@lowdefy/server 5.5.1 → 6.0.0

package/src/routes/auth.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { authHandler } from '@hono/auth-js';
+
+import authJson from '../../lib/build/auth.js';
+
+// Replaces pages/api/auth/[...nextauth].js. Hono routes HEAD requests through
+// GET handlers, so the corporate-email pre-check branch must live inside the
+// middleware, before delegating to the Auth.js handler. See:
+// https://next-auth.js.org/tutorials/avoid-corporate-link-checking-email-provider
+function authMiddleware() {
+  const handler = authJson.configured === true ? authHandler() : null;
+  return async function auth(c, next) {
+    if (authJson.configured !== true) {
+      return c.json({ message: 'Auth not configured' }, 404);
+    }
+    if (c.req.method === 'HEAD') {
+      return c.body(null, 200);
+    }
+    return handler(c, next);
+  };
+}
+
+export default authMiddleware;

package/{pages/api/client-error.js → src/routes/clientError.js}

@@ -16,34 +16,32 @@
 
 import { logClientError } from '@lowdefy/api';
 
-import apiWrapper from '../../lib/server/apiWrapper.js';
 import captureSentryError from '../../lib/server/sentry/captureSentryError.js';
 
-async function handler({ context, req, res }) {
-  if (req.method !== 'POST') {
+async function clientErrorHandler(c) {
+  if (c.req.method !== 'POST') {
     throw new Error('Only POST requests are supported.');
   }
+  const context = c.get('lowdefyContext');
 
-  const origin = req.headers.origin;
+  const origin = c.req.header('origin');
   if (!origin) {
-    res.status(403).json({ error: 'Forbidden' });
-    return;
+    return c.json({ error: 'Forbidden' }, 403);
   }
   try {
-    if (new URL(origin).host !== req.headers.host) {
-      res.status(403).json({ error: 'Forbidden' });
-      return;
+    if (new URL(origin).host !== c.req.header('host')) {
+      return c.json({ error: 'Forbidden' }, 403);
     }
   } catch {
-    res.status(403).json({ error: 'Forbidden' });
-    return;
+    return c.json({ error: 'Forbidden' }, 403);
   }
 
+  const body = await c.req.json();
   // Strip received from payload — prod doesn't need it for schema validation
-  if (req.body?.['~e']) {
-    delete req.body['~e'].received;
+  if (body?.['~e']) {
+    delete body['~e'].received;
   }
-  const { error, ...response } = await logClientError(context, req.body);
+  const { error, ...response } = await logClientError(context, body);
 
   // Capture client error to Sentry (no-op if Sentry not configured)
   captureSentryError({
@@ -52,7 +50,7 @@ async function handler({ context, req, res }) {
     configLocation: response.source ? { source: response.source, config: response.config } : null,
   });
 
-  res.status(200).json({ success: true });
+  return c.json({ success: true });
 }
 
-export default apiWrapper(handler);
+export default clientErrorHandler;

package/src/routes/cron.js

@@ -0,0 +1,44 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { runScheduledEndpoint } from '@lowdefy/api';
+
+import getPathSegments from '../lib/getPathSegments.js';
+
+// Triggered by Vercel Cron: an HTTP GET to /api/cron/<endpointId>. Vercel auto-sends the value of
+// the project env var named exactly CRON_SECRET as `Authorization: Bearer <value>`, and the firing
+// cron expression in the `x-vercel-cron-schedule` header. Fails closed if CRON_SECRET is unset.
+async function cronHandler(c) {
+  if (c.req.method !== 'GET') {
+    throw new Error('Only GET requests are supported.');
+  }
+  const context = c.get('lowdefyContext');
+
+  const secret = process.env.CRON_SECRET;
+  if (!secret || c.req.header('authorization') !== `Bearer ${secret}`) {
+    context.logger.warn({ event: 'cron_unauthorized' });
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  const endpointId = getPathSegments(c, '/api/cron/').join('/');
+  const cron = c.req.header('x-vercel-cron-schedule');
+  const environment = c.req.header('x-lowdefy-cron-environment');
+  context.logger.info({ event: 'call_cron_endpoint', endpointId, cron, environment });
+  const response = await runScheduledEndpoint(context, { endpointId, cron, environment });
+  return c.json(response);
+}
+
+export default cronHandler;

