@lowdefy/server 6.1.0 → 7.0.0

package/lowdefy/build.test.mjs

@@ -0,0 +1,68 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+
+const mockBuild = jest.fn();
+
+jest.unstable_mockModule('@lowdefy/build', () => ({ default: mockBuild }));
+jest.unstable_mockModule('@lowdefy/logger/node', () => ({
+  createNodeLogger: jest.fn(() => 'logger'),
+}));
+jest.unstable_mockModule('./createCustomPluginTypesMap.mjs', () => ({
+  default: jest.fn().mockResolvedValue({}),
+}));
+jest.unstable_mockModule('./createCustomPluginMessagesMap.mjs', () => ({
+  default: jest.fn().mockResolvedValue({}),
+}));
+
+const savedSkip = process.env.LOWDEFY_BUILD_SKIP_PLUGIN_CHECKS;
+let loadCount = 0;
+
+// build.mjs runs the build when imported, so each case loads a fresh module
+// instance and waits for the build call.
+async function runScript() {
+  loadCount += 1;
+  await import(`./build.mjs?case=${loadCount}`);
+  await new Promise((resolve) => setImmediate(resolve));
+}
+
+beforeEach(() => {
+  delete process.env.LOWDEFY_BUILD_SKIP_PLUGIN_CHECKS;
+  mockBuild.mockReset();
+  mockBuild.mockResolvedValue();
+});
+
+afterAll(() => {
+  if (savedSkip === undefined) {
+    delete process.env.LOWDEFY_BUILD_SKIP_PLUGIN_CHECKS;
+  } else {
+    process.env.LOWDEFY_BUILD_SKIP_PLUGIN_CHECKS = savedSkip;
+  }
+});
+
+test('build passes skipPluginChecks true when LOWDEFY_BUILD_SKIP_PLUGIN_CHECKS is true', async () => {
+  process.env.LOWDEFY_BUILD_SKIP_PLUGIN_CHECKS = 'true';
+  await runScript();
+  expect(mockBuild).toHaveBeenCalledTimes(1);
+  expect(mockBuild.mock.calls[0][0].skipPluginChecks).toBe(true);
+});
+
+test('build passes skipPluginChecks false when LOWDEFY_BUILD_SKIP_PLUGIN_CHECKS is unset', async () => {
+  await runScript();
+  expect(mockBuild).toHaveBeenCalledTimes(1);
+  expect(mockBuild.mock.calls[0][0].skipPluginChecks).toBe(false);
+});

