@lowdefy/server-dev 0.0.0-experimental-20260908113207 → 0.0.0-experimental-20260908154018

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server-dev",
-  "version": "0.0.0-experimental-20260908113207",
+  "version": "0.0.0-experimental-20260908154018",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -45,40 +45,40 @@
     "@hono/mcp": "0.3.0",
     "@hono/node-server": "2.0.4",
     "@hono/vite-dev-server": "0.26.0",
-    "@lowdefy/actions-core": "0.0.0-experimental-20260908113207",
-    "@lowdefy/api": "0.0.0-experimental-20260908113207",
-    "@lowdefy/block-utils": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-aggrid": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-antd": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-antd-x": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-basic": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-captcha": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-echarts": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-loaders": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-markdown": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-tiptap": "0.0.0-experimental-20260908113207",
-    "@lowdefy/build": "0.0.0-experimental-20260908113207",
-    "@lowdefy/client": "0.0.0-experimental-20260908113207",
-    "@lowdefy/connection-axios-http": "0.0.0-experimental-20260908113207",
-    "@lowdefy/connection-mongodb": "0.0.0-experimental-20260908113207",
-    "@lowdefy/docs-content": "0.0.0-experimental-20260908113207",
-    "@lowdefy/e2e-utils": "0.0.0-experimental-20260908113207",
-    "@lowdefy/engine": "0.0.0-experimental-20260908113207",
-    "@lowdefy/errors": "0.0.0-experimental-20260908113207",
-    "@lowdefy/helpers": "0.0.0-experimental-20260908113207",
-    "@lowdefy/layout": "0.0.0-experimental-20260908113207",
-    "@lowdefy/logger": "0.0.0-experimental-20260908113207",
-    "@lowdefy/node-utils": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-change-case": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-dayjs": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-diff": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-js": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-mql": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-nunjucks": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-uuid": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-yaml": "0.0.0-experimental-20260908113207",
-    "@lowdefy/plugin-better-auth": "0.0.0-experimental-20260908113207",
-    "@lowdefy/websockets-core": "0.0.0-experimental-20260908113207",
+    "@lowdefy/actions-core": "0.0.0-experimental-20260908154018",
+    "@lowdefy/api": "0.0.0-experimental-20260908154018",
+    "@lowdefy/block-utils": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-aggrid": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-antd": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-antd-x": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-basic": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-captcha": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-echarts": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-loaders": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-markdown": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-tiptap": "0.0.0-experimental-20260908154018",
+    "@lowdefy/build": "0.0.0-experimental-20260908154018",
+    "@lowdefy/client": "0.0.0-experimental-20260908154018",
+    "@lowdefy/connection-axios-http": "0.0.0-experimental-20260908154018",
+    "@lowdefy/connection-mongodb": "0.0.0-experimental-20260908154018",
+    "@lowdefy/docs-content": "0.0.0-experimental-20260908154018",
+    "@lowdefy/e2e-utils": "0.0.0-experimental-20260908154018",
+    "@lowdefy/engine": "0.0.0-experimental-20260908154018",
+    "@lowdefy/errors": "0.0.0-experimental-20260908154018",
+    "@lowdefy/helpers": "0.0.0-experimental-20260908154018",
+    "@lowdefy/layout": "0.0.0-experimental-20260908154018",
+    "@lowdefy/logger": "0.0.0-experimental-20260908154018",
+    "@lowdefy/node-utils": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-change-case": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-dayjs": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-diff": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-js": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-mql": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-nunjucks": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-uuid": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-yaml": "0.0.0-experimental-20260908154018",
+    "@lowdefy/plugin-better-auth": "0.0.0-experimental-20260908154018",
+    "@lowdefy/websockets-core": "0.0.0-experimental-20260908154018",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@tailwindcss/postcss": "4.3.1",
     "@vitejs/plugin-react": "6.0.2",

