@lowdefy/server-dev 6.1.0 → 7.0.0

package/client/recorder/diffStateWrites.js

@@ -0,0 +1,77 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+import jsonType from './jsonType.js';
+import toJsonSafe from './toJsonSafe.js';
+
+// Objects are walked to their leaves so a write to one field of a form object
+// reports that field's path; arrays are leaves, because a journey expectation
+// on "rows.3.name" locks an ordering the app never promised.
+// `seen` closes the cycle: page state is app data and an app is free to put a
+// self-referencing object in it, which the walk would otherwise follow forever.
+function collectLeaves({ into, path, seen = new WeakSet(), value }) {
+  if (type.isObject(value) && Object.keys(value).length > 0 && !seen.has(value)) {
+    seen.add(value);
+    Object.keys(value).forEach((key) => {
+      collectLeaves({ into, path: path === '' ? key : `${path}.${key}`, seen, value: value[key] });
+    });
+    return into;
+  }
+  into.set(path, value);
+  return into;
+}
+
+function isSameValue(a, b) {
+  if (type.isDate(a) && type.isDate(b)) {
+    return a.getTime() === b.getTime();
+  }
+  try {
+    return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+  } catch {
+    // A value that cannot be serialized cannot be compared; report it as written.
+    return false;
+  }
+}
+
+// The paths an action chain wrote, as the difference between the state before
+// the chain ran and the state after. `values` is the dev-only branch: in
+// production the recorder never asks for it, so a value cannot reach the wire.
+function diffStateWrites({ after, before, values = false }) {
+  const beforeLeaves = collectLeaves({ into: new Map(), path: '', value: before ?? {} });
+  const afterLeaves = collectLeaves({ into: new Map(), path: '', value: after ?? {} });
+  const writes = [];
+
+  afterLeaves.forEach((value, path) => {
+    if (path === '') return;
+    if (beforeLeaves.has(path) && isSameValue(beforeLeaves.get(path), value)) return;
+    writes.push(
+      values
+        ? { path, type: jsonType(value), value: toJsonSafe(value) }
+        : { path, type: jsonType(value) }
+    );
+  });
+
+  beforeLeaves.forEach((_, path) => {
+    if (path === '' || afterLeaves.has(path)) return;
+    writes.push({ path, type: 'undefined' });
+  });
+
+  return writes;
+}
+
+export default diffStateWrites;

package/client/recorder/diffStateWrites.test.mjs

@@ -0,0 +1,66 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import diffStateWrites from './diffStateWrites.js';
+
+test('diffStateWrites reports the path and JSON type of each changed leaf', () => {
+  expect(diffStateWrites({ after: { a: 'x', n: 2, ok: true }, before: { a: 'x', n: 1 } })).toEqual([
+    { path: 'n', type: 'number' },
+    { path: 'ok', type: 'boolean' },
+  ]);
+});
+
+test('diffStateWrites walks into objects and treats arrays as leaves', () => {
+  expect(diffStateWrites({ after: { form: { name: 'a' }, rows: [1, 2] }, before: {} })).toEqual([
+    { path: 'form.name', type: 'string' },
+    { path: 'rows', type: 'array' },
+  ]);
+});
+
+test('diffStateWrites reports a removed path as undefined', () => {
+  expect(diffStateWrites({ after: {}, before: { a: 1 } })).toEqual([
+    { path: 'a', type: 'undefined' },
+  ]);
+});
+
+test('diffStateWrites omits values unless values is true', () => {
+  expect(diffStateWrites({ after: { a: 'secret' }, before: {} })).toEqual([
+    { path: 'a', type: 'string' },
+  ]);
+  expect(diffStateWrites({ after: { a: 'secret' }, before: {}, values: true })).toEqual([
+    { path: 'a', type: 'string', value: 'secret' },
+  ]);
+});
+
+test('diffStateWrites names a Date write as a date and does not throw on a cyclic value', () => {
+  const cyclic = {};
+  cyclic.self = cyclic;
+  const writes = diffStateWrites({
+    after: { when: new Date('2026-01-02T03:04:05.000Z'), loop: cyclic },
+    before: {},
+    values: true,
+  });
+  expect(writes).toContainEqual({
+    path: 'when',
+    type: 'date',
+    value: '2026-01-02T03:04:05.000Z',
+  });
+  expect(writes.find(({ path }) => path === 'loop.self')).toEqual({
+    path: 'loop.self',
+    type: 'object',
+    value: null,
+  });
+});

