@lowdefy/server-e2e 6.1.0 → 7.0.0

package/package.original.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server-e2e",
-  "version": "6.1.0",
+  "version": "7.0.0",
   "license": "Apache-2.0",
   "description": "Lowdefy e2e testing server with cookie-based user injection",
   "homepage": "https://lowdefy.com",
@@ -49,56 +49,57 @@
   },
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
-    "@ant-design/x": "2.7.0",
+    "@ant-design/x": "2.9.0",
     "@hono/node-server": "2.0.10",
-    "@lowdefy/actions-core": "6.1.0",
-    "@lowdefy/api": "6.1.0",
-    "@lowdefy/block-utils": "6.1.0",
-    "@lowdefy/blocks-aggrid": "6.1.0",
-    "@lowdefy/blocks-antd": "6.1.0",
-    "@lowdefy/blocks-antd-x": "6.1.0",
-    "@lowdefy/blocks-basic": "6.1.0",
-    "@lowdefy/blocks-echarts": "6.1.0",
-    "@lowdefy/blocks-loaders": "6.1.0",
-    "@lowdefy/blocks-markdown": "6.1.0",
-    "@lowdefy/blocks-tiptap": "6.1.0",
-    "@lowdefy/client": "6.1.0",
-    "@lowdefy/connection-axios-http": "6.1.0",
-    "@lowdefy/connection-mongodb": "6.1.0",
-    "@lowdefy/errors": "6.1.0",
-    "@lowdefy/helpers": "6.1.0",
-    "@lowdefy/layout": "6.1.0",
-    "@lowdefy/logger": "6.1.0",
-    "@lowdefy/node-utils": "6.1.0",
-    "@lowdefy/operators-js": "6.1.0",
-    "@lowdefy/operators-nunjucks": "6.1.0",
-    "@lowdefy/operators-uuid": "6.1.0",
-    "@lowdefy/websockets-core": "6.1.0",
-    "@tailwindcss/postcss": "4.3.1",
+    "@lowdefy/actions-core": "7.0.0",
+    "@lowdefy/api": "7.0.0",
+    "@lowdefy/block-utils": "7.0.0",
+    "@lowdefy/blocks-aggrid": "7.0.0",
+    "@lowdefy/blocks-antd": "7.0.0",
+    "@lowdefy/blocks-antd-x": "7.0.0",
+    "@lowdefy/blocks-basic": "7.0.0",
+    "@lowdefy/blocks-captcha": "7.0.0",
+    "@lowdefy/blocks-echarts": "7.0.0",
+    "@lowdefy/blocks-loaders": "7.0.0",
+    "@lowdefy/blocks-markdown": "7.0.0",
+    "@lowdefy/blocks-table": "7.0.0",
+    "@lowdefy/blocks-tiptap": "7.0.0",
+    "@lowdefy/client": "7.0.0",
+    "@lowdefy/connection-axios-http": "7.0.0",
+    "@lowdefy/connection-mongodb": "7.0.0",
+    "@lowdefy/errors": "7.0.0",
+    "@lowdefy/helpers": "7.0.0",
+    "@lowdefy/layout": "7.0.0",
+    "@lowdefy/logger": "7.0.0",
+    "@lowdefy/node-utils": "7.0.0",
+    "@lowdefy/operators-js": "7.0.0",
+    "@lowdefy/operators-nunjucks": "7.0.0",
+    "@lowdefy/operators-uuid": "7.0.0",
+    "@lowdefy/websockets-core": "7.0.0",
+    "@tailwindcss/postcss": "4.3.3",
     "@vitejs/plugin-react": "6.0.2",
-    "antd": "6.3.1",
+    "antd": "6.6.5",
     "dayjs": "1.11.20",
-    "hono": "4.13.5",
-    "pino": "10.3.1",
+    "hono": "4.13.7",
+    "lightningcss": "1.32.0",
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "react-icons": "5.6.0",
-    "tailwindcss": "4.3.1",
+    "tailwindcss": "4.3.3",
     "uuid": "14.0.0",
     "vite": "8.0.16",
     "ws": "8.21.0"
   },
   "devDependencies": {
     "@jest/globals": "28.1.3",
-    "@lowdefy/build": "6.1.0",
-    "@tailwindcss/postcss": "4.3.1",
+    "@lowdefy/build": "7.0.0",
+    "@tailwindcss/postcss": "4.3.3",
     "jest": "28.1.3",
-    "tailwindcss": "4.3.1",
+    "tailwindcss": "4.3.3",
     "yaml": "2.9.0",
     "yargs": "18.0.0"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "publishConfig": {
     "access": "public"

