@happyvertical/smrt-core 0.44.1 → 0.45.1

package/dist/vite-plugin/resources-route.js

@@ -0,0 +1,154 @@
+import { AUTO_GENERATED_ROUTE_HEADER } from "./route-header.js";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region src/vite-plugin/resources-route.ts
+/**
+* SvelteKit `_resources` route generation — CLI discovery endpoint (#2663;
+* parent epic #2655).
+*
+* Emits `{routesDir}/_resources/+server.ts`: `GET /api/_resources`, the
+* endpoint the distributable CLI (`@happyvertical/smrt-app-cli`) reads to
+* learn which resources and commands it can invoke. Every other generated
+* route lives in `sveltekit-generator.ts` or a sibling emitter; this one is
+* kept in its own module for the same reason `changes-route.ts` and
+* `events-route.ts` are — a one-line registration hook in the shared
+* generator file.
+*
+* ## The dependency constraint
+*
+* The handler this route delegates to, `createResourceListHandler`, lives in
+* `@happyvertical/smrt-users` — and `smrt-users` depends on `smrt-core`, not
+* the reverse, so core cannot import it directly. That is not a problem for
+* *emitting* the import: the generated file is written into the consumer's
+* own `src/routes/`, where `@happyvertical/smrt-users` resolves through the
+* consumer's own dependency graph, exactly like the `@happyvertical/smrt-tenancy`
+* import `sveltekit-generator.ts`'s `generateTenantContextHelper` already
+* emits into tenant-scoped routes (see the comment above that function). The
+* only question is *when* it is safe to emit — a consumer that never took a
+* dependency on `smrt-users` must never receive a route whose import cannot
+* resolve, or a working build turns red.
+*
+* ## Detection mechanism
+*
+* Unlike the tenancy guard — which reads a semantic signal already present in
+* the manifest (whether any object is `@TenantScoped`, which itself implies
+* the app depends on `smrt-tenancy`) — nothing in the manifest indicates
+* whether a consumer has taken on `smrt-users`. Objects don't declare an
+* auth dependency; the app does, at the package level.
+*
+* So this route uses a **resolvable-dependency check**: does the exact
+* subpath the generated file imports — `@happyvertical/smrt-users/sveltekit`
+* — resolve from the consumer's `projectRoot`, via a `createRequire` rooted
+* at the consumer's own `package.json`? That is stronger than reading
+* `package.json`'s `dependencies` block (which can list a package that was
+* never installed) and, unlike a single hardcoded
+* `node_modules/@happyvertical/smrt-users/package.json` path, it uses
+* Node's real module resolution — so it also finds the package when a
+* workspace hoists shared dependencies to an ancestor `node_modules` (npm/
+* yarn workspaces, or pnpm with `node-linker=hoisted`) rather than
+* installing them directly under the consumer's own `projectRoot`.
+* Resolving the `/sveltekit` subpath specifically, rather than the
+* package's bare `package.json`, matters too: `smrt-users`'s `exports` map
+* does not list `./package.json`, so resolving that path would throw
+* `ERR_PACKAGE_PATH_NOT_EXPORTED` even when the package is genuinely
+* installed — resolving the subpath the route actually imports sidesteps
+* that and checks precisely the thing that must succeed at build time.
+*
+* An explicit `sveltekit: { resourcesRoute: { enabled: false } }` escape
+* hatch is also available, matching `changesRoute`/`eventsRoute`, for a
+* consumer that has `smrt-users` installed but wants to keep hand-writing
+* (or omit) `_resources`.
+*
+* ## Preserving a hand-written route
+*
+* Every consumer today hand-writes this route (the reference implementation
+* in the issue). `clearGeneratedRouteFiles` (in `sveltekit-generator.ts`)
+* already only deletes `+server.ts` files that start with
+* {@link AUTO_GENERATED_ROUTE_HEADER}, so a hand-written `_resources` route —
+* which never carries that header — survives the pre-generation sweep
+* untouched. This emitter additionally checks `existsSync` on the target
+* path before writing: by the time it runs, anything still there is
+* necessarily hand-written (a generator-owned copy would already have been
+* swept), so its mere presence is sufficient to skip generation and leave it
+* alone.
