@lowdefy/server-dev 6.1.0 → 7.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server-dev",
-  "version": "6.1.0",
+  "version": "7.1.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -39,62 +39,69 @@
   ],
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
-    "@ant-design/x": "2.7.0",
-    "@auth/core": "0.41.3",
-    "@hono/auth-js": "1.1.1",
-    "@hono/mcp": "0.3.0",
+    "@ant-design/x": "2.9.0",
+    "@better-auth/oauth-provider": "1.7.7",
+    "@better-auth/passkey": "1.7.7",
+    "@hono/mcp": "0.3.2",
     "@hono/node-server": "2.0.10",
     "@hono/vite-dev-server": "0.26.0",
-    "@lowdefy/actions-core": "6.1.0",
-    "@lowdefy/api": "6.1.0",
-    "@lowdefy/block-utils": "6.1.0",
-    "@lowdefy/blocks-aggrid": "6.1.0",
-    "@lowdefy/blocks-antd": "6.1.0",
-    "@lowdefy/blocks-antd-x": "6.1.0",
-    "@lowdefy/blocks-basic": "6.1.0",
-    "@lowdefy/blocks-echarts": "6.1.0",
-    "@lowdefy/blocks-loaders": "6.1.0",
-    "@lowdefy/blocks-markdown": "6.1.0",
-    "@lowdefy/blocks-tiptap": "6.1.0",
-    "@lowdefy/build": "6.1.0",
-    "@lowdefy/client": "6.1.0",
-    "@lowdefy/connection-axios-http": "6.1.0",
-    "@lowdefy/docs-content": "6.1.0",
-    "@lowdefy/engine": "6.1.0",
-    "@lowdefy/errors": "6.1.0",
-    "@lowdefy/helpers": "6.1.0",
-    "@lowdefy/layout": "6.1.0",
-    "@lowdefy/logger": "6.1.0",
-    "@lowdefy/node-utils": "6.1.0",
-    "@lowdefy/operators-change-case": "6.1.0",
-    "@lowdefy/operators-dayjs": "6.1.0",
-    "@lowdefy/operators-diff": "6.1.0",
-    "@lowdefy/operators-js": "6.1.0",
-    "@lowdefy/operators-mql": "6.1.0",
-    "@lowdefy/operators-nunjucks": "6.1.0",
-    "@lowdefy/operators-uuid": "6.1.0",
-    "@lowdefy/operators-yaml": "6.1.0",
-    "@lowdefy/plugin-next-auth": "6.1.0",
-    "@lowdefy/websockets-core": "6.1.0",
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "@tailwindcss/postcss": "4.3.1",
+    "@lowdefy/actions-core": "7.1.0",
+    "@lowdefy/api": "7.1.0",
+    "@lowdefy/block-utils": "7.1.0",
+    "@lowdefy/blocks-aggrid": "7.1.0",
+    "@lowdefy/blocks-antd": "7.1.0",
+    "@lowdefy/blocks-antd-x": "7.1.0",
+    "@lowdefy/blocks-basic": "7.1.0",
+    "@lowdefy/blocks-captcha": "7.1.0",
+    "@lowdefy/blocks-echarts": "7.1.0",
+    "@lowdefy/blocks-loaders": "7.1.0",
+    "@lowdefy/blocks-markdown": "7.1.0",
+    "@lowdefy/blocks-table": "7.1.0",
+    "@lowdefy/blocks-tiptap": "7.1.0",
+    "@lowdefy/build": "7.1.0",
+    "@lowdefy/client": "7.1.0",