package/lowdefy/createCustomPluginTypesMap.mjs

@@ -42,14 +42,15 @@ async function createCustomPluginTypesMap({ directories }) {
     agents: {},
     auth: {
       adapters: {},
-      callbacks: {},
-      events: {},
       providers: {},
+      strategies: {},
     },
     blockMetas: {},
+    connectionMetas: {},
     blocks: {},
     connections: {},
     icons: {},
+    iconSets: {},
     operators: {
       client: {},
       server: {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server",
-  "version": "6.1.0",
+  "version": "7.0.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -39,59 +39,65 @@
   ],
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
-    "@ant-design/x": "2.7.0",
-    "@auth/core": "0.41.3",
-    "@hono/auth-js": "1.1.1",
-    "@hono/mcp": "0.3.0",
+    "@ant-design/x": "2.9.0",
+    "@better-auth/oauth-provider": "1.7.7",
+    "@better-auth/passkey": "1.7.7",
+    "@hono/mcp": "0.3.2",
     "@hono/node-server": "2.0.10",
-    "@lowdefy/actions-core": "6.1.0",
-    "@lowdefy/api": "6.1.0",
-    "@lowdefy/block-utils": "6.1.0",
-    "@lowdefy/blocks-aggrid": "6.1.0",
-    "@lowdefy/blocks-antd": "6.1.0",
-    "@lowdefy/blocks-antd-x": "6.1.0",
-    "@lowdefy/blocks-basic": "6.1.0",
-    "@lowdefy/blocks-echarts": "6.1.0",
-    "@lowdefy/blocks-files": "6.1.0",
-    "@lowdefy/blocks-loaders": "6.1.0",
-    "@lowdefy/blocks-markdown": "6.1.0",
-    "@lowdefy/blocks-tiptap": "6.1.0",
-    "@lowdefy/client": "6.1.0",
-    "@lowdefy/errors": "6.1.0",
-    "@lowdefy/helpers": "6.1.0",
-    "@lowdefy/layout": "6.1.0",
-    "@lowdefy/logger": "6.1.0",
-    "@lowdefy/node-utils": "6.1.0",
-    "@lowdefy/operators-js": "6.1.0",
-    "@lowdefy/plugin-next-auth": "6.1.0",
-    "@lowdefy/websockets-core": "6.1.0",
+    "@lowdefy/actions-core": "7.0.0",
+    "@lowdefy/api": "7.0.0",
+    "@lowdefy/block-utils": "7.0.0",
+    "@lowdefy/blocks-aggrid": "7.0.0",
+    "@lowdefy/blocks-antd": "7.0.0",
+    "@lowdefy/blocks-antd-x": "7.0.0",
+    "@lowdefy/blocks-basic": "7.0.0",
+    "@lowdefy/blocks-captcha": "7.0.0",
+    "@lowdefy/blocks-echarts": "7.0.0",
+    "@lowdefy/blocks-files": "7.0.0",
+    "@lowdefy/blocks-loaders": "7.0.0",
+    "@lowdefy/blocks-markdown": "7.0.0",
+    "@lowdefy/blocks-table": "7.0.0",
+    "@lowdefy/blocks-tiptap": "7.0.0",
+    "@lowdefy/client": "7.0.0",
+    "@lowdefy/connection-anthropic": "7.0.0",
+    "@lowdefy/errors": "7.0.0",
+    "@lowdefy/helpers": "7.0.0",
+    "@lowdefy/layout": "7.0.0",
+    "@lowdefy/logger": "7.0.0",
+    "@lowdefy/node-utils": "7.0.0",
+    "@lowdefy/operators-js": "7.0.0",
+    "@lowdefy/operators-nunjucks": "7.0.0",
+    "@lowdefy/plugin-better-auth": "7.0.0",
+    "@lowdefy/websockets-core": "7.0.0",
     "@sentry/browser": "10.57.0",
     "@sentry/node": "10.57.0",
+    "@sentry/node-core": "10.57.0",
     "@sentry/vite-plugin": "5.3.0",
-    "@tailwindcss/postcss": "4.3.1",
+    "@tailwindcss/postcss": "4.3.3",
     "@vitejs/plugin-react": "6.0.2",
-    "antd": "6.3.1",
+    "antd": "6.6.5",
+    "better-auth": "1.7.7",
     "dayjs": "1.11.20",
-    "hono": "4.13.5",
-    "pino": "10.3.1",
+    "hono": "4.13.7",
+    "lightningcss": "1.32.0",
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "react-icons": "5.6.0",
-    "tailwindcss": "4.3.1",
+    "tailwindcss": "4.3.3",
     "uuid": "14.0.0",
     "vite": "8.0.16",
     "ws": "8.21.0"
   },
   "devDependencies": {
-    "@lowdefy/build": "6.1.0",
-    "@tailwindcss/postcss": "4.3.1",
+    "@jest/globals": "28.1.3",
+    "@lowdefy/build": "7.0.0",
+    "@tailwindcss/postcss": "4.3.3",
     "jest": "28.1.3",
-    "tailwindcss": "4.3.1",
+    "tailwindcss": "4.3.3",
     "yaml": "2.9.0",
     "yargs": "18.0.0"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "publishConfig": {
     "access": "public"

