@lowdefy/server-dev 5.6.0 → 6.0.0

package/package.original.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server-dev",
-  "version": "5.6.0",
+  "version": "6.0.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -28,82 +28,96 @@
   "files": [
     "lib/*",
     "manager/*",
-    "pages/*",
     "public_default/*",
-    "next.config.js",
     "package.original.json",
     ".eslintrc.yaml",
-    ".npmrc"
+    ".npmrc",
+    "src/*",
+    "client/*",
+    "vite.config.js",
+    "postcss.config.cjs"
   ],
   "scripts": {
     "build": "cp package.json package.original.json || copy package.json package.original.json",
+    "prepublishOnly": "pnpm build",
     "start": "node manager/run.mjs",
-    "lint": "next lint",
-    "next": "next",
-    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
-    "prepublishOnly": "pnpm build"
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
   },
   "dependencies": {
-    "@lowdefy/actions-core": "5.6.0",
-    "@lowdefy/api": "5.6.0",
-    "@lowdefy/block-utils": "5.6.0",
-    "@lowdefy/blocks-aggrid": "5.6.0",
-    "@lowdefy/blocks-antd": "5.6.0",
-    "@lowdefy/blocks-antd-x": "5.6.0",
-    "@lowdefy/blocks-basic": "5.6.0",
-    "@lowdefy/blocks-echarts": "5.6.0",
-    "@lowdefy/blocks-loaders": "5.6.0",
-    "@lowdefy/blocks-markdown": "5.6.0",
-    "@lowdefy/blocks-tiptap": "5.6.0",
-    "@lowdefy/build": "5.6.0",
-    "@lowdefy/client": "5.6.0",
-    "@lowdefy/connection-axios-http": "5.6.0",
-    "@lowdefy/engine": "5.6.0",
-    "@lowdefy/errors": "5.6.0",
-    "@lowdefy/helpers": "5.6.0",
-    "@lowdefy/layout": "5.6.0",
-    "@lowdefy/logger": "5.6.0",
-    "@lowdefy/node-utils": "5.6.0",
-    "@lowdefy/operators-change-case": "5.6.0",
-    "@lowdefy/operators-dayjs": "5.6.0",
-    "@lowdefy/operators-diff": "5.6.0",
-    "@lowdefy/operators-js": "5.6.0",
-    "@lowdefy/operators-mql": "5.6.0",
-    "@lowdefy/operators-nunjucks": "5.6.0",
-    "@lowdefy/operators-uuid": "5.6.0",
-    "@lowdefy/operators-yaml": "5.6.0",
-    "@lowdefy/plugin-next-auth": "5.6.0",
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
+    "@auth/core": "0.41.2",
+    "@hono/auth-js": "1.1.1",
+    "@hono/mcp": "0.3.0",
+    "@hono/node-server": "2.0.4",
+    "@hono/vite-dev-server": "0.26.0",
+    "@lowdefy/actions-core": "6.0.0",
+    "@lowdefy/api": "6.0.0",
+    "@lowdefy/block-utils": "6.0.0",
+    "@lowdefy/blocks-aggrid": "6.0.0",
+    "@lowdefy/blocks-antd": "6.0.0",
+    "@lowdefy/blocks-antd-x": "6.0.0",
+    "@lowdefy/blocks-basic": "6.0.0",
+    "@lowdefy/blocks-echarts": "6.0.0",
+    "@lowdefy/blocks-loaders": "6.0.0",
+    "@lowdefy/blocks-markdown": "6.0.0",
+    "@lowdefy/blocks-tiptap": "6.0.0",
+    "@lowdefy/build": "6.0.0",
+    "@lowdefy/client": "6.0.0",
+    "@lowdefy/connection-axios-http": "6.0.0",
+    "@lowdefy/docs-content": "6.0.0",
+    "@lowdefy/engine": "6.0.0",
+    "@lowdefy/errors": "6.0.0",
+    "@lowdefy/helpers": "6.0.0",
+    "@lowdefy/layout": "6.0.0",
+    "@lowdefy/logger": "6.0.0",
+    "@lowdefy/node-utils": "6.0.0",
+    "@lowdefy/operators-change-case": "6.0.0",
+    "@lowdefy/operators-dayjs": "6.0.0",
+    "@lowdefy/operators-diff": "6.0.0",
+    "@lowdefy/operators-js": "6.0.0",
+    "@lowdefy/operators-mql": "6.0.0",
+    "@lowdefy/operators-nunjucks": "6.0.0",
+    "@lowdefy/operators-uuid": "6.0.0",
+    "@lowdefy/operators-yaml": "6.0.0",
+    "@lowdefy/plugin-next-auth": "6.0.0",
+    "@lowdefy/websockets-core": "6.0.0",
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "@tailwindcss/postcss": "4.3.1",
+    "@vitejs/plugin-react": "6.0.2",
     "antd": "6.3.1",
-    "dayjs": "1.11.19",
     "chokidar": "3.5.3",
+    "dayjs": "1.11.20",
     "dotenv": "16.3.1",
-    "@tailwindcss/postcss": "4.2.1",
-    "next": "16.1.6",
-    "postcss": "8.5.6",
-    "tailwindcss": "4.2.1",
-    "next-auth": "4.24.10",
+    "hono": "4.12.25",
+    "html-to-image": "1.11.13",
     "opener": "1.5.2",
-    "pino": "8.16.2",
+    "pino": "10.3.1",
+    "playwright-core": "1.59.1",
+    "postcss": "8.5.6",
     "process": "0.11.10",
     "react": "18.2.0",
     "react-dom": "18.2.0",
     "react-icons": "5.6.0",
     "swr": "2.2.4",
-    "uuid": "13.0.0",
-    "yaml": "2.3.4",
-    "yargs": "17.7.2"
+    "tailwindcss": "4.3.1",
+    "tinykeys": "3.0.0",
+    "uuid": "14.0.0",
+    "vite": "8.0.16",
+    "ws": "8.18.0",
+    "yaml": "2.9.0",
+    "yargs": "18.0.0",
+    "zod": "3.25.76"
   },
   "devDependencies": {
-    "@next/eslint-plugin-next": "16.1.6",
     "jest": "28.1.3",
     "webpack": "5.94.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "type": "module"
 }

