@happyvertical/smrt-scanner 0.40.27 → 0.40.28

package/AGENTS.md

@@ -67,3 +67,21 @@ executes the source.
   unwrapped from their `UnaryExpression` before the check.
 - **Static property capture**: captures `uiSlots` and `adminRoutes` for agent
   manifest generation.
+- **`@smrt()` config spreads resolve only against unescaped same-file `const`s** (issue
+  #2100). `@smrt({ ...INTERNAL_SURFACE })` works when `INTERNAL_SURFACE` is a
+  module-scope `const` object literal in the same file (`as const` and
+  `export const` included); a constant may spread an earlier constant. Anything
+  else — an imported constant, a `let`, a function call, a computed non-literal
+  key, shorthand or non-literal value, mutation/alias/escape, or a spread inside
+  an include array — is reported as a `severity: 'error'` scan diagnostic,
+  never silently dropped. `const` prevents rebinding but not property mutation,
+  and object spread is shallow, so only binding-aware spread references whose
+  shared nested values remain safe through the decorator use are trusted.
+  Silence would be unsafe: a dropped spread can remove `api`/`mcp`/`cli`, and an
+  ABSENT surface key means default-open full CRUD, so a quiet drop turns a
+  deliberate lockdown into a published surface.
+  A constant whose own initializer holds an unresolvable spread
+  (`const CFG = { ...IMPORTED }`) is tracked as **tainted**: it still resolves,
+  but its taint replays into the diagnostics of every decorator that spreads
+  it, transitively through constant chains. Without that the silent drop simply
+  moves one level up. An unused tainted constant reports nothing.

package/dist/chunks/{scanner-Di4QAFXG.js → scanner-_R1muI_s.js}

@@ -374,10 +374,15 @@ function parseFile(filePath) {
 			const importAliases = extractImportAliases(program.body);
 			typeAliases = extractTypeAliases(program.body);
 			smrtImports = extractSmrtImports(program.body);
+			const ctx = {
+				constants: extractModuleObjectConstants(program.body, sourceText),
+				unresolved: []
+			};
 			for (const node of program.body) {
-				const extracted = extractClassFromNode(node, filePath, sourceText, importAliases);
+				const extracted = extractClassFromNode(node, filePath, sourceText, importAliases, ctx);
 				if (extracted) classes.push(extracted);
 			}
+			reportUnresolvedSpreads(ctx.unresolved, filePath, sourceText, errors);
 		}
 	} catch (error) {
 		errors.push({
@@ -422,10 +427,15 @@ function parseSource(sourceText, filename = "test.ts") {
 			const importAliases = extractImportAliases(program.body);
 			typeAliases = extractTypeAliases(program.body);
 			smrtImports = extractSmrtImports(program.body);
+			const ctx = {
+				constants: extractModuleObjectConstants(program.body, sourceText),
+				unresolved: []
+			};
 			for (const node of program.body) {
-				const extracted = extractClassFromNode(node, filename, sourceText, importAliases);
+				const extracted = extractClassFromNode(node, filename, sourceText, importAliases, ctx);
 				if (extracted) classes.push(extracted);
 			}
+			reportUnresolvedSpreads(ctx.unresolved, filename, sourceText, errors);
 		}
 	} catch (error) {
 		errors.push({
@@ -526,24 +536,253 @@ function extractTypeAliases(body) {
 	}
 	return aliases;
 }
-function extractClassFromNode(node, filePath, sourceText, importAliases) {
-	if (node.type === "ExportNamedDeclaration" && node.declaration) return extractClassFromNode(node.declaration, filePath, sourceText, importAliases);
-	if (node.type === "ExportDefaultDeclaration" && node.declaration) return extractClassFromNode(node.declaration, filePath, sourceText, importAliases);
-	if (node.type === "ClassDeclaration") return extractClassDeclaration(node, filePath, sourceText, importAliases);
+function unwrapTypeAssertion(node) {
+	let current = node;
+	for (let depth = 0; current && depth < 8; depth++) {
+		const type = current.type;
+		if (type === "TSAsExpression" || type === "TSSatisfiesExpression" || type === "TSNonNullExpression" || type === "TSTypeAssertion" || type === "ParenthesizedExpression") {
+			current = current.expression;
+			continue;
+		}
+		return current;
+	}
+	return current;
+}
+function extractModuleObjectConstants(body, sourceText) {
+	const constants = /* @__PURE__ */ new Map();
+	for (const node of body) {
