@lowdefy/server-dev 6.1.0 → 7.1.0

package/lib/server/loadDynamicJsMap.js

@@ -0,0 +1,47 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+import staticJsMap from '../../build/plugins/operators/serverJsMap.js';
+
+// Dynamic JS map loading for JIT-built pages — the build rewrites
+// serverJsMap.js when a JIT page discovers new _js operators.
+let cachedJsMapMtime = null;
+let cachedJsMap = staticJsMap;
+
+function loadDynamicJsMap(buildDirectory) {
+  const jsMapPath = path.join(buildDirectory, 'plugins', 'operators', 'serverJsMap.js');
+  try {
+    const stat = fs.statSync(jsMapPath);
+    if (cachedJsMapMtime && stat.mtimeMs === cachedJsMapMtime) {
+      return cachedJsMap;
+    }
+    cachedJsMapMtime = stat.mtimeMs;
+    // For server-side, we can read and eval the JS file
+    const content = fs.readFileSync(jsMapPath, 'utf8');
+    const fn = new Function('exports', content.replace('export default', 'exports.default ='));
+    const exports = {};
+    fn(exports);
+    cachedJsMap = { ...staticJsMap, ...(exports.default ?? {}) };
+    return cachedJsMap;
+  } catch {
+    return cachedJsMap;
+  }
+}
+
+export default loadDynamicJsMap;

package/lib/server/log/createHandleError.js

@@ -14,7 +14,23 @@
   limitations under the License.
 */
 
+import { inspect } from 'node:util';
+
 import { LowdefyInternalError, loadAndResolveErrorLocation } from '@lowdefy/errors';
+import { scrubCredentials } from '@lowdefy/node-utils';
+
+import errorRecordingStamp from '../recording/errorRecordingStamp.js';
+import serverErrorStore from '../../docs/serverErrorStore.js';
+
+// A UserError is an expected outcome of user interaction (a rejected payload,
+// a :reject) and a LowdefyInternalError never carries a config location, so
+// neither belongs in the agent's feedback channel.
+function shouldStore(error) {
+  if (error instanceof LowdefyInternalError) {
+    return false;
+  }
+  return error.name !== 'UserError';
+}
 
 function createHandleError({ context }) {
   return async function handleError(error) {
@@ -36,6 +52,9 @@ function createHandleError({ context }) {
               error,
               readConfigFile: context.readConfigFile,
               configDirectory: context.configDirectory,
+              // The request context's reader adds the JIT page builds' maps
+              // (readMergedMaps); without one, keyMap.json and refMap.json.
+              readMaps: context.readMaps,
             });
 
       // Attach resolved location to error for display layer
@@ -44,11 +63,28 @@ function createHandleError({ context }) {
         error.config = location.config;
       }
 
+      if (shouldStore(error)) {
+        serverErrorStore.push({
+          timestamp: new Date().toISOString(),
+          name: error.name,
+          // Agents read the store through build-status, after this request's scope has ended.
+          message: scrubCredentials(error.message),
+          source: error.source ?? null,
+          config: error.config ?? null,
+          hint: error.hint ?? null,
+          endpointId: context.endpointId ?? null,
+          requestId: context.requestId ?? null,
+          pageId: context.pageId ?? null,
+          recording: errorRecordingStamp(context.recording),
+        });
+      }
+
       context.logger.error(error);
     } catch (e) {
-      console.error(error);
+      // Written past the logger, so past its streamWrite scrub of marked credentials.
+      console.error(scrubCredentials(inspect(error)));
       console.error('An error occurred while logging the error.');
-      console.error(e);
+      console.error(scrubCredentials(inspect(e)));
     }
   };
 }

package/lib/server/log/createHandleError.test.mjs

@@ -15,9 +15,15 @@
 */
 
 import { jest } from '@jest/globals';
-import { ConfigError, LowdefyInternalError } from '@lowdefy/errors';
+import { ConfigError, LowdefyInternalError, UserError } from '@lowdefy/errors';
+import { markCredential, runInCredentialScope } from '@lowdefy/node-utils';
 
-import createHandleError from './createHandleError.js';
+jest.unstable_mockModule('../../docs/serverErrorStore.js', () => ({
+  default: { push: jest.fn(), list: jest.fn(() => []) },
+}));
+
+const { default: serverErrorStore } = await import('../../docs/serverErrorStore.js');
+const { default: createHandleError } = await import('./createHandleError.js');
 