package/src/app.js

@@ -17,18 +17,22 @@
 import { Hono } from 'hono';
 import { compress } from 'hono/compress';
 import { serveStatic } from '@hono/node-server/serve-static';
+import { runInCredentialScope } from '@lowdefy/node-utils';
 
 import apiContext from './middleware/apiContext.js';
 import apiPageHandler from './routes/apiPage.js';
 import clientErrorHandler from './routes/clientError.js';
 import createErrorHandler from './middleware/errorHandler.js';
 import createLogger from '../lib/server/log/createLogger.js';
+import e2eIdentityHandler from './routes/e2eIdentity.js';
 import endpointsHandler from './routes/endpoints.js';
+import mountPageRoutes from './routes/mountPageRoutes.js';
 import lowdefyConfig from '../lib/build/config.js';
 import renderPage from './html/renderPage.js';
 import requestHandler from './routes/request.js';
 import sessionMockHandler from './routes/sessionMock.js';
 import usageHandler from './routes/usage.js';
+import userHandler from './routes/user.js';
 import websocketHandler from './routes/websocket.js';
 
 const basePath = lowdefyConfig.basePath ?? '';
@@ -37,6 +41,10 @@ function createApp() {
   const app = basePath ? new Hono().basePath(basePath) : new Hono();
   const logger = createLogger({ server: 'lowdefy' });
 
+  // Each request runs in its own credential scope: what it marks with _credential is scrubbed
+  // from every log line written while it is handled.
+  app.use('*', (c, next) => runInCredentialScope(next));
+
   app.use('*', async (c, next) => {
     if (c.req.path.includes('/api/websocket')) {
       return next();
@@ -45,15 +53,16 @@ function createApp() {
   });
 
   app.use('/api/*', apiContext());
-  // Mock session endpoint — reads the lowdefy_e2e_user cookie; also the
-  // e2e harness health check (e2e-utils polls /api/auth/session).
+  // Mock session endpoint — reads the lowdefy_e2e_user cookie.
   app.get('/api/auth/session', sessionMockHandler);
+  app.get('/api/e2e/identity', e2eIdentityHandler);
   app.all('/api/request/*', requestHandler);
   app.all('/api/endpoints/*', endpointsHandler);
   app.all('/api/client-error', clientErrorHandler);
   app.all('/api/usage', usageHandler);
   app.get('/api/websocket', websocketHandler);
   app.get('/api/page/*', apiPageHandler);
+  app.get('/api/user', userHandler);
 
   // Vite build output (includes public/ via Vite's publicDir copy). Falls
   // through to the page routes when no file matches.
@@ -66,9 +75,7 @@ function createApp() {
   );
 
   app.use('/*', apiContext());
-  app.get('/', (c) => renderPage(c, { pageId: '' }));
-  app.get('/404', (c) => renderPage(c, { pageId: '404', status: 404 }));
-  app.get('/:rest{.+}', (c) => renderPage(c, { pageId: c.req.param('rest') }));
+  mountPageRoutes({ app, basePath, renderPage });
 
   app.onError(createErrorHandler({ basePath, logger }));
 

package/src/html/getAssets.js

@@ -17,6 +17,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
+import { LowdefyInternalError } from '@lowdefy/errors';
+
 // The Vite manifest is read once at startup — deploys start a new server
 // process after `vite build` completes, so assets never change at runtime.
 // In-place deploys must build before restarting (documented).
@@ -30,7 +32,7 @@ function getAssets() {
   const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
   const entry = manifest['client/main.jsx'];
   if (!entry) {
-    throw new Error(
+    throw new LowdefyInternalError(
       'Vite manifest has no "client/main.jsx" entry. Run the client build before starting the server.'
     );
   }

package/src/html/getHomePath.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { buildPagePath } from '@lowdefy/helpers';
+
+// The path (no leading "/", no basePath) of the home page: the configured
+// homePageId, or the first menu link the user may see with its pathParams.
+// The pattern comes from the route table, which lists every page whatever the
+// caller may open.
+async function getHomePath({ context, home }) {
+  const routes = await context.readConfigFile('routes.json');
+  const route = routes.find(({ pageId }) => pageId === home.pageId);
+  return buildPagePath({ pageId: home.pageId, path: route?.path, pathParams: home.pathParams });
+}
+
+export default getHomePath;