+    "@lowdefy/connection-axios-http": "7.1.0",
+    "@lowdefy/connection-mongodb": "7.1.0",
+    "@lowdefy/docs-content": "7.1.0",
+    "@lowdefy/e2e-utils": "7.1.0",
+    "@lowdefy/engine": "7.1.0",
+    "@lowdefy/errors": "7.1.0",
+    "@lowdefy/helpers": "7.1.0",
+    "@lowdefy/layout": "7.1.0",
+    "@lowdefy/logger": "7.1.0",
+    "@lowdefy/node-utils": "7.1.0",
+    "@lowdefy/operators-change-case": "7.1.0",
+    "@lowdefy/operators-cron": "7.1.0",
+    "@lowdefy/operators-dayjs": "7.1.0",
+    "@lowdefy/operators-diff": "7.1.0",
+    "@lowdefy/operators-js": "7.1.0",
+    "@lowdefy/operators-mql": "7.1.0",
+    "@lowdefy/operators-nunjucks": "7.1.0",
+    "@lowdefy/operators-uuid": "7.1.0",
+    "@lowdefy/operators-yaml": "7.1.0",
+    "@lowdefy/plugin-better-auth": "7.1.0",
+    "@lowdefy/websockets-core": "7.1.0",
+    "@modelcontextprotocol/sdk": "1.31.0",
+    "@tailwindcss/postcss": "4.3.3",
     "@vitejs/plugin-react": "6.0.2",
-    "antd": "6.3.1",
+    "antd": "6.6.5",
+    "better-auth": "1.7.7",
     "chokidar": "3.5.3",
     "dayjs": "1.11.20",
     "dotenv": "16.3.1",
-    "hono": "4.13.5",
+    "hono": "4.13.7",
     "html-to-image": "1.11.13",
+    "mongodb": "7.2.0",
+    "mongodb-memory-server-core": "9.2.0",
     "opener": "1.5.2",
     "pino": "10.3.1",
     "playwright-core": "1.59.1",
-    "postcss": "8.5.23",
-    "process": "0.11.10",
+    "postal-mime": "3.0.0",
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "react-icons": "5.6.0",
+    "smtp-server": "3.19.13",
     "swr": "2.2.4",
-    "tailwindcss": "4.3.1",
+    "tailwindcss": "4.3.3",
     "tinykeys": "3.0.0",
     "uuid": "14.0.0",
     "vite": "8.0.16",
@@ -104,10 +111,14 @@
     "zod": "3.25.76"
   },
   "devDependencies": {
-    "jest": "28.1.3"
+    "@jest/globals": "28.1.3",
+    "@shelf/jest-mongodb": "4.3.2",
+    "jest": "28.1.3",
+    "jest-environment-jsdom": "28.1.3",
+    "nodemailer": "10.0.13"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "publishConfig": {
     "access": "public"
@@ -116,6 +127,8 @@
   "scripts": {
     "build": "cp package.json package.original.json || copy package.json package.original.json",
     "start": "node manager/run.mjs",
-    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
+    "test:fixture": "node --experimental-vm-modules node_modules/jest/bin/jest.js --config jest.fixture.config.mjs",
+    "test:mongodb": "node --experimental-vm-modules node_modules/jest/bin/jest.js --config jest.mongodb.config.mjs"
   }
 }

