@lowdefy/build 5.5.1 → 5.6.0

package/dist/build/buildAgents.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */ import path from 'path';
 import fs from 'fs';
-import { type } from '@lowdefy/helpers';
+import { isReserved, type } from '@lowdefy/helpers';
 import { ConfigError, ConfigWarning } from '@lowdefy/errors';
 import { RESERVED_PLATFORM_TOOL_NAMES } from '@lowdefy/ai-utils';
 import countOperators from '../utils/countOperators.js';
@@ -56,6 +56,14 @@ function buildAgents({ components, context }) {
     });
     components.agents.forEach((agent)=>{
         const configKey = agent['~k'];
+        // agent.id becomes agent.agentId, which keys the detectCycles graph and the
+        // runtime agent registry - both plain objects. Reject a reserved name here,
+        // where the config location is still in hand.
+        if (isReserved(agent.id)) {
+            throw new ConfigError(`Agent id "${agent.id}" is a reserved name and cannot be used as an id.`, {
+                configKey
+            });
+        }
         // Check duplicates
         checkDuplicateAgentId({
             id: agent.id,

package/dist/build/buildAuth/buildAgentAuth.js

@@ -0,0 +1,56 @@
+/* eslint-disable no-param-reassign */ /*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+import getAgentRoles from './getAgentRoles.js';
+import getProtectedAgents from './getProtectedAgents.js';
+import { isInPatternList } from './matchPattern.js';
+// Agents are served from the API surface, so auth.api patterns match agent ids too.
+function buildAgentAuth({ components, context }) {
+    const protectedAgents = getProtectedAgents({
+        components
+    });
+    const agentRoles = getAgentRoles({
+        components
+    });
+    let configPublicApi = [];
+    if (type.isArray(components.auth.api.public)) {
+        configPublicApi = components.auth.api.public;
+    }
+    (components.agents ?? []).forEach((agent)=>{
+        if (agentRoles[agent.id]) {
+            if (isInPatternList(agent.id, configPublicApi)) {
+                throw new ConfigError(`Agent "${agent.id}" is both protected by roles and public.`, {
+                    received: agentRoles[agent.id],
+                    configKey: agent['~k']
+                });
+            }
+            agent.auth = {
+                public: false,
+                roles: agentRoles[agent.id]
+            };
+        } else if (protectedAgents.includes(agent.id)) {
+            agent.auth = {
+                public: false
+            };
+        } else {
+            agent.auth = {
+                public: true
+            };
+        }
+    });
+    return components;
+}
+export default buildAgentAuth;

package/dist/build/buildAuth/buildAuth.js

@@ -14,8 +14,10 @@
   limitations under the License.
 */ import { type } from '@lowdefy/helpers';
 import buildAuthPlugins from './buildAuthPlugins.js';
+import buildAgentAuth from './buildAgentAuth.js';
 import buildApiAuth from './buildApiAuth.js';
 import buildPageAuth from './buildPageAuth.js';
+import rejectReservedEntityIds from './rejectReservedEntityIds.js';
 import validateAuthConfig from './validateAuthConfig.js';
 function buildAuth({ components, context }) {
     const configured = !type.isNone(components.auth);
@@ -23,11 +25,18 @@ function buildAuth({ components, context }) {
         components,
         context
     });
+    rejectReservedEntityIds({
+        components
+    });
     components.auth.configured = configured;
     buildApiAuth({
         components,
         context
     });
+    buildAgentAuth({
+        components,
+        context
+    });
     buildPageAuth({
         components,
         context

