@lowdefy/server-dev 6.0.0 → 6.1.0

package/client/clientBuildImports.test.mjs

@@ -0,0 +1,61 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Everything the client imports from build/ ships in the browser bundle. build/config.json is
+// server-only: it carries every deployment environment's settings (other environments' urls,
+// secret names, email filters). The client learns only the current environment's name and
+// switched-off features, through appMeta. This allowlist fails the build of any new client import
+// of a build artifact until it has been checked for what it exposes.
+const allowed = new Set([
+  'auth.json',
+  'appMeta.json',
+  'logger.json',
+  'i18n/antdLocales.js',
+  'i18n/antdXLocales.js',
+  'i18n/dayjsLocales.js',
+  'plugins/actions.js',
+  'plugins/blockMetas.json',
+  'plugins/blocks.js',
+  'plugins/icons.js',
+  'plugins/operators/client.js',
+  'plugins/operators/clientJsMap.js',
+]);
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+function listSourceFiles(dir) {
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) return listSourceFiles(full);
+    return /\.(js|jsx|mjs)$/.test(entry.name) && !entry.name.includes('.test.') ? [full] : [];
+  });
+}
+
+test('client code imports only client-safe build artifacts', () => {
+  const imported = ['client', 'lib/client'].flatMap((dir) =>
+    listSourceFiles(path.join(root, dir)).flatMap((file) =>
+      [...fs.readFileSync(file, 'utf8').matchAll(/from '[^']*\/build\/([^']+)'/g)].map(
+        (match) => ({ file: path.relative(root, file), artifact: match[1] })
+      )
+    )
+  );
+  expect(imported.length).toBeGreaterThan(0);
+  expect(imported.filter(({ artifact }) => !allowed.has(artifact))).toEqual([]);
+});

package/lib/client/auth/AuthConfigured.jsx

@@ -26,16 +26,15 @@ import {
   useSession,
 } from '@hono/auth-js/react';
 
-import { serializer } from '@lowdefy/helpers';
-
-import rawLowdefyConfig from '../../../build/config.json';
-
-const lowdefyConfig = serializer.deserialize(rawLowdefyConfig);
+// The app basePath, from Vite's BASE_URL (`${config.basePath}/`, set in
+// vite.config.js). build/config.json is server-only - it carries every
+// deployment environment's settings - so it is never imported into the client.
+const basePath = import.meta.env.BASE_URL.replace(/\/$/, '');
 
 // @hono/auth-js/react configures its fetch paths through a module-level
 // manager instead of SessionProvider props.
-if (lowdefyConfig.basePath) {
-  authConfigManager.setConfig({ basePath: `${lowdefyConfig.basePath}/api/auth` });
+if (basePath) {
+  authConfigManager.setConfig({ basePath: `${basePath}/api/auth` });
 }
 
 function Session({ children }) {

package/lib/server/auth/getAuthConfig.js

@@ -20,6 +20,7 @@ import { getSecretsFromEnv } from '@lowdefy/node-utils';
 import adapters from '../../../build/plugins/auth/adapters.js';
 import appMeta from '../../build/appMeta.js';
 import authJson from '../../build/auth.js';
+import config from '../../build/config.js';
 import callbacks from '../../../build/plugins/auth/callbacks.js';
 import events from '../../../build/plugins/auth/events.js';
 import providers from '../../../build/plugins/auth/providers.js';
@@ -28,6 +29,7 @@ function getAuthConfig({ logger }) {
   return getApiAuthConfig({
     appMeta,
     authJson,
+    config,
     dev: true,
     logger,
     plugins: { adapters, callbacks, events, providers },

package/lib/server/createLowdefyContext.js

@@ -31,6 +31,7 @@ import getSession from './auth/session.js';
 import getStrategyCaller from './auth/strategies.js';
 import i18nConfig from '../build/i18n.js';
 import logRequest from './log/logRequest.js';
+import scrubSecrets from './scrubSecrets.js';
 import notifications, {
   interpolateProperties,
   renderEmail,
@@ -84,6 +85,9 @@ async function createLowdefyContext({ c }) {
     configDirectory: process.env.LOWDEFY_DIRECTORY_CONFIG || process.cwd(),
     config,
     connections,
+    // The dev server: environment-specific fallbacks that would be unsafe in
+    // production (a request-derived notification link origin) are allowed.
+    dev: true,
     fileCache,
     headers: c.req.header(),
     // The deployment's own origin — detached endpoint calls loop back
@@ -93,6 +97,7 @@ async function createLowdefyContext({ c }) {
     interpolateProperties,
     jsMap,
     logger: createLogger(),
+    mode: 'dev',
     notifications,
     operators,
     renderEmail,
@@ -101,6 +106,7 @@ async function createLowdefyContext({ c }) {
       method: c.req.method,
       hostname: c.req.header('host'),
     },
+    scrubSecrets,
     secrets,
     websockets,
   };

