@lowdefy/build 5.6.0 → 6.0.0

package/dist/build/buildAgents.js

@@ -19,6 +19,8 @@ import { ConfigError, ConfigWarning } from '@lowdefy/errors';
 import { RESERVED_PLATFORM_TOOL_NAMES } from '@lowdefy/ai-utils';
 import countOperators from '../utils/countOperators.js';
 import createCheckDuplicateId from '../utils/createCheckDuplicateId.js';
+// Provider tool-name rule (Anthropic and OpenAI both).
+const TOOL_NAME_REGEX = /^[a-zA-Z0-9_-]{1,64}$/;
 function detectCycles(agents) {
     const graph = {};
     for (const agent of agents){
@@ -101,13 +103,40 @@ function buildAgents({ components, context }) {
             }
             return tool;
         });
-        // Validate tools reference existing API endpoints with required tool metadata
+        // Assign LLM-safe tool names. Providers require ^[a-zA-Z0-9_-]{1,64}$ —
+        // module-scoped endpoint ids contain '/', so the default name replaces
+        // '/' with '__'; config may override with an explicit "name".
+        const toolNames = new Set();
         agent.tools.forEach((toolConfig)=>{
-            if (RESERVED_PLATFORM_TOOL_NAMES.includes(toolConfig.endpointId)) {
-                throw new ConfigError(`Agent "${agent.id}" tool "${toolConfig.endpointId}" uses a reserved platform tool name. Reserved: ${RESERVED_PLATFORM_TOOL_NAMES.join(', ')}.`, {
+            if (type.isNone(toolConfig.name)) {
+                toolConfig.name = toolConfig.endpointId.replaceAll('/', '__');
+            }
+            if (!TOOL_NAME_REGEX.test(toolConfig.name)) {
+                throw new ConfigError(`Agent "${agent.id}" tool name "${toolConfig.name}" is invalid. Tool names must match ^[a-zA-Z0-9_-]{1,64}$ — set "name" on the tool to override the default derived from the endpoint id.`, {
+                    configKey
+                });
+            }
+            // TOOL_NAME_REGEX admits every reserved name - letters and underscores are
+            // in its allowed set - and tool names key the plain-object tools map.
+            if (isReserved(toolConfig.name)) {
+                throw new ConfigError(`Agent "${agent.id}" tool name "${toolConfig.name}" is a reserved name and cannot be used as a tool name.`, {
                     configKey
                 });
             }
+            if (RESERVED_PLATFORM_TOOL_NAMES.includes(toolConfig.name)) {
+                throw new ConfigError(`Agent "${agent.id}" tool "${toolConfig.name}" uses a reserved platform tool name. Reserved: ${RESERVED_PLATFORM_TOOL_NAMES.join(', ')}.`, {
+                    configKey
+                });
+            }
+            if (toolNames.has(toolConfig.name)) {
+                throw new ConfigError(`Agent "${agent.id}" has duplicate tool name "${toolConfig.name}".`, {
+                    configKey
+                });
+            }
+            toolNames.add(toolConfig.name);
+        });
+        // Validate tools reference existing API endpoints with required tool metadata
+        agent.tools.forEach((toolConfig)=>{
             const endpoint = (components.api ?? []).find((e)=>e.id === toolConfig.endpointId || e.endpointId === toolConfig.endpointId);
             if (!endpoint) {
