lowdefy 5.5.1 → 6.0.0

package/dist/utils/ensurePnpmWorkspaceYaml.js

@@ -0,0 +1,58 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import fs from 'fs';
+import path from 'path';
+import { writeFile } from '@lowdefy/node-utils';
+import findPnpmWorkspaceRoot from './findPnpmWorkspaceRoot.js';
+// pnpm no longer reads the "pnpm" field in package.json, and pnpm 11 fails
+// installs with ERR_PNPM_IGNORED_BUILDS unless dependency build scripts are
+// allowed in pnpm-workspace.yaml. The key differs by version:
+// - packages is required by pnpm 9 and 10.0, and stops pnpm from treating the
+//   server as part of a parent workspace.
+// - onlyBuiltDependencies is read by early pnpm 10 versions.
+// - allowBuilds is read by pnpm >=10.29 and pnpm 11.
+const pnpmWorkspaceYaml = `packages:
+  - '.'
+onlyBuiltDependencies:
+  - better-sqlite3
+  - sharp
+allowBuilds:
+  better-sqlite3: true
+  sharp: true
+`;
+async function ensurePnpmWorkspaceYaml({ context, directory }) {
+    // Local mode runs against the monorepo packages; writing a nested
+    // pnpm-workspace.yaml there would corrupt the monorepo workspace.
+    if (context.lowdefyVersion === 'local') {
+        return;
+    }
+    const filePath = path.join(directory, 'pnpm-workspace.yaml');
+    // Keep existing files so users can allow builds for their own plugin deps.
+    if (fs.existsSync(filePath)) {
+        return;
+    }
+    // Apps inside a pnpm workspace install the server as part of that workspace —
+    // custom plugins pinned as workspace:* only resolve there, and the root's
+    // overrides, packageExtensions and build allowlists must keep applying.
+    // Writing packages: ['.'] would isolate the server and break all of that,
+    // so build allowlists stay the workspace root's responsibility.
+    const workspaceRoot = findPnpmWorkspaceRoot(path.dirname(directory));
+    if (workspaceRoot !== null) {
+        context.logger.debug(`Found pnpm workspace at ${workspaceRoot}; the server installs as part of that workspace.`);
+        return;
+    }
+    await writeFile(filePath, pnpmWorkspaceYaml);
+}
+export default ensurePnpmWorkspaceYaml;

package/dist/utils/findPnpmWorkspaceRoot.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import fs from 'fs';
+import path from 'path';
+// Mirrors how pnpm finds its workspace root: walk up from startDir and return
+// the first directory containing pnpm-workspace.yaml, or null if none exists.
+function findPnpmWorkspaceRoot(startDir) {
+    let dir = startDir;
+    while(dir !== path.dirname(dir)){
+        if (fs.existsSync(path.join(dir, 'pnpm-workspace.yaml'))) {
+            return dir;
+        }
+        dir = path.dirname(dir);
+    }
+    return null;
+}
+export default findPnpmWorkspaceRoot;

package/dist/utils/findTraceBase.js

@@ -0,0 +1,45 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import fs from 'fs';
+import path from 'path';
+// The base directory for @vercel/nft tracing. nft ignores files above the base, and when the server
+// directory is a pnpm workspace member the real dependency files live in the workspace root's
+// node_modules/.pnpm virtual store (the server's node_modules entries are relative symlinks pointing
+// up and out of the server directory). The base must therefore sit at or above the workspace root.
+// A higher base is always safe — it only lengthens the relative paths inside the function.
+function findTraceBase({ serverDirectory }) {
+    let directory = serverDirectory;
+    for(;;){
+        if (fs.existsSync(path.join(directory, 'pnpm-workspace.yaml'))) {
+            return directory;
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory) break;
+        directory = parent;
+    }
+    // No workspace root found — fall back to the repository root so workspace-like layouts without
+    // pnpm-workspace.yaml still trace, else the server directory itself (standalone install).
+    directory = serverDirectory;
+    for(;;){
+        if (fs.existsSync(path.join(directory, '.git'))) {
+            return directory;
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory) break;
+        directory = parent;
+    }
+    return serverDirectory;
+}
+export default findTraceBase;

package/dist/utils/getDirectories.js

@@ -22,7 +22,8 @@ function getDirectories({ configDirectory, options }) {
         config: configDirectory,
         build: path.join(server, 'build'),
         server,
-        dev: options.devDirectory ? path.resolve(options.devDirectory) : path.join(dotLowdefy, 'dev')
+        dev: options.devDirectory ? path.resolve(options.devDirectory) : path.join(dotLowdefy, 'dev'),
+        emails: path.join(dotLowdefy, 'emails')
     };
 }
 export default getDirectories;

package/dist/utils/getOptions.js

@@ -19,6 +19,8 @@
         ...cliConfig,
         ...commandLineOptions
     };
+    // commander parses --port as a string; port comparisons expect a number.
+    options.port = Number(options.port);
     return options;
 }
 export default getOptions;

