@lowdefy/server-dev 6.1.0 → 7.0.0

package/lib/server/sinkExternalConnections.js

@@ -0,0 +1,95 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+// The loopback hosts the dev server's own mail capture listens on (LOWDEFY_DEV_SMTP_PORT).
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);
+
+// An SMTP request whose connection points at the dev server's mail capture is the one request of
+// an external type that is safe to run for real under a data session: nothing leaves the machine,
+// and the journey's `email` step reads what it captures.
+function isDevMailCapture({ connectionType, connection }) {
+  const port = process.env.LOWDEFY_DEV_SMTP_PORT;
+  if (connectionType !== 'SMTP' || type.isNone(port)) return false;
+  return LOOPBACK_HOSTS.has(connection?.host) && String(connection?.port) === String(port);
+}
+
+// What a sunk request carries: where it was aimed and what it asked for, never the connection's
+// properties, which hold its credentials. Request properties are evaluated app config and
+// payload; secrets are scrubbed.
+function describeSunkRequest({ context, args, connectionType }) {
+  const scrub = context.scrubSecrets ?? ((value) => value);
+  return {
+    connectionId: args.connectionId,
+    connectionType,
+    requestId: args.requestId,
+    pageId: args.pageId ?? null,
+    endpointId: args.endpointId ?? null,
+    request: type.isUndefined(args.request)
+      ? null
+      : JSON.parse(scrub(JSON.stringify(args.request))),
+  };
+}
+
+// The plugin connection map for a data session's requests. A connection type that declares
+// meta.dataSet 'external' reaches an outside service and keeps its real target, so under a data
+// session every one of its request resolvers is replaced by a sink. A single request type can
+// declare meta.dataSet 'external' on its resolver too, and only that resolver is replaced, which
+// suits a walled connection whose other request types read and write the walled database. A sunk
+// request is recorded on the session (session.sunk) and answers null, and nothing reaches the service. This is the one
+// place real mail and HTTP are stopped, in the process that would send them, so a branch a click
+// never takes, or an id an operator computes, cannot reach out either. It leaves the resolver's
+// schema and meta in place, so the request is still validated, read-checked and write-checked
+// as for real. Types with no request resolvers (an Mcp config container) have nothing to sink
+// and stay refused by the click rails. Returns a new map; the plugin map is never mutated.
+function sinkExternalConnections({ context, connections, session }) {
+  const sunk = {};
+  Object.entries(connections).forEach(([connectionType, definition]) => {
+    const requests = definition?.requests;
+    if (!type.isObject(requests)) {
+      sunk[connectionType] = definition;
+      return;
+    }
+    const connectionExternal = definition?.meta?.dataSet === 'external';
+    let anySunk = false;
+    const sunkRequests = {};
+    Object.entries(requests).forEach(([requestType, resolver]) => {
+      // A request type can declare meta.dataSet 'external' itself, so a walled connection that
+      // holds database access can still have request types that reach an outside service sunk.
+      if (!connectionExternal && resolver?.meta?.dataSet !== 'external') {
+        sunkRequests[requestType] = resolver;
+        return;
+      }
+      anySunk = true;
+      const sink = async (args) => {
+        if (isDevMailCapture({ connectionType, connection: args.connection })) {
+          return resolver(args);
+        }
+        session.sunk.push({
+          ...describeSunkRequest({ context, args, connectionType }),
+          requestType,
+        });
+        return null;
+      };
+      sunkRequests[requestType] = Object.assign(sink, resolver);
+    });
+    sunk[connectionType] = anySunk ? { ...definition, requests: sunkRequests } : definition;
+  });
+  return sunk;
+}
+
+export default sinkExternalConnections;

