@lowdefy/server 5.6.0 → 6.1.0

package/package.original.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server",
-  "version": "5.6.0",
+  "version": "6.1.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -28,69 +28,81 @@
   "files": [
     "lib/*",
     "lowdefy/*",
-    "pages/*",
     "public_default/*",
-    "next.config.js",
-    "postcss.config.js",
     "package.original.json",
     ".eslintrc.yaml",
-    ".npmrc"
+    ".npmrc",
+    "src/*",
+    "client/*",
+    "vite.config.js",
+    "postcss.config.cjs"
   ],
   "scripts": {
     "build": "cp package.json package.original.json || copy package.json package.original.json",
+    "build:client": "vite build",
     "build:lowdefy": "node lowdefy/build.mjs",
-    "build:next": "next build",
-    "dev": "next dev",
-    "start": "next start",
-    "lint": "next lint",
-    "next": "next",
-    "prepublishOnly": "pnpm build"
+    "prepublishOnly": "pnpm build",
+    "start": "node src/index.js",
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
   },
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
-    "@lowdefy/actions-core": "5.6.0",
-    "@lowdefy/api": "5.6.0",
-    "@lowdefy/block-utils": "5.6.0",
-    "@lowdefy/blocks-antd": "5.6.0",
-    "@lowdefy/blocks-antd-x": "5.6.0",
-    "@lowdefy/blocks-basic": "5.6.0",
-    "@lowdefy/blocks-loaders": "5.6.0",
-    "@lowdefy/blocks-tiptap": "5.6.0",
-    "@lowdefy/client": "5.6.0",
-    "@lowdefy/errors": "5.6.0",
-    "@lowdefy/helpers": "5.6.0",
-    "@lowdefy/layout": "5.6.0",
-    "@lowdefy/logger": "5.6.0",
-    "@lowdefy/node-utils": "5.6.0",
-    "@lowdefy/operators-js": "5.6.0",
-    "@lowdefy/plugin-next-auth": "5.6.0",
-    "@sentry/nextjs": "8.53.0",
-    "@tailwindcss/postcss": "4.2.1",
+    "@auth/core": "0.41.3",
+    "@hono/auth-js": "1.1.1",
+    "@hono/mcp": "0.3.0",
+    "@hono/node-server": "2.0.10",
+    "@lowdefy/actions-core": "6.1.0",
+    "@lowdefy/api": "6.1.0",
+    "@lowdefy/block-utils": "6.1.0",
+    "@lowdefy/blocks-aggrid": "6.1.0",
+    "@lowdefy/blocks-antd": "6.1.0",
+    "@lowdefy/blocks-antd-x": "6.1.0",
+    "@lowdefy/blocks-basic": "6.1.0",
+    "@lowdefy/blocks-echarts": "6.1.0",
+    "@lowdefy/blocks-files": "6.1.0",
+    "@lowdefy/blocks-loaders": "6.1.0",
+    "@lowdefy/blocks-markdown": "6.1.0",
+    "@lowdefy/blocks-tiptap": "6.1.0",
+    "@lowdefy/client": "6.1.0",
+    "@lowdefy/errors": "6.1.0",
+    "@lowdefy/helpers": "6.1.0",
+    "@lowdefy/layout": "6.1.0",
+    "@lowdefy/logger": "6.1.0",
+    "@lowdefy/node-utils": "6.1.0",
+    "@lowdefy/operators-js": "6.1.0",
+    "@lowdefy/plugin-next-auth": "6.1.0",
+    "@lowdefy/websockets-core": "6.1.0",
+    "@sentry/browser": "10.57.0",
+    "@sentry/node": "10.57.0",
+    "@sentry/vite-plugin": "5.3.0",
+    "@tailwindcss/postcss": "4.3.1",
+    "@vitejs/plugin-react": "6.0.2",
     "antd": "6.3.1",
-    "dayjs": "1.11.19",
-    "next": "16.1.6",
-    "next-auth": "4.24.10",
-    "pino": "8.16.2",
+    "dayjs": "1.11.20",
+    "hono": "4.13.5",
+    "pino": "10.3.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",
     "react-icons": "5.6.0",
-    "tailwindcss": "4.2.1",
-    "uuid": "13.0.0"
+    "tailwindcss": "4.3.1",
+    "uuid": "14.0.0",
+    "vite": "8.0.16",
+    "ws": "8.21.0"
   },
   "devDependencies": {
-    "@lowdefy/build": "5.6.0",
-    "@next/eslint-plugin-next": "16.1.6",
-    "@tailwindcss/postcss": "4.2.1",
-    "tailwindcss": "4.2.1",
-    "webpack": "5.94.0",
-    "yaml": "2.3.4",
-    "yargs": "17.7.2"
+    "@lowdefy/build": "6.1.0",
+    "@tailwindcss/postcss": "4.3.1",
+    "jest": "28.1.3",
+    "tailwindcss": "4.3.1",
+    "yaml": "2.9.0",
+    "yargs": "18.0.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "type": "module"
 }