package/dist/build/buildAuth/getAgentRoles.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { matchesPattern } from './matchPattern.js';
+function getAgentRoles({ components }) {
+    const roles = components.auth.api.roles;
+    const agentIds = (components.agents ?? []).map((agent)=>agent.id);
+    const agentRoles = {};
+    Object.keys(roles).forEach((roleName)=>{
+        roles[roleName].forEach((pattern)=>{
+            agentIds.forEach((agentId)=>{
+                if (matchesPattern(agentId, pattern)) {
+                    if (!agentRoles[agentId]) {
+                        agentRoles[agentId] = new Set();
+                    }
+                    agentRoles[agentId].add(roleName);
+                }
+            });
+        });
+    });
+    Object.keys(agentRoles).forEach((agentId)=>{
+        agentRoles[agentId] = [
+            ...agentRoles[agentId]
+        ];
+    });
+    return agentRoles;
+}
+export default getAgentRoles;

package/dist/build/buildAuth/getProtectedAgents.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { isInPatternList } from './matchPattern.js';
+function getProtectedAgents({ components }) {
+    const agentIds = (components.agents ?? []).map((agent)=>agent.id);
+    let protectedAgents = [];
+    if (type.isArray(components.auth.api.public)) {
+        protectedAgents = agentIds.filter((agentId)=>!isInPatternList(agentId, components.auth.api.public));
+    } else if (components.auth.api.protected === true) {
+        protectedAgents = agentIds;
+    } else if (type.isArray(components.auth.api.protected)) {
+        protectedAgents = agentIds.filter((agentId)=>isInPatternList(agentId, components.auth.api.protected));
+    }
+    return protectedAgents;
+}
+export default getProtectedAgents;

package/dist/build/buildAuth/rejectReservedEntityIds.js

@@ -0,0 +1,52 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { isReserved } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+// buildAuth runs before validateId sees page, endpoint and agent ids, and it keys
+// plain-object role maps on them: getPageRoles, getApiRoles and getAgentRoles all
+// build `roles[id]` and read it back with a truthiness check. A reserved id reads
+// through Object.prototype there, so the entity is silently marked protected with
+// Object.prototype as its roles - and the object then travels into addKeys, which
+// stamps a '~k' onto Object.prototype and corrupts every plain object in the
+// process. Gate the ids here, where buildAuth first touches them.
+//
+// validateId reports the same ids again in buildApi, buildAgents and buildPages;
+// logCollectedErrors collapses the pair on source line plus message so the author
+// reads it once.
+function rejectReservedEntityIds({ components }) {
+    const entityTypes = [
+        {
+            items: components.pages,
+            field: 'Page id'
+        },
+        {
+            items: components.api,
+            field: 'Endpoint id'
+        },
+        {
+            items: components.agents,
+            field: 'Agent id'
+        }
+    ];
+    entityTypes.forEach(({ items, field })=>{
+        (items ?? []).forEach((item)=>{
+            if (!isReserved(item.id)) return;
+            throw new ConfigError(`${field} "${item.id}" is a reserved name and cannot be used as an id.`, {
+                configKey: item['~k']
+            });
+        });
+    });
+}
+export default rejectReservedEntityIds;

package/dist/build/buildPages/buildBlock/buildEvents.js

@@ -12,7 +12,7 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { type } from '@lowdefy/helpers';
+*/ import { isReserved, type } from '@lowdefy/helpers';
 import { ConfigError, ConfigWarning } from '@lowdefy/errors';
 import createCheckDuplicateId from '../../../utils/createCheckDuplicateId.js';
 const BROWSER_DEFAULT_SHORTCUTS = new Set([
@@ -175,6 +175,16 @@ function buildEvents(block, pageContext) {
                             configKey: eventConfigKey
                         });
                     }
+                    // The client's shortcut manager keys a plain object by the normalized
+                    // shortcut. Normalization neither creates nor removes a reserved name:
+                    // multi-character key names pass through unchanged, and no reserved
+                    // name is a single character. So checking the raw string is enough, and
+                    // a modified form like "Ctrl+__proto__" stays valid.
+                    if (isReserved(shortcut)) {
+                        throw new ConfigError(`Event shortcut "${shortcut}" on event "${key}" on block "${block.blockId}" on page "${pageContext.pageId}" is a reserved name and cannot be used as a shortcut.`, {
+                            configKey: eventConfigKey
+                        });
+                    }
                     if (BROWSER_DEFAULT_SHORTCUTS.has(shortcut.toLowerCase())) {
                         pageContext.context.handleWarning(new ConfigWarning(`Shortcut "${shortcut}" on event "${key}" on block "${block.blockId}" on page "${pageContext.pageId}" conflicts with a browser default.`, {
                             configKey: eventConfigKey

