@lowdefy/build 5.6.0 → 6.1.0

package/dist/build/registerModules.js

@@ -20,9 +20,9 @@ import operators from '@lowdefy/operators-js/operators/build';
 import { resolve, WalkContext } from './buildRefs/walker.js';
 import getRefContent from './buildRefs/getRefContent.js';
 import makeRefDefinition from './buildRefs/makeRefDefinition.js';
-import evaluateStaticOperators from './buildRefs/evaluateStaticOperators.js';
 import collectDynamicIdentifiers from './collectDynamicIdentifiers.js';
 import validateOperatorsDynamic from './validateOperatorsDynamic.js';
+import { makeShouldStop } from './buildRefs/deferredRegions.js';
 validateOperatorsDynamic({
     operators
 });
@@ -48,11 +48,69 @@ function validateRequiredVars(varDefs, consumerVars, entryId, source, prefix = '
         }
     }
 }
+function getRuntimeOperatorKey(value) {
+    if (!type.isObject(value)) return null;
+    const nonTildeKeys = Object.keys(value).filter((k)=>!k.startsWith('~'));
+    if (nonTildeKeys.length === 1 && nonTildeKeys[0].startsWith('_')) return nonTildeKeys[0];
+    return null;
+}
+function suggestBuildOperator(operatorKey) {
+    // '_string.concat' -> '_build.string.concat', '_sum' -> '_build.sum'
+    return `_build.${operatorKey.slice(1)}`;
+}
+// Component bodies are preserved by config path (components.<i>.component), so
+// bodies under an operator object at `components` itself or at an array element
+// escape preservation and resolve eagerly during the manifest walk. That is
+// harmless for static bodies (operator-composed component lists are supported —
+// pinned by fixture 81-cross-module-build-op-components), but a _var in such a
+// body resolves against the manifest walk's scope instead of the consumer's
+// per-ref vars — a silently wrong value. Error on that combination explicitly.
+// A _ref at either position is fully safe: it resolves top-down, so paths
+// inside the ref'd file still match the preserve regex. An operator at
+// components.<i>.component itself is inside the preserved body and is fine.
+function findVarNode(value) {
+    if (type.isArray(value)) {
+        for (const item of value){
+            const found = findVarNode(item);
+            if (found) return found;
+        }
+        return null;
+    }
+    if (!type.isObject(value)) return null;
+    if (getRuntimeOperatorKey(value) === '_var') return value;
+    for (const key of Object.keys(value)){
+        const found = findVarNode(value[key]);
+        if (found) return found;
+    }
+    return null;
+}
+function assertStaticComponentsList({ components, entryId, filePath }) {
+    if (!type.isObject(components) && !type.isArray(components)) return;
+    const check = (value, position)=>{
+        const operatorKey = getRuntimeOperatorKey(value);
+        if (operatorKey && operatorKey !== '_ref' && findVarNode(value)) {
+            throw new ConfigError(`Module "${entryId}": _var inside an operator-generated components section ` + `cannot resolve per consumer. Found "${operatorKey}" at ${position} with a _var ` + `in its content. Define components whose bodies use _var as static ` + `{ id, component } list items so the bodies are preserved.`, {
+                filePath
+            });
+        }
+    };
+    check(components, '"components"');
+    if (type.isArray(components)) {
+        components.forEach((item, i)=>check(item, `"components.${i}"`));
+    }
+}
 function validateVarTypes(varDefs, resolvedVarCache, entryId, source, prefix = '') {
     for (const [varName, varDef] of Object.entries(varDefs)){
         const fullName = prefix ? `${prefix}.${varName}` : varName;
         const value = resolvedVarCache[fullName];
         if (varDef.type && !type.isNone(value)) {
+            // A typed var must hold a concrete value — runtime operators are not allowed
+            // regardless of whether they are static-foldable or dynamic. Suggest the
+            // build-time equivalent so the user knows how to fix it.
+            const operatorKey = getRuntimeOperatorKey(value);
+            if (operatorKey) {
+                throw new ConfigError(`Module "${entryId}" (${source}) var "${fullName}" is typed "${varDef.type}" ` + `but received a runtime operator "${operatorKey}". ` + `Use the build-time equivalent "${suggestBuildOperator(operatorKey)}" instead.` + (varDef.description ? `\n  - ${varDef.description}` : ''));
+            }
             if (type.typeOf(value) !== varDef.type) {
                 throw new ConfigError(`Module "${entryId}" (${source}) var "${fullName}" must be type ` + `"${varDef.type}" but got "${type.typeOf(value)}".` + (varDef.description ? `\n  - ${varDef.description}` : ''));
             }
@@ -85,7 +143,17 @@ async function resolveLocalManifest({ entry, resolvedPaths, context }) {
         refDef,
         referencedFrom: null
     });
-    // Run walker with shouldStop preserving content that may contain cross-module refs
+    if (type.isObject(content)) {
+        assertStaticComponentsList({
+            components: content.components,
+            entryId: entry.id,
+            filePath: moduleYamlPath
+        });
+    }
+    // Phase A — header parse: walk only the static header keys (dependencies,