package/client/recorder/isEventCall.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+// Whether the newest call of a request or endpoint was made by this event.
+// Action ids are config ids, not unique across blocks or runs, so an id in
+// the event's responses is not enough: the call must come from the event's
+// own block, and from an action this run did not skip (a skipped action keeps
+// its response entry while the call history still holds an earlier run's).
+function isEventCall({ blockId, call, responses }) {
+  if (type.isNone(call) || type.isNone(call.actionId)) return false;
+  if (call.blockId !== blockId || !(call.actionId in responses)) return false;
+  return responses[call.actionId]?.skipped !== true;
+}
+
+export default isEventCall;

package/client/recorder/jsonType.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+// The JSON type name a trace event carries for a written state value. Dates are
+// named as dates rather than collapsed into "object": the engine keeps real Date
+// objects in state, and a journey expectation compiled from the trace has to know
+// it is comparing a date, not a bag of fields.
+function jsonType(value) {
+  if (type.isNone(value)) {
+    return value === null ? 'null' : 'undefined';
+  }
+  if (type.isArray(value)) {
+    return 'array';
+  }
+  if (type.isDate(value)) {
+    return 'date';
+  }
+  if (type.isObject(value)) {
+    return 'object';
+  }
+  return typeof value;
+}
+
+export default jsonType;

package/client/recorder/keyChord.js

@@ -0,0 +1,47 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+const MODIFIER_KEYS = ['Control', 'Meta', 'Alt', 'Shift', 'AltGraph', 'CapsLock'];
+const PLAIN_KEYS = ['Enter', 'Escape'];
+
+function keyName(key) {
+  return key.length === 1 ? key.toLowerCase() : key;
+}
+
+// A keydown as a chord in the journey runner's press syntax, or null when it
+// is typing (captured as input instead). Enter and Escape are recorded alone;
+// any other key only when held with Ctrl, Meta or Alt. The platform modifier
+// (Meta on macOS, Ctrl elsewhere) is written Mod, so a chord replays on
+// either.
+function keyChord(event, { platform }) {
+  const { key } = event;
+  if (typeof key !== 'string' || key === '' || MODIFIER_KEYS.includes(key)) return null;
+  const mac = /mac/i.test(platform ?? '');
+  const platformHeld = mac ? event.metaKey : event.ctrlKey;
+  const otherHeld = mac ? event.ctrlKey : event.metaKey;
+  if (!platformHeld && !otherHeld && !event.altKey) {
+    return PLAIN_KEYS.includes(key) ? key : null;
+  }
+  const parts = [];
+  if (platformHeld) parts.push('Mod');
+  if (otherHeld) parts.push(mac ? 'Control' : 'Meta');
+  if (event.altKey) parts.push('Alt');
+  if (event.shiftKey) parts.push('Shift');
+  parts.push(keyName(key));
+  return parts.join('+');
+}
+
+export default keyChord;