package/src/app.js

@@ -0,0 +1,140 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
+import { compress } from 'hono/compress';
+import { timeout } from 'hono/timeout';
+import { initAuthConfig } from '@hono/auth-js';
+import { serveStatic } from '@hono/node-server/serve-static';
+
+import agentHandler from './routes/agent.js';
+import apiContext from './middleware/apiContext.js';
+import apiPageHandler from './routes/apiPage.js';
+import authJson from '../lib/build/auth.js';
+import authMiddleware from './routes/auth.js';
+import clientErrorHandler from './routes/clientError.js';
+import createErrorHandler from './middleware/errorHandler.js';
+import createLogger from '../lib/server/log/createLogger.js';
+import cronForwardHandler from './routes/cronForward.js';
+import cronHandler from './routes/cron.js';
+import detachedHandler from './routes/detached.js';
+import endpointsHandler from './routes/endpoints.js';
+import getAuthConfig from '../lib/server/auth/getAuthConfig.js';
+import lowdefyConfig from '../lib/build/config.js';
+import mcpHandler from './routes/mcp.js';
+import renderPage from './html/renderPage.js';
+import requestHandler from './routes/request.js';
+import sentryMiddleware from './middleware/sentry.js';
+import usageHandler from './routes/usage.js';
+import websocketHandler from './routes/websocket.js';
+
+const basePath = lowdefyConfig.basePath ?? '';
+
+// Cap how long a single request may run. A request that hangs on an upstream call (DB, SMTP, an
+// external API) would otherwise run to the platform's function limit — on serverless (e.g. Vercel
+// Fluid) that is billed compute. Configured via `config.requestTimeout` (ms) in lowdefy.yaml;
+// defaults to 30s, 0 disables. Agent streaming is exempt below since it is long-lived by design.
+const requestTimeoutMs = lowdefyConfig.requestTimeout ?? 30000;
+
+// `serveStaticAssets` is true for the Node server (it serves `dist/client` itself). On a
+// platform that serves the built client + public files from a CDN (e.g. Vercel), pass false so
+// the request handler skips the Node-only static middleware and only owns the dynamic routes.
+function createApp({ serveStaticAssets = true } = {}) {
+  const app = basePath ? new Hono().basePath(basePath) : new Hono();
+  const logger = createLogger({ server: 'lowdefy' });
+
+  // Liveness endpoint for container health checks and orchestrator probes. Registered
+  // before all middleware so probes skip auth, session, request logging, and Sentry.
+  app.get('/api/lowdefy-health', (c) => c.json({ status: 'ok' }));
+
+  app.use('*', sentryMiddleware());
+
+  // Bound request duration so a hung upstream returns an error instead of running to the platform's
+  // function limit (cost protection on serverless). Agent streaming is long-lived by design, so it
+  // is exempt. Configured via `config.requestTimeout` in lowdefy.yaml (0 disables).
+  if (requestTimeoutMs > 0) {
+    app.use('*', async (c, next) => {
+      if (
+        c.req.path.includes('/api/agent/') ||
+        c.req.path.includes('/api/mcp') ||
+        c.req.path.includes('/api/websocket')
+      ) {
+        return next();
+      }
+      return timeout(requestTimeoutMs)(c, next);
+    });
+  }
+
+  // Next.js compressed responses by default — keep parity, but leave
+  // streaming responses (agent SSE) and websocket upgrades uncompressed.
+  app.use('*', async (c, next) => {
+    if (
+      c.req.path.includes('/api/agent/') ||
+      c.req.path.includes('/api/mcp') ||
+      c.req.path.includes('/api/websocket')
+    ) {
+      return next();
+    }
+    return compress()(c, next);
+  });
+
+  if (authJson.configured === true) {
+    app.use(
+      '*',
+      initAuthConfig(() => getAuthConfig({ logger }))
+    );
+  }
+
+  app.use('/api/*', apiContext());
+  app.use('/api/auth/*', authMiddleware());
+  app.all('/api/request/*', requestHandler);
+  // Endpoint payloads may carry base64 file content (emitFileContent + CallAPI);
+  // cap bodies at 10 MiB to match the agent route.
+  app.all('/api/endpoints/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), endpointsHandler);
+  app.get('/api/cron/*', cronHandler);
+  app.get('/api/cron-forward/*', cronForwardHandler);
+  app.post('/api/detached/*', detachedHandler);
+  app.all('/api/client-error', clientErrorHandler);
+  app.all('/api/usage', usageHandler);
+  app.all('/api/agent/*', bodyLimit({ maxSize: 10 * 1024 * 1024 }), agentHandler);
+  app.all('/api/mcp', bodyLimit({ maxSize: 10 * 1024 * 1024 }), mcpHandler);
+  app.get('/api/websocket', websocketHandler);
+  app.get('/api/page/*', apiPageHandler);
+
+  // Vite build output (includes public/ via Vite's publicDir copy). Falls
+  // through to the page routes when no file matches.
+  if (serveStaticAssets) {
+    app.use(
+      '/*',
+      serveStatic({
+        root: './dist/client',
+        rewriteRequestPath: basePath ? (path) => path.replace(basePath, '') : undefined,
+      })
+    );
+  }
+
+  app.use('/*', apiContext());
+  app.get('/', (c) => renderPage(c, { pageId: '' }));
+  app.get('/404', (c) => renderPage(c, { pageId: '404', status: 404 }));
+  app.get('/:rest{.+}', (c) => renderPage(c, { pageId: c.req.param('rest') }));
+
+  app.onError(createErrorHandler({ basePath, logger }));
+
+  return app;
+}
+
+export default createApp;

