@happyvertical/smrt-core 0.46.0 → 0.47.1

package/dist/generators/rest.d.ts

@@ -179,6 +179,50 @@ export declare class APIGenerator {
      * a returned `{ ok: false, ... }` failure becomes its requested non-2xx
      * status with a redacted payload, and success wraps as `{ action, result }`.
      */
+    /**
+     * Every action this transport treats as DECLARED for a collection route,
+     * paired with its manifest method definition when one is known.
+     *
+     * The union of two declaration sources, so migrating a route entry onto its
+     * method does not silently drop the route here (#2686):
+     *
+     * - a `api.routes[action]` entry, this transport's only source before;
+     * - a method whose `@method()` supplies route-shaping metadata
+     *   (`httpMethod`, `path`, or `scope`).
+     *
+     * Deliberately still DECLARATION-gated rather than adopting the generated
+     * transport's default-route heuristic: this router's URL shape supports only
+     * single-segment collection paths, and widening it to every wire-able public
+     * method would publish endpoints that have never existed here. That is a
+     * separate contract change, not a compatibility fix.
+     *
+     * `declaresRuntimeRestRoute` is shared with `isRestActionRoutable`, the
+     * browser-plane preflight prediction of this same dispatch, so the route and
+     * the prediction of the route cannot drift.
+     */
+    private declaredCollectionActions;
+    /**
+     * The method view a RUNTIME transport should read for one action: the
+     * manifest entry when the project was scanned, with its `@method()` config
+     * backfilled from the live decorator store when it is not.
+     */
+    private runtimeMethod;
+    /**
+     * Refuse a request that matched a DECLARED action's own path and verb but
+     * whose action is withheld — or return `null` to let it fall through.
+     *
+     * Only `POST` is refused, and the asymmetry is the whole point.
+     * `getCrudAction` maps `POST` to `create` and DISCARDS the path segment, so
+     * falling through writes a row and answers 201 for a request aimed at an
+     * operation the author withheld: silent, mutating, and the opposite of what
+     * the generated SvelteKit surface does for the same URL, which 404s because
+     * it wrote no route file. Every other verb carries the segment into a by-id
+     * operation that 404s on its own when the segment is not an id — and that
+     * fall-through is load-bearing, because an object's id may legitimately equal
+     * a declared action's path, and `GET /<collection>/<id>` must keep resolving
+     * to that object (#2686).
+     */
+    private refuseWithheldAction;
     private dispatchCustomCollectionAction;
     /**
      * Public-safe projection for custom-action results, mirroring the generated