+    // plugins, secrets, vars definitions — defaults record-ified). Content
+    // sections stay raw parsed YAML; Phase C.5 record-ifies exportables and
+    // Phase D resolves the rest.
     const ctx = new WalkContext({
         buildContext: context,
         refId: refDef.id,
@@ -93,6 +161,9 @@ async function resolveLocalManifest({ entry, resolvedPaths, context }) {
         vars: {},
         moduleRoot,
         packageRoot,
+        // The entry object is created after this walk; deferred-record coordinates
+        // still need the owning entry id.
+        entryId: entry.id,
         path: '',
         currentFile: moduleYamlPath,
         refChain: new Set(refDef.path ? [
@@ -100,16 +171,9 @@ async function resolveLocalManifest({ entry, resolvedPaths, context }) {
         ] : []),
         operators,
         env: process.env,
+        lowdefyApp: context.appMeta,
         dynamicIdentifiers,
-        shouldStop: (childPath)=>{
-            if (/^vars(\.[^.]+\.properties)*\.[^.]+\.default(\..*)?$/.test(childPath)) return 'preserve';
-            if (/^components\.\d+\.component$/.test(childPath)) return 'preserve';
-            if (/^pages(\..*)?$/.test(childPath)) return 'preserve';
-            if (/^api(\..*)?$/.test(childPath)) return 'preserve';
-            if (/^connections(\..*)?$/.test(childPath)) return 'preserve';
-            if (/^menus\.\d+\.links$/.test(childPath)) return 'preserve';
-            return false;
-        }
+        shouldStop: makeShouldStop('header')
     });
     const manifest = await resolve(content, ctx);
     // Parse dependencies array from manifest
@@ -173,6 +237,49 @@ async function resolveLocalManifest({ entry, resolvedPaths, context }) {
         throw error;
     }
 }
+// Phase C.5 — record-ify exportables: walk only the components and menus
+// sections in module-static scope (entry id known, but NO moduleEntry on the
+// context — a _module.var at a structural position errors, because export ids
+// must not vary per consumer). File refs are entered and static operators
+// resolve; component bodies and menu links become records before any phase can
+// consume them, so cross-entry consumption never races record creation.
+async function recordifyExportables({ entryId, context }) {
+    const moduleEntry = context.modules[entryId];
+    const { manifest, packageRoot, moduleRoot, refDef } = moduleEntry;
+    const moduleYamlPath = path.join(moduleRoot, 'module.lowdefy.yaml');
+    if (type.isObject(manifest)) {
+        assertStaticComponentsList({
+            components: manifest.components,
+            entryId,
+            filePath: moduleYamlPath
+        });
+    }
+    const ctx = new WalkContext({
+        buildContext: context,
+        refId: refDef.id,
+        sourceRefId: null,
+        vars: {},
+        moduleRoot,
+        packageRoot,
+        entryId,
+        path: '',
+        currentFile: moduleYamlPath,
+        refChain: new Set(refDef.path ? [
+            refDef.path
+        ] : []),
+        operators,
+        env: process.env,
+        lowdefyApp: context.appMeta,
+        dynamicIdentifiers,
+        shouldStop: makeShouldStop('exportables')
+    });
+    moduleEntry.manifest = await resolve(manifest, ctx);
+}
+// Phase D — manifest resolve: ONE full walk with the module entry in context.
+// Pages, api, and connections resolve completely; component/menuLinks
+// placeholders pass through the kind-aware dispatch untouched; varDefault
+// placeholders keep their rule so the dispatch cannot force demand-only
+// records.
 async function resolveFullManifest({ entryId, context }) {
     const moduleEntry = context.modules[entryId];
     const { manifest, packageRoot, moduleRoot, moduleDependencies, refDef } = moduleEntry;
@@ -193,24 +300,18 @@ async function resolveFullManifest({ entryId, context }) {
         ] : []),
         operators,
         env: process.env,
+        lowdefyApp: context.appMeta,
         dynamicIdentifiers,
-        shouldStop: (childPath)=>{
-            if (/^vars(\.[^.]+\.properties)*\.[^.]+\.default(\..*)?$/.test(childPath)) return 'preserve';
-            if (/^components\.\d+\.component$/.test(childPath)) return 'preserve';
-            return false;
-        }
-    });
-    let resolved = await resolve(manifest, ctx);
-    resolved = evaluateStaticOperators({
-        context,
-        input: resolved,
-        refDef
+        shouldStop: makeShouldStop('manifest')
     });
+    const resolved = await resolve(manifest, ctx);
     // Filter null entries produced by _ref resolution failures
     for (const key of [
         'pages',
         'connections',
-        'api'
+        'api',
+        'agents',
+        'notifications'
     ]){
         if (type.isArray(resolved[key])) {
             resolved[key] = resolved[key].filter((item)=>!type.isNone(item));
@@ -223,4 +324,4 @@ async function resolveFullManifest({ entryId, context }) {
         validateVarTypes(varDefs, moduleEntry.resolvedVarCache, entryId, moduleEntry.source);
     }
 }
-export { resolveLocalManifest, resolveFullManifest, validateRequiredVars };
+export { resolveLocalManifest, recordifyExportables, resolveFullManifest, validateRequiredVars };

