@lowdefy/server 5.5.1 → 6.0.0

package/src/html/renderPage.js

@@ -0,0 +1,80 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { getPageConfig, getRootConfig } from '@lowdefy/api';
+
+import appJson from '../../lib/build/app.js';
+import lowdefyConfig from '../../lib/build/config.js';
+import themeConfig from '../../lib/build/theme.js';
+import getAssets from './getAssets.js';
+import template from './template.js';
+
+const basePath = lowdefyConfig.basePath ?? '';
+
+// Replaces pages/[[...pageId]].js getServerSideProps and pages/404.js
+// getStaticProps. The home redirect logic lives here, not at the route level.
+async function renderPage(c, { pageId, status = 200 }) {
+  const context = c.get('lowdefyContext');
+  const { logger, session } = context;
+
+  let resolvedPageId = pageId;
+  const rootConfig = await getRootConfig(context);
+
+  if (!resolvedPageId) {
+    const { home } = rootConfig;
+    if (home.configured === false) {
+      logger.info({ event: 'redirect_to_homepage', pageId: home.pageId });
+      return c.redirect(`${basePath}/${home.pageId}`, 302);
+    }
+    resolvedPageId = home.pageId;
+  }
+
+  const pageConfig = await getPageConfig(context, {
+    pageId: resolvedPageId,
+    urlQuery: c.req.query(),
+  });
+
+  if (!pageConfig) {
+    if (resolvedPageId === '404') {
+      // No 404 page in the build — return a plain 404 rather than redirecting in a loop.
+      return c.text('Page not found.', 404);
+    }
+    logger.info({ event: 'redirect_page_not_found', pageId: resolvedPageId });
+    return c.redirect(`${basePath}/404`, 302);
+  }
+
+  logger.info({ event: 'page_view', pageId: resolvedPageId });
+
+  const html = template({
+    appendBody: appJson.html?.appendBody ?? '',
+    appendHead: appJson.html?.appendHead ?? '',
+    assets: getAssets(),
+    basePath,
+    config: {
+      basePath,
+      pageConfig,
+      rootConfig,
+      sentryDsn: process.env.SENTRY_DSN ?? null,
+      session: session ?? null,
+    },
+    themeConfig,
+    title: pageConfig.properties?.title ?? resolvedPageId,
+  });
+
+  return c.html(html, status);
+}
+
+export default renderPage;

package/src/html/template.js

@@ -0,0 +1,95 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import safeScriptJson from '../lib/safeScriptJson.js';
+
+const HTML_ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' };
+
+function escapeHtml(value) {
+  return String(value).replace(/[&<>"]/g, (c) => HTML_ESCAPES[c]);
+}
+
+// Synchronous script that creates the @layer order declaration and keeps it as
+// the first child of <head> via MutationObserver. antd's CSS-in-JS uses
+// prependQueue to inject <style> tags at the top of <head>, which would
+// otherwise make @layer antd the first (lowest priority) layer.
+// MutationObserver fires before paint, so the browser never sees the wrong
+// cascade order.
+const layerOrderScript = `(function(){var s=document.createElement("style");s.id="__lf-layer-order";s.textContent="@layer theme, base, antd, components, utilities;";document.head.prepend(s);new MutationObserver(function(){if(document.head.firstChild!==s)document.head.prepend(s)}).observe(document.head,{childList:true})})();`;
+
+// Synchronous pre-hydration script setting the <html> background and
+// color-scheme — prevents a mode-mismatch flash of the page and of browser
+// chrome (scrollbars, form controls) on page load. Mirrors useDarkMode.js
+// resolution order: configDarkMode → localStorage → prefers-color-scheme.
+function darkModeScript({ configColorMode, darkBg, lightBg }) {
+  return `(function(){var c=${safeScriptJson(configColorMode)};var db=${safeScriptJson(
+    darkBg
+  )};var lb=${safeScriptJson(
+    lightBg
+  )};var d;if(c==="dark")d=true;else if(c==="light")d=false;else{try{var p=localStorage.getItem("lowdefy_darkMode");if(p==="dark")d=true;else if(p==="light")d=false;else d=window.matchMedia("(prefers-color-scheme:dark)").matches}catch(e){d=window.matchMedia("(prefers-color-scheme:dark)").matches}}var bg=d?db:lb;document.documentElement.style.colorScheme=d?"dark":"light";if(bg)document.documentElement.style.backgroundColor=bg})();`;
+}
+
+function template({
+  appendBody = '',
+  appendHead = '',
+  assets,
+  basePath = '',
+  config,
+  themeConfig = {},
+  title,
+}) {
+  const VALID_COLOR_MODES = ['system', 'light', 'dark'];
+  const configColorMode = VALID_COLOR_MODES.includes(themeConfig.darkMode)
+    ? themeConfig.darkMode
+    : 'system';
+  const darkBg = themeConfig?.antd?.darkToken?.colorBgLayout ?? '#000';
+  const lightBg = themeConfig?.antd?.lightToken?.colorBgLayout ?? '';
+
+  const cssLinks = assets.css
+    .map((file) => `<link rel="stylesheet" href="${basePath}/${file}" />`)
+    .join('\n    ');
+  const modulePreloads = assets.imports
+    .map((file) => `<link rel="modulepreload" href="${basePath}/${file}" />`)
+    .join('\n    ');
+
+  // appendHead and appendBody are intentionally raw HTML from app config
+  // (analytics snippets, font links) — they must not be escaped. The config
+  // JSON and pre-hydration interpolations go through safeScriptJson.
+  return `<!DOCTYPE html>
+<html class="lowdefy">
+  <head>
+    <meta charset="utf-8" />
+    <script>${layerOrderScript}</script>
+    <script>${darkModeScript({ configColorMode, darkBg, lightBg })}</script>
+    <link rel="manifest" href="${basePath}/manifest.webmanifest" />
+    <link rel="icon" type="image/svg+xml" href="${basePath}/icon.svg" />
+    <link rel="apple-touch-icon" href="${basePath}/apple-touch-icon.png" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    ${title ? `<title>${escapeHtml(title)}</title>` : ''}
+    ${cssLinks}
+    ${modulePreloads}
+    ${appendHead}
+  </head>
+  <body>
+    <div id="root"></div>
+    <script id="__LOWDEFY_CONFIG__" type="application/json">${safeScriptJson(config)}</script>
+    ${appendBody}
+    <script type="module" src="${basePath}/${assets.js}"></script>
+  </body>
+</html>`;
+}
+
+export default template;