package/dist/build/buildPages/buildBlock/validateBlock.js

@@ -12,7 +12,7 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { type } from '@lowdefy/helpers';
+*/ import { isReserved, splitPath, type } from '@lowdefy/helpers';
 import { ConfigError } from '@lowdefy/errors';
 function validateBlock(block, { pageId }, parentConfigKey) {
     const configKey = block?.['~k'] ?? parentConfigKey;
@@ -33,6 +33,17 @@ function validateBlock(block, { pageId }, parentConfigKey) {
             configKey
         });
     }
+    // Block ids are dot-paths that nest state, so they bypass validateId's shape gate. Every segment
+    // still becomes an object key on the way through get/set, so check per segment: a block
+    // `id: a.constructor.b` would reach `get` with a reserved segment and throw mid-render, which
+    // ErrorBoundary cannot catch because the throw happens during the render that would mount it.
+    const reservedSegment = splitPath(block.id).find(isReserved);
+    if (!type.isNone(reservedSegment)) {
+        throw new ConfigError(`Block id "${block.id}" uses reserved name "${reservedSegment}" as a path segment, at page "${pageId}".`, {
+            received: block.id,
+            configKey
+        });
+    }
     if (type.isNone(block.type)) {
         throw new ConfigError(`Block type is not defined at "${block.id}" on page "${pageId}".`, {
             configKey

package/dist/build/buildRefs/getKey.js

@@ -12,12 +12,23 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { get } from '@lowdefy/helpers';
-function getKey({ input, refDef }) {
+*/ import { get, ReservedKeyError } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+function getKey({ input, refDef, filePath }) {
     if (refDef.key) {
-        return get(input, refDef.key, {
-            default: null
-        });
+        try {
+            return get(input, refDef.key, {
+                default: null
+            });
+        } catch (error) {
+            if (!(error instanceof ReservedKeyError)) throw error;
+            // The ref key is author-written YAML, so a reserved name is a config mistake. Without
+            // this the bare ReservedKeyError reaches the build with no file and no line.
+            throw new ConfigError(`_ref key "${refDef.key}" is a reserved name.`, {
+                cause: error,
+                filePath
+            });
+        }
     }
     return input;
 }

