@lowdefy/server-dev 0.0.0-experimental-20260720072521 → 0.0.0-experimental-20260720135014

package/src/app.js

@@ -1,188 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { Hono } from 'hono';
-import { bodyLimit } from 'hono/body-limit';
-import { serveStatic } from '@hono/node-server/serve-static';
-
-import agentHandler from './routes/agent.js';
-import apiContext from './middleware/apiContext.js';
-import authJson from '../lib/build/auth.js';
-import authMiddleware from './routes/auth.js';
-import clientErrorHandler from './routes/clientError.js';
-import createErrorHandler from './middleware/errorHandler.js';
-import createLogger from '../lib/server/log/createLogger.js';
-import cronHandler from './routes/cron.js';
-import detachedHandler from './routes/detached.js';
-import devInspectHandler from './routes/devInspect.js';
-import devToolsHandler from './routes/devTools.js';
-import feedbackHandler from './routes/feedback.js';
-import docsAppMapHandler from './routes/docs/appMap.js';
-import docsBuildStatusHandler from './routes/docs/buildStatus.js';
-import docsCheckpointsCreateHandler from './routes/docs/checkpointsCreate.js';
-import docsCheckpointsListHandler from './routes/docs/checkpointsList.js';
-import docsCheckpointsRevertHandler from './routes/docs/checkpointsRevert.js';
-import docsContentHandler from './routes/docs/content.js';
-import docsEvalOperatorHandler from './routes/docs/evalOperator.js';
-import docsExamplesHandler from './routes/docs/examples.js';
-import docsFindHandler from './routes/docs/find.js';
-import docsIndexHandler from './routes/docs/index.js';
-import docsInspectStateHandler from './routes/docs/inspectState.js';
-import docsLoadStateHandler from './routes/docs/loadState.js';
-import docsMcpHandler from './routes/docs/mcp.js';
-import docsPageConfigHandler from './routes/docs/pageConfig.js';
-import docsRunRequestHandler from './routes/docs/runRequest.js';
-import docsSnapshotStateHandler from './routes/docs/snapshotState.js';
-import docsStateCheckpointsListHandler from './routes/docs/stateCheckpointsList.js';
-import docsPluginDocHandler from './routes/docs/pluginDoc.js';
-import docsPluginsHandler from './routes/docs/plugins.js';
-import docsSchemaHandler from './routes/docs/schema.js';
-import docsScreenshotHandler from './routes/docs/screenshot.js';
-import docsSearchHandler from './routes/docs/search.js';
-import docsTypesHandler from './routes/docs/types.js';
-import endpointsHandler from './routes/endpoints.js';
-import getAuth from '../lib/server/auth/getAuth.js';
-import getStrategies from '../lib/server/auth/getStrategies.js';
-import getMockUser from '../lib/server/auth/getMockUser.js';
-import iconsDynamicHandler from './routes/iconsDynamic.js';
-import jitPageHandler from './routes/jitPage.js';
-import jsEnvHandler from './routes/jsEnv.js';
-import lowdefyConfig from '../lib/build/config.js';
-import pingHandler from './routes/ping.js';
-import reloadHandler from './routes/reload.js';
-import renderDevPage from './html/renderDevPage.js';
-import requestHandler from './routes/request.js';
-import rootHandler from './routes/root.js';
