@lowdefy/api 5.6.0 → 6.1.0

package/dist/routes/agent/prepareAgent.js

@@ -0,0 +1,179 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import buildEndpointResult from '../../response/buildEndpointResult.js';
+import createWireProjection from '../../response/createWireProjection.js';
+import getEndpointConfig from '../endpoints/getEndpointConfig.js';
+import invokeEndpoint from '../endpoints/invokeEndpoint.js';
+import authorizeAgent from './authorizeAgent.js';
+import getAgentConfig from './getAgentConfig.js';
+import getAgentResolver from './getAgentResolver.js';
+import getConnectionConfig from '../connections/getConnectionConfig.js';
+import getConnection from '../connections/getConnection.js';
+// Shared agent invocation construction for the streaming chat route (callAgent)
+// and the headless CallAgent routine step (handleAgentCall): loads the agent
+// config, evaluates operators, creates the provider connection, and builds the
+// resolver context. mode ('chat' | 'generate') selects the resolver's execution
+// path; endpointDepth threads the endpoint call depth cap through agent tool
+// and hook endpoint calls.
+async function prepareAgent(context, { agentId, agentContext, endpointDepth = 0, mode = 'chat' }) {
+    const agentConfig = await getAgentConfig(context, {
+        agentId
+    });
+    authorizeAgent(context, {
+        agentConfig
+    });
+    // Evaluate operators in agent properties (e.g. _user, _secret, _payload)
+    agentConfig.properties = context.evaluateOperators({
+        input: agentConfig.properties ?? {},
+        location: agentConfig.agentId,
+        payload: agentContext,
+        state: {},
+        steps: {}
+    });
+    // Load connection config from build artifacts using agent's connectionId
+    const connectionConfig = await getConnectionConfig(context, {
+        connectionId: agentConfig.connectionId,
+        configKey: agentConfig['~k']
+    });
+    // Get connection plugin from registry
+    const connection = getConnection(context, {
+        connectionConfig
+    });
+    // Evaluate operators in connection properties
+    const connectionProperties = context.evaluateOperators({
+        input: connectionConfig.properties || {},
+        location: connectionConfig.connectionId,
+        payload: {},
+        state: {},
+        steps: {}
+    });
+    // Create connection instance (e.g., Anthropic provider)
+    const connectionInstance = connection.create({
+        connection: connectionProperties
+    });
+    // Get agent type from plugin registry
+    const agentType = getAgentResolver(context, {
+        agentConfig
+    });
+    // Build resolver context with callEndpoint that allows InternalApi endpoints
+    const resolverContext = {
+        agentContext,
+        i18n: context.i18n,
+        mode,
+        // The agent stream's error text reaches the end user and AgentChat config, so it takes
+        // the wire policy. Built here because the agent plugins cannot import @lowdefy/api.
+        // The AI SDK types onError's argument as unknown: a tool can reject with null or a
+        // string, which takes the generic message like any other non-author error.
+        wireErrorMessage: (error)=>createWireProjection(context)(type.isError(error) ? error : new Error(String(error))).message,
+        evaluateOperators: (input)=>context.evaluateOperators({
+                input,
+                location: agentConfig.agentId,
+                payload: agentContext,
+                state: {},
+                steps: {}
+            }),
+        callEndpoint: async (endpointId, { payload })=>{
+            const { error, response, status } = await invokeEndpoint(context, {
+                endpointId,
+                payload,
+                endpointDepth
+            });
+            return buildEndpointResult(context, {
+                error,
+                response,
+                status
+            });
+        },
+        getEndpointConfig: async ({ endpointId })=>{
+            return getEndpointConfig(context, {
+                endpointId
+            });
+        },
+        getAgentConfig: async ({ agentId: subAgentId })=>{
+            const subAgentConfig = await getAgentConfig(context, {
+                agentId: subAgentId
+            });
+            authorizeAgent(context, {
+                agentConfig: subAgentConfig
+            });
+            return subAgentConfig;
+        },
+        getConnectionForAgent: async ({ agentConfig: subAgentConfig })=>{
+            const subConnectionConfig = await getConnectionConfig(context, {
+                connectionId: subAgentConfig.connectionId,
+                configKey: subAgentConfig['~k']
+            });
+            const subConnection = getConnection(context, {
+                connectionConfig: subConnectionConfig
+            });
+            const subConnectionProperties = context.evaluateOperators({
+                input: subConnectionConfig.properties || {},
+                location: subConnectionConfig.connectionId,
+                payload: {},
+                state: {},
+                steps: {}
+            });
+            return subConnection.create({
+                connection: subConnectionProperties
+            });
+        },
+        resolveMcpSources: async ({ agentConfig: subAgentConfig })=>{
+            const resolvedMcp = [];
+            for (const mcpSource of subAgentConfig.mcp ?? []){
+                if (!type.isNone(mcpSource.connectionId)) {
+                    const mcpConnConfig = await getConnectionConfig(context, {
+                        connectionId: mcpSource.connectionId,
+                        configKey: subAgentConfig['~k']
+                    });
+                    const mcpConnection = getConnection(context, {
+                        connectionConfig: mcpConnConfig
+                    });
+                    const mcpConnProps = context.evaluateOperators({
+                        input: mcpConnConfig.properties || {},
+                        location: mcpConnConfig.connectionId,
+                        payload: {},
+                        state: {},
+                        steps: {}
+                    });
+                    const mcpConfig = mcpConnection.create({
+                        connection: mcpConnProps
+                    });
+                    const { connectionId: _, ...overrides } = mcpSource;
+                    resolvedMcp.push({
+                        ...mcpConfig,
+                        ...overrides
+                    });
+                } else {
+                    resolvedMcp.push(mcpSource);
+                }
+            }
+            return resolvedMcp;
+        }
+    };
+    // Resolve MCP connection references to inline config.
+    // Agent-level overrides (like confirm) may still contain operators —
+    // handleAgentChat evaluates those via its existing evaluateOperators call.
+    agentConfig.mcp = await resolverContext.resolveMcpSources({
+        agentConfig
+    });
+    return {
+        agentConfig,
+        connectionInstance,
+        agentType,
+        resolverContext
+    };
+}
+export default prepareAgent;