package/package.original.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server",
-  "version": "6.1.0",
+  "version": "7.0.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -47,59 +47,65 @@
   },
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
-    "@ant-design/x": "2.7.0",
-    "@auth/core": "0.41.3",
-    "@hono/auth-js": "1.1.1",
-    "@hono/mcp": "0.3.0",
+    "@ant-design/x": "2.9.0",
+    "@better-auth/oauth-provider": "1.7.7",
+    "@better-auth/passkey": "1.7.7",
+    "@hono/mcp": "0.3.2",
     "@hono/node-server": "2.0.10",
-    "@lowdefy/actions-core": "6.1.0",
-    "@lowdefy/api": "6.1.0",
-    "@lowdefy/block-utils": "6.1.0",
-    "@lowdefy/blocks-aggrid": "6.1.0",
-    "@lowdefy/blocks-antd": "6.1.0",
-    "@lowdefy/blocks-antd-x": "6.1.0",
-    "@lowdefy/blocks-basic": "6.1.0",
-    "@lowdefy/blocks-echarts": "6.1.0",
-    "@lowdefy/blocks-files": "6.1.0",
-    "@lowdefy/blocks-loaders": "6.1.0",
-    "@lowdefy/blocks-markdown": "6.1.0",
-    "@lowdefy/blocks-tiptap": "6.1.0",
-    "@lowdefy/client": "6.1.0",
-    "@lowdefy/errors": "6.1.0",
-    "@lowdefy/helpers": "6.1.0",
-    "@lowdefy/layout": "6.1.0",
-    "@lowdefy/logger": "6.1.0",
-    "@lowdefy/node-utils": "6.1.0",
-    "@lowdefy/operators-js": "6.1.0",
-    "@lowdefy/plugin-next-auth": "6.1.0",
-    "@lowdefy/websockets-core": "6.1.0",
+    "@lowdefy/actions-core": "7.0.0",
+    "@lowdefy/api": "7.0.0",
+    "@lowdefy/block-utils": "7.0.0",
+    "@lowdefy/blocks-aggrid": "7.0.0",
+    "@lowdefy/blocks-antd": "7.0.0",
+    "@lowdefy/blocks-antd-x": "7.0.0",
+    "@lowdefy/blocks-basic": "7.0.0",
+    "@lowdefy/blocks-captcha": "7.0.0",
+    "@lowdefy/blocks-echarts": "7.0.0",
+    "@lowdefy/blocks-files": "7.0.0",
+    "@lowdefy/blocks-loaders": "7.0.0",
+    "@lowdefy/blocks-markdown": "7.0.0",
+    "@lowdefy/blocks-table": "7.0.0",
+    "@lowdefy/blocks-tiptap": "7.0.0",
+    "@lowdefy/client": "7.0.0",
+    "@lowdefy/connection-anthropic": "7.0.0",
+    "@lowdefy/errors": "7.0.0",
+    "@lowdefy/helpers": "7.0.0",
+    "@lowdefy/layout": "7.0.0",
+    "@lowdefy/logger": "7.0.0",
+    "@lowdefy/node-utils": "7.0.0",
+    "@lowdefy/operators-js": "7.0.0",
+    "@lowdefy/operators-nunjucks": "7.0.0",
+    "@lowdefy/plugin-better-auth": "7.0.0",
+    "@lowdefy/websockets-core": "7.0.0",
     "@sentry/browser": "10.57.0",
     "@sentry/node": "10.57.0",
+    "@sentry/node-core": "10.57.0",
     "@sentry/vite-plugin": "5.3.0",
-    "@tailwindcss/postcss": "4.3.1",
+    "@tailwindcss/postcss": "4.3.3",
     "@vitejs/plugin-react": "6.0.2",
-    "antd": "6.3.1",
+    "antd": "6.6.5",
+    "better-auth": "1.7.7",
     "dayjs": "1.11.20",
-    "hono": "4.13.5",
-    "pino": "10.3.1",
+    "hono": "4.13.7",
+    "lightningcss": "1.32.0",
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "react-icons": "5.6.0",
-    "tailwindcss": "4.3.1",
+    "tailwindcss": "4.3.3",
     "uuid": "14.0.0",
     "vite": "8.0.16",
     "ws": "8.21.0"
   },
   "devDependencies": {
-    "@lowdefy/build": "6.1.0",
-    "@tailwindcss/postcss": "4.3.1",
+    "@jest/globals": "28.1.3",
+    "@lowdefy/build": "7.0.0",
+    "@tailwindcss/postcss": "4.3.3",
     "jest": "28.1.3",
-    "tailwindcss": "4.3.1",
+    "tailwindcss": "4.3.3",
     "yaml": "2.9.0",
     "yargs": "18.0.0"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "publishConfig": {
     "access": "public"

package/src/app.js

@@ -17,13 +17,13 @@
 import { Hono } from 'hono';
 import { bodyLimit } from 'hono/body-limit';
 import { compress } from 'hono/compress';
-import { timeout } from 'hono/timeout';
-import { initAuthConfig } from '@hono/auth-js';
 import { serveStatic } from '@hono/node-server/serve-static';
+import { runInCredentialScope } from '@lowdefy/node-utils';
 
