@lowdefy/server 6.0.0 → 7.0.0

package/src/html/collectChunkClosure.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Every JS file and stylesheet a dynamic entry needs, following its static
+// imports - what the browser would otherwise discover one round trip at a time.
+function collectChunkClosure({ manifest, key, js, css }) {
+  const chunk = manifest[key];
+  if (js.has(chunk.file)) {
+    return;
+  }
+  js.add(chunk.file);
+  (chunk.css ?? []).forEach((file) => css.add(file));
+  (chunk.imports ?? []).forEach((importKey) =>
+    collectChunkClosure({ manifest, key: importKey, js, css })
+  );
+}
+
+export default collectChunkClosure;

package/src/html/collectLazyImports.js

@@ -0,0 +1,41 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+const LAZY_SUFFIX = '.lazy.js';
+
+// The lazy block implementations a chunk's static closure imports dynamically.
+// Only modules named *.lazy.js count: other import()s, such as an SDK loaded
+// only when a feature is switched on, exist so they are not downloaded. The
+// main entry's closure is not walked, since its dynamic imports are the page
+// types chunks and app-wide optional code, never one page's lazy blocks.
+function collectLazyImports({ manifest, key, entryFiles, visited, lazyKeys }) {
+  if (visited.has(key)) {
+    return;
+  }
+  visited.add(key);
+  const chunk = manifest[key];
+  if (entryFiles.has(chunk.file)) {
+    return;
+  }
+  (chunk.dynamicImports ?? [])
+    .filter((importKey) => importKey.endsWith(LAZY_SUFFIX))
+    .forEach((importKey) => lazyKeys.add(importKey));
+  (chunk.imports ?? []).forEach((importKey) =>
+    collectLazyImports({ manifest, key: importKey, entryFiles, visited, lazyKeys })
+  );
+}
+
+export default collectLazyImports;

package/src/html/collectPageTypesAssets.js

@@ -0,0 +1,57 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import collectChunkClosure from './collectChunkClosure.js';
+import collectLazyImports from './collectLazyImports.js';
+
+const PAGE_TYPES_PREFIX = 'build/plugins/pageTypes/';
+
+// Preloads per page types key: the key's chunk (its types and icons) and its
+// imports, less what the main entry already loads. Prefetches: the lazy
+// block implementations the key's chunks import on mount, with their imports,
+// less anything already preloaded or in the main entry. Prefetch is low
+// priority, so a lazy block that mounts at first paint finds its code in the
+// cache without delaying the page's own chunks.
+function collectPageTypesAssets({ manifest, entryFiles }) {
+  const pageTypes = {};
+  Object.keys(manifest)
+    .filter((key) => key.startsWith(PAGE_TYPES_PREFIX))
+    .forEach((key) => {
+      const typesKey = key.slice(PAGE_TYPES_PREFIX.length).replace(/\.js$/, '');
+      const js = new Set();
+      const css = new Set();
+      collectChunkClosure({ manifest, key, js, css });
+
+      const lazyKeys = new Set();
+      collectLazyImports({ manifest, key, entryFiles, visited: new Set(), lazyKeys });
+      const prefetchJs = new Set();
+      const prefetchCss = new Set();
+      lazyKeys.forEach((lazyKey) =>
+        collectChunkClosure({ manifest, key: lazyKey, js: prefetchJs, css: prefetchCss })
+      );
+
+      pageTypes[typesKey] = {
+        js: [...js].filter((file) => !entryFiles.has(file)),
+        css: [...css].filter((file) => !entryFiles.has(file)),
+        prefetch: [...prefetchJs, ...prefetchCss].filter(
+          (file) => !entryFiles.has(file) && !js.has(file) && !css.has(file)
+        ),
+      };
+    });
+  return pageTypes;
+}
+
+export default collectPageTypesAssets;

