@lowdefy/build 5.6.0 → 6.0.0

package/dist/build/buildAuth/buildAuthStrategies.js

@@ -0,0 +1,117 @@
+/* eslint-disable no-param-reassign */ /*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+const strategyTypes = [
+    'apiKey',
+    'jwt'
+];
+// Prototype-pollution vectors rejected as claimMapping path segments.
+const reservedKeys = new Set([
+    '__proto__',
+    'constructor',
+    'prototype',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__'
+]);
+function setDefault(object, key, value) {
+    if (type.isNone(object[key])) {
+        object[key] = value;
+    }
+}
+function validateApiKeyStrategy({ strategy, configKey }) {
+    const properties = strategy.properties ?? {};
+    if (!type.isArray(properties.keys) || properties.keys.length === 0) {
+        throw new ConfigError(`Auth strategy "${strategy.id}" requires "properties.keys" to be a non-empty array of keys.`, {
+            configKey
+        });
+    }
+    properties.keys.forEach((key, index)=>{
+        if (type.isNone(key.value)) {
+            throw new ConfigError(`Auth strategy "${strategy.id}" key at index ${index} is missing "value". Reference the key with the _secret operator.`, {
+                configKey
+            });
+        }
+    });
+}
+function validateJwtStrategy({ strategy, configKey }) {
+    const properties = strategy.properties ?? {};
+    const hasSecret = !type.isNone(properties.secret);
+    const hasJwksUri = !type.isNone(properties.jwksUri);
+    if (hasSecret === hasJwksUri) {
+        throw new ConfigError(`Auth strategy "${strategy.id}" requires exactly one of "properties.secret" or "properties.jwksUri" to verify token signatures.`, {
+            configKey
+        });
+    }
+    // The algorithms allowlist restricts which signing algorithms are accepted,
+    // preventing "alg: none" and algorithm-confusion downgrade attacks.
+    if (!type.isArray(properties.algorithms) || properties.algorithms.length === 0) {
+        throw new ConfigError(`Auth strategy "${strategy.id}" requires "properties.algorithms" to be a non-empty array restricting the accepted signing algorithms.`, {
+            configKey
+        });
+    }
+    // claimMapping field names become object keys on the user and attributes
+    // objects the jwt verifier builds per request - gated here where the config
+    // location is available, so a pollution-vector key never reaches runtime.
+    Object.keys(properties.claimMapping ?? {}).forEach((field)=>{
+        const reservedSegment = field.split('.').find((segment)=>reservedKeys.has(segment));
+        if (!type.isNone(reservedSegment)) {
+            throw new ConfigError(`Auth strategy "${strategy.id}" claimMapping field "${field}" uses reserved name "${reservedSegment}".`, {
+                configKey
+            });
+        }
+    });
+}
+// Validates auth.strategies and writes per-entry defaults so the runtime
+// never falls back. Objects are mutated in place to preserve ~k markers.
+function buildAuthStrategies({ components }) {
+    const seenIds = {};
+    (components.auth.strategies ?? []).forEach((strategy)=>{
+        const configKey = strategy['~k'];
+        if (seenIds[strategy.id] === true) {
+            throw new ConfigError(`Duplicate auth strategy id "${strategy.id}".`, {
+                configKey
+            });
+        }
+        seenIds[strategy.id] = true;
+        if (!strategyTypes.includes(strategy.type)) {
+            throw new ConfigError(`Auth strategy "${strategy.id}" has unknown type "${strategy.type}". Valid types are: ${strategyTypes.join(', ')}.`, {
+                received: strategy.type,
+                configKey
+            });
+        }
+        if (strategy.type === 'apiKey') {
+            validateApiKeyStrategy({
+                strategy,
+                configKey
+            });
+        }
+        if (strategy.type === 'jwt') {
+            validateJwtStrategy({
+                strategy,
+                configKey
+            });
+        }
+        setDefault(strategy, 'roles', []);
+        setDefault(strategy, 'attributes', {});
+        if (strategy.type === 'apiKey') {
+            setDefault(strategy.properties, 'headerName', 'X-API-Key');
+        }
+    });
+    return components;
+}
+export default buildAuthStrategies;