                 throw new ConfigError(`Agent "${agent.id}" references tool endpoint "${toolConfig.endpointId}" which does not exist.`, {
@@ -186,6 +215,35 @@ function buildAgents({ components, context }) {
             }
             return ref;
         });
+        // Sub-agents surface to the model as tools too — same naming rule.
+        agent.agents.forEach((ref)=>{
+            if (type.isNone(ref.name)) {
+                ref.name = ref.agentId.replaceAll('/', '__');
+            }
+            if (!TOOL_NAME_REGEX.test(ref.name)) {
+                throw new ConfigError(`Agent "${agent.id}" sub-agent tool name "${ref.name}" is invalid. Tool names must match ^[a-zA-Z0-9_-]{1,64}$ — set "name" on the sub-agent reference to override the default derived from the agent id.`, {
+                    configKey
+                });
+            }
+            // Runs on the derived name, so "a/__proto__" -> "a____proto__" is accepted
+            // while an explicit reserved "name" is not.
+            if (isReserved(ref.name)) {
+                throw new ConfigError(`Agent "${agent.id}" sub-agent tool name "${ref.name}" is a reserved name and cannot be used as a tool name.`, {
+                    configKey
+                });
+            }
+            if (RESERVED_PLATFORM_TOOL_NAMES.includes(ref.name)) {
+                throw new ConfigError(`Agent "${agent.id}" sub-agent "${ref.agentId}" uses a reserved platform tool name. Reserved: ${RESERVED_PLATFORM_TOOL_NAMES.join(', ')}.`, {
+                    configKey
+                });
+            }
+            if (toolNames.has(ref.name)) {
+                throw new ConfigError(`Agent "${agent.id}" sub-agent "${ref.agentId}" conflicts with an endpoint tool of the same name.`, {
+                    configKey
+                });
+            }
+            toolNames.add(ref.name);
+        });
         // Validate fileSystem basePath if present
         if (agent.properties?.fileSystem) {
             const basePath = agent.properties.fileSystem.basePath;
@@ -221,19 +279,6 @@ function buildAgents({ components, context }) {
                     configKey
                 });
             }
-            // Reserved platform tool name guard for sub-agents
-            if (RESERVED_PLATFORM_TOOL_NAMES.includes(subAgentRef.agentId)) {
-                throw new ConfigError(`Agent "${agent.agentId}" sub-agent "${subAgentRef.agentId}" uses a reserved platform tool name. Reserved: ${RESERVED_PLATFORM_TOOL_NAMES.join(', ')}.`, {
-                    configKey
-                });
-            }
-            // Check for name collision with endpoint tools
-            const hasToolCollision = agent.tools.some((toolConfig)=>toolConfig.endpointId === subAgentRef.agentId);
-            if (hasToolCollision) {
-                throw new ConfigError(`Agent "${agent.agentId}" sub-agent "${subAgentRef.agentId}" conflicts with an endpoint tool of the same name.`, {
-                    configKey
-                });
-            }
             // Warn if sub-agent has tools with confirm: true (unsupported in sub-agent context)
             const subAgent = components.agents.find((a)=>a.agentId === subAgentRef.agentId);
             const hasConfirmTools = (subAgent?.tools ?? []).some((t)=>t.confirm);

