@lowdefy/server 5.6.0 → 6.1.0

package/{pages/_app.js → client/App.jsx}

@@ -14,13 +14,7 @@
   limitations under the License.
 */
 
-// CSS layer order — MUST be the first CSS import. Next.js treats this as critical
-// CSS that loads before hydration, locking the cascade priority (antd > base/preflight)
-// before antd's StyleProvider injects @layer antd {} at runtime.
-import '../build/layer-order.css';
-
 import React, { useCallback, useRef } from 'react';
-import dynamic from 'next/dynamic';
 
 import { ErrorBoundary } from '@lowdefy/block-utils';
 import { useDarkMode, useLocale } from '@lowdefy/client';
@@ -28,23 +22,20 @@ import { StyleProvider } from '@ant-design/cssinjs';
 import { App as AntdApp, theme as antdTheme } from 'antd';
 import { XProvider } from '@ant-design/x';
 
+import { serializer } from '@lowdefy/helpers';
+
 import antdLocaleLoaders from '../build/i18n/antdLocales.js';
 import antdXLocaleLoaders from '../build/i18n/antdXLocales.js';
 import dayjsLocaleMap from '../build/i18n/dayjsLocales.js';
-import Auth from '../lib/client/auth/Auth.js';
+import rawLoggerConfig from '../build/logger.json';
+import Auth from '../lib/client/auth/Auth.jsx';
 import createLogUsage from '../lib/client/createLogUsage.js';
 import initSentryClient from '../lib/client/sentry/initSentryClient.js';
-import loggerConfig from '../lib/build/logger.js';
 import setSentryUser from '../lib/client/sentry/setSentryUser.js';
+import Page from './Page.jsx';
 
-// Must be in _app due to next specifications.
-import '../build/globals.css';
-
-// Initialize Sentry client once on module load
-initSentryClient({
-  sentryDsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
-  sentryConfig: loggerConfig.sentry,
-});
+// Deserialize to restore arrays (e.g. sentry.userFields) from ~arr markers.
+const loggerConfig = serializer.deserialize(rawLoggerConfig);
 
 function ThemeTokenResolver({ lowdefyRef, children }) {
   const { token } = antdTheme.useToken();
@@ -55,7 +46,16 @@ function ThemeTokenResolver({ lowdefyRef, children }) {
   return children;
 }
 
-function App({ Component, pageProps: { session, rootConfig, pageConfig } }) {
+function App({ config }) {
+  const { rootConfig, session } = config;
+
+  // Sentry DSN arrives at runtime via the embedded config (the server reads
+  // SENTRY_DSN per process) — no build-time env inlining.
+  initSentryClient({
+    sentryDsn: config.sentryDsn,
+    sentryConfig: loggerConfig.sentry,
+  });
+
   const usageDataRef = useRef({});
   const lowdefyRef = useRef({ eventCallback: createLogUsage({ usageDataRef }) });
   if (rootConfig?.theme) {
@@ -67,7 +67,11 @@ function App({ Component, pageProps: { session, rootConfig, pageConfig } }) {
     configDarkMode: lowdefyRef.current.theme?.darkMode,
   });
 
-  const { active: activeLocale, antdLocale, antdXLocale } = useLocale({
+  const {
+    active: activeLocale,
+    antdLocale,
+    antdXLocale,
+  } = useLocale({
     i18n: rootConfig?.i18n,
     antdLocaleLoaders,
     antdXLocaleLoaders,
@@ -98,9 +102,8 @@ function App({ Component, pageProps: { session, rootConfig, pageConfig } }) {
   // gives X components (Bubble, Sender, Conversations, ...) their built-in strings
   // alongside antd's. antd X ships only en_US + zh_CN; other locales fall back
   // to en_US for X-native strings.
-  const mergedLocale = antdLocale || antdXLocale
-    ? { ...(antdLocale ?? {}), ...(antdXLocale ?? {}) }
-    : undefined;
+  const mergedLocale =
+    antdLocale || antdXLocale ? { ...(antdLocale ?? {}), ...(antdXLocale ?? {}) } : undefined;
 
   return (
     <StyleProvider layer>
@@ -131,14 +134,7 @@ function App({ Component, pageProps: { session, rootConfig, pageConfig } }) {
                     user: auth.session,
                     sentryConfig: loggerConfig.sentry,
                   });
-                  return (
-                    <Component
-                      auth={auth}
-                      lowdefy={lowdefyRef.current}
-                      rootConfig={rootConfig}
-                      pageConfig={pageConfig}
-                    />
-                  );
+                  return <Page auth={auth} config={config} lowdefy={lowdefyRef.current} />;
                 }}
               </Auth>
             </ErrorBoundary>
@@ -149,8 +145,4 @@ function App({ Component, pageProps: { session, rootConfig, pageConfig } }) {
   );
 }
 