package/dist/build/buildAuth/buildWebsocketAuth.js

@@ -0,0 +1,55 @@
+/* eslint-disable no-param-reassign */ /*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+import getProtectedWebsockets from './getProtectedWebsockets.js';
+import getWebsocketRoles from './getWebsocketRoles.js';
+import { isInPatternList } from './matchPattern.js';
+function buildWebsocketAuth({ components, context }) {
+    const protectedWebsockets = getProtectedWebsockets({
+        components
+    });
+    const websocketRoles = getWebsocketRoles({
+        components
+    });
+    let configPublicWebsockets = [];
+    if (type.isArray(components.auth.websockets.public)) {
+        configPublicWebsockets = components.auth.websockets.public;
+    }
+    (components.websockets || []).forEach((websocket)=>{
+        if (websocketRoles[websocket.id]) {
+            if (isInPatternList(websocket.id, configPublicWebsockets)) {
+                throw new ConfigError(`Websocket "${websocket.id}" is both protected by roles and public.`, {
+                    received: websocketRoles[websocket.id],
+                    configKey: websocket['~k']
+                });
+            }
+            websocket.auth = {
+                public: false,
+                roles: websocketRoles[websocket.id]
+            };
+        } else if (protectedWebsockets.includes(websocket.id)) {
+            websocket.auth = {
+                public: false
+            };
+        } else {
+            websocket.auth = {
+                public: true
+            };
+        }
+    });
+    return components;
+}
+export default buildWebsocketAuth;

package/dist/build/buildAuth/getProtectedWebsockets.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { isInPatternList } from './matchPattern.js';
+function getProtectedWebsockets({ components }) {
+    const websocketIds = (components.websockets ?? []).map((websocket)=>websocket.id);
+    let protectedWebsockets = [];
+    if (type.isArray(components.auth.websockets.public)) {
+        protectedWebsockets = websocketIds.filter((websocketId)=>!isInPatternList(websocketId, components.auth.websockets.public));
+    } else if (components.auth.websockets.protected === true) {
+        protectedWebsockets = websocketIds;
+    } else if (type.isArray(components.auth.websockets.protected)) {
+        protectedWebsockets = websocketIds.filter((websocketId)=>isInPatternList(websocketId, components.auth.websockets.protected));
+    }
+    return protectedWebsockets;
+}
+export default getProtectedWebsockets;

package/dist/build/buildAuth/getWebsocketRoles.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { matchesPattern } from './matchPattern.js';
+function getWebsocketRoles({ components }) {
+    const roles = components.auth.websockets.roles;
+    const websocketIds = (components.websockets ?? []).map((websocket)=>websocket.id);
+    const websocketRoles = {};
+    Object.keys(roles).forEach((roleName)=>{
+        roles[roleName].forEach((pattern)=>{
+            websocketIds.forEach((websocketId)=>{
+                if (matchesPattern(websocketId, pattern)) {
+                    if (!websocketRoles[websocketId]) {
+                        websocketRoles[websocketId] = new Set();
+                    }
+                    websocketRoles[websocketId].add(roleName);
+                }
+            });
+        });
+    });
+    Object.keys(websocketRoles).forEach((websocketId)=>{
+        websocketRoles[websocketId] = [
+            ...websocketRoles[websocketId]
+        ];
+    });
+    return websocketRoles;
+}
+export default getWebsocketRoles;

