@swell/cli 2.9.32 → 2.9.34

package/dist/lib/create/tests.js

@@ -4,9 +4,11 @@ import { filePathExistsAsync, writeFile } from '../apps/index.js';
 import { APPS_SDK_VERSION } from './component.js';
 import { mockRequestTemplate, setupGlobalsTemplate, tsconfigTemplate, unitTestTemplate, vitestConfigTemplate, } from './tests/templates/index.js';
 const TEST_DEV_DEPENDENCIES = {
-    // npm 10 cannot resolve vitest 4.1 next to the plugin; vitest 5 needs Node 22.12 or later
+    // npm 10 cannot resolve vitest 4.1 next to the plugin; vitest 5 needs Node 22.12 or later.
+    // npm 10 also crashes ("reading 'edgesOut'") on vitest 5.0 since 5.1.0 came out: vitest's
+    // optional peers (@vitest/browser-*) resolve to 5.1, which wants vitest 5.1
     '@cloudflare/vitest-plugin': '1.4.x',
-    vitest: '5.0.x',
+    vitest: '5.1.x',
     '@swell/app-types': 'latest',
     '@swell/apps-sdk': APPS_SDK_VERSION,
 };

package/dist/lib/inspect/extensions.d.ts

@@ -24,7 +24,7 @@ export interface ManifestEntry {
 }
 /** CLI-resolved type. Diverges from raw manifest `type` for payment (card vs alt). */
 export type ExtensionType = 'card' | 'alt' | 'shipping' | 'tax';
-export type ExtensionStatus = 'not deployed' | 'not activated' | 'app id mismatch' | 'id mismatch' | 'not selected' | 'gateway missing' | 'not enabled' | 'no handler' | 'handler mismatch' | 'activated';
+export type ExtensionStatus = 'not deployed' | 'settings unavailable' | 'not activated' | 'app id mismatch' | 'id mismatch' | 'not selected' | 'gateway missing' | 'not enabled' | 'no handler' | 'handler mismatch' | 'activated';
 export type ActionOwner = 'dev' | 'merchant' | null;
 export interface FunctionRecord {
     id?: string;
@@ -163,8 +163,6 @@ export declare function formatExtensionKey(slug: string, extId: string): string;
  * resolves to `card` even with no explicit `method`.
  */
 export declare function resolveExtensionType(entry: Pick<ManifestEntry, 'type' | 'method' | 'id'>): ExtensionType;
-/** Apply the platform's `if(method, method, id)` formula. */
-export declare function paymentMethodIdFor(entry: Pick<ManifestEntry, 'method' | 'id'>): string;
 /** Shipping records use `app_<appId>_<extId>` as both the row id and the carrier id. */
 export declare function shippingBindId(appId: string, extId: string): string;
 /** Card-gateway records use the same id form as shipping rows. */
@@ -229,12 +227,15 @@ export interface BuildDetailInput {
     payments?: PaymentSettings | null;
     shipments?: ShippingSettings | null;
     taxes?: TaxSettingsRecord | null;
+    /** Why each settings record could not be read, if it could not. */
+    unavailableSettings?: UnavailableSettings;
     /** Functions in the same app whose top-level `extension` matches this extId. */
     functions: FunctionRecord[];
     /** Components in the same app whose `values.extension` matches this extId. */
     components: ComponentRecord[];
     localDiff?: LocalDiff | null;
 }
+export type UnavailableSettings = Partial<Record<'payments' | 'shipments' | 'taxes', string>>;
 export interface BuildOrphanInput {
     appId: string;
     appSlug: string;

