@lowdefy/server 0.0.0-experimental-20260720072521 → 0.0.0-experimental-20260721080548

package/.eslintrc.yaml

@@ -0,0 +1 @@
+extends: 'plugin:@next/next/core-web-vitals'

package/lib/build/app.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/app.json'), 'utf8'));
+import raw from '../../build/app.json';
 
 export default serializer.deserialize(raw);

package/lib/build/appMeta.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/appMeta.json'), 'utf8'));
+import raw from '../../build/appMeta.json';
 
 export default serializer.deserialize(raw);

package/lib/build/auth.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/auth.json'), 'utf8'));
+import raw from '../../build/auth.json';
 
 export default serializer.deserialize(raw);

package/lib/build/config.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/config.json'), 'utf8'));
+import raw from '../../build/config.json';
 
 export default serializer.deserialize(raw);

package/lib/build/i18n.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/i18n.json'), 'utf8'));
+import raw from '../../build/i18n.json';
 
 export default serializer.deserialize(raw);

package/lib/build/logger.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/logger.json'), 'utf8'));
+import raw from '../../build/logger.json';
 
 export default serializer.deserialize(raw);

package/lib/build/theme.js

@@ -13,14 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-
-// Build artifacts are read from disk because the Hono server runs as
-// unbundled Node.js ESM — JSON imports would need import attributes, and
-// client code imports the build JSON directly through Vite instead.
-import fs from 'node:fs';
-import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-
-const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/theme.json'), 'utf8'));
+import raw from '../../build/theme.json';
 
 export default serializer.deserialize(raw);

package/lib/client/Page.js

@@ -0,0 +1,56 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import React from 'react';
+
+import { useRouter } from 'next/router';
+import Client from '@lowdefy/client';
+import Head from 'next/head';
+import Link from 'next/link';
+
+import actions from '../../build/plugins/actions.js';
+import blockMetas from '../../build/plugins/blockMetas.json';
+import blocks from '../../build/plugins/blocks.js';
+import icons from '../../build/plugins/icons.js';
+import operators from '../../build/plugins/operators/client.js';
+import jsMap from '../../build/plugins/operators/clientJsMap.js';
+
+const Page = ({ auth, lowdefy, pageConfig, rootConfig }) => {
+  const router = useRouter();
+  return (
+    <Client
+      auth={auth}
+      Components={{ Head, Link }}
+      config={{
+        pageConfig,
+        rootConfig,
+      }}
+      jsMap={jsMap}
+      lowdefy={lowdefy}
+      router={router}
+      types={{
+        actions,
+        blockMetas,
+        blocks,
+        icons,
+        operators,
+      }}
+      window={window}
+    />
+  );
+};
+
+export default Page;

package/lib/client/auth/{Auth.jsx → Auth.js}

@@ -14,24 +14,18 @@
   limitations under the License.
 */
 
+/* eslint-disable react/jsx-props-no-spreading */
+
 import React from 'react';
-import AuthConfigured from './AuthConfigured.jsx';
+import AuthConfigured from './AuthConfigured.js';
 import AuthNotConfigured from './AuthNotConfigured.js';
 
-import { serializer } from '@lowdefy/helpers';
-
-// Client code imports the build JSON directly — Vite handles JSON imports;
-// the lib/build/*.js wrappers are server-only (they read from disk).
-// Deserialize to restore arrays from their ~arr build markers (providers
-// must be a real array for provider lookups in createAuthMethods).
-import rawAuthConfig from '../../../build/auth.json';
-
-const authConfig = serializer.deserialize(rawAuthConfig);
+import authConfig from '../../build/auth.js';
 
-function Auth({ children, user }) {
+function Auth({ children, session }) {
   if (authConfig.configured === true) {
     return (
-      <AuthConfigured serverUser={user} authConfig={authConfig}>
+      <AuthConfigured serverSession={session} authConfig={authConfig}>
         {(auth) => children(auth)}
       </AuthConfigured>
     );

