@lowdefy/server 5.5.1 → 6.0.0

package/{pages/_app.js → client/App.jsx}

@@ -14,13 +14,7 @@
   limitations under the License.
 */
 
-// CSS layer order — MUST be the first CSS import. Next.js treats this as critical
-// CSS that loads before hydration, locking the cascade priority (antd > base/preflight)
-// before antd's StyleProvider injects @layer antd {} at runtime.
-import '../build/layer-order.css';
-
 import React, { useCallback, useRef } from 'react';
-import dynamic from 'next/dynamic';
 
 import { ErrorBoundary } from '@lowdefy/block-utils';
 import { useDarkMode, useLocale } from '@lowdefy/client';
@@ -28,23 +22,20 @@ import { StyleProvider } from '@ant-design/cssinjs';
 import { App as AntdApp, theme as antdTheme } from 'antd';
 import { XProvider } from '@ant-design/x';
 
+import { serializer } from '@lowdefy/helpers';
+
 import antdLocaleLoaders from '../build/i18n/antdLocales.js';
 import antdXLocaleLoaders from '../build/i18n/antdXLocales.js';
 import dayjsLocaleMap from '../build/i18n/dayjsLocales.js';
-import Auth from '../lib/client/auth/Auth.js';
+import rawLoggerConfig from '../build/logger.json';
+import Auth from '../lib/client/auth/Auth.jsx';
 import createLogUsage from '../lib/client/createLogUsage.js';
 import initSentryClient from '../lib/client/sentry/initSentryClient.js';
-import loggerConfig from '../lib/build/logger.js';
 import setSentryUser from '../lib/client/sentry/setSentryUser.js';
+import Page from './Page.jsx';
 
-// Must be in _app due to next specifications.
-import '../build/globals.css';
-
-// Initialize Sentry client once on module load
-initSentryClient({
-  sentryDsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
-  sentryConfig: loggerConfig.sentry,
-});
+// Deserialize to restore arrays (e.g. sentry.userFields) from ~arr markers.
+const loggerConfig = serializer.deserialize(rawLoggerConfig);
 
 function ThemeTokenResolver({ lowdefyRef, children }) {
   const { token } = antdTheme.useToken();
@@ -55,7 +46,16 @@ function ThemeTokenResolver({ lowdefyRef, children }) {
   return children;
 }
 
-function App({ Component, pageProps: { session, rootConfig, pageConfig } }) {
+function App({ config }) {
+  const { rootConfig, session } = config;
+
+  // Sentry DSN arrives at runtime via the embedded config (the server reads
+  // SENTRY_DSN per process) — no build-time env inlining.
+  initSentryClient({
+    sentryDsn: config.sentryDsn,
+    sentryConfig: loggerConfig.sentry,
+  });
+
   const usageDataRef = useRef({});
   const lowdefyRef = useRef({ eventCallback: createLogUsage({ usageDataRef }) });
   if (rootConfig?.theme) {
@@ -67,7 +67,11 @@ function App({ Component, pageProps: { session, rootConfig, pageConfig } }) {
     configDarkMode: lowdefyRef.current.theme?.darkMode,
   });
 
-  const { active: activeLocale, antdLocale, antdXLocale } = useLocale({
+  const {
+    active: activeLocale,
+    antdLocale,
+    antdXLocale,
+  } = useLocale({
     i18n: rootConfig?.i18n,
     antdLocaleLoaders,
     antdXLocaleLoaders,
@@ -98,9 +102,8 @@ function App({ Component, pageProps: { session, rootConfig, pageConfig } }) {
   // gives X components (Bubble, Sender, Conversations, ...) their built-in strings
   // alongside antd's. antd X ships only en_US + zh_CN; other locales fall back
   // to en_US for X-native strings.
-  const mergedLocale = antdLocale || antdXLocale
-    ? { ...(antdLocale ?? {}), ...(antdXLocale ?? {}) }
-    : undefined;
+  const mergedLocale =
+    antdLocale || antdXLocale ? { ...(antdLocale ?? {}), ...(antdXLocale ?? {}) } : undefined;
 
   return (
     <StyleProvider layer>
@@ -131,14 +134,7 @@ function App({ Component, pageProps: { session, rootConfig, pageConfig } }) {
                     user: auth.session,
                     sentryConfig: loggerConfig.sentry,
                   });
-                  return (
-                    <Component
-                      auth={auth}
-                      lowdefy={lowdefyRef.current}
-                      rootConfig={rootConfig}
-                      pageConfig={pageConfig}
-                    />
-                  );
+                  return <Page auth={auth} config={config} lowdefy={lowdefyRef.current} />;
                 }}
               </Auth>
             </ErrorBoundary>
@@ -149,8 +145,4 @@ function App({ Component, pageProps: { session, rootConfig, pageConfig } }) {
   );
 }
 
