@happyvertical/smrt-core 0.49.8 → 0.50.0

package/dist/vite-plugin/sveltekit-generator.js

@@ -1,5 +1,5 @@
 import { MAX_LIST_LIMIT, buildDefaultListOrderBy } from "../query-bounds.js";
-import { CRUD_OPERATIONS, createManifestClassNamePredicate, declaredTypeAcceptsDate, isCrudOperation, queryStringDecoderFor, resolveApiMethodExposure, resolveCustomActionMetadata, resolveCustomActionNames, resolveDeclaredScopeMismatch, resolveEffectiveActionMetadata } from "../generators/custom-action.js";
+import { CRUD_OPERATIONS, createManifestClassNamePredicate, declaredTypeAcceptsDate, isCrudOperation, isFrameworkLifecycleMethod, queryStringDecoderFor, resolveApiMethodExposure, resolveCustomActionMetadata, resolveCustomActionNames, resolveDeclaredScopeMismatch, resolveEffectiveActionMetadata } from "../generators/custom-action.js";
 import { isFrameworkBaseClass } from "../registry/framework-base-classes.js";
 import { generateConditionalGetRouteHelper } from "../generators/conditional-get.js";
 import { AUTO_GENERATED_ROUTE_HEADER } from "./route-header.js";
@@ -1501,26 +1501,51 @@ function resolveCliActionSet(objectDef) {
 * Inspect a manifest and return classes whose effective CLI command set —
 * `cli.include`/`cli.exclude` when spelled out, or (#2638) the same "every
 * public method minus exclude" default `cli: true`/`cli: {}` resolves to —
-* references a command not exposed via the API. Classes that opt out via
-* `cli: { skipApiCheck: true }` are skipped, and so is a class with
-* `cli: false` (no CLI surface at all).
+* references a command not exposed via the API. `cli: { skipApiCheck: true }`
+* skips the whole class; `cli: { skipApiCheck: [...] }` (smrt#2857) skips
+* only the named commands, leaving every other command in the class's
+* effective set checked. So does a class with `cli: false` (no CLI surface
+* at all).
 *
-* Throws nothing; returns the violation list so callers can choose to throw
-* or warn.
+* A name in the array form that isn't a CRUD verb or a scanned public
+* method on the class is reported back via `invalidSkipApiCheck` on the
+* violation entry -- see `validateCliIncludeAgainstApi`, which always
+* throws for it regardless of that gate's narrower `cli.include` filter.
+*
+* Throws nothing else; returns the violation list so callers can choose to
+* throw or warn.
 */
 function findCliApiCoherenceViolations(manifest) {
 	const violations = [];
 	for (const [className, objectDef] of Object.entries(manifest.objects)) {
 		const cliConfig = objectDef.decoratorConfig?.cli;
 		if (cliConfig === false) continue;
-		if (typeof cliConfig === "object" && cliConfig !== null && cliConfig.skipApiCheck) continue;
+		const skipApiCheck = typeof cliConfig === "object" && cliConfig !== null ? cliConfig.skipApiCheck : void 0;
+		if (skipApiCheck === true) continue;
 		const effectiveCliCommands = resolveCliActionSet(objectDef);
-		if (effectiveCliCommands.size === 0) continue;
+		let invalidSkipApiCheck = [];
+		let skipNames = /* @__PURE__ */ new Set();
+		if (Array.isArray(skipApiCheck) && skipApiCheck.length > 0) {
+			const knownNames = /* @__PURE__ */ new Set([...CRUD_OPERATIONS, ...Object.entries(objectDef.methods || {}).filter(([, method]) => method.isPublic).map(([name]) => name)]);
+			const hasExplicitInclude = typeof cliConfig === "object" && cliConfig !== null && Array.isArray(cliConfig.include);
+			const isInEffectiveSurface = (name) => effectiveCliCommands.has(name) || !hasExplicitInclude && (CRUD_OPERATIONS.includes(name) || isFrameworkLifecycleMethod(name));
+			invalidSkipApiCheck = skipApiCheck.filter((name) => !knownNames.has(name) || !isInEffectiveSurface(name)).sort();
+			skipNames = new Set(skipApiCheck.filter((name) => effectiveCliCommands.has(name)));
+		}
+		if (effectiveCliCommands.size === 0) {
+			if (invalidSkipApiCheck.length > 0) violations.push({
+				className,
+				unreachable: [],
+				invalidSkipApiCheck
+			});
+			continue;
+		}
 		const apiActionSet = resolveApiActionSet(objectDef, manifest);
-		const unreachable = [...effectiveCliCommands].filter((action) => !apiActionSet.has(action)).sort();
-		if (unreachable.length > 0) violations.push({
+		const unreachable = [...effectiveCliCommands].filter((action) => !apiActionSet.has(action) && !skipNames.has(action)).sort();
+		if (unreachable.length > 0 || invalidSkipApiCheck.length > 0) violations.push({
 			className,
-			unreachable
+			unreachable,
+			...invalidSkipApiCheck.length > 0 ? { invalidSkipApiCheck } : {}
 		});
 	}
 	return violations;
@@ -1556,12 +1581,21 @@ function findCliApiCoherenceViolations(manifest) {
 * check once that pre-existing surface is triaged.