package/client/recorder/keyChord.test.mjs

@@ -0,0 +1,50 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import keyChord from './keyChord.js';
+
+function key(init) {
+  return { ctrlKey: false, metaKey: false, altKey: false, shiftKey: false, ...init };
+}
+
+test('keyChord records Mod+k for Meta on macOS and for Ctrl elsewhere', () => {
+  expect(keyChord(key({ key: 'k', metaKey: true }), { platform: 'MacIntel' })).toBe('Mod+k');
+  expect(keyChord(key({ key: 'k', ctrlKey: true }), { platform: 'Win32' })).toBe('Mod+k');
+  expect(keyChord(key({ key: 'k', ctrlKey: true }), { platform: 'Linux x86_64' })).toBe('Mod+k');
+});
+
+test('keyChord writes the other platform modifier by name', () => {
+  expect(keyChord(key({ key: 'k', ctrlKey: true }), { platform: 'MacIntel' })).toBe('Control+k');
+  expect(keyChord(key({ key: 'k', metaKey: true }), { platform: 'Win32' })).toBe('Meta+k');
+});
+
+test('keyChord records Enter and Escape alone, and Alt and Shift chords', () => {
+  expect(keyChord(key({ key: 'Enter' }), { platform: 'Win32' })).toBe('Enter');
+  expect(keyChord(key({ key: 'Escape' }), { platform: 'Win32' })).toBe('Escape');
+  expect(keyChord(key({ key: 'K', ctrlKey: true, shiftKey: true }), { platform: 'Win32' })).toBe(
+    'Mod+Shift+k'
+  );
+  expect(keyChord(key({ key: 'ArrowDown', altKey: true }), { platform: 'Win32' })).toBe(
+    'Alt+ArrowDown'
+  );
+});
+
+test('keyChord returns null for typing and for a modifier pressed alone', () => {
+  expect(keyChord(key({ key: 'a' }), { platform: 'Win32' })).toBe(null);
+  expect(keyChord(key({ key: 'A', shiftKey: true }), { platform: 'Win32' })).toBe(null);
+  expect(keyChord(key({ key: 'Meta', metaKey: true }), { platform: 'MacIntel' })).toBe(null);
+  expect(keyChord(key({ key: 'Tab' }), { platform: 'Win32' })).toBe(null);
+});

package/client/recorder/sendRecords.js

@@ -0,0 +1,40 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import chunkRecords from './chunkRecords.js';
+
+// One same-origin POST per chunk. keepalive lets a send started on pagehide
+// finish after the tab is gone, as a beacon would, with one code path. A
+// failed send is dropped: recording must never get in the developer's way.
+async function sendRecords({ basePath, records, fetch }) {
+  const chunks = chunkRecords({ records });
+  await Promise.all(
+    chunks.map(async (chunk) => {
+      try {
+        await fetch(`${basePath}/api/dev-recording`, {
+          method: 'POST',
+          keepalive: true,
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(chunk),
+        });
+      } catch {
+        // Dropped silently.
+      }
+    })
+  );
+}
+
+export default sendRecords;

package/client/recorder/toJsonSafe.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Dev traces carry real values, and a value is whatever a block handed the
+// event: a Date, a DOM node, a structure with a cycle in it. The batch is
+// JSON, so a value that cannot be JSON is recorded as null rather than
+// throwing away the batch it travels in.
+function toJsonSafe(value) {
+  try {
+    return JSON.parse(JSON.stringify(value ?? null));
+  } catch {
+    return null;
+  }
+}
+
+export default toJsonSafe;

package/lib/client/BuildingPage.jsx

@@ -16,6 +16,8 @@
 
 import React from 'react';
 
+import getCspNonce from './getCspNonce.js';
+
 const BuildingPage = () => {
   return (
     <div
@@ -32,7 +34,7 @@ const BuildingPage = () => {
           "system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif",
       }}
     >
-      <style>
+      <style nonce={getCspNonce()}>
         {`
           @keyframes building-progress {
             0% { transform: translateX(-100%); }

package/lib/client/ErrorBar.jsx

@@ -16,15 +16,17 @@
 
 import React, { useCallback, useState } from 'react';
 
+import formatErrorsForCopy from './utils/formatErrorsForCopy.js';
+import getErrorBarColor from './utils/getErrorBarColor.js';
+
 function getBarStyle(errors) {
-  const hasError = errors.some((e) => e.type !== 'ConfigWarning');
   return {
     position: 'fixed',
     bottom: 0,
     left: 0,
     right: 0,
     height: 28,
-    backgroundColor: hasError ? '#cf1322' : '#d48806',
+    backgroundColor: getErrorBarColor(errors),
     color: '#fff',
     display: 'flex',
     alignItems: 'center',
@@ -38,17 +40,6 @@ function getBarStyle(errors) {
   };
 }
 