package/package.original.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server-dev",
-  "version": "6.1.0",
+  "version": "7.1.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -41,66 +41,75 @@
     "build": "cp package.json package.original.json || copy package.json package.original.json",
     "prepublishOnly": "pnpm build",
     "start": "node manager/run.mjs",
-    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
+    "test:fixture": "node --experimental-vm-modules node_modules/jest/bin/jest.js --config jest.fixture.config.mjs",
+    "test:mongodb": "node --experimental-vm-modules node_modules/jest/bin/jest.js --config jest.mongodb.config.mjs"
   },
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
-    "@ant-design/x": "2.7.0",
-    "@auth/core": "0.41.3",
-    "@hono/auth-js": "1.1.1",
-    "@hono/mcp": "0.3.0",
+    "@ant-design/x": "2.9.0",
+    "@better-auth/oauth-provider": "1.7.7",
+    "@better-auth/passkey": "1.7.7",
+    "@hono/mcp": "0.3.2",
     "@hono/node-server": "2.0.10",
     "@hono/vite-dev-server": "0.26.0",
-    "@lowdefy/actions-core": "6.1.0",
-    "@lowdefy/api": "6.1.0",
-    "@lowdefy/block-utils": "6.1.0",
-    "@lowdefy/blocks-aggrid": "6.1.0",
-    "@lowdefy/blocks-antd": "6.1.0",
-    "@lowdefy/blocks-antd-x": "6.1.0",
-    "@lowdefy/blocks-basic": "6.1.0",
-    "@lowdefy/blocks-echarts": "6.1.0",
-    "@lowdefy/blocks-loaders": "6.1.0",
-    "@lowdefy/blocks-markdown": "6.1.0",
-    "@lowdefy/blocks-tiptap": "6.1.0",
-    "@lowdefy/build": "6.1.0",
-    "@lowdefy/client": "6.1.0",
-    "@lowdefy/connection-axios-http": "6.1.0",
-    "@lowdefy/docs-content": "6.1.0",
-    "@lowdefy/engine": "6.1.0",
-    "@lowdefy/errors": "6.1.0",
-    "@lowdefy/helpers": "6.1.0",
-    "@lowdefy/layout": "6.1.0",
-    "@lowdefy/logger": "6.1.0",
-    "@lowdefy/node-utils": "6.1.0",
-    "@lowdefy/operators-change-case": "6.1.0",
-    "@lowdefy/operators-dayjs": "6.1.0",
-    "@lowdefy/operators-diff": "6.1.0",
-    "@lowdefy/operators-js": "6.1.0",
-    "@lowdefy/operators-mql": "6.1.0",
-    "@lowdefy/operators-nunjucks": "6.1.0",
-    "@lowdefy/operators-uuid": "6.1.0",
-    "@lowdefy/operators-yaml": "6.1.0",
-    "@lowdefy/plugin-next-auth": "6.1.0",
-    "@lowdefy/websockets-core": "6.1.0",
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "@tailwindcss/postcss": "4.3.1",
+    "@lowdefy/actions-core": "7.1.0",
+    "@lowdefy/api": "7.1.0",
+    "@lowdefy/block-utils": "7.1.0",
+    "@lowdefy/blocks-aggrid": "7.1.0",
+    "@lowdefy/blocks-antd": "7.1.0",
+    "@lowdefy/blocks-antd-x": "7.1.0",
+    "@lowdefy/blocks-basic": "7.1.0",
+    "@lowdefy/blocks-captcha": "7.1.0",
+    "@lowdefy/blocks-echarts": "7.1.0",
+    "@lowdefy/blocks-loaders": "7.1.0",
+    "@lowdefy/blocks-markdown": "7.1.0",
+    "@lowdefy/blocks-table": "7.1.0",
+    "@lowdefy/blocks-tiptap": "7.1.0",
+    "@lowdefy/build": "7.1.0",
+    "@lowdefy/client": "7.1.0",
+    "@lowdefy/connection-axios-http": "7.1.0",
+    "@lowdefy/connection-mongodb": "7.1.0",
+    "@lowdefy/docs-content": "7.1.0",
+    "@lowdefy/e2e-utils": "7.1.0",
+    "@lowdefy/engine": "7.1.0",
+    "@lowdefy/errors": "7.1.0",
+    "@lowdefy/helpers": "7.1.0",
+    "@lowdefy/layout": "7.1.0",
+    "@lowdefy/logger": "7.1.0",
+    "@lowdefy/node-utils": "7.1.0",
+    "@lowdefy/operators-change-case": "7.1.0",
+    "@lowdefy/operators-cron": "7.1.0",
+    "@lowdefy/operators-dayjs": "7.1.0",
+    "@lowdefy/operators-diff": "7.1.0",
+    "@lowdefy/operators-js": "7.1.0",
+    "@lowdefy/operators-mql": "7.1.0",
+    "@lowdefy/operators-nunjucks": "7.1.0",
+    "@lowdefy/operators-uuid": "7.1.0",
+    "@lowdefy/operators-yaml": "7.1.0",
+    "@lowdefy/plugin-better-auth": "7.1.0",
+    "@lowdefy/websockets-core": "7.1.0",
+    "@modelcontextprotocol/sdk": "1.31.0",
+    "@tailwindcss/postcss": "4.3.3",
     "@vitejs/plugin-react": "6.0.2",
-    "antd": "6.3.1",
+    "antd": "6.6.5",
+    "better-auth": "1.7.7",
     "chokidar": "3.5.3",
     "dayjs": "1.11.20",
     "dotenv": "16.3.1",
-    "hono": "4.13.5",
+    "hono": "4.13.7",
     "html-to-image": "1.11.13",
+    "mongodb": "7.2.0",
+    "mongodb-memory-server-core": "9.2.0",
     "opener": "1.5.2",
     "pino": "10.3.1",
     "playwright-core": "1.59.1",
-    "postcss": "8.5.23",
-    "process": "0.11.10",
+    "postal-mime": "3.0.0",
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "react-icons": "5.6.0",
+    "smtp-server": "3.19.13",
     "swr": "2.2.4",
-    "tailwindcss": "4.3.1",
+    "tailwindcss": "4.3.3",
     "tinykeys": "3.0.0",
     "uuid": "14.0.0",
     "vite": "8.0.16",
@@ -110,10 +119,14 @@
     "zod": "3.25.76"
   },
   "devDependencies": {
-    "jest": "28.1.3"
+    "@jest/globals": "28.1.3",
+    "@shelf/jest-mongodb": "4.3.2",
+    "jest": "28.1.3",
+    "jest-environment-jsdom": "28.1.3",
+    "nodemailer": "10.0.13"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "publishConfig": {
     "access": "public"