-const DynamicApp = dynamic(() => Promise.resolve(App), {
-  ssr: false,
-});
-
-export default DynamicApp;
+export default App;

package/client/Page.jsx

@@ -0,0 +1,122 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import React, { useEffect, useRef, useState } from 'react';
+
+import Client from '@lowdefy/client';
+import createRouter from '@lowdefy/client/adapters/createRouter.js';
+import createLinkComponent from '@lowdefy/client/adapters/Link.js';
+import { createUrl } from '@lowdefy/client/adapters/url.js';
+import Head from '@lowdefy/client/adapters/Head.js';
+
+import actions from '../build/plugins/actions.js';
+import blockMetas from '../build/plugins/blockMetas.json';
+import blocks from '../build/plugins/blocks.js';
+import icons from '../build/plugins/icons.js';
+import operators from '../build/plugins/operators/client.js';
+import jsMap from '../build/plugins/operators/clientJsMap.js';
+import appMeta from '../build/appMeta.json';
+
+import shouldReloadForBuild from './shouldReloadForBuild.js';
+
+// Replaces lib/client/Page.js. The first page renders from the config
+// embedded in the HTML; SPA navigations fetch /api/page/* and swap pageConfig.
+function Page({ auth, config, lowdefy }) {
+  const [pageConfig, setPageConfig] = useState(config.pageConfig);
+
+  const routerRef = useRef(null);
+  if (!routerRef.current) {
+    const router = createRouter({ basePath: config.basePath ?? '', window });
+    routerRef.current = {
+      router,
+      Link: createLinkComponent({ router }),
+    };
+  }
+  const { router, Link } = routerRef.current;
+
+  // Temporary sequence guard for the superseded-navigation race: a slow
+  // response for an abandoned navigation must not paint over a newer one.
+  // Remove when the loader-based lifecycle replaces these fetch paths.
+  const latestNavRef = useRef(0);
+
+  useEffect(() => {
+    const unsubscribe = router.subscribe(async ({ pageId }) => {
+      const token = ++latestNavRef.current;
+      const targetPageId = pageId ?? config.rootConfig.home.pageId;
+      try {
+        // Forward the current query string so server-side Dynamic block
+        // resolution sees the same urlQuery as an initial HTML load.
+        const res = await fetch(
+          `${router.basePath}/api/page/${targetPageId}${window.location.search}`
+        );
+        if (!res.ok) {
+          if (token !== latestNavRef.current) return;
+          if (targetPageId !== '404') {
+            router.replace({ pathname: '/404' });
+          }
+          return;
+        }
+        const { buildId, pageConfig: nextPageConfig } = await res.json();
+        if (token !== latestNavRef.current) return;
+        if (
+          shouldReloadForBuild({ bundleBuildId: appMeta.buildId, serverBuildId: buildId, window })
+        ) {
+          // The app was redeployed after this bundle loaded, so the config may
+          // reference _js functions and plugins this bundle does not carry.
+          // The router has already pushed the target URL, so a reload lands
+          // on the requested page with the current bundle.
+          window.location.reload();
+          return;
+        }
+        setPageConfig(nextPageConfig);
+      } catch (error) {
+        // Network failure on SPA navigation — fall back to a full page load.
+        if (token !== latestNavRef.current) return;
+        window.location.assign(
+          createUrl({
+            basePath: router.basePath,
+            pathname: targetPageId === config.rootConfig.home.pageId ? '/' : `/${targetPageId}`,
+          })
+        );
+      }
+    });
+    return unsubscribe;
+  }, []);
+
+  return (
+    <Client
+      auth={auth}
+      Components={{ Head, Link }}
+      config={{
+        pageConfig,
+        rootConfig: config.rootConfig,
+      }}
+      jsMap={jsMap}
+      lowdefy={lowdefy}
+      router={router}
+      types={{
+        actions,
+        blockMetas,
+        blocks,
+        icons,
+        operators,
+      }}
+      window={window}
+    />
+  );
+}
+
+export default Page;

