@lowdefy/build 5.5.1 → 6.0.0

package/dist/build/buildAuth/buildAuth.js

@@ -14,8 +14,11 @@
   limitations under the License.
 */ import { type } from '@lowdefy/helpers';
 import buildAuthPlugins from './buildAuthPlugins.js';
+import buildAgentAuth from './buildAgentAuth.js';
+import buildAuthStrategies from './buildAuthStrategies.js';
 import buildApiAuth from './buildApiAuth.js';
 import buildPageAuth from './buildPageAuth.js';
+import buildWebsocketAuth from './buildWebsocketAuth.js';
 import validateAuthConfig from './validateAuthConfig.js';
 function buildAuth({ components, context }) {
     const configured = !type.isNone(components.auth);
@@ -24,10 +27,21 @@ function buildAuth({ components, context }) {
         context
     });
     components.auth.configured = configured;
+    buildAuthStrategies({
+        components
+    });
     buildApiAuth({
         components,
         context
     });
+    buildWebsocketAuth({
+        components,
+        context
+    });
+    buildAgentAuth({
+        components,
+        context
+    });
     buildPageAuth({
         components,
         context

package/dist/build/buildAuth/buildAuthPlugins.js

@@ -96,5 +96,11 @@ function buildAuthPlugins({ components, context }) {
         typeClass: 'provider',
         context
     });
+    buildAuthPlugin({
+        counter: counters.strategies,
+        pluginConfig: authConfig.strategies,
+        typeClass: 'strategy',
+        context
+    });
 }
 export default buildAuthPlugins;

package/dist/build/buildAuth/buildAuthStrategies.js

@@ -0,0 +1,117 @@
+/* eslint-disable no-param-reassign */ /*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+const strategyTypes = [
+    'apiKey',
+    'jwt'
+];
+// Prototype-pollution vectors rejected as claimMapping path segments.
+const reservedKeys = new Set([
+    '__proto__',
+    'constructor',
+    'prototype',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__'
+]);
+function setDefault(object, key, value) {
+    if (type.isNone(object[key])) {
+        object[key] = value;
+    }
+}
+function validateApiKeyStrategy({ strategy, configKey }) {
+    const properties = strategy.properties ?? {};
+    if (!type.isArray(properties.keys) || properties.keys.length === 0) {
+        throw new ConfigError(`Auth strategy "${strategy.id}" requires "properties.keys" to be a non-empty array of keys.`, {
+            configKey
+        });
+    }
+    properties.keys.forEach((key, index)=>{
+        if (type.isNone(key.value)) {
+            throw new ConfigError(`Auth strategy "${strategy.id}" key at index ${index} is missing "value". Reference the key with the _secret operator.`, {
+                configKey
+            });
+        }
+    });
+}
+function validateJwtStrategy({ strategy, configKey }) {
+    const properties = strategy.properties ?? {};
+    const hasSecret = !type.isNone(properties.secret);
+    const hasJwksUri = !type.isNone(properties.jwksUri);
+    if (hasSecret === hasJwksUri) {
+        throw new ConfigError(`Auth strategy "${strategy.id}" requires exactly one of "properties.secret" or "properties.jwksUri" to verify token signatures.`, {
+            configKey
+        });
+    }
+    // The algorithms allowlist restricts which signing algorithms are accepted,
+    // preventing "alg: none" and algorithm-confusion downgrade attacks.
+    if (!type.isArray(properties.algorithms) || properties.algorithms.length === 0) {
+        throw new ConfigError(`Auth strategy "${strategy.id}" requires "properties.algorithms" to be a non-empty array restricting the accepted signing algorithms.`, {
+            configKey
+        });
+    }
+    // claimMapping field names become object keys on the user and attributes
+    // objects the jwt verifier builds per request - gated here where the config
+    // location is available, so a pollution-vector key never reaches runtime.
+    Object.keys(properties.claimMapping ?? {}).forEach((field)=>{
+        const reservedSegment = field.split('.').find((segment)=>reservedKeys.has(segment));
+        if (!type.isNone(reservedSegment)) {
+            throw new ConfigError(`Auth strategy "${strategy.id}" claimMapping field "${field}" uses reserved name "${reservedSegment}".`, {
+                configKey
+            });
+        }
+    });
+}
+// Validates auth.strategies and writes per-entry defaults so the runtime
+// never falls back. Objects are mutated in place to preserve ~k markers.
+function buildAuthStrategies({ components }) {
+    const seenIds = {};
+    (components.auth.strategies ?? []).forEach((strategy)=>{
+        const configKey = strategy['~k'];
+        if (seenIds[strategy.id] === true) {
+            throw new ConfigError(`Duplicate auth strategy id "${strategy.id}".`, {
+                configKey
+            });
+        }
+        seenIds[strategy.id] = true;
+        if (!strategyTypes.includes(strategy.type)) {
+            throw new ConfigError(`Auth strategy "${strategy.id}" has unknown type "${strategy.type}". Valid types are: ${strategyTypes.join(', ')}.`, {
+                received: strategy.type,
+                configKey
+            });
+        }
+        if (strategy.type === 'apiKey') {
+            validateApiKeyStrategy({
+                strategy,
+                configKey
+            });
+        }
+        if (strategy.type === 'jwt') {
+            validateJwtStrategy({
+                strategy,
+                configKey
+            });
+        }
+        setDefault(strategy, 'roles', []);
+        setDefault(strategy, 'attributes', {});
+        if (strategy.type === 'apiKey') {
+            setDefault(strategy.properties, 'headerName', 'X-API-Key');
+        }
+    });
+    return components;
+}
+export default buildAuthStrategies;