package/src/routes/cronForward.js

@@ -0,0 +1,47 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { forwardScheduledEndpoint } from '@lowdefy/api';
+
+import getPathSegments from '../lib/getPathSegments.js';
+
+// Triggered by Vercel Cron on the production deployment: an HTTP GET to
+// /api/cron-forward/<environment>/<endpointId>, registered by `lowdefy vercel-output` for the
+// schedules of every environment declared with a url in config.cron.environments. Vercel fires crons
+// only on production, so production pings that environment's own /api/cron/<endpointId> (with the
+// environment's CRON_SECRET) and answers immediately. Same transport auth as cron (CRON_SECRET,
+// fails closed).
+async function cronForwardHandler(c) {
+  if (c.req.method !== 'GET') {
+    throw new Error('Only GET requests are supported.');
+  }
+  const context = c.get('lowdefyContext');
+
+  const secret = process.env.CRON_SECRET;
+  if (!secret || c.req.header('authorization') !== `Bearer ${secret}`) {
+    context.logger.warn({ event: 'cron_forward_unauthorized' });
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  const [environment, ...endpointSegments] = getPathSegments(c, '/api/cron-forward/');
+  const endpointId = endpointSegments.join('/');
+  const cron = c.req.header('x-vercel-cron-schedule');
+  context.logger.info({ event: 'call_cron_forward', environment, endpointId, cron });
+  const response = await forwardScheduledEndpoint(context, { environment, endpointId, cron });
+  return c.json(response);
+}
+
+export default cronForwardHandler;

package/src/routes/detached.js

@@ -0,0 +1,47 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { runDetachedEndpoint } from '@lowdefy/api';
+
+import getPathSegments from '../lib/getPathSegments.js';
+
+// Target of a CallApi step with `detached: true`: the calling invocation
+// fire-and-forgets a POST here, so the endpoint runs in its OWN function
+// invocation with a fresh duration budget (chainable bounded work without a
+// queue). Same transport auth as cron (CRON_SECRET, fails closed) and the same
+// system execution context — InternalApi endpoints are callable, `_user` is
+// undefined. Delivery is at-most-once with no retry: targets must be
+// idempotent.
+async function detachedHandler(c) {
+  if (c.req.method !== 'POST') {
+    throw new Error('Only POST requests are supported.');
+  }
+  const context = c.get('lowdefyContext');
+
+  const secret = process.env.CRON_SECRET;
+  if (!secret || c.req.header('authorization') !== `Bearer ${secret}`) {
+    context.logger.warn({ event: 'detached_unauthorized' });
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  const endpointId = getPathSegments(c, '/api/detached/').join('/');
+  const { payload } = await c.req.json();
+  context.logger.info({ event: 'call_detached_endpoint', endpointId });
+  const response = await runDetachedEndpoint(context, { endpointId, payload });
+  return c.json(response);
+}
+
+export default detachedHandler;

package/src/routes/endpoints.js

@@ -0,0 +1,71 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { callEndpoint, getEndpointConfig, runWebhookEndpoint } from '@lowdefy/api';
+
+import getPathSegments from '../lib/getPathSegments.js';
+
+async function endpointsHandler(c) {
+  if (c.req.method !== 'POST') {
+    throw new Error('Only POST requests are supported.');
+  }
+  const context = c.get('lowdefyContext');
+  const endpointId = getPathSegments(c, '/api/endpoints/').join('/');
+
+  // Endpoints opting in with `webhook: true` are third-party webhook receivers
+  // (SNS, Event Grid, Stripe, ...): they take the request RAW — body in the
+  // caller's own format (not the { payload } envelope), plus query + headers —
+  // and their return value is sent back verbatim, because webhook handshakes
+  // (e.g. Event Grid's validationResponse) require exact response shapes.
+  // The config lookup is a cached file read; an unknown endpoint falls through
+  // to the standard path so its error shape is unchanged. Everything about
+  // non-webhook endpoints is untouched.
+  let endpointConfig = null;
+  try {
+    endpointConfig = await getEndpointConfig(context, { endpointId });
+  } catch {
+    /* unknown endpoint — the standard path below reports it exactly as before */
+  }
+  if (endpointConfig?.webhook === true) {
+    // SNS posts JSON as text/plain — parse regardless of content-type; an
+    // unparseable body arrives as the raw string.
+    const raw = await c.req.text();
+    let body = raw;
+    try {
+      body = JSON.parse(raw);
+    } catch {
+      /* non-JSON body — raw string passthrough */
+    }
+    context.logger.info({ event: 'call_webhook_endpoint', endpointId });
+    const result = await runWebhookEndpoint(context, {
+      endpointId,
+      body,
+      query: c.req.query(),
+      headers: c.req.header(),
+    });
+    if (!result.success) {
+      return c.json({ error: 'Webhook failed.' }, 500);
+    }
+    return c.json(result.response ?? { ok: true });
+  }
+
+  const { blockId, payload, pageId } = await c.req.json();
+  context.logger.info({ event: 'call_api_endpoint', blockId, endpointId, pageId });
+  const response = await callEndpoint(context, { blockId, endpointId, pageId, payload });
+  return c.json(response);
+}
+
+export default endpointsHandler;