-function formatErrorsForCopy(errors) {
-  return errors
-    .map((e) => {
-      let text = `[${e.type}] ${e.message}`;
-      if (e.source) text += `\n  Source: ${e.source}`;
-      if (e.stack) text += `\n${e.stack}`;
-      return text;
-    })
-    .join('\n\n');
-}
-
 function CopyIcon() {
   return (
     <svg
@@ -112,6 +103,19 @@ const ErrorBar = ({ errors }) => {
         }}
       >
         <span style={{ opacity: 0.8 }}>{latest.type}: </span>
+        {latest.prodError === true && (
+          <span
+            style={{
+              backgroundColor: 'rgba(255,255,255,0.25)',
+              borderRadius: 8,
+              padding: '1px 7px',
+              fontSize: 11,
+              marginRight: 6,
+            }}
+          >
+            fails in prod
+          </span>
+        )}
         <span>{latest.message}</span>
         {latest.source && <span style={{ opacity: 0.7, marginLeft: 8 }}>{latest.source}</span>}
       </div>

package/lib/client/RedirectingPage.jsx

@@ -0,0 +1,56 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import React from 'react';
+
+// Shown while the 401 sign-in redirect navigates. The link is the escape
+// hatch for a dropped navigation - the tab must never depend on a single
+// window.location.assign to leave this screen.
+const RedirectingPage = ({ redirect }) => {
+  return (
+    <div
+      style={{
+        height: '100vh',
+        textAlign: 'center',
+        display: 'flex',
+        flexDirection: 'column',
+        alignItems: 'center',
+        justifyContent: 'center',
+        backgroundColor: 'var(--ant-color-bg-layout)',
+        color: 'var(--ant-color-text)',
+        fontFamily:
+          "system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif",
+      }}
+    >
+      <div
+        style={{
+          verticalAlign: 'middle',
+          display: 'inline-block',
+        }}
+      >
+        <h3>Redirecting to sign-in...</h3>
+        <p>
+          <a href={redirect} style={{ color: 'var(--ant-color-primary)' }}>
+            Continue to sign-in
+          </a>{' '}
+          if you are not redirected automatically.
+        </p>
+      </div>
+    </div>
+  );
+};
+
+export default RedirectingPage;

package/lib/client/auth/Auth.jsx

@@ -14,8 +14,6 @@
   limitations under the License.
 */
 
-/* eslint-disable react/jsx-props-no-spreading */
-
 import React from 'react';
 import AuthConfigured from './AuthConfigured.jsx';
 import AuthNotConfigured from './AuthNotConfigured.js';
@@ -25,20 +23,27 @@ import { serializer } from '@lowdefy/helpers';
 // Client code imports the build JSON directly — Vite handles JSON imports;
 // the lib/build/*.js wrappers are server-only (they read from disk).
 // Deserialize to restore arrays from their ~arr build markers (providers
-// must be a real array for single-provider inference in createAuthMethods).
+// must be a real array for provider lookups in createAuthMethods).
 import rawAuthConfig from '../../../build/auth.json';
 
 const authConfig = serializer.deserialize(rawAuthConfig);
 
-function Auth({ children, session }) {
+function Auth({ children, user }) {
   if (authConfig.configured === true) {
     return (
-      <AuthConfigured serverSession={session} authConfig={authConfig}>
+      <AuthConfigured serverUser={user} authConfig={authConfig}>
         {(auth) => children(auth)}
       </AuthConfigured>
     );
   }
-  return <AuthNotConfigured authConfig={authConfig}>{(auth) => children(auth)}</AuthNotConfigured>;
+  // An app whose only auth key is auth.dev has no auth stack, but the dev
+  // server still resolves a caller for auth.dev.mockUser - pass it through so
+  // _user reads the same identity in the browser as on the server.
+  return (
+    <AuthNotConfigured authConfig={authConfig} user={user}>
+      {(auth) => children(auth)}
+    </AuthNotConfigured>
+  );
 }
 
 export default Auth;