package/lib/server/sinkExternalConnections.test.mjs

@@ -0,0 +1,135 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+
+import sinkExternalConnections from './sinkExternalConnections.js';
+
+const realSend = jest.fn(async () => ({ sent: true }));
+realSend.schema = { type: 'object' };
+realSend.meta = { checkWrite: true };
+const realGather = jest.fn(async () => ({ downloaded: true }));
+realGather.schema = { type: 'object' };
+realGather.meta = { checkRead: true, dataSet: 'external' };
+const realRead = jest.fn(async () => ['doc']);
+realRead.meta = { checkRead: true };
+const realMongo = jest.fn(async () => ['row']);
+
+const connections = {
+  SMTP: { schema: {}, meta: { dataSet: 'external' }, requests: { SMTPMailSend: realSend } },
+  MongoDBCollection: { meta: { dataSet: 'redirect' }, requests: { MongoDBFind: realMongo } },
+  Mcp: { meta: { dataSet: 'external' } },
+  Evidence: { meta: { dataSet: 'walled' }, requests: { Gather: realGather, Read: realRead } },
+};
+const context = { scrubSecrets: (value) => value.replace('s3cret', '[REDACTED]') };
+
+let session;
+beforeEach(() => {
+  jest.clearAllMocks();
+  delete process.env.LOWDEFY_DEV_SMTP_PORT;
+  session = { sunk: [] };
+});
+
+function args(overrides = {}) {
+  return {
+    connection: { host: 'smtp.example.com', port: 587, pass: 's3cret' },
+    connectionId: 'notifications-email',
+    requestId: 'send',
+    pageId: 'review',
+    request: { to: 'a@example.com', note: 's3cret' },
+    ...overrides,
+  };
+}
+
+test('an external request is recorded and answers null, and never reaches the real resolver', async () => {
+  const map = sinkExternalConnections({ context, connections, session });
+  const response = await map.SMTP.requests.SMTPMailSend(args());
+  expect(response).toBeNull();
+  expect(realSend).not.toHaveBeenCalled();
+  expect(session.sunk).toEqual([
+    {
+      connectionId: 'notifications-email',
+      connectionType: 'SMTP',
+      requestType: 'SMTPMailSend',
+      requestId: 'send',
+      pageId: 'review',
+      endpointId: null,
+      request: { to: 'a@example.com', note: '[REDACTED]' },
+    },
+  ]);
+  // The connection's own properties, which hold its credentials, are never recorded.
+  expect(JSON.stringify(session.sunk)).not.toContain('smtp.example.com');
+});
+
+test('a sunk resolver keeps the schema and meta of the real one', () => {
+  const map = sinkExternalConnections({ context, connections, session });
+  expect(map.SMTP.requests.SMTPMailSend.schema).toBe(realSend.schema);
+  expect(map.SMTP.requests.SMTPMailSend.meta).toBe(realSend.meta);
+});
+
+test('redirect types, types without requests and the plugin map are left alone', () => {
+  const map = sinkExternalConnections({ context, connections, session });
+  expect(map.MongoDBCollection).toBe(connections.MongoDBCollection);
+  expect(map.Mcp).toBe(connections.Mcp);
+  expect(connections.SMTP.requests.SMTPMailSend).toBe(realSend);
+});
+
+test('an SMTP request to the dev mail capture runs for real, any other host is sunk', async () => {
+  process.env.LOWDEFY_DEV_SMTP_PORT = '2525';
+  const map = sinkExternalConnections({ context, connections, session });
+  const capture = args({ connection: { host: '127.0.0.1', port: 2525 } });
+  expect(await map.SMTP.requests.SMTPMailSend(capture)).toEqual({ sent: true });
+  expect(realSend).toHaveBeenCalledTimes(1);
+  await map.SMTP.requests.SMTPMailSend(args({ connection: { host: '127.0.0.1', port: 587 } }));
+  await map.SMTP.requests.SMTPMailSend(
+    args({ connection: { host: 'smtp.example.com', port: 2525 } })
+  );
+  expect(realSend).toHaveBeenCalledTimes(1);
+  expect(session.sunk).toHaveLength(2);
+});
+
+test('a request type that declares external is sunk on a walled connection, its siblings run for real', async () => {
+  const map = sinkExternalConnections({ context, connections, session });
+  const response = await map.Evidence.requests.Gather(
+    args({ connectionId: 'evidence', requestId: 'gather' })
+  );
+  expect(response).toBeNull();
+  expect(realGather).not.toHaveBeenCalled();
+  expect(session.sunk).toEqual([
+    {
+      connectionId: 'evidence',
+      connectionType: 'Evidence',
+      requestType: 'Gather',
+      requestId: 'gather',
+      pageId: 'review',
+      endpointId: null,
+      request: { to: 'a@example.com', note: '[REDACTED]' },
+    },
+  ]);
+  expect(map.Evidence.requests.Gather.meta).toBe(realGather.meta);
+  expect(map.Evidence.meta).toBe(connections.Evidence.meta);
+  expect(map.Evidence.requests.Read).toBe(realRead);
+  expect(await map.Evidence.requests.Read(args())).toEqual(['doc']);
+  expect(session.sunk).toHaveLength(1);
+});
+
+test('a connection with no external request type is returned as is, and the plugin map is not mutated', () => {
+  const map = sinkExternalConnections({ context, connections, session });
+  expect(map.MongoDBCollection).toBe(connections.MongoDBCollection);
+  expect(connections.Evidence.requests.Gather).toBe(realGather);
+  const plain = { Plain: { meta: { dataSet: 'walled' }, requests: { Read: realRead } } };
+  expect(sinkExternalConnections({ context, connections: plain, session }).Plain).toBe(plain.Plain);
+});

