@lowdefy/api 5.6.0 → 6.0.0

package/dist/routes/mcp/createMcpServer.js

@@ -0,0 +1,160 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { AuthenticationError } from '@lowdefy/errors';
+import { serializer, type } from '@lowdefy/helpers';
+import callEndpoint from '../endpoints/callEndpoint.js';
+import isUnauthenticatedHuman from '../endpoints/isUnauthenticatedHuman.js';
+// LLM-safe tool names use the same rule as buildAgents tool naming.
+function toToolName(id) {
+    return id.replaceAll('/', '__');
+}
+// Twin of cleanBuildArtifact in packages/utils/ai-utils/src/buildAgentTools.js -
+// duplicated here rather than shared, since pulling in @lowdefy/ai-utils would
+// add the ai SDK and MCP client deps to api just for this. Strips build-artifact
+// serializer markers (~k, ~r, ~l) and unwraps { '~arr': [...] } back to a plain
+// array, so payloadSchema reaches MCP clients as plain JSON Schema.
+function cleanBuildArtifact(obj) {
+    return JSON.parse(JSON.stringify(serializer.deserialize(obj)));
+}
+// A stateless per-request MCP server exposing the configured api endpoints
+// as tools. Built with the SDK's low-level Server: tool input schemas are
+// config-provided JSON Schema (payloadSchema), which the low-level handlers
+// accept directly - no zod conversion. The server is constructed with the
+// request's context, so the caller is known at construction time: tools/list
+// filters by context.authorize, and tools/call re-authorizes inside
+// callEndpoint (defense in depth). Returns null when no mcp block is
+// configured.
+async function createMcpServer({ context }) {
+    const mcpConfig = await context.readConfigFile('mcp.json');
+    if (type.isNone(mcpConfig) || mcpConfig.configured !== true) {
+        return null;
+    }
+    // serverInfo doubles as the connector card in clients such as claude.ai:
+    // title, websiteUrl and icons are optional branding the app may configure,
+    // and are omitted (not sent as undefined) when it does not. icons is config
+    // structure, so like payloadSchema it carries build-artifact markers that
+    // must not reach the client.
+    const serverInfo = {
+        name: mcpConfig.name,
+        version: mcpConfig.version
+    };
+    for (const key of [
+        'title',
+        'websiteUrl'
+    ]){
+        if (!type.isNone(mcpConfig[key])) {
+            serverInfo[key] = mcpConfig[key];
+        }
+    }
+    if (!type.isNone(mcpConfig.icons)) {
+        serverInfo.icons = cleanBuildArtifact(mcpConfig.icons);
+    }
+    const server = new Server(serverInfo, {
+        capabilities: {
+            tools: {}
+        }
+    });
+    server.setRequestHandler(ListToolsRequestSchema, async ()=>{
+        const tools = [];
+        for (const endpointId of mcpConfig.endpoints){
+            const endpointConfig = await context.readConfigFile(`api/${endpointId}.json`);
+            if (type.isNone(endpointConfig) || !context.authorize(endpointConfig)) {
+                continue;
+            }
+            tools.push({
+                name: toToolName(endpointId),
+                description: endpointConfig.description,
+                inputSchema: cleanBuildArtifact(endpointConfig.payloadSchema)
+            });
+        }
+        return {
+            tools
+        };
+    });
+    server.setRequestHandler(CallToolRequestSchema, async (request)=>{
+        const { name, arguments: args } = request.params;
+        context.logger.info({
+            event: 'mcp_tool_call',
+            tool: name
+        });
+        const endpointId = mcpConfig.endpoints.find((id)=>toToolName(id) === name);
+        try {
+            if (!type.isNone(endpointId)) {
+                const { error, response, success } = await callEndpoint(context, {
+                    blockId: '_mcp',
+                    endpointId,
+                    pageId: '_mcp',
+                    payload: args ?? {}
+                });
+                if (!success) {
+                    const deserialized = serializer.deserialize(error);
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: deserialized?.message ?? 'Endpoint failed.'
+                            }
+                        ],
+                        isError: true
+                    };
+                }
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify(serializer.deserialize(response))
+                        }
+                    ]
+                };
+            }
+            // An unknown tool answers like a gated one for an anonymous caller on an
+            // auth'd app, so tools/call cannot be used to enumerate tool names that
+            // tools/list already hides from that caller.
+            if (await isUnauthenticatedHuman(context)) {
+                throw new AuthenticationError(`Authentication required for API endpoint "${name}".`);
+            }
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Unknown tool "${name}".`
+                    }
+                ],
+                isError: true
+            };
+        } catch (error) {
+            // Unauthenticated calls to gated tools are expected probing traffic -
+            // a warn line and the 401-shaped message, not a structured error log.
+            if (error.name === 'AuthenticationError') {
+                context.logger.warn(`Unauthenticated MCP tool call: ${name}`);
+            } else {
+                context.logger.error(error);
+            }
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: error.message
+                    }
+                ],
+                isError: true
+            };
+        }
+    });
+    return server;
+}
+export default createMcpServer;