package/dist/build/buildAuth/validateAuthConfig.js

@@ -32,6 +32,12 @@ function validateAuthConfig({ components, context }) {
     if (type.isNone(components.auth.api.roles)) {
         components.auth.api.roles = {};
     }
+    if (type.isNone(components.auth.websockets)) {
+        components.auth.websockets = {};
+    }
+    if (type.isNone(components.auth.websockets.roles)) {
+        components.auth.websockets.roles = {};
+    }
     if (type.isNone(components.auth.authPages)) {
         components.auth.authPages = {};
     }
@@ -93,9 +99,15 @@ function validateAuthConfig({ components, context }) {
         context,
         entity: 'pages'
     });
-    // Validate NEXTAUTH_SECRET is set when auth providers are configured
-    if (components.auth.providers.length > 0 && type.isNone(process.env.NEXTAUTH_SECRET)) {
-        throw new ConfigError('Auth providers are configured but NEXTAUTH_SECRET environment variable is not set. ' + 'Set NEXTAUTH_SECRET to a secure random string (e.g., generate with `openssl rand -base64 32`).', {
+    validateMutualExclusivity({
+        components,
+        context,
+        entity: 'websockets'
+    });
+    // Validate AUTH_SECRET is set when auth providers are configured. Auth.js v5
+    // reads AUTH_SECRET; the v4 NEXTAUTH_SECRET variable is not supported.
+    if (components.auth.providers.length > 0 && type.isNone(process.env.AUTH_SECRET)) {
+        throw new ConfigError('Auth providers are configured but AUTH_SECRET environment variable is not set. ' + 'Set AUTH_SECRET to a secure random string (e.g., generate with `openssl rand -base64 32`).', {
             configKey: components.auth.providers['~k'] ?? components.auth['~k']
         });
     }

package/dist/build/buildImports/buildImportsDev.js

@@ -27,9 +27,12 @@ function getPluginPackages({ components }) {
     getPackages(components.types.auth.callbacks);
     getPackages(components.types.auth.events);
     getPackages(components.types.auth.providers);
+    getPackages(components.types.auth.strategies);
     getPackages(components.types.blocks);
     getPackages(components.types.connections);
+    getPackages(components.types.notifications);
     getPackages(components.types.requests);
+    getPackages(components.types.websockets);
     getPackages(components.types.operators.client);
     getPackages(components.types.operators.server);
     return pluginPackages;
@@ -74,6 +77,10 @@ function buildImportsDev({ components, context }) {
             providers: buildImportClassDev({
                 pluginPackages,
                 map: context.typesMap.auth.providers
+            }),
+            strategies: buildImportClassDev({
+                pluginPackages,
+                map: context.typesMap.auth.strategies
             })
         },
         blocks,
@@ -87,10 +94,18 @@ function buildImportsDev({ components, context }) {
             context,
             defaults: defaultIconsDev
         }),
+        notifications: buildImportClassDev({
+            pluginPackages,
+            map: context.typesMap.notifications
+        }),
         requests: buildImportClassDev({
             pluginPackages,
             map: context.typesMap.requests
         }),
+        websockets: buildImportClassDev({
+            pluginPackages,
+            map: context.typesMap.websockets
+        }),
         operators: {
             client: buildImportClassDev({
                 pluginPackages,

package/dist/build/buildImports/buildImportsProd.js

@@ -30,7 +30,8 @@ function buildImportsProd({ components, context }) {
             adapters: buildImportClassProd(components.types.auth.adapters),
             callbacks: buildImportClassProd(components.types.auth.callbacks),
             events: buildImportClassProd(components.types.auth.events),
-            providers: buildImportClassProd(components.types.auth.providers)
+            providers: buildImportClassProd(components.types.auth.providers),
+            strategies: buildImportClassProd(components.types.auth.strategies)
         },
         blocks,
         connections: buildImportClassProd(components.types.connections),
@@ -40,7 +41,9 @@ function buildImportsProd({ components, context }) {
             context,
             defaults: defaultIconsProd
         }),
+        notifications: buildImportClassProd(components.types.notifications),
         requests: buildImportClassProd(components.types.requests),
+        websockets: buildImportClassProd(components.types.websockets),
         operators: {
             client: buildImportClassProd(components.types.operators.client),
             server: buildImportClassProd(components.types.operators.server)

