@lowdefy/server 6.1.0 → 7.1.0

package/src/middleware/errorHandler.test.mjs

@@ -0,0 +1,440 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { HTTPException } from 'hono/http-exception';
+import { jest } from '@jest/globals';
+
+// The handler is byte-identical to `server-dev`'s and `server-e2e`'s apart from
+// the Sentry capture tested at the bottom of this file. Keep the three in sync
+// when changing any of them.
+const captureException = jest.fn();
+
+const { default: sentrySdk } = await import('../../lib/server/sentry/sentrySdk.js');
+const { default: createErrorHandler } = await import('./errorHandler.js');
+
+// A string that must never reach a client. It is put on `received` at every
+// level of the cause chain, so a single JSON.stringify search over the body
+// proves the redaction reached that level.
+const SECRET = 'SECRET-RECEIVED-VALUE';
+
+function createLogger() {
+  return { error: jest.fn(), warn: jest.fn() };
+}
+
+// The error handler is only reachable through hono's app-level onError, so the
+// handler is driven the way production drives it: a route that throws, with the
+// lowdefyContext set by upstream middleware when there is one.
+function createApp({ basePath = '', context, error, logger }) {
+  const app = new Hono();
+  app.use('*', async (c, next) => {
+    if (context) c.set('lowdefyContext', context);
+    await next();
+  });
+  app.all('*', () => {
+    throw error;
+  });
+  app.onError(createErrorHandler({ basePath, logger }));
+  return app;
+}
+
+function createAuthenticationError(message) {
+  const error = new Error(message);
+  error.name = 'AuthenticationError';
+  error.received = SECRET;
+  return error;
+}
+
+function createAuthorizationError(message) {
+  const error = new Error(message);
+  error.name = 'AuthorizationError';
+  error.received = SECRET;
+  return error;
+}
+
+function createTwoFactorEnrolmentRequiredError(message) {
+  const error = new Error(message);
+  error.name = 'TwoFactorEnrolmentRequiredError';
+  error.received = SECRET;
+  return error;
+}
+
+function createUserError(message) {
+  const error = new Error(message);
+  error.name = 'UserError';
+  error.received = SECRET;
+  return error;
+}
+
+// Two Error levels, each with a stack (every Error has one) and a recognisable
+// `received`, plus a configKey the policy keeps.
+function createErrorWithCause() {
+  const cause = new Error('Cause message.');
+  cause.received = `${SECRET}-cause`;
+  const error = new Error('Top message.', { cause });
+  error.received = `${SECRET}-top`;
+  error.configKey = 'page:home.blocks.0';
+  return error;
+}
+
+test('errorHandler returns 401 with only name and message for an AuthenticationError on an api path', async () => {
+  const logger = createLogger();
+  const context = { handleError: jest.fn() };
+  const res = await createApp({
+    context,
+    error: createAuthenticationError('Unauthenticated.'),
+    logger,
+  }).request('/api/request/getUsers');
+
+  expect(res.status).toEqual(401);
+  expect(await res.json()).toEqual({ name: 'AuthenticationError', message: 'Unauthenticated.' });
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.warn.mock.calls[0][0]).toMatch(/Unauthenticated request/);
+  expect(logger.error).not.toHaveBeenCalled();
+  expect(context.handleError).not.toHaveBeenCalled();
+});
+
+test('errorHandler does not send an AuthenticationError through the redactor', async () => {
+  const res = await createApp({
+    error: createAuthenticationError('Unauthenticated.'),
+    logger: createLogger(),
+  }).request('/api/request/getUsers');
+
+  const body = await res.json();
+  expect(body['~e']).toBeUndefined();
+});
+
+test('errorHandler returns text Unauthorized at 401 for an AuthenticationError on a page path', async () => {
+  const logger = createLogger();
+  const res = await createApp({
+    error: createAuthenticationError('Unauthenticated.'),
+    logger,
+  }).request('/home');
+
+  expect(res.status).toEqual(401);
+  expect(await res.text()).toEqual('Unauthorized');
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+});
+
+test('errorHandler returns 403 with only name and message for an AuthorizationError on an api path', async () => {
+  const logger = createLogger();
+  const context = { handleError: jest.fn() };
+  const res = await createApp({
+    context,
+    error: createAuthorizationError('Forbidden.'),
+    logger,
+  }).request('/api/request/getUsers');
+
+  expect(res.status).toEqual(403);
+  expect(await res.json()).toEqual({ name: 'AuthorizationError', message: 'Forbidden.' });
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.warn.mock.calls[0][0]).toMatch(/Forbidden: GET \/api\/request\/getUsers/);
+  expect(logger.error).not.toHaveBeenCalled();
+  expect(context.handleError).not.toHaveBeenCalled();
+});
+
+test('errorHandler does not send an AuthorizationError through the redactor', async () => {
+  const res = await createApp({
+    error: createAuthorizationError('Forbidden.'),
+    logger: createLogger(),
+  }).request('/api/request/getUsers');
+
+  const body = await res.json();
+  expect(body['~e']).toBeUndefined();
+  expect(JSON.stringify(body)).not.toContain(SECRET);
