSecretsFromEnv } from '@lowdefy/node-utils';
+
+// Dev logs stay unscrubbed, but _error reads this off the context like every
+// other server package, so a thrown message behaves identically in every mode.
+const scrubSecrets = createSecretScrubber({ secrets: getSecretsFromEnv() });
+
+export default scrubSecrets;

package/manager/getContext.mjs

@@ -22,18 +22,16 @@ import { hideBin } from 'yargs/helpers';
 import pino from 'pino';
 import { createNodeLogger } from '@lowdefy/logger/node';
 import checkMockUserWarning from './processes/checkMockUserWarning.mjs';
-import compileCss from './processes/compileCss.mjs';
 import initialBuild from './processes/initialBuild.mjs';
 import installPlugins from './processes/installPlugins.mjs';
 import lowdefyBuild from './processes/lowdefyBuild.mjs';
-import nextBuild from './processes/nextBuild.mjs';
 import readDotEnv from './processes/readDotEnv.mjs';
 import reloadClients from './processes/reloadClients.mjs';
 import restartServer from './processes/restartServer.mjs';
 import shutdownServer from './processes/shutdownServer.mjs';
 import startWatchers from './processes/startWatchers.mjs';
 
-import getNextBin from './utils/getNextBin.mjs';
+import getViteBin from './utils/getViteBin.mjs';
 
 const argv = yargs(hideBin(process.argv)).array('watch').array('watchIgnore').argv;
 
@@ -42,7 +40,7 @@ async function getContext() {
 
   const context = {
     bin: {
-      next: getNextBin(),
+      vite: getViteBin(),
     },
     directories: {
       build: path.resolve(process.cwd(), './build'),
@@ -56,7 +54,7 @@ async function getContext() {
       destination: pino.destination({ dest: 1, sync: true }),
     }),
     options: {
-      port: argv.port ?? env.PORT ?? 3000,
+      port: Number(argv.port ?? env.PORT ?? 3000),
       refResolver: argv.refResolver ?? env.LOWDEFY_BUILD_REF_RESOLVER,
       watch:
         argv.watch ?? env.LOWDEFY_SERVER_DEV_WATCH ? JSON.parse(env.LOWDEFY_SERVER_DEV_WATCH) : [],
@@ -87,8 +85,6 @@ async function getContext() {
     }
   };
 
-  context.compileCss = compileCss(context);
-  context.nextBuild = nextBuild(context);
   context.readDotEnv = readDotEnv(context);
   context.reloadClients = reloadClients(context);
   context.restartServer = restartServer(context);