package/src/html/renderPage.js

@@ -15,48 +15,55 @@
 */
 
 import { getPageConfig, getRootConfig } from '@lowdefy/api';
+import { type } from '@lowdefy/helpers';
 
 import appJson from '../../lib/build/app.js';
 import lowdefyConfig from '../../lib/build/config.js';
 import themeConfig from '../../lib/build/theme.js';
 import getAssets from './getAssets.js';
+import getHomePath from './getHomePath.js';
 import template from './template.js';
 
 const basePath = lowdefyConfig.basePath ?? '';
 
-// Replaces pages/[[...pageId]].js getServerSideProps and pages/404.js
-// getStaticProps. The home redirect logic lives here, not at the route level.
-async function renderPage(c, { pageId, status = 200 }) {
+// Renders the page a request path matches. path (basePath and the leading "/"
+// removed, still encoded) is empty for the app root, which serves the home
+// page: the configured homePageId, else a redirect to the first menu link the
+// user may see.
+async function renderPage(c, { path, matchedPath, status = 200 }) {
   const context = c.get('lowdefyContext');
-  const { logger, session } = context;
+  const { logger, user } = context;
 
-  let resolvedPageId = pageId;
   const rootConfig = await getRootConfig(context);
 
-  if (!resolvedPageId) {
+  let pagePath = path;
+  if (path === '') {
     const { home } = rootConfig;
+    pagePath = await getHomePath({ context, home });
     if (home.configured === false) {
-      logger.info({ event: 'redirect_to_homepage', pageId: home.pageId });
-      return c.redirect(`${basePath}/${home.pageId}`, 302);
+      logger.info({ event: 'redirect_to_homepage', pageId: home.pageId, path: pagePath });
+      return c.redirect(`${basePath}/${pagePath}`, 302);
     }
-    resolvedPageId = home.pageId;
   }
 
-  const pageConfig = await getPageConfig(context, {
-    pageId: resolvedPageId,
+  const result = await getPageConfig(context, {
+    path: pagePath,
     urlQuery: c.req.query(),
   });
+  const { pageId, pathParams } = result;
 
-  if (!pageConfig) {
-    if (resolvedPageId === '404') {
+  if (result.status !== 'ok') {
+    if (pagePath === '404') {
       // No 404 page in the build — return a plain 404 rather than redirecting in a loop.
       return c.text('Page not found.', 404);
     }
-    logger.info({ event: 'redirect_page_not_found', pageId: resolvedPageId });
+    logger.info({ event: 'redirect_page_not_found', pageId, path: pagePath });
     return c.redirect(`${basePath}/404`, 302);
   }
 
-  logger.info({ event: 'page_view', pageId: resolvedPageId });
+  const { pageConfig } = result;
+
+  logger.info({ event: 'page_view', pageId, path: pagePath });
 
   const html = template({
     appendBody: appJson.html?.appendBody ?? '',
@@ -65,12 +72,17 @@ async function renderPage(c, { pageId, status = 200 }) {
     basePath,
     config: {
       basePath,
+      matchedPath,
       pageConfig,
+      pageId,
+      pathParams,
       rootConfig,
-      session: session ?? null,
+      user: user ?? null,
     },
+    slug: rootConfig.lowdefyApp?.slug,
     themeConfig,
-    title: pageConfig.properties?.title ?? resolvedPageId,
+    // A title written as an operator is evaluated on the client, which replaces this one.
+    title: type.isString(pageConfig.properties?.title) ? pageConfig.properties.title : pageId,
   });
 
   return c.html(html, status);