 */
 function validateCliIncludeAgainstApi(manifest) {
-	const violations = findCliApiCoherenceViolations(manifest).filter(({ className }) => {
+	const allViolations = findCliApiCoherenceViolations(manifest);
+	const invalidSkipApiCheckMessages = allViolations.flatMap(({ className, invalidSkipApiCheck }) => (invalidSkipApiCheck ?? []).map((name) => `[smrt] ${className}: cli.skipApiCheck names '${name}', which isn't a\n  CRUD verb or a scanned public method on this class, or isn't part of\n  its current cli.include/cli.exclude surface (a typo, or a stale\n  entry left behind after the command was dropped from cli.include).\n  Fix the typo, or remove '${name}' from cli.skipApiCheck -- an\n  unrecognized or stale name grants no exemption at all.`));
+	const violations = allViolations.filter(({ className, unreachable }) => {
+		if (unreachable.length === 0) return false;
 		const cliConfig = manifest.objects[className]?.decoratorConfig?.cli;
 		return typeof cliConfig === "object" && cliConfig !== null && Array.isArray(cliConfig.include) && cliConfig.include.length > 0;
 	});
-	if (violations.length === 0) return;
-	const messages = violations.flatMap(({ className, unreachable }) => unreachable.map((action) => `[smrt] ${className}.${action} is exposed as a CLI command but is not exposed via the api.\n  Either:\n    - Decorate '${action}' with @method({ expose: true }) to route it, or\n    - Add '${action}' to api.include, or\n    - Remove '${action}' from cli.include / add it to cli.exclude.\n  The CLI invokes methods over HTTP; methods without API routes are unreachable.\n  A public method is routed by default only when every parameter can be\n  built from JSON; @method({ expose: true }) overrides that for one method\n  without widening api.include. See withheldSurfaces in the knowledge\n  artifact for the reason this one was withheld (#2686).\n  If this CLI is intentionally invoked in-process (no HTTP), set\n  \`cli: { skipApiCheck: true }\` on the @smrt() decorator to acknowledge.`));
+	if (violations.length === 0 && invalidSkipApiCheckMessages.length === 0) return;
+	const messages = [...invalidSkipApiCheckMessages, ...violations.flatMap(({ className, unreachable }) => {
+		const methods = manifest.objects[className]?.methods ?? {};
+		const isRealCommandName = (name) => CRUD_OPERATIONS.includes(name) || methods[name]?.isPublic === true;
+		return unreachable.map((action) => {
+			return `[smrt] ${className}.${action} is exposed as a CLI command but is not exposed via the api.\n  Either:\n    - Decorate '${action}' with @method({ expose: true }) to route it, or\n    - Add '${action}' to api.include, or\n    - Remove '${action}' from cli.include / add it to cli.exclude.\n  The CLI invokes methods over HTTP; methods without API routes are unreachable.\n  A public method is routed by default only when every parameter can be\n  built from JSON; @method({ expose: true }) overrides that for one method\n  without widening api.include. See withheldSurfaces in the knowledge\n  artifact for the reason this one was withheld (#2686).\n  If this CLI is intentionally invoked in-process (no HTTP), set\n  \`cli: { skipApiCheck: true }\`${isRealCommandName(action) ? ` (or \`skipApiCheck: ['${action}']\` to acknowledge only this command)` : ""} on the\n  @smrt() decorator.`;
+		});
+	})];
 	throw new Error(messages.join("\n\n"));
 }
 /**