package/package.original.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server-dev",
-  "version": "0.0.0-experimental-20260908113207",
+  "version": "0.0.0-experimental-20260908154018",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -51,40 +51,40 @@
     "@hono/mcp": "0.3.0",
     "@hono/node-server": "2.0.4",
     "@hono/vite-dev-server": "0.26.0",
-    "@lowdefy/actions-core": "0.0.0-experimental-20260908113207",
-    "@lowdefy/api": "0.0.0-experimental-20260908113207",
-    "@lowdefy/block-utils": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-aggrid": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-antd": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-antd-x": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-basic": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-captcha": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-echarts": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-loaders": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-markdown": "0.0.0-experimental-20260908113207",
-    "@lowdefy/blocks-tiptap": "0.0.0-experimental-20260908113207",
-    "@lowdefy/build": "0.0.0-experimental-20260908113207",
-    "@lowdefy/client": "0.0.0-experimental-20260908113207",
-    "@lowdefy/connection-axios-http": "0.0.0-experimental-20260908113207",
-    "@lowdefy/connection-mongodb": "0.0.0-experimental-20260908113207",
-    "@lowdefy/docs-content": "0.0.0-experimental-20260908113207",
-    "@lowdefy/e2e-utils": "0.0.0-experimental-20260908113207",
-    "@lowdefy/engine": "0.0.0-experimental-20260908113207",
-    "@lowdefy/errors": "0.0.0-experimental-20260908113207",
-    "@lowdefy/helpers": "0.0.0-experimental-20260908113207",
-    "@lowdefy/layout": "0.0.0-experimental-20260908113207",
-    "@lowdefy/logger": "0.0.0-experimental-20260908113207",
-    "@lowdefy/node-utils": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-change-case": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-dayjs": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-diff": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-js": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-mql": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-nunjucks": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-uuid": "0.0.0-experimental-20260908113207",
-    "@lowdefy/operators-yaml": "0.0.0-experimental-20260908113207",
-    "@lowdefy/plugin-better-auth": "0.0.0-experimental-20260908113207",
-    "@lowdefy/websockets-core": "0.0.0-experimental-20260908113207",
+    "@lowdefy/actions-core": "0.0.0-experimental-20260908154018",
+    "@lowdefy/api": "0.0.0-experimental-20260908154018",
+    "@lowdefy/block-utils": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-aggrid": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-antd": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-antd-x": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-basic": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-captcha": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-echarts": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-loaders": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-markdown": "0.0.0-experimental-20260908154018",
+    "@lowdefy/blocks-tiptap": "0.0.0-experimental-20260908154018",
+    "@lowdefy/build": "0.0.0-experimental-20260908154018",
+    "@lowdefy/client": "0.0.0-experimental-20260908154018",
+    "@lowdefy/connection-axios-http": "0.0.0-experimental-20260908154018",
+    "@lowdefy/connection-mongodb": "0.0.0-experimental-20260908154018",
+    "@lowdefy/docs-content": "0.0.0-experimental-20260908154018",
+    "@lowdefy/e2e-utils": "0.0.0-experimental-20260908154018",
+    "@lowdefy/engine": "0.0.0-experimental-20260908154018",
+    "@lowdefy/errors": "0.0.0-experimental-20260908154018",
+    "@lowdefy/helpers": "0.0.0-experimental-20260908154018",
+    "@lowdefy/layout": "0.0.0-experimental-20260908154018",
+    "@lowdefy/logger": "0.0.0-experimental-20260908154018",
+    "@lowdefy/node-utils": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-change-case": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-dayjs": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-diff": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-js": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-mql": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-nunjucks": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-uuid": "0.0.0-experimental-20260908154018",
+    "@lowdefy/operators-yaml": "0.0.0-experimental-20260908154018",
+    "@lowdefy/plugin-better-auth": "0.0.0-experimental-20260908154018",
+    "@lowdefy/websockets-core": "0.0.0-experimental-20260908154018",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@tailwindcss/postcss": "4.3.1",
     "@vitejs/plugin-react": "6.0.2",