package/dist/lib/inspect/extensions.js

@@ -42,10 +42,6 @@ export function resolveExtensionType(entry) {
     const method = entry.method ?? entry.id;
     return method === 'card' ? 'card' : 'alt';
 }
-/** Apply the platform's `if(method, method, id)` formula. */
-export function paymentMethodIdFor(entry) {
-    return entry.method ?? entry.id;
-}
 /** Shipping records use `app_<appId>_<extId>` as both the row id and the carrier id. */
 export function shippingBindId(appId, extId) {
     return `app_${appId}_${extId}`;
@@ -200,7 +196,9 @@ function findShippingCarrier(shipments, carrierId) {
  * gate on `enabled`) is intentional.
  */
 function deriveAltDispatch(ctx) {
-    const methodId = paymentMethodIdFor(ctx.manifest);
+    // The dashboard keys an extension's method by the extension's id, whatever
+    // its `method`, and checkout dispatches on that id
+    const methodId = ctx.extId;
     const expectedGatewayId = gatewayBindId(ctx.appId, ctx.extId);
     const method = findPaymentMethod(ctx.payments, methodId);
     const gateway = findPaymentGateway(ctx.payments, expectedGatewayId);
@@ -254,8 +252,11 @@ function deriveCardDispatch(ctx) {
     const expectedGatewayId = gatewayBindId(ctx.appId, ctx.extId);
     const cardMethod = findPaymentMethod(ctx.payments, 'card');
     const gateway = findPaymentGateway(ctx.payments, expectedGatewayId);
+    // Charges and refunds go to the app and extension the card method names
     const methodChecks = {
         gateway: cardMethod?.gateway === expectedGatewayId,
+        extension_app_id: cardMethod?.extension_app_id === ctx.appId,
+        extension_config_id: cardMethod?.extension_config_id === ctx.extId,
     };
     const gatewayChecks = {
         extension_app_id: gateway?.extension_app_id === ctx.appId,
@@ -285,6 +286,12 @@ function deriveCardDispatch(ctx) {
     if (cardMethod?.gateway !== expectedGatewayId) {
         return { status: 'not activated', native_bindings };
     }
+    if (cardMethod.extension_app_id !== ctx.appId) {
+        return { status: 'app id mismatch', native_bindings };
+    }
+    if (cardMethod.extension_config_id !== ctx.extId) {
+        return { status: 'id mismatch', native_bindings };
+    }
     return { status: 'activated', native_bindings };
 }
 /**
@@ -401,6 +408,26 @@ export function buildExtensionDetail(input) {
         throw new Error('buildExtensionDetail: missing manifest for a deployed extension');
     }
     const type = resolveExtensionType(input.manifest);
+    // Without the settings the activation cannot be told
+    const settingsRecord = type === 'shipping' ? 'shipments' : type === 'tax' ? 'taxes' : 'payments';
+    const unavailable = input.unavailableSettings?.[settingsRecord];
+    if (unavailable) {
+        return {
+            status: 'settings unavailable',
+            action_owner: 'dev',
+            action: `Could not read /settings/${settingsRecord}: ${unavailable}`,
+            type,
+            manifest: input.manifest,
+            native_bindings: [],
+            bound: {
+                functions: input.functions.map((f) => liftBoundFunction(f)),
+                components: input.components.map((c) => liftBoundComponent(c)),
+            },
+            required_events: requiredEventsFor(type),
+            missing_required_events: missingRequiredEvents(type, input.functions),
+            local_diff: input.localDiff ?? null,
+        };
+    }
     const dispatch = deriveDispatch(type, {
         appId: input.appId,
         extId: input.extId,
@@ -487,6 +514,10 @@ function describeAction(status, ctx) {
         case 'not deployed': {
             return { action: 'swell app push', action_owner: 'dev' };
         }
+        // buildExtensionDetail names the settings it could not read
+        case 'settings unavailable': {
+            return { action: null, action_owner: 'dev' };
+        }
         case 'not activated': {
             return {
                 action: `Open Settings → ${section} → ${label} → Save`,

package/dist/lib/swell-function-wrapper.js

@@ -124,9 +124,9 @@ class SwellRequest {
         this.swell = new SwellAPI(this, context);
         // URL of the original request
         this.url;
-        // Request body text. On a route called through the storefront gateway with
-        // a JSON body, this is the exact text the caller sent, so verify HMAC/webhook
-        // signatures against it. Other bodies arrive re-serialized as JSON.
+        // Request body text. On a route called through the storefront gateway, this
+        // is the exact body the caller sent, so verify HMAC/webhook signatures
+        // against it. Form-encoded bodies arrive re-serialized as JSON.
         this.rawBody = '';
         // Parsed JSON body as object, or raw text string when body isn't JSON.
         this.body = {};
@@ -508,7 +508,8 @@ class SwellResponse extends Response {
     }
     static async _respond(req, response, context) {
         let finalResponse = response;
-        const isHook = Boolean(req.data?.$event?.hook);
+        // Only the platform marks a hook's call: a route's data comes from its caller
+        const isHook = Boolean(req.headers.get('Swell-Event-Hook'));
         if (finalResponse instanceof Response &&
             !(finalResponse instanceof SwellResponse)) {
             // Non-hook responses pass through unchanged so the handler's body,