+});
+
+test('errorHandler returns text Forbidden at 403 for an AuthorizationError on a page path', async () => {
+  const logger = createLogger();
+  const res = await createApp({
+    error: createAuthorizationError('Forbidden.'),
+    logger,
+  }).request('/home');
+
+  expect(res.status).toEqual(403);
+  expect(await res.text()).toEqual('Forbidden');
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.error).not.toHaveBeenCalled();
+});
+
+test('errorHandler returns 403 with only name and message for a TwoFactorEnrolmentRequiredError on an api path', async () => {
+  const logger = createLogger();
+  const context = { handleError: jest.fn() };
+  const res = await createApp({
+    context,
+    error: createTwoFactorEnrolmentRequiredError('Two-factor enrolment required.'),
+    logger,
+  }).request('/api/request/getUsers');
+
+  expect(res.status).toEqual(403);
+  expect(await res.json()).toEqual({
+    name: 'TwoFactorEnrolmentRequiredError',
+    message: 'Two-factor enrolment required.',
+  });
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.warn.mock.calls[0][0]).toMatch(/Two-factor enrolment required/);
+  expect(logger.error).not.toHaveBeenCalled();
+  expect(context.handleError).not.toHaveBeenCalled();
+});
+
+test('errorHandler does not send a TwoFactorEnrolmentRequiredError through the redactor', async () => {
+  const res = await createApp({
+    error: createTwoFactorEnrolmentRequiredError('Two-factor enrolment required.'),
+    logger: createLogger(),
+  }).request('/api/request/getUsers');
+
+  const body = await res.json();
+  expect(body['~e']).toBeUndefined();
+});
+
+test('errorHandler returns text at 403 for a TwoFactorEnrolmentRequiredError on a page path', async () => {
+  const logger = createLogger();
+  const context = { handleError: jest.fn() };
+  const res = await createApp({
+    context,
+    error: createTwoFactorEnrolmentRequiredError('Two-factor enrolment required.'),
+    logger,
+  }).request('/home');
+
+  expect(res.status).toEqual(403);
+  expect(await res.text()).toEqual('Two-factor enrolment required');
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(context.handleError).not.toHaveBeenCalled();
+});
+
+test('errorHandler returns 400 with only name and message for a UserError on an api path', async () => {
+  const logger = createLogger();
+  const context = { handleError: jest.fn() };
+  const res = await createApp({
+    context,
+    error: createUserError('Payload for endpoint "x" does not match its payloadSchema.'),
+    logger,
+  }).request('/api/endpoints/x', { method: 'POST' });
+
+  expect(res.status).toEqual(400);
+  expect(await res.json()).toEqual({
+    name: 'UserError',
+    message: 'Payload for endpoint "x" does not match its payloadSchema.',
+  });
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.warn.mock.calls[0][0]).toMatch(/Bad request: POST \/api\/endpoints\/x/);
+  expect(logger.error).not.toHaveBeenCalled();
+  expect(context.handleError).not.toHaveBeenCalled();
+  expect(captureException).not.toHaveBeenCalled();
+});
+
+test('errorHandler does not send a UserError through the redactor', async () => {
+  const res = await createApp({
+    error: createUserError('Bad payload.'),
+    logger: createLogger(),
+  }).request('/api/endpoints/x');
+
+  const body = await res.json();
+  expect(body['~e']).toBeUndefined();
+  expect(JSON.stringify(body)).not.toContain(SECRET);
+});
+
+test('errorHandler returns text Bad Request at 400 for a UserError on a page path', async () => {
+  const logger = createLogger();
+  const res = await createApp({
+    error: createUserError('Bad payload.'),
+    logger,
+  }).request('/home');
+
+  expect(res.status).toEqual(400);
+  expect(await res.text()).toEqual('Bad Request');
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.error).not.toHaveBeenCalled();
+});
+
+test('errorHandler sends an HTTPException response as-is with one warning and no error log', async () => {
+  const logger = createLogger();
+  const error = new HTTPException(404, {
+    res: Response.json(
+      { jsonrpc: '2.0', error: { code: -32000, message: 'Unsupported protocol version' } },
+      { status: 404 }
+    ),
+  });
+  const res = await createApp({ error, logger }).request('/api/mcp', { method: 'POST' });
+  expect(res.status).toEqual(404);
+  expect(await res.json()).toEqual({
+    jsonrpc: '2.0',
+    error: { code: -32000, message: 'Unsupported protocol version' },
+  });
+  expect(logger.warn).toHaveBeenCalledWith('404 answered by the route: POST /api/mcp');
+  expect(logger.error).not.toHaveBeenCalled();
+});
+
+test('errorHandler returns 500 with the serialized error envelope on an api path', async () => {
+  const res = await createApp({
+    error: createErrorWithCause(),
+    logger: createLogger(),
+  }).request('/api/request/getUsers');
+
+  expect(res.status).toEqual(500);
+  const body = await res.json();
+  expect(body['~e'].name).toEqual('Error');
+  expect(body['~e'].message).toEqual('Something went wrong.');
+  expect(body['~e'].cause).toBeUndefined();
+});
+
+test('errorHandler omits stack and received from the 500 envelope at the top level', async () => {
