@lowdefy/server-dev 6.1.0 → 7.0.0

package/lib/docs/rails/checkAuthActionsRan.test.mjs

@@ -0,0 +1,149 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+
+import checkAuthActionsRan, { armAuthActionRecorder } from './checkAuthActionsRan.js';
+import authEngineMethods from './authEngineMethods.js';
+
+// A page whose evaluate runs the function here, against a window made for the test.
+function createPage(window) {
+  return {
+    evaluate: async (fn, arg) => {
+      globalThis.window = window;
+      try {
+        return await fn(arg);
+      } finally {
+        delete globalThis.window;
+      }
+    },
+  };
+}
+
+// The app calling an auth method while its document is the page's window.
+async function callAuth(window, method, ...args) {
+  globalThis.window = window;
+  try {
+    return await window.auth[method](...args);
+  } finally {
+    delete globalThis.window;
+  }
+}
+
+function createWindow() {
+  const store = new Map();
+  const auth = {
+    login: jest.fn(async () => 'logged in'),
+    setActiveOrganization: jest.fn(async () => 'switched'),
+    updateSession: jest.fn(async () => 'synced'),
+    notAuthEngine: jest.fn(),
+  };
+  return {
+    auth,
+    lowdefy: { _internal: { auth } },
+    sessionStorage: {
+      getItem: (key) => store.get(key) ?? null,
+      setItem: (key, value) => store.set(key, value),
+      removeItem: (key) => store.delete(key),
+    },
+  };
+}
+
+const journey = { dataSetRails: {} };
+
+test('a click whose auth actions were skipped passes', async () => {
+  const window = createWindow();
+  const page = createPage(window);
+  await armAuthActionRecorder({ journey, page });
+  await expect(
+    checkAuthActionsRan({ journey, page, blockId: 'create_org' })
+  ).resolves.toBeUndefined();
+});
+
+test('a click that ran an auth action fails, naming the block and the action', async () => {
+  const window = createWindow();
+  const page = createPage(window);
+  await armAuthActionRecorder({ journey, page });
+  await callAuth(window, 'setActiveOrganization', { organizationId: 'a' });
+  await callAuth(window, 'updateSession');
+  await expect(checkAuthActionsRan({ journey, page, blockId: 'create_org' })).rejects.toMatchObject(
+    {
+      message: expect.stringMatching(
+        /^Block "create_org" ran the auth action SetActiveOrganization, UpdateSession, which a data-set journey cannot run: its users are injected and have no auth session\./
+      ),
+      expected: 'a click that runs no auth action',
+      actual: 'a click that ran the auth action SetActiveOrganization, UpdateSession',
+    }
+  );
+  // The recording is cleared once read.
+  await expect(
+    checkAuthActionsRan({ journey, page, blockId: 'create_org' })
+  ).resolves.toBeUndefined();
+});
+
+test('a wrapped auth method still calls through with its arguments and result', async () => {
+  const window = createWindow();
+  const original = window.auth.login;
+  await armAuthActionRecorder({ journey, page: createPage(window) });
+  await expect(callAuth(window, 'login', { email: 'a@b.c' })).resolves.toBe('logged in');
+  expect(original).toHaveBeenCalledWith({ email: 'a@b.c' });
+});
+
+test('methods that are not auth-engine methods are not recorded', async () => {
+  const window = createWindow();
+  const page = createPage(window);
+  await armAuthActionRecorder({ journey, page });
+  await callAuth(window, 'notAuthEngine');
+  await expect(checkAuthActionsRan({ journey, page })).resolves.toBeUndefined();
+});
+
+test('the recording is read back after the document that made it is replaced', async () => {
+  const first = createWindow();
+  await armAuthActionRecorder({ journey, page: createPage(first) });
+  await callAuth(first, 'login', {});
+  // A navigation: a new document with the same sessionStorage.
+  const second = createWindow();
+  second.sessionStorage = first.sessionStorage;
+  await expect(
+    checkAuthActionsRan({ journey, page: createPage(second), blockId: 'sign_in' })
+  ).rejects.toMatchObject({ actual: 'a click that ran the auth action Login' });
+});
+
+test('a click with no known block says A click', async () => {
+  const window = createWindow();
+  const page = createPage(window);
+  await armAuthActionRecorder({ journey, page });
+  await callAuth(window, 'login', {});
+  await expect(checkAuthActionsRan({ journey, page, blockId: null })).rejects.toMatchObject({
+    message: expect.stringMatching(/^A click ran the auth action Login,/),
+  });
+});
+
+test('a journey without a data set is not recorded or checked', async () => {
+  const window = createWindow();
+  const page = createPage(window);
+  await armAuthActionRecorder({ journey: {}, page });
+  await callAuth(window, 'login', {});
+  expect(window.sessionStorage.getItem('__lowdefyAuthActions')).toBeNull();
+  await expect(checkAuthActionsRan({ journey: {}, page })).resolves.toBeUndefined();
+});
+
+test('a page with no auth methods records nothing and does not fail', async () => {
+  const page = createPage({ lowdefy: {}, sessionStorage: createWindow().sessionStorage });
+  await armAuthActionRecorder({ journey, page });
+  await expect(checkAuthActionsRan({ journey, page })).resolves.toBeUndefined();
+  expect(Object.keys(authEngineMethods).length).toBeGreaterThan(0);
+});