package/dist/generators/rest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../src/generators/rest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,WAAW,CAAC;AAQ/D,OAAO,KAAK,EAEV,eAAe,EAGhB,MAAM,mBAAmB,CAAC;AAiC3B,OAAO,EAKL,KAAK,yBAAyB,EAC/B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,EAAE,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,KACX,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;CAC/C;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,oDAAoD;IACpD,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAChC;AAiED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAkC,GAC5E,MAAM,CAcR;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,WAAW,CAAiD;IACpE,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,mBAAmB,CAAqB;gBAEpC,MAAM,GAAE,SAAc,EAAE,OAAO,GAAE,UAAe;IAa5D;;;;;OAKG;IACH,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,GACrC,IAAI;IAKP;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;OAEG;IACH,YAAY,IAAI;QAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAoBpD;;OAEG;YACW,cAAc;IAQ5B;;OAEG;YACW,uBAAuB;IAyBrC;;OAEG;YACW,yBAAyB;IAkEvC;;OAEG;IACH,eAAe,IAAI,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC;IAItD;;OAEG;YACW,aAAa;IA4E3B;;OAEG;YACW,iBAAiB;IAmG/B;;OAEG;YACW,oBAAoB;IAiFlC,OAAO,CAAC,aAAa;IAmBrB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,uBAAuB;IAuB/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,8BAA8B;IA8J5C;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAoC5B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;OAEG;YACW,SAAS;IAkEvB;;OAEG;YACW,UAAU;IAwFxB;;OAEG;YACW,WAAW;IA8CzB;;OAEG;YACW,YAAY;IAW1B;;OAEG;YACW,YAAY;IAoB1B;;OAEG;YACW,YAAY;IAc1B;;;;;OAKG;YACW,eAAe;IAqB7B;;;;OAIG;YACW,sBAAsB;IA+DpC;;OAEG;YACW,aAAa;IA6B3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;;OAGG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,oBAAoB;IAI5B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IA2B9B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,yBAAyB;IAejC,OAAO,CAAC,uBAAuB;IAe/B,OAAO,CAAC,2BAA2B;IAyBnC;;;;;;;;;;OAUG;YACW,eAAe;IAqB7B,OAAO,CAAC,mBAAmB;IAQ3B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAQ5B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAI9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAsB1B;;OAEG;IACH,OAAO,CAAC,cAAc;IA+BtB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;IA0BpC;;OAEG;IACH,OAAO,CAAC,SAAS;CASlB;AAID,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CActC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAwB9B"}
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../src/generators/rest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,WAAW,CAAC;AAQ/D,OAAO,KAAK,EAEV,eAAe,EAGhB,MAAM,mBAAmB,CAAC;AAoC3B,OAAO,EAKL,KAAK,yBAAyB,EAC/B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,EAAE,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,KACX,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;CAC/C;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,oDAAoD;IACpD,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAChC;AAiED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAkC,GAC5E,MAAM,CAcR;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,WAAW,CAAiD;IACpE,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,mBAAmB,CAAqB;gBAEpC,MAAM,GAAE,SAAc,EAAE,OAAO,GAAE,UAAe;IAa5D;;;;;OAKG;IACH,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,GACrC,IAAI;IAKP;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;OAEG;IACH,YAAY,IAAI;QAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAoBpD;;OAEG;YACW,cAAc;IAQ5B;;OAEG;YACW,uBAAuB;IAyBrC;;OAEG;YACW,yBAAyB;IAkEvC;;OAEG;IACH,eAAe,IAAI,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC;IAItD;;OAEG;YACW,aAAa;IA4E3B;;OAEG;YACW,iBAAiB;IAmG/B;;OAEG;YACW,oBAAoB;IAiFlC,OAAO,CAAC,aAAa;IAmBrB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,uBAAuB;IAuB/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAOrB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;YAYd,8BAA8B;IA2N5C;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAoC5B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;OAEG;YACW,SAAS;IAkEvB;;OAEG;YACW,UAAU;IAwFxB;;OAEG;YACW,WAAW;IA8CzB;;OAEG;YACW,YAAY;IAW1B;;OAEG;YACW,YAAY;IAoB1B;;OAEG;YACW,YAAY;IAc1B;;;;;OAKG;YACW,eAAe;IAqB7B;;;;OAIG;YACW,sBAAsB;IA+DpC;;OAEG;YACW,aAAa;IA6B3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;;OAGG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,oBAAoB;IAI5B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IA2B9B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,yBAAyB;IAejC,OAAO,CAAC,uBAAuB;IAe/B,OAAO,CAAC,2BAA2B;IAyBnC;;;;;;;;;;OAUG;YACW,eAAe;IAqB7B,OAAO,CAAC,mBAAmB;IAQ3B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAQ5B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAI9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAsB1B;;OAEG;IACH,OAAO,CAAC,cAAc;IA+BtB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;IA0BpC;;OAEG;IACH,OAAO,CAAC,SAAS;CASlB;AAID,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CActC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAwB9B"}