-import usageHandler from './routes/usage.js';
-import userHandler from './routes/user.js';
-import websocketHandler from './routes/websocket.js';
-
-const basePath = lowdefyConfig.basePath ?? '';
-
-// Dev Hono app — mounted into Vite via @hono/vite-dev-server (Vite owns HTTP
-// and serves /client/* modules with HMR; everything else lands here).
-// No compression in dev (parity with the old next.config compress: false,
-// and SSE must stay unbuffered).
-function createApp() {
-  const app = basePath ? new Hono().basePath(basePath) : new Hono();
-  const logger = createLogger({ server: 'lowdefy-dev' });
-
-  // No api context: SSE/health/static-js routes had no apiWrapper before.
-  app.get('/api/reload', reloadHandler);
-  app.get('/api/ping', pingHandler);
-  app.get('/api/js/:env', jsEnvHandler);
-  app.get('/api/icons/dynamic', iconsDynamicHandler);
-  app.get('/api/dev-tools', devToolsHandler);
-  // Annotation helper: the in-page overlay (Cmd/Ctrl+/) POSTs annotation
-  // batches here and gets back the enriched agent-readable text, which the
-  // overlay copies to the clipboard. No api context needed.
-  // /lowdefy-feedback is a reserved page-path prefix in dev, like /lowdefy-docs.
-  app.post('/lowdefy-feedback', feedbackHandler);
-
-  const mockUser = getMockUser();
-  if (authJson.configured === true && !mockUser) {
-    // Construct the BetterAuth instance and strategy verifiers at startup so
-    // config errors fail boot instead of the first request, and so the
-    // process-memoized singletons capture the base logger rather than the
-    // first request's rid-scoped child.
-    getAuth({ logger });
-    getStrategies({ logger });
-  }
-
-  // Docs and MCP endpoint for AI coding agents — always on in dev. Serves
-  // schemas/examples/docs for every installed plugin (core and local) plus
-  // the extracted core docs (@lowdefy/docs-content). Mounted outside /api/*
-  // so it can't clash with user API endpoints; /lowdefy-docs is a reserved page
-  // prefix in dev. The handlers need no auth protection or api context —
-  // they read build artifacts and node_modules directly — but run-request
-  // and eval-operator build a full Lowdefy context (createLowdefyContext),
-  // which resolves the caller from the request headers via resolveAuthentication.
-  app.all('/lowdefy-docs/mcp', docsMcpHandler);
-  app.get('/lowdefy-docs', docsIndexHandler);
-  app.get('/lowdefy-docs/build-status', docsBuildStatusHandler);
-  app.get('/lowdefy-docs/page-config/:pageId', docsPageConfigHandler);
-  app.get('/lowdefy-docs/find/:id', docsFindHandler);
-  app.get('/lowdefy-docs/screenshot/:pageId', docsScreenshotHandler);
-  app.get('/lowdefy-docs/inspect-state/:pageId', docsInspectStateHandler);
-  app.post('/lowdefy-docs/eval-operator', docsEvalOperatorHandler);
-  app.post('/lowdefy-docs/run-request', docsRunRequestHandler);
-  app.get('/lowdefy-docs/app-map', docsAppMapHandler);
-  app.get('/lowdefy-docs/checkpoints', docsCheckpointsListHandler);
-  app.post('/lowdefy-docs/checkpoints', docsCheckpointsCreateHandler);
-  app.post('/lowdefy-docs/checkpoints/revert', docsCheckpointsRevertHandler);