package/dist/routes/notifications/derivePreview.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+// Rough inversion of the interpolation pipeline for the preview text: strip
+// author markdown syntax and unescape the backslash-escaped interpolated values.
+function stripMarkdown(text) {
+    return text.replace(/```[\s\S]*?```/g, ' ').replace(/`([^`]*)`/g, '$1').replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1').replace(/\[([^\]]*)\]\([^)]*\)/g, '$1').replace(/^#{1,6}\s+/gm, '').replace(/^\s*>\s?/gm, '').replace(/^\s*[-*+]\s+/gm, '').replace(/(\*\*|__|\*|_|~~)/g, '').replace(/\\([!-/:-@[-`{-~])/g, '$1').replace(/\s+/g, ' ').trim();
+}
+function derivePreview({ properties }) {
+    if (type.isString(properties.preview) && properties.preview !== '') {
+        return properties.preview;
+    }
+    if (type.isString(properties.message) && properties.message !== '') {
+        return stripMarkdown(properties.message).slice(0, 140);
+    }
+    return null;
+}
+export default derivePreview;

package/dist/routes/notifications/getNotificationConfig.js

@@ -0,0 +1,32 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ConfigError } from '@lowdefy/errors';
+async function getNotificationConfig({ logger, readConfigFile }, { notificationId, configKey }) {
+    const notification = await readConfigFile(`notifications/${notificationId}.json`);
+    if (!notification) {
+        const err = new ConfigError(`Notification "${notificationId}" does not exist.`, {
+            configKey
+        });
+        logger.debug({
+            params: {
+                notificationId
+            },
+            err
+        }, err.message);
+        throw err;
+    }
+    return notification;
+}
+export default getNotificationConfig;

package/dist/routes/notifications/resolveNotificationLinks.js

@@ -0,0 +1,72 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { serializer, type, urlQuery } from '@lowdefy/helpers';
+function resolveLinkValue({ link, option, serverUrl, basePath, landingPage, recordId }) {
+    // Absolute URLs pass through — links into other apps or external destinations.
+    // They skip any landing page, so they carry no mark-as-read.
+    if (type.isString(link)) {
+        return link;
+    }
+    if (type.isObject(link) && !type.isNone(link.pageId)) {
+        if (type.isNone(landingPage)) {
+            // No landing page configured — link straight to the target page.
+            const query = urlQuery.stringify(link.urlQuery ?? {});
+            return `${serverUrl}${basePath}/${link.pageId}${query ? `?${query}` : ''}`;
+        }
+        // The option query param is the dot-path of the link inside the record's
+        // data — the landing page reads the original target back with
+        // get(record.data, option) after marking the record read.
+        const query = urlQuery.stringify({
+            _id: recordId,
+            option
+        });
+        return `${serverUrl}${basePath}${landingPage}?${query}`;
+    }
+    return link;
+}
+// Resolves link values in a copy of the data item to URLs; the stored record
+// keeps the original { pageId, urlQuery } objects for in-app navigation.
+// data.links is the framework convention; link fields inside arrays are
+// resolved for the data keys the template declares (Template.dataKeys), so
+// custom templates get the same treatment as the built-in ones.
+function resolveNotificationLinks({ item, dataKeys, serverUrl, basePath, landingPage, recordId }) {
+    const resolved = serializer.copy(item);
+    Object.keys(resolved.links ?? {}).forEach((key)=>{
+        resolved.links[key] = resolveLinkValue({
+            link: resolved.links[key],
+            option: `links.${key}`,
+            serverUrl,
+            basePath,
+            landingPage,
+            recordId
+        });
+    });
+    (dataKeys ?? []).forEach((arrayKey)=>{
+        if (!type.isArray(resolved[arrayKey])) return;
+        resolved[arrayKey].forEach((entry, index)=>{
+            if (!type.isObject(entry) || type.isNone(entry.link)) return;
+            entry.link = resolveLinkValue({
+                link: entry.link,
+                option: `${arrayKey}.${index}.link`,
+                serverUrl,
+                basePath,
+                landingPage,
+                recordId
+            });
+        });
+    });
+    return resolved;
+}
+export default resolveNotificationLinks;