package/lib/server/createLowdefyContext.test.mjs

@@ -0,0 +1,117 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+import { jest } from '@jest/globals';
+import { projectCaughtError } from '@lowdefy/helpers';
+import { operatorsServer } from '@lowdefy/operators-js';
+
+const secret = 'planted-dev-secret';
+process.env.LOWDEFY_SECRET_TEST = secret;
+
+jest.unstable_mockModule('@lowdefy/api', () => ({ createApiContext: jest.fn() }));
+jest.unstable_mockModule('../build/appMeta.js', () => ({ default: {} }));
+jest.unstable_mockModule('../build/config.js', () => ({ default: {} }));
+jest.unstable_mockModule('../build/i18n.js', () => ({ default: {} }));
+jest.unstable_mockModule('./log/createHandleError.js', () => ({
+  default: jest.fn(() => jest.fn()),
+}));
+jest.unstable_mockModule('./log/createLogger.js', () => ({
+  default: jest.fn(() => ({ debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() })),
+}));
+jest.unstable_mockModule('./fileCache.js', () => ({ default: {} }));
+jest.unstable_mockModule('./auth/session.js', () => ({ default: jest.fn(async () => undefined) }));
+jest.unstable_mockModule('./auth/strategies.js', () => ({ default: jest.fn(async () => null) }));
+jest.unstable_mockModule('./log/logRequest.js', () => ({ default: jest.fn() }));
+
+// createLowdefyContext statically imports the app build's plugin artifacts,
+// which only exist in a built app (build/** is gitignored). Materialize the
+// minimal set it needs — same fixture strategy as auth/getDevSession.test.mjs
+// — so the import resolves; clean up only what this test created.
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const pluginsDir = path.resolve(dirname, '../../build/plugins');
+const fixtures = [
+  { file: 'agents.js', content: 'export default {};\n' },
+  { file: 'connections.js', content: 'export default {};\n' },
+  {
+    file: 'notifications.js',
+    content: 'export default {};\nexport const interpolateProperties = () => {};\nexport const renderEmail = () => {};\n',
+  },
+  { file: path.join('operators', 'server.js'), content: 'export default {};\n' },
+  { file: path.join('operators', 'serverJsMap.js'), content: 'export default {};\n' },
+  { file: 'websockets.js', content: 'export default {};\n' },
+].map(({ file, content }) => ({ absolutePath: path.join(pluginsDir, file), content }));
+
+const createdFixtures = [];
+fixtures.forEach(({ absolutePath, content }) => {
+  if (!fs.existsSync(absolutePath)) {
+    fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+    fs.writeFileSync(absolutePath, content);
+    createdFixtures.push(absolutePath);
+  }
+});
+
+// A checkout that has built an app already holds real artifacts here, which import plugins this
+// package does not depend on, so the stubs are also mocked over whatever is on disk.
+fixtures.forEach(({ absolutePath }) => {
+  jest.unstable_mockModule(absolutePath, () => ({
+    default: {},
+    interpolateProperties: () => {},
+    renderEmail: () => {},
+  }));
+});
+
+afterAll(() => {
+  createdFixtures.forEach((absolutePath) => fs.rmSync(absolutePath, { force: true }));
+});
+
+const { default: createLowdefyContext } = await import('./createLowdefyContext.js');
+
+function createHonoContext({ path: reqPath = '/api/request/foo' } = {}) {
+  return {
+    req: {
+      header: (name) => (name ? undefined : {}),
+      path: reqPath,
+      method: 'POST',
+      url: `http://localhost${reqPath}`,
+    },
+  };
+}
+
+test('createLowdefyContext sets mode to dev', async () => {
+  const context = await createLowdefyContext({ c: createHonoContext() });
+  expect(context.mode).toEqual('dev');
+});
+
+test('createLowdefyContext scrubSecrets redacts a planted secret', async () => {
+  const context = await createLowdefyContext({ c: createHonoContext() });
+  expect(context.scrubSecrets(`token ${secret} end`)).toEqual('token [REDACTED] end');
+});
+
+// controlTry builds the value `_error` reads from context.scrubSecrets, so a dev context has to
+// scrub a caught message the same way the production server does.
+test('_error on a dev context reads a caught message with a planted secret scrubbed', async () => {
+  const context = await createLowdefyContext({ c: createHonoContext() });
+  const error = projectCaughtError(new Error(`Connect failed with ${secret}.`), {
+    scrub: context.scrubSecrets,
+  });
+  expect(operatorsServer._error({ error, location: 'test', params: 'message' })).toEqual(
+    'Connect failed with [REDACTED].'
+  );
+});

