@lowdefy/build 5.5.1 → 6.0.0

package/dist/build/buildPages/buildBlock/buildEvents.js

@@ -12,7 +12,7 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { type } from '@lowdefy/helpers';
+*/ import { isReserved, type } from '@lowdefy/helpers';
 import { ConfigError, ConfigWarning } from '@lowdefy/errors';
 import createCheckDuplicateId from '../../../utils/createCheckDuplicateId.js';
 const BROWSER_DEFAULT_SHORTCUTS = new Set([
@@ -23,7 +23,43 @@ const BROWSER_DEFAULT_SHORTCUTS = new Set([
     'mod+q',
     'mod+l'
 ]);
-function checkAction(action, { blockId, callApiActionRefs, checkDuplicateActionId, eventId, linkActionRefs, pageId, requestActionRefs, typeCounters }) {
+const CONTROL_KEYS = [
+    ':if',
+    ':switch',
+    ':return'
+];
+const ACTION_KEYS_NOT_ALLOWED_ON_CONTROLS = [
+    'id',
+    'skip',
+    'messages'
+];
+const CONTROL_ALLOWED_KEYS = {
+    ':if': [
+        ':if',
+        ':then',
+        ':else'
+    ],
+    ':return': [
+        ':return'
+    ],
+    ':switch': [
+        ':switch',
+        ':default'
+    ]
+};
+const CASE_ALLOWED_KEYS = [
+    ':case',
+    ':then'
+];
+// '~'-prefixed keys are build meta markers (~k, ~r, ~l, ~ignoreBuildChecks) and
+// never user config - tolerate them by prefix, as the rest of the build does.
+function isMetaKey(key) {
+    return key.startsWith('~');
+}
+function isControl(item) {
+    return type.isObject(item) && CONTROL_KEYS.some((key)=>key in item);
+}
+function checkAction(action, { blockId, callApiActionRefs, checkDuplicateActionId, eventId, linkActionRefs, pageId, requestActionRefs, typeCounters, websocketActionRefs }) {
     const configKey = action['~k'];
     if (type.isUndefined(action.id)) {
         throw new ConfigError(`Action id missing on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
@@ -108,6 +144,142 @@ function checkAction(action, { blockId, callApiActionRefs, checkDuplicateActionI
             });
         }
     }
+    // Collect static Subscribe/Unsubscribe/Publish action references for validation
+    if ([
+        'Subscribe',
+        'Unsubscribe'
+    ].includes(action.type) && type.isString(action.params)) {
+        (websocketActionRefs ?? []).push({
+            websocketId: action.params,
+            action,
+            actionType: action.type,
+            blockId,
+            eventId,
+            sourcePageId: pageId
+        });
+    }
+    if (action.type === 'Publish' && type.isObject(action.params) && type.isString(action.params.websocketId)) {
+        (websocketActionRefs ?? []).push({
+            websocketId: action.params.websocketId,
+            action,
+            actionType: action.type,
+            blockId,
+            eventId,
+            sourcePageId: pageId
+        });
+    }
+}
+function checkBranchList({ list, listName, configKey }, ctx) {
+    const { blockId, eventId, pageId } = ctx;
+    if (!type.isArray(list)) {
+        throw new ConfigError(`Control "${listName}" must be an array on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
+            received: list,
+            configKey
+        });
+    }
+    checkActionList(list, ctx);
+}
+function checkControl(control, ctx) {
+    const { blockId, eventId, pageId } = ctx;
+    const configKey = control['~k'];
+    const controlKeys = CONTROL_KEYS.filter((key)=>key in control);
+    if (controlKeys.length > 1) {
+        const keyList = controlKeys.map((key)=>`"${key}"`).join(', ');
+        throw new ConfigError(`Control has more than one control key (${keyList}) on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
+            received: controlKeys,
+            configKey
+        });
+    }
+    const [controlKey] = controlKeys;
+    const invalidKeys = Object.keys(control).filter((key)=>!CONTROL_ALLOWED_KEYS[controlKey].includes(key) && !isMetaKey(key));
