@lowdefy/server 5.6.0 → 6.0.0

package/lib/server/log/logRequest.js

@@ -14,53 +14,49 @@
   limitations under the License.
 */
 
-// TODO: Better name needed here maybe?
-function logRequest({ context }) {
+// Emits one access-log line per request, after the response is finalized.
+function logRequest({ context, status, durationMs }) {
   const { headers = {}, user = {} } = context;
-  context.logger.info({
-    // TODO:
-    // app_name
-    // app_version
-    // lowdefy_version
-    // build_hash
-    // config_hash
-    user: {
-      id: user.id,
-      roles: user.roles,
-      sub: user.sub,
-      session_id: user.session_id, // TODO: Implement session id
+  context.logger.info(
+    {
+      user: {
+        id: user.id,
+        roles: user.roles,
+        sub: user.sub,
+        session_id: user.session_id, // TODO: Implement session id
+      },
+      url: context.req.url,
+      method: context.req.method,
+      hostname: context.req.hostname,
+      status,
+      duration_ms: durationMs,
+      headers: {
+        'accept-language': headers['accept-language'],
+        'sec-ch-ua-mobile': headers['sec-ch-ua-mobile'],
+        'sec-ch-ua-platform': headers['sec-ch-ua-platform'],
+        'sec-ch-ua': headers['sec-ch-ua'],
+        'user-agent': headers['user-agent'],
+        host: headers.host,
+        referer: headers.referer,
+        'x-forwarded-for': headers['x-forwarded-for'],
+        // Vercel headers
+        'x-vercel-id': headers['x-vercel-id'],
+        'x-real-ip': headers['x-real-ip'],
+        'x-vercel-ip-country': headers['x-vercel-ip-country'],
+        'x-vercel-ip-country-region': headers['x-vercel-ip-country-region'],
+        'x-vercel-ip-city': headers['x-vercel-ip-city'],
+        'x-vercel-ip-latitude': headers['x-vercel-ip-latitude'],
+        'x-vercel-ip-longitude': headers['x-vercel-ip-longitude'],
+        'x-vercel-ip-timezone': headers['x-vercel-ip-timezone'],
+        // Cloudflare headers
+        'cf-connecting-ip': headers['cf-connecting-ip'],
+        'cf-ray': headers['cf-ray'],
+        'cf-ipcountry': headers['cf-ipcountry'],
+        'cf-visitor': headers['cf-visitor'],
+      },
     },
-    url: context.req.url,
-    method: context.req.method,
-    resolvedUrl: context.nextContext?.resolvedUrl,
-    hostname: context.req.hostname,
-    headers: {
-      'accept-language': headers['accept-language'],
-      'sec-ch-ua-mobile': headers['sec-ch-ua-mobile'],
-      'sec-ch-ua-platform': headers['sec-ch-ua-platform'],
-      'sec-ch-ua': headers['sec-ch-ua'],
-      'user-agent': headers['user-agent'],
-      host: headers.host,
-      referer: headers.referer,
-      'x-forward-for': headers['x-forward-for'],
-      // Vercel headers
-      'x-vercel-id': headers['x-vercel-id'],
-      'x-real-ip': headers['x-real-ip'],
-      'x-vercel-ip-country': headers['x-vercel-ip-country'],
-      'x-vercel-ip-country-region': headers['x-vercel-ip-country-region'],
-      'x-vercel-ip-city': headers['x-vercel-ip-city'],
-      'x-vercel-ip-latitude': headers['x-vercel-ip-latitude'],
-      'x-vercel-ip-longitude': headers['x-vercel-ip-longitude'],
-      'x-vercel-ip-timezone': headers['x-vercel-ip-timezone'],
-      // Cloudflare headers
-      'cf-connecting-ip': headers['cf-connecting-ip'],
-      'cf-ray': headers['cf-ray'],
-      'cf-ipcountry': headers['cf-ipcountry'],
-      'cf-visitor': headers['cf-visitor'],
-    },
-  });
-  // TODO:
-  // Next local? nextContext.locale, nextContext.locales, nextContext.defaultLocale
+    'request completed'
+  );
 }
 
 export default logRequest;

package/lib/server/sentry/captureSentryError.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/node';
 
 function captureSentryError({ error, context, configLocation }) {
   // No-op if Sentry not initialized (DSN not set)

package/lib/server/sentry/initSentry.js

@@ -14,21 +14,23 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/node';
 
 import loggerConfig from '../../build/logger.js';
 