+*
+* Once a consumer's `_resources` route IS generator-owned (no hand-written
+* file present, `smrt-users` resolvable), its path is generator-owned for
+* `.gitignore` purposes too — it is included in `generatedRoutePaths` like
+* any other emitted route, so `updateGitignore` puts it in the managed
+* block. A project that migrated from a hand-written route to a fully
+* generated one may still carry a stale `# Application-owned rule` comment
+* above the same literal path from before the migration; `updateGitignore`
+* only ever touches its own managed block, so that stale comment is left as
+* project history for the consumer to clean up — the same way any other
+* manual `.gitignore` edit outside the managed block is preserved.
+*/
+/**
+* Whether `@happyvertical/smrt-users/sveltekit` — the exact subpath the
+* generated route imports — is resolvable from the consumer at
+* `projectRoot`. See the module doc for why this check (rather than reading
+* `package.json`'s declared `dependencies`, or checking one hardcoded
+* physical path) is the chosen signal.
+*/
+function consumerHasSmrtUsers(projectRoot) {
+	try {
+		createRequire(pathToFileURL(join(projectRoot, "package.json")).href).resolve("@happyvertical/smrt-users/sveltekit");
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Generate the `_resources/+server.ts` route. Returns true when a route was
+* written. Disabled with `sveltekit: { resourcesRoute: { enabled: false } }`;
+* skipped (with a log line) when `@happyvertical/smrt-users` is not
+* resolvable from the consumer, or when a hand-written route already
+* occupies the path.
+*/
+function generateResourcesRoute(projectRoot, options) {
+	if (options.resourcesRoute?.enabled === false) return false;
+	if (!consumerHasSmrtUsers(projectRoot)) {
+		console.log("[smrt] Skipping _resources route - @happyvertical/smrt-users is not resolvable; createResourceListHandler would not resolve in the consumer build");
+		return false;
+	}
+	const routeDir = join(projectRoot, options.routesDir, "_resources");
+	const filePath = join(routeDir, "+server.ts");
+	const existingServerFile = ["+server.ts", "+server.js"].find((name) => existsSync(join(routeDir, name)));
+	if (existingServerFile) {
+		console.log(`[smrt] Preserving hand-written _resources route (${existingServerFile}, not generator-owned)`);
+		return false;
+	}
+	if (!existsSync(routeDir)) mkdirSync(routeDir, { recursive: true });
+	writeFileSync(filePath, generateResourcesRouteTemplate(options), "utf-8");
+	console.log(`[smrt] Generated: ${filePath}`);
+	return true;
+}
+function generateResourcesRouteTemplate(options) {
+	return `${AUTO_GENERATED_ROUTE_HEADER}
+// DO NOT EDIT - changes will be overwritten
+//
+// GET /api/_resources — CLI discovery endpoint (#2663). Returns the auth-aware
+// list of resources and commands the distributable CLI
+// (@happyvertical/smrt-app-cli) can invoke, derived from ObjectRegistry by
+// createResourceListHandler. Subsumes the route every consumer previously
+// hand-wrote (see the issue for the reference implementation this replaces).
+
+import { createResourceListHandler } from '@happyvertical/smrt-users/sveltekit';
+// Side effect: registers @smrt() classes in ObjectRegistry before the
+// handler walks it (mirrors the generated CRUD/changes/events routes'
+// $lib/server/smrt import).