package/src/html/collectPageTypesAssets.test.mjs

@@ -0,0 +1,130 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import collectPageTypesAssets from './collectPageTypesAssets.js';
+
+const manifest = {
+  'client/main.jsx': { file: 'assets/main.js', css: ['assets/main.css'], imports: ['_react.js'] },
+  '_react.js': { file: 'assets/react.js' },
+  'build/plugins/icons.js': { file: 'assets/icons.js', imports: ['_ai.js', 'client/main.jsx'] },
+  '_ai.js': { file: 'assets/ai.js', imports: ['client/main.jsx'] },
+  'build/plugins/pageTypes/aaaaaaaaaaaa.js': {
+    file: 'assets/aaaa.js',
+    imports: ['_antd.js', 'client/main.jsx'],
+  },
+  '_antd.js': { file: 'assets/antd.js', css: ['assets/antd.css'], imports: ['_react.js'] },
+  'build/plugins/pageTypes/bbbbbbbbbbbb.js': {
+    file: 'assets/bbbb.js',
+    imports: ['client/main.jsx'],
+  },
+};
+
+const entryFiles = new Set(['assets/main.js', 'assets/main.css', 'assets/react.js']);
+
+test('collectPageTypesAssets preloads each key chunk and every import, less main and the app-wide icons', () => {
+  expect(collectPageTypesAssets({ manifest, entryFiles })).toEqual({
+    aaaaaaaaaaaa: {
+      js: ['assets/aaaa.js', 'assets/antd.js'],
+      css: ['assets/antd.css'],
+      prefetch: [],
+    },
+    bbbbbbbbbbbb: {
+      js: ['assets/bbbb.js'],
+      css: [],
+      prefetch: [],
+    },
+  });
+});
+
+// A page whose chunks import a lazy block implementation, an optional SDK, and
+// a nested lazy import inside the implementation.
+const lazyManifest = {
+  'client/main.jsx': {
+    file: 'assets/main.js',
+    css: ['assets/main.css'],
+    imports: ['_react.js'],
+    dynamicImports: [
+      'build/plugins/pageTypes/cccccccccccc.js',
+      'build/plugins/pageTypes/dddddddddddd.js',
+      'node_modules/app-wide/Everywhere.lazy.js',
+    ],
+  },
+  '_react.js': { file: 'assets/react.js' },
+  'build/plugins/icons.js': { file: 'assets/icons.js', imports: ['client/main.jsx'] },
+  'node_modules/app-wide/Everywhere.lazy.js': {
+    file: 'assets/Everywhere.lazy.js',
+    isDynamicEntry: true,
+  },
+  'build/plugins/pageTypes/cccccccccccc.js': {
+    file: 'assets/cccc.js',
+    imports: ['_blocks.js', 'client/main.jsx'],
+  },
+  '_blocks.js': {
+    file: 'assets/blocks.js',
+    imports: ['_antd.js', '_react.js'],
+    dynamicImports: [
+      'plugins/blocks-antd-x/dist/blocks/AgentChat/AgentChat.lazy.js',
+      'node_modules/posthog-js/dist/module.js',
+    ],
+  },
+  '_antd.js': { file: 'assets/antd.js', css: ['assets/antd.css'], imports: ['_react.js'] },
+  'plugins/blocks-antd-x/dist/blocks/AgentChat/AgentChat.lazy.js': {
+    file: 'assets/AgentChat.lazy.js',
+    css: ['assets/AgentChat.css'],
+    isDynamicEntry: true,
+    imports: ['_x.js', '_antd.js', '_react.js'],
+    dynamicImports: ['node_modules/@ant-design/x/es/mermaid/index.js'],
+  },
+  '_x.js': { file: 'assets/x.js', imports: ['_markdown.js'] },
+  '_markdown.js': { file: 'assets/markdown.js', css: ['assets/markdown.css'] },
+  'node_modules/@ant-design/x/es/mermaid/index.js': {
+    file: 'assets/mermaid.js',
+    isDynamicEntry: true,
+  },
+  'node_modules/posthog-js/dist/module.js': { file: 'assets/posthog.js', isDynamicEntry: true },
+  'build/plugins/pageTypes/dddddddddddd.js': {
+    file: 'assets/dddd.js',
+    imports: ['client/main.jsx'],
+  },
+};
+
+test('collectPageTypesAssets prefetches the lazy block implementations a page imports, with their imports', () => {
+  const pageTypes = collectPageTypesAssets({ manifest: lazyManifest, entryFiles });
+  expect(pageTypes.cccccccccccc).toEqual({
+    js: ['assets/cccc.js', 'assets/blocks.js', 'assets/antd.js'],
+    css: ['assets/antd.css'],
+    prefetch: [
+      'assets/AgentChat.lazy.js',
+      'assets/x.js',
+      'assets/markdown.js',
+      'assets/AgentChat.css',
+      'assets/markdown.css',
+    ],
+  });
+});
+
+test('collectPageTypesAssets does not prefetch dynamic imports that are not *.lazy.js', () => {
+  const { prefetch } = collectPageTypesAssets({ manifest: lazyManifest, entryFiles }).cccccccccccc;
+  expect(prefetch).not.toContain('assets/posthog.js');
+  // Imported only once the implementation runs, so it stays on demand.
+  expect(prefetch).not.toContain('assets/mermaid.js');
+});
+
+test('collectPageTypesAssets does not prefetch lazy imports of the main entry or other page types', () => {
+  const pageTypes = collectPageTypesAssets({ manifest: lazyManifest, entryFiles });
+  expect(pageTypes.dddddddddddd.prefetch).toEqual([]);
+  expect(pageTypes.cccccccccccc.prefetch).not.toContain('assets/Everywhere.lazy.js');
+});