package/src/html/renderPage.test.mjs

@@ -0,0 +1,162 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+const { default: getPageConfig } = await import('@lowdefy/api/routes/page/getPageConfig.js');
+
+const mockGetRootConfig = jest.fn();
+jest.unstable_mockModule('@lowdefy/api', () => ({
+  getPageConfig,
+  getRootConfig: mockGetRootConfig,
+}));
+
+jest.unstable_mockModule('../../lib/build/app.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/build/config.js', () => ({ default: { basePath: '' } }));
+jest.unstable_mockModule('../../lib/build/theme.js', () => ({ default: {} }));
+jest.unstable_mockModule('./getAssets.js', () => ({ default: () => ({}) }));
+jest.unstable_mockModule('./template.js', () => ({
+  default: ({ config, title }) => JSON.stringify({ config, title }),
+}));
+
+const { default: renderPage } = await import('./renderPage.js');
+const { default: mountPageRoutes } = await import('../routes/mountPageRoutes.js');
+
+const routes = [
+  { pageId: '404', path: '404' },
+  { pageId: 'home', path: 'home' },
+  { pageId: 'state-title', path: 'state-title' },
+  { pageId: 'ticket', path: '{space}/tickets/{ticket_id}' },
+  { pageId: 'section', path: '{section}' },
+];
+
+const pages = {
+  404: { id: '404' },
+  home: { id: 'home' },
+  'state-title': { id: 'state-title', properties: { title: { _state: 'title' } } },
+  ticket: { id: 'ticket', properties: { title: 'Ticket' } },
+  section: { id: 'section' },
+};
+
+function createApp({
+  outcome = 'allow',
+  pagesProtectedByDefault = false,
+  routeTable = routes,
+  user = { id: 'u1' },
+} = {}) {
+  const app = new Hono();
+  app.use('*', async (c, next) => {
+    c.set('lowdefyContext', {
+      authEnforcement: { pagesProtectedByDefault },
+      authorizeOutcome: () => outcome,
+      logger: { info: jest.fn() },
+      readConfigFile: async (file) => {
+        if (file === 'routes.json') return routeTable;
+        return pages[file.slice('pages/'.length, -'.json'.length)] ?? null;
+      },
+      user,
+    });
+    await next();
+  });
+  mountPageRoutes({ app, basePath: '', renderPage });
+  return app;
+}
+
+beforeEach(() => {
+  mockGetRootConfig.mockResolvedValue({
+    home: { configured: true, pageId: 'home', pathParams: {} },
+  });
+});
+
+async function readConfig(res) {
+  return JSON.parse(await res.text()).config;
+}
+
+test('renderPage embeds pageId, pathParams and matchedPath for a patterned page', async () => {
+  const res = await createApp().request('/support/tickets/1234');
+  expect(res.status).toEqual(200);
+  const config = await readConfig(res);
+  expect(config.pageId).toEqual('ticket');
+  expect(config.pathParams).toEqual({ space: 'support', ticket_id: '1234' });
+  expect(config.matchedPath).toEqual('support/tickets/1234');
+  expect(config.pageConfig).toEqual({ id: 'ticket', properties: { title: 'Ticket' } });
+});
+
+test('renderPage decodes an encoded "/" in a value once and keeps matchedPath encoded', async () => {
+  const res = await createApp().request('/support/tickets/a%2Fb/');
+  const config = await readConfig(res);
+  expect(config.pathParams).toEqual({ space: 'support', ticket_id: 'a/b' });
+  expect(config.matchedPath).toEqual('support/tickets/a%2Fb');
+});
+
+test('renderPage redirects an unmatched path to /404', async () => {
+  const res = await createApp().request('/support/tickets');
+  expect(res.status).toEqual(302);
+  expect(res.headers.get('location')).toEqual('/404');
+});
+
+test('renderPage serves a page without path at its id', async () => {
+  const res = await createApp().request('/home');
+  const config = await readConfig(res);
+  expect(config.pageId).toEqual('home');
+  expect(config.pathParams).toEqual({});
+  expect(config.matchedPath).toEqual('home');
+});
+
+test('renderPage serves the configured home page at /', async () => {
+  const res = await createApp().request('/');
+  expect(res.status).toEqual(200);
+  const config = await readConfig(res);
+  expect(config.pageId).toEqual('home');
+  expect(config.matchedPath).toEqual('');
+});
+
+test('renderPage redirects / to the home menu link built from its pathParams', async () => {
+  mockGetRootConfig.mockResolvedValue({
+    home: {
+      configured: false,
+      pageId: 'ticket',
+      pathParams: { space: 'support', ticket_id: '12 34' },
+    },
+  });
+  const res = await createApp().request('/');
+  expect(res.status).toEqual(302);
+  expect(res.headers.get('location')).toEqual('/support/tickets/12%2034');
+});
+
+test('renderPage serves /404 as a fixed route with status 404', async () => {
+  const res = await createApp().request('/404');
+  expect(res.status).toEqual(404);
+  const config = await readConfig(res);
+  expect(config.pageId).toEqual('404');
+});
+
+test('renderPage returns a plain 404 when the build has no 404 page', async () => {
+  const res = await createApp({ routeTable: [{ pageId: 'home', path: 'home' }] }).request('/404');
+  expect(res.status).toEqual(404);
+  expect(await res.text()).toEqual('Page not found.');
+});
+
+test('renderPage serves the page title written as a string', async () => {
+  const res = await createApp().request('/support/tickets/1234');
+  expect(JSON.parse(await res.text()).title).toEqual('Ticket');
+});
+
+test('renderPage serves the page id as the title when the title is an operator', async () => {
+  const res = await createApp().request('/state-title');
+  expect(JSON.parse(await res.text()).title).toEqual('state-title');
+});