-const DynamicApp = dynamic(() => Promise.resolve(App), {
-  ssr: false,
-});
-
-export default DynamicApp;
+export default App;

package/client/Page.jsx

@@ -0,0 +1,109 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import React, { useEffect, useRef, useState } from 'react';
+
+import Client from '@lowdefy/client';
+import createRouter from '@lowdefy/client/adapters/createRouter.js';
+import createLinkComponent from '@lowdefy/client/adapters/Link.js';
+import { createUrl } from '@lowdefy/client/adapters/url.js';
+import Head from '@lowdefy/client/adapters/Head.js';
+
+import actions from '../build/plugins/actions.js';
+import blockMetas from '../build/plugins/blockMetas.json';
+import blocks from '../build/plugins/blocks.js';
+import icons from '../build/plugins/icons.js';
+import operators from '../build/plugins/operators/client.js';
+import jsMap from '../build/plugins/operators/clientJsMap.js';
+
+// Replaces lib/client/Page.js. The first page renders from the config
+// embedded in the HTML; SPA navigations fetch /api/page/* and swap pageConfig.
+function Page({ auth, config, lowdefy }) {
+  const [pageConfig, setPageConfig] = useState(config.pageConfig);
+
+  const routerRef = useRef(null);
+  if (!routerRef.current) {
+    const router = createRouter({ basePath: config.basePath ?? '', window });
+    routerRef.current = {
+      router,
+      Link: createLinkComponent({ router }),
+    };
+  }
+  const { router, Link } = routerRef.current;
+
+  // Temporary sequence guard for the superseded-navigation race: a slow
+  // response for an abandoned navigation must not paint over a newer one.
+  // Remove when the loader-based lifecycle replaces these fetch paths.
+  const latestNavRef = useRef(0);
+
+  useEffect(() => {
+    const unsubscribe = router.subscribe(async ({ pageId }) => {
+      const token = ++latestNavRef.current;
+      const targetPageId = pageId ?? config.rootConfig.home.pageId;
+      try {
+        // Forward the current query string so server-side Dynamic block
+        // resolution sees the same urlQuery as an initial HTML load.
+        const res = await fetch(
+          `${router.basePath}/api/page/${targetPageId}${window.location.search}`
+        );
+        if (!res.ok) {
+          if (token !== latestNavRef.current) return;
+          if (targetPageId !== '404') {
+            router.replace({ pathname: '/404' });
+          }
+          return;
+        }
+        const { pageConfig: nextPageConfig } = await res.json();
+        if (token !== latestNavRef.current) return;
+        setPageConfig(nextPageConfig);
+      } catch (error) {
+        // Network failure on SPA navigation — fall back to a full page load.
+        if (token !== latestNavRef.current) return;
+        window.location.assign(
+          createUrl({
+            basePath: router.basePath,
+            pathname: targetPageId === config.rootConfig.home.pageId ? '/' : `/${targetPageId}`,
+          })
+        );
+      }
+    });
+    return unsubscribe;
+  }, []);
+
+  return (
+    <Client
+      auth={auth}
+      Components={{ Head, Link }}
+      config={{
+        pageConfig,
+        rootConfig: config.rootConfig,
+      }}
+      jsMap={jsMap}
+      lowdefy={lowdefy}
+      router={router}
+      types={{
+        actions,
+        blockMetas,
+        blocks,
+        icons,
+        operators,
+      }}
+      window={window}
+    />
+  );
+}
+
+export default Page;

package/client/main.jsx

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// CSS layer order — MUST be the first CSS import. This locks the cascade
+// priority (antd > base/preflight) before antd's StyleProvider injects
+// @layer antd {} at runtime.
+import '../build/layer-order.css';
+
+import React from 'react';
+import { createRoot } from 'react-dom/client';
+
+import App from './App.jsx';
+
+import '../build/globals.css';
+
+const config = JSON.parse(document.getElementById('__LOWDEFY_CONFIG__').textContent);
+const container = document.getElementById('root');
+
+// Keep one React root across Vite HMR updates — re-running createRoot on a
+// container that already has a root is an error.
+const root = import.meta.hot?.data.root ?? createRoot(container);
+if (import.meta.hot) {
+  import.meta.hot.data.root = root;
+}
+
+root.render(<App config={config} />);

package/lib/build/app.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/app.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/app.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/appMeta.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/appMeta.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/appMeta.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/auth.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/auth.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/auth.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/config.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/config.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/config.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/i18n.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/i18n.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/i18n.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/logger.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/logger.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/logger.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/theme.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/theme.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/theme.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/client/auth/{Auth.js → Auth.jsx}

