@lowdefy/server-e2e 5.6.0 → 6.0.0

package/src/lib/safeScriptJson.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Escape characters that could break out of the enclosing <script> tag or
+// terminate a JS string literal. Used to defuse the js/bad-code-sanitization
+// class of injection for values embedded into inline scripts and the
+// application/json config script.
+const SCRIPT_ESCAPES = {
+  '<': '\\u003C',
+  '>': '\\u003E',
+  '\b': '\\b',
+  '\f': '\\f',
+  '\n': '\\n',
+  '\r': '\\r',
+  '\t': '\\t',
+  '\0': '\\0',
+  '\u2028': '\\u2028',
+  '\u2029': '\\u2029',
+};
+
+function safeScriptJson(value) {
+  return JSON.stringify(value).replace(/[<>\b\f\n\r\t\0\u2028\u2029]/g, (c) => SCRIPT_ESCAPES[c]);
+}
+
+export default safeScriptJson;

package/src/middleware/apiContext.js

@@ -0,0 +1,81 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import path from 'node:path';
+import { createApiContext } from '@lowdefy/api';
+import { v4 as uuid } from 'uuid';
+
+import agents from '../../build/plugins/agents.js';
+import appMeta from '../../lib/build/appMeta.js';
+import config from '../../lib/build/config.js';
+import connections from '../../build/plugins/connections.js';
+import createHandleError from '../../lib/server/log/createHandleError.js';
+import createLogger from '../../lib/server/log/createLogger.js';
+import fileCache from '../../lib/server/fileCache.js';
+import getE2eSecrets from '../../lib/server/getE2eSecrets.js';
+import getSession from '../../lib/server/auth/session.js';
+import i18nConfig from '../../lib/build/i18n.js';
+import jsMap from '../../build/plugins/operators/serverJsMap.js';
+import logRequest from '../../lib/server/log/logRequest.js';
+import operators from '../../build/plugins/operators/server.js';
+import websockets from '../../build/plugins/websockets.js';
+
+const secrets = getE2eSecrets();
+
+// Replaces lib/server/apiWrapper.js. Builds the request context consumed by
+// @lowdefy/api functions. Errors thrown by handlers are routed by Hono to the
+// app-level error handler (src/middleware/errorHandler.js), which reads this
+// context back from the Hono context.
+function apiContext() {
+  return async function apiContextMiddleware(c, next) {
+    // The page-route mount ('/*') also matches /api/* paths that already
+    // built a context — never build twice for one request.
+    if (c.get('lowdefyContext')) {
+      return next();
+    }
+    const rid = uuid();
+    const context = {
+      rid,
+      agents,
+      appMeta,
+      buildDirectory: path.join(process.cwd(), 'build'),
+      config,
+      configDirectory: process.env.LOWDEFY_DIRECTORY_CONFIG || process.cwd(),
+      connections,
+      fileCache,
+      headers: c.req.header(),
+      i18n: i18nConfig,
+      jsMap,
+      logger: createLogger({ rid }),
+      operators,
+      req: {
+        url: c.req.path,
+        method: c.req.method,
+        hostname: c.req.header('host'),
+      },
+      secrets,
+      websockets,
+    };
+    context.handleError = createHandleError({ context });
+    context.session = getSession(c);
+    createApiContext(context);
+    logRequest({ context });
+    c.set('lowdefyContext', context);
+    return next();
+  };
+}
+
+export default apiContext;

package/src/middleware/errorHandler.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { redactErrorResponse } from '@lowdefy/api';
+
+// Hono routes every handler error to the app-level error handler — upstream
+// middleware try/catch never sees them (compose catches per dispatch level).
+// API routes get the serialized error JSON the old apiWrapper returned;
+// page routes get a plain 500.
+function createErrorHandler({ basePath = '', logger }) {
+  return async function errorHandler(error, c) {
+    const context = c.get('lowdefyContext');
+    if (context) {
+      await context.handleError(error);
+    } else {
+      logger.error(error);
+    }
+    const path = basePath ? c.req.path.replace(basePath, '') : c.req.path;
+    if (path.startsWith('/api/')) {
+      return c.json(redactErrorResponse(context, error), 500);
+    }
+    return c.text('Internal Server Error', 500);
+  };
+}
+
+export default createErrorHandler;