+import '$lib/server/smrt';
+
+export const GET = createResourceListHandler({
+  ensureRegistry: async () => {
+    await import('$lib/server/smrt');
+  },${options.kebabRoutes ? "\n  kebabRoutes: true," : ""}
+});
+`;
+}
+//#endregion
+export { consumerHasSmrtUsers, generateResourcesRoute };
+
+//# sourceMappingURL=resources-route.js.map

package/dist/vite-plugin/resources-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources-route.js","names":[],"sources":["../../src/vite-plugin/resources-route.ts"],"sourcesContent":["/**\n * SvelteKit `_resources` route generation — CLI discovery endpoint (#2663;\n * parent epic #2655).\n *\n * Emits `{routesDir}/_resources/+server.ts`: `GET /api/_resources`, the\n * endpoint the distributable CLI (`@happyvertical/smrt-app-cli`) reads to\n * learn which resources and commands it can invoke. Every other generated\n * route lives in `sveltekit-generator.ts` or a sibling emitter; this one is\n * kept in its own module for the same reason `changes-route.ts` and\n * `events-route.ts` are — a one-line registration hook in the shared\n * generator file.\n *\n * ## The dependency constraint\n *\n * The handler this route delegates to, `createResourceListHandler`, lives in\n * `@happyvertical/smrt-users` — and `smrt-users` depends on `smrt-core`, not\n * the reverse, so core cannot import it directly. That is not a problem for\n * *emitting* the import: the generated file is written into the consumer's\n * own `src/routes/`, where `@happyvertical/smrt-users` resolves through the\n * consumer's own dependency graph, exactly like the `@happyvertical/smrt-tenancy`\n * import `sveltekit-generator.ts`'s `generateTenantContextHelper` already\n * emits into tenant-scoped routes (see the comment above that function). The\n * only question is *when* it is safe to emit — a consumer that never took a\n * dependency on `smrt-users` must never receive a route whose import cannot\n * resolve, or a working build turns red.\n *\n * ## Detection mechanism\n *\n * Unlike the tenancy guard — which reads a semantic signal already present in\n * the manifest (whether any object is `@TenantScoped`, which itself implies\n * the app depends on `smrt-tenancy`) — nothing in the manifest indicates\n * whether a consumer has taken on `smrt-users`. Objects don't declare an\n * auth dependency; the app does, at the package level.\n *\n * So this route uses a **resolvable-dependency check**: does the exact\n * subpath the generated file imports — `@happyvertical/smrt-users/sveltekit`\n * — resolve from the consumer's `projectRoot`, via a `createRequire` rooted\n * at the consumer's own `package.json`? That is stronger than reading\n * `package.json`'s `dependencies` block (which can list a package that was\n * never installed) and, unlike a single hardcoded\n * `node_modules/@happyvertical/smrt-users/package.json` path, it uses\n * Node's real module resolution — so it also finds the package when a\n * workspace hoists shared dependencies to an ancestor `node_modules` (npm/\n * yarn workspaces, or pnpm with `node-linker=hoisted`) rather than\n * installing them directly under the consumer's own `projectRoot`.\n * Resolving the `/sveltekit` subpath specifically, rather than the\n * package's bare `package.json`, matters too: `smrt-users`'s `exports` map\n * does not list `./package.json`, so resolving that path would throw\n * `ERR_PACKAGE_PATH_NOT_EXPORTED` even when the package is genuinely\n * installed — resolving the subpath the route actually imports sidesteps\n * that and checks precisely the thing that must succeed at build time.\n *\n * An explicit `sveltekit: { resourcesRoute: { enabled: false } }` escape\n * hatch is also available, matching `changesRoute`/`eventsRoute`, for a\n * consumer that has `smrt-users` installed but wants to keep hand-writing\n * (or omit) `_resources`.\n *\n * ## Preserving a hand-written route\n *\n * Every consumer today hand-writes this route (the reference implementation\n * in the issue). `clearGeneratedRouteFiles` (in `sveltekit-generator.ts`)\n * already only deletes `+server.ts` files that start with\n * {@link AUTO_GENERATED_ROUTE_HEADER}, so a hand-written `_resources` route —\n * which never carries that header — survives the pre-generation sweep\n * untouched. This emitter additionally checks `existsSync` on the target\n * path before writing: by the time it runs, anything still there is\n * necessarily hand-written (a generator-owned copy would already have been\n * swept), so its mere presence is sufficient to skip generation and leave it\n * alone.