+    if (invalidKeys.length > 0) {
+        // Action keys do nothing on a control - call out the likely mistake directly.
+        if (ACTION_KEYS_NOT_ALLOWED_ON_CONTROLS.includes(invalidKeys[0])) {
+            throw new ConfigError(`Control "${controlKey}" can not have action property "${invalidKeys[0]}" on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
+                received: invalidKeys,
+                configKey
+            });
+        }
+        throw new ConfigError(`Control "${controlKey}" has invalid key "${invalidKeys[0]}" on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
+            received: invalidKeys,
+            configKey
+        });
+    }
+    if (controlKey === ':if') {
+        if (type.isNone(control[':then'])) {
+            throw new ConfigError(`Control ":if" requires a ":then" list on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
+                configKey
+            });
+        }
+        checkBranchList({
+            list: control[':then'],
+            listName: ':then',
+            configKey
+        }, ctx);
+        if (!type.isNone(control[':else'])) {
+            checkBranchList({
+                list: control[':else'],
+                listName: ':else',
+                configKey
+            }, ctx);
+        }
+    }
+    if (controlKey === ':switch') {
+        if (!type.isArray(control[':switch'])) {
+            throw new ConfigError(`Control ":switch" must be an array of case objects on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
+                received: control[':switch'],
+                configKey
+            });
+        }
+        control[':switch'].forEach((caseObject)=>{
+            if (!type.isObject(caseObject)) {
+                throw new ConfigError(`Control ":switch" case must be an object on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
+                    received: caseObject,
+                    configKey
+                });
+            }
+            const caseConfigKey = caseObject['~k'] ?? configKey;
+            if (!(':case' in caseObject)) {
+                throw new ConfigError(`Control ":switch" case requires a ":case" condition on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
+                    configKey: caseConfigKey
+                });
+            }
+            if (type.isNone(caseObject[':then'])) {
+                throw new ConfigError(`Control ":case" requires a ":then" list on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
+                    configKey: caseConfigKey
+                });
+            }
+            const invalidCaseKeys = Object.keys(caseObject).filter((key)=>!CASE_ALLOWED_KEYS.includes(key) && !isMetaKey(key));
+            if (invalidCaseKeys.length > 0) {
+                throw new ConfigError(`Control ":switch" case has invalid key "${invalidCaseKeys[0]}" on event "${eventId}" on block "${blockId}" on page "${pageId}".`, {
+                    received: invalidCaseKeys,
+                    configKey: caseConfigKey
+                });
+            }
+            checkBranchList({
+                list: caseObject[':then'],
+                listName: ':then',
+                configKey: caseConfigKey
+            }, ctx);
+        });
+        if (!type.isNone(control[':default'])) {
+            checkBranchList({
+                list: control[':default'],
+                listName: ':default',
+                configKey
+            }, ctx);
+        }
+    }
+// ':return' takes a value, not a list - nothing more to validate.
+}
+function checkActionList(list, ctx) {
+    list.forEach((item)=>{
+        if (isControl(item)) {
+            checkControl(item, ctx);
+        } else {