package/lib/server/log/createLogger.test.mjs

@@ -0,0 +1,62 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+import { createNodeLogger } from '@lowdefy/logger/node';
+import { serializer } from '@lowdefy/helpers';
+
+const secret = 'planted-dev-secret-value';
+
+const lines = [];
+const destination = {
+  write(line) {
+    lines.push(line);
+  },
+};
+
+// The CLI's dev terminal is parsed from this logger's output, so it must keep the full default
+// serialization; route the real logger to memory to read the exact emitted line.
+jest.unstable_mockModule('@lowdefy/logger/node', () => ({
+  createNodeLogger: (options) => createNodeLogger({ ...options, destination }),
+}));
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+
+const { default: createLogger } = await import('./createLogger.js');
+
+function createAxiosError() {
+  const error = new Error(`Request failed for key ${secret}`);
+  error.name = 'AxiosError';
+  error.code = 'ERR_BAD_REQUEST';
+  error.config = {
+    auth: { username: 'svc-user', password: 'planted-config-password' },
+    params: { api_key: 'planted-config-param' },
+    headers: { Authorization: 'Bearer planted-config-header' },
+  };
+  return error;
+}
+
+test('dev logger writes an axios error with full default serialization and no scrub', () => {
+  const error = createAxiosError();
+  createLogger().error({ err: error }, error.message);
+  expect(lines).toHaveLength(1);
+  const { err, msg } = JSON.parse(lines[0]);
+  expect(err).toEqual(JSON.parse(JSON.stringify(serializer.serialize(error)['~e'])));
+  expect(err.config.auth.password).toBe('planted-config-password');
+  expect(err.config.params.api_key).toBe('planted-config-param');
+  expect(err.config.headers.Authorization).toBe('Bearer planted-config-header');
+  expect(msg).toBe(`Request failed for key ${secret}`);
+});