package/client/clientBuildImports.test.mjs

@@ -0,0 +1,61 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Everything the client imports from build/ ships in the browser bundle. build/config.json is
+// server-only: it carries every deployment environment's settings (other environments' urls,
+// secret names, email filters). The client learns only the current environment's name and
+// switched-off features, through appMeta. This allowlist fails the build of any new client import
+// of a build artifact until it has been checked for what it exposes.
+const allowed = new Set([
+  'auth.json',
+  'appMeta.json',
+  'logger.json',
+  'i18n/antdLocales.js',
+  'i18n/antdXLocales.js',
+  'i18n/dayjsLocales.js',
+  'plugins/actions.js',
+  'plugins/blockMetas.json',
+  'plugins/blocks.js',
+  'plugins/icons.js',
+  'plugins/operators/client.js',
+  'plugins/operators/clientJsMap.js',
+]);
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+function listSourceFiles(dir) {
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) return listSourceFiles(full);
+    return /\.(js|jsx|mjs)$/.test(entry.name) && !entry.name.includes('.test.') ? [full] : [];
+  });
+}
+
+test('client code imports only client-safe build artifacts', () => {
+  const imported = ['client', 'lib/client'].flatMap((dir) =>
+    listSourceFiles(path.join(root, dir)).flatMap((file) =>
+      [...fs.readFileSync(file, 'utf8').matchAll(/from '[^']*\/build\/([^']+)'/g)].map(
+        (match) => ({ file: path.relative(root, file), artifact: match[1] })
+      )
+    )
+  );
+  expect(imported.length).toBeGreaterThan(0);
+  expect(imported.filter(({ artifact }) => !allowed.has(artifact))).toEqual([]);
+});

package/client/main.jsx

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// CSS layer order — MUST be the first CSS import. This locks the cascade
+// priority (antd > base/preflight) before antd's StyleProvider injects
+// @layer antd {} at runtime.
+import '../build/layer-order.css';
+
+import React from 'react';
+import { createRoot } from 'react-dom/client';
+
+import App from './App.jsx';
+
+import '../build/globals.css';
+
+const config = JSON.parse(document.getElementById('__LOWDEFY_CONFIG__').textContent);
+const container = document.getElementById('root');
+
+// Keep one React root across Vite HMR updates — re-running createRoot on a
+// container that already has a root is an error.
+const root = import.meta.hot?.data.root ?? createRoot(container);
+if (import.meta.hot) {
+  import.meta.hot.data.root = root;
+}
+
+root.render(<App config={config} />);

package/client/shouldReloadForBuild.js

@@ -0,0 +1,48 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+// sessionStorage key holding the server build this tab last reloaded for.
+const RELOADED_FOR_BUILD_KEY = 'lowdefy.reloadedForBuild';
+
+// True when a page config fetched during SPA navigation came from a newer
+// deploy than the bundle this tab is running, so the tab must do a full load
+// to pick up the current bundle. Without this the new config can reference
+// _js functions the old bundle never shipped, and the page throws mid-event.
+//
+// A tab reloads at most once per server build: if the freshly loaded bundle
+// still disagrees with the server (a rolling deploy answering from mixed
+// versions, a proxy caching old HTML), reloading again would loop forever.
+// The old-config-on-old-bundle throw is the lesser failure in that case.
+function shouldReloadForBuild({ bundleBuildId, serverBuildId, window }) {
+  if (type.isNone(serverBuildId) || serverBuildId === bundleBuildId) {
+    return false;
+  }
+  try {
+    if (window.sessionStorage.getItem(RELOADED_FOR_BUILD_KEY) === serverBuildId) {
+      return false;
+    }
+    window.sessionStorage.setItem(RELOADED_FOR_BUILD_KEY, serverBuildId);
+  } catch (error) {
+    // Browsers with storage disabled throw on sessionStorage access. Without
+    // the once-per-build record the loop guard cannot work, so do not reload.
+    return false;
+  }
+  return true;
+}
+
+export default shouldReloadForBuild;

package/client/shouldReloadForBuild.test.mjs

@@ -0,0 +1,75 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import shouldReloadForBuild from './shouldReloadForBuild.js';
+
+function createWindow({ stored = {}, throws = false } = {}) {
+  return {
+    sessionStorage: {
+      getItem: (key) => {
+        if (throws) throw new Error('storage disabled');
+        return stored[key] ?? null;
+      },
+      setItem: (key, value) => {
+        if (throws) throw new Error('storage disabled');
+        stored[key] = value;
+      },
+    },
+  };
+}
+
+test('shouldReloadForBuild is false when the server build matches the bundle', () => {
+  const window = createWindow();
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-1', window })).toBe(
+    false
+  );
+});
+
+test('shouldReloadForBuild is false when the server sends no build id', () => {
+  const window = createWindow();
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: undefined, window })).toBe(
+    false
+  );
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: null, window })).toBe(
+    false
+  );
+});
+
+test('shouldReloadForBuild is true once per newer server build, then false', () => {
+  const stored = {};
+  const window = createWindow({ stored });
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-2', window })).toBe(
+    true
+  );
+  expect(stored['lowdefy.reloadedForBuild']).toEqual('build-2');
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-2', window })).toBe(
+    false
+  );
+});
+
+test('shouldReloadForBuild reloads again when the server moves to a third build', () => {
+  const window = createWindow({ stored: { 'lowdefy.reloadedForBuild': 'build-2' } });
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-2', serverBuildId: 'build-3', window })).toBe(
+    true
+  );
+});
+
+test('shouldReloadForBuild is false when sessionStorage is unavailable', () => {
+  const window = createWindow({ throws: true });
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-2', window })).toBe(
+    false
+  );
+});

