@lowdefy/build 5.1.0 → 5.3.0

package/dist/build/buildMenu.js

@@ -32,9 +32,50 @@ function buildDefaultMenu({ components, context }) {
     ];
     return menus;
 }
+function validateMenuItem(menuItem, menuId, context) {
+    const configKey = menuItem?.['~k'];
+    if (!type.isObject(menuItem)) {
+        collectExceptions(context, new ConfigError(`Menu item should be an object on menu "${menuId}".`, {
+            received: menuItem,
+            configKey
+        }));
+        return false;
+    }
+    if (type.isUndefined(menuItem.id)) {
+        collectExceptions(context, new ConfigError(`Menu item id missing on menu "${menuId}".`, {
+            configKey
+        }));
+        return false;
+    }
+    if (!type.isString(menuItem.id)) {
+        collectExceptions(context, new ConfigError(`Menu item id is not a string on menu "${menuId}".`, {
+            received: menuItem.id,
+            configKey
+        }));
+        return false;
+    }
+    if (type.isNone(menuItem.type)) {
+        collectExceptions(context, new ConfigError(`Menu item type is not defined at "${menuItem.id}" on menu "${menuId}".`, {
+            configKey
+        }));
+        return false;
+    }
+    if (!type.isString(menuItem.type)) {
+        collectExceptions(context, new ConfigError(`Menu item type is not a string at "${menuItem.id}" on menu "${menuId}".`, {
+            received: menuItem.type,
+            configKey
+        }));
+        return false;
+    }
+    return true;
+}
 function loopItems({ parent, menuId, pages, missingPageWarnings, checkDuplicateMenuItemId, context }) {
     if (type.isArray(parent.links)) {
         parent.links.forEach((menuItem)=>{
+            if (!validateMenuItem(menuItem, menuId, context)) {
+                menuItem.remove = true;
+                return;
+            }
             const configKey = menuItem['~k'];
             if (menuItem.type === 'MenuLink') {
                 if (type.isString(menuItem.pageId)) {

package/dist/build/buildModuleDefs.js

@@ -0,0 +1,97 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import operators from '@lowdefy/operators-js/operators/build';
+import { resolve, WalkContext } from './buildRefs/walker.js';
+import getRefContent from './buildRefs/getRefContent.js';
+import makeRefDefinition from './buildRefs/makeRefDefinition.js';
+import evaluateStaticOperators from './buildRefs/evaluateStaticOperators.js';
+import collectDynamicIdentifiers from './collectDynamicIdentifiers.js';
+import validateOperatorsDynamic from './validateOperatorsDynamic.js';
+import fetchModules from './fetchModules.js';
+import { resolveLocalManifest, resolveFullManifest } from './registerModules.js';
+import resolveModuleDependencies from './resolveModuleDependencies.js';
+validateOperatorsDynamic({
+    operators
+});
+const dynamicIdentifiers = collectDynamicIdentifiers({
+    operators
+});
+async function parseLowdefyYaml({ context }) {
+    const refDef = makeRefDefinition('lowdefy.yaml', null, context.refMap);
+    const content = await getRefContent({
+        context,
+        refDef,
+        referencedFrom: null
+    });
+    const ctx = new WalkContext({
+        buildContext: context,
+        refId: refDef.id,
+        sourceRefId: null,
+        vars: {},
+        path: '',
+        currentFile: refDef.path,
+        refChain: new Set(refDef.path ? [
+            refDef.path
+        ] : []),
+        operators,
+        env: process.env,
+        dynamicIdentifiers,
+        shouldStop: (path)=>{
+            if (path.startsWith('modules')) return false;
+            return 'preserve';
+        }
+    });
+    let config = await resolve(content, ctx);
+    config = evaluateStaticOperators({
+        context,
+        input: config,
+        refDef
+    });
+    return config ?? {};
+}
+async function buildModuleDefs({ context }) {
+    const lowdefyConfig = await parseLowdefyYaml({
+        context
+    });
+    context.plugins = lowdefyConfig.plugins ?? [];
+    const moduleEntries = lowdefyConfig.modules ?? [];
+    if (moduleEntries.length === 0) {
+        return;
+    }
+    const resolvedPaths = await fetchModules({
+        moduleEntries,
+        context
+    });
+    // Step 1: Local resolve — concrete arrays, preserved content, exports/deps extracted
+    for (const entry of moduleEntries){
+        await resolveLocalManifest({
+            entry,
+            resolvedPaths: resolvedPaths[entry.id],
+            context
+        });
+    }
+    // Step 2: Auto-wire and validate dependency wiring
+    resolveModuleDependencies({
+        context
+    });
+    // Step 3: Full resolve — cross-module refs, preserved content
+    for (const entryId of Object.keys(context.modules)){
+        await resolveFullManifest({
+            entryId,
+            context
+        });
+    }
+}
+export default buildModuleDefs;