\n *\n * Once a consumer's `_resources` route IS generator-owned (no hand-written\n * file present, `smrt-users` resolvable), its path is generator-owned for\n * `.gitignore` purposes too — it is included in `generatedRoutePaths` like\n * any other emitted route, so `updateGitignore` puts it in the managed\n * block. A project that migrated from a hand-written route to a fully\n * generated one may still carry a stale `# Application-owned rule` comment\n * above the same literal path from before the migration; `updateGitignore`\n * only ever touches its own managed block, so that stale comment is left as\n * project history for the consumer to clean up — the same way any other\n * manual `.gitignore` edit outside the managed block is preserved.\n */\n\nimport { existsSync, mkdirSync, writeFileSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { AUTO_GENERATED_ROUTE_HEADER } from './route-header.js';\nimport type { SvelteKitOptions } from './sveltekit-generator.js';\n\n/**\n * Whether `@happyvertical/smrt-users/sveltekit` — the exact subpath the\n * generated route imports — is resolvable from the consumer at\n * `projectRoot`. See the module doc for why this check (rather than reading\n * `package.json`'s declared `dependencies`, or checking one hardcoded\n * physical path) is the chosen signal.\n */\nexport function consumerHasSmrtUsers(projectRoot: string): boolean {\n  try {\n    const consumerRequire = createRequire(\n      pathToFileURL(join(projectRoot, 'package.json')).href,\n    );\n    consumerRequire.resolve('@happyvertical/smrt-users/sveltekit');\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Generate the `_resources/+server.ts` route. Returns true when a route was\n * written. Disabled with `sveltekit: { resourcesRoute: { enabled: false } }`;\n * skipped (with a log line) when `@happyvertical/smrt-users` is not\n * resolvable from the consumer, or when a hand-written route already\n * occupies the path.\n */\nexport function generateResourcesRoute(\n  projectRoot: string,\n  options: SvelteKitOptions,\n): boolean {\n  if (options.resourcesRoute?.enabled === false) {\n    return false;\n  }\n\n  if (!consumerHasSmrtUsers(projectRoot)) {\n    console.log(\n      '[smrt] Skipping _resources route - @happyvertical/smrt-users is not ' +\n        'resolvable; createResourceListHandler would not resolve in the ' +\n        'consumer build',\n    );\n    return false;\n  }\n\n  const routeDir = join(projectRoot, options.routesDir, '_resources');\n  const filePath = join(routeDir, '+server.ts');\n\n  // By this point in generation, clearGeneratedRouteFiles has already swept\n  // any previously generator-owned copy at this path — anything still here\n  // is necessarily hand-written. Preserve it rather than clobbering a\n  // consumer's customized discovery route. Check every server-module\n  // extension SvelteKit resolves by default (`.js` and `.ts` — see\n  // https://svelte.dev/docs/kit/configuration#moduleExtensions), not only\n  // `.ts`: a hand-written `+server.js` is invisible to a `.ts`-only check,\n  // so the generator would write `+server.ts` alongside it and SvelteKit\n  // would then refuse the route with \"Multiple endpoint files found\".\n  const existingServerFile = ['+server.ts', '+server.js'].find((name) =>\n    existsSync(join(routeDir, name)),\n  );\n  if (existingServerFile) {\n    console.log(\n      `[smrt] Preserving hand-written _resources route (${existingServerFile}, not generator-owned)`,\n    );\n    return false;\n  }\n\n  if (!existsSync(routeDir)) {\n    mkdirSync(routeDir, { recursive: true });\n  }\n  writeFileSync(filePath, generateResourcesRouteTemplate(options), 'utf-8');\n  console.log(`[smrt] Generated: ${filePath}`);\n  return true;\n}\n\nfunction generateResourcesRouteTemplate(options: SvelteKitOptions): string {\n  const kebabRoutesOption = options.kebabRoutes ? '\\n  kebabRoutes: true,' : '';\n\n  return `${AUTO_GENERATED_ROUTE_HEADER}\n// DO NOT EDIT - changes will be overwritten\n//\n// GET /api/_resources — CLI discovery endpoint (#2663). Returns the auth-aware\n// list of resources and commands the distributable CLI\n// (@happyvertical/smrt-app-cli) can invoke, derived from ObjectRegistry by\n// createResourceListHandler. Subsumes the route every consumer previously\n// hand-wrote (see the issue for the reference implementation this replaces).\n\nimport { createResourceListHandler } from '@happyvertical/smrt-users/sveltekit';\n// Side effect: registers @smrt() classes in ObjectRegistry before the\n// handler walks it (mirrors the generated CRUD/changes/events routes'\n// $lib/server/smrt import).