package/src/routes/apiPage.js

@@ -0,0 +1,37 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { getPageConfig } from '@lowdefy/api';
+
+import getPathSegments from '../lib/getPathSegments.js';
+
+// Page config as JSON for client-side SPA navigation. The first page load is
+// served embedded in the HTML; subsequent navigations fetch from here.
+async function apiPageHandler(c) {
+  const context = c.get('lowdefyContext');
+  const pageId = getPathSegments(c, '/api/page/').join('/');
+  // The client forwards its current query string on the fetch so Dynamic block
+  // resolution sees the same urlQuery as an initial HTML load.
+  const pageConfig = await getPageConfig(context, { pageId, urlQuery: c.req.query() });
+  if (!pageConfig) {
+    context.logger.info({ event: 'api_page_not_found', pageId });
+    return c.json({ pageConfig: null }, 404);
+  }
+  context.logger.info({ event: 'api_page_view', pageId });
+  return c.json({ pageConfig });
+}
+
+export default apiPageHandler;

package/{pages/api/client-error.js → src/routes/clientError.js}

@@ -16,36 +16,32 @@
 
 import { logClientError } from '@lowdefy/api';
 
-import apiWrapper from '../../lib/server/apiWrapper.js';
-
-async function handler({ context, req, res }) {
-  if (req.method !== 'POST') {
+async function clientErrorHandler(c) {
+  if (c.req.method !== 'POST') {
     throw new Error('Only POST requests are supported.');
   }
+  const context = c.get('lowdefyContext');
 
-  const origin = req.headers.origin;
+  const origin = c.req.header('origin');
   if (!origin) {
-    res.status(403).json({ error: 'Forbidden' });
-    return;
+    return c.json({ error: 'Forbidden' }, 403);
   }
   try {
-    if (new URL(origin).host !== req.headers.host) {
-      res.status(403).json({ error: 'Forbidden' });
-      return;
+    if (new URL(origin).host !== c.req.header('host')) {
+      return c.json({ error: 'Forbidden' }, 403);
     }
   } catch {
-    res.status(403).json({ error: 'Forbidden' });
-    return;
+    return c.json({ error: 'Forbidden' }, 403);
   }
 
+  const body = await c.req.json();
   // Strip received from payload — prod doesn't need it for schema validation
-  if (req.body?.['~e']) {
-    delete req.body['~e'].received;
+  if (body?.['~e']) {
+    delete body['~e'].received;
   }
-  // eslint-disable-next-line no-unused-vars
-  const { error, ...response } = await logClientError(context, req.body);
+  await logClientError(context, body);
 
-  res.status(200).json({ success: true });
+  return c.json({ success: true });
 }
 
-export default apiWrapper(handler);
+export default clientErrorHandler;

package/{pages/api/endpoints/[...endpointId].js → src/routes/endpoints.js}

@@ -16,17 +16,18 @@
 
 import { callEndpoint } from '@lowdefy/api';
 
-import apiWrapper from '../../../lib/server/apiWrapper.js';
+import getPathSegments from '../lib/getPathSegments.js';
 
-async function handler({ context, req, res }) {
-  if (req.method !== 'POST') {
+async function endpointsHandler(c) {
+  if (c.req.method !== 'POST') {
     throw new Error('Only POST requests are supported.');
   }
-  const endpointId = req.query.endpointId.join('/');
-  const { blockId, payload, pageId } = req.body;
+  const context = c.get('lowdefyContext');
+  const endpointId = getPathSegments(c, '/api/endpoints/').join('/');
+  const { blockId, payload, pageId } = await c.req.json();
   context.logger.info({ event: 'call_api_endpoint', blockId, endpointId, pageId });
   const response = await callEndpoint(context, { blockId, endpointId, pageId, payload });
-  res.status(200).json(response);
+  return c.json(response);
 }
 
-export default apiWrapper(handler);
+export default endpointsHandler;

package/{pages/api/request/[...path].js → src/routes/request.js}

@@ -16,23 +16,23 @@
 
 import { callRequest } from '@lowdefy/api';
 
-import apiWrapper from '../../../lib/server/apiWrapper.js';
+import getPathSegments from '../lib/getPathSegments.js';
 