+// Returns true when Sentry was initialized, so the caller can log it through
+// the structured logger — this module runs before the logger exists.
 function initSentryServer() {
   // No-op if SENTRY_DSN not set
   if (!process.env.SENTRY_DSN) {
-    return;
+    return false;
   }
 
   const sentryConfig = loggerConfig.sentry || {};
 
   // No-op if server logging is explicitly disabled
   if (sentryConfig.server === false) {
-    return;
+    return false;
   }
 
   Sentry.init({
@@ -37,7 +39,7 @@ function initSentryServer() {
     tracesSampleRate: sentryConfig.tracesSampleRate ?? 0.1,
   });
 
-  console.log('Sentry enabled: server');
+  return true;
 }
 
 export default initSentryServer;

package/lib/server/sentry/setSentryUser.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/node';
 
 function setSentryUser({ user, sentryConfig }) {
   // No-op if Sentry not initialized (DSN not set)

package/lowdefy/createCustomPluginTypesMap.mjs

@@ -55,6 +55,7 @@ async function createCustomPluginTypesMap({ directories }) {
       server: {},
     },
     requests: {},
+    websockets: {},
   };
 
   const pluginDefinitions = await getPluginDefinitions({ directories });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server",
-  "version": "5.6.0",
+  "version": "6.0.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -28,68 +28,81 @@
   "files": [
     "lib/*",
     "lowdefy/*",
-    "pages/*",
     "public_default/*",
-    "next.config.js",
-    "postcss.config.js",
     "package.original.json",
     ".eslintrc.yaml",
-    ".npmrc"
+    ".npmrc",
+    "src/*",
+    "client/*",
+    "vite.config.js",
+    "postcss.config.cjs"
   ],
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
-    "@lowdefy/actions-core": "5.6.0",
-    "@lowdefy/api": "5.6.0",
-    "@lowdefy/block-utils": "5.6.0",
-    "@lowdefy/blocks-antd": "5.6.0",
-    "@lowdefy/blocks-antd-x": "5.6.0",
-    "@lowdefy/blocks-basic": "5.6.0",
-    "@lowdefy/blocks-loaders": "5.6.0",
-    "@lowdefy/blocks-tiptap": "5.6.0",
-    "@lowdefy/client": "5.6.0",
-    "@lowdefy/errors": "5.6.0",
-    "@lowdefy/helpers": "5.6.0",
-    "@lowdefy/layout": "5.6.0",
-    "@lowdefy/logger": "5.6.0",
-    "@lowdefy/node-utils": "5.6.0",
-    "@lowdefy/operators-js": "5.6.0",
-    "@lowdefy/plugin-next-auth": "5.6.0",
+    "@auth/core": "0.41.2",
+    "@hono/auth-js": "1.1.1",
+    "@hono/mcp": "0.3.0",
+    "@hono/node-server": "2.0.4",
+    "@lowdefy/actions-core": "6.0.0",
+    "@lowdefy/api": "6.0.0",
+    "@lowdefy/block-utils": "6.0.0",
+    "@lowdefy/blocks-aggrid": "6.0.0",
+    "@lowdefy/blocks-antd": "6.0.0",
+    "@lowdefy/blocks-antd-x": "6.0.0",
+    "@lowdefy/blocks-basic": "6.0.0",
+    "@lowdefy/blocks-echarts": "6.0.0",
+    "@lowdefy/blocks-files": "6.0.0",
+    "@lowdefy/blocks-loaders": "6.0.0",
+    "@lowdefy/blocks-markdown": "6.0.0",
+    "@lowdefy/blocks-tiptap": "6.0.0",
+    "@lowdefy/client": "6.0.0",
+    "@lowdefy/errors": "6.0.0",
+    "@lowdefy/helpers": "6.0.0",
+    "@lowdefy/layout": "6.0.0",
+    "@lowdefy/logger": "6.0.0",
+    "@lowdefy/node-utils": "6.0.0",
+    "@lowdefy/operators-js": "6.0.0",
+    "@lowdefy/plugin-next-auth": "6.0.0",
+    "@lowdefy/websockets-core": "6.0.0",
+    "@sentry/browser": "10.57.0",
     "@sentry/nextjs": "8.53.0",
-    "@tailwindcss/postcss": "4.2.1",
+    "@sentry/node": "10.57.0",
+    "@sentry/vite-plugin": "5.3.0",
+    "@tailwindcss/postcss": "4.3.1",
+    "@vitejs/plugin-react": "6.0.2",
     "antd": "6.3.1",
-    "dayjs": "1.11.19",
-    "next": "16.1.6",
-    "next-auth": "4.24.10",
-    "pino": "8.16.2",
+    "dayjs": "1.11.20",
+    "hono": "4.12.25",
+    "pino": "10.3.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",
     "react-icons": "5.6.0",
-    "tailwindcss": "4.2.1",
-    "uuid": "13.0.0"
+    "tailwindcss": "4.3.1",
+    "uuid": "14.0.0",
+    "vite": "8.0.16",
+    "ws": "8.18.0"
   },
   "devDependencies": {
-    "@lowdefy/build": "5.6.0",
+    "@lowdefy/build": "6.0.0",
     "@next/eslint-plugin-next": "16.1.6",
-    "@tailwindcss/postcss": "4.2.1",
-    "tailwindcss": "4.2.1",
+    "@tailwindcss/postcss": "4.3.1",
+    "tailwindcss": "4.3.1",
     "webpack": "5.94.0",
-    "yaml": "2.3.4",
-    "yargs": "17.7.2"
+    "yaml": "2.9.0",
+    "yargs": "18.0.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "publishConfig": {
     "access": "public"
   },
+  "type": "module",
   "scripts": {
     "build": "cp package.json package.original.json || copy package.json package.original.json",
+    "build:client": "vite build",
     "build:lowdefy": "node lowdefy/build.mjs",
-    "build:next": "next build",
-    "dev": "next dev",
-    "start": "next start",
-    "lint": "next lint",
-    "next": "next"
+    "start": "node src/index.js"
   }
 }