package/src/app.js

@@ -16,8 +16,8 @@
 
 import { Hono } from 'hono';
 import { bodyLimit } from 'hono/body-limit';
-import { initAuthConfig } from '@hono/auth-js';
 import { serveStatic } from '@hono/node-server/serve-static';
+import { runInCredentialScope } from '@lowdefy/node-utils';
 
 import agentHandler from './routes/agent.js';
 import apiContext from './middleware/apiContext.js';
@@ -30,6 +30,7 @@ import cronForwardHandler from './routes/cronForward.js';
 import cronHandler from './routes/cron.js';
 import detachedHandler from './routes/detached.js';
 import devInspectHandler from './routes/devInspect.js';
+import devRecordingHandler from './routes/devRecording.js';
 import devToolsHandler from './routes/devTools.js';
 import feedbackHandler from './routes/feedback.js';
 import docsAppMapHandler from './routes/docs/appMap.js';
@@ -39,13 +40,18 @@ import docsCheckpointsListHandler from './routes/docs/checkpointsList.js';
 import docsCheckpointsRevertHandler from './routes/docs/checkpointsRevert.js';
 import docsContentHandler from './routes/docs/content.js';
 import docsEvalOperatorHandler from './routes/docs/evalOperator.js';
+import docsEventsHandler from './routes/docs/events.js';
 import docsExamplesHandler from './routes/docs/examples.js';
 import docsFindHandler from './routes/docs/find.js';
 import docsIndexHandler from './routes/docs/index.js';
 import docsInspectStateHandler from './routes/docs/inspectState.js';
+import docsJourneyHandler from './routes/docs/journey.js';
+import docsMutantsHandler from './routes/docs/mutants.js';
 import docsLoadStateHandler from './routes/docs/loadState.js';
 import docsMcpHandler from './routes/docs/mcp.js';
 import docsPageConfigHandler from './routes/docs/pageConfig.js';
+import docsRestartHandler from './routes/docs/restart.js';
+import docsRunEndpointHandler from './routes/docs/runEndpoint.js';
 import docsRunRequestHandler from './routes/docs/runRequest.js';
 import docsSnapshotStateHandler from './routes/docs/snapshotState.js';
 import docsStateCheckpointsListHandler from './routes/docs/stateCheckpointsList.js';
@@ -53,23 +59,41 @@ import docsPluginDocHandler from './routes/docs/pluginDoc.js';
 import docsPluginsHandler from './routes/docs/plugins.js';
 import docsSchemaHandler from './routes/docs/schema.js';
 import docsScreenshotHandler from './routes/docs/screenshot.js';
+import docsIconsHandler from './routes/docs/icons.js';
 import docsSearchHandler from './routes/docs/search.js';
 import docsTypesHandler from './routes/docs/types.js';
 import endpointsHandler from './routes/endpoints.js';
-import getAuthConfig from '../lib/server/auth/getAuthConfig.js';
+import getAuth from '../lib/server/auth/getAuth.js';
+import getStrategies from '../lib/server/auth/getStrategies.js';
+import getMockUser from '../lib/server/auth/getMockUser.js';
 import jitPageHandler from './routes/jitPage.js';
+import localDevToolsOnly from './middleware/localDevToolsOnly.js';
 import lowdefyConfig from '../lib/build/config.js';
 import mcpHandler from './routes/mcp.js';
+import mountDevPageRoutes from './routes/mountDevPageRoutes.js';
+import mountOauthDiscovery from './routes/mountOauthDiscovery.js';
+import noStore from './middleware/noStore.js';
+import wellKnownFallbackHandler from './routes/wellKnownFallback.js';
 import pingHandler from './routes/ping.js';
 import reloadHandler from './routes/reload.js';
 import renderDevPage from './html/renderDevPage.js';
 import requestHandler from './routes/request.js';
+import requestTimeout from './middleware/requestTimeout.js';
 import rootHandler from './routes/root.js';
+import staleFlag from './middleware/staleFlag.js';
+import stampCaller from './middleware/stampCaller.js';
+import startIdleGc from '../lib/server/startIdleGc.js';
+import getDocsIndex from '../lib/docs/getDocsIndex.js';
 import usageHandler from './routes/usage.js';
+import userHandler from './routes/user.js';
 import websocketHandler from './routes/websocket.js';
 