package/dist/build/buildAuth/buildWebsocketAuth.js

@@ -0,0 +1,55 @@
+/* eslint-disable no-param-reassign */ /*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+import getProtectedWebsockets from './getProtectedWebsockets.js';
+import getWebsocketRoles from './getWebsocketRoles.js';
+import { isInPatternList } from './matchPattern.js';
+function buildWebsocketAuth({ components, context }) {
+    const protectedWebsockets = getProtectedWebsockets({
+        components
+    });
+    const websocketRoles = getWebsocketRoles({
+        components
+    });
+    let configPublicWebsockets = [];
+    if (type.isArray(components.auth.websockets.public)) {
+        configPublicWebsockets = components.auth.websockets.public;
+    }
+    (components.websockets || []).forEach((websocket)=>{
+        if (websocketRoles[websocket.id]) {
+            if (isInPatternList(websocket.id, configPublicWebsockets)) {
+                throw new ConfigError(`Websocket "${websocket.id}" is both protected by roles and public.`, {
+                    received: websocketRoles[websocket.id],
+                    configKey: websocket['~k']
+                });
+            }
+            websocket.auth = {
+                public: false,
+                roles: websocketRoles[websocket.id]
+            };
+        } else if (protectedWebsockets.includes(websocket.id)) {
+            websocket.auth = {
+                public: false
+            };
+        } else {
+            websocket.auth = {
+                public: true
+            };
+        }
+    });
+    return components;
+}
+export default buildWebsocketAuth;

package/dist/build/buildAuth/getAgentRoles.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { matchesPattern } from './matchPattern.js';
+function getAgentRoles({ components }) {
+    const roles = components.auth.api.roles;
+    const agentIds = (components.agents ?? []).map((agent)=>agent.id);
+    const agentRoles = {};
+    Object.keys(roles).forEach((roleName)=>{
+        roles[roleName].forEach((pattern)=>{
+            agentIds.forEach((agentId)=>{
+                if (matchesPattern(agentId, pattern)) {
+                    if (!agentRoles[agentId]) {
+                        agentRoles[agentId] = new Set();
+                    }
+                    agentRoles[agentId].add(roleName);
+                }
+            });
+        });
+    });
+    Object.keys(agentRoles).forEach((agentId)=>{
+        agentRoles[agentId] = [
+            ...agentRoles[agentId]
+        ];
+    });
+    return agentRoles;
+}
+export default getAgentRoles;