package/dist/build/buildModules.js

@@ -0,0 +1,96 @@
+/* eslint-disable no-param-reassign */ /*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ConfigError } from '@lowdefy/errors';
+import { serializer, type } from '@lowdefy/helpers';
+function validateModuleSecrets({ content, manifest, entryId }) {
+    const declaredSecrets = new Set((manifest.secrets ?? []).map((s)=>s.name));
+    serializer.copy(content, {
+        reviver: (_, value)=>{
+            if (!type.isObject(value)) return value;
+            const keys = Object.keys(value).filter((k)=>!k.startsWith('~'));
+            if (keys.length !== 1) return value;
+            if (!type.isUndefined(value['_secret'])) {
+                const secretName = value['_secret'];
+                if (type.isString(secretName) && !declaredSecrets.has(secretName)) {
+                    throw new ConfigError(`Module "${entryId}" references secret "${secretName}" ` + `but does not declare it in module.lowdefy.yaml secrets. ` + `Add it to the module's secrets list or remove the reference.`);
+                }
+            }
+            return value;
+        }
+    });
+}
+function buildModules({ components, context }) {
+    const moduleEntries = components.modules ?? [];
+    delete components.modules;
+    for (const entry of moduleEntries){
+        const moduleEntry = context.modules[entry.id];
+        if (!moduleEntry) {
+            throw new ConfigError(`Module entry "${entry.id}" not registered. ` + `Check that buildModuleDefs ran successfully.`);
+        }
+        const manifest = moduleEntry.manifest;
+        // Validate connection remapping keys
+        const remapping = moduleEntry.connections ?? {};
+        const moduleConnIds = new Set((manifest.connections ?? []).map((c)=>c.id));
+        for (const remapKey of Object.keys(remapping)){
+            if (!moduleConnIds.has(remapKey)) {
+                throw new ConfigError(`Module "${entry.id}" connection remapping references "${remapKey}", ` + `but the module does not export a connection with that id.`);
+            }
+        }
+        // Validate secret whitelist on non-remapped content
+        for (const page of manifest.pages ?? []){
+            validateModuleSecrets({
+                content: page,
+                manifest,
+                entryId: entry.id
+            });
+        }
+        for (const conn of manifest.connections ?? []){
+            if (remapping[conn.id]) continue;
+            validateModuleSecrets({
+                content: conn,
+                manifest,
+                entryId: entry.id
+            });
+        }
+        for (const endpoint of manifest.api ?? []){
+            validateModuleSecrets({
+                content: endpoint,
+                manifest,
+                entryId: entry.id
+            });
+        }
+        // Process pages
+        for (const page of manifest.pages ?? []){
+            page.id = `${entry.id}/${page.id}`;
+            components.pages = components.pages ?? [];
+            components.pages.push(page);
+        }
+        // Process connections (skip remapped -- app provides those)
+        for (const conn of manifest.connections ?? []){
+            if (remapping[conn.id]) continue;
+            conn.id = `${entry.id}/${conn.id}`;
+            components.connections = components.connections ?? [];
+            components.connections.push(conn);
+        }
+        // Process API endpoints
+        for (const endpoint of manifest.api ?? []){
+            endpoint.id = `${entry.id}/${endpoint.id}`;
+            components.api = components.api ?? [];
+            components.api.push(endpoint);
+        }
+    }
+    return components;
+}
+export default buildModules;

package/dist/build/buildPages/buildBlock/buildBlock.js

@@ -25,8 +25,8 @@ import normalizeLayout from './normalizeLayout.js';
 import setBlockId from './setBlockId.js';
 import validateBlock from './validateBlock.js';
 import validateSlots from './validateSlots.js';
-function buildBlock(block, pageContext) {
-    validateBlock(block, pageContext);
+function buildBlock(block, pageContext, parentConfigKey) {
+    validateBlock(block, pageContext, parentConfigKey);
     setBlockId(block, pageContext);
     normalizeLayout(block, pageContext);
     moveAreasToSlots(block, pageContext);