+		const decl = node.type === "VariableDeclaration" ? node : node.type === "ExportNamedDeclaration" && node.declaration?.type === "VariableDeclaration" ? node.declaration : null;
+		if (decl?.kind !== "const") continue;
+		for (const declarator of decl.declarations) {
+			if (declarator.id?.type !== "Identifier") continue;
+			const name = declarator.id.name;
+			if (!name || !isSafeObjectKey(name)) continue;
+			const init = unwrapTypeAssertion(declarator.init);
+			if (init?.type !== "ObjectExpression") continue;
+			const unresolved = [];
+			const dependencies = [];
+			const value = extractObjectLiteral(init, sourceText, {
+				constants,
+				unresolved,
+				dependencies,
+				requireLiteralValues: true
+			});
+			constants.set(name, {
+				value,
+				unresolved,
+				unsafeReferences: [],
+				dependencies
+			});
+		}
+	}
+	taintUnsafeModuleConstantReferences(body, constants, sourceText);
+	propagateModuleConstantTaint(constants);
+	return constants;
+}
+function taintUnsafeModuleConstantReferences(body, constants, sourceText) {
+	if (constants.size === 0) return;
+	const tainted = /* @__PURE__ */ new Set();
+	const visit = (value, ancestors, shadowed) => {
+		if (Array.isArray(value)) {
+			for (const entry of value) visit(entry, ancestors, shadowed);
+			return;
+		}
+		if (!value || typeof value !== "object") return;
+		const node = value;
+		if (typeof node.type !== "string") {
+			for (const child of Object.values(node)) visit(child, ancestors, shadowed);
+			return;
+		}
+		if (node.type === "Identifier" && typeof node.name === "string" && constants.has(node.name) && !shadowed.has(node.name) && !isTypeOnlyReference(node, ancestors) && !isSafeModuleConstantReference(node, ancestors, constants)) {
+			const name = node.name;
+			if (!tainted.has(name)) {
+				tainted.add(name);
+				const unresolved = {
+					expression: sliceSource(node, sourceText) ?? name,
+					start: typeof node.start === "number" ? node.start : void 0
+				};
+				const constant = constants.get(name);
+				constant?.unsafeReferences.push(unresolved);
+				constant?.unresolved.push(unresolved);
+			}
+		}
+		const nextShadowed = createsLexicalScope(node) ? /* @__PURE__ */ new Set([...shadowed, ...collectScopeBindings(node)]) : shadowed;
+		const nextAncestors = [...ancestors, node];
+		for (const [key, child] of Object.entries(node)) {
+			if (key === "loc" || key === "range" || key === "start" || key === "end") continue;
+			visit(child, nextAncestors, nextShadowed);
+		}
+	};
+	visit(body, [], /* @__PURE__ */ new Set());
+}
+function createsLexicalScope(node) {
+	return node.type === "BlockStatement" || node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression" || node.type === "CatchClause" || node.type === "ForStatement" || node.type === "ForInStatement" || node.type === "ForOfStatement" || node.type === "ClassDeclaration" || node.type === "ClassExpression";
+}
+function collectScopeBindings(node) {
+	const bindings = /* @__PURE__ */ new Set();
+	const addPattern = (value) => {
+		if (!value || typeof value !== "object") return;
+		const pattern = value;
+		if (pattern.type === "Identifier" && typeof pattern.name === "string") {
+			bindings.add(pattern.name);
+			return;
+		}
+		if (pattern.type === "RestElement") {
+			addPattern(pattern.argument);
+			return;
+		}
+		if (pattern.type === "AssignmentPattern") {
+			addPattern(pattern.left);
+			return;
+		}
+		if (pattern.type === "ArrayPattern" && Array.isArray(pattern.elements)) {
+			for (const element of pattern.elements) addPattern(element);
+			return;
+		}
+		if (pattern.type === "ObjectPattern" && Array.isArray(pattern.properties)) for (const property of pattern.properties) {
+			if (!property || typeof property !== "object") continue;
+			const propertyNode = property;
+			addPattern(propertyNode.type === "RestElement" ? propertyNode.argument : propertyNode.value);
+		}
+	};
+	if (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression") {
+		if (node.type !== "ArrowFunctionExpression") addPattern(node.id);
+		if (Array.isArray(node.params)) for (const parameter of node.params) addPattern(parameter);
+		collectFunctionVarBindings(node.body, bindings);
+	} else if (node.type === "CatchClause") addPattern(node.param);
+	else if (node.type === "ForStatement" || node.type === "ForInStatement" || node.type === "ForOfStatement") {
+		const declaration = node.type === "ForStatement" ? node.init : node.left;