 const basePath = lowdefyConfig.basePath ?? '';
 
+// Same default as the production server, so a request that would time out in production (a 504
+// the page shows as a generic error, beside the other requests' results) also times out in dev.
+const requestTimeoutMs = lowdefyConfig.requestTimeout ?? 30000;
+
 // Dev Hono app — mounted into Vite via @hono/vite-dev-server (Vite owns HTTP
 // and serves /client/* modules with HMR; everything else lands here).
 // No compression in dev (parity with the old next.config compress: false,
@@ -78,6 +102,10 @@ function createApp() {
   const app = basePath ? new Hono().basePath(basePath) : new Hono();
   const logger = createLogger({ server: 'lowdefy-dev' });
 
+  // Each request runs in its own credential scope: what it marks with _credential is scrubbed
+  // from every log line written while it is handled.
+  app.use('*', (c, next) => runInCredentialScope(next));
+
   // No api context: SSE/health routes had no apiWrapper before.
   app.get('/api/reload', reloadHandler);
   app.get('/api/ping', pingHandler);
@@ -88,34 +116,59 @@ function createApp() {
   // /lowdefy-feedback is a reserved page-path prefix in dev, like /lowdefy-docs.
   app.post('/lowdefy-feedback', feedbackHandler);
 
-  // Auth config must be registered before the /lowdefy-docs routes: Hono
-  // middleware only applies to routes registered after it, and run-request/
-  // eval-operator build a full Lowdefy context whose getSession(c) reads the
-  // authConfig this middleware sets. It does not protect any route — it only
-  // makes the auth config available on the Hono context.
-  if (authJson.configured === true) {
-    app.use(
-      '*',
-      initAuthConfig(() => getAuthConfig({ logger }))
-    );
+  const mockUser = getMockUser();
+  if (authJson.configured === true && !mockUser) {
+    // Construct the BetterAuth instance and strategy verifiers at startup so
+    // config errors fail boot instead of the first request, and so the
+    // process-memoized singletons capture the base logger rather than the
+    // first request's rid-scoped child.
+    getAuth({ logger });
+    getStrategies({ logger });
   }
 