package/dist/build/buildRefs/walker.js

@@ -13,7 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import path from 'path';
-import { get, serializer, type } from '@lowdefy/helpers';
+import { get, ReservedKeyError, serializer, type } from '@lowdefy/helpers';
 import { ConfigError } from '@lowdefy/errors';
 import { evaluateOperators } from '@lowdefy/operators';
 import makeRefDefinition from './makeRefDefinition.js';
@@ -203,19 +203,35 @@ function evaluateBuildOperator(node, ctx) {
     }
     return output;
 }
+// _var keys are author-written YAML, so a reserved name (e.g. "constructor") is a config
+// mistake, not a missing var. Wraps both call shapes for that check. The object form call
+// site below passes no `options` argument at all, so a missing key comes back from `get` as
+// `undefined` instead of a default — resolveVar relies on that `undefined` to tell "var not
+// provided" apart from "var provided as null".
+function readVar(key, ctx, options) {
+    try {
+        return get(ctx.vars, key, options);
+    } catch (error) {
+        if (!(error instanceof ReservedKeyError)) throw error;
+        throw new ConfigError(`_var key "${key}" is a reserved name.`, {
+            cause: error,
+            filePath: ctx.currentFile
+        });
+    }
+}
 // Resolve a _var node
 function resolveVar(node, ctx) {
     const varDef = node._var;
     // String form: { _var: "key" }
     if (type.isString(varDef)) {
-        const value = get(ctx.vars, varDef, {
+        const value = readVar(varDef, ctx, {
             default: null
         });
         return cloneVarValue(value, ctx.sourceRefId);
     }
     // Object form: { _var: { key, default } }
     if (type.isObject(varDef) && type.isString(varDef.key)) {
-        const varFromParent = get(ctx.vars, varDef.key);
+        const varFromParent = readVar(varDef.key, ctx);
         // Var provided (even if null) → use parent's sourceRefId for location
         if (!type.isUndefined(varFromParent)) {
             return cloneVarValue(varFromParent, ctx.sourceRefId);
@@ -610,7 +626,8 @@ async function resolveRef(node, ctx) {
         // 14. Extract key
         content = getKey({
             input: content,
-            refDef
+            refDef,
+            filePath: ctx.currentFile
         });
         // 15. Tag all nodes with ~r for provenance
         tagRefDeep(content, refDef.id);

package/dist/build/fetchModules.js

@@ -14,6 +14,7 @@
   limitations under the License.
 */ import fs from 'node:fs';
 import path from 'node:path';
+import { ReservedKeyError, setKey } from '@lowdefy/helpers';
 import { ConfigError } from '@lowdefy/errors';
 import fetchGitHubModule from './fetchGitHubModule.js';
 import parseModuleSource from './parseModuleSource.js';
@@ -28,6 +29,19 @@ function findGitRoot(startPath) {
         dir = parent;
     }
 }
+// Module ids come from the app's lowdefy.yaml, so they key this map from user
+// config. Surface a reserved id as the build's ConfigError rather than a bare
+// ReservedKeyError.
+function setResolvedPaths(resolved, id, paths) {
+    try {
+        setKey(resolved, id, paths);
+    } catch (error) {
+        if (!(error instanceof ReservedKeyError)) throw error;
+        throw new ConfigError(`Module entry id "${id}" is a reserved name.`, {
+            cause: error
+        });
+    }
+}
 async function fetchModules({ moduleEntries, context }) {
     const resolved = {};
     for (const entry of moduleEntries){
@@ -37,22 +51,22 @@ async function fetchModules({ moduleEntries, context }) {
             if (!fs.existsSync(path.join(resolvedPath, 'module.lowdefy.yaml'))) {
                 throw new ConfigError(`Module "${entry.id}": module.lowdefy.yaml not found at ${resolvedPath}`);
             }
-            resolved[entry.id] = {
+            setResolvedPaths(resolved, entry.id, {
                 packageRoot: findGitRoot(resolvedPath) ?? resolvedPath,
                 moduleRoot: resolvedPath,
                 isLocal: true
-            };
+            });
         } else if (source.type === 'github') {
             const cached = await fetchGitHubModule(source, context);
             const moduleRoot = source.path ? path.join(cached.packageRoot, source.path) : cached.packageRoot;
             if (!fs.existsSync(path.join(moduleRoot, 'module.lowdefy.yaml'))) {
                 throw new ConfigError(`Module "${entry.id}": module.lowdefy.yaml not found at path "${source.path || '/'}" in ${source.owner}/${source.repo}@${source.ref}`);
             }
-            resolved[entry.id] = {
+            setResolvedPaths(resolved, entry.id, {
                 packageRoot: cached.packageRoot,
                 moduleRoot,
                 isLocal: false
-            };
+            });
         }
     }
     return resolved;