+            checkAction(item, ctx);
+        }
+    });
 }
 function buildEvents(block, pageContext) {
     if (block.events) {
@@ -143,26 +315,19 @@ function buildEvents(block, pageContext) {
             const checkDuplicateActionId = createCheckDuplicateId({
                 message: 'Duplicate actionId "{{ id }}" on event "{{ eventId }}" on block "{{ blockId }}" on page "{{ pageId }}".'
             });
-            block.events[key].try.map((action)=>checkAction(action, {
-                    eventId: key,
-                    blockId: block.blockId,
-                    callApiActionRefs: pageContext.callApiActionRefs,
-                    typeCounters: pageContext.typeCounters,
-                    pageId: pageContext.pageId,
-                    linkActionRefs: pageContext.linkActionRefs,
-                    requestActionRefs: pageContext.requestActionRefs,
-                    checkDuplicateActionId
-                }));
-            block.events[key].catch.map((action)=>checkAction(action, {
-                    eventId: key,
-                    blockId: block.blockId,
-                    callApiActionRefs: pageContext.callApiActionRefs,
-                    typeCounters: pageContext.typeCounters,
-                    pageId: pageContext.pageId,
-                    linkActionRefs: pageContext.linkActionRefs,
-                    requestActionRefs: pageContext.requestActionRefs,
-                    checkDuplicateActionId
-                }));
+            const actionContext = {
+                eventId: key,
+                blockId: block.blockId,
+                callApiActionRefs: pageContext.callApiActionRefs,
+                typeCounters: pageContext.typeCounters,
+                pageId: pageContext.pageId,
+                linkActionRefs: pageContext.linkActionRefs,
+                requestActionRefs: pageContext.requestActionRefs,
+                websocketActionRefs: pageContext.websocketActionRefs,
+                checkDuplicateActionId
+            };
+            checkActionList(block.events[key].try, actionContext);
+            checkActionList(block.events[key].catch, actionContext);
             // Validate shortcut strings and collect refs for duplicate detection
             if (type.isObject(block.events[key]) && !type.isNone(block.events[key].shortcut)) {
                 const shortcuts = type.isArray(block.events[key].shortcut) ? block.events[key].shortcut : [
@@ -175,6 +340,16 @@ function buildEvents(block, pageContext) {
                             configKey: eventConfigKey
                         });
                     }
+                    // The client's shortcut manager keys a plain object by the normalized
+                    // shortcut. Normalization neither creates nor removes a reserved name:
+                    // multi-character key names pass through unchanged, and no reserved
+                    // name is a single character. So checking the raw string is enough, and
+                    // a modified form like "Ctrl+__proto__" stays valid.
+                    if (isReserved(shortcut)) {
+                        throw new ConfigError(`Event shortcut "${shortcut}" on event "${key}" on block "${block.blockId}" on page "${pageContext.pageId}" is a reserved name and cannot be used as a shortcut.`, {
+                            configKey: eventConfigKey
+                        });
+                    }
                     if (BROWSER_DEFAULT_SHORTCUTS.has(shortcut.toLowerCase())) {
                         pageContext.context.handleWarning(new ConfigWarning(`Shortcut "${shortcut}" on event "${key}" on block "${block.blockId}" on page "${pageContext.pageId}" conflicts with a browser default.`, {
                             configKey: eventConfigKey

