@lotics/cli 0.45.1 → 0.46.0

package/dist/app_commands.d.ts

@@ -102,6 +102,12 @@ export declare function appPull(client: LoticsClient, args: {
     app_id: string;
     targetPath?: string;
 }): Promise<void>;
+/**
+ * Capabilities the source CALLS but the manifest does not DECLARE — each one
+ * silently 403s at runtime (GAP-29). Pure over the concatenated source text so
+ * it's unit-testable; the deploy warns (non-blocking) on a non-empty result.
+ */
+export declare function undeclaredCapabilities(sourceText: string, declared: Record<string, boolean | undefined> | undefined): string[];
 /**
  * `lotics app deploy [-m <message>]`
  *

package/dist/app_commands.js

@@ -289,6 +289,48 @@ export async function appPull(client, args) {
     console.error(`  # edit src/App.tsx`);
     console.error(`  lotics app deploy`);
 }
+/**
+ * SDK calls that only work when the matching capability is declared in
+ * `package.json#lotics.capabilities`. Used by the deploy pre-flight (GAP-29):
+ * code that calls one of these but omits the capability silently 403s at
+ * runtime, with no build or deploy error. Extend this map when a new capability
+ * gate ships in `@lotics/app-sdk`.
+ */
+const CAPABILITY_GATED_CALLS = {
+    comments: ["useComments", "createComment", "updateComment", "deleteComment"],
+};
+/**
+ * Capabilities the source CALLS but the manifest does not DECLARE — each one
+ * silently 403s at runtime (GAP-29). Pure over the concatenated source text so
+ * it's unit-testable; the deploy warns (non-blocking) on a non-empty result.
+ */
+export function undeclaredCapabilities(sourceText, declared) {
+    const used = [];
+    for (const [capability, calls] of Object.entries(CAPABILITY_GATED_CALLS)) {
+        const isCalled = calls.some((call) => new RegExp(`\\b${call}\\b`).test(sourceText));
+        if (isCalled && declared?.[capability] !== true)
+            used.push(capability);
+    }
+    return used;
+}
+/** Concatenated text of the app's `src/` files — the input to the capability pre-flight. */
+function readAppSourceText(projectDir) {
+    const srcDir = path.join(projectDir, "src");
+    if (!fs.existsSync(srcDir))
+        return "";
+    const parts = [];
+    const walk = (dir) => {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                walk(full);
+            else if (/\.(ts|tsx|js|jsx)$/.test(entry.name))
+                parts.push(fs.readFileSync(full, "utf8"));
+        }
+    };
+    walk(srcDir);
+    return parts.join("\n");
+}
 /**
  * `lotics app deploy [-m <message>]`
  *
@@ -300,6 +342,16 @@ export async function appPull(client, args) {
 export async function appDeploy(client, args) {
     const projectDir = path.resolve(args.projectDir ?? process.cwd());
     const meta = readAppMeta(projectDir);
+    // Pre-flight (GAP-29): a capability the code calls but the manifest doesn't
+    // declare silently 403s at runtime with no other signal — warn before shipping
+    // it. Non-blocking, like the unbranded nudge below.
+    const undeclared = undeclaredCapabilities(readAppSourceText(projectDir), meta.capabilities);
+    if (undeclared.length > 0) {
+        const block = JSON.stringify(Object.fromEntries(undeclared.map((c) => [c, true])));
+        console.error(`\n⚠ This app calls capability-gated SDK functions for ${undeclared.join(", ")} but the ` +
+            `manifest doesn't declare ${undeclared.length > 1 ? "them" : "it"} — those calls will 403 at runtime.\n` +
+            `  Add to package.json#lotics.capabilities:  ${block}`);
+    }
     // Regenerate AppWorkflows typing before the build picks up source. Keeps
     // .lotics/app_workflows.d.ts in sync with the manifest's workflows map
     // every time the developer ships.

package/dist/app_commands.test.js

@@ -2,7 +2,7 @@ import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import fs from "node:fs";
 import path from "node:path";
 import { tmpdir } from "node:os";
-import { stampPulledManifest } from "./app_commands.js";
+import { stampPulledManifest, undeclaredCapabilities } from "./app_commands.js";
 /**
  * `appPull` reads workflows from the live App row (server response), NOT from
  * the manifest embedded in the extracted source archive. The frozen archive
@@ -104,3 +104,31 @@ describe("stampPulledManifest", () => {
         expect(dts).toContain("only_live");
     });
 });
+/**
+ * The deploy pre-flight that catches GAP-29: source that CALLS a capability-gated
+ * SDK function while the manifest omits that capability would silently 403 at
+ * runtime. `undeclaredCapabilities` is the pure decision the warning is built on.
+ */
+describe("undeclaredCapabilities", () => {
+    const commentsSource = `import { useComments } from "@lotics/app-sdk";\nconst { available } = useComments({ record_id });`;
+    it("flags a capability that's called but not declared", () => {
+        expect(undeclaredCapabilities(commentsSource, undefined)).toEqual(["comments"]);
+        expect(undeclaredCapabilities(commentsSource, {})).toEqual(["comments"]);
+        expect(undeclaredCapabilities(commentsSource, { comments: false })).toEqual(["comments"]);
+    });
+    it("stays quiet when the called capability is declared", () => {
+        expect(undeclaredCapabilities(commentsSource, { comments: true })).toEqual([]);
+    });
+    it("stays quiet when the capability isn't used at all", () => {
+        expect(undeclaredCapabilities(`const x = createInvoice();`, undefined)).toEqual([]);
+        expect(undeclaredCapabilities("", { comments: true })).toEqual([]);
+    });
+    it("matches on whole identifiers, not substrings", () => {
+        // `myUseCommentsHelper` is not a call to the gated `useComments`.
+        expect(undeclaredCapabilities(`const x = myUseCommentsHelper();`, undefined)).toEqual([]);
+    });
+    it("detects any of a capability's gated calls", () => {
+        expect(undeclaredCapabilities(`await createComment({ body });`, {})).toEqual(["comments"]);
+        expect(undeclaredCapabilities(`await deleteComment(id);`, {})).toEqual(["comments"]);
+    });
+});

package/dist/client.js

@@ -154,7 +154,7 @@ export class LoticsClient {
         return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}`);
     }
     async createApp(body) {
-        return this.request("POST", "/v1/apps", { ...body, ui: { type: "custom_code" } });
+        return this.request("POST", "/v1/apps", body);
     }
     /**
      * Rename an app's public subdomain — its `<slug>.lotics.app` address.