package/dist/routes/auth/createLogger.js

@@ -20,11 +20,8 @@
 };
 function createLogger({ logger }) {
     return {
-        error: (code, metadata)=>{
-            const error = metadata instanceof Error ? metadata : metadata?.error;
-            if (error) {
-                error.code = code;
-            }
+        // Auth.js v5 logger contract: error(error), warn(code), debug(message, metadata).
+        error: (error)=>{
             logger.error(error);
         },
         warn: (code)=>{

package/dist/routes/auth/createPrefixedCookies.js

@@ -0,0 +1,52 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function slugifyPrefix(value) {
+    return String(value).trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+// Injects an app-specific prefix into each Auth.js cookie name so multiple apps
+// on the same host do not share a cookie jar (browsers do not scope cookies by
+// port). Only names are overridden — Auth.js v5 deep-merges `config.cookies`
+// into its defaults, so cookie options (httpOnly, secure, maxAge) stay in sync
+// with @auth/core's per-request defaults. Names mirror defaultCookies in
+// @auth/core/lib/utils/cookie.js.
+function createPrefixedCookies({ prefix, useSecureCookies }) {
+    const securePrefix = useSecureCookies ? '__Secure-' : '';
+    const hostPrefix = useSecureCookies ? '__Host-' : '';
+    return {
+        sessionToken: {
+            name: `${securePrefix}${prefix}.authjs.session-token`
+        },
+        callbackUrl: {
+            name: `${securePrefix}${prefix}.authjs.callback-url`
+        },
+        csrfToken: {
+            name: `${hostPrefix}${prefix}.authjs.csrf-token`
+        },
+        pkceCodeVerifier: {
+            name: `${securePrefix}${prefix}.authjs.pkce.code_verifier`
+        },
+        state: {
+            name: `${securePrefix}${prefix}.authjs.state`
+        },
+        nonce: {
+            name: `${securePrefix}${prefix}.authjs.nonce`
+        },
+        webauthnChallenge: {
+            name: `${securePrefix}${prefix}.authjs.challenge`
+        }
+    };
+}
+export { slugifyPrefix };
+export default createPrefixedCookies;

package/dist/routes/auth/defaultAuthUrl.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import getCurrentEnvironment from '../../context/getCurrentEnvironment.js';
+// Auth.js reads its base URL from AUTH_URL (NEXTAUTH_URL is aliased to it at startup). Default it to
+// the current environment's url so a deployment declared in config.environments needs no separate
+// AUTH_URL / NEXTAUTH_URL. The dev server build drops the current environment's url, so the dev
+// server keeps the request origin.
+function defaultAuthUrl({ config }) {
+    // Same "is it set" test as resolveCookies, so both agree on whether an auth URL is configured.
+    if (!type.isNone(process.env.AUTH_URL ?? process.env.NEXTAUTH_URL)) return;
+    const url = getCurrentEnvironment({
+        config
+    })?.url;
+    if (!type.isNone(url)) {
+        process.env.AUTH_URL = url;
+    }
+}
+export default defaultAuthUrl;