-async function handler({ context, req, res }) {
-  if (req.method !== 'POST') {
+async function requestHandler(c) {
+  if (c.req.method !== 'POST') {
     throw new Error('Only POST requests are supported.');
   }
-  const segments = req.query.path;
-  if (!Array.isArray(segments) || segments.length < 2) {
-    res.status(400).json({ error: 'Invalid request path' });
-    return;
+  const context = c.get('lowdefyContext');
+  const segments = getPathSegments(c, '/api/request/');
+  if (segments.length < 2) {
+    return c.json({ error: 'Invalid request path' }, 400);
   }
   const requestId = segments[segments.length - 1];
   const pageId = segments.slice(0, -1).join('/');
-  const { actionId, blockId, payload } = req.body;
+  const { actionId, blockId, payload } = await c.req.json();
   context.logger.info({ event: 'call_request', pageId, requestId, blockId, actionId });
   const response = await callRequest(context, { blockId, pageId, payload, requestId });
-  res.status(200).json(response);
+  return c.json(response);
 }
 
-export default apiWrapper(handler);
+export default requestHandler;

package/{pages/api/auth/session.js → src/routes/sessionMock.js}

@@ -14,10 +14,9 @@
   limitations under the License.
 */
 
-import apiWrapper from '../../../lib/server/apiWrapper.js';
-
-async function handler({ context, req, res }) {
-  return res.status(200).json(context.session ?? {});
+async function sessionMockHandler(c) {
+  const context = c.get('lowdefyContext');
+  return c.json(context.session ?? {});
 }
 
-export default apiWrapper(handler);
+export default sessionMockHandler;

package/{pages/api → src/routes}/usage.js

@@ -14,20 +14,23 @@
   limitations under the License.
 */
 
-import packageJson from '../../package.json';
-import apiWrapper from '../../lib/server/apiWrapper.js';
+import fs from 'node:fs';
+import path from 'node:path';
 
-async function handler({ context, req, res }) {
-  if (req.method !== 'POST') {
+const packageJson = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
+
+async function usageHandler(c) {
+  if (c.req.method !== 'POST') {
     throw new Error('Only POST requests are supported.');
   }
-  const { user, machine } = req.body;
-  const host = req.headers.host;
+  const context = c.get('lowdefyContext');
+  const { user, machine } = await c.req.json();
+  const host = c.req.header('host');
   context.logger.info({ event: 'log_usage', user, machine });
 
   const timestamp = Date.now();
 
-  return res.status(200).json({
+  return c.json({
     offline: false,
     data: {
       gitSha: context.appMeta.gitSha,
@@ -40,4 +43,4 @@ async function handler({ context, req, res }) {
   });
 }
 
-export default apiWrapper(handler);
+export default usageHandler;

package/src/routes/websocket.js

@@ -0,0 +1,46 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { upgradeWebSocket } from '@hono/node-server';
+import { createChannelRegistry, createWebSocketConnection } from '@lowdefy/api';
+
+// One registry per server process — channels and their running source
+// resolvers are shared across all websocket connections on this instance.
+const registry = createChannelRegistry();
+
+const websocketHandler = upgradeWebSocket((c) => {
+  const context = c.get('lowdefyContext');
+  let connection;
+  return {
+    onOpen(event, ws) {
+      connection = createWebSocketConnection(context, {
+        registry,
+        send: (message) => ws.send(message),
+      });
+    },
+    onMessage(event) {
+      connection?.handleMessage(event.data);
+    },
+    onClose() {
+      connection?.close();
+    },
+    onError(event) {
+      context.logger.debug({ event: 'ws_error' }, String(event?.error ?? 'WebSocket error'));
+    },
+  };
+});
+
+export default websocketHandler;

package/vite.config.js

@@ -0,0 +1,45 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+
+// basePath from the Lowdefy build — assets are served under it.
+let basePath = '';
+try {
+  const config = JSON.parse(fs.readFileSync('./build/config.json', 'utf8'));
+  basePath = config.basePath ?? '';
+} catch (e) {
+  // No build yet (e.g. editor tooling) — default base.
+}
+
+export default defineConfig(({ mode }) => ({
+  base: `${basePath}/`,
+  plugins: [react()],
+  define: {
+    // Vite does not replace process.env.NODE_ENV inside dependencies —
+    // plugin and client code branch on it.
+    'process.env.NODE_ENV': JSON.stringify(mode === 'production' ? 'production' : 'development'),
+  },
+  build: {
+    outDir: 'dist/client',
+    manifest: true,
+    rollupOptions: {
+      input: 'client/main.jsx',
+    },
+  },
+}));

package/.eslintrc.yaml

@@ -1 +0,0 @@
-extends: 'plugin:@next/next/core-web-vitals'

