remove globalThis and added URL to global

.specify/memory/constitution.md

@@ -105,23 +105,42 @@ During code review and planning:
 The `server.js` file MUST inject the following objects into VM context for use by `proxy.js`:
 
 **VM Context Injection Pattern:**
+
+server.js uses a spread operator pattern for cleaner context creation:
+
 ```javascript
-// Create a context with all globals that proxy.js needs
+// Define static VM context (libraries and built-ins)
+const globalVMContext = {
+  URLSearchParams,
+  console: logger,
+  crypto,
+  axios,
+  uuidv4,
+  jwt,
+  xmlBuilder,
+};
+
+// Load dynamic data from global/ directory into globalVariableContext
+let globalVariableContext = {};  // Populated by loadGlobalObjects()
+
+// Per-request: Create fresh context with all dependencies
 const context = vm.createContext({
-   ...globalVMContext,
-   ...globalVariableContext,
-   req,
-   res,
+  ...globalVMContext,           // Spread static dependencies
+  ...globalVariableContext,     // Spread dynamic data (e.g., google_drive_settings)
+  req,                          // Fresh request object
+  res                           // Fresh response object
 });
 script.runInContext(context);
 ```
 
+**Note:** proxy.js accesses these as direct variables (e.g., `google_drive_settings`, not `globalThis["google_drive_settings"]`). The VM context makes all properties available as top-level variables.
+
 **Core Infrastructure Context Variables:**
 
 1. **console** - Custom logger from `logger.js`
    - Purpose: Structured JSON logging
    - Usage: `console.info()`, `console.debug()`, `console.error()`
-   - Injected from: `globalVMContext.console`
+   - Injected from: `globalVMContext.console` (set to `logger`)
 
 2. **crypto** - Web Crypto API (built-in)
    - Purpose: UUID generation, cryptographic operations
@@ -129,14 +148,7 @@ script.runInContext(context);
    - Injected from: `globalVMContext.crypto`
    - Note: Web Crypto API available by default in Node.js
 
-3. **config** - Configuration object
-   - Purpose: Infrastructure settings ONLY (server host/port, logging level)
-   - Usage: `config.server.port`, `config.logging.level`
-   - Injected from: `global.config`
-   - Loaded from: `config/default.json` merged with ENV vars
-   - **DOES NOT contain**: Authentication, secrets, API keys, behavioral config (use global/ instead)
-
-4. **axios** - HTTP client library
+3. **axios** - HTTP client library
    - Purpose: Making HTTP requests to external APIs
    - Usage: `axios.get(url)`, `axios.post(url, data)`
    - Package: `axios`