package/dist/build/buildPages/buildBlock/buildRequests.js

@@ -75,6 +75,15 @@ function buildRequest(request, pageContext) {
     pageContext.requests.push(request);
 }
 function buildRequests(block, pageContext) {
+    // Runtime-resolved dynamic content cannot define requests — request
+    // artifacts are written at build time, so a runtime request would have no
+    // server-side properties to execute.
+    if (pageContext.forbidRequests === true && !type.isNone(block.requests)) {
+        throw new ConfigError(`Dynamic content must not define requests — found "requests" on block "${block.blockId}" on page "${pageContext.pageId}". Reference requests defined statically on the page instead.`, {
+            received: block.requests,
+            configKey: block['~k']
+        });
+    }
     (block.requests || []).forEach((request)=>{
         buildRequest(request, pageContext);
     });

package/dist/build/buildPages/buildBlock/normalizeClassAndStyles.js

@@ -12,7 +12,7 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { type } from '@lowdefy/helpers';
+*/ import { getOperatorType, type } from '@lowdefy/helpers';
 import { ConfigError } from '@lowdefy/errors';
 const breakpointKeys = new Set([
     'xs',
@@ -22,17 +22,8 @@ const breakpointKeys = new Set([
     'xl',
     '2xl'
 ]);
-// Keys that look like operators (single key starting with _) but are not.
-const KNOWN_NON_OPERATORS = new Set([
-    '_id'
-]);
 function isOperator(value) {
-    const nonTildeKeys = Object.keys(value).filter((k)=>!k.startsWith('~'));
-    if (nonTildeKeys.length !== 1) return false;
-    const key = nonTildeKeys[0];
-    const [op] = key.split('.');
-    const operator = op.replace(/^(_+)/gm, '_');
-    return operator.length > 1 && operator[0] === '_' && !KNOWN_NON_OPERATORS.has(operator);
+    return getOperatorType(value) !== null;
 }
 function stripDotPrefix(key) {
     return key.startsWith('.') ? key.slice(1) : key;

package/dist/build/buildPages/buildBlock/setBlockId.js

@@ -13,14 +13,17 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { ConfigError } from '@lowdefy/errors';
-function setBlockId(block, { pageId, blockIdCounter }) {
+function setBlockId(block, { pageId, blockIdCounter, blockIdPrefix }) {
     block.blockId = block.id;
     if (block.blockId === pageId && blockIdCounter.getCount(block.blockId) > 0) {
         throw new ConfigError(`Block id "${block.blockId}" on page "${pageId}" collides with the page id. A block cannot have the same id as its page.`, {
             configKey: block['~k']
         });
     }
-    block.id = `block:${pageId}:${block.blockId}:${blockIdCounter.getCount(block.blockId)}`;
+    // blockIdPrefix namespaces runtime-built dynamic content ids under the
+    // resolving Dynamic block's id so they can never collide with static ids.
+    const prefix = blockIdPrefix ?? `block:${pageId}`;
+    block.id = `${prefix}:${block.blockId}:${blockIdCounter.getCount(block.blockId)}`;
     blockIdCounter.increment(block.blockId);
 }
 export default setBlockId;

package/dist/build/buildPages/buildBlock/validateBlock.js

@@ -12,7 +12,7 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { type } from '@lowdefy/helpers';
+*/ import { isReserved, splitPath, type } from '@lowdefy/helpers';
 import { ConfigError } from '@lowdefy/errors';
 function validateBlock(block, { pageId }, parentConfigKey) {
     const configKey = block?.['~k'] ?? parentConfigKey;
@@ -33,6 +33,17 @@ function validateBlock(block, { pageId }, parentConfigKey) {
             configKey
         });
     }
+    // Block ids are dot-paths that nest state, so they bypass validateId's shape gate. Every segment
+    // still becomes an object key on the way through get/set, so check per segment: a block
+    // `id: a.constructor.b` would reach `get` with a reserved segment and throw mid-render, which
+    // ErrorBoundary cannot catch because the throw happens during the render that would mount it.
+    const reservedSegment = splitPath(block.id).find(isReserved);
+    if (!type.isNone(reservedSegment)) {
+        throw new ConfigError(`Block id "${block.id}" uses reserved name "${reservedSegment}" as a path segment, at page "${pageId}".`, {
+            received: block.id,
+            configKey
+        });
+    }
     if (type.isNone(block.type)) {
         throw new ConfigError(`Block type is not defined at "${block.id}" on page "${pageId}".`, {
             configKey
@@ -52,5 +63,12 @@ function validateBlock(block, { pageId }, parentConfigKey) {
             });
         }
     }
+    // Page subscriptions are extracted before block building — any subscriptions
+    // key reaching here is defined on a nested block, where it has no effect.
+    if (!type.isNone(block.subscriptions)) {
+        throw new ConfigError(`Subscriptions are only allowed on the page, not on block "${block.id}" on page "${pageId}".`, {
+            configKey
+        });
+    }
 }
 export default validateBlock;