package/dist/build/buildAuth/getProtectedAgents.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { isInPatternList } from './matchPattern.js';
+function getProtectedAgents({ components }) {
+    const agentIds = (components.agents ?? []).map((agent)=>agent.id);
+    let protectedAgents = [];
+    if (type.isArray(components.auth.api.public)) {
+        protectedAgents = agentIds.filter((agentId)=>!isInPatternList(agentId, components.auth.api.public));
+    } else if (components.auth.api.protected === true) {
+        protectedAgents = agentIds;
+    } else if (type.isArray(components.auth.api.protected)) {
+        protectedAgents = agentIds.filter((agentId)=>isInPatternList(agentId, components.auth.api.protected));
+    }
+    return protectedAgents;
+}
+export default getProtectedAgents;

package/dist/build/buildAuth/getProtectedWebsockets.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { isInPatternList } from './matchPattern.js';
+function getProtectedWebsockets({ components }) {
+    const websocketIds = (components.websockets ?? []).map((websocket)=>websocket.id);
+    let protectedWebsockets = [];
+    if (type.isArray(components.auth.websockets.public)) {
+        protectedWebsockets = websocketIds.filter((websocketId)=>!isInPatternList(websocketId, components.auth.websockets.public));
+    } else if (components.auth.websockets.protected === true) {
+        protectedWebsockets = websocketIds;
+    } else if (type.isArray(components.auth.websockets.protected)) {
+        protectedWebsockets = websocketIds.filter((websocketId)=>isInPatternList(websocketId, components.auth.websockets.protected));
+    }
+    return protectedWebsockets;
+}
+export default getProtectedWebsockets;

package/dist/build/buildAuth/getWebsocketRoles.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { matchesPattern } from './matchPattern.js';
+function getWebsocketRoles({ components }) {
+    const roles = components.auth.websockets.roles;
+    const websocketIds = (components.websockets ?? []).map((websocket)=>websocket.id);
+    const websocketRoles = {};
+    Object.keys(roles).forEach((roleName)=>{
+        roles[roleName].forEach((pattern)=>{
+            websocketIds.forEach((websocketId)=>{
+                if (matchesPattern(websocketId, pattern)) {
+                    if (!websocketRoles[websocketId]) {
+                        websocketRoles[websocketId] = new Set();
+                    }
+                    websocketRoles[websocketId].add(roleName);
+                }
+            });
+        });
+    });
+    Object.keys(websocketRoles).forEach((websocketId)=>{
+        websocketRoles[websocketId] = [
+            ...websocketRoles[websocketId]
+        ];
+    });
+    return websocketRoles;
+}
+export default getWebsocketRoles;

package/dist/build/buildAuth/rejectReservedEntityIds.js

@@ -0,0 +1,52 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { isReserved } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+// buildAuth runs before validateId sees page, endpoint and agent ids, and it keys
+// plain-object role maps on them: getPageRoles, getApiRoles and getAgentRoles all
+// build `roles[id]` and read it back with a truthiness check. A reserved id reads
+// through Object.prototype there, so the entity is silently marked protected with
+// Object.prototype as its roles - and the object then travels into addKeys, which
+// stamps a '~k' onto Object.prototype and corrupts every plain object in the
+// process. Gate the ids here, where buildAuth first touches them.
+//
+// validateId reports the same ids again in buildApi, buildAgents and buildPages;
+// logCollectedErrors collapses the pair on source line plus message so the author
+// reads it once.
+function rejectReservedEntityIds({ components }) {
+    const entityTypes = [
+        {
+            items: components.pages,
+            field: 'Page id'
+        },
+        {
+            items: components.api,
+            field: 'Endpoint id'
+        },
+        {
+            items: components.agents,
+            field: 'Agent id'
+        }
+    ];
+    entityTypes.forEach(({ items, field })=>{
+        (items ?? []).forEach((item)=>{
+            if (!isReserved(item.id)) return;
+            throw new ConfigError(`${field} "${item.id}" is a reserved name and cannot be used as an id.`, {
+                configKey: item['~k']
+            });
+        });
+    });
+}
+export default rejectReservedEntityIds;