+  mountOauthDiscovery({
+    app,
+    auth: authJson.configured === true && !mockUser ? getAuth({ logger }) : null,
+  });
+  app.all('/.well-known/*', wellKnownFallbackHandler);
+
   // Docs and MCP endpoint for AI coding agents — always on in dev. Serves
   // schemas/examples/docs for every installed plugin (core and local) plus
   // the extracted core docs (@lowdefy/docs-content). Mounted outside /api/*
   // so it can't clash with user API endpoints; /lowdefy-docs is a reserved page
   // prefix in dev. The handlers need no auth protection or api context —
-  // they read build artifacts and node_modules directly — but run-request
-  // and eval-operator read the caller's session, hence initAuthConfig above.
+  // they read build artifacts and node_modules directly — but run-request,
+  // run-endpoint and eval-operator build a full Lowdefy context (createLowdefyContext),
+  // which resolves the caller from the request headers via resolveAuthentication.
+  // The MCP transport is registered before staleFlag on purpose: hono
+  // dispatches in registration order, so the stale middleware never sees a
+  // JSON-RPC envelope. MCP carries its own stale notice, prepended to each
+  // tool result in createDocsMcpServer — merging fields into the envelope
+  // instead would put unknown members on a strictly-validated message.
+  // localDevToolsOnly comes first of all: it refuses requests a browser sends
+  // on behalf of another site. Registered twice because hono's `/*` pattern
+  // does not match the bare path.
+  app.use('/lowdefy-docs', localDevToolsOnly());
+  app.use('/lowdefy-docs/*', localDevToolsOnly());
   app.all('/lowdefy-docs/mcp', docsMcpHandler);
+  // Flags every other docs response while the last build failed. Registered
+  // twice: hono's `/*` pattern does not match the bare path.
+  app.use('/lowdefy-docs', staleFlag());
+  app.use('/lowdefy-docs/*', staleFlag());
   app.get('/lowdefy-docs', docsIndexHandler);
   app.get('/lowdefy-docs/build-status', docsBuildStatusHandler);
-  app.get('/lowdefy-docs/page-config/:pageId', docsPageConfigHandler);
+  // Push channel for non-MCP clients. Must sit above the `/lowdefy-docs/:kind`
+  // catch-all, which would otherwise treat "events" as a type kind.
+  app.get('/lowdefy-docs/events', docsEventsHandler);
+  app.get('/lowdefy-docs/page-config/:pageId{.+}', docsPageConfigHandler);
   app.get('/lowdefy-docs/find/:id', docsFindHandler);
-  app.get('/lowdefy-docs/screenshot/:pageId', docsScreenshotHandler);
-  app.get('/lowdefy-docs/inspect-state/:pageId', docsInspectStateHandler);
+  app.get('/lowdefy-docs/screenshot/:pageId{.+}', docsScreenshotHandler);
+  app.post('/lowdefy-docs/journey', docsJourneyHandler);
+  app.post('/lowdefy-docs/mutants', docsMutantsHandler);
+  app.get('/lowdefy-docs/inspect-state/:pageId{.+}', docsInspectStateHandler);
   app.post('/lowdefy-docs/eval-operator', docsEvalOperatorHandler);
   app.post('/lowdefy-docs/run-request', docsRunRequestHandler);
+  app.post('/lowdefy-docs/run-endpoint', docsRunEndpointHandler);
   app.get('/lowdefy-docs/app-map', docsAppMapHandler);
   app.get('/lowdefy-docs/checkpoints', docsCheckpointsListHandler);
   app.post('/lowdefy-docs/checkpoints', docsCheckpointsCreateHandler);
@@ -123,21 +176,71 @@ function createApp() {
   app.get('/lowdefy-docs/state-checkpoints', docsStateCheckpointsListHandler);
   app.post('/lowdefy-docs/state-checkpoints/snapshot', docsSnapshotStateHandler);
   app.post('/lowdefy-docs/state-checkpoints/load', docsLoadStateHandler);
+  app.post('/lowdefy-docs/restart', docsRestartHandler);
   // Live-tab inspection channel: dev tabs (client/Inspector.jsx) answer
   // targeted SSE events by posting results here; GET lists connected tabs
   // and serves checkpoint parts for the ?_checkpoint bootstrap.
+  // The live-tab channel acts on the developer's open tabs and loads recorded
+  // request mocks - the same cross-site guard as the docs tools.
+  app.use('/api/dev-inspect', localDevToolsOnly());
+  app.use('/api/dev-inspect/*', localDevToolsOnly());
   app.all('/api/dev-inspect', devInspectHandler);
   app.all('/api/dev-inspect/*', devInspectHandler);
+  // The dev recorder (client/Recorder.jsx) posts interaction records here.
+  // It needs no Lowdefy context, and registering it before apiContext keeps
+  // it out of the request timeout list.
+  app.use('/api/dev-recording', localDevToolsOnly());
+  app.post('/api/dev-recording', bodyLimit({ maxSize: 1024 * 1024 }), devRecordingHandler);
+  // Built now so the first doc search does not pay for reading every plugin
+  // and module's docs.
+  getDocsIndex();
   app.get('/lowdefy-docs/plugins', docsPluginsHandler);
   app.get('/lowdefy-docs/schema/:kind/:type', docsSchemaHandler);
   app.get('/lowdefy-docs/examples/:type', docsExamplesHandler);
   app.get('/lowdefy-docs/search', docsSearchHandler);
+  app.get('/lowdefy-docs/icons', docsIconsHandler);
   app.get('/lowdefy-docs/plugin-doc/:package{.+}', docsPluginDocHandler);
   app.get('/lowdefy-docs/content/:slug{.+}', docsContentHandler);
   app.get('/lowdefy-docs/:kind', docsTypesHandler);
 