package/dist/build/validateCallAgentSteps.js

@@ -0,0 +1,58 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError, ConfigWarning } from '@lowdefy/errors';
+function collectCallAgentSteps(routine, steps) {
+    if (type.isArray(routine)) {
+        routine.forEach((item)=>collectCallAgentSteps(item, steps));
+        return;
+    }
+    if (type.isObject(routine)) {
+        if (routine.type === 'CallAgent') {
+            steps.push(routine);
+        }
+        // Recurse into all values (handles control structures like :then, :else, :try, :catch)
+        Object.values(routine).forEach((value)=>collectCallAgentSteps(value, steps));
+    }
+}
+// Runs after buildAgents (needs context.agentIds and normalized agent.tools).
+// Validates that CallAgent steps with a static agentId reference an existing
+// agent, and warns when that agent has confirm tools — headless runs have no
+// client to resolve an approval, so those tools auto-execute. Operator
+// (dynamic) agentIds are skipped; they resolve at runtime.
+function validateCallAgentSteps({ components, context }) {
+    (components.api ?? []).forEach((endpoint)=>{
+        const steps = [];
+        collectCallAgentSteps(endpoint.routine, steps);
+        steps.forEach((step)=>{
+            const agentId = step.properties?.agentId;
+            if (!type.isString(agentId)) return;
+            if (!context.agentIds?.has(agentId)) {
+                throw new ConfigError(`CallAgent step "${step.stepId}" at endpoint "${endpoint.endpointId}" references agent "${agentId}" which does not exist.`, {
+                    configKey: step['~k']
+                });
+            }
+            const agent = (components.agents ?? []).find((a)=>a.agentId === agentId);
+            const hasConfirmTools = (agent?.tools ?? []).some((t)=>t.confirm);
+            if (hasConfirmTools) {
+                context.handleWarning(new ConfigWarning(`Agent "${agentId}" has tools with confirm: true, but tool approval is not supported when run from a CallAgent step. Tools will auto-execute.`, {
+                    configKey: step['~k']
+                }));
+            }
+        });
+    });
+    return components;
+}
+export default validateCallAgentSteps;