 import agentHandler from './routes/agent.js';
 import apiContext from './middleware/apiContext.js';
 import apiPageHandler from './routes/apiPage.js';
+import appMeta from '../lib/build/appMeta.js';
 import authJson from '../lib/build/auth.js';
 import authMiddleware from './routes/auth.js';
 import clientErrorHandler from './routes/clientError.js';
@@ -33,13 +33,23 @@ import cronForwardHandler from './routes/cronForward.js';
 import cronHandler from './routes/cron.js';
 import detachedHandler from './routes/detached.js';
 import endpointsHandler from './routes/endpoints.js';
-import getAuthConfig from '../lib/server/auth/getAuthConfig.js';
+import getAuth from '../lib/server/auth/getAuth.js';
+import getStrategies from '../lib/server/auth/getStrategies.js';
 import lowdefyConfig from '../lib/build/config.js';
 import mcpHandler from './routes/mcp.js';
+import mountOauthDiscovery from './routes/mountOauthDiscovery.js';
+import mountPageRoutes from './routes/mountPageRoutes.js';
+import noStore from './middleware/noStore.js';
+import wellKnownFallbackHandler from './routes/wellKnownFallback.js';
 import renderPage from './html/renderPage.js';
 import requestHandler from './routes/request.js';
+import refuseOtherBuild from './middleware/refuseOtherBuild.js';
+import requestTimeout from './middleware/requestTimeout.js';
 import sentryMiddleware from './middleware/sentry.js';
+import stampBuildId from './middleware/stampBuildId.js';
+import stampCaller from './middleware/stampCaller.js';
 import usageHandler from './routes/usage.js';
+import userHandler from './routes/user.js';
 import websocketHandler from './routes/websocket.js';
 
 const basePath = lowdefyConfig.basePath ?? '';
@@ -53,7 +63,10 @@ const requestTimeoutMs = lowdefyConfig.requestTimeout ?? 30000;
 // `serveStaticAssets` is true for the Node server (it serves `dist/client` itself). On a
 // platform that serves the built client + public files from a CDN (e.g. Vercel), pass false so
 // the request handler skips the Node-only static middleware and only owns the dynamic routes.
-function createApp({ serveStaticAssets = true } = {}) {
+// `clientAddressHeader` names the header a platform's edge sets to the client address on every
+// request (Vercel's x-real-ip). Without it the Node server resolves the address from the
+// connection and config.trustedProxies.
+function createApp({ serveStaticAssets = true, clientAddressHeader } = {}) {
   const app = basePath ? new Hono().basePath(basePath) : new Hono();
   const logger = createLogger({ server: 'lowdefy' });
 
@@ -61,12 +74,17 @@ function createApp({ serveStaticAssets = true } = {}) {
   // before all middleware so probes skip auth, session, request logging, and Sentry.
   app.get('/api/lowdefy-health', (c) => c.json({ status: 'ok' }));
 
+  // Each request runs in its own credential scope: what it marks with _credential is scrubbed
+  // from every log line written while it is handled.
+  app.use('*', (c, next) => runInCredentialScope(next));
+
   app.use('*', sentryMiddleware());
 
   // Bound request duration so a hung upstream returns an error instead of running to the platform's
   // function limit (cost protection on serverless). Agent streaming is long-lived by design, so it
   // is exempt. Configured via `config.requestTimeout` in lowdefy.yaml (0 disables).
   if (requestTimeoutMs > 0) {
+    const timeoutMiddleware = requestTimeout({ timeoutMs: requestTimeoutMs });
     app.use('*', async (c, next) => {
       if (
         c.req.path.includes('/api/agent/') ||
@@ -75,7 +93,7 @@ function createApp({ serveStaticAssets = true } = {}) {
       ) {
         return next();
       }
-      return timeout(requestTimeoutMs)(c, next);
+      return timeoutMiddleware(c, next);
     });
   }
 
@@ -93,18 +111,46 @@ function createApp({ serveStaticAssets = true } = {}) {
   });
 
   if (authJson.configured === true) {
-    app.use(
-      '*',
-      initAuthConfig(() => getAuthConfig({ logger }))
-    );
+    // Construct the BetterAuth instance and strategy verifiers at startup so
+    // config errors fail boot instead of the first request, and so the
+    // process-memoized singletons capture the base logger rather than the
+    // first request's rid-scoped child.
+    getAuth({ logger });
+    getStrategies({ logger });
   }
 
