@lowdefy/server 5.6.0 → 6.1.0

package/src/middleware/apiContext.js

@@ -0,0 +1,138 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import path from 'node:path';
+import { createApiContext } from '@lowdefy/api';
+import { getSecretsFromEnv } from '@lowdefy/node-utils';
+import { v4 as uuid } from 'uuid';
+
+import agents from '../../build/plugins/agents.js';
+import appMeta from '../../lib/build/appMeta.js';
+import config from '../../lib/build/config.js';
+import connections from '../../build/plugins/connections.js';
+import createHandleError from '../../lib/server/log/createHandleError.js';
+import createLogger from '../../lib/server/log/createLogger.js';
+import fileCache from '../../lib/server/fileCache.js';
+import getSession from '../../lib/server/auth/session.js';
+import getStrategyCaller from '../../lib/server/auth/strategies.js';
+import i18nConfig from '../../lib/build/i18n.js';
+import jsMap from '../../build/plugins/operators/serverJsMap.js';
+import logRequest from '../../lib/server/log/logRequest.js';
+import loggerConfig from '../../lib/build/logger.js';
+import scrubSecrets from '../../lib/server/scrubSecrets.js';
+import notifications, {
+  interpolateProperties,
+  renderEmail,
+} from '../../build/plugins/notifications.js';
+import operators from '../../build/plugins/operators/server.js';
+import setSentryUser from '../../lib/server/sentry/setSentryUser.js';
+import websockets from '../../build/plugins/websockets.js';
+
+const secrets = getSecretsFromEnv();
+
+// Charset/length guard so a hostile x-request-id can't inject into logs.
+const REQUEST_ID_REGEX = /^[\w.:-]{1,128}$/;
+
+// Honor the request id assigned by an upstream proxy or load balancer so one
+// id correlates client, proxy, and server logs; generate one otherwise.
+function getRequestId(c) {
+  const incoming = c.req.header('x-request-id');
+  if (incoming && REQUEST_ID_REGEX.test(incoming)) {
+    return incoming;
+  }
+  return uuid();
+}
+
+// Replaces lib/server/apiWrapper.js. Builds the request context consumed by
+// @lowdefy/api functions. Errors thrown by handlers are routed by Hono to the
+// app-level error handler (src/middleware/errorHandler.js), which reads this
+// context back from the Hono context.
+function apiContext() {
+  return async function apiContextMiddleware(c, next) {
+    // The page-route mount ('/*') also matches /api/* paths that already
+    // built a context — never build twice for one request.
+    if (c.get('lowdefyContext')) {
+      return next();
+    }
+    const rid = getRequestId(c);
+    const context = {
+      rid,
+      agents,
+      appMeta,
+      buildDirectory: path.join(process.cwd(), 'build'),
+      config,
+      connections,
+      fileCache,
+      headers: c.req.header(),
+      // The deployment's own origin — detached endpoint calls loop back
+      // through it so the target runs in its own function invocation.
+      origin: new URL(c.req.url).origin,
+      i18n: i18nConfig,
+      interpolateProperties,
+      jsMap,
+      logger: createLogger({ rid }),
+      mode: 'prod',
+      notifications,
+      operators,
+      renderEmail,
+      req: {
+        url: c.req.path,
+        method: c.req.method,
+        hostname: c.req.header('host'),
+      },
+      scrubSecrets,
+      secrets,
+      // On Vercel (fluid compute) the platform request context keeps the
+      // invocation alive until waitUntil promises settle; on long-lived hosts
+      // the lookup resolves to nothing and background promises just run.
+      waitUntil: (promise) =>
+        globalThis[Symbol.for('@vercel/request-context')]?.get?.()?.waitUntil?.(promise),
+      websockets,
+    };
+    context.handleError = createHandleError({ context });
+    if (!c.req.path.includes('/api/auth')) {
+      context.session = await getSession(c);
+      if (!context.session?.user) {
+        const caller = await getStrategyCaller(c, context.logger);
+        if (caller) {
+          context.session = { user: caller };
+        }
+      }
+      // Set Sentry user context for authenticated requests
+      setSentryUser({
+        user: context.session?.user,
+        sentryConfig: loggerConfig.sentry,
+      });
+    }
+    createApiContext(context);
+    c.set('lowdefyContext', context);
+    // Echo the request id so clients and proxies can quote it when reporting
+    // a failure, and it can be matched to the rid on the server log lines.
+    c.header('x-request-id', context.rid);
+    const startTime = performance.now();
+    // Handler errors never reject next() — Hono's compose routes them to the
+    // app-level error handler at the throwing dispatch level, so by the time
+    // next() resolves c.res holds the final response, error or not.
+    await next();
+    logRequest({
+      context,
+      status: c.res.status,
+      durationMs: Math.round(performance.now() - startTime),
+    });
+  };
+}
+
+export default apiContext;