package/dist/build/validateConfig.js

@@ -13,7 +13,8 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { type } from '@lowdefy/helpers';
-function validateConfig({ components }) {
+import buildEnvironments from './buildEnvironments.js';
+function validateConfig({ components, context }) {
     if (type.isNone(components.config)) {
         components.config = {};
     }
@@ -25,6 +26,10 @@ function validateConfig({ components }) {
             throw new Error('Base path must start with "/".');
         }
     }
+    buildEnvironments({
+        components,
+        context
+    });
     return components;
 }
 export default validateConfig;

package/dist/build/validateEnvironmentGuards.js

@@ -0,0 +1,69 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+import collectEnvironmentGuards from '@lowdefy/node-utils/collectEnvironmentGuards.js';
+const guardKinds = [
+    'secrets',
+    'env'
+];
+// Guard shape and patterns are validated for every environment, not only the current one, so a
+// broken guard fails the build that introduces it.
+function validateEnvironmentGuards({ name, guards, configKey }) {
+    if (type.isUndefined(guards)) return;
+    const where = `config.environments.${name}.guards`;
+    if (!type.isObject(guards)) {
+        throw new ConfigError(`App "${where}" should be an object.`, {
+            received: guards,
+            configKey
+        });
+    }
+    // An unknown key (a `secret:` typo for `secrets:`) would otherwise check nothing and let the
+    // value it was meant to pin through, so it fails the build.
+    Object.keys(guards).forEach((kind)=>{
+        if (kind.startsWith('~') || guardKinds.includes(kind)) return;
+        throw new ConfigError(`App "${where}.${kind}" is not a guard kind. Guards are "secrets" (Lowdefy secret names) and "env" (environment variable names).`, {
+            configKey
+        });
+    });
+    guardKinds.forEach((kind)=>{
+        const map = guards[kind];
+        if (type.isUndefined(map)) return;
+        if (!type.isObject(map)) {
+            throw new ConfigError(`App "${where}.${kind}" should be an object.`, {
+                received: map,
+                configKey
+            });
+        }
+    });
+    collectEnvironmentGuards({
+        guards
+    }).forEach(({ label, pattern })=>{
+        if (!type.isString(pattern) || pattern === '') {
+            throw new ConfigError(`App "${where}" ${label} should be a regular expression string.`, {
+                received: pattern,
+                configKey
+            });
+        }
+        try {
+            new RegExp(pattern);
+        } catch (error) {
+            throw new ConfigError(`App "${where}" ${label} is not a valid regular expression: ${error.message}`, {
+                configKey
+            });
+        }
+    });
+}
+export default validateEnvironmentGuards;

package/dist/build/validateRenderNotificationSteps.js

@@ -0,0 +1,50 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+function collectRenderNotificationSteps(routine, steps) {
+    if (type.isArray(routine)) {
+        routine.forEach((item)=>collectRenderNotificationSteps(item, steps));
+        return;
+    }
+    if (type.isObject(routine)) {
+        if (routine.type === 'RenderNotification') {
+            steps.push(routine);
+        }
+        // Recurse into all values (handles control structures like :then, :else, :try, :catch)
+        Object.values(routine).forEach((value)=>collectRenderNotificationSteps(value, steps));
+    }
+}
+// Runs after buildNotifications (needs context.notificationIds). Validates that
+// RenderNotification steps with a static notificationId reference an existing
+// notification. Operator (dynamic) notificationIds are skipped; they resolve at
+// runtime.
+function validateRenderNotificationSteps({ components, context }) {
+    (components.api ?? []).forEach((endpoint)=>{
+        const steps = [];
+        collectRenderNotificationSteps(endpoint.routine, steps);
+        steps.forEach((step)=>{
+            const notificationId = step.properties?.notificationId;
+            if (!type.isString(notificationId)) return;
+            if (!context.notificationIds?.has(notificationId)) {
+                throw new ConfigError(`RenderNotification step "${step.stepId}" at endpoint "${endpoint.endpointId}" references notification "${notificationId}" which does not exist.`, {
+                    configKey: step['~k']
+                });
+            }
+        });
+    });
+    return components;
+}
+export default validateRenderNotificationSteps;