package/dist/build/buildPages/buildBlock/buildEvents.js

@@ -23,7 +23,7 @@ const BROWSER_DEFAULT_SHORTCUTS = new Set([
     'mod+q',
     'mod+l'
 ]);
-function checkAction(action, { blockId, checkDuplicateActionId, eventId, linkActionRefs, pageId, requestActionRefs, typeCounters }) {
+function checkAction(action, { blockId, callApiActionRefs, checkDuplicateActionId, eventId, linkActionRefs, pageId, requestActionRefs, typeCounters }) {
     const configKey = action['~k'];
     if (type.isUndefined(action.id)) {
         throw new ConfigError(`Action id missing on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
@@ -95,6 +95,19 @@ function checkAction(action, { blockId, checkDuplicateActionId, eventId, linkAct
             });
         }
     }
+    // Collect static CallAPI action references for validation
+    if (action.type === 'CallAPI' && !type.isNone(action.params)) {
+        const params = action.params;
+        if (type.isObject(params) && type.isString(params.endpointId)) {
+            callApiActionRefs.push({
+                endpointId: params.endpointId,
+                action,
+                blockId,
+                eventId,
+                sourcePageId: pageId
+            });
+        }
+    }
 }
 function buildEvents(block, pageContext) {
     if (block.events) {
@@ -133,6 +146,7 @@ function buildEvents(block, pageContext) {
             block.events[key].try.map((action)=>checkAction(action, {
                     eventId: key,
                     blockId: block.blockId,
+                    callApiActionRefs: pageContext.callApiActionRefs,
                     typeCounters: pageContext.typeCounters,
                     pageId: pageContext.pageId,
                     linkActionRefs: pageContext.linkActionRefs,
@@ -142,6 +156,7 @@ function buildEvents(block, pageContext) {
             block.events[key].catch.map((action)=>checkAction(action, {
                     eventId: key,
                     blockId: block.blockId,
+                    callApiActionRefs: pageContext.callApiActionRefs,
                     typeCounters: pageContext.typeCounters,
                     pageId: pageContext.pageId,
                     linkActionRefs: pageContext.linkActionRefs,

package/dist/build/buildPages/buildBlock/buildSubBlocks.js

@@ -27,7 +27,8 @@ function buildSubBlocks(block, pageContext) {
                     configKey: block.slots[key]['~k'] ?? block['~k']
                 });
             }
-            block.slots[key].blocks.map((blk)=>buildBlock(blk, pageContext));
+            const slotConfigKey = block.slots[key].blocks['~k'] ?? block.slots[key]['~k'] ?? block['~k'];
+            block.slots[key].blocks.map((blk)=>buildBlock(blk, pageContext, slotConfigKey));
         });
     }
 }

package/dist/build/buildPages/buildBlock/validateBlock.js

@@ -14,10 +14,10 @@
   limitations under the License.
 */ import { type } from '@lowdefy/helpers';
 import { ConfigError } from '@lowdefy/errors';
-function validateBlock(block, { pageId }) {
-    const configKey = block?.['~k'];
+function validateBlock(block, { pageId }, parentConfigKey) {
+    const configKey = block?.['~k'] ?? parentConfigKey;
     if (!type.isObject(block)) {
-        throw new ConfigError(`Expected block to be an object on page "${pageId}".`, {
+        throw new ConfigError(`Block should be an object on page "${pageId}".`, {
             received: block,
             configKey
         });

package/dist/build/buildPages/buildPage.js

@@ -57,6 +57,7 @@ function buildPage({ page, index, context, checkDuplicatePageId }) {
     buildBlock(page, {
         auth: page.auth,
         blockIdCounter: createCounter(),
+        callApiActionRefs: context.callApiActionRefs ?? [],
         checkDuplicateRequestId: createCheckDuplicateId({
             message: 'Duplicate requestId "{{ id }}" on page "{{ pageId }}".'
         }),