package/src/index.js

@@ -0,0 +1,85 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { serve } from '@hono/node-server';
+import * as Sentry from '@sentry/node';
+import { WebSocketServer } from 'ws';
+
+import initSentryServer from '../lib/server/sentry/initSentry.js';
+
+// Auth.js v5 reads AUTH_URL but not NEXTAUTH_URL — alias the v4 variable
+// before any auth config loads so existing deployments keep working.
+if (process.env.NEXTAUTH_URL && !process.env.AUTH_URL) {
+  process.env.AUTH_URL = process.env.NEXTAUTH_URL;
+}
+
+const sentryEnabled = initSentryServer();
+
+// Import after Sentry init so instrumentation observes the module graph.
+const { default: createApp } = await import('./app.js');
+const { default: createLogger } = await import('../lib/server/log/createLogger.js');
+const { default: appMeta } = await import('../lib/build/appMeta.js');
+
+const app = createApp();
+const logger = createLogger({ server: 'lowdefy' });
+const port = Number(process.env.PORT ?? 3000);
+
+if (sentryEnabled) {
+  logger.info('Sentry enabled: server');
+}
+
+// Handles /api/websocket upgrades via serve({ websocket }). 256 KiB max frame,
+// aligned with Vercel's documented default for WebSocket functions.
+const wss = new WebSocketServer({ noServer: true, maxPayload: 256 * 1024 });
+
+const server = serve({ fetch: app.fetch, port, websocket: { server: wss } }, (info) => {
+  // lowdefy_version logs once here rather than on every line — it is implied
+  // by the build, unlike the per-line deploy identity fields on the logger.
+  logger.info(
+    { port: info.port, lowdefy_version: appMeta.lowdefyVersion },
+    `Lowdefy server listening on http://localhost:${info.port}`
+  );
+});
+
+// Container runtimes send SIGTERM and escalate to SIGKILL after a grace period
+// (Docker defaults to 10s) — finish in-flight work and exit before that deadline.
+let shuttingDown = false;
+function shutdown() {
+  if (shuttingDown) {
+    return;
+  }
+  shuttingDown = true;
+  // 1001 "going away" — clients reconnect and resubscribe on their own.
+  for (const client of wss.clients) {
+    client.close(1001, 'Server shutting down');
+  }
+  // Drop idle keep-alive connections so close() only waits on in-flight requests.
+  server.closeIdleConnections?.();
+  server.close(() => {
+    // Flush queued Sentry events; resolves immediately when Sentry is not enabled.
+    Sentry.close(2000).finally(() => process.exit(0));
+  });
+  // In-flight requests that outlive the grace period would otherwise hold the
+  // process open until SIGKILL — exit first so shutdown stays clean.
+  setTimeout(() => process.exit(1), 8000).unref();
+}
+
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);
+
+// Vercel's Node.js builder consumes the exported server — the same pattern
+// Vercel documents for WebSocket support with Hono on Fluid compute.
+export default server;