@@ -17,10 +17,18 @@
 /* eslint-disable react/jsx-props-no-spreading */
 
 import React from 'react';
-import AuthConfigured from './AuthConfigured.js';
+import AuthConfigured from './AuthConfigured.jsx';
 import AuthNotConfigured from './AuthNotConfigured.js';
 
-import authConfig from '../../build/auth.js';
+import { serializer } from '@lowdefy/helpers';
+
+// Client code imports the build JSON directly — Vite handles JSON imports;
+// the lib/build/*.js wrappers are server-only (they read from disk).
+// Deserialize to restore arrays from their ~arr build markers (providers
+// must be a real array for single-provider inference in createAuthMethods).
+import rawAuthConfig from '../../../build/auth.json';
+
+const authConfig = serializer.deserialize(rawAuthConfig);
 
 function Auth({ children, session }) {
   if (authConfig.configured === true) {

package/lib/client/auth/{AuthConfigured.js → AuthConfigured.jsx}

@@ -17,9 +17,26 @@
 /* eslint-disable react/jsx-props-no-spreading */
 
 import React, { useEffect, useRef } from 'react';
-import { getSession, SessionProvider, signIn, signOut, useSession } from 'next-auth/react';
+import {
+  authConfigManager,
+  getSession,
+  SessionProvider,
+  signIn,
+  signOut,
+  useSession,
+} from '@hono/auth-js/react';
 
-import lowdefyConfig from '../../build/config.js';
+import { serializer } from '@lowdefy/helpers';
+
+import rawLowdefyConfig from '../../../build/config.json';
+
+const lowdefyConfig = serializer.deserialize(rawLowdefyConfig);
+
+// @hono/auth-js/react configures its fetch paths through a module-level
+// manager instead of SessionProvider props.
+if (lowdefyConfig.basePath) {
+  authConfigManager.setConfig({ basePath: `${lowdefyConfig.basePath}/api/auth` });
+}
 
 function Session({ children }) {
   const wasAuthenticated = useRef(false);
@@ -32,9 +49,8 @@ function Session({ children }) {
     }
   }, [status]);
 
-  // If session is passed to SessionProvider from getServerSideProps
-  // we won't have a loading state here.
-  // But 404 uses getStaticProps so we have this for 404.
+  // If session is passed to SessionProvider from the server-rendered config
+  // we won't have a loading state here, but unauthenticated first loads do.
   if (status === 'loading') {
     return '';
   }
@@ -43,12 +59,8 @@ function Session({ children }) {
 
 function AuthConfigured({ authConfig, children, serverSession }) {
   const auth = { authConfig, getSession, signIn, signOut };
-  let basePath = lowdefyConfig.basePath;
-  if (basePath) {
-    basePath = `${basePath}/api/auth`;
-  }
   return (
-    <SessionProvider session={serverSession} basePath={basePath}>
+    <SessionProvider session={serverSession}>
       <Session>
         {(session) => {
           auth.session = session;

package/lib/client/sentry/captureSentryError.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/browser';
 
 function captureSentryError({ error, pageId, blockId, configLocation }) {
   const tags = {};

package/lib/client/sentry/initSentryClient.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/browser';
 
 let initialized = false;
 

package/lib/client/sentry/setSentryUser.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/browser';
 
 function setSentryUser({ user, sentryConfig }) {
   // No-op if no user

package/lib/server/apiWrapper.js

@@ -15,9 +15,8 @@
 */
 
 import path from 'path';
-import { createApiContext } from '@lowdefy/api';
+import { createApiContext, redactErrorResponse } from '@lowdefy/api';
 import { getSecretsFromEnv } from '@lowdefy/node-utils';
-import { serializer } from '@lowdefy/helpers';
 import { v4 as uuid } from 'uuid';
 
 import agents from '../../build/plugins/agents.js';
@@ -80,13 +79,7 @@ function apiWrapper(handler) {
       return response;
     } catch (error) {
       await context.handleError(error);
-      const serialized = serializer.serialize(error);
-      if (serialized?.['~e']) {
-        delete serialized['~e'].received;
-        delete serialized['~e'].stack;
-        delete serialized['~e'].configKey;
-      }
-      res.status(500).json(serialized);
+      res.status(500).json(redactErrorResponse(context, error));
     }
   };
 }