package/dist/build/buildApi/buildApi.js

@@ -26,6 +26,8 @@ function buildApi({ components, context }) {
     const checkDuplicateEndpointId = createCheckDuplicateId({
         message: 'Duplicate endpointId "{{ id }}".'
     });
+    // Validated by validateConfig, which runs before buildApi.
+    const cronEnvironments = components.config?.cron?.environments;
     // Wrap each endpoint build to collect errors instead of stopping on first error
     api.forEach((endpoint, index)=>{
         try {
@@ -33,7 +35,8 @@ function buildApi({ components, context }) {
                 endpoint,
                 index,
                 context,
-                checkDuplicateEndpointId
+                checkDuplicateEndpointId,
+                cronEnvironments
             });
         } catch (error) {
             // Skip suppressed ConfigErrors (via ~ignoreBuildChecks)

package/dist/build/buildApi/buildEndpoint.js

@@ -13,15 +13,21 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import buildRoutine from './buildRoutine/buildRoutine.js';
+import resolveEndpointSchedules from './resolveEndpointSchedules.js';
 import validateEndpoint from './validateEndpoint.js';
 import validateStepReferences from './validateStepReferences.js';
-function buildEndpoint({ endpoint, index, context, checkDuplicateEndpointId }) {
+function buildEndpoint({ endpoint, index, context, checkDuplicateEndpointId, cronEnvironments }) {
     validateEndpoint({
         endpoint,
         index,
-        checkDuplicateEndpointId
+        checkDuplicateEndpointId,
+        cronEnvironments
     });
     endpoint.endpointId = endpoint.id;
+    resolveEndpointSchedules({
+        endpoint,
+        cronEnvironments
+    });
     buildRoutine(endpoint.routine, {
         endpointId: endpoint.endpointId,
         typeCounters: context.typeCounters

package/dist/build/buildApi/buildRoutine/countStepTypes.js

@@ -13,7 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ function countStepTypes(step, { typeCounters }) {
-    if (step.type === 'CallApi' || step.type === 'ValidateSchema') {
+    if (step.type === 'CallAgent' || step.type === 'CallApi' || step.type === 'RenderNotification' || step.type === 'ValidateSchema') {
         return;
     }
     typeCounters.requests.increment(step.type, step['~k']);

package/dist/build/buildApi/buildRoutine/setStepId.js

@@ -13,7 +13,9 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ const prefixByType = {
+    CallAgent: 'agent',
     CallApi: 'endpoint',
+    RenderNotification: 'notification',
     ValidateSchema: 'validate'
 };
 function setStepId(step, { endpointId }) {

package/dist/build/buildApi/buildRoutine/validateStep.js

@@ -69,6 +69,67 @@ function validateStep(step, { endpointId }) {
         }
         return;
     }
+    if (step.type === 'CallAgent') {
+        if (type.isNone(step.properties?.agentId)) {
+            throw new ConfigError(`CallAgent step "${step.id}" at endpoint "${endpointId}" requires properties.agentId.`, {
+                configKey
+            });
+        }
+        if (!type.isString(step.properties.agentId) && !type.isObject(step.properties.agentId)) {
+            throw new ConfigError(`CallAgent step "${step.id}" at endpoint "${endpointId}" properties.agentId is not a string.`, {
+                received: step.properties.agentId,
+                configKey
+            });
+        }
+        if (type.isNone(step.properties?.prompt)) {
+            throw new ConfigError(`CallAgent step "${step.id}" at endpoint "${endpointId}" requires properties.prompt.`, {
+                configKey
+            });
+        }
+        if (!type.isString(step.properties.prompt) && !type.isObject(step.properties.prompt)) {
+            throw new ConfigError(`CallAgent step "${step.id}" at endpoint "${endpointId}" properties.prompt is not a string.`, {
+                received: step.properties.prompt,
+                configKey
+            });
+        }
+        if (!type.isNone(step.connectionId)) {
+            throw new ConfigError(`CallAgent step "${step.id}" at endpoint "${endpointId}" should not have a connectionId.`, {
+                configKey
+            });
+        }
+        return;
+    }
+    if (step.type === 'RenderNotification') {
+        if (type.isNone(step.properties?.notificationId)) {
+            throw new ConfigError(`RenderNotification step "${step.id}" at endpoint "${endpointId}" requires properties.notificationId.`, {
+                configKey
+            });
+        }
+        if (!type.isString(step.properties.notificationId) && !type.isObject(step.properties.notificationId)) {
+            throw new ConfigError(`RenderNotification step "${step.id}" at endpoint "${endpointId}" properties.notificationId is not a string.`, {
+                received: step.properties.notificationId,
+                configKey
+            });
+        }
+        if (type.isNone(step.properties?.data)) {
+            throw new ConfigError(`RenderNotification step "${step.id}" at endpoint "${endpointId}" requires properties.data.`, {
+                configKey
+            });
+        }
+        // One item per render — arrays are iterated with a :for control in the routine.
+        if (!type.isObject(step.properties.data)) {
+            throw new ConfigError(`RenderNotification step "${step.id}" at endpoint "${endpointId}" properties.data is not an object.`, {
+                received: step.properties.data,
+                configKey
+            });
+        }
+        if (!type.isNone(step.connectionId)) {
+            throw new ConfigError(`RenderNotification step "${step.id}" at endpoint "${endpointId}" should not have a connectionId.`, {
+                configKey
+            });
+        }
+        return;
+    }
     if (step.type === 'ValidateSchema') {
         if (type.isNone(step.properties?.schema)) {
             throw new ConfigError(`ValidateSchema step "${step.id}" at endpoint "${endpointId}" requires properties.schema.`, {