package/dist/routes/auth/{getNextAuthConfig.js → getAuthConfig.js}

@@ -19,10 +19,15 @@ import createCallbacks from './callbacks/createCallbacks.js';
 import createEvents from './events/createEvents.js';
 import createLogger from './createLogger.js';
 import createProviders from './createProviders.js';
-const nextAuthConfig = {};
+import defaultAuthUrl from './defaultAuthUrl.js';
+import resolveCookies from './resolveCookies.js';
+const authConfigCache = {};
 let initialized = false;
-function getNextAuthConfig({ appMeta, authJson, logger, plugins, secrets }) {
-    if (initialized) return nextAuthConfig;
+function getAuthConfig({ appMeta, authJson, config, dev, logger, plugins, secrets }) {
+    if (initialized) return authConfigCache;
+    defaultAuthUrl({
+        config
+    });
     const operatorsParser = new ServerParser({
         lowdefyApp: appMeta,
         operators: {
@@ -40,36 +45,46 @@ function getNextAuthConfig({ appMeta, authJson, logger, plugins, secrets }) {
     if (operatorErrors.length > 0) {
         throw operatorErrors[0];
     }
-    nextAuthConfig.adapter = createAdapter({
+    authConfigCache.adapter = createAdapter({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.callbacks = createCallbacks({
+    authConfigCache.callbacks = createCallbacks({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.events = createEvents({
+    authConfigCache.events = createEvents({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.logger = createLogger({
+    authConfigCache.logger = createLogger({
         logger
     });
-    nextAuthConfig.providers = createProviders({
+    authConfigCache.providers = createProviders({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.debug = authConfig.debug ?? logger?.isLevelEnabled('debug') === true;
-    nextAuthConfig.pages = authConfig.authPages;
-    nextAuthConfig.session = authConfig.session;
-    nextAuthConfig.theme = authConfig.theme;
-    nextAuthConfig.cookies = authConfig?.advanced?.cookies;
-    nextAuthConfig.originalRedirectCallback = nextAuthConfig.callbacks.redirect;
+    authConfigCache.debug = authConfig.debug ?? logger?.isLevelEnabled('debug') === true;
+    authConfigCache.pages = authConfig.authPages;
+    authConfigCache.session = authConfig.session;
+    authConfigCache.theme = authConfig.theme;
+    authConfigCache.cookies = resolveCookies({
+        appMeta,
+        authConfig,
+        dev
+    });
+    // Auth.js v5 reads AUTH_SECRET; the v4 NEXTAUTH_SECRET variable is not
+    // supported — deployments must rename it (see the v5-to-v6 migration doc).
+    authConfigCache.secret = process.env.AUTH_SECRET;
+    // Self-hosted servers run behind arbitrary proxies; derive URLs from request
+    // headers (v4 derived them from NEXTAUTH_URL, aliased to AUTH_URL at startup).
+    authConfigCache.trustHost = true;
+    authConfigCache.basePath = '/api/auth';
     initialized = true;
-    return nextAuthConfig;
+    return authConfigCache;
 }
-export default getNextAuthConfig;
+export default getAuthConfig;

package/dist/routes/auth/resolveCookies.js

@@ -0,0 +1,37 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import createPrefixedCookies, { slugifyPrefix } from './createPrefixedCookies.js';
+// Cookie name resolution, in order of precedence:
+//   1. An explicit `auth.advanced.cookies` object is used verbatim.
+//   2. An explicit `auth.advanced.cookiePrefix` namespaces cookie names (dev and prod).
+//   3. When running the dev server, derive a prefix from the app slug/name so multiple
+//      apps on localhost do not share a cookie jar (browsers do not scope cookies by
+//      port). Production is left untouched, returning undefined for Auth.js defaults.
+function resolveCookies({ appMeta, authConfig, dev }) {
+    const explicitCookies = authConfig?.advanced?.cookies;
+    if (!type.isNone(explicitCookies)) return explicitCookies;
+    const devPrefix = dev ? slugifyPrefix(appMeta?.slug ?? appMeta?.name ?? '') : '';
+    const prefix = authConfig?.advanced?.cookiePrefix ?? (devPrefix === '' ? undefined : devPrefix);
+    if (type.isNone(prefix) || prefix === '') return undefined;
+    // Auth.js v5 reads AUTH_URL with NEXTAUTH_URL as a v4 fallback.
+    const authUrl = process.env.AUTH_URL ?? process.env.NEXTAUTH_URL;
+    const useSecureCookies = authUrl?.startsWith('https://') ?? false;
+    return createPrefixedCookies({
+        prefix,
+        useSecureCookies
+    });
+}
+export default resolveCookies;