\nimport '$lib/server/smrt';\n\nexport const GET = createResourceListHandler({\n  ensureRegistry: async () => {\n    await import('$lib/server/smrt');\n  },${kebabRoutesOption}\n});\n`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgGA,SAAgB,qBAAqB,aAA8B;CACjE,IAAI;EAIF,cAFE,cAAc,KAAK,aAAa,cAAc,CAAC,CAAC,CAAC,IAEnD,CAAA,CAAgB,QAAQ,qCAAqC;EAC7D,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;AASA,SAAgB,uBACd,aACA,SACS;CACT,IAAI,QAAQ,gBAAgB,YAAY,OACtC,OAAO;CAGT,IAAI,CAAC,qBAAqB,WAAW,GAAG;EACtC,QAAQ,IACN,mJAGF;EACA,OAAO;CACT;CAEA,MAAM,WAAW,KAAK,aAAa,QAAQ,WAAW,YAAY;CAClE,MAAM,WAAW,KAAK,UAAU,YAAY;CAW5C,MAAM,qBAAqB,CAAC,cAAc,YAAY,CAAC,CAAC,MAAM,SAC5D,WAAW,KAAK,UAAU,IAAI,CAAC,CACjC;CACA,IAAI,oBAAoB;EACtB,QAAQ,IACN,oDAAoD,mBAAmB,uBACzE;EACA,OAAO;CACT;CAEA,IAAI,CAAC,WAAW,QAAQ,GACtB,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;CAEzC,cAAc,UAAU,+BAA+B,OAAO,GAAG,OAAO;CACxE,QAAQ,IAAI,qBAAqB,UAAU;CAC3C,OAAO;AACT;AAEA,SAAS,+BAA+B,SAAmC;CAGzE,OAAO,GAAG,4BAA4B;;;;;;;;;;;;;;;;;;MAFZ,QAAQ,cAAc,2BAA2B,GAoBrD;;;AAGxB"}

package/dist/vite-plugin/sveltekit-generator.d.ts

@@ -43,6 +43,16 @@ export interface SvelteKitOptions {
         allowedOrigins?: string[];
         allowCredentials?: boolean;
     };
+    /**
+     * CLI discovery `_resources` route generation (#2663). Enabled by default,
+     * but only ever emitted when `@happyvertical/smrt-users` is resolvable
+     * from the consumer (see `resources-route.ts` for the detection
+     * mechanism) — set `enabled: false` to opt out even when it is present. A
+     * pre-existing hand-written `_resources` route is always preserved.
+     */
+    resourcesRoute?: {
+        enabled?: boolean;
+    };
 }
 export interface ResolvedApiActionRouteConfig {
     scope: 'item' | 'collection';
@@ -88,19 +98,45 @@ export interface CliApiCoherenceViolation {
     unreachable: string[];
 }
 /**
- * Inspect a manifest and return classes whose `cli.include` references
- * methods not exposed via the API. Classes that opt out via
- * `cli: { skipApiCheck: true }` are skipped.
+ * Inspect a manifest and return classes whose effective CLI command set —
+ * `cli.include`/`cli.exclude` when spelled out, or (#2638) the same "every
+ * public method minus exclude" default `cli: true`/`cli: {}` resolves to —
+ * references a command not exposed via the API. Classes that opt out via
+ * `cli: { skipApiCheck: true }` are skipped, and so is a class with
+ * `cli: false` (no CLI surface at all).
  *
  * Throws nothing; returns the violation list so callers can choose to throw
  * or warn.
  */
 export declare function findCliApiCoherenceViolations(manifest: SmartObjectManifest): CliApiCoherenceViolation[];
 /**
- * Throw if any class in the manifest has `cli.include` methods that aren't
- * reachable via the API. Default build-time gate; opt-out per-class via
- * `cli: { skipApiCheck: true }` (or globally via the vite plugin option
- * `validateCliApiCoherence: false`).
+ * Throw if any class in the manifest has an EXPLICIT `cli.include` command
+ * that isn't reachable via the API. Default build-time gate; opt-out
+ * per-class via `cli: { skipApiCheck: true }` (or globally via the vite
+ * plugin option `validateCliApiCoherence: false`).
+ *
+ * This is deliberately narrower than `findCliApiCoherenceViolations` above.
+ * That function is now fully correct for the broader `cli: true`/`cli: {}`
+ * default surface too (#2638: same "every public method minus exclude"
+ * resolution `listCommands()` uses, so a bare `cli: true` is inspected the
+ * same as an explicit `include`). But `smrtPlugin()`'s default
+ * `validateCliApiCoherence: true` calls this THROWING gate unconditionally
+ * from every consuming package's own build (`configResolved`,
+ * `vite-plugin/index.ts`) -- and a full-monorepo build during #2638
+ * development showed that broader surface has thousands of pre-existing
+ * public getters/business-logic methods (e.g.
+ * `@happyvertical/smrt-ads:AdGroup.hasStarted`,
+ * `@happyvertical/smrt-tags:Tag.getParent`) across ~28 packages that were
+ * never meant to be REST-reachable and have no API route today. That
+ * over-exposure is real, pre-existing, and unrelated to #2638's framework-
+ * lifecycle-method defect -- flipping this gate to enforce it unconditionally
+ * would break every one of those packages' builds today, which is a
+ * repo-wide triage effort (add routes, or an explicit `cli.exclude`/
+ * `skipApiCheck` per owner) this PR did not undertake and is out of its
+ * file boundary. So the gate keeps its pre-#2638 blast radius -- classes
+ * that spell out a non-empty `cli.include` -- while `findCliApiCoherenceViolations`
+ * is complete and available (and covered by its own tests) for the broader
+ * check once that pre-existing surface is triaged.