package/lib/server/scrubSecrets.js

@@ -0,0 +1,23 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { createSecretScrubber, getSecretsFromEnv } from '@lowdefy/node-utils';
+
+// Dev logs stay unscrubbed, but _error reads this off the context like every
+// other server package, so a thrown message behaves identically in every mode.
+const scrubSecrets = createSecretScrubber({ secrets: getSecretsFromEnv() });
+
+export default scrubSecrets;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server-dev",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -40,42 +40,42 @@
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
-    "@auth/core": "0.41.2",
+    "@auth/core": "0.41.3",
     "@hono/auth-js": "1.1.1",
     "@hono/mcp": "0.3.0",
-    "@hono/node-server": "2.0.4",
+    "@hono/node-server": "2.0.10",
     "@hono/vite-dev-server": "0.26.0",
-    "@lowdefy/actions-core": "6.0.0",
-    "@lowdefy/api": "6.0.0",
-    "@lowdefy/block-utils": "6.0.0",
-    "@lowdefy/blocks-aggrid": "6.0.0",
-    "@lowdefy/blocks-antd": "6.0.0",
-    "@lowdefy/blocks-antd-x": "6.0.0",
-    "@lowdefy/blocks-basic": "6.0.0",
-    "@lowdefy/blocks-echarts": "6.0.0",
-    "@lowdefy/blocks-loaders": "6.0.0",
-    "@lowdefy/blocks-markdown": "6.0.0",
-    "@lowdefy/blocks-tiptap": "6.0.0",
-    "@lowdefy/build": "6.0.0",
-    "@lowdefy/client": "6.0.0",
-    "@lowdefy/connection-axios-http": "6.0.0",
-    "@lowdefy/docs-content": "6.0.0",
-    "@lowdefy/engine": "6.0.0",
-    "@lowdefy/errors": "6.0.0",
-    "@lowdefy/helpers": "6.0.0",
-    "@lowdefy/layout": "6.0.0",
-    "@lowdefy/logger": "6.0.0",
-    "@lowdefy/node-utils": "6.0.0",
-    "@lowdefy/operators-change-case": "6.0.0",
-    "@lowdefy/operators-dayjs": "6.0.0",
-    "@lowdefy/operators-diff": "6.0.0",
-    "@lowdefy/operators-js": "6.0.0",
-    "@lowdefy/operators-mql": "6.0.0",
-    "@lowdefy/operators-nunjucks": "6.0.0",
-    "@lowdefy/operators-uuid": "6.0.0",
-    "@lowdefy/operators-yaml": "6.0.0",
-    "@lowdefy/plugin-next-auth": "6.0.0",
-    "@lowdefy/websockets-core": "6.0.0",
+    "@lowdefy/actions-core": "6.1.0",
+    "@lowdefy/api": "6.1.0",
+    "@lowdefy/block-utils": "6.1.0",
+    "@lowdefy/blocks-aggrid": "6.1.0",
+    "@lowdefy/blocks-antd": "6.1.0",
+    "@lowdefy/blocks-antd-x": "6.1.0",
+    "@lowdefy/blocks-basic": "6.1.0",
+    "@lowdefy/blocks-echarts": "6.1.0",
+    "@lowdefy/blocks-loaders": "6.1.0",
+    "@lowdefy/blocks-markdown": "6.1.0",
+    "@lowdefy/blocks-tiptap": "6.1.0",
+    "@lowdefy/build": "6.1.0",
+    "@lowdefy/client": "6.1.0",
+    "@lowdefy/connection-axios-http": "6.1.0",
+    "@lowdefy/docs-content": "6.1.0",
+    "@lowdefy/engine": "6.1.0",
+    "@lowdefy/errors": "6.1.0",
+    "@lowdefy/helpers": "6.1.0",
+    "@lowdefy/layout": "6.1.0",
+    "@lowdefy/logger": "6.1.0",
+    "@lowdefy/node-utils": "6.1.0",
+    "@lowdefy/operators-change-case": "6.1.0",
+    "@lowdefy/operators-dayjs": "6.1.0",
+    "@lowdefy/operators-diff": "6.1.0",
+    "@lowdefy/operators-js": "6.1.0",
+    "@lowdefy/operators-mql": "6.1.0",
+    "@lowdefy/operators-nunjucks": "6.1.0",
+    "@lowdefy/operators-uuid": "6.1.0",
+    "@lowdefy/operators-yaml": "6.1.0",
+    "@lowdefy/plugin-next-auth": "6.1.0",
+    "@lowdefy/websockets-core": "6.1.0",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@tailwindcss/postcss": "4.3.1",
     "@vitejs/plugin-react": "6.0.2",
@@ -83,12 +83,12 @@
     "chokidar": "3.5.3",
     "dayjs": "1.11.20",
     "dotenv": "16.3.1",
-    "hono": "4.12.25",
+    "hono": "4.13.5",
     "html-to-image": "1.11.13",
     "opener": "1.5.2",
     "pino": "10.3.1",
     "playwright-core": "1.59.1",
-    "postcss": "8.5.6",
+    "postcss": "8.5.23",
     "process": "0.11.10",
     "react": "18.2.0",
     "react-dom": "18.2.0",
@@ -98,14 +98,13 @@
     "tinykeys": "3.0.0",
     "uuid": "14.0.0",
     "vite": "8.0.16",
-    "ws": "8.18.0",
+    "ws": "8.21.0",
     "yaml": "2.9.0",
     "yargs": "18.0.0",
     "zod": "3.25.76"
   },
   "devDependencies": {
-    "jest": "28.1.3",
-    "webpack": "5.94.0"
+    "jest": "28.1.3"
   },
   "engines": {
     "node": ">=22"