package/dist/build/buildAuth/validateAuthConfig.js

@@ -32,6 +32,12 @@ function validateAuthConfig({ components, context }) {
     if (type.isNone(components.auth.api.roles)) {
         components.auth.api.roles = {};
     }
+    if (type.isNone(components.auth.websockets)) {
+        components.auth.websockets = {};
+    }
+    if (type.isNone(components.auth.websockets.roles)) {
+        components.auth.websockets.roles = {};
+    }
     if (type.isNone(components.auth.authPages)) {
         components.auth.authPages = {};
     }
@@ -93,9 +99,15 @@ function validateAuthConfig({ components, context }) {
         context,
         entity: 'pages'
     });
-    // Validate NEXTAUTH_SECRET is set when auth providers are configured
-    if (components.auth.providers.length > 0 && type.isNone(process.env.NEXTAUTH_SECRET)) {
-        throw new ConfigError('Auth providers are configured but NEXTAUTH_SECRET environment variable is not set. ' + 'Set NEXTAUTH_SECRET to a secure random string (e.g., generate with `openssl rand -base64 32`).', {
+    validateMutualExclusivity({
+        components,
+        context,
+        entity: 'websockets'
+    });
+    // Validate AUTH_SECRET is set when auth providers are configured. Auth.js v5
+    // reads AUTH_SECRET; the v4 NEXTAUTH_SECRET variable is not supported.
+    if (components.auth.providers.length > 0 && type.isNone(process.env.AUTH_SECRET)) {
+        throw new ConfigError('Auth providers are configured but AUTH_SECRET environment variable is not set. ' + 'Set AUTH_SECRET to a secure random string (e.g., generate with `openssl rand -base64 32`).', {
             configKey: components.auth.providers['~k'] ?? components.auth['~k']
         });
     }

package/dist/build/buildImports/buildImportsDev.js

@@ -27,9 +27,12 @@ function getPluginPackages({ components }) {
     getPackages(components.types.auth.callbacks);
     getPackages(components.types.auth.events);
     getPackages(components.types.auth.providers);
+    getPackages(components.types.auth.strategies);
     getPackages(components.types.blocks);
     getPackages(components.types.connections);
+    getPackages(components.types.notifications);
     getPackages(components.types.requests);
+    getPackages(components.types.websockets);
     getPackages(components.types.operators.client);
     getPackages(components.types.operators.server);
     return pluginPackages;
@@ -74,6 +77,10 @@ function buildImportsDev({ components, context }) {
             providers: buildImportClassDev({
                 pluginPackages,
                 map: context.typesMap.auth.providers
+            }),
+            strategies: buildImportClassDev({
+                pluginPackages,
+                map: context.typesMap.auth.strategies
             })
         },
         blocks,
@@ -87,10 +94,18 @@ function buildImportsDev({ components, context }) {
             context,
             defaults: defaultIconsDev
         }),
+        notifications: buildImportClassDev({
+            pluginPackages,
+            map: context.typesMap.notifications
+        }),
         requests: buildImportClassDev({
             pluginPackages,
             map: context.typesMap.requests
         }),
+        websockets: buildImportClassDev({
+            pluginPackages,
+            map: context.typesMap.websockets
+        }),
         operators: {
             client: buildImportClassDev({
                 pluginPackages,

package/dist/build/buildImports/buildImportsProd.js

@@ -30,7 +30,8 @@ function buildImportsProd({ components, context }) {
             adapters: buildImportClassProd(components.types.auth.adapters),
             callbacks: buildImportClassProd(components.types.auth.callbacks),
             events: buildImportClassProd(components.types.auth.events),
-            providers: buildImportClassProd(components.types.auth.providers)
+            providers: buildImportClassProd(components.types.auth.providers),
+            strategies: buildImportClassProd(components.types.auth.strategies)
         },
         blocks,
         connections: buildImportClassProd(components.types.connections),
@@ -40,7 +41,9 @@ function buildImportsProd({ components, context }) {
             context,
             defaults: defaultIconsProd
         }),
+        notifications: buildImportClassProd(components.types.notifications),
         requests: buildImportClassProd(components.types.requests),
+        websockets: buildImportClassProd(components.types.websockets),
         operators: {
             client: buildImportClassProd(components.types.operators.client),
             server: buildImportClassProd(components.types.operators.server)