package/dist/build/writeApi.js

@@ -13,9 +13,102 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { type, serializer } from '@lowdefy/helpers';
+import getEnvironmentNames from '../utils/getEnvironmentNames.js';
 async function writeEndpoint({ endpoint, context }) {
     await context.writeBuildArtifact(`api/${endpoint.endpointId}.json`, serializer.serializeToString(endpoint ?? {}));
 }
+// Flat manifest of every scheduled endpoint, consumed by the Vercel Build Output assembly to
+// generate the `crons` array in config.json. The runtime reads schedules off the endpoint artifact
+// directly, so it does not depend on this file.
+//
+// With config.environments declared there is one entry per registered environment and schedule:
+// `environment` names it and `forward` is true for environments this deployment forwards to.
+// Vercel fires crons only on production, so:
+//   - the current environment registers its own schedules;
+//   - an environment with a cron.secret is forwarded to, so its own crons never fire it; any other
+//     current environment is the one Vercel fires crons on and also registers every forwarded
+//     environment's schedules;
+//   - without a current environment only the `default` schedules are registered;
+//   - cron.enabled: false registers nothing for that environment.
+function getSchedules({ endpoint, key }) {
+    if (type.isArray(endpoint.schedules)) return endpoint.schedules;
+    return endpoint.schedules?.[key] ?? [];
+}
+function toManifestEntries({ endpoint, key, environment, forward }) {
+    return getSchedules({
+        endpoint,
+        key
+    }).map((schedule)=>({
+            endpointId: endpoint.endpointId,
+            cron: schedule.cron,
+            payload: schedule.payload ?? {},
+            ...type.isUndefined(environment) ? {} : {
+                environment,
+                forward
+            }
+        }));
+}
+function isCronEnabled(environment) {
+    return environment.cron?.enabled !== false;
+}
+function isForwardTarget(environment) {
+    return !type.isUndefined(environment.cron?.secret);
+}
+function getRegisteredEnvironments({ environments, current }) {
+    const registered = [];
+    if (isCronEnabled(environments[current])) {
+        registered.push({
+            name: current,
+            forward: false
+        });
+    }
+    if (isForwardTarget(environments[current])) return registered;
+    getEnvironmentNames(environments).forEach((name)=>{
+        const environment = environments[name];
+        if (name === current || !isForwardTarget(environment) || !isCronEnabled(environment)) return;
+        registered.push({
+            name,
+            forward: true
+        });
+    });
+    return registered;
+}
+async function writeSchedulesManifest({ components, context }) {
+    const { environments, environment: current } = components.config ?? {};
+    const declared = getEnvironmentNames(environments).length > 0;
+    const registered = declared && !type.isUndefined(current) ? getRegisteredEnvironments({
+        environments,
+        current
+    }) : [];
+    const schedules = [];
+    (components.api ?? []).forEach((endpoint)=>{
+        if (!declared) {
+            schedules.push(...toManifestEntries({
+                endpoint
+            }));
+            return;
+        }
+        if (type.isUndefined(current)) {
+            schedules.push(...toManifestEntries({
+                endpoint,
+                key: 'default'
+            }));
+            return;
+        }
+        registered.forEach(({ name, forward })=>{
+            schedules.push(...toManifestEntries({
+                endpoint,
+                key: name,
+                environment: name,
+                forward
+            }));
+        });
+    });
+    // Only emit the manifest when something is scheduled; the Vercel assembly treats a missing
+    // schedules.json as "no crons".
+    if (schedules.length === 0) return;
+    await context.writeBuildArtifact('schedules.json', serializer.serializeToString(schedules));
+}
 async function writeApi({ components, context }) {
     if (type.isNone(components.api)) return;
     if (!type.isArray(components.api)) {
@@ -25,6 +118,10 @@ async function writeApi({ components, context }) {
             endpoint,
             context
         }));
-    return Promise.all(writePromises);
+    await Promise.all(writePromises);
+    await writeSchedulesManifest({
+        components,
+        context
+    });
 }
 export default writeApi;