package/lib/docs/rails/checkClickRails.js

@@ -0,0 +1,56 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+import JourneyStepError from '../JourneyStepError.js';
+import { armAuthActionRecorder } from './checkAuthActionsRan.js';
+
+// The Lowdefy block a click lands on: the nearest #bl-<blockId> wrapper of the
+// element the click resolved to, the element itself included. A `text` or
+// `containing` target has no blockId of its own, and a container target is
+// clicked on the control inside it, which may be a block of its own.
+async function readClickedBlockId({ locator }) {
+  return locator.evaluate((element) => element.closest('[id^="bl-"]')?.id.slice(3) ?? null);
+}
+
+// On a data-set run (journey.dataSetRails), refuses a click that would reach a
+// connection whose type does not declare a data-set mode the session can run
+// (redirect or walled) before it acts, and starts recording the auth-engine
+// actions the click runs (checkAuthActionsRan fails the step if one does).
+// Returns the clicked block's id, or null when it is not known. Journeys
+// without a data set click anything.
+async function checkClickRails({ journey, page, locator }) {
+  if (type.isUndefined(journey.dataSetRails)) {
+    return null;
+  }
+  await armAuthActionRecorder({ journey, page });
+  const pageId = await page.evaluate(() => window.lowdefy?.pageId);
+  const blockId = await readClickedBlockId({ locator });
+  if (type.isNone(pageId) || blockId === null) {
+    return blockId;
+  }
+  const refused = journey.dataSetRails.refusal({ pageId, blockId });
+  if (refused === null) {
+    return blockId;
+  }
+  throw new JourneyStepError(refused.message, {
+    expected: 'a click a data-set journey can make',
+    actual: refused.actual,
+  });
+}
+
+export default checkClickRails;

package/lib/docs/rails/createDataSetRails.js

@@ -0,0 +1,82 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+import { normaliseBlockId } from '@lowdefy/node-utils';
+
+import findExternalBlocks from './findExternalBlocks.js';
+
+// A list item's block (`rows.2.delete`) is listed by its template id
+// (`rows.$.delete`).
+function findListed({ blocks, blockId }) {
+  const normalised = normaliseBlockId(blockId);
+  const listed = Object.keys(blocks).find((id) => normaliseBlockId(id) === normalised);
+  return type.isUndefined(listed) ? undefined : blocks[listed];
+}
+
+// What the connection's type declares, as the author would fix it.
+function describeDeclaration({ type: connectionType, dataSet }) {
+  if (type.isNone(connectionType)) return 'no connection artifact';
+  if (type.isNone(dataSet)) return `${connectionType}, no dataSet declaration`;
+  return `${connectionType}, dataSet: ${dataSet}`;
+}
+
+function describeReason({ dataSet }) {
+  if (dataSet === 'external') return 'which reaches a real service';
+  return 'which a data set cannot redirect';
+}
+
+function describeConnection(connection) {
+  return `"${connection.connectionId}" (${describeDeclaration(connection)})`;
+}
+
+// The static rail of a data-set journey run: a click on a block whose events
+// reach a connection whose type declares meta.dataSet 'external', declares
+// nothing, or has no artifact would reach a real service or be refused by the
+// gate. Declarations are read from connections, the plugin connection map the
+// gate reads. refusal({ pageId, blockId }) says why such a click is refused, or
+// null when the block may be clicked. Each page's list is read from the build
+// once per run. (Auth-engine actions are a runtime rail: see
+// checkAuthActionsRan.)
+function createDataSetRails({ buildDirectory, connections }) {
+  const pages = new Map();
+  function readPage(pageId) {
+    if (!pages.has(pageId)) {
+      pages.set(pageId, findExternalBlocks({ buildDirectory, pageId, connections }).blocks);
+    }
+    return pages.get(pageId);
+  }
+  function refusal({ pageId, blockId }) {
+    const refused = findListed({ blocks: readPage(pageId), blockId });
+    if (!type.isUndefined(refused)) {
+      const reasons = refused
+        .map(
+          (connection) =>
+            `connection ${describeConnection(connection)}, ${describeReason(connection)}`
+        )
+        .join(', and ');
+      const named = refused.map(describeConnection).join(', ');
+      return {
+        message: `Block "${blockId}" reaches ${reasons}, so a data-set journey cannot click it.`,
+        actual: `a click that reaches connection ${named}`,
+      };
+    }
+    return null;
+  }
+  return { refusal };
+}
+
+export default createDataSetRails;