package/lib/server/skipStaleMapWrites.js

@@ -0,0 +1,62 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'fs';
+import path from 'path';
+
+const mapFiles = new Set(['keyMap.json', 'refMap.json']);
+const jsMapFiles = new Set([
+  'plugins/operators/clientJsMap.js',
+  'plugins/operators/serverJsMap.js',
+]);
+
+function isMapFile(filePath) {
+  return mapFiles.has(filePath) || filePath.startsWith('jitMaps/');
+}
+
+function readLiveKeyPrefix({ buildDirectory }) {
+  return JSON.parse(fs.readFileSync(path.join(buildDirectory, 'idCounter.json'), 'utf8')).prefix;
+}
+
+// A config rebuild publishes new maps while a page build that started against the
+// previous build may still be running. That build's keyMap and refMap describe the
+// previous build, so writing them would replace the new maps, and errors would resolve
+// against the wrong build until the next rebuild. Its jitMaps/ files would outlive the
+// publish that cleared the old build's. The build's key prefix names the build
+// a context was created from.
+//
+// The JS map files are written whole from a context's jsMap, so a page build on
+// a context that is no longer the kept one (a config publish, or the map budget,
+// discarded it) would replace the entries pages built on the newer context
+// added. Pages built on the discarded context are rebuilt on their next request
+// or API call, which writes their entries again.
+function skipStaleMapWrites({ buildDirectory, context, keyPrefix, isKeptContext }) {
+  const writeBuildArtifact = context.writeBuildArtifact;
+  context.writeBuildArtifact = async (filePath, content, options) => {
+    if (isMapFile(filePath) && readLiveKeyPrefix({ buildDirectory }) !== keyPrefix) {
+      return;
+    }
+    if (
+      jsMapFiles.has(filePath) &&
+      (!isKeptContext() || readLiveKeyPrefix({ buildDirectory }) !== keyPrefix)
+    ) {
+      return;
+    }
+    await writeBuildArtifact(filePath, content, options);
+  };
+}
+
+export default skipStaleMapWrites;

package/lib/server/skipStaleMapWrites.test.mjs

@@ -0,0 +1,113 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+
+import { jest } from '@jest/globals';
+
+import skipStaleMapWrites from './skipStaleMapWrites.js';
+
+let buildDirectory;
+
+function publishBuild(prefix) {
+  fs.writeFileSync(
+    path.join(buildDirectory, 'idCounter.json'),
+    JSON.stringify({ prefix, counter: 10 })
+  );
+}
+
+beforeEach(() => {
+  buildDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'lowdefy-stale-maps-'));
+});
+
+afterEach(() => {
+  fs.rmSync(buildDirectory, { recursive: true });
+});
+
+test('a page build writes its maps while its config build is the live one', async () => {
+  publishBuild('a1b2_');
+  const writeBuildArtifact = jest.fn();
+  const context = { writeBuildArtifact };
+  skipStaleMapWrites({ buildDirectory, context, keyPrefix: 'a1b2_', isKeptContext: () => true });
+
+  await context.writeBuildArtifact('keyMap.json', '{}');
+  await context.writeBuildArtifact('refMap.json', '{}');
+
+  expect(writeBuildArtifact.mock.calls).toEqual([
+    ['keyMap.json', '{}'],
+    ['refMap.json', '{}'],
+  ]);
+});
+
+test('a page build started before a config rebuild does not replace the new maps', async () => {
+  publishBuild('a1b2_');
+  const writeBuildArtifact = jest.fn();
+  const context = { writeBuildArtifact };
+  skipStaleMapWrites({ buildDirectory, context, keyPrefix: 'a1b2_', isKeptContext: () => true });
+
+  publishBuild('c3d4_');
+  await context.writeBuildArtifact('keyMap.json', '{}');
+  await context.writeBuildArtifact('refMap.json', '{}');
+  await context.writeBuildArtifact('pages/home.json', '{}');
+
+  expect(writeBuildArtifact.mock.calls).toEqual([['pages/home.json', '{}']]);
+});
+
+test('a page build started before a config rebuild writes no jitMaps file', async () => {
+  publishBuild('a1b2_');
+  const writeBuildArtifact = jest.fn();
+  const context = { writeBuildArtifact };
+  skipStaleMapWrites({ buildDirectory, context, keyPrefix: 'a1b2_', isKeptContext: () => true });
+
+  await context.writeBuildArtifact('jitMaps/abc123-1-1.json', '{}');
+  publishBuild('c3d4_');
+  await context.writeBuildArtifact('jitMaps/abc123-1-2.json', '{}');
+
+  expect(writeBuildArtifact.mock.calls).toEqual([['jitMaps/abc123-1-1.json', '{}']]);
+});
+
+test('a page build on a context that is no longer kept does not write the JS maps', async () => {
+  publishBuild('a1b2_');
+  const writeBuildArtifact = jest.fn();
+  const context = { writeBuildArtifact };
+  let kept = true;
+  skipStaleMapWrites({ buildDirectory, context, keyPrefix: 'a1b2_', isKeptContext: () => kept });
+
+  await context.writeBuildArtifact('plugins/operators/serverJsMap.js', 'a');
+  kept = false;
+  await context.writeBuildArtifact('plugins/operators/serverJsMap.js', 'b');
+  await context.writeBuildArtifact('plugins/operators/clientJsMap.js', 'b');
+  await context.writeBuildArtifact('pages/home.json', '{}');
+
+  expect(writeBuildArtifact.mock.calls).toEqual([
+    ['plugins/operators/serverJsMap.js', 'a'],
+    ['pages/home.json', '{}'],
+  ]);
+});
+
+test('a page build started before a config rebuild does not write the JS maps', async () => {
+  publishBuild('a1b2_');
+  const writeBuildArtifact = jest.fn();
+  const context = { writeBuildArtifact };
+  skipStaleMapWrites({ buildDirectory, context, keyPrefix: 'a1b2_', isKeptContext: () => true });
+
+  publishBuild('c3d4_');
+  await context.writeBuildArtifact('plugins/operators/serverJsMap.js', 'a');
+
+  expect(writeBuildArtifact.mock.calls).toEqual([]);
+});