package/src/lib/getPathSegments.js

@@ -0,0 +1,25 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Splits the rest of a catch-all route into decoded segments, independent of
+// any configured basePath. Mirrors the Next.js [...param] query arrays —
+// nested ids (slashes in pageId or endpointId) are real.
+function getPathSegments(c, prefix) {
+  const rest = c.req.path.split(prefix)[1] ?? '';
+  return rest.split('/').filter(Boolean).map(decodeURIComponent);
+}
+
+export default getPathSegments;

package/src/lib/safeScriptJson.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Escape characters that could break out of the enclosing <script> tag or
+// terminate a JS string literal. Used to defuse the js/bad-code-sanitization
+// class of injection for values embedded into inline scripts and the
+// application/json config script.
+const SCRIPT_ESCAPES = {
+  '<': '\\u003C',
+  '>': '\\u003E',
+  '\b': '\\b',
+  '\f': '\\f',
+  '\n': '\\n',
+  '\r': '\\r',
+  '\t': '\\t',
+  '\0': '\\0',
+  '\u2028': '\\u2028',
+  '\u2029': '\\u2029',
+};
+
+function safeScriptJson(value) {
+  return JSON.stringify(value).replace(/[<>\b\f\n\r\t\0\u2028\u2029]/g, (c) => SCRIPT_ESCAPES[c]);
+}
+
+export default safeScriptJson;

package/src/middleware/apiContext.js

@@ -0,0 +1,135 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import path from 'node:path';
+import { createApiContext } from '@lowdefy/api';
+import { getSecretsFromEnv } from '@lowdefy/node-utils';
+import { v4 as uuid } from 'uuid';
+
+import agents from '../../build/plugins/agents.js';
+import appMeta from '../../lib/build/appMeta.js';
+import config from '../../lib/build/config.js';
+import connections from '../../build/plugins/connections.js';
+import createHandleError from '../../lib/server/log/createHandleError.js';
+import createLogger from '../../lib/server/log/createLogger.js';
+import fileCache from '../../lib/server/fileCache.js';
+import getSession from '../../lib/server/auth/session.js';
+import getStrategyCaller from '../../lib/server/auth/strategies.js';
+import i18nConfig from '../../lib/build/i18n.js';
+import jsMap from '../../build/plugins/operators/serverJsMap.js';
+import logRequest from '../../lib/server/log/logRequest.js';
+import loggerConfig from '../../lib/build/logger.js';
+import notifications, {
+  interpolateProperties,
+  renderEmail,
+} from '../../build/plugins/notifications.js';
+import operators from '../../build/plugins/operators/server.js';
+import setSentryUser from '../../lib/server/sentry/setSentryUser.js';
+import websockets from '../../build/plugins/websockets.js';
+
+const secrets = getSecretsFromEnv();
+
+// Charset/length guard so a hostile x-request-id can't inject into logs.
+const REQUEST_ID_REGEX = /^[\w.:-]{1,128}$/;
+
+// Honor the request id assigned by an upstream proxy or load balancer so one
+// id correlates client, proxy, and server logs; generate one otherwise.
+function getRequestId(c) {
+  const incoming = c.req.header('x-request-id');
+  if (incoming && REQUEST_ID_REGEX.test(incoming)) {
+    return incoming;
+  }
+  return uuid();
+}
+
+// Replaces lib/server/apiWrapper.js. Builds the request context consumed by
+// @lowdefy/api functions. Errors thrown by handlers are routed by Hono to the
+// app-level error handler (src/middleware/errorHandler.js), which reads this
+// context back from the Hono context.
+function apiContext() {
+  return async function apiContextMiddleware(c, next) {
+    // The page-route mount ('/*') also matches /api/* paths that already
+    // built a context — never build twice for one request.
+    if (c.get('lowdefyContext')) {
+      return next();
+    }
+    const rid = getRequestId(c);
+    const context = {
+      rid,
+      agents,
+      appMeta,
+      buildDirectory: path.join(process.cwd(), 'build'),
+      config,
+      connections,
+      fileCache,
+      headers: c.req.header(),
+      // The deployment's own origin — detached endpoint calls loop back
+      // through it so the target runs in its own function invocation.
+      origin: new URL(c.req.url).origin,
+      i18n: i18nConfig,
+      interpolateProperties,
+      jsMap,
+      logger: createLogger({ rid }),
+      notifications,
+      operators,
+      renderEmail,
+      req: {
+        url: c.req.path,
+        method: c.req.method,
+        hostname: c.req.header('host'),
+      },
+      secrets,
+      // On Vercel (fluid compute) the platform request context keeps the
+      // invocation alive until waitUntil promises settle; on long-lived hosts
+      // the lookup resolves to nothing and background promises just run.
+      waitUntil: (promise) =>
+        globalThis[Symbol.for('@vercel/request-context')]?.get?.()?.waitUntil?.(promise),
+      websockets,
+    };
+    context.handleError = createHandleError({ context });
+    if (!c.req.path.includes('/api/auth')) {
+      context.session = await getSession(c);
+      if (!context.session?.user) {
+        const caller = await getStrategyCaller(c, context.logger);
+        if (caller) {
+          context.session = { user: caller };
+        }
+      }
+      // Set Sentry user context for authenticated requests
+      setSentryUser({
+        user: context.session?.user,
+        sentryConfig: loggerConfig.sentry,
+      });
+    }
+    createApiContext(context);
+    c.set('lowdefyContext', context);
+    // Echo the request id so clients and proxies can quote it when reporting
+    // a failure, and it can be matched to the rid on the server log lines.
+    c.header('x-request-id', context.rid);
+    const startTime = performance.now();
+    // Handler errors never reject next() — Hono's compose routes them to the
+    // app-level error handler at the throwing dispatch level, so by the time
+    // next() resolves c.res holds the final response, error or not.
+    await next();
+    logRequest({
+      context,
+      status: c.res.status,
+      durationMs: Math.round(performance.now() - startTime),
+    });
+  };
+}
+
+export default apiContext;