package/src/html/template.js

@@ -14,6 +14,8 @@
   limitations under the License.
 */
 
+import { appStorageKey } from '@lowdefy/helpers';
+
 import safeScriptJson from '../lib/safeScriptJson.js';
 
 const HTML_ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' };
@@ -33,13 +35,15 @@ const layerOrderScript = `(function(){var s=document.createElement("style");s.id
 // Synchronous pre-hydration script setting the <html> background and
 // color-scheme — prevents a mode-mismatch flash of the page and of browser
 // chrome (scrollbars, form controls) on page load. Mirrors useDarkMode.js
-// resolution order: configDarkMode → localStorage → prefers-color-scheme.
-function darkModeScript({ configColorMode, darkBg, lightBg }) {
+// resolution order: configDarkMode → localStorage → prefers-color-scheme. The preference is
+// kept under the app's storage key; a value under the bare key from before keys were kept per
+// app is read until useDarkMode moves it.
+function darkModeScript({ configColorMode, darkBg, lightBg, storageKey }) {
   return `(function(){var c=${safeScriptJson(configColorMode)};var db=${safeScriptJson(
     darkBg
-  )};var lb=${safeScriptJson(
-    lightBg
-  )};var d;if(c==="dark")d=true;else if(c==="light")d=false;else{try{var p=localStorage.getItem("lowdefy_darkMode");if(p==="dark")d=true;else if(p==="light")d=false;else d=window.matchMedia("(prefers-color-scheme:dark)").matches}catch(e){d=window.matchMedia("(prefers-color-scheme:dark)").matches}}var bg=d?db:lb;document.documentElement.style.colorScheme=d?"dark":"light";if(bg)document.documentElement.style.backgroundColor=bg})();`;
+  )};var lb=${safeScriptJson(lightBg)};var k=${safeScriptJson(
+    storageKey
+  )};var d;if(c==="dark")d=true;else if(c==="light")d=false;else{try{var p=localStorage.getItem(k);if(p===null)p=localStorage.getItem("lowdefy_darkMode");if(p==="dark")d=true;else if(p==="light")d=false;else d=window.matchMedia("(prefers-color-scheme:dark)").matches}catch(e){d=window.matchMedia("(prefers-color-scheme:dark)").matches}}var bg=d?db:lb;document.documentElement.style.colorScheme=d?"dark":"light";if(bg)document.documentElement.style.backgroundColor=bg})();`;
 }
 
 function template({
@@ -48,6 +52,7 @@ function template({
   assets,
   basePath = '',
   config,
+  slug,
   themeConfig = {},
   title,
 }) {
@@ -73,7 +78,12 @@ function template({
   <head>
     <meta charset="utf-8" />
     <script>${layerOrderScript}</script>
-    <script>${darkModeScript({ configColorMode, darkBg, lightBg })}</script>
+    <script>${darkModeScript({
+      configColorMode,
+      darkBg,
+      lightBg,
+      storageKey: appStorageKey({ basePath, name: 'lowdefy_darkMode', slug }),
+    })}</script>
     <link rel="manifest" href="${basePath}/manifest.webmanifest" />
     <link rel="icon" type="image/svg+xml" href="${basePath}/icon.svg" />
     <link rel="apple-touch-icon" href="${basePath}/apple-touch-icon.png" />

package/src/index.js

@@ -17,6 +17,9 @@
 import { serve } from '@hono/node-server';
 import { WebSocketServer } from 'ws';
 
+import registerServer from '@lowdefy/node-utils/registerServer.js';
+import watchOwner from '@lowdefy/node-utils/watchOwner.js';
+
 import createApp from './app.js';
 import createLogger from '../lib/server/log/createLogger.js';
 