+  const res = await createApp({
+    error: createErrorWithCause(),
+    logger: createLogger(),
+  }).request('/api/request/getUsers');
+
+  const body = await res.json();
+  expect(body['~e'].stack).toBeUndefined();
+  expect(body['~e'].received).toBeUndefined();
+});
+
+test('errorHandler omits the cause chain from the 500 envelope', async () => {
+  const res = await createApp({
+    error: createErrorWithCause(),
+    logger: createLogger(),
+  }).request('/api/request/getUsers');
+
+  const body = await res.json();
+  expect(body['~e'].cause).toBeUndefined();
+  expect(JSON.stringify(body)).not.toContain(SECRET);
+  expect(JSON.stringify(body)).not.toContain('Cause message.');
+});
+
+test('errorHandler keeps configKey on the 500 envelope so the fault can be located in config', async () => {
+  const res = await createApp({
+    error: createErrorWithCause(),
+    logger: createLogger(),
+  }).request('/api/request/getUsers');
+
+  const body = await res.json();
+  expect(body['~e'].configKey).toEqual('page:home.blocks.0');
+});
+
+test('errorHandler returns text Internal Server Error at 500 on a page path with no payload', async () => {
+  const res = await createApp({
+    error: createErrorWithCause(),
+    logger: createLogger(),
+  }).request('/home');
+
+  expect(res.status).toEqual(500);
+  expect(await res.text()).toEqual('Internal Server Error');
+});
+
+test('errorHandler awaits context.handleError before serializing the response', async () => {
+  const context = {
+    handleError: jest.fn(async (error) => {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+      error.handled = true;
+    }),
+  };
+  const error = createErrorWithCause();
+  const res = await createApp({ context, error, logger: createLogger() }).request(
+    '/api/request/getUsers'
+  );
+
+  expect(context.handleError).toHaveBeenCalledTimes(1);
+  expect(context.handleError).toHaveBeenCalledWith(error);
+  const body = await res.json();
+  expect(body['~e'].handled).toBe(true);
+});
+
+// createHandleError sets error.handled once it has logged. The client reads it
+// to decide whether to POST the error back for logging, so it has to survive
+// serialization or the error is logged a second time.
+test('errorHandler returns handled true on the 500 envelope after handleError sets it', async () => {
+  const context = {
+    handleError: jest.fn(async (error) => {
+      error.handled = true;
+    }),
+  };
+  const res = await createApp({
+    context,
+    error: createErrorWithCause(),
+    logger: createLogger(),
+  }).request('/api/request/getUsers');
+
+  const body = await res.json();
+  expect(body['~e'].handled).toBe(true);
+});
+
+test('errorHandler logs with logger.error when the request has no lowdefyContext', async () => {
+  const logger = createLogger();
+  const error = createErrorWithCause();
+  const res = await createApp({ error, logger }).request('/api/request/getUsers');
+
+  expect(res.status).toEqual(500);
+  expect(logger.error).toHaveBeenCalledTimes(1);
+  expect(logger.error).toHaveBeenCalledWith(error);
+});
+
+test('errorHandler treats a basePath prefixed api path as an api path', async () => {
+  const res = await createApp({
+    basePath: '/base',
+    error: createErrorWithCause(),
+    logger: createLogger(),
+  }).request('/base/api/request/getUsers');
+
+  expect(res.status).toEqual(500);
+  const body = await res.json();
+  expect(body['~e'].message).toEqual('Something went wrong.');
+});
+
+test('errorHandler treats a basePath prefixed page path as a page path', async () => {
+  const res = await createApp({
+    basePath: '/base',
+    error: createErrorWithCause(),
+    logger: createLogger(),
+  }).request('/base/home');
+
+  expect(res.status).toEqual(500);
+  expect(await res.text()).toEqual('Internal Server Error');
+});
+
+// context.handleError captures to Sentry itself (createHandleError ->
+// captureSentryError), so the handler must not capture the same fault again.
+test('errorHandler does not capture to Sentry when a lowdefyContext handled the error', async () => {
+  sentrySdk.current = { captureException };
+  const context = { handleError: jest.fn() };
+  await createApp({
+    context,
+    error: createErrorWithCause(),
+    logger: createLogger(),
+  }).request('/api/request/getUsers');
+
+  expect(context.handleError).toHaveBeenCalledTimes(1);
+  expect(captureException).not.toHaveBeenCalled();
+  sentrySdk.current = null;
+});
+
+test('errorHandler captures to Sentry when there is no lowdefyContext to handle the error', async () => {
+  sentrySdk.current = { captureException };
+  const error = createErrorWithCause();
+  await createApp({ error, logger: createLogger() }).request('/api/request/getUsers');
+
+  expect(captureException).toHaveBeenCalledTimes(1);
+  expect(captureException).toHaveBeenCalledWith(error);
+  sentrySdk.current = null;
+});
+
+test('errorHandler does not capture to Sentry when Sentry was not started', async () => {
+  sentrySdk.current = null;
+  await createApp({ error: createErrorWithCause(), logger: createLogger() }).request(
+    '/api/request/getUsers'
+  );
+
+  expect(captureException).not.toHaveBeenCalled();
+});