package/dist/build/buildApi/resolveEndpointSchedules.js

@@ -0,0 +1,37 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import getCronEnvironmentNames from '../../utils/getCronEnvironmentNames.js';
+// With config.cron.environments declared, the artifact carries `schedules` as an object with one
+// explicit list per declared environment: the environment's own entry when the author keyed the
+// schedules by environment, else the `default` entry, else nothing (`[]` turns the crons off). An
+// array applies as-is to every environment. The runtime and the schedules manifest then read
+// `schedules.<environment>` without repeating the inheritance. Without config.cron the endpoint
+// keeps its array.
+function resolveEndpointSchedules({ endpoint, cronEnvironments }) {
+    const names = getCronEnvironmentNames(cronEnvironments);
+    if (names.length === 0 || type.isUndefined(endpoint.schedules)) return;
+    const authored = endpoint.schedules;
+    const resolved = {};
+    names.forEach((name)=>{
+        if (type.isArray(authored)) {
+            resolved[name] = authored;
+            return;
+        }
+        resolved[name] = authored[name] ?? authored.default ?? [];
+    });
+    endpoint.schedules = resolved;
+}
+export default resolveEndpointSchedules;

package/dist/build/buildApi/validateEndpoint.js

@@ -15,7 +15,89 @@
 */ import { type } from '@lowdefy/helpers';
 import { ConfigError } from '@lowdefy/errors';
 import validateId from '../../utils/validateId.js';
-function validateEndpoint({ endpoint, index, checkDuplicateEndpointId }) {
+import validateCronExpression from '../../utils/validateCronExpression.js';
+import getCronEnvironmentNames from '../../utils/getCronEnvironmentNames.js';
+// `where` names the schedules list in messages: "" for the endpoint's own schedules, or
+// ` for environment "staging"` for an override.
+function validateSchedules({ schedules, endpoint, configKey, where = '' }) {
+    if (type.isUndefined(schedules)) return;
+    if (!type.isArray(schedules)) {
+        throw new ConfigError(`Endpoint schedules${where} is not an array${where ? '' : ' or an object keyed by environment'} at "${endpoint.id}".`, {
+            received: schedules,
+            configKey
+        });
+    }
+    const seenCrons = new Set();
+    schedules.forEach((schedule, scheduleIndex)=>{
+        if (!type.isObject(schedule)) {
+            throw new ConfigError(`Endpoint schedule ${scheduleIndex}${where} is not an object at "${endpoint.id}".`, {
+                received: schedule,
+                configKey
+            });
+        }
+        if (!type.isString(schedule.cron)) {
+            throw new ConfigError(`Endpoint schedule ${scheduleIndex}${where} cron is not a string at "${endpoint.id}".`, {
+                received: schedule.cron,
+                configKey
+            });
+        }
+        const reason = validateCronExpression(schedule.cron);
+        if (reason) {
+            throw new ConfigError(`Endpoint schedule ${scheduleIndex}${where} cron "${schedule.cron}" is invalid at "${endpoint.id}": ${reason}.`, {
+                received: schedule.cron,
+                configKey
+            });
+        }
+        // The x-vercel-cron-schedule header disambiguates which schedule fired at runtime, so an
+        // endpoint's cron expressions must be unique within one environment.
+        if (seenCrons.has(schedule.cron)) {
+            throw new ConfigError(`Endpoint schedule ${scheduleIndex}${where} has duplicate cron "${schedule.cron}" at "${endpoint.id}".`, {
+                received: schedule.cron,
+                configKey
+            });
+        }
+        seenCrons.add(schedule.cron);
+        if (!type.isUndefined(schedule.payload) && !type.isObject(schedule.payload)) {
+            throw new ConfigError(`Endpoint schedule ${scheduleIndex}${where} payload is not an object at "${endpoint.id}".`, {
+                received: schedule.payload,
+                configKey
+            });
+        }
+    });
+}