package/lib/server/startIdleGc.js

@@ -0,0 +1,67 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+import readInstanceRecord from './readInstanceRecord.js';
+
+// Vite can evaluate the app entry more than once (an SSR reload, the
+// websocket upgrade path), and each evaluation calls this.
+const STARTED = Symbol.for('lowdefy.server-dev.idleGc');
+
+/*
+Hands the child's V8 slack back once the server goes quiet: one full GC per
+quiet period, when the activity the manager records in the instance record
+(lastActivityAt, activeRequests, building) says nothing has used the server
+for quietMs and nothing is in flight. It runs again only after activity
+resumes (a newer lastActivityAt). A child started without --expose-gc has no
+globalThis.gc and does nothing.
+*/
+function startIdleGc({
+  configDirectory,
+  gc = globalThis.gc,
+  readInstance = readInstanceRecord,
+  now = Date.now,
+  pollMs = 5000,
+  quietMs = 10000,
+}) {
+  if (globalThis[STARTED] === true || !type.isFunction(gc)) {
+    return;
+  }
+  globalThis[STARTED] = true;
+  let collectedFor = null;
+  const interval = setInterval(() => {
+    const record = readInstance({ configDirectory });
+    if (type.isNone(record) || !type.isString(record.lastActivityAt)) {
+      return;
+    }
+    if (record.building === true || (record.activeRequests ?? 0) > 0) {
+      return;
+    }
+    if (record.lastActivityAt === collectedFor) {
+      return;
+    }
+    if (now() - Date.parse(record.lastActivityAt) < quietMs) {
+      return;
+    }
+    collectedFor = record.lastActivityAt;
+    gc();
+  }, pollMs);
+  // Never the reason the child stays up.
+  interval.unref();
+}
+
+export default startIdleGc;