package/{lib/server/auth/session.js → src/middleware/noStore.js}

@@ -14,18 +14,14 @@
   limitations under the License.
 */
 
-import { getAuthUser } from '@hono/auth-js';
-
-import authJson from '../../build/auth.js';
-
-// Replaces getServerSession.js — reads the session from the Hono context
-// populated by the initAuthConfig middleware.
-async function getSession(c) {
-  if (authJson.configured !== true) {
-    return undefined;
-  }
-  const authUser = await getAuthUser(c);
-  return authUser?.session ?? undefined;
+// Pages and API responses carry the caller's data, so neither the browser nor a
+// shared proxy may store them. Set after next() so redirects and error responses
+// carry it too.
+function noStore() {
+  return async function noStoreMiddleware(c, next) {
+    await next();
+    c.header('Cache-Control', 'private, no-store');
+  };
 }
 
-export default getSession;
+export default noStore;

package/src/middleware/refuseOtherBuild.js

@@ -0,0 +1,49 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+// Refuses a request or endpoint call from a tab running another build, before
+// anything runs. The old page's payload may be the wrong shape for the new
+// build's request and still be written, so a call that cannot be trusted is
+// stopped here rather than detected on its response. The client reloads once
+// onto the current build (@lowdefy/client request.js); a call that names no
+// build (a third-party webhook, a page from before this check) runs as before.
+// UserError is an expected outcome: if the reload guard has already fired the
+// client shows the message without reporting it as a fault.
+function refuseOtherBuild({ buildId }) {
+  return async function refuseOtherBuildMiddleware(c, next) {
+    const callerBuildId = c.req.header('x-lowdefy-build');
+    if (type.isNone(callerBuildId) || callerBuildId === buildId) {
+      return next();
+    }
+    c.get('lowdefyContext').logger.info({
+      event: 'refused_other_build',
+      path: c.req.path,
+      callerBuildId,
+    });
+    return c.json(
+      {
+        name: 'UserError',
+        message: 'This page is from an earlier version of the app. Reload the page to continue.',
+        buildId,
+      },
+      409
+    );
+  };
+}
+
+export default refuseOtherBuild;