+// The object form of `schedules`: lists keyed by environment name plus an optional `default` the
+// other environments inherit. Every key must be declared in config.cron.environments, so a typo
+// cannot silently leave an environment on the defaults.
+function validateEnvironmentSchedules({ endpoint, configKey, cronEnvironments }) {
+    const declared = getCronEnvironmentNames(cronEnvironments);
+    if (declared.length === 0) {
+        throw new ConfigError(`Endpoint "${endpoint.id}" keys schedules by environment but lowdefy.config.cron.environments is not defined.`, {
+            configKey
+        });
+    }
+    getCronEnvironmentNames(endpoint.schedules).forEach((name)=>{
+        if (name !== 'default' && !declared.includes(name)) {
+            throw new ConfigError(`Endpoint schedules environment "${name}" at "${endpoint.id}" is not declared in lowdefy.config.cron.environments. Declared environments: ${declared.join(', ')}.`, {
+                configKey
+            });
+        }
+        const schedules = endpoint.schedules[name];
+        const where = ` for environment "${name}"`;
+        if (!type.isArray(schedules)) {
+            throw new ConfigError(`Endpoint schedules${where} is not an array at "${endpoint.id}".`, {
+                received: schedules,
+                configKey
+            });
+        }
+        validateSchedules({
+            schedules,
+            endpoint,
+            configKey,
+            where
+        });
+    });
+}
+function validateEndpoint({ endpoint, index, checkDuplicateEndpointId, cronEnvironments }) {
     const configKey = endpoint['~k'];
     if (type.isUndefined(endpoint.id)) {
         throw new ConfigError(`Endpoint id missing at endpoint ${index}.`, {
@@ -58,5 +140,18 @@ function validateEndpoint({ endpoint, index, checkDuplicateEndpointId }) {
         id: endpoint.id,
         configKey
     });
+    if (type.isObject(endpoint.schedules)) {
+        validateEnvironmentSchedules({
+            endpoint,
+            configKey,
+            cronEnvironments
+        });
+    } else {
+        validateSchedules({
+            schedules: endpoint.schedules,
+            endpoint,
+            configKey
+        });
+    }
 }
 export default validateEndpoint;

package/dist/build/buildApp.js

@@ -12,17 +12,7 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { execSync } from 'child_process';
-import { type } from '@lowdefy/helpers';
-function computeGitSha() {
-    const fromEnv = process.env.LOWDEFY_GIT_SHA?.trim();
-    if (fromEnv) return fromEnv;
-    try {
-        return execSync('git rev-parse HEAD').toString().trim();
-    } catch (_) {
-        return null;
-    }
-}
+*/ import { type } from '@lowdefy/helpers';
 function buildApp({ components }) {
     if (type.isNone(components.app)) {
         components.app = {};
@@ -39,15 +29,18 @@ function buildApp({ components }) {
     if (type.isNone(components.app.html.appendHead)) {
         components.app.html.appendHead = '';
     }
-    components.appMeta = {
-        slug: components.slug ?? null,
-        name: components.name ?? null,
-        version: components.version ?? null,
-        description: components.description ?? null,
-        license: components.license ?? null,
-        lowdefyVersion: components.lowdefy ?? null,
-        gitSha: computeGitSha()
-    };
+    if (type.isNone(components.app.email)) {
+        components.app.email = {};
+    }
+    // Email branding defaults from existing app config — baked into app.json at
+    // build so the runtime theme merge stays a plain shallow spread.
+    if (type.isNone(components.app.email.companyName) && type.isString(components.name)) {
+        components.app.email.companyName = components.name;
+    }
+    const colorPrimary = components.theme?.antd?.token?.colorPrimary;
+    if (type.isNone(components.app.email.primaryColor) && type.isString(colorPrimary)) {
+        components.app.email.primaryColor = colorPrimary;
+    }
     return components;
 }
 export default buildApp;