package/dist/build/buildPages/validateCallApiRefs.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ConfigWarning } from '@lowdefy/errors';
+function validateCallApiRefs({ callApiActionRefs, endpointConfigs, context }) {
+    const internalEndpoints = new Set(endpointConfigs.filter((config)=>config.type === 'InternalApi').map((config)=>config.endpointId));
+    callApiActionRefs.forEach(({ endpointId, action, sourcePageId })=>{
+        if (action.skip === true) {
+            return;
+        }
+        if (internalEndpoints.has(endpointId)) {
+            context.handleWarning(new ConfigWarning(`CallAPI action on page "${sourcePageId}" targets InternalApi endpoint "${endpointId}". InternalApi endpoints are not accessible from client pages.`, {
+                configKey: action['~k'],
+                prodError: true,
+                checkSlug: 'callapi-internal-refs'
+            }));
+        }
+    });
+}
+export default validateCallApiRefs;

package/dist/build/buildRefs/getModuleRefContent.js

@@ -0,0 +1,81 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ConfigError } from '@lowdefy/errors';
+function describeRef(refDef) {
+    const parts = [];
+    if (refDef.module) parts.push(`module: "${refDef.module}"`);
+    if (refDef.component) parts.push(`component: "${refDef.component}"`);
+    if (refDef.menu) parts.push(`menu: "${refDef.menu}"`);
+    if (refDef.page) parts.push(`page: "${refDef.page}"`);
+    if (refDef.connection) parts.push(`connection: "${refDef.connection}"`);
+    if (refDef.api) parts.push(`api: "${refDef.api}"`);
+    return `_ref { ${parts.join(', ')} }`;
+}
+async function getModuleRefContent({ context, refDef, referencedFrom, walkCtx, configKey }) {
+    const rawName = refDef.module;
+    let entryId;
+    if (walkCtx?.moduleDependencies && rawName in walkCtx.moduleDependencies) {
+        entryId = walkCtx.moduleDependencies[rawName];
+    } else {
+        entryId = rawName;
+    }
+    const moduleEntry = context.modules[entryId];
+    if (!moduleEntry) {
+        throw new ConfigError(`${describeRef(refDef)} references module "${rawName}" but no module with that entry id was registered` + (entryId !== rawName ? ` ("${rawName}" was mapped to "${entryId}" via dependency wiring).` : '.'), {
+            configKey
+        });
+    }
+    const manifest = moduleEntry.manifest;
+    // Cross-module _ref is limited to component and menu.
+    // Reject page, connection, api with a clear error pointing to the ID operators.
+    if (refDef.page || refDef.connection || refDef.api) {
+        const refType = refDef.page ? 'page' : refDef.connection ? 'connection' : 'api';
+        const operator = refDef.page ? '_module.pageId' : refDef.connection ? '_module.connectionId' : '_module.endpointId';
+        throw new ConfigError(`Cross-module _ref does not support "${refType}". ` + `Use ${operator}: { id: "${refDef[refType]}", module: "${rawName}" } instead.`, {
+            configKey
+        });
+    }
+    const exportTypes = [
+        'component',
+        'menu'
+    ];
+    const exportType = exportTypes.find((t)=>refDef[t]) ?? null;
+    if (!exportType) {
+        throw new ConfigError('Module _ref requires "component" or "menu" property.', {
+            configKey
+        });
+    }
+    const exportName = refDef[exportType];
+    const manifestArray = {
+        component: manifest.components,
+        menu: manifest.menus
+    }[exportType] ?? [];
+    let content;
+    if (exportType === 'component') {
+        content = manifestArray.find((item)=>item.id === exportName)?.component;
+    } else if (exportType === 'menu') {
+        content = manifestArray.find((item)=>item.id === exportName)?.links;
+    }
+    if (!content) {
+        throw new ConfigError(`Module "${entryId}" does not export ${exportType} "${exportName}".`, {
+            configKey
+        });
+    }
+    return {
+        content,
+        entryId
+    };
+}
+export default getModuleRefContent;

package/dist/build/buildRefs/makeRefDefinition.js

@@ -39,6 +39,12 @@ function makeRefDefinition(refDefinition, parent, refMap, lineNumber, walkerPath
         vars: get(refDefinition, 'vars', {
             default: {}
         }),
+        module: get(refDefinition, 'module'),
+        component: get(refDefinition, 'component'),
+        menu: get(refDefinition, 'menu'),
+        page: get(refDefinition, 'page'),
+        connection: get(refDefinition, 'connection'),
+        api: get(refDefinition, 'api'),
         ...ignoreBuildChecks !== undefined && {
             ignoreBuildChecks
         }