package/lib/build/app.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/app.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/app.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/appMeta.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/appMeta.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/appMeta.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/auth.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/auth.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/auth.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/config.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/config.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/config.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/i18n.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/i18n.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/i18n.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/logger.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/logger.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/logger.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/build/theme.js

@@ -13,7 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
+
+// Build artifacts are read from disk because the Hono server runs as
+// unbundled Node.js ESM — JSON imports would need import attributes, and
+// client code imports the build JSON directly through Vite instead.
+import fs from 'node:fs';
+import path from 'node:path';
 import { serializer } from '@lowdefy/helpers';
-import raw from '../../build/theme.json';
+
+const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build/theme.json'), 'utf8'));
 
 export default serializer.deserialize(raw);

package/lib/client/auth/{Auth.js → Auth.jsx}

@@ -17,10 +17,18 @@
 /* eslint-disable react/jsx-props-no-spreading */
 
 import React from 'react';
-import AuthConfigured from './AuthConfigured.js';
+import AuthConfigured from './AuthConfigured.jsx';
 import AuthNotConfigured from './AuthNotConfigured.js';
 
-import authConfig from '../../build/auth.js';
+import { serializer } from '@lowdefy/helpers';
+
+// Client code imports the build JSON directly — Vite handles JSON imports;
+// the lib/build/*.js wrappers are server-only (they read from disk).
+// Deserialize to restore arrays from their ~arr build markers (providers
+// must be a real array for single-provider inference in createAuthMethods).
+import rawAuthConfig from '../../../build/auth.json';
+
+const authConfig = serializer.deserialize(rawAuthConfig);
 
 function Auth({ children, session }) {
   if (authConfig.configured === true) {

package/lib/client/auth/{AuthConfigured.js → AuthConfigured.jsx}

@@ -17,9 +17,25 @@
 /* eslint-disable react/jsx-props-no-spreading */
 
 import React, { useEffect, useRef } from 'react';
-import { getSession, SessionProvider, signIn, signOut, useSession } from 'next-auth/react';
+import {
+  authConfigManager,
+  getSession,
+  SessionProvider,
+  signIn,
+  signOut,
+  useSession,
+} from '@hono/auth-js/react';
 
-import lowdefyConfig from '../../build/config.js';
+// The app basePath, from Vite's BASE_URL (`${config.basePath}/`, set in
+// vite.config.js). build/config.json is server-only - it carries every
+// deployment environment's settings - so it is never imported into the client.
+const basePath = import.meta.env.BASE_URL.replace(/\/$/, '');
+
+// @hono/auth-js/react configures its fetch paths through a module-level
+// manager instead of SessionProvider props.
+if (basePath) {
+  authConfigManager.setConfig({ basePath: `${basePath}/api/auth` });
+}
 
 function Session({ children }) {
   const wasAuthenticated = useRef(false);
@@ -32,9 +48,8 @@ function Session({ children }) {
     }
   }, [status]);
 
-  // If session is passed to SessionProvider from getServerSideProps
-  // we won't have a loading state here.
-  // But 404 uses getStaticProps so we have this for 404.
+  // If session is passed to SessionProvider from the server-rendered config
+  // we won't have a loading state here, but unauthenticated first loads do.
   if (status === 'loading') {
     return '';
   }
@@ -43,12 +58,8 @@ function Session({ children }) {
 
 function AuthConfigured({ authConfig, children, serverSession }) {
   const auth = { authConfig, getSession, signIn, signOut };
-  let basePath = lowdefyConfig.basePath;
-  if (basePath) {
-    basePath = `${basePath}/api/auth`;
-  }
   return (
-    <SessionProvider session={serverSession} basePath={basePath}>
+    <SessionProvider session={serverSession}>
       <Session>
         {(session) => {
           auth.session = session;

package/lib/client/sentry/captureSentryError.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/browser';
 
 function captureSentryError({ error, pageId, blockId, configLocation }) {
   const tags = {};