package/dist/routes/notifications/resolveThemeLogo.js

@@ -0,0 +1,35 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+// A theme logo written as an app-relative path ("/logo.png", a public/ asset)
+// resolves against the deployment's serverUrl + basePath, so one config works
+// across environments. Absolute ("https://...") and protocol-relative ("//...")
+// URLs pass through. Without a serverUrl an email client can never fetch a
+// relative path, so the logo is dropped — EmailLayout falls back to the
+// companyName text header, which beats a broken image.
+function resolveThemeLogo({ theme, serverUrl, basePath }) {
+    const { logo, ...rest } = theme;
+    if (!type.isString(logo) || !logo.startsWith('/') || logo.startsWith('//')) {
+        return theme;
+    }
+    if (type.isNone(serverUrl)) {
+        return rest;
+    }
+    return {
+        ...rest,
+        logo: `${serverUrl}${basePath}${logo}`
+    };
+}
+export default resolveThemeLogo;

package/dist/routes/page/dynamic/resolveDynamicContent.js

@@ -0,0 +1,172 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+import createEvaluateOperators from '../../../context/createEvaluateOperators.js';
+import invokeEndpoint from '../../endpoints/invokeEndpoint.js';
+import unescapeOperators from './unescapeOperators.js';
+import validateFragment from './validateFragment.js';
+const MAX_DYNAMIC_DEPTH = 5;
+function collectDynamicBlocks(block, found) {
+    if (block.type === 'Dynamic') {
+        // A Dynamic block's content comes from resolution; its fallback slot is
+        // resolved separately when a failure activates it.
+        found.push(block);
+        return;
+    }
+    Object.values(block.slots ?? {}).forEach((slot)=>{
+        (slot.blocks ?? []).forEach((child)=>collectDynamicBlocks(child, found));
+    });
+}
+function setResolvedContent(block, blocks) {
+    if (!block.slots) {
+        block.slots = {};
+    }
+    block.slots.content = {
+        ...block.slots.content ?? {},
+        blocks
+    };
+    delete block.slots.fallback;
+    delete block.properties.endpointId;
+    delete block.properties.params;
+    delete block.properties.required;
+    delete block.properties.types;
+}
+async function resolveBlocks(context, { blocks, depth, shared }) {
+    const found = [];
+    blocks.forEach((block)=>collectDynamicBlocks(block, found));
+    await Promise.all(found.map((block)=>resolveDynamicBlock(context, {
+            block,
+            depth,
+            shared
+        })));
+}
+async function resolveDynamicBlock(context, { block, depth, shared }) {
+    const { logger } = context;
+    const { endpointId, params, required } = block.properties;
+    try {
+        if (depth >= MAX_DYNAMIC_DEPTH) {
+            throw new ConfigError(`Dynamic block "${block.blockId}" on page "${shared.pageId}" exceeded the maximum dynamic nesting depth of ${MAX_DYNAMIC_DEPTH}.`, {
+                configKey: block['~k']
+            });
+        }
+        const { error, response, status } = await invokeEndpoint(context, {
+            endpointId,
+            payload: {
+                blockId: block.blockId,
+                pageId: shared.pageId,
+                params: params ?? {},
+                urlQuery: shared.urlQuery ?? {}
+            },
+            endpointDepth: 0
+        });
+        if ([
+            'error',
+            'reject'
+        ].includes(status)) {
+            throw error ?? new ConfigError(`Dynamic block "${block.blockId}" on page "${shared.pageId}" endpoint "${endpointId}" failed with status "${status}".`, {