  */
 export declare function validateCliIncludeAgainstApi(manifest: SmartObjectManifest): void;
 //# sourceMappingURL=sveltekit-generator.d.ts.map

package/dist/vite-plugin/sveltekit-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sveltekit-generator.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/sveltekit-generator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAQvE,OAAO,KAAK,EAGV,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAEV,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAY1B,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iFAAiF;IACjF,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC;;;OAGG;IACH,YAAY,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACrC;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;CACH;AAYD,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAqxBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKtD;AA+BD,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,EACjC,SAAS,EAAE,OAAO,EAClB,YAAY,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,EAC5C,YAAY,GAAE,MAAM,GAAG,YAEb,GACT,4BAA4B,CAwB9B;AAiUD;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAuFf;AAy0BD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,qBAAqB,EAChC,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,GAAG,CAAC,MAAM,CAAC,CA6Cb;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,mBAAmB,GAC5B,wBAAwB,EAAE,CA+B5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,mBAAmB,GAC5B,IAAI,CAkBN"}
+{"version":3,"file":"sveltekit-generator.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/sveltekit-generator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAYvE,OAAO,KAAK,EAGV,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAEV,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAa1B,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iFAAiF;IACjF,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC;;;OAGG;IACH,YAAY,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACrC;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxC;AAYD,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAqxBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKtD;AA+BD,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,EACjC,SAAS,EAAE,OAAO,EAClB,YAAY,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,EAC5C,YAAY,GAAE,MAAM,GAAG,YAEb,GACT,4BAA4B,CAwB9B;AAiUD;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAqGf;AAy0BD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,qBAAqB,EAChC,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,GAAG,CAAC,MAAM,CAAC,CA6Cb;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAuDD;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,mBAAmB,GAC5B,wBAAwB,EAAE,CAsB5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,mBAAmB,GAC5B,IAAI,CA2BN"}

package/dist/vite-plugin/sveltekit-generator.js

@@ -1,9 +1,11 @@
 import { MAX_LIST_LIMIT, buildDefaultListOrderBy } from "../query-bounds.js";
-import { resolveCustomActionMetadata } from "../generators/custom-action.js";
+import { resolveCustomActionMetadata, resolveCustomActionNames } from "../generators/custom-action.js";
+import { isFrameworkBaseClass } from "../registry/framework-base-classes.js";
 import { generateConditionalGetRouteHelper } from "../generators/conditional-get.js";
 import { AUTO_GENERATED_ROUTE_HEADER } from "./route-header.js";
 import { generateChangesRoute } from "./changes-route.js";
 import { generateEventsRoute } from "./events-route.js";
+import { generateResourcesRoute } from "./resources-route.js";
 import { generateSyncApplyRoute } from "./sync-apply-route.js";
 import { computeWebManifestHash, isCollectionManifestClass, resolveCollectionItemObject, resolveCollectionItemTypeName } from "./web-collections.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
@@ -764,6 +766,7 @@ async function generateSvelteKitRoutes(projectRoot, manifest, options) {
 	let generatedCount = 0;
 	let skippedCollections = 0;
 	for (const [className, objectDef] of Object.entries(manifest.objects)) {
+		if (isFrameworkBaseClass(objectDef.className, objectDef.packageName)) continue;
 		if (isCollectionManifestClass(manifest, objectDef)) {
 			const collectionRoutePaths = await generateCollectionRoutesForObject(projectRoot, className, objectDef, manifest, options);
 			generatedRoutePaths.push(...collectionRoutePaths);
@@ -781,6 +784,7 @@ async function generateSvelteKitRoutes(projectRoot, manifest, options) {
 	if (generateSyncApplyRoute(projectRoot, manifest, options)) generatedRoutePaths.push(join(projectRoot, options.routesDir, "sync", "apply", "+server.ts"));
 	if (generateChangesRoute(projectRoot, manifest, options)) generatedRoutePaths.push(join(projectRoot, options.routesDir, "_changes", "+server.ts"));
 	if (generateEventsRoute(projectRoot, manifest, options, computeWebManifestHash(manifest))) generatedRoutePaths.push(join(projectRoot, options.routesDir, "_events", "+server.ts"));
+	if (generateResourcesRoute(projectRoot, options)) generatedRoutePaths.push(join(projectRoot, options.routesDir, "_resources", "+server.ts"));
 	updateGitignore(projectRoot, generatedRoutePaths);
 	const skippedMsg = skippedCollections > 0 ? ` (skipped ${skippedCollections} collection classes)` : "";
 	console.log(`[smrt] Generated routes for ${generatedCount} SMRT objects${skippedMsg}`);
@@ -1295,9 +1299,54 @@ function resolveApiActionSet(objectDef, manifest) {
 	return actions;
 }
 /**
-* Inspect a manifest and return classes whose `cli.include` references
-* methods not exposed via the API. Classes that opt out via
-* `cli: { skipApiCheck: true }` are skipped.