package/dist/build/buildJs/generateClientJsModule.js

@@ -0,0 +1,27 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import generateJsFile from './generateJsFile.js';
+// Single definition of the client _js function prototype. Both the full build
+// (writeJs) and the dev server's per-page fold (getPageJitEnrichment) generate
+// client jsMap module text through here, so the destructured argument list has
+// exactly one source of truth.
+const CLIENT_JS_FUNCTION_PROTOTYPE = `{ actions, args, event, input, location, lowdefyApp, lowdefyGlobal, request, state, urlQuery, user }`;
+function generateClientJsModule(map) {
+    return generateJsFile({
+        map,
+        functionPrototype: CLIENT_JS_FUNCTION_PROTOTYPE
+    });
+}
+export default generateClientJsModule;

package/dist/build/buildJs/writeJs.js

@@ -12,12 +12,10 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import generateJsFile from './generateJsFile.js';
+*/ import generateClientJsModule from './generateClientJsModule.js';
+import generateJsFile from './generateJsFile.js';
 async function writeJs({ context }) {
-    await context.writeBuildArtifact('plugins/operators/clientJsMap.js', generateJsFile({
-        map: context.jsMap.client,
-        functionPrototype: `{ actions, args, event, input, location, lowdefyApp, lowdefyGlobal, request, state, urlQuery, user }`
-    }));
+    await context.writeBuildArtifact('plugins/operators/clientJsMap.js', generateClientJsModule(context.jsMap.client));
     await context.writeBuildArtifact('plugins/operators/serverJsMap.js', generateJsFile({
         map: context.jsMap.server,
         functionPrototype: `{ args, item, lowdefyApp, payload, secret, state, step, user }`

package/dist/build/buildMcp.js

@@ -0,0 +1,73 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ /* eslint-disable no-param-reassign */ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+// Validates the mcp block and writes its defaults. Endpoints are matched via
+// the same dual id/endpointId match buildApi uses. Referenced endpoints must
+// carry the metadata an MCP client needs: a description and a payloadSchema
+// (the tool inputSchema).
+function buildMcp({ components }) {
+    if (type.isNone(components.mcp)) {
+        components.mcp = {};
+    }
+    const mcp = components.mcp;
+    const configKey = mcp['~k'] ?? components['~k'];
+    // Agent tools were removed from mcp; schema validation only warns on
+    // unknown properties, so a leftover "agents" key would otherwise build
+    // silently instead of surfacing the removal.
+    if (!type.isNone(mcp.agents)) {
+        throw new ConfigError('MCP agent tools are not supported. Remove "mcp.agents" from your config.', {
+            configKey
+        });
+    }
+    mcp.name = mcp.name ?? 'lowdefy';
+    mcp.version = mcp.version ?? '1.0.0';
+    mcp.endpoints = mcp.endpoints ?? [];
+    mcp.configured = mcp.endpoints.length > 0;
+    const seen = new Set();
+    mcp.endpoints.forEach((endpointId)=>{
+        if (seen.has(endpointId)) {
+            throw new ConfigError(`Duplicate MCP tool "${endpointId}".`, {
+                configKey
+            });
+        }
+        seen.add(endpointId);
+        const endpoint = (components.api ?? []).find((e)=>e.id === endpointId || e.endpointId === endpointId);
+        if (type.isNone(endpoint)) {
+            throw new ConfigError(`MCP endpoint "${endpointId}" does not reference a defined api endpoint.`, {
+                configKey
+            });
+        }
+        // MCP is an external transport - InternalApi endpoints are not addressable
+        // from outside the server, matching the HTTP endpoint route.
+        if (endpoint.type === 'InternalApi') {
+            throw new ConfigError(`MCP endpoint "${endpointId}" is an InternalApi endpoint. Only "Api" endpoints can be exposed as MCP tools.`, {
+                configKey
+            });
+        }
+        if (type.isNone(endpoint.description)) {
+            throw new ConfigError(`Endpoint "${endpointId}" is exposed as an MCP tool but does not have a "description".`, {
+                configKey: endpoint['~k'] ?? configKey
+            });
+        }
+        if (type.isNone(endpoint.payloadSchema)) {
+            throw new ConfigError(`Endpoint "${endpointId}" is exposed as an MCP tool but does not have a "payloadSchema".`, {
+                configKey: endpoint['~k'] ?? configKey
+            });
+        }
+    });
+    return components;
+}
+export default buildMcp;