-  app.get('/lowdefy-docs/state-checkpoints', docsStateCheckpointsListHandler);
-  app.post('/lowdefy-docs/state-checkpoints/snapshot', docsSnapshotStateHandler);
-  app.post('/lowdefy-docs/state-checkpoints/load', docsLoadStateHandler);
-  // Live-tab inspection channel: dev tabs (client/Inspector.jsx) answer
-  // targeted SSE events by posting results here; GET lists connected tabs
-  // and serves checkpoint parts for the ?_checkpoint bootstrap.
-  app.all('/api/dev-inspect', devInspectHandler);
-  app.all('/api/dev-inspect/*', devInspectHandler);
-  app.get('/lowdefy-docs/plugins', docsPluginsHandler);
-  app.get('/lowdefy-docs/schema/:kind/:type', docsSchemaHandler);
-  app.get('/lowdefy-docs/examples/:type', docsExamplesHandler);
-  app.get('/lowdefy-docs/search', docsSearchHandler);
-  app.get('/lowdefy-docs/plugin-doc/:package{.+}', docsPluginDocHandler);
-  app.get('/lowdefy-docs/content/:slug{.+}', docsContentHandler);
-  app.get('/lowdefy-docs/:kind', docsTypesHandler);
-
-  app.use('/api/*', apiContext());
-  // Unified dev get-session: createLowdefyContext resolves the mock or headless
-  // caller into context.user on every path, so read it here rather than
-  // re-deriving the precedence. context.user is only absent in the real-engine
-  // case (the developer's own browser), which must fall through to BetterAuth.
-  // Registered before the /api/auth/* mount so this exact path wins while every
-  // other auth route still reaches the engine.
-  app.get('/api/auth/get-session', async (c, next) => {
-    const context = c.get('lowdefyContext');
-    if (context.user) return c.json({ session: { id: 'dev' }, user: context.user });
-    return next();
-  });
-  app.use('/api/auth/*', authMiddleware({ logger }));
-  app.get('/api/root', rootHandler);
-  app.get('/api/page/*', jitPageHandler);
-  app.all('/api/request/*', requestHandler);
-  // Endpoint payloads may carry base64 file content (emitFileContent + CallAPI);
-  // cap bodies at 10 MiB to match the agent route.
-  app.all('/api/endpoints/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), endpointsHandler);
-  app.get('/api/cron/*', cronHandler);
-  app.post('/api/detached/*', detachedHandler);
-  app.all('/api/client-error', clientErrorHandler);
-  app.all('/api/usage', usageHandler);
-  app.all('/api/agent/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), agentHandler);
-  app.get('/api/websocket', websocketHandler);
-  app.get('/api/user', userHandler);
-
-  // User public assets (icons, images). Vite serves /client modules itself.
-  app.use(
-    '/*',
-    serveStatic({
-      root: './public',
-      rewriteRequestPath: basePath ? (path) => path.replace(basePath, '') : undefined,
-    })
-  );
-
-  // Every page path renders the same shell — the client fetches config and
-  // handles home/404 routing, exactly like the old dev pages router did.
-  app.get('/', (c) => renderDevPage(c, { basePath }));
-  app.get('/:rest{.+}', (c) => renderDevPage(c, { basePath }));
-
-  app.onError(createErrorHandler({ basePath, logger }));
-
-  return app;
-}
-
-export default createApp();