package/package.original.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server",
-  "version": "5.6.0",
+  "version": "6.0.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -28,69 +28,82 @@
   "files": [
     "lib/*",
     "lowdefy/*",
-    "pages/*",
     "public_default/*",
-    "next.config.js",
-    "postcss.config.js",
     "package.original.json",
     ".eslintrc.yaml",
-    ".npmrc"
+    ".npmrc",
+    "src/*",
+    "client/*",
+    "vite.config.js",
+    "postcss.config.cjs"
   ],
   "scripts": {
     "build": "cp package.json package.original.json || copy package.json package.original.json",
+    "build:client": "vite build",
     "build:lowdefy": "node lowdefy/build.mjs",
-    "build:next": "next build",
-    "dev": "next dev",
-    "start": "next start",
-    "lint": "next lint",
-    "next": "next",
-    "prepublishOnly": "pnpm build"
+    "prepublishOnly": "pnpm build",
+    "start": "node src/index.js"
   },
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
-    "@lowdefy/actions-core": "5.6.0",
-    "@lowdefy/api": "5.6.0",
-    "@lowdefy/block-utils": "5.6.0",
-    "@lowdefy/blocks-antd": "5.6.0",
-    "@lowdefy/blocks-antd-x": "5.6.0",
-    "@lowdefy/blocks-basic": "5.6.0",
-    "@lowdefy/blocks-loaders": "5.6.0",
-    "@lowdefy/blocks-tiptap": "5.6.0",
-    "@lowdefy/client": "5.6.0",
-    "@lowdefy/errors": "5.6.0",
-    "@lowdefy/helpers": "5.6.0",
-    "@lowdefy/layout": "5.6.0",
-    "@lowdefy/logger": "5.6.0",
-    "@lowdefy/node-utils": "5.6.0",
-    "@lowdefy/operators-js": "5.6.0",
-    "@lowdefy/plugin-next-auth": "5.6.0",
+    "@auth/core": "0.41.2",
+    "@hono/auth-js": "1.1.1",
+    "@hono/mcp": "0.3.0",
+    "@hono/node-server": "2.0.4",
+    "@lowdefy/actions-core": "6.0.0",
+    "@lowdefy/api": "6.0.0",
+    "@lowdefy/block-utils": "6.0.0",
+    "@lowdefy/blocks-aggrid": "6.0.0",
+    "@lowdefy/blocks-antd": "6.0.0",
+    "@lowdefy/blocks-antd-x": "6.0.0",
+    "@lowdefy/blocks-basic": "6.0.0",
+    "@lowdefy/blocks-echarts": "6.0.0",
+    "@lowdefy/blocks-files": "6.0.0",
+    "@lowdefy/blocks-loaders": "6.0.0",
+    "@lowdefy/blocks-markdown": "6.0.0",
+    "@lowdefy/blocks-tiptap": "6.0.0",
+    "@lowdefy/client": "6.0.0",
+    "@lowdefy/errors": "6.0.0",
+    "@lowdefy/helpers": "6.0.0",
+    "@lowdefy/layout": "6.0.0",
+    "@lowdefy/logger": "6.0.0",
+    "@lowdefy/node-utils": "6.0.0",
+    "@lowdefy/operators-js": "6.0.0",
+    "@lowdefy/plugin-next-auth": "6.0.0",
+    "@lowdefy/websockets-core": "6.0.0",
+    "@sentry/browser": "10.57.0",
     "@sentry/nextjs": "8.53.0",
-    "@tailwindcss/postcss": "4.2.1",
+    "@sentry/node": "10.57.0",
+    "@sentry/vite-plugin": "5.3.0",
+    "@tailwindcss/postcss": "4.3.1",
+    "@vitejs/plugin-react": "6.0.2",
     "antd": "6.3.1",
-    "dayjs": "1.11.19",
-    "next": "16.1.6",
-    "next-auth": "4.24.10",
-    "pino": "8.16.2",
+    "dayjs": "1.11.20",
+    "hono": "4.12.25",
+    "pino": "10.3.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",
     "react-icons": "5.6.0",
-    "tailwindcss": "4.2.1",
-    "uuid": "13.0.0"
+    "tailwindcss": "4.3.1",
+    "uuid": "14.0.0",
+    "vite": "8.0.16",
+    "ws": "8.18.0"
   },
   "devDependencies": {
-    "@lowdefy/build": "5.6.0",
+    "@lowdefy/build": "6.0.0",
     "@next/eslint-plugin-next": "16.1.6",
-    "@tailwindcss/postcss": "4.2.1",
-    "tailwindcss": "4.2.1",
+    "@tailwindcss/postcss": "4.3.1",
+    "tailwindcss": "4.3.1",
     "webpack": "5.94.0",
-    "yaml": "2.3.4",
-    "yargs": "17.7.2"
+    "yaml": "2.9.0",
+    "yargs": "18.0.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "type": "module"
 }