package/dist/build/buildModuleDefs.js

@@ -14,13 +14,13 @@
   limitations under the License.
 */ import operators from '@lowdefy/operators-js/operators/build';
 import { resolve, WalkContext } from './buildRefs/walker.js';
+import { assertNoPlaceholderLeaks } from './buildRefs/deferredRegistry.js';
 import getRefContent from './buildRefs/getRefContent.js';
 import makeRefDefinition from './buildRefs/makeRefDefinition.js';
-import evaluateStaticOperators from './buildRefs/evaluateStaticOperators.js';
 import collectDynamicIdentifiers from './collectDynamicIdentifiers.js';
 import validateOperatorsDynamic from './validateOperatorsDynamic.js';
 import fetchModules from './fetchModules.js';
-import { resolveLocalManifest, resolveFullManifest, validateRequiredVars } from './registerModules.js';
+import { resolveLocalManifest, recordifyExportables, resolveFullManifest, validateRequiredVars } from './registerModules.js';
 import resolveModuleDependencies from './resolveModuleDependencies.js';
 validateOperatorsDynamic({
     operators
@@ -50,64 +50,86 @@ async function parseLowdefyYaml({ context }) {
         ] : []),
         operators,
         env: process.env,
+        lowdefyApp: context.appMeta,
         dynamicIdentifiers,
         shouldStop: (path)=>{
             // Defer entry vars and connections: they may contain cross-module
-            // refs that require modules to be registered first.
-            if (/^modules\.\d+\.vars$/.test(path)) return 'preserve';
-            if (/^modules\.\d+\.connections$/.test(path)) return 'preserve';
+            // refs that require modules to be registered first. Non-modules keys
+            // stay raw for the app buildRefs pass.
+            if (/^modules\.\d+\.vars$/.test(path)) return 'skip';
+            if (/^modules\.\d+\.connections$/.test(path)) return 'skip';
             if (path.startsWith('modules')) return false;
-            return 'preserve';
+            return 'skip';
         }
     });
-    let config = await resolve(content, ctx);
-    config = evaluateStaticOperators({
-        context,
-        input: config,
-        refDef
-    });
+    const config = await resolve(content, ctx);
     return config ?? {};
 }
-async function resolveEntryConfig({ entry, context }) {
-    const moduleEntry = context.modules[entry.id];
+function makeAppLevelCtx({ context, deferModuleRefs = false, entryId, entrySection }) {
     const lowdefyYamlRefDef = context.lowdefyYamlRefDef;
-    function makeAppLevelCtx() {
-        return new WalkContext({
-            buildContext: context,
-            refId: lowdefyYamlRefDef.id,
-            sourceRefId: null,
-            vars: {},
-            path: '',
-            currentFile: lowdefyYamlRefDef.path,
-            refChain: new Set(lowdefyYamlRefDef.path ? [
-                lowdefyYamlRefDef.path
-            ] : []),
-            operators,
-            env: process.env,
-            dynamicIdentifiers
-        });
-    }
-    const refDef = lowdefyYamlRefDef;
-    let resolvedVars = await resolve(moduleEntry.consumerVars, makeAppLevelCtx());
-    resolvedVars = evaluateStaticOperators({
-        context,
-        input: resolvedVars,
-        refDef
+    return new WalkContext({
+        buildContext: context,
+        refId: lowdefyYamlRefDef.id,
+        sourceRefId: null,
+        vars: {},
+        path: '',
+        currentFile: lowdefyYamlRefDef.path,
+        refChain: new Set(lowdefyYamlRefDef.path ? [
+            lowdefyYamlRefDef.path
+        ] : []),
+        operators,
+        env: process.env,
+        lowdefyApp: context.appMeta,
+        dynamicIdentifiers,
+        deferModuleRefs,
+        entryId,
+        entrySection
     });
-    moduleEntry.consumerVars = resolvedVars ?? {};
-    let resolvedConnections = await resolve(moduleEntry.connections, makeAppLevelCtx());
-    resolvedConnections = evaluateStaticOperators({
+}
+// Stage 1 — prepare: resolve entry vars/connections in the enclosing (app)
+// scope; cross-module refs become entryRef records with the prepared refDef as