package/dist/build/registerModules.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */ import path from 'path';
 import semver from 'semver';
-import { type } from '@lowdefy/helpers';
+import { ReservedKeyError, setKey, type } from '@lowdefy/helpers';
 import { ConfigError } from '@lowdefy/errors';
 import operators from '@lowdefy/operators-js/operators/build';
 import { resolve, WalkContext } from './buildRefs/walker.js';
@@ -69,9 +69,6 @@ async function resolveLocalManifest({ entry, resolvedPaths, context }) {
     if (entry.id.includes('/')) {
         throw new ConfigError(`Module entry id "${entry.id}" must not contain '/'. ` + `Use a flat identifier like "team-users".`);
     }
-    if (entry.id === '__proto__' || entry.id === 'constructor' || entry.id === 'prototype') {
-        throw new ConfigError(`Module entry id "${entry.id}" is a reserved name.`);
-    }
     if (!entry.source || !type.isString(entry.source)) {
         throw new ConfigError(`Module entry "${entry.id}": 'source' is required and must be a string.`);
     }
@@ -151,21 +148,30 @@ async function resolveLocalManifest({ entry, resolvedPaths, context }) {
             throw new ConfigError(`Module "${entry.id}" requires plugin "${plugin.name}" version "${plugin.version}" ` + `but the app has version "${appVersion}" installed. ` + `Update the plugin to a compatible version.`);
         }
     }
-    context.modules[entry.id] = {
-        id: entry.id,
-        source: entry.source,
-        packageRoot,
-        moduleRoot,
-        isLocal,
-        consumerVars: entry.vars ?? {},
-        varDefs,
-        resolvedVarCache: {},
-        connections: entry.connections ?? {},
-        manifest,
-        dependencies,
-        moduleDependencies: entry.dependencies ?? {},
-        refDef
-    };
+    try {
+        setKey(context.modules, entry.id, {
+            id: entry.id,
+            source: entry.source,
+            packageRoot,
+            moduleRoot,
+            isLocal,
+            consumerVars: entry.vars ?? {},
+            varDefs,
+            resolvedVarCache: {},
+            connections: entry.connections ?? {},
+            manifest,
+            dependencies,
+            moduleDependencies: entry.dependencies ?? {},
+            refDef
+        });
+    } catch (error) {
+        if (error instanceof ReservedKeyError) {
+            throw new ConfigError(`Module entry id "${entry.id}" is a reserved name.`, {
+                cause: error
+            });
+        }
+        throw error;
+    }
 }
 async function resolveFullManifest({ entryId, context }) {
     const moduleEntry = context.modules[entryId];

package/dist/build/writeI18n.js

@@ -13,7 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { ConfigError, ConfigWarning } from '@lowdefy/errors';
-import { mergeObjects, serializer, type } from '@lowdefy/helpers';
+import { isReserved, mergeObjects, serializer, type } from '@lowdefy/helpers';
 function collectPluginMessages({ messagesMap, declaredCodes }) {
     const collected = {};
     Object.values(messagesMap ?? {}).forEach((pluginCatalog)=>{
@@ -57,6 +57,13 @@ async function writeI18n({ components, context }) {
                 configKey: locale?.['~k'] ?? i18n['~k']
             });
         }
+        // The code keys the collected plugin catalog and the merged messages
+        // artifact, both plain objects.
+        if (isReserved(locale.code)) {
+            throw new ConfigError(`Locale code "${locale.code}" in "config.i18n.locales" is a reserved name and cannot be used as a locale code.`, {
+                configKey: locale['~k']
+            });
+        }
         if (codes.has(locale.code)) {
             throw new ConfigError(`Duplicate locale code "${locale.code}" in "config.i18n.locales".`, {
                 configKey: locale['~k']

package/dist/build/writePluginImports/writeGlobalsCss.js

@@ -62,7 +62,6 @@ function objectToThemeVars(obj, prefix) {
 }
 function buildThemeVars(tailwindConfig) {
     const merged = mergeObjects([
-        {},
         BRIDGE_DEFAULTS,
         tailwindConfig ?? {}
     ]);