package/postcss.config.cjs

@@ -0,0 +1 @@
+module.exports = { plugins: { '@tailwindcss/postcss': {} } };

package/src/app.js

@@ -0,0 +1,175 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
+import { initAuthConfig } from '@hono/auth-js';
+import { serveStatic } from '@hono/node-server/serve-static';
+
+import agentHandler from './routes/agent.js';
+import apiContext from './middleware/apiContext.js';
+import authJson from '../lib/build/auth.js';
+import authMiddleware from './routes/auth.js';
+import clientErrorHandler from './routes/clientError.js';
+import createErrorHandler from './middleware/errorHandler.js';
+import createLogger from '../lib/server/log/createLogger.js';
+import cronForwardHandler from './routes/cronForward.js';
+import cronHandler from './routes/cron.js';
+import detachedHandler from './routes/detached.js';
+import devInspectHandler from './routes/devInspect.js';
+import devToolsHandler from './routes/devTools.js';
+import feedbackHandler from './routes/feedback.js';
+import docsAppMapHandler from './routes/docs/appMap.js';
+import docsBuildStatusHandler from './routes/docs/buildStatus.js';
+import docsCheckpointsCreateHandler from './routes/docs/checkpointsCreate.js';
+import docsCheckpointsListHandler from './routes/docs/checkpointsList.js';
+import docsCheckpointsRevertHandler from './routes/docs/checkpointsRevert.js';
+import docsContentHandler from './routes/docs/content.js';
+import docsEvalOperatorHandler from './routes/docs/evalOperator.js';
+import docsExamplesHandler from './routes/docs/examples.js';
+import docsFindHandler from './routes/docs/find.js';
+import docsIndexHandler from './routes/docs/index.js';
+import docsInspectStateHandler from './routes/docs/inspectState.js';
+import docsLoadStateHandler from './routes/docs/loadState.js';
+import docsMcpHandler from './routes/docs/mcp.js';
+import docsPageConfigHandler from './routes/docs/pageConfig.js';
+import docsRunRequestHandler from './routes/docs/runRequest.js';
+import docsSnapshotStateHandler from './routes/docs/snapshotState.js';
+import docsStateCheckpointsListHandler from './routes/docs/stateCheckpointsList.js';
+import docsPluginDocHandler from './routes/docs/pluginDoc.js';
+import docsPluginsHandler from './routes/docs/plugins.js';
+import docsSchemaHandler from './routes/docs/schema.js';
+import docsScreenshotHandler from './routes/docs/screenshot.js';
+import docsSearchHandler from './routes/docs/search.js';
+import docsTypesHandler from './routes/docs/types.js';
+import endpointsHandler from './routes/endpoints.js';
+import getAuthConfig from '../lib/server/auth/getAuthConfig.js';
+import jitPageHandler from './routes/jitPage.js';
+import lowdefyConfig from '../lib/build/config.js';
+import mcpHandler from './routes/mcp.js';
+import pingHandler from './routes/ping.js';
+import reloadHandler from './routes/reload.js';
+import renderDevPage from './html/renderDevPage.js';
+import requestHandler from './routes/request.js';
+import rootHandler from './routes/root.js';
+import usageHandler from './routes/usage.js';
+import websocketHandler from './routes/websocket.js';
+
+const basePath = lowdefyConfig.basePath ?? '';
+
+// Dev Hono app — mounted into Vite via @hono/vite-dev-server (Vite owns HTTP
+// and serves /client/* modules with HMR; everything else lands here).
+// No compression in dev (parity with the old next.config compress: false,
+// and SSE must stay unbuffered).
+function createApp() {
+  const app = basePath ? new Hono().basePath(basePath) : new Hono();
+  const logger = createLogger({ server: 'lowdefy-dev' });
+
+  // No api context: SSE/health routes had no apiWrapper before.
+  app.get('/api/reload', reloadHandler);
+  app.get('/api/ping', pingHandler);
+  app.get('/api/dev-tools', devToolsHandler);
+  // Annotation helper: the in-page overlay (Cmd/Ctrl+/) POSTs annotation
+  // batches here and gets back the enriched agent-readable text, which the
+  // overlay copies to the clipboard. No api context needed.
+  // /lowdefy-feedback is a reserved page-path prefix in dev, like /lowdefy-docs.
+  app.post('/lowdefy-feedback', feedbackHandler);
+
+  // Auth config must be registered before the /lowdefy-docs routes: Hono
+  // middleware only applies to routes registered after it, and run-request/