package/lib/docs/rails/createDataSetRails.test.mjs

@@ -0,0 +1,172 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import createDataSetRails from './createDataSetRails.js';
+
+let buildDirectory;
+
+const connections = {
+  MongoDBCollection: { meta: { tenant: true, dataSet: 'redirect' } },
+  AxiosHttp: { meta: { dataSet: 'external' } },
+  FolderRuntime: { meta: { dataSet: 'redirect' } },
+  WalledRuntime: { meta: { tenant: false, dataSet: 'walled' } },
+  Knex: {},
+};
+
+function write(name, value) {
+  const filePath = path.join(buildDirectory, name);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(value));
+}
+
+function button(blockId, ...actions) {
+  return {
+    blockId,
+    type: 'Button',
+    events: { onClick: { try: actions, catch: [] } },
+  };
+}
+
+beforeEach(() => {
+  buildDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'lowdefy-rails-'));
+  write('pages/orders.json', {
+    pageId: 'orders',
+    blockId: 'orders',
+    requests: [{ requestId: 'save' }, { requestId: 'notify' }],
+    slots: {
+      content: {
+        blocks: [
+          button('save_button', { id: 's', type: 'Request', params: 'save' }),
+          button('notify_button', { id: 'n', type: 'Request', params: 'notify' }),
+          button('logout_button', { id: 'l', type: 'Logout' }),
+          button('accept_button', { id: 'a', type: 'Request', params: 'accept' }),
+          button('archive_button', { id: 'a', type: 'Request', params: 'archive' }),
+          button('report_button', { id: 'r', type: 'Request', params: 'report' }),
+          button('orphan_button', { id: 'o', type: 'Request', params: 'orphan' }),
+          button(
+            'everything_button',
+            { id: 'n', type: 'Request', params: 'notify' },
+            { id: 'r', type: 'Request', params: 'report' },
+            { id: 'o', type: 'Request', params: 'orphan' }
+          ),
+          {
+            blockId: 'rows',
+            type: 'List',
+            slots: {
+              content: {
+                blocks: [button('rows.$.notify', { id: 'n', type: 'Request', params: 'notify' })],
+              },
+            },
+          },
+        ],
+      },
+    },
+  });
+  write('pages/orders/requests/save.json', { requestId: 'save', connectionId: 'orders_db' });
+  write('pages/orders/requests/notify.json', { requestId: 'notify', connectionId: 'mailer' });
+  write('connections/orders_db.json', { connectionId: 'orders_db', type: 'MongoDBCollection' });
+  write('connections/mailer.json', { connectionId: 'mailer', type: 'AxiosHttp' });
+  write('pages/orders/requests/accept.json', { requestId: 'accept', connectionId: 'runtime' });
+  write('pages/orders/requests/archive.json', { requestId: 'archive', connectionId: 'folders' });
+  write('pages/orders/requests/report.json', { requestId: 'report', connectionId: 'sql' });
+  write('pages/orders/requests/orphan.json', { requestId: 'orphan', connectionId: 'gone' });
+  write('connections/runtime.json', { connectionId: 'runtime', type: 'WalledRuntime' });
+  write('connections/folders.json', { connectionId: 'folders', type: 'FolderRuntime' });
+  write('connections/sql.json', { connectionId: 'sql', type: 'Knex' });
+});
+
+afterEach(() => {
+  fs.rmSync(buildDirectory, { recursive: true, force: true });
+});
+
+test('a block whose request uses a MongoDBCollection connection, declaring redirect, may be clicked', () => {
+  const rails = createDataSetRails({ buildDirectory, connections });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'save_button' })).toBeNull();
+});
+
+test('a block that reaches a plugin type declaring redirect or walled may be clicked', () => {
+  const rails = createDataSetRails({ buildDirectory, connections });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'archive_button' })).toBeNull();