 // This sink is the sole writer of `error.handled`. Two callers read the flag and
 // neither can set it for itself: runRoutine's catch guards on `!error.handled` to
@@ -46,6 +52,7 @@ function testContext({ logger, readConfigFile, configDirectory } = {}) {
 
 beforeEach(() => {
   console.error = jest.fn();
+  serverErrorStore.push.mockReset();
 });
 
 test('handleError marks the error handled and resolves its location', async () => {
@@ -124,3 +131,119 @@ test('handleError marks a plain Error handled', async () => {
 
   expect(error.handled).toBe(true);
 });
+
+test('handleError pushes an error with a configKey into the server error store with its source', async () => {
+  const context = testContext();
+  context.endpointId = 'get-customer';
+  context.pageId = '_mcp';
+  const handleError = createHandleError({ context });
+  const error = new ConfigError('Bad config.', { configKey: 'key_1' });
+
+  await handleError(error);
+
+  expect(serverErrorStore.push).toHaveBeenCalledTimes(1);
+  const entry = serverErrorStore.push.mock.calls[0][0];
+  expect(entry).toEqual({
+    timestamp: expect.any(String),
+    name: 'ConfigError',
+    message: 'Bad config.',
+    source: 'pages/home.yaml:5',
+    config: 'root.pages[0:home]',
+    hint: null,
+    endpointId: 'get-customer',
+    requestId: null,
+    pageId: '_mcp',
+    recording: null,
+  });
+  // Pushed before the log so a throwing logger cannot lose the entry.
+  expect(serverErrorStore.push.mock.invocationCallOrder[0]).toBeLessThan(
+    context.logger.error.mock.invocationCallOrder[0]
+  );
+});
+
+test('handleError does not push a UserError into the server error store', async () => {
+  const context = testContext();
+  const handleError = createHandleError({ context });
+  const error = new UserError('Rejected.');
+
+  await handleError(error);
+
+  expect(error.handled).toBe(true);
+  expect(serverErrorStore.push).not.toHaveBeenCalled();
+  expect(context.logger.error).toHaveBeenCalledWith(error);
+});
+
+test('handleError does not push a LowdefyInternalError into the server error store', async () => {
+  const context = testContext();
+  const handleError = createHandleError({ context });
+  const error = new LowdefyInternalError('Unexpected condition.');
+
+  await handleError(error);
+
+  expect(serverErrorStore.push).not.toHaveBeenCalled();
+  expect(context.logger.error).toHaveBeenCalledWith(error);
+});
+
+test('handleError still logs when the server error store throws', async () => {
+  serverErrorStore.push.mockImplementation(() => {
+    throw new Error('Store full.');
+  });
+  const context = testContext();
+  const handleError = createHandleError({ context });
+  const error = new ConfigError('Bad config.', { configKey: 'key_1' });
+
+  await handleError(error);
+
+  expect(error.handled).toBe(true);
+  expect(console.error).toHaveBeenCalledWith(expect.stringContaining('Bad config.'));
+  expect(console.error).toHaveBeenCalledWith('An error occurred while logging the error.');
+});
+
+test('handleError writes its fallback lines with the credentials the request marked redacted', async () => {
+  serverErrorStore.push.mockImplementation(() => {
+    throw new Error('Store refused runtime-made-app-key-0001.');
+  });
+  const handleError = createHandleError({ context: testContext() });
+  await runInCredentialScope(async () => {
+    markCredential('runtime-made-app-key-0001');
+    await handleError(new ConfigError('Upstream refused runtime-made-app-key-0001.'));
+  });
+  const written = console.error.mock.calls.map(([line]) => line);
+  expect(written).toEqual(
+    expect.arrayContaining([
+      expect.stringContaining('Upstream refused [REDACTED].'),
+      expect.stringContaining('Store refused [REDACTED].'),
+    ])
+  );
+  written.forEach((line) => expect(line).not.toContain('runtime-made-app-key-0001'));
+});
+
+test('handleError stamps a stored error with the recording of the context that caused it', async () => {
+  const context = testContext();
+  context.recording = {
+    source: 'journey',
+    run: { id: '20261003T151200Z-p0d4rm', by: 'agent', journey: 'save-ticket', actor: 'main' },
+  };
+  await createHandleError({ context })(new ConfigError('Bad config.', { configKey: 'key_1' }));
+  expect(serverErrorStore.push.mock.calls[0][0].recording).toEqual({
+    source: 'journey',
+    run: '20261003T151200Z-p0d4rm',
+    journey: 'save-ticket',
+  });
+});
+
+test('handleError stamps a developer request error with a null recording', async () => {
+  const context = testContext();
+  context.recording = null;
+  await createHandleError({ context })(new ConfigError('Bad config.', { configKey: 'key_1' }));
+  expect(serverErrorStore.push.mock.calls[0][0].recording).toBeNull();
+});
+
+test('handleError stores a message with the credentials the request marked redacted', async () => {
+  const handleError = createHandleError({ context: testContext() });
+  await runInCredentialScope(async () => {
+    markCredential('runtime-made-app-key-0001');
+    await handleError(new ConfigError('Upstream refused runtime-made-app-key-0001.'));
+  });
+  expect(serverErrorStore.push.mock.calls[0][0].message).toBe('Upstream refused [REDACTED].');
+});