+		if (declaration && typeof declaration === "object" && declaration.type === "VariableDeclaration") for (const declarator of declaration.declarations) addPattern(declarator.id);
+	} else if ((node.type === "ClassDeclaration" || node.type === "ClassExpression") && node.id) addPattern(node.id);
+	if (node.type === "BlockStatement" && Array.isArray(node.body)) for (const statement of node.body) {
+		const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
+		if (declaration?.type === "VariableDeclaration") for (const declarator of declaration.declarations) addPattern(declarator.id);
+		else if (declaration?.type === "FunctionDeclaration" || declaration?.type === "ClassDeclaration") addPattern(declaration.id);
+	}
+	return bindings;
+}
+function collectFunctionVarBindings(value, bindings) {
+	if (Array.isArray(value)) {
+		for (const entry of value) collectFunctionVarBindings(entry, bindings);
+		return;
+	}
+	if (!value || typeof value !== "object") return;
+	const node = value;
+	if (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression") return;
+	if (node.type === "VariableDeclaration" && node.kind === "var") for (const declarator of node.declarations) {
+		const id = declarator.id;
+		if (id?.type === "Identifier" && typeof id.name === "string") bindings.add(id.name);
+	}
+	for (const [key, child] of Object.entries(node)) {
+		if (key === "loc" || key === "range" || key === "start" || key === "end") continue;
+		collectFunctionVarBindings(child, bindings);
+	}
+}
+function isTypeOnlyReference(identifier, ancestors) {
+	let child = identifier;
+	for (let index = ancestors.length - 1; index >= 0; index--) {
+		const parent = ancestors[index];
+		if ((parent.type === "TSAsExpression" || parent.type === "TSSatisfiesExpression" || parent.type === "TSNonNullExpression" || parent.type === "TSTypeAssertion") && parent.expression === child) {
+			child = parent;
+			continue;
+		}
+		if (typeof parent.type === "string" && parent.type.startsWith("TS")) return true;
+		break;
+	}
+	return false;
+}
+function propagateModuleConstantTaint(constants) {
+	let changed = true;
+	while (changed) {
+		changed = false;
+		for (const constant of constants.values()) for (const dependency of constant.dependencies) {
+			const source = constants.get(dependency.name);
+			if (!source) continue;
+			for (const unresolved of source.unresolved) {
+				if (dependency.start !== void 0 && unresolved.start !== void 0 && unresolved.start > dependency.start && !hasNestedReferenceValue(source.value)) continue;
+				if (!constant.unresolved.some((existing) => existing.expression === unresolved.expression && existing.start === unresolved.start)) {
+					constant.unresolved.push(unresolved);
+					changed = true;
+				}
+			}
+			if (hasNestedReferenceValue(source.value)) for (const unsafeReference of constant.unsafeReferences) {
+				const matchesUnsafeReference = (existing) => existing.expression === unsafeReference.expression && existing.start === unsafeReference.start;
+				if (!source.unresolved.some(matchesUnsafeReference)) {
+					source.unresolved.push(unsafeReference);
+					changed = true;
+				}
+				if (!source.unsafeReferences.some(matchesUnsafeReference)) {
+					source.unsafeReferences.push(unsafeReference);
+					changed = true;
+				}
+			}
+		}
+	}
+}
+function hasNestedReferenceValue(value) {
+	return Object.values(value).some((entry) => entry !== null && typeof entry === "object");
+}
+function isSafeModuleConstantReference(identifier, ancestors, constants) {
+	let child = identifier;
+	for (let index = ancestors.length - 1; index >= 0; index--) {
+		const parent = ancestors[index];
+		if (parent.type === "VariableDeclarator" && parent.id === child) return true;
+		if (parent.type === "Property" && parent.key === child && parent.computed === false && parent.shorthand === false) return true;
+		if (parent.type === "MemberExpression" && parent.property === child && parent.computed === false) return true;
+		if ((parent.type === "TSAsExpression" || parent.type === "TSSatisfiesExpression" || parent.type === "TSNonNullExpression" || parent.type === "TSTypeAssertion" || parent.type === "ParenthesizedExpression") && parent.expression === child) {
+			child = parent;
+			continue;
+		}
+		if (parent.type === "SpreadElement" && parent.argument === child) {
+			const name = typeof identifier.name === "string" ? identifier.name : void 0;