package/dist/routes/auth/strategies/createAuthStrategies.js

@@ -0,0 +1,77 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ServerParser } from '@lowdefy/operators';
+import { _app, _secret } from '@lowdefy/operators-js/operators/server';
+import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+// Builds the API auth strategy verifiers from the auth.json build artifact.
+// Build has validated the config and written all defaults, so this resolves
+// the _secret operators and constructs each strategy type's verifier.
+// Verifier factories warn on short static keys at construction, so key
+// strength surfaces at startup, never as a build failure.
+function createAuthStrategies({ appMeta, authJson, logger, plugins, secrets }) {
+    if (!type.isArray(authJson.strategies) || authJson.strategies.length === 0) {
+        return [];
+    }
+    const operatorsParser = new ServerParser({
+        lowdefyApp: appMeta,
+        operators: {
+            _app,
+            _secret
+        },
+        secrets,
+        user: {}
+    });
+    const { output: strategiesConfig, errors: operatorErrors } = operatorsParser.parse({
+        input: authJson.strategies,
+        location: 'auth.strategies',
+        payload: {}
+    });
+    if (operatorErrors.length > 0) {
+        // Startup fails on the first error; log the rest so they can all be
+        // fixed in one pass instead of one boot per error.
+        operatorErrors.slice(1).forEach((error)=>logger.error(error));
+        throw operatorErrors[0];
+    }
+    return strategiesConfig.map((strategy)=>{
+        const strategyPlugin = plugins.strategies[strategy.type];
+        if (type.isNone(strategyPlugin)) {
+            throw new ConfigError(`Auth strategy type "${strategy.type}" not found at strategy "${strategy.id}".`, {
+                configKey: strategy['~k']
+            });
+        }
+        let verify;
+        try {
+            verify = strategyPlugin({
+                logger,
+                properties: strategy.properties,
+                strategyId: strategy.id
+            });
+        } catch (error) {
+            throw new ConfigError(error.message, {
+                cause: error,
+                configKey: strategy['~k']
+            });
+        }
+        return {
+            attributes: strategy.attributes,
+            id: strategy.id,
+            roles: strategy.roles,
+            type: strategy.type,
+            verify
+        };
+    });
+}
+export default createAuthStrategies;

package/dist/routes/auth/strategies/getAuthStrategies.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createAuthStrategies from './createAuthStrategies.js';
+let strategies;
+// The strategy verifiers are constructed once per process at first use -
+// the server middleware tries them in config order on every request that
+// resolves no session.
+function getAuthStrategies({ appMeta, authJson, logger, plugins, secrets }) {
+    if (strategies) return strategies;
+    strategies = createAuthStrategies({
+        appMeta,
+        authJson,
+        logger,
+        plugins,
+        secrets
+    });
+    return strategies;
+}
+export default getAuthStrategies;

package/dist/routes/endpoints/authorizeApiEndpoint.js

@@ -12,14 +12,20 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { ConfigError } from '@lowdefy/errors';
-function authorizeApiEndpoint({ authorize, logger }, { endpointConfig }) {
+*/ import { AuthenticationError, ConfigError } from '@lowdefy/errors';
+import { type } from '@lowdefy/helpers';
+function authorizeApiEndpoint({ authorize, logger, user }, { endpointConfig }) {
     if (!authorize(endpointConfig)) {
         logger.debug({
             event: 'debug_api_authorize',
             authorized: false,
             auth_config: endpointConfig.auth
         });
+        // Unauthenticated on a protected endpoint - 401 tells the caller to fix
+        // its credentials. Wrong roles stay opaque below.
+        if (type.isNone(user)) {
+            throw new AuthenticationError(`Authentication required for API endpoint "${endpointConfig.endpointId}".`);
+        }
         throw new ConfigError(`API Endpoint "${endpointConfig.endpointId}" does not exist.`);
     }
     logger.debug({