package/lib/server/log/createLogger.js

@@ -15,11 +15,14 @@
 */
 
 import { createNodeLogger } from '@lowdefy/logger/node';
+import { scrubCredentials } from '@lowdefy/node-utils';
 
 const logger = createNodeLogger({
   name: 'lowdefy_server_dev',
   level: process.env.LOWDEFY_LOG_LEVEL ?? 'info',
   base: { pid: undefined, hostname: undefined },
+  // Secrets stay in these logs, but a value a request marked with _credential does not.
+  hooks: { streamWrite: scrubCredentials },
 });
 
 function createLogger(metadata = {}) {

package/lib/server/log/createLogger.test.mjs

@@ -16,6 +16,7 @@
 
 import { jest } from '@jest/globals';
 import { createNodeLogger } from '@lowdefy/logger/node';
+import { markCredential, runInCredentialScope } from '@lowdefy/node-utils';
 import { serializer } from '@lowdefy/helpers';
 
 const secret = 'planted-dev-secret-value';
@@ -60,3 +61,17 @@ test('dev logger writes an axios error with full default serialization and no sc
   expect(err.config.headers.Authorization).toBe('Bearer planted-config-header');
   expect(msg).toBe(`Request failed for key ${secret}`);
 });
+
+test('dev logger redacts a value the request marked as a credential and keeps secrets', () => {
+  lines.length = 0;
+  runInCredentialScope(() => {
+    markCredential('runtime-made-app-key-0001');
+    createLogger({ rid: 'req-1' }).info({
+      event: 'debug_control_set_state',
+      evaluated: { key: 'runtime-made-app-key-0001', secret },
+    });
+  });
+  expect(lines).toHaveLength(1);
+  const { evaluated } = JSON.parse(lines[0]);
+  expect(evaluated).toEqual({ key: '[REDACTED]', secret });
+});

package/lib/server/log/logRequest.js

@@ -16,17 +16,16 @@
 
 // TODO: Better name needed here maybe?
 function logRequest({ context }) {
-  const { user = {} } = context;
+  const user = context.user ?? {};
   context.logger.debug({
     user: {
       id: user.id,
       roles: user.roles,
-      sub: user.sub,
-      session_id: user.session_id,
     },
     url: context.req.url,
     method: context.req.method,
     resolvedUrl: context.nextContext?.resolvedUrl,
+    dataSet: context.dataSet,
   });
 }
 