package/src/middleware/apiContext.test.mjs

@@ -0,0 +1,118 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+const secret = 'planted-apicontext-secret';
+process.env.LOWDEFY_SECRET_TEST = secret;
+
+jest.unstable_mockModule('@lowdefy/api', () => ({ createApiContext: jest.fn() }));
+jest.unstable_mockModule('../../lib/build/appMeta.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/build/config.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/build/i18n.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/build/logger.js', () => ({ default: { sentry: {} } }));
+jest.unstable_mockModule('../../lib/server/log/createHandleError.js', () => ({
+  default: jest.fn(() => jest.fn()),
+}));
+jest.unstable_mockModule('../../lib/server/log/createLogger.js', () => ({
+  default: jest.fn(() => ({ debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() })),
+}));
+jest.unstable_mockModule('../../lib/server/fileCache.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/server/auth/session.js', () => ({
+  default: jest.fn(async () => undefined),
+}));
+jest.unstable_mockModule('../../lib/server/auth/strategies.js', () => ({
+  default: jest.fn(async () => null),
+}));
+jest.unstable_mockModule('../../lib/server/log/logRequest.js', () => ({ default: jest.fn() }));
+jest.unstable_mockModule('../../lib/server/sentry/setSentryUser.js', () => ({
+  default: jest.fn(),
+}));
+
+// apiContext statically imports the app build's plugin artifacts, which only
+// exist in a built app (build/** is gitignored). Materialize the minimal set
+// it needs so the import resolves; clean up only what this test created.
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const pluginsDir = path.resolve(dirname, '../../build/plugins');
+const fixtures = [
+  { file: 'agents.js', content: 'export default {};\n' },
+  { file: 'connections.js', content: 'export default {};\n' },
+  {
+    file: 'notifications.js',
+    content:
+      'export default {};\nexport const interpolateProperties = () => {};\nexport const renderEmail = () => {};\n',
+  },
+  { file: path.join('operators', 'server.js'), content: 'export default {};\n' },
+  { file: path.join('operators', 'serverJsMap.js'), content: 'export default {};\n' },
+  { file: 'websockets.js', content: 'export default {};\n' },
+].map(({ file, content }) => ({ absolutePath: path.join(pluginsDir, file), content }));
+
+const createdFixtures = [];
+fixtures.forEach(({ absolutePath, content }) => {
+  if (!fs.existsSync(absolutePath)) {
+    fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+    fs.writeFileSync(absolutePath, content);
+    createdFixtures.push(absolutePath);
+  }
+});
+
+// A checkout that has built an app already holds real artifacts here, which import plugins this
+// package does not depend on, so the stubs are also mocked over whatever is on disk.
+fixtures.forEach(({ absolutePath }) => {
+  jest.unstable_mockModule(absolutePath, () => ({
+    default: {},
+    interpolateProperties: () => {},
+    renderEmail: () => {},
+  }));
+});
+
+afterAll(() => {
+  createdFixtures.forEach((absolutePath) => fs.rmSync(absolutePath, { force: true }));
+});
+
+const { default: apiContext } = await import('./apiContext.js');
+
+function createApp() {
+  const app = new Hono();
+  app.use('*', apiContext());
+  app.get('/api/ping', (c) => {
+    const context = c.get('lowdefyContext');
+    return c.json({
+      mode: context.mode,
+      scrubbed: context.scrubSecrets(`token ${secret} end`),
+    });
+  });
+  return app;
+}
+
+test('apiContext sets mode to prod', async () => {
+  const res = await createApp().request('/api/ping');
+  expect(res.status).toEqual(200);
+  const body = await res.json();
+  expect(body.mode).toEqual('prod');
+});
+
+test('apiContext scrubSecrets redacts a planted secret', async () => {
+  const res = await createApp().request('/api/ping');
+  expect(res.status).toEqual(200);
+  const body = await res.json();
+  expect(body.scrubbed).toEqual('token [REDACTED] end');
+});