+  // Only the routes that run app logic: JIT page builds, the docs/MCP routes and the SSE streams
+  // are dev-only and can legitimately run longer than any production request.
+  if (requestTimeoutMs > 0) {
+    const timeoutMiddleware = requestTimeout({ timeoutMs: requestTimeoutMs });
+    [
+      '/api/request/*',
+      '/api/endpoints/*',
+      '/api/cron/*',
+      '/api/cron-forward/*',
+      '/api/detached/*',
+    ].forEach((route) => app.use(route, timeoutMiddleware));
+  }
+
   app.use('/api/*', apiContext());
-  app.use('/api/auth/*', authMiddleware());
+  // Responses that carry the caller's data are never stored by a browser or proxy cache,
+  // as in the production server. /api/root is the dev form of the root config the
+  // production page embeds. The page routes use the same middleware.
+  const noStoreMiddleware = noStore();
+  ['/api/root', '/api/page/*', '/api/user', '/api/request/*', '/api/endpoints/*'].forEach((route) =>
+    app.use(route, noStoreMiddleware)
+  );
+  // Unified dev get-session: createLowdefyContext resolves the mock or headless
+  // caller into context.user on every path, so read it here rather than
+  // re-deriving the precedence. context.user is only absent in the real-engine
+  // case (the developer's own browser), which must fall through to BetterAuth.
+  // Registered before the /api/auth/* mount so this exact path wins while every
+  // other auth route still reaches the engine.
+  app.get('/api/auth/get-session', async (c, next) => {
+    const context = c.get('lowdefyContext');
+    if (context.user) return c.json({ session: { id: 'dev' }, user: context.user });
+    return next();
+  });
+  app.use('/api/auth/*', authMiddleware({ logger }));
+  // The caller each page, request and endpoint response was answered as: the
+  // client reloads when it differs from the caller it renders (stampCaller).
+  app.use('/api/request/*', stampCaller());
+  app.use('/api/endpoints/*', stampCaller());
+  app.use('/api/page/*', stampCaller());
   app.get('/api/root', rootHandler);
   app.get('/api/page/*', jitPageHandler);
   app.all('/api/request/*', requestHandler);
@@ -152,6 +255,7 @@ function createApp() {
   app.all('/api/agent/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), agentHandler);
   app.all('/api/mcp', bodyLimit({ maxSize: 10 * 1024 * 1024 }), mcpHandler);
   app.get('/api/websocket', websocketHandler);
+  app.get('/api/user', userHandler);
 
   // User public assets (icons, images). Vite serves /client modules itself.
   app.use(
@@ -164,12 +268,19 @@ function createApp() {
 
   // Every page path renders the same shell — the client fetches config and
   // handles home/404 routing, exactly like the old dev pages router did.
-  app.get('/', (c) => renderDevPage(c, { basePath }));
-  app.get('/:rest{.+}', (c) => renderDevPage(c, { basePath }));
+  // The context middleware runs here too (mirroring the production server)
+  // so the shell can inject the resolved caller — without it the client's
+  // _user never carries roles/organization_id under `lowdefy dev`.
+  app.use('/*', apiContext());
+  // Registered after the static middleware, which answers a file without calling next().
+  app.use('/*', noStoreMiddleware);
+  mountDevPageRoutes({ app, renderPage: (c) => renderDevPage(c, { basePath }) });
 
   app.onError(createErrorHandler({ basePath, logger }));
 
   return app;
 }
 
+startIdleGc({ configDirectory: process.env.LOWDEFY_DIRECTORY_CONFIG });
+
 export default createApp();