package/src/app.js

@@ -0,0 +1,140 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
+import { compress } from 'hono/compress';
+import { timeout } from 'hono/timeout';
+import { initAuthConfig } from '@hono/auth-js';
+import { serveStatic } from '@hono/node-server/serve-static';
+
+import agentHandler from './routes/agent.js';
+import apiContext from './middleware/apiContext.js';
+import apiPageHandler from './routes/apiPage.js';
+import authJson from '../lib/build/auth.js';
+import authMiddleware from './routes/auth.js';
+import clientErrorHandler from './routes/clientError.js';
+import createErrorHandler from './middleware/errorHandler.js';
+import createLogger from '../lib/server/log/createLogger.js';
+import cronForwardHandler from './routes/cronForward.js';
+import cronHandler from './routes/cron.js';
+import detachedHandler from './routes/detached.js';
+import endpointsHandler from './routes/endpoints.js';
+import getAuthConfig from '../lib/server/auth/getAuthConfig.js';
+import lowdefyConfig from '../lib/build/config.js';
+import mcpHandler from './routes/mcp.js';
+import renderPage from './html/renderPage.js';
+import requestHandler from './routes/request.js';
+import sentryMiddleware from './middleware/sentry.js';
+import usageHandler from './routes/usage.js';
+import websocketHandler from './routes/websocket.js';
+
+const basePath = lowdefyConfig.basePath ?? '';
+
+// Cap how long a single request may run. A request that hangs on an upstream call (DB, SMTP, an
+// external API) would otherwise run to the platform's function limit — on serverless (e.g. Vercel
+// Fluid) that is billed compute. Configured via `config.requestTimeout` (ms) in lowdefy.yaml;
+// defaults to 30s, 0 disables. Agent streaming is exempt below since it is long-lived by design.
+const requestTimeoutMs = lowdefyConfig.requestTimeout ?? 30000;
+
+// `serveStaticAssets` is true for the Node server (it serves `dist/client` itself). On a
+// platform that serves the built client + public files from a CDN (e.g. Vercel), pass false so
+// the request handler skips the Node-only static middleware and only owns the dynamic routes.
+function createApp({ serveStaticAssets = true } = {}) {
+  const app = basePath ? new Hono().basePath(basePath) : new Hono();
+  const logger = createLogger({ server: 'lowdefy' });
+
+  // Liveness endpoint for container health checks and orchestrator probes. Registered
+  // before all middleware so probes skip auth, session, request logging, and Sentry.
+  app.get('/api/lowdefy-health', (c) => c.json({ status: 'ok' }));
+
+  app.use('*', sentryMiddleware());
+
+  // Bound request duration so a hung upstream returns an error instead of running to the platform's
+  // function limit (cost protection on serverless). Agent streaming is long-lived by design, so it
+  // is exempt. Configured via `config.requestTimeout` in lowdefy.yaml (0 disables).
+  if (requestTimeoutMs > 0) {
+    app.use('*', async (c, next) => {
+      if (
+        c.req.path.includes('/api/agent/') ||
+        c.req.path.includes('/api/mcp') ||
+        c.req.path.includes('/api/websocket')
+      ) {