package/src/middleware/errorHandler.js

@@ -0,0 +1,54 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import * as Sentry from '@sentry/node';
+import { redactErrorResponse } from '@lowdefy/api';
+
+// Hono routes every handler error to the app-level error handler — upstream
+// middleware try/catch never sees them (compose catches per dispatch level).
+// API routes get the serialized error JSON the old apiWrapper returned;
+// page routes get a plain 500.
+function createErrorHandler({ basePath = '', logger }) {
+  return async function errorHandler(error, c) {
+    const path = basePath ? c.req.path.replace(basePath, '') : c.req.path;
+    // Unauthenticated requests to protected endpoints are expected traffic -
+    // one warning line and a 401, skipping the structured error log and the
+    // Sentry capture so probing cannot flood either. Keys strictly on the
+    // error name; the 500 path below is untouched.
+    if (error.name === 'AuthenticationError') {
+      logger.warn(`Unauthenticated request: ${c.req.method} ${c.req.path}`);
+      if (path.startsWith('/api/')) {
+        return c.json({ name: error.name, message: error.message }, 401);
+      }
+      return c.text('Unauthorized', 401);
+    }
+    const context = c.get('lowdefyContext');
+    if (context) {
+      await context.handleError(error);
+    } else {
+      logger.error(error);
+    }
+    if (process.env.SENTRY_DSN) {
+      Sentry.captureException(error);
+    }
+    if (path.startsWith('/api/')) {
+      return c.json(redactErrorResponse(context, error), 500);
+    }
+    return c.text('Internal Server Error', 500);
+  };
+}
+
+export default createErrorHandler;

package/src/middleware/sentry.js

@@ -0,0 +1,33 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import * as Sentry from '@sentry/node';
+
+// Replaces @sentry/nextjs route auto-instrumentation: every request becomes
+// an http.server transaction. Handler errors never propagate through
+// middleware in Hono — captureException happens in the app error handler.
+function sentryMiddleware() {
+  return async function sentry(c, next) {
+    if (!process.env.SENTRY_DSN) {
+      return next();
+    }
+    return Sentry.startSpan({ name: `${c.req.method} ${c.req.path}`, op: 'http.server' }, () =>
+      next()
+    );
+  };
+}
+
+export default sentryMiddleware;

package/{pages/api/agent/[...path].js → src/routes/agent.js}

@@ -17,34 +17,31 @@
 import { callAgent } from '@lowdefy/api';
 import { translate, type } from '@lowdefy/helpers';
 
-import apiWrapper from '../../../lib/server/apiWrapper.js';
+import getPathSegments from '../lib/getPathSegments.js';
 
-async function handler({ context, req, res }) {
+async function agentHandler(c) {
+  const context = c.get('lowdefyContext');
   const t = (key, values) => translate({ key, values, i18n: context.i18n });
-  if (req.method !== 'POST') {
+  if (c.req.method !== 'POST') {
     throw new Error(t('agent.runtime.methodNotAllowed'));
   }
-  const segments = req.query.path;
-  if (!Array.isArray(segments) || segments.length < 2) {
-    res.status(400).json({ error: t('agent.runtime.invalidPath') });
-    return;
+  const segments = getPathSegments(c, '/api/agent/');
+  if (segments.length < 2) {
+    return c.json({ error: t('agent.runtime.invalidPath') }, 400);
   }
   const agentId = segments[segments.length - 1];
   const pageId = segments.slice(0, -1).join('/');
   context.logger.info({ event: 'call_agent', agentId, pageId });
-  const { conversationId } = req.query;
-  const { messages, urlQuery, sharedState } = req.body;
+  const { conversationId } = c.req.query();
+  const { messages, urlQuery, sharedState } = await c.req.json();
   if (!Array.isArray(messages)) {
-    res.status(400).json({ error: t('agent.runtime.messagesMustBeArray') });
-    return;
+    return c.json({ error: t('agent.runtime.messagesMustBeArray') }, 400);
   }
   if (urlQuery != null && (typeof urlQuery !== 'object' || Array.isArray(urlQuery))) {
-    res.status(400).json({ error: t('agent.runtime.urlQueryMustBeObject') });
-    return;
+    return c.json({ error: t('agent.runtime.urlQueryMustBeObject') }, 400);
   }
   if (sharedState != null && !type.isObject(sharedState)) {
-    res.status(400).json({ error: t('agent.runtime.sharedStateMustBeObject') });
-    return;
+    return c.json({ error: t('agent.runtime.sharedStateMustBeObject') }, 400);
   }
   const { response: webResponse } = await callAgent(context, {
     agentId,
@@ -55,32 +52,13 @@ async function handler({ context, req, res }) {
     urlQuery: urlQuery ?? undefined,
   });
 