package/src/html/getAssets.js

@@ -17,6 +17,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
+import { LowdefyInternalError } from '@lowdefy/errors';
+
+import collectChunkClosure from './collectChunkClosure.js';
+import collectPageTypesAssets from './collectPageTypesAssets.js';
+
 // The Vite manifest is read once at startup — deploys start a new server
 // process after `vite build` completes, so assets never change at runtime.
 // In-place deploys must build before restarting (documented).
@@ -30,14 +35,28 @@ function getAssets() {
   const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
   const entry = manifest['client/main.jsx'];
   if (!entry) {
-    throw new Error(
+    throw new LowdefyInternalError(
       'Vite manifest has no "client/main.jsx" entry. Run the client build before starting the server.'
     );
   }
+  const entryJs = new Set();
+  const entryCss = new Set();
+  collectChunkClosure({ manifest, key: 'client/main.jsx', js: entryJs, css: entryCss });
+  const entryFiles = new Set([...entryJs, ...entryCss]);
+  // Every icon the app bundles: preloaded only for a page whose Dynamic
+  // content loads them all before its first render.
+  const iconsJs = new Set();
+  const iconsCss = new Set();
+  collectChunkClosure({ manifest, key: 'build/plugins/icons.js', js: iconsJs, css: iconsCss });
   assets = {
     js: entry.file,
     css: entry.css ?? [],
+    icons: {
+      js: [...iconsJs].filter((file) => !entryFiles.has(file)),
+      css: [...iconsCss].filter((file) => !entryFiles.has(file)),
+    },
     imports: (entry.imports ?? []).map((key) => manifest[key]?.file).filter(Boolean),
+    pageTypes: collectPageTypesAssets({ manifest, entryFiles }),
   };
   return assets;
 }

package/src/html/getHomePath.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { buildPagePath } from '@lowdefy/helpers';
+
+// The path (no leading "/", no basePath) of the home page: the configured
+// homePageId, or the first menu link the user may see with its pathParams.
+// The pattern comes from the route table, which lists every page whatever the
+// caller may open.
+async function getHomePath({ context, home }) {
+  const routes = await context.readConfigFile('routes.json');
+  const route = routes.find(({ pageId }) => pageId === home.pageId);
+  return buildPagePath({ pageId: home.pageId, path: route?.path, pathParams: home.pathParams });
+}
+
+export default getHomePath;

package/src/html/getPageAssets.js

@@ -0,0 +1,32 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The chunks a page's first render waits for: its types key's chunk and
+// imports, plus every icon when Dynamic content needs icons outside the
+// page's set (loadPageTypes loads them before rendering).
+function getPageAssets({ assets, pageConfig }) {
+  const pageAssets = assets.pageTypes[pageConfig.typesKey];
+  if (pageConfig.loadAllTypes !== true && pageConfig.loadAllIcons !== true) {
+    return pageAssets;
+  }
+  return {
+    ...pageAssets,
+    js: [...new Set([...pageAssets.js, ...assets.icons.js])],
+    css: [...new Set([...pageAssets.css, ...assets.icons.css])],
+  };
+}
+
+export default getPageAssets;

package/src/html/getPageAssets.test.mjs

@@ -0,0 +1,47 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import getPageAssets from './getPageAssets.js';
+
+const assets = {
+  icons: { js: ['assets/icons.js', 'assets/shared.js'], css: [] },
+  pageTypes: {
+    aaaaaaaaaaaa: {
+      js: ['assets/aaaa.js', 'assets/shared.js'],
+      css: ['assets/a.css'],
+      prefetch: [],
+    },
+  },
+};
+
+test('getPageAssets preloads only the key chunks for a page that needs only its own icons', () => {
+  expect(getPageAssets({ assets, pageConfig: { typesKey: 'aaaaaaaaaaaa' } })).toBe(
+    assets.pageTypes.aaaaaaaaaaaa
+  );
+});
+
+test.each([['loadAllIcons'], ['loadAllTypes']])(
+  'getPageAssets also preloads every icon for a page flagged %s',
+  (flag) => {
+    expect(
+      getPageAssets({ assets, pageConfig: { typesKey: 'aaaaaaaaaaaa', [flag]: true } })
+    ).toEqual({
+      js: ['assets/aaaa.js', 'assets/shared.js', 'assets/icons.js'],
+      css: ['assets/a.css'],
+      prefetch: [],
+    });
+  }
+);