+			const constant = name ? constants.get(name) : void 0;
+			if (!constant || !hasNestedReferenceValue(constant.value)) return true;
+			if ([...constants.values()].some((candidate) => candidate.dependencies.some((dependency) => dependency.name === name && dependency.start === parent.start))) return true;
+			return ancestors.some((ancestor) => {
+				if (ancestor.type !== "Decorator" || !ancestor.expression || typeof ancestor.expression !== "object") return false;
+				const expression = ancestor.expression;
+				if (expression.type !== "CallExpression" || !expression.callee || typeof expression.callee !== "object") return false;
+				const callee = expression.callee;
+				return callee.type === "Identifier" && callee.name === "smrt";
+			});
+		}
+		return false;
+	}
+	return false;
+}
+function reportUnresolvedSpreads(unresolved, filePath, sourceText, errors) {
+	for (const spread of unresolved) {
+		const loc = spread.start === void 0 ? void 0 : getLineColumn(sourceText, spread.start);
+		errors.push({
+			message: `Cannot statically resolve \`${spread.expression}\` while expanding a @smrt() config. Only literal keys/values and unescaped module-scope \`const\` object literals in the same file are supported. Inline the keys or remove the mutation/alias \u2014 an unresolved expression would drop api/mcp/cli from the manifest, and an absent surface defaults to open.`,
+			filePath,
+			line: loc?.line,
+			column: loc?.column,
+			severity: "error"
+		});
+	}
+}
+function extractClassFromNode(node, filePath, sourceText, importAliases, ctx) {
+	if (node.type === "ExportNamedDeclaration" && node.declaration) return extractClassFromNode(node.declaration, filePath, sourceText, importAliases, ctx);
+	if (node.type === "ExportDefaultDeclaration" && node.declaration) return extractClassFromNode(node.declaration, filePath, sourceText, importAliases, ctx);
+	if (node.type === "ClassDeclaration") return extractClassDeclaration(node, filePath, sourceText, importAliases, ctx);
 	return null;
 }
-function extractClassDeclaration(node, filePath, sourceText, importAliases) {
+function extractClassDeclaration(node, filePath, sourceText, importAliases, ctx) {
 	const className = node.id?.name || "AnonymousClass";
 	const decorators = node.decorators || [];
 	const smrtDecorator = decorators.find((d) => isSmrtDecorator(d));
 	const reportDecorator = decorators.find((d) => isNamedDecorator(d, "report"));
 	const tenantScopedDecorator = decorators.find((d) => isNamedDecorator(d, "TenantScoped"));
 	const hasSmartDecorator = !!smrtDecorator;
-	const smrtConfig = smrtDecorator ? extractDecoratorConfig(smrtDecorator, sourceText) : null;
+	const smrtConfig = smrtDecorator ? extractDecoratorConfig(smrtDecorator, sourceText, ctx ? {
+		...ctx,
+		requireLiteralValues: true
+	} : ctx) : null;
 	const decoratorConfig = tenantScopedDecorator || reportDecorator ? {
 		...smrtConfig ?? {},
-		...reportDecorator ? { report: extractDecoratorConfig(reportDecorator, sourceText) } : {},
-		...tenantScopedDecorator ? { tenantScoped: extractDecoratorConfig(tenantScopedDecorator, sourceText) } : {}
+		...reportDecorator ? { report: extractDecoratorConfig(reportDecorator, sourceText, ctx) } : {},
+		...tenantScopedDecorator ? { tenantScoped: extractDecoratorConfig(tenantScopedDecorator, sourceText, ctx) } : {}
 	} : smrtConfig;
 	const { extendsClause, extendsTypeArg } = extractExtendsClause(node, importAliases);
 	const fields = [];
@@ -580,19 +819,45 @@ function isNamedDecorator(decorator, name) {
 	if (expr.type === "Identifier" && expr.name === name) return true;
 	return false;
 }
-function extractDecoratorConfig(decorator, sourceText) {
+function extractDecoratorConfig(decorator, sourceText, ctx) {
 	const expr = decorator.expression;
 	if (expr.type === "CallExpression" && expr.arguments.length > 0) {
-		const arg = expr.arguments[0];
-		if (arg.type === "ObjectExpression") return extractObjectLiteral(arg, sourceText);
+		const arg = unwrapTypeAssertion(expr.arguments[0]);
+		if (arg?.type === "ObjectExpression") return extractObjectLiteral(arg, sourceText, ctx);
 	}
 	return {};
 }
-function extractObjectLiteral(node, sourceText) {
+function extractObjectLiteral(node, sourceText, ctx) {
 	const result = {};
-	for (const prop of node.properties) if (prop.type === "Property" && !prop.computed) {