+* Resolve the effective CLI command set for an object, for the cli↔api
+* coherence lint. Two distinct resolutions, chosen by whether `cli.include`
+* is spelled out:
+*
+* **Explicit `cli.include`** (preserves the lint's exact pre-#2638
+* algorithm): the literal `include − exclude`, verbatim, whether or not an
+* entry resolves to a real CRUD verb or a scanned public method. This is
+* deliberate, not an oversight -- an `include` entry that names a typo, a
+* getter (never in the manifest's `methods` map), or a private/protected
+* method (the scanner drops these rather than recording `isPublic: false`,
+* so nothing else catches it) must still surface as "unreachable" so the
+* build fails loudly on the config mistake, the same way it always has.
+* Resolving it instead through `resolveCustomActionNames` -- which only
+* iterates real scanned methods -- would silently drop such an entry with no
+* error at all (final review, #2638).
+*
+* **Bare `cli: true`/`cli: {}`** (#2638, the new case this lint now
+* inspects): every public custom method minus exclude, exactly the "every
+* public method minus exclude" resolution `CLIGenerator.listCommands()`
+* already applies (via `resolveCustomActionNames`, reused not
+* reimplemented) -- lifecycle methods excluded, same as everywhere else.
+* CRUD verbs are NOT checked in this branch: a class that closes its API
+* entirely (`api: false`) while keeping a default-open, CLI/MCP-only admin
+* surface (`cli: true`/omitted) is a common, intentional combination (see
+* `cli.skipApiCheck`'s own "in-process, no HTTP" doc comment); blanket-
+* checking CRUD reachability for every such class would flag that existing,
+* legitimate pattern across the whole codebase, not just the #2638 defect
+* (confirmed by running this against the full monorepo build during
+* development — it did exactly that).
+*/
+function resolveCliActionSet(objectDef) {
+	const cliConfig = objectDef.decoratorConfig?.cli;
+	if (cliConfig === false) return /* @__PURE__ */ new Set();
+	const included = typeof cliConfig === "object" ? cliConfig.include : void 0;
+	const excluded = typeof cliConfig === "object" && Array.isArray(cliConfig.exclude) ? cliConfig.exclude : [];
+	if (included) return new Set(included.filter((cmd) => !excluded.includes(cmd)));
+	return resolveCustomActionNames(Object.entries(objectDef.methods || {}), {
+		include: void 0,
+		exclude: excluded
+	}, STANDARD_API_ACTIONS);
+}
+/**
+* Inspect a manifest and return classes whose effective CLI command set —
+* `cli.include`/`cli.exclude` when spelled out, or (#2638) the same "every
+* public method minus exclude" default `cli: true`/`cli: {}` resolves to —
+* references a command not exposed via the API. Classes that opt out via
+* `cli: { skipApiCheck: true }` are skipped, and so is a class with
+* `cli: false` (no CLI surface at all).
 *
 * Throws nothing; returns the violation list so callers can choose to throw
 * or warn.