+  // eval-operator build a full Lowdefy context whose getSession(c) reads the
+  // authConfig this middleware sets. It does not protect any route — it only
+  // makes the auth config available on the Hono context.
+  if (authJson.configured === true) {
+    app.use(
+      '*',
+      initAuthConfig(() => getAuthConfig({ logger }))
+    );
+  }
+
+  // Docs and MCP endpoint for AI coding agents — always on in dev. Serves
+  // schemas/examples/docs for every installed plugin (core and local) plus
+  // the extracted core docs (@lowdefy/docs-content). Mounted outside /api/*
+  // so it can't clash with user API endpoints; /lowdefy-docs is a reserved page
+  // prefix in dev. The handlers need no auth protection or api context —
+  // they read build artifacts and node_modules directly — but run-request
+  // and eval-operator read the caller's session, hence initAuthConfig above.
+  app.all('/lowdefy-docs/mcp', docsMcpHandler);
+  app.get('/lowdefy-docs', docsIndexHandler);
+  app.get('/lowdefy-docs/build-status', docsBuildStatusHandler);
+  app.get('/lowdefy-docs/page-config/:pageId', docsPageConfigHandler);
+  app.get('/lowdefy-docs/find/:id', docsFindHandler);
+  app.get('/lowdefy-docs/screenshot/:pageId', docsScreenshotHandler);
+  app.get('/lowdefy-docs/inspect-state/:pageId', docsInspectStateHandler);
+  app.post('/lowdefy-docs/eval-operator', docsEvalOperatorHandler);
+  app.post('/lowdefy-docs/run-request', docsRunRequestHandler);
+  app.get('/lowdefy-docs/app-map', docsAppMapHandler);
+  app.get('/lowdefy-docs/checkpoints', docsCheckpointsListHandler);
+  app.post('/lowdefy-docs/checkpoints', docsCheckpointsCreateHandler);
+  app.post('/lowdefy-docs/checkpoints/revert', docsCheckpointsRevertHandler);
+  app.get('/lowdefy-docs/state-checkpoints', docsStateCheckpointsListHandler);
+  app.post('/lowdefy-docs/state-checkpoints/snapshot', docsSnapshotStateHandler);
+  app.post('/lowdefy-docs/state-checkpoints/load', docsLoadStateHandler);
+  // Live-tab inspection channel: dev tabs (client/Inspector.jsx) answer
+  // targeted SSE events by posting results here; GET lists connected tabs
+  // and serves checkpoint parts for the ?_checkpoint bootstrap.
+  app.all('/api/dev-inspect', devInspectHandler);
+  app.all('/api/dev-inspect/*', devInspectHandler);
+  app.get('/lowdefy-docs/plugins', docsPluginsHandler);
+  app.get('/lowdefy-docs/schema/:kind/:type', docsSchemaHandler);
+  app.get('/lowdefy-docs/examples/:type', docsExamplesHandler);
+  app.get('/lowdefy-docs/search', docsSearchHandler);
+  app.get('/lowdefy-docs/plugin-doc/:package{.+}', docsPluginDocHandler);
+  app.get('/lowdefy-docs/content/:slug{.+}', docsContentHandler);
+  app.get('/lowdefy-docs/:kind', docsTypesHandler);
+
+  app.use('/api/*', apiContext());
+  app.use('/api/auth/*', authMiddleware());
+  app.get('/api/root', rootHandler);
+  app.get('/api/page/*', jitPageHandler);
+  app.all('/api/request/*', requestHandler);
+  // Endpoint payloads may carry base64 file content (emitFileContent + CallAPI);
+  // cap bodies at 10 MiB to match the agent route.
+  app.all('/api/endpoints/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), endpointsHandler);
+  app.get('/api/cron/*', cronHandler);
+  app.get('/api/cron-forward/*', cronForwardHandler);
+  app.post('/api/detached/*', detachedHandler);
+  app.all('/api/client-error', clientErrorHandler);
+  app.all('/api/usage', usageHandler);
+  app.all('/api/agent/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), agentHandler);
+  app.all('/api/mcp', bodyLimit({ maxSize: 10 * 1024 * 1024 }), mcpHandler);
+  app.get('/api/websocket', websocketHandler);
+
+  // User public assets (icons, images). Vite serves /client modules itself.
+  app.use(
+    '/*',
+    serveStatic({
+      root: './public',
+      rewriteRequestPath: basePath ? (path) => path.replace(basePath, '') : undefined,
+    })
+  );
+
+  // Every page path renders the same shell — the client fetches config and
+  // handles home/404 routing, exactly like the old dev pages router did.
+  app.get('/', (c) => renderDevPage(c, { basePath }));
+  app.get('/:rest{.+}', (c) => renderDevPage(c, { basePath }));
+
+  app.onError(createErrorHandler({ basePath, logger }));
+
+  return app;
+}
+
+export default createApp();