package/dist/utils/installServer.js

@@ -12,31 +12,39 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { spawnProcess } from '@lowdefy/node-utils';
+*/ import { installIfPackageJsonChanged, spawnProcess } from '@lowdefy/node-utils';
 async function installServer({ context, directory }) {
-    context.logger.info({
-        spin: 'start'
-    }, 'Installing dependencies.');
-    try {
-        await spawnProcess({
-            command: context.pnpmCmd,
-            args: [
-                'install',
-                '--no-frozen-lockfile'
-            ],
-            stdOutLineHandler: (line)=>context.logger.debug(line),
-            processOptions: {
-                cwd: directory,
-                // https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2#command-injection-via-args-parameter-of-child_processspawn-without-shell-option-enabled-on-windows-cve-2024-27980---high
-                shell: process.platform === 'win32'
+    const installed = await installIfPackageJsonChanged({
+        directory,
+        install: async ()=>{
+            context.logger.info({
+                spin: 'start'
+            }, 'Installing dependencies.');
+            try {
+                await spawnProcess({
+                    command: context.pnpmCmd,
+                    args: [
+                        'install',
+                        '--no-frozen-lockfile'
+                    ],
+                    stdOutLineHandler: (line)=>context.logger.debug(line),
+                    processOptions: {
+                        cwd: directory,
+                        // https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2#command-injection-via-args-parameter-of-child_processspawn-without-shell-option-enabled-on-windows-cve-2024-27980---high
+                        shell: process.platform === 'win32'
+                    }
+                });
+            } catch (error) {
+                context.logger.info({
+                    spin: 'fail'
+                }, 'Installing dependencies.');
+                throw new Error('Dependency installation failed.');
             }
-        });
-    } catch (error) {
-        context.logger.info({
-            spin: 'fail'
-        }, 'Installing dependencies.');
-        throw new Error('Dependency installation failed.');
+            context.logger.info('Dependencies install successfully.');
+        }
+    });
+    if (!installed) {
+        context.logger.info('Dependencies unchanged.');
     }
-    context.logger.info('Dependencies install successfully.');
 }
 export default installServer;

package/dist/utils/{runNextBuild.js → runClientBuild.js}

@@ -15,25 +15,25 @@
 */ import { spawnProcess } from '@lowdefy/node-utils';
 function createStdOutLineHandler({ context }) {
     function stdOutLineHandler(line) {
-        // Matches next build output of form: ┌ λ /           261 B        403 kB
-        const match = line.match(/┌ λ \/\s*\d* [a-zA-Z]*\s*(\d* [a-zA-Z]*)/u);
+        // Matches vite build output of form: dist/client/assets/main-XXXX.js  5,205.62 kB │ gzip: 1,544.04 kB
+        const match = line.match(/assets\/main-[\w-]+\.js\s+[\d,.]+ kB │ gzip:\s+([\d,.]+ kB)/u);
         if (match) {
-            context.logger.info(`Home page first load JS size: ${match[1]}.`);
+            context.logger.info(`Client bundle size (gzip): ${match[1]}.`);
         }
         context.logger.debug(line);
     }
     return stdOutLineHandler;
 }
-async function runNextBuild({ context, directory }) {
+async function runClientBuild({ context, directory }) {
     context.logger.info({
         spin: 'start'
-    }, 'Running Next build.');
+    }, 'Running client build.');
     try {
         await spawnProcess({
             command: context.pnpmCmd,
             args: [
                 'run',
-                'build:next'
+                'build:client'
             ],
             stdOutLineHandler: createStdOutLineHandler({
                 context
@@ -42,18 +42,15 @@ async function runNextBuild({ context, directory }) {
                 // https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2#command-injection-via-args-parameter-of-child_processspawn-without-shell-option-enabled-on-windows-cve-2024-27980---high
                 shell: process.platform === 'win32',
                 cwd: directory,
-                env: {
-                    ...process.env,
-                    NEXT_TELEMETRY_DISABLED: context.options.disableTelemetry ? '1' : undefined
-                }
+                env: process.env
             }
         });
     } catch (error) {
         context.logger.info({
             spin: 'fail'
-        }, 'Running Next build.');
-        throw new Error('Next build failed.');
+        }, 'Running client build.');
+        throw new Error('Client build failed.');
     }
-    context.logger.info('Next build successful.');
+    context.logger.info('Client build successful.');
 }
-export default runNextBuild;
+export default runClientBuild;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lowdefy",
-  "version": "5.5.1",
+  "version": "6.0.0",
   "license": "Apache-2.0",
   "description": "Lowdefy CLI",
   "homepage": "https://lowdefy.com",
@@ -32,28 +32,29 @@
   ],
   "exports": "./dist/index.js",
   "dependencies": {
-    "@lowdefy/errors": "5.5.1",
-    "@lowdefy/helpers": "5.5.1",
-    "@lowdefy/logger": "5.5.1",
-    "@lowdefy/node-utils": "5.5.1",
-    "axios": "1.8.2",
-    "commander": "11.1.0",
+    "@lowdefy/errors": "6.0.0",
+    "@lowdefy/helpers": "6.0.0",
+    "@lowdefy/logger": "6.0.0",
+    "@lowdefy/node-utils": "6.0.0",
+    "@vercel/nft": "1.10.2",
+    "axios": "1.15.2",
+    "commander": "14.0.3",
     "decompress": "4.2.1",
     "decompress-targz": "4.1.1",
     "dotenv": "16.3.1",
-    "semver": "7.5.4",
-    "uuid": "9.0.1",
-    "yaml": "2.3.4"
+    "semver": "7.7.4",
+    "uuid": "14.0.0",
+    "yaml": "2.9.0"
   },
   "devDependencies": {
     "@jest/globals": "28.1.3",
-    "@swc/cli": "0.8.0",
-    "@swc/core": "1.15.18",
+    "@swc/cli": "0.8.1",
+    "@swc/core": "1.15.32",
     "@swc/jest": "0.2.39",
     "jest": "28.1.3"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "publishConfig": {
     "access": "public"