+  expect(rails.refusal({ pageId: 'orders', blockId: 'accept_button' })).toBeNull();
+});
+
+test('a block that reaches a connection declaring external is refused, naming the declaration', () => {
+  const rails = createDataSetRails({ buildDirectory, connections });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'notify_button' })).toEqual({
+    message:
+      'Block "notify_button" reaches connection "mailer" (AxiosHttp, dataSet: external), which reaches a real service, so a data-set journey cannot click it.',
+    actual: 'a click that reaches connection "mailer" (AxiosHttp, dataSet: external)',
+  });
+});
+
+test('a block that reaches a connection whose type declares nothing is refused, saying so', () => {
+  const rails = createDataSetRails({ buildDirectory, connections });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'report_button' })).toEqual({
+    message:
+      'Block "report_button" reaches connection "sql" (Knex, no dataSet declaration), which a data set cannot redirect, so a data-set journey cannot click it.',
+    actual: 'a click that reaches connection "sql" (Knex, no dataSet declaration)',
+  });
+});
+
+test('a block that reaches a connection with no artifact is refused, saying so', () => {
+  const rails = createDataSetRails({ buildDirectory, connections });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'orphan_button' })).toEqual({
+    message:
+      'Block "orphan_button" reaches connection "gone" (no connection artifact), which a data set cannot redirect, so a data-set journey cannot click it.',
+    actual: 'a click that reaches connection "gone" (no connection artifact)',
+  });
+});
+
+test('a block that reaches several refused connections names each with its declaration', () => {
+  const rails = createDataSetRails({ buildDirectory, connections });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'everything_button' })).toEqual({
+    message:
+      'Block "everything_button" reaches connection "gone" (no connection artifact), which a data set cannot redirect, and connection "mailer" (AxiosHttp, dataSet: external), which reaches a real service, and connection "sql" (Knex, no dataSet declaration), which a data set cannot redirect, so a data-set journey cannot click it.',
+    actual:
+      'a click that reaches connection "gone" (no connection artifact), "mailer" (AxiosHttp, dataSet: external), "sql" (Knex, no dataSet declaration)',
+  });
+});
+
+test('a MongoDBCollection connection is refused when the connection map does not declare it', () => {
+  const { MongoDBCollection, ...withoutMongo } = connections;
+  const rails = createDataSetRails({ buildDirectory, connections: withoutMongo });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'save_button' })?.actual).toBe(
+    'a click that reaches connection "orders_db" (MongoDBCollection, no dataSet declaration)'
+  );
+});
+
+test('a list item block is matched through its template id', () => {
+  const rails = createDataSetRails({ buildDirectory, connections });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'rows.2.notify' })?.actual).toBe(
+    'a click that reaches connection "mailer" (AxiosHttp, dataSet: external)'
+  );
+});
+
+test('a block that runs an auth action is not refused: the auth rail acts at runtime', () => {
+  const rails = createDataSetRails({ buildDirectory, connections });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'logout_button' })).toBeNull();
+});
+
+test("a page's lists are read once per run", () => {
+  const rails = createDataSetRails({ buildDirectory, connections });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'save_button' })).toBeNull();
+  fs.rmSync(path.join(buildDirectory, 'pages'), { recursive: true });
+  expect(rails.refusal({ pageId: 'orders', blockId: 'notify_button' })).not.toBeNull();
+});