package/lib/client/auth/AuthConfigured.js

@@ -0,0 +1,62 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/* eslint-disable react/jsx-props-no-spreading */
+
+import React, { useEffect, useRef } from 'react';
+import { getSession, SessionProvider, signIn, signOut, useSession } from 'next-auth/react';
+
+import lowdefyConfig from '../../build/config.js';
+
+function Session({ children }) {
+  const wasAuthenticated = useRef(false);
+  const { data: session, status } = useSession();
+  wasAuthenticated.current = wasAuthenticated.current || status === 'authenticated';
+
+  useEffect(() => {
+    if (wasAuthenticated.current && status === 'unauthenticated') {
+      window.location.reload();
+    }
+  }, [status]);
+
+  // If session is passed to SessionProvider from getServerSideProps
+  // we won't have a loading state here.
+  // But 404 uses getStaticProps so we have this for 404.
+  if (status === 'loading') {
+    return '';
+  }
+  return children(session);
+}
+
+function AuthConfigured({ authConfig, children, serverSession }) {
+  const auth = { authConfig, getSession, signIn, signOut };
+  let basePath = lowdefyConfig.basePath;
+  if (basePath) {
+    basePath = `${basePath}/api/auth`;
+  }
+  return (
+    <SessionProvider session={serverSession} basePath={basePath}>
+      <Session>
+        {(session) => {
+          auth.session = session;
+          return children(auth);
+        }}
+      </Session>
+    </SessionProvider>
+  );
+}
+
+export default AuthConfigured;

package/lib/client/auth/AuthNotConfigured.js

@@ -14,6 +14,8 @@
   limitations under the License.
 */
 
+/* eslint-disable react/jsx-props-no-spreading */
+
 function authNotConfigured() {
   throw new Error('Auth not configured.');
 }
@@ -21,30 +23,9 @@ function authNotConfigured() {
 function AuthNotConfigured({ authConfig, children }) {
   const auth = {
     authConfig,
-    user: null,
-    acceptInvitation: authNotConfigured,
-    addPasskey: authNotConfigured,
-    changePassword: authNotConfigured,
-    deletePasskey: authNotConfigured,
-    getResolvedUser: authNotConfigured,
     getSession: authNotConfigured,
-    impersonateUser: authNotConfigured,
-    requestPasswordReset: authNotConfigured,
-    resetPassword: authNotConfigured,
-    revokeOtherSessions: authNotConfigured,
-    sendVerificationEmail: authNotConfigured,
-    setActiveOrganization: authNotConfigured,
-    signInEmail: authNotConfigured,
-    signInMagicLink: authNotConfigured,
-    signInOauth2: authNotConfigured,
-    signInSocial: authNotConfigured,
+    signIn: authNotConfigured,
     signOut: authNotConfigured,
-    signUpEmail: authNotConfigured,
-    stopImpersonating: authNotConfigured,
-    twoFactorDisable: authNotConfigured,
-    twoFactorEnable: authNotConfigured,
-    twoFactorVerifyBackupCode: authNotConfigured,
-    twoFactorVerifyTotp: authNotConfigured,
   };
 
   return children(auth);

package/lib/client/sentry/captureSentryError.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/browser';
+import * as Sentry from '@sentry/nextjs';
 
 function captureSentryError({ error, pageId, blockId, configLocation }) {
   const tags = {};

package/lib/client/sentry/initSentryClient.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/browser';
+import * as Sentry from '@sentry/nextjs';
 
 let initialized = false;
 

package/lib/client/sentry/setSentryUser.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/browser';
+import * as Sentry from '@sentry/nextjs';
 
 function setSentryUser({ user, sentryConfig }) {
   // No-op if no user

package/lib/server/apiWrapper.js

@@ -0,0 +1,94 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import path from 'path';
+import { createApiContext } from '@lowdefy/api';
+import { getSecretsFromEnv } from '@lowdefy/node-utils';
+import { serializer } from '@lowdefy/helpers';
+import { v4 as uuid } from 'uuid';
+
+import agents from '../../build/plugins/agents.js';
+import appMeta from '../build/appMeta.js';
+import config from '../build/config.js';
+import i18nConfig from '../build/i18n.js';
+import connections from '../../build/plugins/connections.js';
+import createLogger from './log/createLogger.js';
+import fileCache from './fileCache.js';
+import getServerSession from './auth/getServerSession.js';
+import createHandleError from './log/createHandleError.js';
+import logRequest from './log/logRequest.js';
+import operators from '../../build/plugins/operators/server.js';
+import jsMap from '../../build/plugins/operators/serverJsMap.js';
+import getAuthOptions from './auth/getAuthOptions.js';
+import loggerConfig from '../build/logger.js';
+import setSentryUser from './sentry/setSentryUser.js';
+
+const secrets = getSecretsFromEnv();
+
+function apiWrapper(handler) {
+  return async function wrappedHandler(req, res) {
+    const context = {
+      // Important to give absolute path so Next can trace build files
+      rid: uuid(),
+      agents,
+      appMeta,
+      buildDirectory: path.join(process.cwd(), 'build'),
+      config,
+      connections,
+      fileCache,
+      headers: req?.headers,
+      i18n: i18nConfig,
+      jsMap,
+      handleError: async (err) => {
+        console.error(err);
+      },
+      logger: console,
+      operators,
+      req,
+      res,
+      secrets,
+    };
+    try {
+      context.logger = createLogger({ rid: context.rid });
+      context.handleError = createHandleError({ context });
+      context.authOptions = getAuthOptions(context);
+      if (!req.url.startsWith('/api/auth')) {
+        context.session = await getServerSession(context);
+        // Set Sentry user context for authenticated requests
+        setSentryUser({
+          user: context.session?.user,
+          sentryConfig: loggerConfig.sentry,
+        });
+      }
+      createApiContext(context);
+      logRequest({ context });
+      // Await here so that if handler throws it is caught.
+      const response = await handler({ context, req, res });
+      return response;
+    } catch (error) {
+      await context.handleError(error);
+      const serialized = serializer.serialize(error);
+      if (serialized?.['~e']) {
+        delete serialized['~e'].received;
+        delete serialized['~e'].stack;
+        delete serialized['~e'].configKey;
+      }
+      res.status(500).json(serialized);
+    }
+  };
+}
+
+export default apiWrapper;