package/src/app.js

@@ -25,6 +25,7 @@ import authMiddleware from './routes/auth.js';
 import clientErrorHandler from './routes/clientError.js';
 import createErrorHandler from './middleware/errorHandler.js';
 import createLogger from '../lib/server/log/createLogger.js';
+import cronForwardHandler from './routes/cronForward.js';
 import cronHandler from './routes/cron.js';
 import detachedHandler from './routes/detached.js';
 import devInspectHandler from './routes/devInspect.js';
@@ -184,6 +185,7 @@ function createApp() {
   // cap bodies at 10 MiB to match the agent route.
   app.all('/api/endpoints/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), endpointsHandler);
   app.get('/api/cron/*', cronHandler);
+  app.get('/api/cron-forward/*', cronForwardHandler);
   app.post('/api/detached/*', detachedHandler);
   app.all('/api/client-error', clientErrorHandler);
   app.all('/api/usage', usageHandler);

package/src/routes/cron.js

@@ -21,7 +21,9 @@ import getPathSegments from '../lib/getPathSegments.js';
 // Triggered by Vercel Cron in production: an HTTP GET to /api/cron/<endpointId>. Available in dev so
 // scheduled endpoints can be triggered locally with curl. Vercel auto-sends the value of the project
 // env var named exactly CRON_SECRET as `Authorization: Bearer <value>`, and the firing cron
-// expression in the `x-vercel-cron-schedule` header. Fails closed if CRON_SECRET is unset.
+// expression in the `x-vercel-cron-schedule` header. Fails closed if CRON_SECRET is unset. A request
+// forwarded from the production deployment of another environment (see cronForward.js) also names
+// the environment whose schedules apply in `x-lowdefy-cron-environment`.
 async function cronHandler(c) {
   if (c.req.method !== 'GET') {
     // A wrong-method request is client-caused: answer 405 rather than raising a
@@ -38,8 +40,9 @@ async function cronHandler(c) {
 
   const endpointId = getPathSegments(c, '/api/cron/').join('/');
   const cron = c.req.header('x-vercel-cron-schedule');
-  context.logger.info({ event: 'call_cron_endpoint', endpointId, cron });
-  const response = await runScheduledEndpoint(context, { endpointId, cron });
+  const environment = c.req.header('x-lowdefy-cron-environment');
+  context.logger.info({ event: 'call_cron_endpoint', endpointId, cron, environment });
+  const response = await runScheduledEndpoint(context, { endpointId, cron, environment });
   return c.json(response);
 }
 

package/src/routes/cronForward.js

@@ -0,0 +1,49 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { forwardScheduledEndpoint } from '@lowdefy/api';
+
+import getPathSegments from '../lib/getPathSegments.js';
+
+// Triggered by Vercel Cron on the production deployment: an HTTP GET to
+// /api/cron-forward/<environment>/<endpointId>, registered by `lowdefy vercel-output` for the
+// schedules of every environment declared with a url in config.cron.environments. Vercel fires crons
+// only on production, so production pings that environment's own /api/cron/<endpointId> (with the
+// environment's CRON_SECRET) and answers immediately. Same transport auth as cron (CRON_SECRET,
+// fails closed).
+async function cronForwardHandler(c) {
+  if (c.req.method !== 'GET') {
+    // A wrong-method request is client-caused: answer 405 rather than raising a
+    // fault that would be logged at error level and answered with a 500.
+    return c.json({ error: 'Method not allowed.' }, 405);
+  }
+  const context = c.get('lowdefyContext');
+
+  const secret = process.env.CRON_SECRET;
+  if (!secret || c.req.header('authorization') !== `Bearer ${secret}`) {
+    context.logger.warn({ event: 'cron_forward_unauthorized' });
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  const [environment, ...endpointSegments] = getPathSegments(c, '/api/cron-forward/');
+  const endpointId = endpointSegments.join('/');
+  const cron = c.req.header('x-vercel-cron-schedule');
+  context.logger.info({ event: 'call_cron_forward', environment, endpointId, cron });
+  const response = await forwardScheduledEndpoint(context, { environment, endpointId, cron });
+  return c.json(response);
+}
+
+export default cronForwardHandler;