+        return next();
+      }
+      return timeout(requestTimeoutMs)(c, next);
+    });
+  }
+
+  // Next.js compressed responses by default — keep parity, but leave
+  // streaming responses (agent SSE) and websocket upgrades uncompressed.
+  app.use('*', async (c, next) => {
+    if (
+      c.req.path.includes('/api/agent/') ||
+      c.req.path.includes('/api/mcp') ||
+      c.req.path.includes('/api/websocket')
+    ) {
+      return next();
+    }
+    return compress()(c, next);
+  });
+
+  if (authJson.configured === true) {
+    app.use(
+      '*',
+      initAuthConfig(() => getAuthConfig({ logger }))
+    );
+  }
+
+  app.use('/api/*', apiContext());
+  app.use('/api/auth/*', authMiddleware());
+  app.all('/api/request/*', requestHandler);
+  // Endpoint payloads may carry base64 file content (emitFileContent + CallAPI);
+  // cap bodies at 10 MiB to match the agent route.
+  app.all('/api/endpoints/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), endpointsHandler);
+  app.get('/api/cron/*', cronHandler);
+  app.get('/api/cron-forward/*', cronForwardHandler);
+  app.post('/api/detached/*', detachedHandler);
+  app.all('/api/client-error', clientErrorHandler);
+  app.all('/api/usage', usageHandler);
+  app.all('/api/agent/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), agentHandler);
+  app.all('/api/mcp', bodyLimit({ maxSize: 10 * 1024 * 1024 }), mcpHandler);
+  app.get('/api/websocket', websocketHandler);
+  app.get('/api/page/*', apiPageHandler);
+
+  // Vite build output (includes public/ via Vite's publicDir copy). Falls
+  // through to the page routes when no file matches.
+  if (serveStaticAssets) {
+    app.use(
+      '/*',
+      serveStatic({
+        root: './dist/client',
+        rewriteRequestPath: basePath ? (path) => path.replace(basePath, '') : undefined,
+      })
+    );
+  }
+
+  app.use('/*', apiContext());
+  app.get('/', (c) => renderPage(c, { pageId: '' }));
+  app.get('/404', (c) => renderPage(c, { pageId: '404', status: 404 }));
+  app.get('/:rest{.+}', (c) => renderPage(c, { pageId: c.req.param('rest') }));
+
+  app.onError(createErrorHandler({ basePath, logger }));
+
+  return app;
+}
+
+export default createApp;

package/src/html/getAssets.js

@@ -0,0 +1,45 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+// The Vite manifest is read once at startup — deploys start a new server
+// process after `vite build` completes, so assets never change at runtime.
+// In-place deploys must build before restarting (documented).
+let assets = null;
+
+function getAssets() {
+  if (assets) {
+    return assets;
+  }
+  const manifestPath = path.join(process.cwd(), 'dist/client/.vite/manifest.json');
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const entry = manifest['client/main.jsx'];
+  if (!entry) {
+    throw new Error(
+      'Vite manifest has no "client/main.jsx" entry. Run the client build before starting the server.'
+    );
+  }
+  assets = {
+    js: entry.file,
+    css: entry.css ?? [],
+    imports: (entry.imports ?? []).map((key) => manifest[key]?.file).filter(Boolean),
+  };
+  return assets;
+}
+
+export default getAssets;