package/package.original.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server-dev",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -46,42 +46,42 @@
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
-    "@auth/core": "0.41.2",
+    "@auth/core": "0.41.3",
     "@hono/auth-js": "1.1.1",
     "@hono/mcp": "0.3.0",
-    "@hono/node-server": "2.0.4",
+    "@hono/node-server": "2.0.10",
     "@hono/vite-dev-server": "0.26.0",
-    "@lowdefy/actions-core": "6.0.0",
-    "@lowdefy/api": "6.0.0",
-    "@lowdefy/block-utils": "6.0.0",
-    "@lowdefy/blocks-aggrid": "6.0.0",
-    "@lowdefy/blocks-antd": "6.0.0",
-    "@lowdefy/blocks-antd-x": "6.0.0",
-    "@lowdefy/blocks-basic": "6.0.0",
-    "@lowdefy/blocks-echarts": "6.0.0",
-    "@lowdefy/blocks-loaders": "6.0.0",
-    "@lowdefy/blocks-markdown": "6.0.0",
-    "@lowdefy/blocks-tiptap": "6.0.0",
-    "@lowdefy/build": "6.0.0",
-    "@lowdefy/client": "6.0.0",
-    "@lowdefy/connection-axios-http": "6.0.0",
-    "@lowdefy/docs-content": "6.0.0",
-    "@lowdefy/engine": "6.0.0",
-    "@lowdefy/errors": "6.0.0",
-    "@lowdefy/helpers": "6.0.0",
-    "@lowdefy/layout": "6.0.0",
-    "@lowdefy/logger": "6.0.0",
-    "@lowdefy/node-utils": "6.0.0",
-    "@lowdefy/operators-change-case": "6.0.0",
-    "@lowdefy/operators-dayjs": "6.0.0",
-    "@lowdefy/operators-diff": "6.0.0",
-    "@lowdefy/operators-js": "6.0.0",
-    "@lowdefy/operators-mql": "6.0.0",
-    "@lowdefy/operators-nunjucks": "6.0.0",
-    "@lowdefy/operators-uuid": "6.0.0",
-    "@lowdefy/operators-yaml": "6.0.0",
-    "@lowdefy/plugin-next-auth": "6.0.0",
-    "@lowdefy/websockets-core": "6.0.0",
+    "@lowdefy/actions-core": "6.1.0",
+    "@lowdefy/api": "6.1.0",
+    "@lowdefy/block-utils": "6.1.0",
+    "@lowdefy/blocks-aggrid": "6.1.0",
+    "@lowdefy/blocks-antd": "6.1.0",
+    "@lowdefy/blocks-antd-x": "6.1.0",
+    "@lowdefy/blocks-basic": "6.1.0",
+    "@lowdefy/blocks-echarts": "6.1.0",
+    "@lowdefy/blocks-loaders": "6.1.0",
+    "@lowdefy/blocks-markdown": "6.1.0",
+    "@lowdefy/blocks-tiptap": "6.1.0",
+    "@lowdefy/build": "6.1.0",
+    "@lowdefy/client": "6.1.0",
+    "@lowdefy/connection-axios-http": "6.1.0",
+    "@lowdefy/docs-content": "6.1.0",
+    "@lowdefy/engine": "6.1.0",
+    "@lowdefy/errors": "6.1.0",
+    "@lowdefy/helpers": "6.1.0",
+    "@lowdefy/layout": "6.1.0",
+    "@lowdefy/logger": "6.1.0",
+    "@lowdefy/node-utils": "6.1.0",
+    "@lowdefy/operators-change-case": "6.1.0",
+    "@lowdefy/operators-dayjs": "6.1.0",
+    "@lowdefy/operators-diff": "6.1.0",
+    "@lowdefy/operators-js": "6.1.0",
+    "@lowdefy/operators-mql": "6.1.0",
+    "@lowdefy/operators-nunjucks": "6.1.0",
+    "@lowdefy/operators-uuid": "6.1.0",
+    "@lowdefy/operators-yaml": "6.1.0",
+    "@lowdefy/plugin-next-auth": "6.1.0",
+    "@lowdefy/websockets-core": "6.1.0",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@tailwindcss/postcss": "4.3.1",
     "@vitejs/plugin-react": "6.0.2",
@@ -89,12 +89,12 @@
     "chokidar": "3.5.3",
     "dayjs": "1.11.20",
     "dotenv": "16.3.1",
-    "hono": "4.12.25",
+    "hono": "4.13.5",
     "html-to-image": "1.11.13",
     "opener": "1.5.2",
     "pino": "10.3.1",
     "playwright-core": "1.59.1",
-    "postcss": "8.5.6",
+    "postcss": "8.5.23",
     "process": "0.11.10",
     "react": "18.2.0",
     "react-dom": "18.2.0",
@@ -104,14 +104,13 @@
     "tinykeys": "3.0.0",
     "uuid": "14.0.0",
     "vite": "8.0.16",
-    "ws": "8.18.0",
+    "ws": "8.21.0",
     "yaml": "2.9.0",
     "yargs": "18.0.0",
     "zod": "3.25.76"
   },
   "devDependencies": {
-    "jest": "28.1.3",
-    "webpack": "5.94.0"
+    "jest": "28.1.3"
   },
   "engines": {
     "node": ">=22"