package/lib/server/mutantDataSetWrappers.test.mjs

@@ -0,0 +1,115 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { serializer } from '@lowdefy/helpers';
+
+import applyDataSetRedirect from './applyDataSetRedirect.js';
+import createMutantReadConfigFile from './mutants/createMutantReadConfigFile.js';
+import { endpointFixture } from './mutants/test/fixtures.mjs';
+import { openMutantRun } from './mutants/mutantRuns.js';
+
+// A journey on a data set under a mutant has both read wrappers on its
+// context: the data set redirect on connections/<id>.json and the mutant on
+// its one artifact. They touch different artifacts, so the order they are
+// stacked in must not matter.
+
+const connections = { MongoDBCollection: { meta: { tenant: true, dataSet: 'redirect' } } };
+
+const session = {
+  id: 'session-1',
+  name: 'shop',
+  state: 'open',
+  databaseUri: 'mongodb://127.0.0.1:27999/?replicaSet=rs',
+  prefix: 'ld_0123456789ab',
+  databaseName: 'ld_0123456789ab_0',
+  databases: new Map([[JSON.stringify(['secret:MONGODB_URI', null]), 'ld_0123456789ab_0']]),
+  databaseCount: 1,
+};
+
+function setup() {
+  const { root } = endpointFixture();
+  const files = {
+    'api/notify.json': serializer.serializeToString(root),
+    'connections/tickets.json': serializer.serializeToString({
+      id: 'connection:tickets',
+      connectionId: 'tickets',
+      type: 'MongoDBCollection',
+      properties: { databaseUri: { _secret: 'MONGODB_URI' }, collection: 'tickets', write: true },
+    }),
+  };
+  async function readConfigFile(filePath) {
+    return serializer.deserializeFromString(files[filePath] ?? 'null');
+  }
+  const opened = openMutantRun({
+    mutant: {
+      buildId: 'build-1',
+      artifact: 'api/notify.json',
+      key: root.routine[0]['~k'],
+      arg: null,
+      operator: 'drop-step',
+    },
+  });
+  return { opened, readConfigFile };
+}
+
+function stackDataThenMutant({ readConfigFile, run }) {
+  const context = { readConfigFile };
+  applyDataSetRedirect({ context, session, connections });
+  context.readConfigFile = createMutantReadConfigFile({
+    readConfigFile: context.readConfigFile,
+    run,
+  });
+  return context.readConfigFile;
+}
+
+function stackMutantThenData({ readConfigFile, run }) {
+  const context = { readConfigFile: createMutantReadConfigFile({ readConfigFile, run }) };
+  applyDataSetRedirect({ context, session, connections });
+  return context.readConfigFile;
+}
+
+async function readBoth(stack) {
+  const { opened, readConfigFile } = setup();
+  const read = stack({ readConfigFile, run: opened.run });
+  const result = {
+    endpoint: await read('api/notify.json'),
+    connection: await read('connections/tickets.json'),
+    applied: opened.run.applied,
+    misses: opened.run.misses,
+  };
+  opened.close();
+  return result;
+}
+
+test('the data set redirect and the mutant wrapper give the same reads stacked in either order', async () => {
+  const dataFirst = await readBoth(stackDataThenMutant);
+  const mutantFirst = await readBoth(stackMutantThenData);
+  expect(mutantFirst).toEqual(dataFirst);
+
+  expect(dataFirst.applied).toBe(1);
+  expect(dataFirst.misses).toEqual([]);
+  expect(dataFirst.endpoint.routine.map((step) => step.stepId ?? Object.keys(step)[0])).toEqual([
+    ':if',
+    ':if',
+    ':return',
+  ]);
+  expect(dataFirst.connection.properties).toEqual({
+    databaseUri: session.databaseUri,
+    databaseName: session.databaseName,
+    collection: 'tickets',
+    write: true,
+  });
+});

package/lib/server/mutants/applyMutant.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+import findNodeByKey from './findNodeByKey.js';
+import findNodeByPointer from './findNodeByPointer.js';
+import operators from './operators/index.js';
+
+// Applies one mutant to a deserialised artifact copy, in place. Reports
+// whether it applied, and why not when it did not, changing nothing then. The
+// node is found by its key; when the page was rebuilt since the mutant was
+// listed its keys are new, and the node is found by its pointer instead.
+function applyMutant({ root, mutant: { operator, key, arg, pointer, nodeHash } }) {
+  const definition = operators[operator];
+  if (type.isUndefined(definition)) {
+    return { applied: false, reason: `unknown operator "${operator}"` };
+  }
+  const found = findNodeByKey({ root, key }) ?? findNodeByPointer({ root, pointer, nodeHash });
+  if (found === null) {
+    return { applied: false, reason: 'key not found' };
+  }
+  return definition.apply({ ...found, arg });
+}
+
+export default applyMutant;