-		const key = getPropertyKey(prop.key);
-		if (key && isSafeObjectKey(key)) result[key] = extractValue(prop.value, sourceText);
+	for (const prop of node.properties) {
+		if (prop.type === "SpreadElement") {
+			const argument = unwrapTypeAssertion(prop.argument);
+			const constant = argument?.type === "Identifier" ? ctx?.constants.get(argument.name) : void 0;
+			const resolved = constant?.value ?? (argument?.type === "ObjectExpression" ? extractObjectLiteral(argument, sourceText, ctx) : void 0);
+			if (resolved) {
+				if (constant && ctx?.dependencies && argument?.type === "Identifier") ctx.dependencies.push({
+					name: argument.name,
+					start: prop.start
+				});
+				for (const [key, value] of Object.entries(resolved)) if (isSafeObjectKey(key)) result[key] = value;
+				if (constant?.unresolved.length && ctx && !ctx.dependencies) ctx.unresolved.push(...constant.unresolved.filter((unresolved) => hasNestedReferenceValue(constant.value) || prop.start === void 0 || unresolved.start === void 0 || unresolved.start <= prop.start));
+			} else if (ctx) ctx.unresolved.push({
+				expression: sliceSource(prop, sourceText) ?? "...<unknown>",
+				start: prop.start
+			});
+			continue;
+		}
+		if (prop.type === "Property") {
+			const key = getPropertyKey(prop.key);
+			if (prop.shorthand || prop.computed && !(prop.key.type === "Literal" && typeof prop.key.value === "string")) {
+				ctx?.unresolved.push({
+					expression: sliceSource(prop, sourceText) ?? "<unknown property>",
+					start: prop.start
+				});
+				continue;
+			}
+			if (key && isSafeObjectKey(key)) result[key] = extractValue(prop.value, sourceText, ctx);
+		}
 	}
 	return result;
 }
@@ -601,7 +866,9 @@ function getPropertyKey(node) {
 	if (node.type === "Literal" && typeof node.value === "string") return node.value;
 	return null;
 }
-function extractValue(node, sourceText) {
+function extractValue(node, sourceText, ctx) {
+	const unwrapped = unwrapTypeAssertion(node);
+	if (unwrapped && unwrapped !== node) return extractValue(unwrapped, sourceText, ctx);
 	switch (node.type) {
 		case "Literal": return node.value;
 		case "Identifier":
@@ -609,9 +876,18 @@ function extractValue(node, sourceText) {
 			if (node.name === "null") return null;
 			if (node.name === "true") return true;
 			if (node.name === "false") return false;
+			if (ctx?.requireLiteralValues) ctx.unresolved.push({
+				expression: sliceSource(node, sourceText) ?? node.name,
+				start: node.start
+			});
 			return node.name;
-		case "ArrayExpression": return node.elements.filter((el) => el !== null && typeof el === "object" && "type" in el && el.type !== "SpreadElement").map((el) => extractValue(el, sourceText));
-		case "ObjectExpression": return extractObjectLiteral(node, sourceText);
+		case "ArrayExpression":
+			for (const el of node.elements) if (el && typeof el === "object" && el.type === "SpreadElement" && ctx) ctx.unresolved.push({
+				expression: sliceSource(el, sourceText) ?? "...<unknown>",
+				start: el.start
+			});
+			return node.elements.filter((el) => el !== null && typeof el === "object" && "type" in el && el.type !== "SpreadElement").map((el) => extractValue(el, sourceText, ctx));
+		case "ObjectExpression": return extractObjectLiteral(node, sourceText, ctx);
 		case "UnaryExpression":
 			if (node.operator === "-" && node.argument?.type === "Literal") {
 				const value = node.argument.value;
@@ -621,12 +897,24 @@ function extractValue(node, sourceText) {
 		case "CallExpression":
 		case "NewExpression": {
 			const src = sliceSource(node, sourceText);
-			if (src) return src;
+			if (src) {
+				if (ctx?.requireLiteralValues) ctx.unresolved.push({
+					expression: src,
+					start: node.start
+				});
+				return src;
+			}
 			break;
 		}
 	}
 	const rawSrc = sliceSource(node, sourceText);
-	if (rawSrc) return rawSrc;
+	if (rawSrc) {
+		if (ctx?.requireLiteralValues) ctx.unresolved.push({
+			expression: rawSrc,
+			start: node.start
+		});
+		return rawSrc;
+	}
 }
 function extractExtendsClause(node, importAliases) {
 	if (!node.superClass) return {
@@ -1817,4 +2105,4 @@ var OxcScanner = class {
 //#endregion
 export { parseSource as a, parseFile as i, ManifestAdapter as n, InheritanceResolver as o, extractSmrtImports as r, OxcScanner as t };
 
-//# sourceMappingURL=scanner-Di4QAFXG.js.map
+//# sourceMappingURL=scanner-_R1muI_s.js.map