package/src/html/renderDevPage.js

@@ -1,86 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import fs from 'node:fs';
-import path from 'node:path';
-
-import safeScriptJson from '../lib/safeScriptJson.js';
-
-// Dev HTML shell — config-free: the client fetches root config and page
-// config over the API (SWR), exactly like the old dev pages did. Theme and
-// app config are read per request so a lowdefyBuild does not require a
-// server restart for the pre-hydration values to update.
-//
-// @hono/vite-dev-server injects /@vite/client into this response; the
-// react-refresh preamble must be inlined here for @vitejs/plugin-react.
-const layerOrderScript = `(function(){var s=document.createElement("style");s.id="__lf-layer-order";s.textContent="@layer theme, base, antd, components, utilities;";document.head.prepend(s);new MutationObserver(function(){if(document.head.firstChild!==s)document.head.prepend(s)}).observe(document.head,{childList:true})})();`;
-
-function readBuildJson(name) {
-  try {
-    return JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build', `${name}.json`), 'utf8'));
-  } catch {
-    return {};
-  }
-}
-
-function renderDevPage(c, { basePath = '' }) {
-  const themeConfig = readBuildJson('theme');
-  const appJson = readBuildJson('app');
-
-  const VALID_COLOR_MODES = ['system', 'light', 'dark'];
-  const configColorMode = VALID_COLOR_MODES.includes(themeConfig.darkMode)
-    ? themeConfig.darkMode
-    : 'system';
-  const darkBg = themeConfig?.antd?.darkToken?.colorBgLayout ?? '#000';
-  const lightBg = themeConfig?.antd?.lightToken?.colorBgLayout ?? '';
-
-  const darkModeScript = `(function(){var c=${safeScriptJson(
-    configColorMode
-  )};var db=${safeScriptJson(darkBg)};var lb=${safeScriptJson(
-    lightBg
-  )};var d;if(c==="dark")d=true;else if(c==="light")d=false;else{try{var p=localStorage.getItem("lowdefy_darkMode");if(p==="dark")d=true;else if(p==="light")d=false;else d=window.matchMedia("(prefers-color-scheme:dark)").matches}catch(e){d=window.matchMedia("(prefers-color-scheme:dark)").matches}}var bg=d?db:lb;if(bg)document.documentElement.style.backgroundColor=bg})();`;
-
-  const html = `<!DOCTYPE html>
-<html class="lowdefy">
-  <head>
-    <meta charset="utf-8" />
-    <script>${layerOrderScript}</script>
-    <script>${darkModeScript}</script>
-    <link rel="manifest" href="${basePath}/manifest.webmanifest" />
-    <link rel="icon" type="image/svg+xml" href="${basePath}/icon.svg" />
-    <link rel="apple-touch-icon" href="${basePath}/apple-touch-icon.png" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <script type="module">
-import RefreshRuntime from '${basePath}/@react-refresh';
-RefreshRuntime.injectIntoGlobalHook(window);
-window.$RefreshReg$ = () => {};
-window.$RefreshSig$ = () => (type) => type;
-window.__vite_plugin_react_preamble_installed__ = true;
-    </script>
-    ${appJson.html?.appendHead ?? ''}
-  </head>
-  <body>
-    <div id="root"></div>
-    <script id="__LOWDEFY_CONFIG__" type="application/json">${safeScriptJson({ basePath })}</script>
-    ${appJson.html?.appendBody ?? ''}
-    <script type="module" src="${basePath}/client/main.jsx"></script>
-  </body>
-</html>`;
-
-  return c.html(html);
-}
-
-export default renderDevPage;

package/src/lib/getPathSegments.js

@@ -1,25 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-// Splits the rest of a catch-all route into decoded segments, independent of
-// any configured basePath. Mirrors the Next.js [...param] query arrays —
-// nested ids (slashes in pageId or endpointId) are real.
-function getPathSegments(c, prefix) {
-  const rest = c.req.path.split(prefix)[1] ?? '';
-  return rest.split('/').filter(Boolean).map(decodeURIComponent);
-}
-
-export default getPathSegments;

package/src/lib/safeScriptJson.js

@@ -1,38 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-// Escape characters that could break out of the enclosing <script> tag or
-// terminate a JS string literal. Used to defuse the js/bad-code-sanitization
-// class of injection for values embedded into inline scripts and the
-// application/json config script.
-const SCRIPT_ESCAPES = {
-  '<': '\\u003C',
-  '>': '\\u003E',
-  '\b': '\\b',
-  '\f': '\\f',
-  '\n': '\\n',
-  '\r': '\\r',
-  '\t': '\\t',
-  '\0': '\\0',
-  '\u2028': '\\u2028',
-  '\u2029': '\\u2029',
-};
-
-function safeScriptJson(value) {
-  return JSON.stringify(value).replace(/[<>\b\f\n\r\t\0\u2028\u2029]/g, (c) => SCRIPT_ESCAPES[c]);
-}
-
-export default safeScriptJson;

package/src/middleware/apiContext.js

@@ -1,32 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import createLowdefyContext from '../../lib/server/createLowdefyContext.js';
-
-// Replaces lib/server/apiWrapper.js. Errors thrown by handlers are routed by
-// Hono to the app-level error handler (src/middleware/errorHandler.js).
-function apiContext() {
-  return async function apiContextMiddleware(c, next) {
-    if (c.get('lowdefyContext')) {
-      return next();
-    }
-    const context = await createLowdefyContext({ c });
-    c.set('lowdefyContext', context);
-    return next();
-  };
-}
-
-export default apiContext;