package/dist/build/buildPages/buildPage.js

@@ -15,6 +15,7 @@
 */ import { type } from '@lowdefy/helpers';
 import { ConfigError, ConfigWarning } from '@lowdefy/errors';
 import buildBlock from './buildBlock/buildBlock.js';
+import buildSubscriptions from './buildSubscriptions.js';
 import collectExceptions from '../../utils/collectExceptions.js';
 import createCheckDuplicateId from '../../utils/createCheckDuplicateId.js';
 import validateId from '../../utils/validateId.js';
@@ -54,10 +55,16 @@ function buildPage({ page, index, context, checkDuplicatePageId }) {
     const requests = [];
     const requestActionRefs = [];
     const shortcutRefs = [];
-    buildBlock(page, {
+    // Extract subscriptions before block building — validateBlock rejects the
+    // subscriptions key on nested blocks, so the page root must not carry it.
+    const subscriptions = page.subscriptions;
+    delete page.subscriptions;
+    const pageContext = {
         auth: page.auth,
         blockIdCounter: createCounter(),
         callApiActionRefs: context.callApiActionRefs ?? [],
+        websocketActionRefs: context.websocketActionRefs ?? [],
+        dynamicBlockRefs: context.dynamicBlockRefs ?? [],
         checkDuplicateRequestId: createCheckDuplicateId({
             message: 'Duplicate requestId "{{ id }}" on page "{{ pageId }}".'
         }),
@@ -68,9 +75,26 @@ function buildPage({ page, index, context, checkDuplicatePageId }) {
         shortcutRefs,
         linkActionRefs: context.linkActionRefs,
         typeCounters: context.typeCounters
-    });
+    };
+    buildBlock(page, pageContext);
     // set page.id since buildBlock sets id as well.
     page.id = `page:${page.pageId}`;
+    // Flag pages with Dynamic blocks so the server can skip resolution
+    // (and the deep copy it requires) for static pages with one property read.
+    if (pageContext.hasDynamicBlocks === true) {
+        page.dynamic = true;
+    }
+    page.subscriptions = subscriptions;
+    buildSubscriptions(page, {
+        callApiActionRefs: context.callApiActionRefs ?? [],
+        context,
+        linkActionRefs: context.linkActionRefs,
+        pageId: page.pageId,
+        requestActionRefs,
+        shortcutRefs,
+        typeCounters: context.typeCounters,
+        websocketActionRefs: context.websocketActionRefs ?? []
+    });
     // Validate that all Request actions reference defined requests
     validateRequestReferences({
         requestActionRefs,
@@ -79,7 +103,7 @@ function buildPage({ page, index, context, checkDuplicatePageId }) {
         context
     });
     // Warn on duplicate shortcuts within the page
-    const seenShortcuts = {};
+    const seenShortcuts = Object.create(null);
     shortcutRefs.forEach(({ shortcut, blockId, eventId, configKey })=>{
         if (seenShortcuts[shortcut]) {
             context.handleWarning(new ConfigWarning(`Duplicate shortcut "${shortcut}" on event "${eventId}" on block "${blockId}" on page "${page.pageId}" — already defined on block "${seenShortcuts[shortcut].blockId}".`, {