+                configKey: block['~k']
+            });
+        }
+        if (!type.isObject(response) || !type.isArray(response.blocks)) {
+            throw new ConfigError(`Dynamic block "${block.blockId}" on page "${shared.pageId}" endpoint "${endpointId}" must return an object with a "blocks" array.`, {
+                received: response,
+                configKey: block['~k']
+            });
+        }
+        // Unescape before building so operator counting validates the real
+        // (client-evaluated) operators against the bundle.
+        const { blocks, callApiActionRefs, requestActionRefs, warnings } = shared.buildDynamicBlocks({
+            blocks: unescapeOperators(response.blocks),
+            pageId: shared.pageId,
+            dynamicBlockId: block.blockId,
+            idPrefix: block.id,
+            types: shared.types,
+            blockMetas: shared.blockMetas
+        });
+        warnings.forEach((warning)=>{
+            logger.warn({
+                event: 'dynamic_block_warning',
+                blockId: block.blockId,
+                pageId: shared.pageId
+            }, warning.message);
+        });
+        await validateFragment(context, {
+            blocks,
+            blockSchemas: shared.blockSchemas,
+            callApiActionRefs,
+            dynamicBlockId: block.blockId,
+            pageId: shared.pageId,
+            pageRequests: shared.pageRequests,
+            requestActionRefs
+        });
+        await resolveBlocks(context, {
+            blocks,
+            depth: depth + 1,
+            shared
+        });
+        setResolvedContent(block, blocks);
+    } catch (error) {
+        if (required === true) {
+            throw new ConfigError(`Dynamic block "${block.blockId}" on page "${shared.pageId}" failed to resolve: ${error.message}`, {
+                configKey: block['~k'],
+                cause: error
+            });
+        }
+        logger.error({
+            event: 'dynamic_block_error',
+            blockId: block.blockId,
+            endpointId,
+            pageId: shared.pageId,
+            err: error
+        }, `Dynamic block "${block.blockId}" on page "${shared.pageId}" failed to resolve: ${error.message}`);
+        const fallbackBlocks = block.slots?.fallback?.blocks ?? [];
+        setResolvedContent(block, fallbackBlocks);
+        await resolveBlocks(context, {
+            blocks: fallbackBlocks,
+            depth: depth + 1,
+            shared
+        });
+    }
+}
+async function resolveDynamicContent(context, { pageConfig, urlQuery }) {
+    // Loaded lazily so apps without dynamic pages never load the build package.
+    const { default: buildDynamicBlocks } = await import('@lowdefy/build/dynamic');
+    const [types, blockMetas, blockSchemas] = await Promise.all([
+        context.readConfigFile('types.json'),
+        context.readConfigFile('plugins/blockMetas.json'),
+        context.readConfigFile('plugins/blockSchemas.json')
+    ]);
+    context.evaluateOperators = createEvaluateOperators(context);
+    const shared = {
+        blockMetas: blockMetas ?? {},
+        blockSchemas: blockSchemas ?? {},
+        buildDynamicBlocks,
+        pageId: pageConfig.pageId,
+        pageRequests: pageConfig.requests ?? [],
+        types: types ?? {},
+        urlQuery
+    };
+    // The page root block itself can be a Dynamic block.
+    await resolveBlocks(context, {
+        blocks: [
+            pageConfig
+        ],
+        depth: 0,
+        shared
+    });
+    return pageConfig;
+}
+export default resolveDynamicContent;