package/dist/build/buildAppMeta.js

@@ -0,0 +1,130 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { execSync } from 'child_process';
+import { ConfigError } from '@lowdefy/errors';
+import { type } from '@lowdefy/helpers';
+import { evaluateOperators } from '@lowdefy/operators';
+import operators from '@lowdefy/operators-js/operators/build';
+import collectDynamicIdentifiers from './collectDynamicIdentifiers.js';
+import collectExceptions from '../utils/collectExceptions.js';
+import getRefContent from './buildRefs/getRefContent.js';
+const dynamicIdentifiers = collectDynamicIdentifiers({
+    operators
+});
+const ROOT_METADATA_FILE = 'lowdefy.yaml';
+function computeGitSha() {
+    const fromEnv = process.env.LOWDEFY_GIT_SHA?.trim();
+    if (fromEnv) return fromEnv;
+    try {
+        return execSync('git rev-parse HEAD').toString().trim();
+    } catch (_) {
+        return null;
+    }
+}
+// Returns the single operator key of value (a non-tilde key starting with '_'),
+// or null when value is not a single-operator object.
+function operatorKey(value) {
+    if (!type.isObject(value)) return null;
+    const keys = Object.keys(value).filter((key)=>!key.startsWith('~'));
+    if (keys.length !== 1) return null;
+    return keys[0].startsWith('_') ? keys[0] : null;
+}
+function collectFieldError(context, message, lineNumber) {
+    const error = new ConfigError(message);
+    error.filePath = ROOT_METADATA_FILE;
+    if (!type.isNone(lineNumber)) {
+        error.lineNumber = lineNumber;
+    }
+    collectExceptions(context, error);
+}
+// Resolve a single root metadata scalar. Root metadata must be final before the
+// walker runs (it is what _app / _build.app read), so it can only depend on
+// values available now: literals and _build.* operators. _ref/_var/static-_
+// operators resolve later in buildRefs — deriving metadata from them is circular.
+function resolveField({ context, field, value }) {
+    if (type.isNone(value)) return null;
+    // _build.app in root metadata is self-referential: app metadata cannot read
+    // itself. Caught explicitly so every field reports clearly, not only `slug`.
+    // Only the top-level form is special-cased; a _build.app nested deeper (e.g.
+    // inside _build.string.concat) resolves against an undefined lowdefyApp —
+    // yielding null for non-slug fields, or the "slug required" throw for slug.
+    if (operatorKey(value) === '_build.app') {
+        collectFieldError(context, `Root metadata field \`${field}\` cannot use \`_build.app\` — app metadata cannot reference itself.`, value['~l']);
+        return null;
+    }
+    const { output, errors } = evaluateOperators({
+        input: value,
+        operators,
+        operatorPrefix: '_build.',
+        env: process.env,
+        dynamicIdentifiers
+    });
+    if (errors.length > 0) {
+        errors.forEach((error)=>{
+            error.filePath = ROOT_METADATA_FILE;
+            collectExceptions(context, error);
+        });
+        return null;
+    }
+    if (operatorKey(output)) {
+        collectFieldError(context, `Root metadata field \`${field}\` must be a literal or a \`_build.*\` operator; \`_ref\`/\`_var\`/\`_*\` operators are not supported here.`, value['~l']);
+        return null;
+    }
+    return output ?? null;
+}
+async function buildAppMeta({ context }) {
+    const content = await getRefContent({
+        context,
+        refDef: {
+            path: ROOT_METADATA_FILE
+        },
+        referencedFrom: null
+    }) ?? {};
+    context.appMeta = {
+        slug: resolveField({
+            context,
+            field: 'slug',
+            value: content.slug
+        }),
+        name: resolveField({
+            context,
+            field: 'name',
+            value: content.name
+        }),
+        version: resolveField({
+            context,
+            field: 'version',
+            value: content.version
+        }),
+        description: resolveField({
+            context,
+            field: 'description',
+            value: content.description
+        }),
+        license: resolveField({
+            context,
+            field: 'license',
+            value: content.license
+        }),
+        lowdefyVersion: resolveField({
+            context,
+            field: 'lowdefy',
+            value: content.lowdefy
+        }),
+        gitSha: computeGitSha()
+    };
+    return context.appMeta;
+}
+export default buildAppMeta;