package/dist/build/writeMcp.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { serializer } from '@lowdefy/helpers';
+// Always written, even unconfigured - the runtime reads mcp.configured and
+// never needs an existence check on the artifact.
+async function writeMcp({ components, context }) {
+    await context.writeBuildArtifact('mcp.json', serializer.serializeToString(components.mcp));
+}
+export default writeMcp;

package/dist/build/writeNotifications.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type, serializer } from '@lowdefy/helpers';
+async function writeNotification({ notification, context }) {
+    await context.writeBuildArtifact(`notifications/${notification.notificationId}.json`, serializer.serializeToString(notification ?? {}));
+}
+async function writeNotifications({ components, context }) {
+    if (type.isNone(components.notifications)) return;
+    if (!type.isArray(components.notifications)) {
+        throw new Error(`Notifications is not an array.`);
+    }
+    const writePromises = components.notifications.map((notification)=>writeNotification({
+            notification,
+            context
+        }));
+    return Promise.all(writePromises);
+}
+export default writeNotifications;

package/dist/build/writePluginImports/importPluginModule.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { createRequire } from 'node:module';
+import path from 'node:path';
+// Import a plugin module (e.g. `${pkg}/schemas`, `${pkg}/connections`) for
+// schema collection. Default packages resolve from the build package itself;
+// custom plugins only exist in the server's node_modules, so fall back to
+// resolving from the server directory. Returns undefined when unresolvable —
+// callers degrade gracefully.
+async function importPluginModule({ context, specifier }) {
+    try {
+        return await import(/* webpackIgnore: true */ /* @vite-ignore */ specifier);
+    } catch  {
+    // Not resolvable from the build package — try the server's node_modules.
+    }
+    const serverDir = context.directories?.server;
+    if (!serverDir) {
+        return undefined;
+    }
+    try {
+        const require = createRequire(path.join(serverDir, 'package.json'));
+        return await import(/* webpackIgnore: true */ /* @vite-ignore */ require.resolve(specifier));
+    } catch  {
+        return undefined;
+    }
+}
+export default importPluginModule;

package/dist/build/writePluginImports/writeActionSchemaMap.js

@@ -12,7 +12,8 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ async function writeActionSchemaMap({ components, context }) {
+*/ import importPluginModule from './importPluginModule.js';
+async function writeActionSchemaMap({ components, context }) {
     const schemas = {};
     const typesMapSchemas = context.typesMap.schemas?.actions ?? {};
     const actionsByPackage = {};
@@ -23,12 +24,10 @@
         actionsByPackage[action.package].push(action);
     }
     for (const [packageName, actions] of Object.entries(actionsByPackage)){
-        let packageSchemas;
-        try {
-            packageSchemas = await import(/* webpackIgnore: true */ `${packageName}/schemas`);
-        } catch  {
-        // Package not resolvable from build context (custom plugins) — skip
-        }
+        const packageSchemas = await importPluginModule({
+            context,
+            specifier: `${packageName}/schemas`
+        });
         for (const action of actions){
             if (typesMapSchemas[action.typeName]) {
                 schemas[action.typeName] = typesMapSchemas[action.typeName];

package/dist/build/writePluginImports/writeAuthImports.js

@@ -30,5 +30,9 @@ async function writeAuthImports({ components, context }) {
         imports: components.imports.auth.providers,
         importPath: 'auth/providers'
     }));
+    await context.writeBuildArtifact('plugins/auth/strategies.js', generateImportFile({
+        imports: components.imports.auth.strategies,
+        importPath: 'auth/strategies'
+    }));
 }
 export default writeAuthImports;