package/src/middleware/errorHandler.test.mjs

@@ -114,8 +114,8 @@ test('errorHandler returns 500 with the serialized error envelope on an api path
   expect(res.status).toEqual(500);
   const body = await res.json();
   expect(body['~e'].name).toEqual('Error');
-  expect(body['~e'].message).toEqual('Top message.');
-  expect(body['~e'].cause.message).toEqual('Cause message.');
+  expect(body['~e'].message).toEqual('Something went wrong.');
+  expect(body['~e'].cause).toBeUndefined();
 });
 
 test('errorHandler omits stack and received from the 500 envelope at the top level', async () => {
@@ -129,19 +129,31 @@ test('errorHandler omits stack and received from the 500 envelope at the top lev
   expect(body['~e'].received).toBeUndefined();
 });
 
-// The regression test for the real bug: the four inline `delete` statements this
-// replaces only ever reached depth 0, so a `received` or `stack` on the cause
-// still crossed the wire. The policy is now applied at every error node.
-test('errorHandler omits stack and received from the 500 envelope on the cause at depth 1', async () => {
+test('errorHandler omits the cause chain from the 500 envelope', async () => {
   const res = await createApp({
     error: createErrorWithCause(),
     logger: createLogger(),
   }).request('/api/request/getUsers');
 
   const body = await res.json();
-  expect(body['~e'].cause.stack).toBeUndefined();
-  expect(body['~e'].cause.received).toBeUndefined();
+  expect(body['~e'].cause).toBeUndefined();
   expect(JSON.stringify(body)).not.toContain(SECRET);
+  expect(JSON.stringify(body)).not.toContain('Cause message.');
+});
+
+test('errorHandler adds devError with the full error to the 500 envelope in dev mode', async () => {
+  const context = { handleError: jest.fn(), mode: 'dev', rid: 'rid-1' };
+  const res = await createApp({
+    context,
+    error: createErrorWithCause(),
+    logger: createLogger(),
+  }).request('/api/request/getUsers');
+
+  const body = await res.json();
+  expect(body['~e'].message).toEqual('Something went wrong.');
+  expect(body.devError['~e'].message).toEqual('Top message.');
+  expect(body.devError['~e'].requestId).toEqual('rid-1');
+  expect(body.devError['~e'].cause.message).toEqual('Cause message.');
 });
 
 test('errorHandler keeps configKey on the 500 envelope so the fault can be located in config', async () => {
@@ -168,7 +180,7 @@ test('errorHandler awaits context.handleError before serializing the response',
   const context = {
     handleError: jest.fn(async (error) => {
       await new Promise((resolve) => setTimeout(resolve, 10));
-      error.awaited = true;
+      error.handled = true;
     }),
   };
   const error = createErrorWithCause();
@@ -179,7 +191,7 @@ test('errorHandler awaits context.handleError before serializing the response',
   expect(context.handleError).toHaveBeenCalledTimes(1);
   expect(context.handleError).toHaveBeenCalledWith(error);
   const body = await res.json();
-  expect(body['~e'].awaited).toBe(true);
+  expect(body['~e'].handled).toBe(true);
 });
 
 // createHandleError sets error.handled once it has logged. The client reads it
@@ -220,7 +232,7 @@ test('errorHandler treats a basePath prefixed api path as an api path', async ()
 
   expect(res.status).toEqual(500);
   const body = await res.json();
-  expect(body['~e'].message).toEqual('Top message.');
+  expect(body['~e'].message).toEqual('Something went wrong.');
 });
 
 test('errorHandler treats a basePath prefixed page path as a page path', async () => {

package/src/routes/cronForward.js

@@ -20,7 +20,7 @@ import getPathSegments from '../lib/getPathSegments.js';
 
 // Triggered by Vercel Cron on the production deployment: an HTTP GET to
 // /api/cron-forward/<environment>/<endpointId>, registered by `lowdefy vercel-output` for the
-// schedules of every environment declared with a url in config.cron.environments. Vercel fires crons
+// schedules of every environment declared with a cron.secret in config.environments. Vercel fires crons
 // only on production, so production pings that environment's own /api/cron/<endpointId> (with the
 // environment's CRON_SECRET) and answers immediately. Same transport auth as cron (CRON_SECRET,
 // fails closed).