-  app.use('/api/*', apiContext());
-  app.use('/api/auth/*', authMiddleware());
-  app.all('/api/request/*', requestHandler);
+  mountOauthDiscovery({
+    app,
+    auth: authJson.configured === true ? getAuth({ logger }) : null,
+  });
+  app.all('/.well-known/*', wellKnownFallbackHandler);
+
+  app.use('/api/*', apiContext({ clientAddressHeader }));
+  // Responses that carry the caller's data are never stored by a browser or proxy cache.
+  // Static assets keep their own caching below; the page routes use the same middleware.
+  const noStoreMiddleware = noStore();
+  ['/api/page/*', '/api/user', '/api/request/*', '/api/endpoints/*'].forEach((route) =>
+    app.use(route, noStoreMiddleware)
+  );
+  // A tab left open across a deploy (or restored from the browser cache) runs
+  // the old bundle against this build: see refuseOtherBuild and stampBuildId.
+  app.use('/api/auth/*', stampBuildId({ buildId: appMeta.buildId }));
+  app.use('/api/user', stampBuildId({ buildId: appMeta.buildId }));
+  app.use('/api/auth/*', authMiddleware({ logger }));
+  // The caller each page, request and endpoint response was answered as: the
+  // client reloads when it differs from the caller it renders (stampCaller).
+  app.use('/api/request/*', stampCaller());
+  app.use('/api/endpoints/*', stampCaller());
+  app.use('/api/page/*', stampCaller());
+  app.all('/api/request/*', refuseOtherBuild({ buildId: appMeta.buildId }), requestHandler);
   // Endpoint payloads may carry base64 file content (emitFileContent + CallAPI);
   // cap bodies at 10 MiB to match the agent route.
-  app.all('/api/endpoints/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), endpointsHandler);
+  app.all(
+    '/api/endpoints/*',
+    refuseOtherBuild({ buildId: appMeta.buildId }),
+    bodyLimit({ maxSize: 10 * 1024 * 1024 }),
+    endpointsHandler
+  );
   app.get('/api/cron/*', cronHandler);
   app.get('/api/cron-forward/*', cronForwardHandler);
   app.post('/api/detached/*', detachedHandler);
@@ -114,10 +160,21 @@ function createApp({ serveStaticAssets = true } = {}) {
   app.all('/api/mcp', bodyLimit({ maxSize: 10 * 1024 * 1024 }), mcpHandler);
   app.get('/api/websocket', websocketHandler);
   app.get('/api/page/*', apiPageHandler);
+  app.get('/api/user', userHandler);
 
   // Vite build output (includes public/ via Vite's publicDir copy). Falls
   // through to the page routes when no file matches.
   if (serveStaticAssets) {
+    // Vite content-hashes everything under assets/, so a file never changes at
+    // its URL. Pages load many small chunks; without this each is re-fetched
+    // whenever the browser's heuristic freshness runs out (serveStatic sets
+    // Last-Modified but never answers 304).
+    app.use('/assets/*', async (c, next) => {
+      await next();
+      if (c.res.status === 200) {
+        c.header('Cache-Control', 'public, max-age=31536000, immutable');
+      }
+    });
     app.use(
       '/*',
       serveStatic({
@@ -127,10 +184,10 @@ function createApp({ serveStaticAssets = true } = {}) {
     );
   }
 
-  app.use('/*', apiContext());
-  app.get('/', (c) => renderPage(c, { pageId: '' }));
-  app.get('/404', (c) => renderPage(c, { pageId: '404', status: 404 }));
-  app.get('/:rest{.+}', (c) => renderPage(c, { pageId: c.req.param('rest') }));
+  app.use('/*', apiContext({ clientAddressHeader }));
+  // Registered after the static middleware, which answers a file without calling next().
+  app.use('/*', noStoreMiddleware);
+  mountPageRoutes({ app, basePath, renderPage });
 
   app.onError(createErrorHandler({ basePath, logger }));
 