package/dist/generators/rest.js

@@ -1,7 +1,7 @@
 import { isTenantScopedClassResolved, resolveDispatchTenantScope } from "../dispatch/tenant-resolver.js";
 import { getTableVersion } from "../change-feed.js";
 import { buildDefaultListOrderBy, resolveListLimit, resolveListOffset } from "../query-bounds.js";
-import { buildCustomActionInvocationArgs, normalizeCustomActionFailure, resolveCustomActionMetadata } from "./custom-action.js";
+import { buildCustomActionInvocationArgs, declaresRuntimeRestRouteShape, normalizeCustomActionFailure, readMethodDecoratorConfig, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "./custom-action.js";
 import { isFrameworkBaseClass } from "../registry/framework-base-classes.js";
 import { ObjectRegistry } from "../registry.js";
 import "../dispatch/index.js";
@@ -385,28 +385,103 @@ var APIGenerator = class {
 	* a returned `{ ok: false, ... }` failure becomes its requested non-2xx
 	* status with a redacted payload, and success wraps as `{ action, result }`.
 	*/
+	/**
+	* Every action this transport treats as DECLARED for a collection route,
+	* paired with its manifest method definition when one is known.
+	*
+	* The union of two declaration sources, so migrating a route entry onto its
+	* method does not silently drop the route here (#2686):
+	*
+	* - a `api.routes[action]` entry, this transport's only source before;
+	* - a method whose `@method()` supplies route-shaping metadata
+	*   (`httpMethod`, `path`, or `scope`).
+	*
+	* Deliberately still DECLARATION-gated rather than adopting the generated
+	* transport's default-route heuristic: this router's URL shape supports only
+	* single-segment collection paths, and widening it to every wire-able public
+	* method would publish endpoints that have never existed here. That is a
+	* separate contract change, not a compatibility fix.
+	*
+	* `declaresRuntimeRestRoute` is shared with `isRestActionRoutable`, the
+	* browser-plane preflight prediction of this same dispatch, so the route and
+	* the prediction of the route cannot drift.
+	*/
+	declaredCollectionActions(objectName, apiConfig) {
+		const names = new Set(Object.keys(apiConfig.routes ?? {}));
+		for (const name of ObjectRegistry.listDecoratedMethodNames(objectName)) if (declaresRuntimeRestRouteShape(this.runtimeMethod(objectName, name))) names.add(name);
+		return [...names].map((name) => [name, this.runtimeMethod(objectName, name)]);
+	}
+	/**
+	* The method view a RUNTIME transport should read for one action: the
+	* manifest entry when the project was scanned, with its `@method()` config
+	* backfilled from the live decorator store when it is not.
+	*/
+	runtimeMethod(objectName, methodName) {
+		return ObjectRegistry.resolveRuntimeMethod(objectName, methodName).method;
+	}
+	/**
+	* Refuse a request that matched a DECLARED action's own path and verb but
+	* whose action is withheld — or return `null` to let it fall through.
+	*
+	* Only `POST` is refused, and the asymmetry is the whole point.
+	* `getCrudAction` maps `POST` to `create` and DISCARDS the path segment, so
+	* falling through writes a row and answers 201 for a request aimed at an
+	* operation the author withheld: silent, mutating, and the opposite of what
+	* the generated SvelteKit surface does for the same URL, which 404s because
+	* it wrote no route file. Every other verb carries the segment into a by-id
+	* operation that 404s on its own when the segment is not an id — and that
+	* fall-through is load-bearing, because an object's id may legitimately equal
+	* a declared action's path, and `GET /<collection>/<id>` must keep resolving
+	* to that object (#2686).
+	*/
+	refuseWithheldAction(req, actionName, withheldBy) {
+		if (req.method.toUpperCase() !== "POST") return null;
+		return this.createErrorResponse(404, `Custom action '${actionName}' is not exposed (${withheldBy})`);
+	}
 	async dispatchCustomCollectionAction(req, collection, pathSegment, url, objectName) {
 		const apiConfig = ObjectRegistry.getConfig(objectName)?.api;
-		if (!apiConfig || typeof apiConfig !== "object" || !apiConfig.routes) return null;
-		for (const [actionName, routeConfig] of Object.entries(apiConfig.routes)) {
-			const routePath = routeConfig?.path || actionName;
+		if (!apiConfig || typeof apiConfig !== "object") return null;
+		const declaredActions = this.declaredCollectionActions(objectName, apiConfig);
+		if (declaredActions.length === 0) return null;
+		for (const [actionName, declaredMethod] of declaredActions) {
+			const effective = resolveEffectiveActionMetadata({
+				actionName,
+				...declaredMethod ? { method: declaredMethod } : {},
+				apiConfig
+			});
+			const routePath = effective.path || actionName;
 			if (routePath.includes("/") || routePath !== pathSegment) continue;
-			const routeMethod = (routeConfig?.method || "POST").toUpperCase();
+			const routeMethod = (effective.httpMethod || "POST").toUpperCase();
 			if (routeMethod !== req.method.toUpperCase()) continue;
-			if (apiConfig.include && !apiConfig.include.includes(actionName)) continue;
-			if (apiConfig.exclude?.includes(actionName)) continue;
+			if (apiConfig.include && !apiConfig.include.includes(actionName)) {
+				const refusal = this.refuseWithheldAction(req, actionName, "api.include");
+				if (refusal) return refusal;
+				continue;
+			}
+			if (apiConfig.exclude?.includes(actionName)) {
+				const refusal = this.refuseWithheldAction(req, actionName, "api.exclude");
+				if (refusal) return refusal;
+				continue;
+			}
+			if (readMethodDecoratorConfig(declaredMethod)?.expose === false) {
+				const refusal = this.refuseWithheldAction(req, actionName, "@method({ expose: false })");
+				if (refusal) return refusal;
+				continue;
+			}
 			const collectionMethod = collection[actionName];
 			const itemConstructor = ObjectRegistry.getClass(objectName)?.constructor;
 			const staticMethod = itemConstructor?.[actionName];
 			const isCollectionHosted = typeof collectionMethod === "function";
 			if (!isCollectionHosted && !(!isCollectionHosted && typeof staticMethod === "function")) {
-				if (routeConfig?.scope === "collection") return this.createErrorResponse(501, `Custom action '${actionName}' is declared but not implemented`);
+				if (effective.scope === "collection") return this.createErrorResponse(501, `Custom action '${actionName}' is declared but not implemented`);
+				const refusal = this.refuseWithheldAction(req, actionName, "an item-scoped declaration, which this transport does not serve");
+				if (refusal) return refusal;
 				continue;
 			}
 			const metadata = resolveCustomActionMetadata({
 				actionName,
 				apiConfig,
-				method: ObjectRegistry.getMethods(objectName)?.get(actionName),
+				...declaredMethod ? { method: declaredMethod } : {},
 				defaultScope: "collection"
 			});
 			if (metadata.scope !== "collection") continue;