package/src/middleware/errorHandler.js

@@ -1,55 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { serializer } from '@lowdefy/helpers';
-
-// Hono routes every handler error to the app-level error handler — upstream
-// middleware try/catch never sees them. API routes get the serialized error
-// JSON the old apiWrapper returned; page routes get a plain 500.
-function createErrorHandler({ basePath = '', logger }) {
-  return async function errorHandler(error, c) {
-    const path = basePath ? c.req.path.replace(basePath, '') : c.req.path;
-    // Unauthenticated requests to protected endpoints are expected traffic -
-    // one warning line and a 401, skipping the structured error log so
-    // probing cannot flood it. Keys strictly on the error name; the 500 path
-    // below is untouched.
-    if (error.name === 'AuthenticationError') {
-      logger.warn(`Unauthenticated request: ${c.req.method} ${c.req.path}`);
-      if (path.startsWith('/api/')) {
-        return c.json({ name: error.name, message: error.message }, 401);
-      }
-      return c.text('Unauthorized', 401);
-    }
-    const context = c.get('lowdefyContext');
-    if (context) {
-      await context.handleError(error);
-    } else {
-      logger.error(error);
-    }
-    if (path.startsWith('/api/')) {
-      const serialized = serializer.serialize(error);
-      if (serialized?.['~e']) {
-        delete serialized['~e'].received;
-        delete serialized['~e'].stack;
-        delete serialized['~e'].configKey;
-      }
-      return c.json(serialized, 500);
-    }
-    return c.text('Internal Server Error', 500);
-  };
-}
-
-export default createErrorHandler;

package/src/routes/agent.js

@@ -1,64 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { callAgent } from '@lowdefy/api';
-import { translate, type } from '@lowdefy/helpers';
-
-import getPathSegments from '../lib/getPathSegments.js';
-
-async function agentHandler(c) {
-  const context = c.get('lowdefyContext');
-  const t = (key, values) => translate({ key, values, i18n: context.i18n });
-  if (c.req.method !== 'POST') {
-    throw new Error(t('agent.runtime.methodNotAllowed'));
-  }
-  const segments = getPathSegments(c, '/api/agent/');
-  if (segments.length < 2) {
-    return c.json({ error: t('agent.runtime.invalidPath') }, 400);
-  }
-  const agentId = segments[segments.length - 1];
-  const pageId = segments.slice(0, -1).join('/');
-  context.logger.info({ event: 'call_agent', agentId, pageId });
-  const { conversationId } = c.req.query();
-  const { messages, urlQuery, sharedState } = await c.req.json();
-  if (!Array.isArray(messages)) {
-    return c.json({ error: t('agent.runtime.messagesMustBeArray') }, 400);
-  }
-  if (urlQuery != null && (typeof urlQuery !== 'object' || Array.isArray(urlQuery))) {
-    return c.json({ error: t('agent.runtime.urlQueryMustBeObject') }, 400);
-  }
-  if (sharedState != null && !type.isObject(sharedState)) {
-    return c.json({ error: t('agent.runtime.sharedStateMustBeObject') }, 400);
-  }
-  const { response: webResponse } = await callAgent(context, {
-    agentId,
-    pageId,
-    messages,
-    conversationId: conversationId ?? undefined,
-    sharedState: sharedState ?? undefined,
-    urlQuery: urlQuery ?? undefined,
-  });
-
-  // callAgent returns a Web Response — stream its body straight through.
-  return c.body(webResponse.body, 200, {
-    'Content-Type': 'text/event-stream',
-    'Cache-Control': 'no-cache',
-    Connection: 'keep-alive',
-    'Content-Encoding': 'none',
-  });
-}
-
-export default agentHandler;