package/src/middleware/refuseOtherBuild.test.mjs

@@ -0,0 +1,63 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+import refuseOtherBuild from './refuseOtherBuild.js';
+
+function createApp() {
+  const handler = jest.fn((c) => c.json({ ran: true }));
+  const app = new Hono();
+  app.use('*', async (c, next) => {
+    c.set('lowdefyContext', { logger: { info: jest.fn() } });
+    await next();
+  });
+  app.post('/api/request/home/save', refuseOtherBuild({ buildId: 'build-2' }), handler);
+  return { app, handler };
+}
+
+test('refuseOtherBuild refuses a call from another build with 409 before the handler runs', async () => {
+  const { app, handler } = createApp();
+  const res = await app.request('/api/request/home/save', {
+    method: 'POST',
+    headers: { 'x-lowdefy-build': 'build-1' },
+  });
+  expect(res.status).toBe(409);
+  expect(await res.json()).toEqual({
+    name: 'UserError',
+    message: 'This page is from an earlier version of the app. Reload the page to continue.',
+    buildId: 'build-2',
+  });
+  expect(handler).not.toHaveBeenCalled();
+});
+
+test('refuseOtherBuild runs a call from the same build', async () => {
+  const { app, handler } = createApp();
+  const res = await app.request('/api/request/home/save', {
+    method: 'POST',
+    headers: { 'x-lowdefy-build': 'build-2' },
+  });
+  expect(res.status).toBe(200);
+  expect(handler).toHaveBeenCalledTimes(1);
+});
+
+test('refuseOtherBuild runs a call that names no build', async () => {
+  const { app, handler } = createApp();
+  const res = await app.request('/api/request/home/save', { method: 'POST' });
+  expect(res.status).toBe(200);
+  expect(handler).toHaveBeenCalledTimes(1);
+});

package/src/middleware/requestTimeout.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { HTTPException } from 'hono/http-exception';
+import { timeout } from 'hono/timeout';
+
+// Caps how long a request may run, and cancels the work it leaves behind. The 504 is
+// answered while the handler is still running; the TimeoutError on the request's
+// timeout signal (which apiContext folds into context.signal) cancels the upstream
+// calls the handler is waiting on, such as an AI provider call, instead of letting
+// them run, and bill, after the response has gone.
+function requestTimeout({ timeoutMs }) {
+  return function requestTimeoutMiddleware(c, next) {
+    const controller = new AbortController();
+    c.set('requestTimeoutSignal', controller.signal);
+    return timeout(timeoutMs, () => {
+      controller.abort(
+        new DOMException(`The request timeout of ${timeoutMs}ms was exceeded.`, 'TimeoutError')
+      );
+      return new HTTPException(504, { message: 'Gateway Timeout' });
+    })(c, next);
+  };
+}
+
+export default requestTimeout;

package/src/middleware/sentry.js

@@ -14,16 +14,24 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/node';
+import { bindCredentialScrub } from '@lowdefy/node-utils';
 
-// Replaces @sentry/nextjs route auto-instrumentation: every request becomes
-// an http.server transaction. Handler errors never propagate through
-// middleware in Hono — captureException happens in the app error handler.
+import sentrySdk from '../../lib/server/sentry/sentrySdk.js';
+
+// Every request becomes an http.server transaction when the server traces requests. Handler
+// errors never propagate through middleware in Hono — captureException happens in the app error
+// handler.
 function sentryMiddleware() {
   return async function sentry(c, next) {
-    if (!process.env.SENTRY_DSN) {
+    const Sentry = sentrySdk.current;
+    if (!Sentry) {
       return next();
     }
+    // The request's transaction is sent once the response is written, after its credential scope
+    // has ended, so the scope's scrub rides on the request's isolation scope to scrubEvent.
+    Sentry.getIsolationScope().setSDKProcessingMetadata({
+      scrubRequestCredentials: bindCredentialScrub(),
+    });
     return Sentry.startSpan({ name: `${c.req.method} ${c.req.path}`, op: 'http.server' }, () =>
       next()
     );

package/src/middleware/stampBuildId.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Stamps the server's build on auth responses. Auth calls are not refused on a
+// mismatch (they are Lowdefy's routes, not app config, and a session refetch on
+// window focus would reload away unsaved input); instead the client reloads
+// when an auth call fails and this header shows a newer build answered
+// (lib/client/auth/createFetchCheckingBuild.js). Set after next() so error responses
+// and the raw responses BetterAuth returns carry it too.
+function stampBuildId({ buildId }) {
+  return async function stampBuildIdMiddleware(c, next) {
+    await next();
+    c.header('x-lowdefy-build', buildId);
+  };
+}
+
+export default stampBuildId;