package/dist/build/buildAuth/buildAgentAuth.js

@@ -12,13 +12,26 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { type } from '@lowdefy/helpers';
+*/ import { isReserved, type } from '@lowdefy/helpers';
 import { ConfigError } from '@lowdefy/errors';
 import getAgentRoles from './getAgentRoles.js';
 import getProtectedAgents from './getProtectedAgents.js';
 import { isInPatternList } from './matchPattern.js';
 // Agents are served from the API surface, so auth.api patterns match agent ids too.
 function buildAgentAuth({ components, context }) {
+    // buildAuth runs before buildAgents, so this is the first step to read an
+    // agent id - and both helpers below key plain objects on it. A reserved id
+    // resolves through Object.prototype: `agentRoles.__proto__` is truthy for
+    // every app, so the agent is stamped with Object.prototype as its roles and
+    // the whole build writes through the global prototype from there. Gate before
+    // either helper runs - buildAgents' own gate never gets the chance.
+    (components.agents ?? []).forEach((agent)=>{
+        if (isReserved(agent.id)) {
+            throw new ConfigError(`Agent id "${agent.id}" is a reserved name and cannot be used as an id.`, {
+                configKey: agent['~k']
+            });
+        }
+    });
     const protectedAgents = getProtectedAgents({
         components
     });

package/dist/build/buildAuth/buildAuth.js

@@ -15,9 +15,10 @@
 */ import { type } from '@lowdefy/helpers';
 import buildAuthPlugins from './buildAuthPlugins.js';
 import buildAgentAuth from './buildAgentAuth.js';
+import buildAuthStrategies from './buildAuthStrategies.js';
 import buildApiAuth from './buildApiAuth.js';
 import buildPageAuth from './buildPageAuth.js';
-import rejectReservedEntityIds from './rejectReservedEntityIds.js';
+import buildWebsocketAuth from './buildWebsocketAuth.js';
 import validateAuthConfig from './validateAuthConfig.js';
 function buildAuth({ components, context }) {
     const configured = !type.isNone(components.auth);
@@ -25,14 +26,18 @@ function buildAuth({ components, context }) {
         components,
         context
     });
-    rejectReservedEntityIds({
+    components.auth.configured = configured;
+    buildAuthStrategies({
         components
     });
-    components.auth.configured = configured;
     buildApiAuth({
         components,
         context
     });
+    buildWebsocketAuth({
+        components,
+        context
+    });
     buildAgentAuth({
         components,
         context

package/dist/build/buildAuth/buildAuthPlugins.js

@@ -96,5 +96,11 @@ function buildAuthPlugins({ components, context }) {
         typeClass: 'provider',
         context
     });
+    buildAuthPlugin({
+        counter: counters.strategies,
+        pluginConfig: authConfig.strategies,
+        typeClass: 'strategy',
+        context
+    });
 }
 export default buildAuthPlugins;