package/lib/server/auth/{getAuthOptions.js → getAuthConfig.js}

@@ -14,17 +14,18 @@
   limitations under the License.
 */
 
-import { getNextAuthConfig } from '@lowdefy/api';
+import { getAuthConfig as getApiAuthConfig } from '@lowdefy/api';
 import { getSecretsFromEnv } from '@lowdefy/node-utils';
 
 import adapters from '../../../build/plugins/auth/adapters.js';
+import appMeta from '../../build/appMeta.js';
 import authJson from '../../build/auth.js';
 import callbacks from '../../../build/plugins/auth/callbacks.js';
 import events from '../../../build/plugins/auth/events.js';
 import providers from '../../../build/plugins/auth/providers.js';
 
-function getAuthOptions({ appMeta, logger }) {
-  return getNextAuthConfig({
+function getAuthConfig({ logger }) {
+  return getApiAuthConfig({
     appMeta,
     authJson,
     logger,
@@ -33,4 +34,4 @@ function getAuthOptions({ appMeta, logger }) {
   });
 }
 
-export default getAuthOptions;
+export default getAuthConfig;

package/lib/server/auth/{getServerSession.js → session.js}

@@ -14,15 +14,18 @@
   limitations under the License.
 */
 
-import { getServerSession as getNextAuthServerSession } from 'next-auth/next';
+import { getAuthUser } from '@hono/auth-js';
 
 import authJson from '../../build/auth.js';
 
-function getServerSession({ authOptions, req, res }) {
-  if (authJson.configured === true) {
-    return getNextAuthServerSession(req, res, authOptions);
+// Replaces getServerSession.js — reads the session from the Hono context
+// populated by the initAuthConfig middleware.
+async function getSession(c) {
+  if (authJson.configured !== true) {
+    return undefined;
   }
-  return undefined;
+  const authUser = await getAuthUser(c);
+  return authUser?.session ?? undefined;
 }
 
-export default getServerSession;
+export default getSession;

package/lib/server/auth/strategies.js

@@ -0,0 +1,47 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { getAuthStrategies, resolveStrategyCaller } from '@lowdefy/api';
+import { getSecretsFromEnv } from '@lowdefy/node-utils';
+
+import appMeta from '../../build/appMeta.js';
+import authJson from '../../build/auth.js';
+import strategies from '../../../build/plugins/auth/strategies.js';
+
+// Secrets are process-static env, so read once at module load rather than
+// on every sessionless request.
+const secrets = getSecretsFromEnv();
+
+// API auth strategies (apiKey/jwt headers) let MCP and service clients that
+// cannot hold a session cookie authenticate. Tried only when no session
+// resolved; a match is synthesized as session.user so createAuthorize and
+// _user work unchanged.
+async function getStrategyCaller(c, logger) {
+  const authStrategies = getAuthStrategies({
+    appMeta,
+    authJson,
+    logger,
+    plugins: { strategies },
+    secrets,
+  });
+  return resolveStrategyCaller({
+    headers: c.req.raw.headers,
+    logger,
+    strategies: authStrategies,
+  });
+}
+
+export default getStrategyCaller;

package/lib/server/log/createHandleError.js

@@ -59,7 +59,20 @@ function getEventType(error) {
 function createHandleError({ context }) {
   return async function handleError(error) {
     try {
-      const { headers = {}, user = {} } = context;
+      // Set first, not after the log call: this function is the server's error
+      // sink, so reaching it is what makes the error already-logged, and the catch
+      // below guarantees something is written even when the steps here fail. The
+      // client reads `handled` to decide whether to POST the error to
+      // /api/client-error, so a later throw skipping this assignment would have it
+      // logged a second time. Not keyed on `source`, which a LowdefyInternalError
+      // never gets - location resolution is skipped for it below.
+      error.handled = true;
+
+      // `?? {}` rather than a destructuring default: context.user is null (not
+      // undefined) for an anonymous caller and for every system context, so a
+      // default would not fire and reading user.id below would throw.
+      const headers = context.headers ?? {};
+      const user = context.user ?? {};
       const eventType = getEventType(error);
       const isServiceError = error instanceof ServiceError;
       const isLowdefyInternalError = error instanceof LowdefyInternalError;
@@ -114,7 +127,7 @@ function createHandleError({ context }) {
             host: headers.host,
             referer: headers.referer,
             // Non localhost headers
-            'x-forward-for': headers['x-forward-for'],
+            'x-forwarded-for': headers['x-forwarded-for'],
             // Vercel headers
             'x-vercel-id': headers['x-vercel-id'],
             'x-real-ip': headers['x-real-ip'],