-  // Stream the Web Response body to the Next.js response
-  res.setHeader('Content-Type', 'text/event-stream');
-  res.setHeader('Cache-Control', 'no-cache');
-  res.setHeader('Connection', 'keep-alive');
-  res.setHeader('Content-Encoding', 'none');
-  res.setHeader('Transfer-Encoding', 'chunked');
-
-  const reader = webResponse.body.getReader();
-  const decoder = new TextDecoder();
-  let done = false;
-  while (!done) {
-    const { value, done: readerDone } = await reader.read();
-    done = readerDone;
-    if (value) {
-      res.write(decoder.decode(value, { stream: true }));
-    }
-  }
-  res.end();
+  // callAgent returns a Web Response — stream its body straight through.
+  return c.body(webResponse.body, 200, {
+    'Content-Type': 'text/event-stream',
+    'Cache-Control': 'no-cache',
+    Connection: 'keep-alive',
+    'Content-Encoding': 'none',
+  });
 }
 
-export const config = {
-  api: {
-    bodyParser: {
-      sizeLimit: '10mb',
-    },
-  },
-};
-
-export default apiWrapper(handler);
+export default agentHandler;

package/src/routes/apiPage.js

@@ -0,0 +1,40 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { getPageConfig } from '@lowdefy/api';
+
+import appMeta from '../../lib/build/appMeta.js';
+import getPathSegments from '../lib/getPathSegments.js';
+
+// Page config as JSON for client-side SPA navigation. The first page load is
+// served embedded in the HTML; subsequent navigations fetch from here.
+async function apiPageHandler(c) {
+  const context = c.get('lowdefyContext');
+  const pageId = getPathSegments(c, '/api/page/').join('/');
+  // The client forwards its current query string on the fetch so Dynamic block
+  // resolution sees the same urlQuery as an initial HTML load.
+  const pageConfig = await getPageConfig(context, { pageId, urlQuery: c.req.query() });
+  if (!pageConfig) {
+    context.logger.info({ event: 'api_page_not_found', pageId });
+    return c.json({ pageConfig: null }, 404);
+  }
+  context.logger.info({ event: 'api_page_view', pageId });
+  // buildId lets a tab that loaded its bundle from an earlier deploy notice
+  // that this config comes from a newer build and reload (client/Page.jsx).
+  return c.json({ buildId: appMeta.buildId, pageConfig });
+}
+
+export default apiPageHandler;

package/src/routes/apiPage.test.mjs

@@ -0,0 +1,59 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+const mockGetPageConfig = jest.fn();
+jest.unstable_mockModule('@lowdefy/api', () => ({
+  getPageConfig: mockGetPageConfig,
+}));
+
+jest.unstable_mockModule('../../lib/build/appMeta.js', () => ({
+  default: { buildId: 'build-abc' },
+}));
+
+const { default: apiPageHandler } = await import('./apiPage.js');
+
+function createApp() {
+  const app = new Hono();
+  app.use('*', async (c, next) => {
+    c.set('lowdefyContext', {
+      logger: { debug: jest.fn(), info: jest.fn(), error: jest.fn() },
+    });
+    await next();
+  });
+  app.get('/api/page/*', apiPageHandler);
+  return app;
+}
+
+afterEach(() => {
+  mockGetPageConfig.mockReset();
+});
+
+test('apiPageHandler returns the pageConfig stamped with the build id', async () => {
+  mockGetPageConfig.mockResolvedValue({ id: 'invoices' });
+  const res = await createApp().request('/api/page/invoices');
+  expect(res.status).toEqual(200);
+  expect(await res.json()).toEqual({ buildId: 'build-abc', pageConfig: { id: 'invoices' } });
+});
+
+test('apiPageHandler returns 404 when the page is not found', async () => {
+  mockGetPageConfig.mockResolvedValue(null);
+  const res = await createApp().request('/api/page/missing');
+  expect(res.status).toEqual(404);
+  expect(await res.json()).toEqual({ pageConfig: null });
+});