@@ -28,13 +31,33 @@ const wss = new WebSocketServer({ noServer: true, maxPayload: 256 * 1024 });
 
 const server = serve({ fetch: app.fetch, port, websocket: { server: wss } }, (info) => {
   logger.info(`Lowdefy e2e server listening on http://localhost:${info.port}`);
+  // Only when the CLI asks (it sets the registry directory).
+  registerServer({
+    kind: 'server',
+    port: info.port,
+    configDirectory: process.env.LOWDEFY_DIRECTORY_CONFIG,
+    logger,
+  });
 });
 
+let shuttingDown = false;
 function shutdown() {
+  if (shuttingDown) {
+    return;
+  }
+  shuttingDown = true;
+  server.closeIdleConnections?.();
   server.close(() => {
     process.exit(0);
   });
+  // A test browser holding a connection open must not keep the server alive.
+  setTimeout(() => process.exit(1), 5000).unref();
 }
 
 process.on('SIGINT', shutdown);
 process.on('SIGTERM', shutdown);
+process.on('SIGHUP', shutdown);
+
+// A server started by a test runner stops when that runner stops, however it
+// ends. Inert unless the spawner set its variables.
+watchOwner({ onExit: shutdown });

package/src/lib/getRequestPath.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The rest of the request path after basePath and prefix, still encoded: the
+// page matcher decodes each segment once, and Hono's c.req.path is partly
+// decoded, so it is taken from the request URL. path goes to the matcher as it
+// arrived; matchedPath is path with one trailing "/" removed, the form the
+// client compares its navigations with.
+function getRequestPath({ c, basePath, prefix }) {
+  const pathname = new URL(c.req.url).pathname.slice(basePath.length);
+  const path = pathname.startsWith(prefix) ? pathname.slice(prefix.length) : '';
+  const matchedPath = path.endsWith('/') ? path.slice(0, -1) : path;
+  return { path, matchedPath };
+}
+
+export default getRequestPath;

package/src/middleware/apiContext.js

@@ -15,23 +15,25 @@
 */
 
 import path from 'node:path';
-import { createApiContext } from '@lowdefy/api';
+import { createApiContext, createRequestSignal, normalizeInjectedCaller } from '@lowdefy/api';
 import { v4 as uuid } from 'uuid';
 
 import agents from '../../build/plugins/agents.js';
 import appMeta from '../../lib/build/appMeta.js';
+import authJson from '../../lib/build/auth.js';
 import config from '../../lib/build/config.js';
 import connections from '../../build/plugins/connections.js';
 import createHandleError from '../../lib/server/log/createHandleError.js';
 import createLogger from '../../lib/server/log/createLogger.js';
 import fileCache from '../../lib/server/fileCache.js';
 import getE2eSecrets from '../../lib/server/getE2eSecrets.js';
-import getSession from '../../lib/server/auth/session.js';
+import getUser from '../../lib/server/auth/getUser.js';
 import i18nConfig from '../../lib/build/i18n.js';
 import jsMap from '../../build/plugins/operators/serverJsMap.js';
 import logRequest from '../../lib/server/log/logRequest.js';
 import operators from '../../build/plugins/operators/server.js';
 import scrubSecrets from '../../lib/server/scrubSecrets.js';
+import steps from '../../build/plugins/steps.js';
 import websockets from '../../build/plugins/websockets.js';
 
 const secrets = getE2eSecrets();
@@ -70,11 +72,25 @@ function apiContext() {
       },
       scrubSecrets,
       secrets,
+      // Aborts when the client disconnects before the response is sent.
+      signal: createRequestSignal({ clientSignal: c.req.raw.signal }),
+      steps,
       websockets,
     };
     context.handleError = createHandleError({ context });
-    context.session = getSession(c);
+    // The cookie user is a pre-resolved caller substituting for
+    // resolveAuthentication - normalizeInjectedCaller floors it to the
+    // resolved-caller shape. An absent cookie stays a logged-out (null) caller.
+    const user = getUser(c);
+    context.user = user ? normalizeInjectedCaller(user) : null;
     createApiContext(context);
+    // No auth engine runs in the e2e server, so createApiContext retains no
+    // organization binding. Derive the policy from the built auth config so
+    // the tenant wall's policy gate still engages for a tenant app; pinned
+    // stays null (no engine means no seeded organization row).
+    if (authJson.organizations) {
+      context.organization = { policy: authJson.organizations.policy, pinned: null };
+    }
     logRequest({ context });
     c.set('lowdefyContext', context);
     return next();