package/lib/docs/rails/findExternalBlocks.js

@@ -0,0 +1,147 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+import pageBlocks from '../pageBlocks.js';
+import readBuiltArtifact from './readBuiltArtifact.js';
+import readRoutineSteps from '../readRoutineSteps.js';
+
+// The meta.dataSet declarations a data session runs against the session's database (see
+// lib/server/applyDataSetRedirect.js): 'redirect' takes the session database, 'walled' reaches it
+// only through walled connections. Every other declaration, or none, would reach a real service or
+// is refused by the gate.
+const CLICKABLE_DATA_SET_MODES = new Set(['redirect', 'walled']);
+
+// An 'external' type with request resolvers is clickable too: under a data session its requests
+// are sunk (recorded, never sent), see lib/server/sinkExternalConnections.js. An external type
+// with none (an Mcp config container) has nothing to sink and stays refused.
+function isSunk({ connections, connectionType, dataSet }) {
+  if (dataSet !== 'external') return false;
+  const requests = connections[connectionType]?.requests;
+  return type.isObject(requests) && Object.keys(requests).length > 0;
+}
+
+function requestedIds({ params, pageRequestIds }) {
+  if (type.isString(params)) return [params];
+  if (type.isArray(params)) return params.filter((id) => type.isString(id));
+  if (!type.isObject(params)) return [];
+  if (params.all === true) return pageRequestIds;
+  if (type.isString(params.requestId)) return [params.requestId];
+  if (type.isArray(params.requestIds)) return params.requestIds.filter((id) => type.isString(id));
+  return [];
+}
+
+function createConnectionReader({ buildDirectory }) {
+  const types = new Map();
+  return function connectionType(connectionId) {
+    if (!types.has(connectionId)) {
+      const connection = readBuiltArtifact({
+        buildDirectory,
+        name: `connections/${connectionId}.json`,
+      });
+      types.set(connectionId, connection?.type ?? null);
+    }
+    return types.get(connectionId);
+  };
+}
+
+// The connections an endpoint's routine reaches, through endpoints its
+// CallApi steps call. A dev build only warns about a call to an endpoint
+// with no artifact (callapi-refs), so such a call reaches nothing.
+function endpointConnections({ buildDirectory, endpointId }) {
+  const connections = new Set();
+  const seen = new Set();
+  const queue = [endpointId];
+  while (queue.length > 0) {
+    const id = queue.shift();
+    if (seen.has(id)) continue;
+    seen.add(id);
+    const endpoint = readBuiltArtifact({ buildDirectory, name: `api/${id}.json` });
+    if (endpoint === null) continue;
+    readRoutineSteps({ routine: endpoint.routine }).forEach((step) => {
+      if (type.isString(step.connectionId)) connections.add(step.connectionId);
+      if (step.type === 'CallApi' && type.isString(step.properties?.endpointId)) {
+        queue.push(step.properties.endpointId);
+      }
+    });
+  }
+  return connections;
+}
+
+// The declared data-set mode of a connection type, from the plugin connection map the gate reads.
+function dataSetMode({ connections, connectionType }) {
+  if (type.isNone(connectionType)) return null;
+  return connections[connectionType]?.meta?.dataSet ?? null;
+}
+
+// The blocks of a page whose events reach a connection a data set cannot run
+// against its database, through a Request action or a CallAPI into endpoint
+// routines. A connection is refused when its type declares meta.dataSet
+// 'external', declares nothing (or any value but 'redirect' and 'walled'), or
+// it has no artifact. Each block lists the connections it reaches as
+// { connectionId, type, dataSet } (type null for a connection with no
+// artifact, dataSet the declared value or null). The rails mirror the
+// declaration only: a redirect connection whose properties the gate refuses
+// fails when its request runs. A data-set journey may not click these blocks
+// (see createDataSetRails). Ids computed by operators are not followed.
+function findExternalBlocks({ buildDirectory, pageId, connections }) {
+  const page = readBuiltArtifact({ buildDirectory, name: `pages/${pageId}.json` });
+  if (page === null) {
+    throw new Error(`Page "${pageId}" has no build artifact in ${buildDirectory}.`);
+  }
+  const pageRequestIds = (page.requests ?? []).map((request) => request.requestId);
+  const connectionType = createConnectionReader({ buildDirectory });
+  const blocks = {};
+  pageBlocks(page).forEach(({ blockId, actions }) => {
+    const reached = new Set();
+    actions.forEach((action) => {
+      if (action.type === 'Request') {
+        requestedIds({ params: action.params, pageRequestIds }).forEach((requestId) => {
+          const request = readBuiltArtifact({
+            buildDirectory,
+            name: `pages/${pageId}/requests/${requestId}.json`,
+          });
+          if (type.isString(request?.connectionId)) reached.add(request.connectionId);
+        });
+      }
+      if (action.type === 'CallAPI' && type.isString(action.params?.endpointId)) {
+        endpointConnections({ buildDirectory, endpointId: action.params.endpointId }).forEach(
+          (connectionId) => reached.add(connectionId)
+        );
+      }
+    });
+    const external = [...reached]
+      .sort()
+      .map((connectionId) => {
+        const reachedType = connectionType(connectionId);
+        return {
+          connectionId,
+          type: reachedType,
+          dataSet: dataSetMode({ connections, connectionType: reachedType }),
+        };
+      })
+      .filter(
+        (connection) =>
+          !CLICKABLE_DATA_SET_MODES.has(connection.dataSet) &&
+          !isSunk({ connections, connectionType: connection.type, dataSet: connection.dataSet })
+      );
+    if (external.length > 0) blocks[blockId] = external;
+  });
+  return { blocks };
+}
+
+export default findExternalBlocks;