package/dist/routes/endpoints/callEndpoint.js

@@ -13,12 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { serializer } from '@lowdefy/helpers';
-import { ConfigError } from '@lowdefy/errors';
+import { AuthenticationError, ConfigError } from '@lowdefy/errors';
 import authorizeApiEndpoint from './authorizeApiEndpoint.js';
 import buildEndpointResult from '../../response/buildEndpointResult.js';
 import createEvaluateOperators from '../../context/createEvaluateOperators.js';
 import getEndpointConfig from './getEndpointConfig.js';
+import isUnauthenticatedHuman from './isUnauthenticatedHuman.js';
 import runRoutine from './runRoutine.js';
+import scheduleBackground from './scheduleBackground.js';
 async function callEndpoint(context, { blockId, endpointId, pageId, payload }) {
     const { logger } = context;
     context.blockId = blockId;
@@ -35,9 +37,11 @@ async function callEndpoint(context, { blockId, endpointId, pageId, payload }) {
     const endpointConfig = await getEndpointConfig(context, {
         endpointId
     });
-    // Block HTTP access to InternalApi endpoints — same error as missing endpoint
+    // Block HTTP access to InternalApi endpoints - same error as a missing
+    // endpoint, including the unauthenticated fork, so an internal endpoint is
+    // indistinguishable from one that does not exist on both paths.
     if (endpointConfig.type === 'InternalApi') {
-        const err = new ConfigError(`API Endpoint "${endpointId}" does not exist.`);
+        const err = await isUnauthenticatedHuman(context) ? new AuthenticationError(`Authentication required for API endpoint "${endpointId}".`) : new ConfigError(`API Endpoint "${endpointId}" does not exist.`);
         logger.debug({
             params: {
                 endpointId
@@ -53,10 +57,30 @@ async function callEndpoint(context, { blockId, endpointId, pageId, payload }) {
         steps: {},
         payload: serializer.deserialize(payload),
         arrayIndices: [],
+        error: null,
         items: {},
         state: {},
         endpointDepth: 0
     };
+    // async: true — acknowledge now, run the routine in the background.
+    // Auth was already checked above; the outcome lands in logs (scheduleBackground)
+    // and in whatever the routine itself records.
+    if (endpointConfig.async === true) {
+        scheduleBackground(context, {
+            event: 'background_endpoint',
+            endpointId
+        }, ()=>runRoutine(context, routineContext, {
+                routine: endpointConfig.routine
+            }));
+        return {
+            error: null,
+            response: serializer.serialize({
+                accepted: true
+            }),
+            status: 'accepted',
+            success: true
+        };
+    }
     const { error, response, status } = await runRoutine(context, routineContext, {
         routine: endpointConfig.routine
     });

package/dist/routes/endpoints/control/controlFor.js

@@ -14,20 +14,17 @@
   limitations under the License.
 */ import { ConfigError } from '@lowdefy/errors';
 import runRoutine from '../runRoutine.js';
+import evaluateRoutineOperators from '../evaluateRoutineOperators.js';
 async function controlFor(context, routineContext, { control }) {
-    const { endpointId, logger, evaluateOperators } = context;
+    const { endpointId, logger } = context;
     const { items } = routineContext;
     const itemName = control[':for'];
     if (!itemName) {
         throw new Error(`Invalid :for in endpoint "${endpointId}" - missing variable name in :for.`);
     }
-    const array = evaluateOperators({
+    const array = evaluateRoutineOperators(context, routineContext, {
         input: control[':in'],
-        items,
-        location: control['~k'] ?? ':for',
-        payload: routineContext.payload,
-        state: routineContext.state,
-        steps: routineContext.steps
+        location: control['~k'] ?? ':for'
     });
     logger.debug({
         event: 'debug_control_for',

package/dist/routes/endpoints/control/controlIf.js

@@ -13,16 +13,12 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import runRoutine from '../runRoutine.js';
+import evaluateRoutineOperators from '../evaluateRoutineOperators.js';
 async function controlIf(context, routineContext, { control }) {
-    const { endpointId, logger, evaluateOperators } = context;
-    const { items } = routineContext;
-    const evaluatedIf = evaluateOperators({
+    const { endpointId, logger } = context;
+    const evaluatedIf = evaluateRoutineOperators(context, routineContext, {
         input: control[':if'],
-        items,
-        location: control['~k'] ?? ':if',
-        payload: routineContext.payload,
-        state: routineContext.state,
-        steps: routineContext.steps
+        location: control['~k'] ?? ':if'
     });
     logger.debug({
         event: 'debug_control_if',