package/src/html/getAssets.js

@@ -0,0 +1,45 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+// The Vite manifest is read once at startup — deploys start a new server
+// process after `vite build` completes, so assets never change at runtime.
+// In-place deploys must build before restarting (documented).
+let assets = null;
+
+function getAssets() {
+  if (assets) {
+    return assets;
+  }
+  const manifestPath = path.join(process.cwd(), 'dist/client/.vite/manifest.json');
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const entry = manifest['client/main.jsx'];
+  if (!entry) {
+    throw new Error(
+      'Vite manifest has no "client/main.jsx" entry. Run the client build before starting the server.'
+    );
+  }
+  assets = {
+    js: entry.file,
+    css: entry.css ?? [],
+    imports: (entry.imports ?? []).map((key) => manifest[key]?.file).filter(Boolean),
+  };
+  return assets;
+}
+
+export default getAssets;

package/src/html/renderPage.js

@@ -0,0 +1,80 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { getPageConfig, getRootConfig } from '@lowdefy/api';
+
+import appJson from '../../lib/build/app.js';
+import lowdefyConfig from '../../lib/build/config.js';
+import themeConfig from '../../lib/build/theme.js';
+import getAssets from './getAssets.js';
+import template from './template.js';
+
+const basePath = lowdefyConfig.basePath ?? '';
+
+// Replaces pages/[[...pageId]].js getServerSideProps and pages/404.js
+// getStaticProps. The home redirect logic lives here, not at the route level.
+async function renderPage(c, { pageId, status = 200 }) {
+  const context = c.get('lowdefyContext');
+  const { logger, session } = context;
+
+  let resolvedPageId = pageId;
+  const rootConfig = await getRootConfig(context);
+
+  if (!resolvedPageId) {
+    const { home } = rootConfig;
+    if (home.configured === false) {
+      logger.info({ event: 'redirect_to_homepage', pageId: home.pageId });
+      return c.redirect(`${basePath}/${home.pageId}`, 302);
+    }
+    resolvedPageId = home.pageId;
+  }
+
+  const pageConfig = await getPageConfig(context, {
+    pageId: resolvedPageId,
+    urlQuery: c.req.query(),
+  });
+
+  if (!pageConfig) {
+    if (resolvedPageId === '404') {
+      // No 404 page in the build — return a plain 404 rather than redirecting in a loop.
+      return c.text('Page not found.', 404);
+    }
+    logger.info({ event: 'redirect_page_not_found', pageId: resolvedPageId });
+    return c.redirect(`${basePath}/404`, 302);
+  }
+
+  logger.info({ event: 'page_view', pageId: resolvedPageId });
+
+  const html = template({
+    appendBody: appJson.html?.appendBody ?? '',
+    appendHead: appJson.html?.appendHead ?? '',
+    assets: getAssets(),
+    basePath,
+    config: {
+      basePath,
+      pageConfig,
+      rootConfig,
+      sentryDsn: process.env.SENTRY_DSN ?? null,
+      session: session ?? null,
+    },
+    themeConfig,
+    title: pageConfig.properties?.title ?? resolvedPageId,
+  });
+
+  return c.html(html, status);
+}
+
+export default renderPage;