package/src/html/renderDevPage.js

@@ -0,0 +1,86 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+import safeScriptJson from '../lib/safeScriptJson.js';
+
+// Dev HTML shell — config-free: the client fetches root config and page
+// config over the API (SWR), exactly like the old dev pages did. Theme and
+// app config are read per request so a lowdefyBuild does not require a
+// server restart for the pre-hydration values to update.
+//
+// @hono/vite-dev-server injects /@vite/client into this response; the
+// react-refresh preamble must be inlined here for @vitejs/plugin-react.
+const layerOrderScript = `(function(){var s=document.createElement("style");s.id="__lf-layer-order";s.textContent="@layer theme, base, antd, components, utilities;";document.head.prepend(s);new MutationObserver(function(){if(document.head.firstChild!==s)document.head.prepend(s)}).observe(document.head,{childList:true})})();`;
+
+function readBuildJson(name) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(process.cwd(), 'build', `${name}.json`), 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+function renderDevPage(c, { basePath = '' }) {
+  const themeConfig = readBuildJson('theme');
+  const appJson = readBuildJson('app');
+
+  const VALID_COLOR_MODES = ['system', 'light', 'dark'];
+  const configColorMode = VALID_COLOR_MODES.includes(themeConfig.darkMode)
+    ? themeConfig.darkMode
+    : 'system';
+  const darkBg = themeConfig?.antd?.darkToken?.colorBgLayout ?? '#000';
+  const lightBg = themeConfig?.antd?.lightToken?.colorBgLayout ?? '';
+
+  const darkModeScript = `(function(){var c=${safeScriptJson(
+    configColorMode
+  )};var db=${safeScriptJson(darkBg)};var lb=${safeScriptJson(
+    lightBg
+  )};var d;if(c==="dark")d=true;else if(c==="light")d=false;else{try{var p=localStorage.getItem("lowdefy_darkMode");if(p==="dark")d=true;else if(p==="light")d=false;else d=window.matchMedia("(prefers-color-scheme:dark)").matches}catch(e){d=window.matchMedia("(prefers-color-scheme:dark)").matches}}var bg=d?db:lb;document.documentElement.style.colorScheme=d?"dark":"light";if(bg)document.documentElement.style.backgroundColor=bg})();`;
+
+  const html = `<!DOCTYPE html>
+<html class="lowdefy">
+  <head>
+    <meta charset="utf-8" />
+    <script>${layerOrderScript}</script>
+    <script>${darkModeScript}</script>
+    <link rel="manifest" href="${basePath}/manifest.webmanifest" />
+    <link rel="icon" type="image/svg+xml" href="${basePath}/icon.svg" />
+    <link rel="apple-touch-icon" href="${basePath}/apple-touch-icon.png" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <script type="module">
+import RefreshRuntime from '${basePath}/@react-refresh';
+RefreshRuntime.injectIntoGlobalHook(window);
+window.$RefreshReg$ = () => {};
+window.$RefreshSig$ = () => (type) => type;
+window.__vite_plugin_react_preamble_installed__ = true;
+    </script>
+    ${appJson.html?.appendHead ?? ''}
+  </head>
+  <body>
+    <div id="root"></div>
+    <script id="__LOWDEFY_CONFIG__" type="application/json">${safeScriptJson({ basePath })}</script>
+    ${appJson.html?.appendBody ?? ''}
+    <script type="module" src="${basePath}/client/main.jsx"></script>
+  </body>
+</html>`;
+
+  return c.html(html);
+}
+
+export default renderDevPage;