package/dist/routes/page/dynamic/unescapeOperators.js

@@ -0,0 +1,36 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+// One extra leading underscore defers operator evaluation by one level — the
+// same convention _function bodies use for __args. Shared operators like
+// _state are registered on the server, so a plain `_state` in a routine's
+// :return evaluates there (against empty routine state). Authors write
+// `__state` instead: it survives the server evaluation untouched, and this
+// unescape strips one underscore so the client evaluates the real operator.
+function unescapeOperators(value) {
+    if (type.isArray(value)) {
+        return value.map(unescapeOperators);
+    }
+    if (!type.isObject(value)) {
+        return value;
+    }
+    const result = {};
+    Object.keys(value).forEach((key)=>{
+        const unescapedKey = key.startsWith('__') ? key.slice(1) : key;
+        result[unescapedKey] = unescapeOperators(value[key]);
+    });
+    return result;
+}
+export default unescapeOperators;

package/dist/routes/page/dynamic/validateFragment.js

@@ -0,0 +1,104 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { validate } from '@lowdefy/ajv';
+import { getOperatorType, type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+function isOperatorObject(value) {
+    return getOperatorType(value) !== null;
+}
+function escapePointerSegment(segment) {
+    return segment.replace(/~/g, '~0').replace(/\//g, '~1');
+}
+function collectOperatorPaths(value, path, paths) {
+    if (type.isArray(value)) {
+        value.forEach((item, index)=>collectOperatorPaths(item, `${path}/${index}`, paths));
+        return;
+    }
+    if (!type.isObject(value)) {
+        return;
+    }
+    if (isOperatorObject(value)) {
+        paths.push(path);
+        return;
+    }
+    Object.keys(value).forEach((key)=>{
+        if (key.startsWith('~')) return;
+        collectOperatorPaths(value[key], `${path}/${escapePointerSegment(key)}`, paths);
+    });
+}
+// A schema violation at or under an operator node cannot be judged before the
+// operator evaluates on the client — { _state: columns } may legitimately sit
+// where the schema wants an array. Violations on operator-free paths stand.
+function validateBlockProperties(block, { blockSchemas, dynamicBlockId, pageId }) {
+    const properties = block.properties;
+    if (!type.isObject(properties) || isOperatorObject(properties)) {
+        return;
+    }
+    // Block schemas validate the whole pre-build block shape; the plugin's
+    // properties schema sits at schema.properties.properties.
+    const propertiesSchema = blockSchemas[block.type]?.properties?.properties;
+    if (type.isNone(propertiesSchema)) {
+        return;
+    }
+    const result = validate({
+        schema: propertiesSchema,
+        data: properties,
+        returnErrors: true
+    });
+    if (result.valid) {
+        return;
+    }
+    const operatorPaths = [];
+    collectOperatorPaths(properties, '', operatorPaths);
+    const errors = result.errors.filter((error)=>!operatorPaths.some((path)=>error.instancePath === path || error.instancePath.startsWith(`${path}/`)));
+    if (errors.length > 0) {
+        const messages = errors.map((error)=>`properties${error.instancePath || ''} ${error.message}`);
+        throw new ConfigError(`Dynamic block "${dynamicBlockId}" on page "${pageId}" resolved block "${block.blockId}" (${block.type}) has invalid properties:\n${messages.map((message)=>`  - ${message}`).join('\n')}`);
+    }
+}
+function walkBlocks(blocks, callback) {
+    blocks.forEach((block)=>{
+        callback(block);
+        Object.values(block.slots ?? {}).forEach((slot)=>{
+            walkBlocks(slot.blocks ?? [], callback);
+        });
+    });
+}
+async function validateFragment(context, { blocks, blockSchemas, callApiActionRefs, dynamicBlockId, pageId, pageRequests, requestActionRefs }) {
+    walkBlocks(blocks, (block)=>{
+        validateBlockProperties(block, {
+            blockSchemas,
+            dynamicBlockId,
+            pageId
+        });
+    });
+    // Request actions can only reference requests defined statically on the page —
+    // request artifacts are written at build time.
+    const pageRequestIds = new Set(pageRequests.map((request)=>request.requestId));
+    requestActionRefs.forEach(({ requestId, blockId, eventId })=>{
+        if (!pageRequestIds.has(requestId)) {
+            throw new ConfigError(`Dynamic block "${dynamicBlockId}" on page "${pageId}" resolved content references request "${requestId}" on event "${eventId}" on block "${blockId}" which is not defined on the page.`);
+        }
+    });
+    // CallAPI refs fail resolution instead of the user's click — same checks the
+    // HTTP endpoint route applies.
+    await Promise.all(callApiActionRefs.map(async ({ endpointId, blockId, eventId })=>{
+        const endpointConfig = await context.readConfigFile(`api/${endpointId}.json`);
+        if (!endpointConfig || endpointConfig.type === 'InternalApi') {
+            throw new ConfigError(`Dynamic block "${dynamicBlockId}" on page "${pageId}" resolved content has a CallAPI action on event "${eventId}" on block "${blockId}" targeting endpoint "${endpointId}" which does not exist or is not accessible from client pages.`);
+        }
+    }));
+}
+export default validateFragment;

package/dist/routes/page/getPageConfig.js

@@ -13,14 +13,24 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { serializer } from '@lowdefy/helpers';
-async function getPageConfig({ authorize, readConfigFile }, { pageId }) {
-    const pageConfig = await readConfigFile(`pages/${pageId}.json`);
-    if (pageConfig && authorize(pageConfig)) {
+import resolveDynamicContent from './dynamic/resolveDynamicContent.js';
+async function getPageConfig(context, { pageId, urlQuery }) {
+    const pageConfig = await context.readConfigFile(`pages/${pageId}.json`);
+    if (pageConfig && context.authorize(pageConfig)) {
         // eslint-disable-next-line no-unused-vars
         const { auth, ...rest } = pageConfig;
-        // Use serializer.serialize to ensure ~k keys (non-enumerable after deserialize)
-        // are made enumerable again for JSON transfer to client
-        return serializer.serialize(rest);
+        if (rest.dynamic !== true) {
+            // Use serializer.serialize to ensure ~k keys (non-enumerable after deserialize)
+            // are made enumerable again for JSON transfer to client
+            return serializer.serialize(rest);
+        }
+        // readConfigFile caches parsed artifacts — deep copy before resolution so
+        // one request's resolved content never reaches another via the cache.
+        const resolved = await resolveDynamicContent(context, {
+            pageConfig: serializer.copy(rest),
+            urlQuery
+        });
+        return serializer.serialize(resolved);
     }
     return null;
 }