package/src/html/template.js

@@ -0,0 +1,95 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import safeScriptJson from '../lib/safeScriptJson.js';
+
+const HTML_ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' };
+
+function escapeHtml(value) {
+  return String(value).replace(/[&<>"]/g, (c) => HTML_ESCAPES[c]);
+}
+
+// Synchronous script that creates the @layer order declaration and keeps it as
+// the first child of <head> via MutationObserver. antd's CSS-in-JS uses
+// prependQueue to inject <style> tags at the top of <head>, which would
+// otherwise make @layer antd the first (lowest priority) layer.
+// MutationObserver fires before paint, so the browser never sees the wrong
+// cascade order.
+const layerOrderScript = `(function(){var s=document.createElement("style");s.id="__lf-layer-order";s.textContent="@layer theme, base, antd, components, utilities;";document.head.prepend(s);new MutationObserver(function(){if(document.head.firstChild!==s)document.head.prepend(s)}).observe(document.head,{childList:true})})();`;
+
+// Synchronous pre-hydration script setting the <html> background and
+// color-scheme — prevents a mode-mismatch flash of the page and of browser
+// chrome (scrollbars, form controls) on page load. Mirrors useDarkMode.js
+// resolution order: configDarkMode → localStorage → prefers-color-scheme.
+function darkModeScript({ configColorMode, darkBg, lightBg }) {
+  return `(function(){var c=${safeScriptJson(configColorMode)};var db=${safeScriptJson(
+    darkBg
+  )};var lb=${safeScriptJson(
+    lightBg
+  )};var d;if(c==="dark")d=true;else if(c==="light")d=false;else{try{var p=localStorage.getItem("lowdefy_darkMode");if(p==="dark")d=true;else if(p==="light")d=false;else d=window.matchMedia("(prefers-color-scheme:dark)").matches}catch(e){d=window.matchMedia("(prefers-color-scheme:dark)").matches}}var bg=d?db:lb;document.documentElement.style.colorScheme=d?"dark":"light";if(bg)document.documentElement.style.backgroundColor=bg})();`;
+}
+
+function template({
+  appendBody = '',
+  appendHead = '',
+  assets,
+  basePath = '',
+  config,
+  themeConfig = {},
+  title,
+}) {
+  const VALID_COLOR_MODES = ['system', 'light', 'dark'];
+  const configColorMode = VALID_COLOR_MODES.includes(themeConfig.darkMode)
+    ? themeConfig.darkMode
+    : 'system';
+  const darkBg = themeConfig?.antd?.darkToken?.colorBgLayout ?? '#000';
+  const lightBg = themeConfig?.antd?.lightToken?.colorBgLayout ?? '';
+
+  const cssLinks = assets.css
+    .map((file) => `<link rel="stylesheet" href="${basePath}/${file}" />`)
+    .join('\n    ');
+  const modulePreloads = assets.imports
+    .map((file) => `<link rel="modulepreload" href="${basePath}/${file}" />`)
+    .join('\n    ');
+
+  // appendHead and appendBody are intentionally raw HTML from app config
+  // (analytics snippets, font links) — they must not be escaped. The config
+  // JSON and pre-hydration interpolations go through safeScriptJson.
+  return `<!DOCTYPE html>
+<html class="lowdefy">
+  <head>
+    <meta charset="utf-8" />
+    <script>${layerOrderScript}</script>
+    <script>${darkModeScript({ configColorMode, darkBg, lightBg })}</script>
+    <link rel="manifest" href="${basePath}/manifest.webmanifest" />
+    <link rel="icon" type="image/svg+xml" href="${basePath}/icon.svg" />
+    <link rel="apple-touch-icon" href="${basePath}/apple-touch-icon.png" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    ${title ? `<title>${escapeHtml(title)}</title>` : ''}
+    ${cssLinks}
+    ${modulePreloads}
+    ${appendHead}
+  </head>
+  <body>
+    <div id="root"></div>
+    <script id="__LOWDEFY_CONFIG__" type="application/json">${safeScriptJson(config)}</script>
+    ${appendBody}
+    <script type="module" src="${basePath}/${assets.js}"></script>
+  </body>
+</html>`;
+}
+
+export default template;