package/dist/build/buildPages/buildSubscriptions.js

@@ -0,0 +1,145 @@
+/* eslint-disable no-param-reassign */ /*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError, ConfigWarning } from '@lowdefy/errors';
+import buildEvents from './buildBlock/buildEvents.js';
+import countOperators from '../../utils/countOperators.js';
+import createCheckDuplicateId from '../../utils/createCheckDuplicateId.js';
+const SUBSCRIPTION_EVENTS = [
+    'onMessage',
+    'onSubscribe',
+    'onError'
+];
+const DEFAULT_MAX_MESSAGES = 100;
+const DEFAULT_THROTTLE_RENDER = 250;
+const MIN_THROTTLE_RENDER = 100;
+function buildSubscription({ subscription, pageContext }) {
+    const { context, pageId } = pageContext;
+    const configKey = subscription['~k'];
+    if (type.isUndefined(subscription.websocketId)) {
+        throw new ConfigError(`Subscription websocketId missing at page "${pageId}".`, {
+            configKey
+        });
+    }
+    if (!type.isString(subscription.websocketId)) {
+        throw new ConfigError(`Subscription websocketId is not a string at page "${pageId}".`, {
+            received: subscription.websocketId,
+            configKey
+        });
+    }
+    pageContext.checkDuplicateSubscriptionId({
+        id: subscription.websocketId,
+        configKey,
+        pageId
+    });
+    if (!context.websocketIds.has(subscription.websocketId)) {
+        throw new ConfigError(`Subscription "${subscription.websocketId}" at page "${pageId}" references a websocket which does not exist.`, {
+            configKey
+        });
+    }
+    if (type.isNone(subscription.payload)) {
+        subscription.payload = {};
+    }
+    if (!type.isObject(subscription.payload)) {
+        throw new ConfigError(`Subscription "${subscription.websocketId}" at page "${pageId}" payload should be an object.`, {
+            received: subscription.payload,
+            configKey
+        });
+    }
+    if (type.isNone(subscription.client)) {
+        subscription.client = {};
+    }
+    if (!type.isObject(subscription.client)) {
+        throw new ConfigError(`Subscription "${subscription.websocketId}" at page "${pageId}" client should be an object.`, {
+            received: subscription.client,
+            configKey
+        });
+    }
+    if (type.isNone(subscription.client.maxMessages)) {
+        subscription.client.maxMessages = DEFAULT_MAX_MESSAGES;
+    }
+    if (!type.isInt(subscription.client.maxMessages) || subscription.client.maxMessages < 1) {
+        throw new ConfigError(`Subscription "${subscription.websocketId}" at page "${pageId}" client.maxMessages should be a positive integer.`, {
+            received: subscription.client.maxMessages,
+            configKey
+        });
+    }
+    if (type.isNone(subscription.client.throttleRender)) {
+        subscription.client.throttleRender = DEFAULT_THROTTLE_RENDER;
+    }
+    if (!type.isNumber(subscription.client.throttleRender)) {
+        throw new ConfigError(`Subscription "${subscription.websocketId}" at page "${pageId}" client.throttleRender should be a number.`, {
+            received: subscription.client.throttleRender,
+            configKey
+        });
+    }
+    if (subscription.client.throttleRender < MIN_THROTTLE_RENDER) {
+        context.handleWarning(new ConfigWarning(`Subscription "${subscription.websocketId}" at page "${pageId}" client.throttleRender is below the minimum of ${MIN_THROTTLE_RENDER}ms and will be clamped.`, {
+            configKey
+        }));
+        subscription.client.throttleRender = MIN_THROTTLE_RENDER;
+    }
+    if (type.isNone(subscription.events)) {
+        subscription.events = {};
+    }
+    Object.keys(subscription.events).forEach((eventName)=>{
+        if (eventName.startsWith('~')) return;
+        if (!SUBSCRIPTION_EVENTS.includes(eventName)) {
+            context.handleWarning(new ConfigWarning(`Subscription "${subscription.websocketId}" at page "${pageId}" has event "${eventName}" which will never fire. Supported events: ${SUBSCRIPTION_EVENTS.join(', ')}.`, {
+                configKey: subscription.events[eventName]?.['~k'] ?? configKey
+            }));
+        }
+    });
+    // Reuse the block event builder — normalizes actions to { try, catch },
+    // validates action ids, counts action types, and collects Request action
+    // refs so subscription events can trigger page requests.
+    buildEvents({
+        blockId: `subscription:${subscription.websocketId}`,
+        events: subscription.events,
+        '~k': configKey
+    }, pageContext);
+    // Subscriptions are extracted from the page before buildBlock runs, so
+    // countBlockOperators never sees them — count client operators here.
+    // Payload and event action params are both evaluated client-side.
+    countOperators({
+        events: subscription.events,
+        payload: subscription.payload
+    }, {
+        counter: pageContext.typeCounters.operators.client
+    });
+    subscription.pageId = pageId;
+    subscription.id = `subscription:${pageId}:${subscription.websocketId}`;
+}
+function buildSubscriptions(page, pageContext) {
+    if (type.isNone(page.subscriptions)) {
+        page.subscriptions = [];
+    }
+    if (!type.isArray(page.subscriptions)) {
+        throw new ConfigError(`Subscriptions is not an array at page "${pageContext.pageId}".`, {
+            received: page.subscriptions,
+            configKey: page['~k']
+        });
+    }
+    pageContext.checkDuplicateSubscriptionId = createCheckDuplicateId({
+        message: 'Duplicate subscription "{{ id }}" on page "{{ pageId }}".'
+    });
+    page.subscriptions.forEach((subscription)=>{
+        buildSubscription({
+            subscription,
+            pageContext
+        });
+    });
+}
+export default buildSubscriptions;