package/src/routes/auth.js

@@ -1,43 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import authJson from '../../lib/build/auth.js';
-import getAuth from '../../lib/server/auth/getAuth.js';
-import getMockUser from '../../lib/server/auth/getMockUser.js';
-
-// Mounts BetterAuth's Web Standard handler on /api/auth/*. Hono routes HEAD
-// requests through GET handlers, so HEAD short-circuits before the handler -
-// corporate email link-checkers pre-fetch magic-link and verification URLs
-// with HEAD, and letting those reach the handler would consume the one-time
-// token before the user clicks.
-function authMiddleware({ logger }) {
-  return async function auth(c) {
-    if (authJson.configured !== true) {
-      return c.json({ message: 'Auth not configured' }, 404);
-    }
-    if (getMockUser()) {
-      // Mock user active - no auth engine runs; the get-session stub in
-      // app.js is the only auth endpoint.
-      return c.json({ message: 'Auth engine disabled while dev.mockUser is active' }, 404);
-    }
-    if (c.req.method === 'HEAD') {
-      return c.body(null, 200);
-    }
-    return getAuth({ logger }).handler(c.req.raw);
-  };
-}
-
-export default authMiddleware;

package/src/routes/clientError.js

@@ -1,57 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { logClientError } from '@lowdefy/api';
-
-import clientErrorStore from '../../lib/docs/clientErrorStore.js';
-
-async function clientErrorHandler(c) {
-  if (c.req.method !== 'POST') {
-    throw new Error('Only POST requests are supported.');
-  }
-  const context = c.get('lowdefyContext');
-
-  const origin = c.req.header('origin');
-  if (!origin) {
-    return c.json({ error: 'Forbidden' }, 403);
-  }
-  try {
-    if (new URL(origin).host !== c.req.header('host')) {
-      return c.json({ error: 'Forbidden' }, 403);
-    }
-  } catch {
-    return c.json({ error: 'Forbidden' }, 403);
-  }
-
-  // Dev keeps `received` in the payload — it powers error tracing in dev tools.
-  const body = await c.req.json();
-  const { error, ...response } = await logClientError(context, body);
-
-  // Feed the agent-facing feedback loop (GET /lowdefy-docs/build-status) with a
-  // serializable summary — not the full error object, which may carry
-  // non-serializable `received` values.
-  clientErrorStore.push({
-    timestamp: new Date().toISOString(),
-    name: error?.name ?? 'Error',
-    message: error?.message ?? null,
-    source: response.source ?? null,
-    config: response.config ?? null,
-  });
-
-  return c.json(response);
-}
-
-export default clientErrorHandler;

package/src/routes/cron.js

@@ -1,44 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { runScheduledEndpoint } from '@lowdefy/api';
-
-import getPathSegments from '../lib/getPathSegments.js';
-
-// Triggered by Vercel Cron in production: an HTTP GET to /api/cron/<endpointId>. Available in dev so
-// scheduled endpoints can be triggered locally with curl. Vercel auto-sends the value of the project
-// env var named exactly CRON_SECRET as `Authorization: Bearer <value>`, and the firing cron
-// expression in the `x-vercel-cron-schedule` header. Fails closed if CRON_SECRET is unset.
-async function cronHandler(c) {
-  if (c.req.method !== 'GET') {
-    throw new Error('Only GET requests are supported.');
-  }
-  const context = c.get('lowdefyContext');
-
-  const secret = process.env.CRON_SECRET;
-  if (!secret || c.req.header('authorization') !== `Bearer ${secret}`) {
-    context.logger.warn({ event: 'cron_unauthorized' });
-    return c.json({ error: 'Unauthorized' }, 401);
-  }
-
-  const endpointId = getPathSegments(c, '/api/cron/').join('/');
-  const cron = c.req.header('x-vercel-cron-schedule');
-  context.logger.info({ event: 'call_cron_endpoint', endpointId, cron });
-  const response = await runScheduledEndpoint(context, { endpointId, cron });
-  return c.json(response);
-}
-
-export default cronHandler;