package/src/lib/getPathSegments.js

@@ -0,0 +1,25 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Splits the rest of a catch-all route into decoded segments, independent of
+// any configured basePath. Mirrors the Next.js [...param] query arrays —
+// nested ids (slashes in pageId or endpointId) are real.
+function getPathSegments(c, prefix) {
+  const rest = c.req.path.split(prefix)[1] ?? '';
+  return rest.split('/').filter(Boolean).map(decodeURIComponent);
+}
+
+export default getPathSegments;

package/src/lib/safeScriptJson.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Escape characters that could break out of the enclosing <script> tag or
+// terminate a JS string literal. Used to defuse the js/bad-code-sanitization
+// class of injection for values embedded into inline scripts and the
+// application/json config script.
+const SCRIPT_ESCAPES = {
+  '<': '\\u003C',
+  '>': '\\u003E',
+  '\b': '\\b',
+  '\f': '\\f',
+  '\n': '\\n',
+  '\r': '\\r',
+  '\t': '\\t',
+  '\0': '\\0',
+  '\u2028': '\\u2028',
+  '\u2029': '\\u2029',
+};
+
+function safeScriptJson(value) {
+  return JSON.stringify(value).replace(/[<>\b\f\n\r\t\0\u2028\u2029]/g, (c) => SCRIPT_ESCAPES[c]);
+}
+
+export default safeScriptJson;

package/src/middleware/apiContext.js

@@ -0,0 +1,32 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import createLowdefyContext from '../../lib/server/createLowdefyContext.js';
+
+// Replaces lib/server/apiWrapper.js. Errors thrown by handlers are routed by
+// Hono to the app-level error handler (src/middleware/errorHandler.js).
+function apiContext() {
+  return async function apiContextMiddleware(c, next) {
+    if (c.get('lowdefyContext')) {
+      return next();
+    }
+    const context = await createLowdefyContext({ c });
+    c.set('lowdefyContext', context);
+    return next();
+  };
+}
+
+export default apiContext;

package/src/middleware/errorHandler.js

@@ -0,0 +1,48 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { redactErrorResponse } from '@lowdefy/api';
+
+// Hono routes every handler error to the app-level error handler — upstream
+// middleware try/catch never sees them. API routes get the serialized error
+// JSON the old apiWrapper returned; page routes get a plain 500.
+function createErrorHandler({ basePath = '', logger }) {
+  return async function errorHandler(error, c) {
+    const path = basePath ? c.req.path.replace(basePath, '') : c.req.path;
+    // Unauthenticated requests to protected endpoints are expected traffic -
+    // one warning line and a 401, skipping the structured error log so
+    // probing cannot flood it. Keys strictly on the error name.
+    if (error.name === 'AuthenticationError') {
+      logger.warn(`Unauthenticated request: ${c.req.method} ${c.req.path}`);
+      if (path.startsWith('/api/')) {
+        return c.json({ name: error.name, message: error.message }, 401);
+      }
+      return c.text('Unauthorized', 401);
+    }
+    const context = c.get('lowdefyContext');
+    if (context) {
+      await context.handleError(error);
+    } else {
+      logger.error(error);
+    }
+    if (path.startsWith('/api/')) {
+      return c.json(redactErrorResponse(context, error), 500);
+    }
+    return c.text('Internal Server Error', 500);
+  };
+}
+
+export default createErrorHandler;