package/lib/server/mutants/artifactPatterns.js

@@ -0,0 +1,25 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The build artifacts config mutants reach, by path relative to the build
+// directory. A request artifact sits under its page's folder, so a page
+// artifact is any other JSON file under pages/.
+const REQUEST_ARTIFACT = /^pages\/.+\/requests\/[^/]+\.json$/;
+const PAGE_ARTIFACT = /^pages\/(?!.+\/requests\/[^/]+\.json$).+\.json$/;
+const ENDPOINT_ARTIFACT = /^api\/.+\.json$/;
+const EVENTS_ARTIFACT = /^events\.json$/;
+
+export { REQUEST_ARTIFACT, PAGE_ARTIFACT, ENDPOINT_ARTIFACT, EVENTS_ARTIFACT };

package/lib/server/mutants/buildAnchor.js

@@ -0,0 +1,45 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Where a mutant sits, in the terms a journey's measured path uses, so the
+// harden run can tell which journeys reach it.
+function buildAnchor({ scope, type }) {
+  switch (type) {
+    case 'action':
+      return {
+        type,
+        pageId: scope.pageId,
+        blockId: scope.blockId,
+        eventName: scope.eventName,
+        actionId: scope.actionId,
+      };
+    case 'block':
+      return {
+        type,
+        pageId: scope.pageId,
+        blockId: scope.blockId,
+        parentBlockId: scope.parentBlockId,
+      };
+    case 'request':
+      return { type, pageId: scope.pageId, requestId: scope.requestId };
+    case 'endpoint':
+      return { type, endpointId: scope.endpointId };
+    default:
+      throw new Error(`Unknown mutant anchor type "${type}".`);
+  }
+}
+
+export default buildAnchor;

package/lib/server/mutants/collectSharedIds.js

@@ -0,0 +1,41 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import configPathSegments from './configPathSegments.js';
+
+// The array items, across a build's keyMap, whose id and type label is shared
+// by a sibling at another index. Their position-free path keeps the index,
+// since the label alone would name two nodes.
+function collectSharedIds({ keyMap }) {
+  const indices = new Map();
+  Object.values(keyMap).forEach((entry) => {
+    const segments = configPathSegments(entry.key ?? '');
+    const last = segments[segments.length - 1];
+    if (last === undefined || last.label === '' || last.end !== entry.key.length) {
+      return;
+    }
+    const sibling = `${last.prefix}[${last.label}]`;
+    if (!indices.has(sibling)) {
+      indices.set(sibling, new Set());
+    }
+    indices.get(sibling).add(last.index);
+  });
+  return new Set(
+    [...indices.entries()].filter(([, found]) => found.size > 1).map(([sibling]) => sibling)
+  );
+}
+
+export default collectSharedIds;

package/lib/server/mutants/configPathSegments.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The array-item segments of a keyMap config path, such as
+// `root.pages[0:tickets:PageHeaderMenu].blocks[3:assign_submit:Button]`: each
+// with the path before it, its index and what follows the index (the item's
+// id and type, empty for an item that has neither).
+function configPathSegments(configPath) {
+  const pattern = /\[(\d+)(?::([^\]]*))?\]/g;
+  const segments = [];
+  let match = pattern.exec(configPath);
+  while (match !== null) {
+    segments.push({
+      start: match.index,
+      end: match.index + match[0].length,
+      prefix: configPath.slice(0, match.index),
+      index: match[1],
+      label: match[2] ?? '',
+    });
+    match = pattern.exec(configPath);
+  }
+  return segments;
+}
+
+export default configPathSegments;

package/lib/server/mutants/createMutantReadConfigFile.js

@@ -0,0 +1,42 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { serializer } from '@lowdefy/helpers';
+
+import applyMutant from './applyMutant.js';
+
+// Wraps a request's readConfigFile so the one artifact a mutant run targets is
+// served mutated: the original read (which the cache may share with every
+// other request) is copied, the mutant applied to the copy, and each
+// application counted on the run. Every other path passes straight through.
+function createMutantReadConfigFile({ readConfigFile, run }) {
+  return async function mutantReadConfigFile(filePath) {
+    const original = await readConfigFile(filePath);
+    if (filePath !== run.mutant.artifact) {
+      return original;
+    }
+    const copy = serializer.copy(original);
+    const outcome = applyMutant({ root: copy, mutant: run.mutant });
+    if (outcome.applied) {
+      run.applied += 1;
+    } else {
+      run.misses.push({ reason: outcome.reason, path: filePath });
+    }
+    return copy;
+  };
+}
+
+export default createMutantReadConfigFile;