@@ -1306,14 +1355,12 @@ function findCliApiCoherenceViolations(manifest) {
 	const violations = [];
 	for (const [className, objectDef] of Object.entries(manifest.objects)) {
 		const cliConfig = objectDef.decoratorConfig?.cli;
-		if (!cliConfig || typeof cliConfig !== "object") continue;
-		if (cliConfig.skipApiCheck) continue;
-		if (!cliConfig.include || cliConfig.include.length === 0) continue;
-		const cliExclude = Array.isArray(cliConfig.exclude) ? cliConfig.exclude : [];
-		const effectiveCliCommands = cliConfig.include.filter((cmd) => !cliExclude.includes(cmd));
-		if (effectiveCliCommands.length === 0) continue;
+		if (cliConfig === false) continue;
+		if (typeof cliConfig === "object" && cliConfig.skipApiCheck) continue;
+		const effectiveCliCommands = resolveCliActionSet(objectDef);
+		if (effectiveCliCommands.size === 0) continue;
 		const apiActionSet = resolveApiActionSet(objectDef, manifest);
-		const unreachable = effectiveCliCommands.filter((action) => !apiActionSet.has(action));
+		const unreachable = [...effectiveCliCommands].filter((action) => !apiActionSet.has(action)).sort();
 		if (unreachable.length > 0) violations.push({
 			className,
 			unreachable
@@ -1322,15 +1369,41 @@ function findCliApiCoherenceViolations(manifest) {
 	return violations;
 }
 /**
-* Throw if any class in the manifest has `cli.include` methods that aren't
-* reachable via the API. Default build-time gate; opt-out per-class via
-* `cli: { skipApiCheck: true }` (or globally via the vite plugin option
-* `validateCliApiCoherence: false`).
+* Throw if any class in the manifest has an EXPLICIT `cli.include` command
+* that isn't reachable via the API. Default build-time gate; opt-out
+* per-class via `cli: { skipApiCheck: true }` (or globally via the vite
+* plugin option `validateCliApiCoherence: false`).
+*
+* This is deliberately narrower than `findCliApiCoherenceViolations` above.
+* That function is now fully correct for the broader `cli: true`/`cli: {}`
+* default surface too (#2638: same "every public method minus exclude"
+* resolution `listCommands()` uses, so a bare `cli: true` is inspected the
+* same as an explicit `include`). But `smrtPlugin()`'s default
+* `validateCliApiCoherence: true` calls this THROWING gate unconditionally
+* from every consuming package's own build (`configResolved`,
+* `vite-plugin/index.ts`) -- and a full-monorepo build during #2638
+* development showed that broader surface has thousands of pre-existing
+* public getters/business-logic methods (e.g.
+* `@happyvertical/smrt-ads:AdGroup.hasStarted`,
+* `@happyvertical/smrt-tags:Tag.getParent`) across ~28 packages that were
+* never meant to be REST-reachable and have no API route today. That
+* over-exposure is real, pre-existing, and unrelated to #2638's framework-
+* lifecycle-method defect -- flipping this gate to enforce it unconditionally
+* would break every one of those packages' builds today, which is a
+* repo-wide triage effort (add routes, or an explicit `cli.exclude`/
+* `skipApiCheck` per owner) this PR did not undertake and is out of its
+* file boundary. So the gate keeps its pre-#2638 blast radius -- classes
+* that spell out a non-empty `cli.include` -- while `findCliApiCoherenceViolations`
+* is complete and available (and covered by its own tests) for the broader
+* check once that pre-existing surface is triaged.
 */
 function validateCliIncludeAgainstApi(manifest) {
-	const violations = findCliApiCoherenceViolations(manifest);
+	const violations = findCliApiCoherenceViolations(manifest).filter(({ className }) => {
+		const cliConfig = manifest.objects[className]?.decoratorConfig?.cli;
+		return typeof cliConfig === "object" && Array.isArray(cliConfig.include) && cliConfig.include.length > 0;
+	});
 	if (violations.length === 0) return;
-	const messages = violations.flatMap(({ className, unreachable }) => unreachable.map((action) => `[smrt] ${className}.${action} is declared in cli.include but is not exposed via the api.\n  Either:\n    - Add '${action}' to api.include, or\n    - Remove '${action}' from cli.include.\n  The CLI invokes methods over HTTP; methods without API routes are unreachable.\n  If this CLI is intentionally invoked in-process (no HTTP), set\n  \`cli: { skipApiCheck: true }\` on the @smrt() decorator to acknowledge.`));
+	const messages = violations.flatMap(({ className, unreachable }) => unreachable.map((action) => `[smrt] ${className}.${action} is exposed as a CLI command but is not exposed via the api.\n  Either:\n    - Add '${action}' to api.include, or\n    - Remove '${action}' from cli.include / add it to cli.exclude.\n  The CLI invokes methods over HTTP; methods without API routes are unreachable.\n  If this CLI is intentionally invoked in-process (no HTTP), set\n  \`cli: { skipApiCheck: true }\` on the @smrt() decorator to acknowledge.`));
 	throw new Error(messages.join("\n\n"));
 }
 /**