package/src/index.js

@@ -0,0 +1,95 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { serve } from '@hono/node-server';
+import * as Sentry from '@sentry/node';
+import { WebSocketServer } from 'ws';
+
+import checkEnvironmentGuards from '@lowdefy/node-utils/checkEnvironmentGuards.js';
+
+import initSentryServer from '../lib/server/sentry/initSentry.js';
+
+// Auth.js v5 reads AUTH_URL but not NEXTAUTH_URL — alias the v4 variable
+// before any auth config loads so existing deployments keep working.
+if (process.env.NEXTAUTH_URL && !process.env.AUTH_URL) {
+  process.env.AUTH_URL = process.env.NEXTAUTH_URL;
+}
+
+const sentryEnabled = initSentryServer();
+
+// Import after Sentry init so instrumentation observes the module graph.
+const { default: createApp } = await import('./app.js');
+const { default: createLogger } = await import('../lib/server/log/createLogger.js');
+const { default: appMeta } = await import('../lib/build/appMeta.js');
+const { default: config } = await import('../lib/build/config.js');
+
+// The build checked the current environment's guards, but an image built once can be started with
+// different variables, so they are checked again before the server takes any traffic.
+checkEnvironmentGuards({
+  name: config.environment,
+  guards: config.environments?.[config.environment]?.guards,
+});
+
+const app = createApp();
+const logger = createLogger({ server: 'lowdefy' });
+const port = Number(process.env.PORT ?? 3000);
+
+if (sentryEnabled) {
+  logger.info('Sentry enabled: server');
+}
+
+// Handles /api/websocket upgrades via serve({ websocket }). 256 KiB max frame,
+// aligned with Vercel's documented default for WebSocket functions.
+const wss = new WebSocketServer({ noServer: true, maxPayload: 256 * 1024 });
+
+const server = serve({ fetch: app.fetch, port, websocket: { server: wss } }, (info) => {
+  // lowdefy_version logs once here rather than on every line — it is implied
+  // by the build, unlike the per-line deploy identity fields on the logger.
+  logger.info(
+    { port: info.port, lowdefy_version: appMeta.lowdefyVersion },
+    `Lowdefy server listening on http://localhost:${info.port}`
+  );
+});
+
+// Container runtimes send SIGTERM and escalate to SIGKILL after a grace period
+// (Docker defaults to 10s) — finish in-flight work and exit before that deadline.
+let shuttingDown = false;
+function shutdown() {
+  if (shuttingDown) {
+    return;
+  }
+  shuttingDown = true;
+  // 1001 "going away" — clients reconnect and resubscribe on their own.
+  for (const client of wss.clients) {
+    client.close(1001, 'Server shutting down');
+  }
+  // Drop idle keep-alive connections so close() only waits on in-flight requests.
+  server.closeIdleConnections?.();
+  server.close(() => {
+    // Flush queued Sentry events; resolves immediately when Sentry is not enabled.
+    Sentry.close(2000).finally(() => process.exit(0));
+  });
+  // In-flight requests that outlive the grace period would otherwise hold the
+  // process open until SIGKILL — exit first so shutdown stays clean.
+  setTimeout(() => process.exit(1), 8000).unref();
+}
+
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);
+
+// Vercel's Node.js builder consumes the exported server — the same pattern
+// Vercel documents for WebSocket support with Hono on Fluid compute.
+export default server;

package/src/lib/getPathSegments.js

@@ -0,0 +1,25 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Splits the rest of a catch-all route into decoded segments, independent of
+// any configured basePath. Mirrors the Next.js [...param] query arrays —
+// nested ids (slashes in pageId or endpointId) are real.
+function getPathSegments(c, prefix) {
+  const rest = c.req.path.split(prefix)[1] ?? '';
+  return rest.split('/').filter(Boolean).map(decodeURIComponent);
+}
+
+export default getPathSegments;

package/src/lib/safeScriptJson.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Escape characters that could break out of the enclosing <script> tag or
+// terminate a JS string literal. Used to defuse the js/bad-code-sanitization
+// class of injection for values embedded into inline scripts and the
+// application/json config script.
+const SCRIPT_ESCAPES = {
+  '<': '\\u003C',
+  '>': '\\u003E',
+  '\b': '\\b',
+  '\f': '\\f',
+  '\n': '\\n',
+  '\r': '\\r',
+  '\t': '\\t',
+  '\0': '\\0',
+  '\u2028': '\\u2028',
+  '\u2029': '\\u2029',
+};
+
+function safeScriptJson(value) {
+  return JSON.stringify(value).replace(/[<>\b\f\n\r\t\0\u2028\u2029]/g, (c) => SCRIPT_ESCAPES[c]);
+}
+
+export default safeScriptJson;