+// body (their dynamic parts already resolved), leaving placeholders in the
+// blobs. Order-free: nothing is consumed here.
+async function prepareEntryConfig({ moduleEntry, context }) {
+    const varsResult = await resolve(moduleEntry.consumerVars, makeAppLevelCtx({
         context,
-        input: resolvedConnections,
-        refDef
-    });
-    moduleEntry.connections = resolvedConnections ?? {};
-    validateRequiredVars(moduleEntry.varDefs, moduleEntry.consumerVars, entry.id, entry.source);
+        deferModuleRefs: true,
+        entryId: moduleEntry.id,
+        entrySection: 'consumerVars'
+    }));
+    moduleEntry.consumerVars = varsResult ?? {};
+    const connectionsResult = await resolve(moduleEntry.connections, makeAppLevelCtx({
+        context,
+        deferModuleRefs: true,
+        entryId: moduleEntry.id,
+        entrySection: 'connections'
+    }));
+    moduleEntry.connections = connectionsResult ?? {};
+}
+// Final sweep: re-walk each entry's blobs with deferral off. Placeholders
+// dispatch into resolveDeferred (value-granular demand, wait-graph cycle
+// detection — order immaterial, memo skips already-demanded records), and the
+// _module.connectionId object form (deferred during prepare) resolves against
+// now-prepared targets. In-place walk mutation is the write-back, so resolved
+// values land in consumerVars/connections with consumption provenance.
+async function sweepEntryConfig({ moduleEntry, context }) {
+    const varsResult = await resolve(moduleEntry.consumerVars, makeAppLevelCtx({
+        context
+    }));
+    moduleEntry.consumerVars = varsResult ?? {};
+    const connectionsResult = await resolve(moduleEntry.connections, makeAppLevelCtx({
+        context
+    }));
+    moduleEntry.connections = connectionsResult ?? {};
+    validateRequiredVars(moduleEntry.varDefs, moduleEntry.consumerVars, moduleEntry.id, moduleEntry.source);
 }
 async function buildModuleDefs({ context }) {
     const lowdefyConfig = await parseLowdefyYaml({
         context
     });
+    // Stash for index.js to compute appMeta before buildRefs, so the _build.app
+    // operator can resolve app metadata during ref resolution.
+    context.lowdefyConfig = lowdefyConfig;
     context.plugins = lowdefyConfig.plugins ?? [];
     const moduleEntries = lowdefyConfig.modules ?? [];
     if (moduleEntries.length === 0) {
@@ -129,11 +151,28 @@ async function buildModuleDefs({ context }) {
     resolveModuleDependencies({
         context
     });
-    // Step 2.5: Resolve deferred entry vars and connections at app level,
-    // then validate required vars against the resolved values.
+    // Step 2.5a — prepare all entries. No cross-entry work; order-free.
     for (const entry of moduleEntries){
-        await resolveEntryConfig({
-            entry,
+        await prepareEntryConfig({
+            moduleEntry: context.modules[entry.id],
+            context
+        });
+    }
+    // Phase C.5 — record-ify exportables (components, menu links) for every
+    // entry BEFORE anything can consume them: record creation must precede all
+    // consumption, or cross-entry refs would race manifest resolve order.
+    for (const entry of moduleEntries){
+        await recordifyExportables({
+            entryId: entry.id,
+            context
+        });
+    }
+    // Step 2.5b — final sweep. Per-record demand through the wait-graph makes
+    // the order immaterial; required-var validation runs per entry after its
+    // blobs are concrete.
+    for (const entry of moduleEntries){
+        await sweepEntryConfig({
+            moduleEntry: context.modules[entry.id],
             context
         });
     }
@@ -144,5 +183,8 @@ async function buildModuleDefs({ context }) {
             context
         });
     }
+    // Post-sweep invariant: no deferred placeholder survives outside the
+    // per-consumer slots (manifest component/menu bodies, varDefs defaults).
+    assertNoPlaceholderLeaks(context);
 }
 export default buildModuleDefs;