package/lib/client/Page.js

@@ -1,57 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import React from 'react';
-
-import { useRouter } from 'next/router';
-import Client from '@lowdefy/client';
-import Head from 'next/head';
-import Link from 'next/link';
-
-import actions from '../../build/plugins/actions.js';
-import blockMetas from '../../build/plugins/blockMetas.json';
-import blocks from '../../build/plugins/blocks.js';
-import icons from '../../build/plugins/icons.js';
-import operators from '../../build/plugins/operators/client.js';
-import jsMap from '../../build/plugins/operators/clientJsMap.js';
-
-const Page = ({ auth, lowdefy, pageConfig, rootConfig }) => {
-  const router = useRouter();
-  return (
-    <Client
-      auth={auth}
-      Components={{ Head, Link }}
-      config={{
-        pageConfig,
-        rootConfig,
-      }}
-      jsMap={jsMap}
-      lowdefy={lowdefy}
-      router={router}
-      types={{
-        actions,
-        blockMetas,
-        blocks,
-        icons,
-        operators,
-      }}
-      stage="e2e"
-      window={window}
-    />
-  );
-};
-
-export default Page;

package/lib/server/serverSidePropsWrapper.js

@@ -1,64 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import path from 'path';
-import { createApiContext } from '@lowdefy/api';
-import { v4 as uuid } from 'uuid';
-
-import appMeta from '../build/appMeta.js';
-import config from '../build/config.js';
-import createLogger from './log/createLogger.js';
-import fileCache from './fileCache.js';
-import getServerSession from './auth/getServerSession.js';
-import createHandleError from './log/createHandleError.js';
-import logRequest from './log/logRequest.js';
-
-function serverSidePropsWrapper(handler) {
-  return async function wrappedHandler(nextContext) {
-    const context = {
-      // Important to give absolute path so Next can trace build files
-      rid: uuid(),
-      appMeta,
-      buildDirectory: path.join(process.cwd(), 'build'),
-      configDirectory: process.env.LOWDEFY_DIRECTORY_CONFIG || process.cwd(),
-      config,
-      fileCache,
-      handleError: async (err) => {
-        console.error(err);
-      },
-      headers: nextContext?.req?.headers,
-      logger: console,
-      nextContext,
-      req: nextContext?.req,
-      res: nextContext?.res,
-    };
-    try {
-      context.logger = createLogger({ rid: context.rid });
-      context.handleError = createHandleError({ context });
-      context.session = getServerSession(context);
-      createApiContext(context);
-      logRequest({ context });
-      // Await here so that if handler throws it is caught.
-      const response = await handler({ context, nextContext });
-      return response;
-    } catch (error) {
-      await context.handleError(error);
-      throw error;
-    }
-  };
-}
-
-export default serverSidePropsWrapper;

package/next.config.js

@@ -1,20 +0,0 @@
-const lowdefyConfig = require('./build/config.json');
-const blockPackages = require('./build/blockPackages.json');
-const serverExternalPackages = require('./build/serverExternalPackages.json');
-
-const nextConfig = {
-  basePath: lowdefyConfig.basePath,
-  reactStrictMode: true,
-  transpilePackages: [
-    '@lowdefy/client',
-    '@ant-design/x',
-    '@ant-design/x-markdown',
-    ...blockPackages,
-  ],
-  serverExternalPackages,
-  turbopack: {},
-  poweredByHeader: false,
-  output: process.env.LOWDEFY_BUILD_OUTPUT_STANDALONE === '1' ? 'standalone' : undefined,
-};
-
-module.exports = nextConfig;

package/pages/404.js

@@ -1,49 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import path from 'path';
-import { createApiContext, getPageConfig, getRootConfig } from '@lowdefy/api';
-
-import appMeta from '../lib/build/appMeta.js';
-import config from '../lib/build/config.js';
-import fileCache from '../lib/server/fileCache.js';
-import Page from '../lib/client/Page.js';
-
-export async function getStaticProps() {
-  // Important to give absolute path so Next can trace build files
-  const context = {
-    appMeta,
-    buildDirectory: path.join(process.cwd(), 'build'),
-    config,
-    fileCache,
-    logger: console, // TODO: pino or console or 🤷‍♂️?
-  };
-  createApiContext(context);
-
-  const [rootConfig, pageConfig] = await Promise.all([
-    getRootConfig(context),
-    getPageConfig(context, { pageId: '404' }),
-  ]);
-
-  return {
-    props: {
-      pageConfig,
-      rootConfig,
-    },
-  };
-}
-
-export default Page;