package/dist/build/buildPages/validateDynamicBlockRefs.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ConfigWarning } from '@lowdefy/errors';
+function validateDynamicBlockRefs({ dynamicBlockRefs, endpointConfigs, context }) {
+    // Both Api and InternalApi endpoints are valid — resolution is an in-process
+    // call, so InternalApi is the recommended resolver type.
+    const existingEndpointIds = new Set(endpointConfigs.map((config)=>config.endpointId));
+    dynamicBlockRefs.forEach(({ endpointId, block, sourcePageId })=>{
+        if (!existingEndpointIds.has(endpointId)) {
+            context.handleWarning(new ConfigWarning(`Dynamic block "${block.blockId}" on page "${sourcePageId}" references non-existent endpoint "${endpointId}".`, {
+                configKey: block['~k'],
+                prodError: true,
+                checkSlug: 'dynamic-endpoint-refs'
+            }));
+        }
+    });
+}
+export default validateDynamicBlockRefs;

package/dist/build/buildPages/validateStateReferences.js

@@ -68,10 +68,12 @@ function validateStateReferences({ page, context }) {
     stateRefs.forEach((configKey, topLevelKey)=>{
         // Skip if state key is from an input block or SetState action
         if (blockIds.has(topLevelKey) || setStateKeys.has(topLevelKey)) return;
-        const message = `_state references "${topLevelKey}" on page "${page.pageId}", ` + `but no input block with id "${topLevelKey}" exists on this page. ` + `State keys are created from input block ids. ` + `Check for typos, add an input block with this id, or initialize the state with SetState.`;
+        const message = `_state references "${topLevelKey}" on page "${page.pageId}", ` + `but no input block with id "${topLevelKey}" exists on this page. ` + `State keys are created from input block ids. ` + `Check for typos, add an input block with this id, or initialize the state with SetState. ` + `If the state is set at runtime (for example by a custom action calling setState), ` + `suppress this check with "~ignoreBuildChecks: [state-refs]" on the reference.`;
+        // This check is a heuristic: state written at runtime — custom actions
+        // calling setState, dynamic SetState wrappers — is statically invisible,
+        // so a miss here must never fail a production build (no prodError).
         context.handleWarning(new ConfigWarning(message, {
             configKey,
-            prodError: true,
             checkSlug: 'state-refs'
         }));
     });

package/dist/build/buildPages/validateWebsocketRefs.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ConfigWarning } from '@lowdefy/errors';
+function validateWebsocketRefs({ websocketActionRefs, websocketIds, context }) {
+    websocketActionRefs.forEach(({ websocketId, action, actionType, sourcePageId })=>{
+        if (action.skip === true) {
+            return;
+        }
+        if (!websocketIds.has(websocketId)) {
+            context.handleWarning(new ConfigWarning(`${actionType} action on page "${sourcePageId}" references non-existent websocket "${websocketId}".`, {
+                configKey: action['~k'],
+                prodError: true,
+                checkSlug: 'websocket-refs'
+            }));
+        }
+    });
+}
+export default validateWebsocketRefs;