package/src/html/renderPage.contentSecurityPolicy.test.mjs

@@ -0,0 +1,134 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+const { default: getPageConfig } = await import('@lowdefy/api/routes/page/getPageConfig.js');
+const { default: createContentSecurityPolicy } = await import(
+  '@lowdefy/api/csp/createContentSecurityPolicy.js'
+);
+const { default: addNonceToElements } = await import('@lowdefy/api/csp/addNonceToElements.js');
+
+const security = { contentSecurityPolicy: null };
+
+jest.unstable_mockModule('@lowdefy/api', () => ({
+  addNonceToElements,
+  createContentSecurityPolicy,
+  getPageConfig,
+  getRootConfig: async () => ({ home: { configured: true, pageId: 'home', pathParams: {} } }),
+}));
+jest.unstable_mockModule('../../lib/build/app.js', () => ({
+  default: {
+    html: {
+      appendHead: '<script src="https://cdn.example.com/a.js"></script>',
+      appendBody: '<script>window.b = 1;</script>',
+    },
+  },
+}));
+jest.unstable_mockModule('../../lib/build/auth.js', () => ({
+  default: { authPages: { signIn: '/auth/login' } },
+}));
+jest.unstable_mockModule('../../lib/build/config.js', () => ({ default: { basePath: '' } }));
+jest.unstable_mockModule('../../lib/build/security.js', () => ({ default: security }));
+jest.unstable_mockModule('../../lib/build/theme.js', () => ({ default: {} }));
+jest.unstable_mockModule('./getAssets.js', () => ({
+  default: () => ({ js: 'assets/main.js', css: [], imports: [] }),
+}));
+jest.unstable_mockModule('./getPageAssets.js', () => ({
+  default: () => ({ js: [], css: [], prefetch: [] }),
+}));
+
+const { default: renderPage } = await import('./renderPage.js');
+const { default: mountPageRoutes } = await import('../routes/mountPageRoutes.js');
+
+const policy = {
+  reportOnly: false,
+  directives: {
+    'default-src': ["'self'"],
+    'script-src': ["'self'"],
+    'style-src': ["'self'"],
+    'connect-src': ["'self'"],
+  },
+  nonceDirectives: ['script-src', 'style-src'],
+  websockets: true,
+};
+
+function createApp() {
+  const app = new Hono();
+  app.use('*', async (c, next) => {
+    c.set('lowdefyContext', {
+      authEnforcement: { pagesProtectedByDefault: false },
+      authorizeOutcome: () => 'allow',
+      logger: { info: jest.fn() },
+      readConfigFile: async (file) => {
+        if (file === 'routes.json') return [{ pageId: 'home', path: 'home' }];
+        if (file === 'pages/home.json') return { id: 'home' };
+        return null;
+      },
+      user: null,
+    });
+    await next();
+  });
+  mountPageRoutes({ app, basePath: '', renderPage });
+  return app;
+}
+
+function getHeaderNonce(header) {
+  return header.match(/'nonce-([^']+)'/)[1];
+}
+
+afterEach(() => {
+  security.contentSecurityPolicy = null;
+});
+
+test('renderPage sends no Content-Security-Policy and writes no nonce when the policy is off', async () => {
+  const res = await createApp().request('https://app.example.com/home');
+  expect(res.headers.get('content-security-policy')).toBeNull();
+  expect(res.headers.get('content-security-policy-report-only')).toBeNull();
+  expect(await res.text()).not.toContain(' nonce="');
+});
+
+test('renderPage puts the header nonce on every script element of the page', async () => {
+  security.contentSecurityPolicy = policy;
+  const res = await createApp().request('https://app.example.com/home');
+  const header = res.headers.get('content-security-policy');
+  const nonce = getHeaderNonce(header);
+  expect(header).toEqual(
+    `default-src 'self'; script-src 'self' 'nonce-${nonce}'; style-src 'self' 'nonce-${nonce}'; connect-src 'self' wss://app.example.com`
+  );
+  const scripts = (await res.text()).match(/<script\b[^>]*>/g);
+  expect(scripts.length).toEqual(6);
+  scripts.forEach((tag) => expect(tag).toContain(` nonce="${nonce}"`));
+});
+
+test('renderPage draws a different nonce for each render', async () => {
+  security.contentSecurityPolicy = policy;
+  const app = createApp();
+  const first = await app.request('https://app.example.com/home');
+  const second = await app.request('https://app.example.com/home');
+  const firstNonce = getHeaderNonce(first.headers.get('content-security-policy'));
+  const secondNonce = getHeaderNonce(second.headers.get('content-security-policy'));
+  expect(firstNonce).not.toEqual(secondNonce);
+  expect(await second.text()).toContain(`nonce="${secondNonce}"`);
+});
+
+test('renderPage sends the report-only header when the policy is report only', async () => {
+  security.contentSecurityPolicy = { ...policy, reportOnly: true };
+  const res = await createApp().request('https://app.example.com/home');
+  expect(res.headers.get('content-security-policy')).toBeNull();
+  expect(res.headers.get('content-security-policy-report-only')).toContain("default-src 'self'");
+});