package/dist/build/buildJs/generateClientJsModule.js

@@ -0,0 +1,27 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import generateJsFile from './generateJsFile.js';
+// Single definition of the client _js function prototype. Both the full build
+// (writeJs) and the dev server's per-page fold (getPageJitEnrichment) generate
+// client jsMap module text through here, so the destructured argument list has
+// exactly one source of truth.
+const CLIENT_JS_FUNCTION_PROTOTYPE = `{ actions, args, event, input, location, lowdefyApp, lowdefyGlobal, request, state, urlQuery, user }`;
+function generateClientJsModule(map) {
+    return generateJsFile({
+        map,
+        functionPrototype: CLIENT_JS_FUNCTION_PROTOTYPE
+    });
+}
+export default generateClientJsModule;

package/dist/build/buildJs/writeJs.js

@@ -12,12 +12,10 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import generateJsFile from './generateJsFile.js';
+*/ import generateClientJsModule from './generateClientJsModule.js';
+import generateJsFile from './generateJsFile.js';
 async function writeJs({ context }) {
-    await context.writeBuildArtifact('plugins/operators/clientJsMap.js', generateJsFile({
-        map: context.jsMap.client,
-        functionPrototype: `{ actions, args, event, input, location, lowdefyApp, lowdefyGlobal, request, state, urlQuery, user }`
-    }));
+    await context.writeBuildArtifact('plugins/operators/clientJsMap.js', generateClientJsModule(context.jsMap.client));
     await context.writeBuildArtifact('plugins/operators/serverJsMap.js', generateJsFile({
         map: context.jsMap.server,
         functionPrototype: `{ args, item, lowdefyApp, payload, secret, state, step, user }`

package/dist/build/buildMcp.js

@@ -0,0 +1,73 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ /* eslint-disable no-param-reassign */ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+// Validates the mcp block and writes its defaults. Endpoints are matched via
+// the same dual id/endpointId match buildApi uses. Referenced endpoints must
+// carry the metadata an MCP client needs: a description and a payloadSchema
+// (the tool inputSchema).
+function buildMcp({ components }) {
+    if (type.isNone(components.mcp)) {
+        components.mcp = {};
+    }
+    const mcp = components.mcp;
+    const configKey = mcp['~k'] ?? components['~k'];
+    // Agent tools were removed from mcp; schema validation only warns on
+    // unknown properties, so a leftover "agents" key would otherwise build
+    // silently instead of surfacing the removal.
+    if (!type.isNone(mcp.agents)) {
+        throw new ConfigError('MCP agent tools are not supported. Remove "mcp.agents" from your config.', {
+            configKey
+        });
+    }
+    mcp.name = mcp.name ?? 'lowdefy';
+    mcp.version = mcp.version ?? '1.0.0';
+    mcp.endpoints = mcp.endpoints ?? [];
+    mcp.configured = mcp.endpoints.length > 0;
+    const seen = new Set();
+    mcp.endpoints.forEach((endpointId)=>{
+        if (seen.has(endpointId)) {
+            throw new ConfigError(`Duplicate MCP tool "${endpointId}".`, {
+                configKey
+            });
+        }
+        seen.add(endpointId);
+        const endpoint = (components.api ?? []).find((e)=>e.id === endpointId || e.endpointId === endpointId);
+        if (type.isNone(endpoint)) {
+            throw new ConfigError(`MCP endpoint "${endpointId}" does not reference a defined api endpoint.`, {
+                configKey
+            });
+        }
+        // MCP is an external transport - InternalApi endpoints are not addressable
+        // from outside the server, matching the HTTP endpoint route.
+        if (endpoint.type === 'InternalApi') {
+            throw new ConfigError(`MCP endpoint "${endpointId}" is an InternalApi endpoint. Only "Api" endpoints can be exposed as MCP tools.`, {
+                configKey
+            });
+        }
+        if (type.isNone(endpoint.description)) {
+            throw new ConfigError(`Endpoint "${endpointId}" is exposed as an MCP tool but does not have a "description".`, {
+                configKey: endpoint['~k'] ?? configKey
+            });
+        }
+        if (type.isNone(endpoint.payloadSchema)) {
+            throw new ConfigError(`Endpoint "${endpointId}" is exposed as an MCP tool but does not have a "payloadSchema".`, {
+                configKey: endpoint['~k'] ?? configKey
+            });
+        }
+    });
+    return components;
+}
+export default buildMcp;