package/src/app.test.mjs

@@ -0,0 +1,118 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { jest } from '@jest/globals';
+
+// The real app wiring with every handler stubbed, to check which routes carry which
+// Cache-Control header.
+function handler(c) {
+  return c.json({ ok: true });
+}
+function throwingHandler() {
+  throw new Error('Request failed.');
+}
+function passThrough() {
+  return (c, next) => next();
+}
+
+jest.unstable_mockModule('./routes/agent.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/apiPage.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/auth.js', () => ({ default: () => handler }));
+jest.unstable_mockModule('./routes/clientError.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/cron.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/cronForward.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/detached.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/endpoints.js', () => ({ default: throwingHandler }));
+jest.unstable_mockModule('./routes/mcp.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/mountOauthDiscovery.js', () => ({ default: () => {} }));
+jest.unstable_mockModule('./routes/request.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/usage.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/user.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/websocket.js', () => ({ default: handler }));
+jest.unstable_mockModule('./routes/wellKnownFallback.js', () => ({ default: handler }));
+jest.unstable_mockModule('./html/renderPage.js', () => ({
+  default: (c) => c.html('<html></html>'),
+}));
+jest.unstable_mockModule('./middleware/apiContext.js', () => ({ default: passThrough }));
+jest.unstable_mockModule('./middleware/sentry.js', () => ({ default: passThrough }));
+jest.unstable_mockModule('./middleware/errorHandler.js', () => ({
+  default: () => (error, c) => c.json({ error: error.message }, 500),
+}));
+jest.unstable_mockModule('../lib/build/appMeta.js', () => ({ default: { buildId: 'build-1' } }));
+jest.unstable_mockModule('../lib/build/auth.js', () => ({ default: { configured: false } }));
+jest.unstable_mockModule('../lib/build/config.js', () => ({ default: {} }));
+jest.unstable_mockModule('../lib/server/auth/getAuth.js', () => ({ default: jest.fn() }));
+jest.unstable_mockModule('../lib/server/auth/getStrategies.js', () => ({ default: jest.fn() }));
+jest.unstable_mockModule('../lib/server/log/createLogger.js', () => ({
+  default: () => ({ info: jest.fn(), warn: jest.fn(), error: jest.fn() }),
+}));
+
+const { default: createApp } = await import('./app.js');
+
+const originalCwd = process.cwd();
+let serverDirectory;
+
+beforeAll(() => {
+  serverDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'lowdefy-server-app-'));
+  fs.mkdirSync(path.join(serverDirectory, 'dist/client/assets'), { recursive: true });
+  fs.writeFileSync(path.join(serverDirectory, 'dist/client/assets/main-abc.js'), 'export {};');
+  fs.writeFileSync(path.join(serverDirectory, 'dist/client/icon.svg'), '<svg></svg>');
+  process.chdir(serverDirectory);
+});
+
+afterAll(() => {
+  process.chdir(originalCwd);
+  fs.rmSync(serverDirectory, { recursive: true, force: true });
+});
+
+test.each([
+  ['GET', '/home'],
+  ['GET', '/'],
+  ['GET', '/404'],
+  ['GET', '/api/page/home'],
+  ['GET', '/api/user'],
+  ['POST', '/api/request/home/get_data'],
+  ['POST', '/api/endpoints/my_endpoint'],
+])('%s %s responds with Cache-Control private, no-store', async (method, url) => {
+  const res = await createApp().request(url, { method });
+  expect(res.headers.get('cache-control')).toEqual('private, no-store');
+});
+
+test('an endpoint that throws still responds with Cache-Control private, no-store', async () => {
+  const res = await createApp().request('/api/endpoints/my_endpoint', { method: 'POST' });
+  expect(res.status).toEqual(500);
+  expect(res.headers.get('cache-control')).toEqual('private, no-store');
+});
+
+test('hashed assets keep their long-lived immutable caching', async () => {
+  const res = await createApp().request('/assets/main-abc.js');
+  expect(res.status).toEqual(200);
+  expect(res.headers.get('cache-control')).toEqual('public, max-age=31536000, immutable');
+});
+
+test.each([
+  ['GET', '/icon.svg'],
+  ['GET', '/api/cron/nightly'],
+  ['POST', '/api/client-error'],
+  ['GET', '/api/lowdefy-health'],
+])('%s %s gets no no-store header', async (method, url) => {
+  const res = await createApp().request(url, { method });
+  expect(res.headers.get('cache-control')).not.toEqual('private, no-store');
+});

package/src/html/collectChunkClosure.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Every JS file and stylesheet a dynamic entry needs, following its static
+// imports - what the browser would otherwise discover one round trip at a time.
+function collectChunkClosure({ manifest, key, js, css }) {
+  const chunk = manifest[key];
+  if (js.has(chunk.file)) {
+    return;
+  }
+  js.add(chunk.file);
+  (chunk.css ?? []).forEach((file) => css.add(file));
+  (chunk.imports ?? []).forEach((importKey) =>
+    collectChunkClosure({ manifest, key: importKey, js, css })
+  );
+}
+
+export default collectChunkClosure;