package/lib/server/auth/{getAuth.js → getAuthOptions.js}

@@ -14,32 +14,23 @@
   limitations under the License.
 */
 
-import { getBetterAuth } from '@lowdefy/api';
+import { getNextAuthConfig } from '@lowdefy/api';
 import { getSecretsFromEnv } from '@lowdefy/node-utils';
 
 import adapters from '../../../build/plugins/auth/adapters.js';
-import appMeta from '../../build/appMeta.js';
 import authJson from '../../build/auth.js';
-import createSystemContext from './createSystemContext.js';
-import lowdefyConfig from '../../build/config.js';
+import callbacks from '../../../build/plugins/auth/callbacks.js';
+import events from '../../../build/plugins/auth/events.js';
 import providers from '../../../build/plugins/auth/providers.js';
 
-// Returns the BetterAuth instance (memoized in @lowdefy/api), or null when
-// auth is not configured - it handles /api/auth/* and resolves the session
-// for every request.
-function getAuth({ logger }) {
-  if (authJson.configured !== true) {
-    return null;
-  }
-  return getBetterAuth({
+function getAuthOptions({ appMeta, logger }) {
+  return getNextAuthConfig({
     appMeta,
     authJson,
-    config: lowdefyConfig,
-    createSystemContext,
     logger,
-    plugins: { adapters, providers },
+    plugins: { adapters, callbacks, events, providers },
     secrets: getSecretsFromEnv(),
   });
 }
 
-export default getAuth;
+export default getAuthOptions;

package/{src/lib/getPathSegments.js → lib/server/auth/getServerSession.js}

@@ -14,12 +14,15 @@
   limitations under the License.
 */
 
-// Splits the rest of a catch-all route into decoded segments, independent of
-// any configured basePath. Mirrors the Next.js [...param] query arrays —
-// nested ids (slashes in pageId or endpointId) are real.
-function getPathSegments(c, prefix) {
-  const rest = c.req.path.split(prefix)[1] ?? '';
-  return rest.split('/').filter(Boolean).map(decodeURIComponent);
+import { getServerSession as getNextAuthServerSession } from 'next-auth/next';
+
+import authJson from '../../build/auth.js';
+
+function getServerSession({ authOptions, req, res }) {
+  if (authJson.configured === true) {
+    return getNextAuthServerSession(req, res, authOptions);
+  }
+  return undefined;
 }
 
-export default getPathSegments;
+export default getServerSession;

package/lib/server/log/createHandleError.js

@@ -114,7 +114,7 @@ function createHandleError({ context }) {
             host: headers.host,
             referer: headers.referer,
             // Non localhost headers
-            'x-forwarded-for': headers['x-forwarded-for'],
+            'x-forward-for': headers['x-forward-for'],
             // Vercel headers
             'x-vercel-id': headers['x-vercel-id'],
             'x-real-ip': headers['x-real-ip'],

package/lib/server/log/createLogger.js

@@ -15,27 +15,10 @@
 */
 
 import { createNodeLogger } from '@lowdefy/logger/node';
-import { type } from '@lowdefy/helpers';
-
-import appMeta from '../../build/appMeta.js';
-
-// Deploy identity on every log line — pid/hostname are stripped, so these
-// fields are what correlates a line to an app build across replicas.
-const base = { pid: undefined, hostname: undefined };
-if (!type.isNone(appMeta.name)) {
-  base.app_name = appMeta.name;
-}
-if (!type.isNone(appMeta.version)) {
-  base.app_version = appMeta.version;
-}
-if (!type.isNone(appMeta.gitSha)) {
-  base.git_sha = appMeta.gitSha;
-}
-
 const logger = createNodeLogger({
   name: 'lowdefy_server',
   level: process.env.LOWDEFY_LOG_LEVEL ?? 'info',
-  base,
+  base: { pid: undefined, hostname: undefined },
 });
 