package/src/routes/mcp.js

@@ -0,0 +1,34 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { StreamableHTTPTransport } from '@hono/mcp';
+import { createMcpServer } from '@lowdefy/api';
+
+// Stateless per-request MCP server over the app's configured endpoints. The
+// apiContext middleware has already resolved the caller's session, so tool
+// listing and calls are authorized per request.
+async function mcpHandler(c) {
+  const context = c.get('lowdefyContext');
+  const server = await createMcpServer({ context });
+  if (!server) {
+    return c.json({ error: 'MCP is not configured.' }, 404);
+  }
+  const transport = new StreamableHTTPTransport();
+  await server.connect(transport);
+  return transport.handleRequest(c);
+}
+
+export default mcpHandler;

package/{pages/api/request/[...path].js → src/routes/request.js}

@@ -16,23 +16,23 @@
 
 import { callRequest } from '@lowdefy/api';
 
-import apiWrapper from '../../../lib/server/apiWrapper.js';
+import getPathSegments from '../lib/getPathSegments.js';
 
-async function handler({ context, req, res }) {
-  if (req.method !== 'POST') {
+async function requestHandler(c) {
+  if (c.req.method !== 'POST') {
     throw new Error('Only POST requests are supported.');
   }
-  const segments = req.query.path;
-  if (!Array.isArray(segments) || segments.length < 2) {
-    res.status(400).json({ error: 'Invalid request path' });
-    return;
+  const context = c.get('lowdefyContext');
+  const segments = getPathSegments(c, '/api/request/');
+  if (segments.length < 2) {
+    return c.json({ error: 'Invalid request path' }, 400);
   }
   const requestId = segments[segments.length - 1];
   const pageId = segments.slice(0, -1).join('/');
-  const { actionId, blockId, payload } = req.body;
+  const { actionId, blockId, payload } = await c.req.json();
   context.logger.info({ event: 'call_request', pageId, requestId, blockId, actionId });
   const response = await callRequest(context, { blockId, pageId, payload, requestId });
-  res.status(200).json(response);
+  return c.json(response);
 }
 
-export default apiWrapper(handler);
+export default requestHandler;

package/src/routes/usage.js

@@ -0,0 +1,46 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+const packageJson = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
+
+async function usageHandler(c) {
+  if (c.req.method !== 'POST') {
+    throw new Error('Only POST requests are supported.');
+  }
+  const context = c.get('lowdefyContext');
+  const { user, machine } = await c.req.json();
+  const host = c.req.header('host');
+  context.logger.info({ event: 'log_usage', user, machine });
+
+  const timestamp = Date.now();
+
+  return c.json({
+    offline: false,
+    data: {
+      gitSha: context.appMeta.gitSha,
+      host,
+      machine,
+      timestamp,
+      user,
+      version: packageJson.version,
+    },
+  });
+}
+
+export default usageHandler;

package/src/routes/websocket.js

@@ -0,0 +1,46 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { upgradeWebSocket } from '@hono/node-server';
+import { createChannelRegistry, createWebSocketConnection } from '@lowdefy/api';
+
+// One registry per server process — channels and their running source
+// resolvers are shared across all websocket connections on this instance.
+const registry = createChannelRegistry();
+
+const websocketHandler = upgradeWebSocket((c) => {
+  const context = c.get('lowdefyContext');
+  let connection;
+  return {
+    onOpen(event, ws) {
+      connection = createWebSocketConnection(context, {
+        registry,
+        send: (message) => ws.send(message),
+      });
+    },
+    onMessage(event) {
+      connection?.handleMessage(event.data);
+    },
+    onClose() {
+      connection?.close();
+    },
+    onError(event) {
+      context.logger.debug({ event: 'ws_error' }, String(event?.error ?? 'WebSocket error'));
+    },
+  };
+});
+
+export default websocketHandler;