package/src/routes/auth.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { authHandler } from '@hono/auth-js';
+
+import authJson from '../../lib/build/auth.js';
+
+// Replaces pages/api/auth/[...nextauth].js. Hono routes HEAD requests through
+// GET handlers, so the corporate-email pre-check branch must live inside the
+// middleware, before delegating to the Auth.js handler. See:
+// https://next-auth.js.org/tutorials/avoid-corporate-link-checking-email-provider
+function authMiddleware() {
+  const handler = authJson.configured === true ? authHandler() : null;
+  return async function auth(c, next) {
+    if (authJson.configured !== true) {
+      return c.json({ message: 'Auth not configured' }, 404);
+    }
+    if (c.req.method === 'HEAD') {
+      return c.body(null, 200);
+    }
+    return handler(c, next);
+  };
+}
+
+export default authMiddleware;

package/{pages/api/client-error.js → src/routes/clientError.js}

@@ -16,34 +16,32 @@
 
 import { logClientError } from '@lowdefy/api';
 
-import apiWrapper from '../../lib/server/apiWrapper.js';
 import captureSentryError from '../../lib/server/sentry/captureSentryError.js';
 
-async function handler({ context, req, res }) {
-  if (req.method !== 'POST') {
+async function clientErrorHandler(c) {
+  if (c.req.method !== 'POST') {
     throw new Error('Only POST requests are supported.');
   }
+  const context = c.get('lowdefyContext');
 
-  const origin = req.headers.origin;
+  const origin = c.req.header('origin');
   if (!origin) {
-    res.status(403).json({ error: 'Forbidden' });
-    return;
+    return c.json({ error: 'Forbidden' }, 403);
   }
   try {
-    if (new URL(origin).host !== req.headers.host) {
-      res.status(403).json({ error: 'Forbidden' });
-      return;
+    if (new URL(origin).host !== c.req.header('host')) {
+      return c.json({ error: 'Forbidden' }, 403);
     }
   } catch {
-    res.status(403).json({ error: 'Forbidden' });
-    return;
+    return c.json({ error: 'Forbidden' }, 403);
   }
 
+  const body = await c.req.json();
   // Strip received from payload — prod doesn't need it for schema validation
-  if (req.body?.['~e']) {
-    delete req.body['~e'].received;
+  if (body?.['~e']) {
+    delete body['~e'].received;
   }
-  const { error, ...response } = await logClientError(context, req.body);
+  const { error, ...response } = await logClientError(context, body);
 
   // Capture client error to Sentry (no-op if Sentry not configured)
   captureSentryError({
@@ -52,7 +50,7 @@ async function handler({ context, req, res }) {
     configLocation: response.source ? { source: response.source, config: response.config } : null,
   });
 
-  res.status(200).json({ success: true });
+  return c.json({ success: true });
 }
 
-export default apiWrapper(handler);
+export default clientErrorHandler;

package/src/routes/cron.js

@@ -0,0 +1,44 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { runScheduledEndpoint } from '@lowdefy/api';
+
+import getPathSegments from '../lib/getPathSegments.js';
+
+// Triggered by Vercel Cron: an HTTP GET to /api/cron/<endpointId>. Vercel auto-sends the value of
+// the project env var named exactly CRON_SECRET as `Authorization: Bearer <value>`, and the firing
+// cron expression in the `x-vercel-cron-schedule` header. Fails closed if CRON_SECRET is unset.
+async function cronHandler(c) {
+  if (c.req.method !== 'GET') {
+    throw new Error('Only GET requests are supported.');
+  }
+  const context = c.get('lowdefyContext');
+
+  const secret = process.env.CRON_SECRET;
+  if (!secret || c.req.header('authorization') !== `Bearer ${secret}`) {
+    context.logger.warn({ event: 'cron_unauthorized' });
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  const endpointId = getPathSegments(c, '/api/cron/').join('/');
+  const cron = c.req.header('x-vercel-cron-schedule');
+  const environment = c.req.header('x-lowdefy-cron-environment');
+  context.logger.info({ event: 'call_cron_endpoint', endpointId, cron, environment });
+  const response = await runScheduledEndpoint(context, { endpointId, cron, environment });
+  return c.json(response);
+}
+
+export default cronHandler;