 function createLogger(metadata = {}) {

package/lib/server/log/logRequest.js

@@ -14,48 +14,53 @@
   limitations under the License.
 */
 
-// Emits one access-log line per request, after the response is finalized.
-function logRequest({ context, status, durationMs }) {
-  const { headers = {} } = context;
-  const user = context.user ?? {};
-  context.logger.info(
-    {
-      user: {
-        id: user.id,
-        roles: user.roles,
-      },
-      url: context.req.url,
-      method: context.req.method,
-      hostname: context.req.hostname,
-      status,
-      duration_ms: durationMs,
-      headers: {
-        'accept-language': headers['accept-language'],
-        'sec-ch-ua-mobile': headers['sec-ch-ua-mobile'],
-        'sec-ch-ua-platform': headers['sec-ch-ua-platform'],
-        'sec-ch-ua': headers['sec-ch-ua'],
-        'user-agent': headers['user-agent'],
-        host: headers.host,
-        referer: headers.referer,
-        'x-forwarded-for': headers['x-forwarded-for'],
-        // Vercel headers
-        'x-vercel-id': headers['x-vercel-id'],
-        'x-real-ip': headers['x-real-ip'],
-        'x-vercel-ip-country': headers['x-vercel-ip-country'],
-        'x-vercel-ip-country-region': headers['x-vercel-ip-country-region'],
-        'x-vercel-ip-city': headers['x-vercel-ip-city'],
-        'x-vercel-ip-latitude': headers['x-vercel-ip-latitude'],
-        'x-vercel-ip-longitude': headers['x-vercel-ip-longitude'],
-        'x-vercel-ip-timezone': headers['x-vercel-ip-timezone'],
-        // Cloudflare headers
-        'cf-connecting-ip': headers['cf-connecting-ip'],
-        'cf-ray': headers['cf-ray'],
-        'cf-ipcountry': headers['cf-ipcountry'],
-        'cf-visitor': headers['cf-visitor'],
-      },
+// TODO: Better name needed here maybe?
+function logRequest({ context }) {
+  const { headers = {}, user = {} } = context;
+  context.logger.info({
+    // TODO:
+    // app_name
+    // app_version
+    // lowdefy_version
+    // build_hash
+    // config_hash
+    user: {
+      id: user.id,
+      roles: user.roles,
+      sub: user.sub,
+      session_id: user.session_id, // TODO: Implement session id
     },
-    'request completed'
-  );
+    url: context.req.url,
+    method: context.req.method,
+    resolvedUrl: context.nextContext?.resolvedUrl,
+    hostname: context.req.hostname,
+    headers: {
+      'accept-language': headers['accept-language'],
+      'sec-ch-ua-mobile': headers['sec-ch-ua-mobile'],
+      'sec-ch-ua-platform': headers['sec-ch-ua-platform'],
+      'sec-ch-ua': headers['sec-ch-ua'],
+      'user-agent': headers['user-agent'],
+      host: headers.host,
+      referer: headers.referer,
+      'x-forward-for': headers['x-forward-for'],
+      // Vercel headers
+      'x-vercel-id': headers['x-vercel-id'],
+      'x-real-ip': headers['x-real-ip'],
+      'x-vercel-ip-country': headers['x-vercel-ip-country'],
+      'x-vercel-ip-country-region': headers['x-vercel-ip-country-region'],
+      'x-vercel-ip-city': headers['x-vercel-ip-city'],
+      'x-vercel-ip-latitude': headers['x-vercel-ip-latitude'],
+      'x-vercel-ip-longitude': headers['x-vercel-ip-longitude'],
+      'x-vercel-ip-timezone': headers['x-vercel-ip-timezone'],
+      // Cloudflare headers
+      'cf-connecting-ip': headers['cf-connecting-ip'],
+      'cf-ray': headers['cf-ray'],
+      'cf-ipcountry': headers['cf-ipcountry'],
+      'cf-visitor': headers['cf-visitor'],
+    },
+  });
+  // TODO:
+  // Next local? nextContext.locale, nextContext.locales, nextContext.defaultLocale
 }
 
 export default logRequest;

package/lib/server/sentry/captureSentryError.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/node';
+import * as Sentry from '@sentry/nextjs';
 
 function captureSentryError({ error, context, configLocation }) {
   // No-op if Sentry not initialized (DSN not set)