package/vite.config.js

@@ -0,0 +1,61 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+import { sentryVitePlugin } from '@sentry/vite-plugin';
+
+// basePath from the Lowdefy build — assets are served under it.
+let basePath = '';
+try {
+  const config = JSON.parse(fs.readFileSync('./build/config.json', 'utf8'));
+  basePath = config.basePath ?? '';
+} catch (e) {
+  // No build yet (e.g. editor tooling) — default base.
+}
+
+const uploadSourceMaps = Boolean(process.env.SENTRY_AUTH_TOKEN);
+
+export default defineConfig(({ mode }) => ({
+  base: `${basePath}/`,
+  plugins: [
+    react(),
+    uploadSourceMaps &&
+      sentryVitePlugin({
+        org: process.env.SENTRY_ORG,
+        project: process.env.SENTRY_PROJECT,
+        authToken: process.env.SENTRY_AUTH_TOKEN,
+      }),
+  ].filter(Boolean),
+  define: {
+    // Vite does not replace process.env.NODE_ENV inside dependencies —
+    // plugin and client code branch on it.
+    'process.env.NODE_ENV': JSON.stringify(mode === 'production' ? 'production' : 'development'),
+  },
+  build: {
+    outDir: 'dist/client',
+    manifest: true,
+    sourcemap: uploadSourceMaps,
+    rollupOptions: {
+      input: 'client/main.jsx',
+    },
+  },
+  resolve: {
+    // linked plugin packages (pnpm link: / workspace) must share one React.
+    dedupe: ['react', 'react-dom'],
+  },
+}));

package/.eslintrc.yaml

@@ -1 +0,0 @@
-extends: 'plugin:@next/next/core-web-vitals'

package/lib/client/Page.js

@@ -1,56 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import React from 'react';
-
-import { useRouter } from 'next/router';
-import Client from '@lowdefy/client';
-import Head from 'next/head';
-import Link from 'next/link';
-
-import actions from '../../build/plugins/actions.js';
-import blockMetas from '../../build/plugins/blockMetas.json';
-import blocks from '../../build/plugins/blocks.js';
-import icons from '../../build/plugins/icons.js';
-import operators from '../../build/plugins/operators/client.js';
-import jsMap from '../../build/plugins/operators/clientJsMap.js';
-
-const Page = ({ auth, lowdefy, pageConfig, rootConfig }) => {
-  const router = useRouter();
-  return (
-    <Client
-      auth={auth}
-      Components={{ Head, Link }}
-      config={{
-        pageConfig,
-        rootConfig,
-      }}
-      jsMap={jsMap}
-      lowdefy={lowdefy}
-      router={router}
-      types={{
-        actions,
-        blockMetas,
-        blocks,
-        icons,
-        operators,
-      }}
-      window={window}
-    />
-  );
-};
-
-export default Page;

package/lib/server/serverSidePropsWrapper.js

@@ -1,66 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import path from 'path';
-import { createApiContext } from '@lowdefy/api';
-import { v4 as uuid } from 'uuid';
-
-import appMeta from '../build/appMeta.js';
-import config from '../build/config.js';
-import createLogger from './log/createLogger.js';
-import fileCache from './fileCache.js';
-import getServerSession from './auth/getServerSession.js';
-import createHandleError from './log/createHandleError.js';
-import logRequest from './log/logRequest.js';
-import getAuthOptions from './auth/getAuthOptions.js';
-
-// TODO: Merge serverSidePropsWrapper and apiWrapper?
-function serverSidePropsWrapper(handler) {
-  return async function wrappedHandler(nextContext) {
-    const context = {
-      // Important to give absolute path so Next can trace build files
-      rid: uuid(),
-      appMeta,
-      buildDirectory: path.join(process.cwd(), 'build'),
-      config,
-      fileCache,
-      handleError: async (err) => {
-        console.error(err);
-      },
-      headers: nextContext?.req?.headers,
-      logger: console,
-      nextContext,
-      req: nextContext?.req,
-      res: nextContext?.res,
-    };
-    try {
-      context.logger = createLogger({ rid: context.rid });
-      context.handleError = createHandleError({ context });
-      context.authOptions = getAuthOptions(context);
-      context.session = await getServerSession(context);
-      createApiContext(context);
-      logRequest({ context });
-      // Await here so that if handler throws it is caught.
-      const response = await handler({ context, nextContext });
-      return response;
-    } catch (error) {
-      await context.handleError(error);
-      throw error;
-    }
-  };
-}
-
-export default serverSidePropsWrapper;