package/src/middleware/errorHandler.js

@@ -0,0 +1,54 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import * as Sentry from '@sentry/node';
+import { redactErrorResponse } from '@lowdefy/api';
+
+// Hono routes every handler error to the app-level error handler — upstream
+// middleware try/catch never sees them (compose catches per dispatch level).
+// API routes get the serialized error JSON the old apiWrapper returned;
+// page routes get a plain 500.
+function createErrorHandler({ basePath = '', logger }) {
+  return async function errorHandler(error, c) {
+    const path = basePath ? c.req.path.replace(basePath, '') : c.req.path;
+    // Unauthenticated requests to protected endpoints are expected traffic -
+    // one warning line and a 401, skipping the structured error log and the
+    // Sentry capture so probing cannot flood either. Keys strictly on the
+    // error name; the 500 path below is untouched.
+    if (error.name === 'AuthenticationError') {
+      logger.warn(`Unauthenticated request: ${c.req.method} ${c.req.path}`);
+      if (path.startsWith('/api/')) {
+        return c.json({ name: error.name, message: error.message }, 401);
+      }
+      return c.text('Unauthorized', 401);
+    }
+    const context = c.get('lowdefyContext');
+    if (context) {
+      await context.handleError(error);
+    } else {
+      logger.error(error);
+    }
+    if (process.env.SENTRY_DSN) {
+      Sentry.captureException(error);
+    }
+    if (path.startsWith('/api/')) {
+      return c.json(redactErrorResponse(context, error), 500);
+    }
+    return c.text('Internal Server Error', 500);
+  };
+}
+
+export default createErrorHandler;

package/src/middleware/sentry.js

@@ -0,0 +1,33 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import * as Sentry from '@sentry/node';
+
+// Replaces @sentry/nextjs route auto-instrumentation: every request becomes
+// an http.server transaction. Handler errors never propagate through
+// middleware in Hono — captureException happens in the app error handler.
+function sentryMiddleware() {
+  return async function sentry(c, next) {
+    if (!process.env.SENTRY_DSN) {
+      return next();
+    }
+    return Sentry.startSpan({ name: `${c.req.method} ${c.req.path}`, op: 'http.server' }, () =>
+      next()
+    );
+  };
+}
+
+export default sentryMiddleware;

package/{pages/api/agent/[...path].js → src/routes/agent.js}

@@ -17,34 +17,31 @@
 import { callAgent } from '@lowdefy/api';
 import { translate, type } from '@lowdefy/helpers';
 