package/lib/server/startIdleGc.test.mjs

@@ -0,0 +1,138 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+
+import startIdleGc from './startIdleGc.js';
+
+const STARTED = Symbol.for('lowdefy.server-dev.idleGc');
+const START = Date.parse('2026-10-03T10:00:00.000Z');
+
+let clock;
+let record;
+let gc;
+
+function start(options = {}) {
+  startIdleGc({
+    configDirectory: '/apps/tenant',
+    gc,
+    readInstance: () => record,
+    now: () => clock,
+    ...options,
+  });
+}
+
+function tick(ms) {
+  clock += ms;
+  jest.advanceTimersByTime(ms);
+}
+
+beforeEach(() => {
+  // performance is not redefinable on this Node, and nothing here reads it.
+  jest.useFakeTimers({ doNotFake: ['performance'] });
+  delete globalThis[STARTED];
+  clock = START;
+  gc = jest.fn();
+  record = {
+    lastActivityAt: new Date(START).toISOString(),
+    activeRequests: 0,
+    building: false,
+  };
+});
+
+afterEach(() => {
+  jest.clearAllTimers();
+  jest.useRealTimers();
+  delete globalThis[STARTED];
+});
+
+test('startIdleGc collects once the server has been quiet for 10 s', () => {
+  start();
+
+  tick(5000);
+  expect(gc).not.toHaveBeenCalled();
+  tick(5000);
+  expect(gc).toHaveBeenCalledTimes(1);
+  tick(60_000);
+  expect(gc).toHaveBeenCalledTimes(1);
+});
+
+test('startIdleGc does not collect while a request is in flight', () => {
+  record.activeRequests = 1;
+  start();
+
+  tick(60_000);
+
+  expect(gc).not.toHaveBeenCalled();
+});
+
+test('startIdleGc does not collect while a build runs', () => {
+  record.building = true;
+  start();
+
+  tick(60_000);
+
+  expect(gc).not.toHaveBeenCalled();
+});
+
+test('startIdleGc collects again only after activity resumes', () => {
+  start();
+  tick(10_000);
+  expect(gc).toHaveBeenCalledTimes(1);
+
+  record = { ...record, lastActivityAt: new Date(clock).toISOString() };
+  tick(5000);
+  expect(gc).toHaveBeenCalledTimes(1);
+  tick(5000);
+
+  expect(gc).toHaveBeenCalledTimes(2);
+});
+
+test('startIdleGc does nothing when the instance record has no activity', () => {
+  record = null;
+  start();
+
+  tick(60_000);
+
+  expect(gc).not.toHaveBeenCalled();
+});
+
+test('startIdleGc does nothing when the child was started without gc exposed', () => {
+  // The gc default is globalThis.gc, which every later test file in a jest worker has once
+  // createIdleGc.test.mjs has set --expose-gc in it.
+  const exposedGc = globalThis.gc;
+  delete globalThis.gc;
+  gc = undefined;
+  try {
+    start();
+
+    expect(globalThis[STARTED]).toBeUndefined();
+    expect(jest.getTimerCount()).toBe(0);
+  } finally {
+    if (exposedGc !== undefined) {
+      globalThis.gc = exposedGc;
+    }
+  }
+});
+
+test('startIdleGc starts one interval however often the app entry is evaluated', () => {
+  start();
+  start();
+
+  expect(jest.getTimerCount()).toBe(1);
+  tick(10_000);
+  expect(gc).toHaveBeenCalledTimes(1);
+});

package/lib/server/testFixtures/importAppCodeTwice.mjs

@@ -0,0 +1,70 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Run by importAppCode.test.mjs in its own process: Jest can load neither Vite
+// nor a module URL with a query. Loads the build's importAppCode the way the dev
+// server's JIT page builds do, then imports an app code file, imports it again
+// unchanged, edits it and imports it again. With `vite`, through Vite's SSR
+// module runner (@lowdefy/build linked, as in the monorepo); with `node`,
+// natively (@lowdefy/build installed from npm, which Vite externalises).
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { createServer } from 'vite';
+
+const [loader, configDir] = process.argv.slice(2);
+const require = createRequire(import.meta.url);
+const serverDevDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../..');
+
+const buildDevEntry = require.resolve('@lowdefy/build/dev');
+const modulePath = path.join(path.dirname(buildDevEntry), 'utils/createImportAppCode.js');
+
+let server = null;
+if (loader === 'vite') {
+  server = await createServer({
+    configFile: false,
+    root: serverDevDir,
+    logLevel: 'error',
+    appType: 'custom',
+    server: { middlewareMode: true, hmr: false, watch: null },
+  });
+}
+
+try {
+  const { default: createImportAppCode } = server
+    ? await server.ssrLoadModule(modulePath)
+    : await import(pathToFileURL(modulePath).href);
+  const importAppCode = createImportAppCode({ directories: { config: configDir } });
+  const filePath = path.join(configDir, 'transformer.js');
+
+  fs.writeFileSync(filePath, "export default () => 'before';\n");
+  const first = await importAppCode('transformer.js');
+  const unchanged = await importAppCode('transformer.js');
+  fs.writeFileSync(filePath, "export default () => 'after';\n");
+  const edited = await importAppCode('transformer.js');
+
+  process.stdout.write(
+    JSON.stringify({
+      first: first(),
+      edited: edited(),
+      unchangedReused: unchanged === first,
+    })
+  );
+} finally {
+  await server?.close();
+}