-import apiWrapper from '../../../lib/server/apiWrapper.js';
+import getPathSegments from '../lib/getPathSegments.js';
 
-async function handler({ context, req, res }) {
+async function agentHandler(c) {
+  const context = c.get('lowdefyContext');
   const t = (key, values) => translate({ key, values, i18n: context.i18n });
-  if (req.method !== 'POST') {
+  if (c.req.method !== 'POST') {
     throw new Error(t('agent.runtime.methodNotAllowed'));
   }
-  const segments = req.query.path;
-  if (!Array.isArray(segments) || segments.length < 2) {
-    res.status(400).json({ error: t('agent.runtime.invalidPath') });
-    return;
+  const segments = getPathSegments(c, '/api/agent/');
+  if (segments.length < 2) {
+    return c.json({ error: t('agent.runtime.invalidPath') }, 400);
   }
   const agentId = segments[segments.length - 1];
   const pageId = segments.slice(0, -1).join('/');
   context.logger.info({ event: 'call_agent', agentId, pageId });
-  const { conversationId } = req.query;
-  const { messages, urlQuery, sharedState } = req.body;
+  const { conversationId } = c.req.query();
+  const { messages, urlQuery, sharedState } = await c.req.json();
   if (!Array.isArray(messages)) {
-    res.status(400).json({ error: t('agent.runtime.messagesMustBeArray') });
-    return;
+    return c.json({ error: t('agent.runtime.messagesMustBeArray') }, 400);
   }
   if (urlQuery != null && (typeof urlQuery !== 'object' || Array.isArray(urlQuery))) {
-    res.status(400).json({ error: t('agent.runtime.urlQueryMustBeObject') });
-    return;
+    return c.json({ error: t('agent.runtime.urlQueryMustBeObject') }, 400);
   }
   if (sharedState != null && !type.isObject(sharedState)) {
-    res.status(400).json({ error: t('agent.runtime.sharedStateMustBeObject') });
-    return;
+    return c.json({ error: t('agent.runtime.sharedStateMustBeObject') }, 400);
   }
   const { response: webResponse } = await callAgent(context, {
     agentId,
@@ -55,32 +52,13 @@ async function handler({ context, req, res }) {
     urlQuery: urlQuery ?? undefined,
   });
 
-  // Stream the Web Response body to the Next.js response
-  res.setHeader('Content-Type', 'text/event-stream');
-  res.setHeader('Cache-Control', 'no-cache');
-  res.setHeader('Connection', 'keep-alive');
-  res.setHeader('Content-Encoding', 'none');
-  res.setHeader('Transfer-Encoding', 'chunked');
-
-  const reader = webResponse.body.getReader();
-  const decoder = new TextDecoder();
-  let done = false;
-  while (!done) {
-    const { value, done: readerDone } = await reader.read();
-    done = readerDone;
-    if (value) {
-      res.write(decoder.decode(value, { stream: true }));
-    }
-  }
-  res.end();
+  // callAgent returns a Web Response — stream its body straight through.
+  return c.body(webResponse.body, 200, {
+    'Content-Type': 'text/event-stream',
+    'Cache-Control': 'no-cache',
+    Connection: 'keep-alive',
+    'Content-Encoding': 'none',
+  });
 }
 
-export const config = {
-  api: {
-    bodyParser: {
-      sizeLimit: '10mb',
-    },
-  },
-};
-
-export default apiWrapper(handler);
+export default agentHandler;

package/src/routes/apiPage.js

@@ -0,0 +1,37 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { getPageConfig } from '@lowdefy/api';
+
+import getPathSegments from '../lib/getPathSegments.js';
+
+// Page config as JSON for client-side SPA navigation. The first page load is
+// served embedded in the HTML; subsequent navigations fetch from here.
+async function apiPageHandler(c) {
+  const context = c.get('lowdefyContext');
+  const pageId = getPathSegments(c, '/api/page/').join('/');
+  // The client forwards its current query string on the fetch so Dynamic block
+  // resolution sees the same urlQuery as an initial HTML load.
+  const pageConfig = await getPageConfig(context, { pageId, urlQuery: c.req.query() });
+  if (!pageConfig) {
+    context.logger.info({ event: 'api_page_not_found', pageId });
+    return c.json({ pageConfig: null }, 404);
+  }
+  context.logger.info({ event: 'api_page_view', pageId });
+  return c.json({ pageConfig });
+}
+
+export default apiPageHandler;