package/dist/push-app-command.js

@@ -7,11 +7,12 @@ import Stream from 'node:stream';
 import ora from 'ora';
 import { default as swellConfig } from './lib/app-config.js';
 import { componentsToRebuild } from './lib/apps/components.js';
+import { extensionManifestWarnings } from './lib/apps/extension-manifest.js';
 import { buildFrontendPackage, getManagedFrontendFramework, } from './lib/apps/frontend-package.js';
 import { warnFrontendRouteCollisions } from './lib/apps/frontend-routes.js';
 import { ConfigType, getFrontendProjectValidValues, allConfigFilesInDir, CUSTOM_FRAMEWORK_SLUG, appConfigFromFile, filePathExistsAsync, findAppConfig, getConfigTypeFromPath, getConfigTypeKeyFromValue, getFrontendProjectType, getProjectCommands, globAllFilesByPath, hashFile, hashString, isPathDirectory, toPosixPath, } from './lib/apps/index.js';
 import { warnListingSources } from './lib/apps/listing.js';
-import { getGlobIgnorePathsChecker } from './lib/apps/paths.js';
+import { getGlobIgnorePathsChecker, globFrontendEnvFiles, isCredentialFile, } from './lib/apps/paths.js';
 import { slugFromApp } from './lib/apps/slug.js';
 import { getLocalInputs } from './lib/bundle.js';
 import { default as localConfig } from './lib/config.js';
@@ -363,6 +364,9 @@ export class PushAppCommand extends RemoteAppCommand {
         }
         if (this.pushesSwellJson(file)) {
             warnListingSources(this.appPath, this.swellConfig.store, (message) => this.warn(message));
+            for (const message of extensionManifestWarnings(this.swellConfig.get('extensions'))) {
+                this.warn(message);
+            }
         }
         // If app exists but owned by another client, create a new instance
         if (app?.client_id && app.client_id !== currentStore) {
@@ -372,7 +376,7 @@ export class PushAppCommand extends RemoteAppCommand {
                 return false;
             }
         }
-        else if (file) {
+        else if (file && !this.pushesSwellJson(file)) {
             // Targeting a file: don't update the app from swell.json, but keep the
             // remote one to diff config hashes and the frontend deployment hash
             if (app) {
@@ -380,7 +384,8 @@ export class PushAppCommand extends RemoteAppCommand {
             }
         }
         else {
-            // Update existing app if not targeting a file
+            // The app takes its details from swell.json before any upload, so that
+            // details the app refuses fail the push first
             this.app = await this.getCreateUpdateApp(app);
         }
         return true;
@@ -501,8 +506,12 @@ export class PushAppCommand extends RemoteAppCommand {
         if (frontendHashes.length > 0) {
             const packageHash = localConfigs.find((config) => config.filePath === 'package.json')?.hash;
             frontendHashes += `|${packageHash}`;
-            // Shared code the worker imports from outside frontend/, e.g. functions/lib
-            for (const input of await this.getFrontendSharedInputs()) {
+            // Shared code the worker imports from outside frontend/, e.g.
+            // functions/lib, and the .env files its build reads
+            for (const input of [
+                ...(await this.getFrontendSharedInputs()),
+                ...(await globFrontendEnvFiles(this.appPath)),
+            ]) {
                 frontendHashes += `|${hashFile(path.join(this.appPath, input), undefined, input)}`;
             }
         }
@@ -795,6 +804,11 @@ export class PushAppCommand extends RemoteAppCommand {
     }
     async pushFile(relativePath) {
         const relativePathPosix = toPosixPath(relativePath);
+        if (isCredentialFile(relativePathPosix)) {
+            ora().fail(`${relativePathPosix} is never pushed: .env and .dev.vars files can hold credentials`);
+            this.failedFiles.push(relativePathPosix);
+            return;
+        }
         const basePath = relativePathPosix.split('/')[0];
         const configType = getConfigTypeFromPath(basePath) || ConfigType.FILE;
         const config = await appConfigFromFile(relativePathPosix, configType, this.appPath);
@@ -825,7 +839,7 @@ export class PushAppCommand extends RemoteAppCommand {
             const pushConcurrency = configTypeKey === 'ASSET' ? 1 : PUSH_CONCURRENCY;
             while (pushFiles.length > 0) {
                 // eslint-disable-next-line no-await-in-loop
-                await Promise.all(pushFiles
+                await this.runTogether(pushFiles
                     .splice(0, pushConcurrency)
                     .map((appConfig) => this.pushRemoteFile(appConfig)));
             }
@@ -834,7 +848,7 @@ export class PushAppCommand extends RemoteAppCommand {
         if (filesToRemove.length > 0) {
             while (filesToRemove.length > 0) {
                 // eslint-disable-next-line no-await-in-loop
-                await Promise.all(filesToRemove
+                await this.runTogether(filesToRemove
                     .splice(0, PUSH_CONCURRENCY)
                     .map((appConfig) => this.removeRemoteFile(appConfig)));
             }
@@ -870,18 +884,17 @@ export class PushAppCommand extends RemoteAppCommand {
         // Process queue in batches with concurrency control
         /* eslint-disable no-await-in-loop */
         while (queue.length > 0) {
-            try {
-                await Promise.all(queue
-                    .splice(0, PUSH_CONCURRENCY)
-                    .map(async ({ action, appConfig }) => {
-                    const result = await (action === 'remove'
-                        ? this.removeRemoteFile(appConfig, this.logWatchChanges)
-                        : this.pushRemoteFile(appConfig, this.logWatchChanges));
-                    this.onWatchChange?.(appConfig, action, result);
-                }));
-            }
-            catch {
-                // TODO: Ignore only some errors
+            const results = await Promise.allSettled(queue.splice(0, PUSH_CONCURRENCY).map(async ({ action, appConfig }) => {
+                const result = await (action === 'remove'
+                    ? this.removeRemoteFile(appConfig, this.logWatchChanges)
+                    : this.pushRemoteFile(appConfig, this.logWatchChanges));
+                this.onWatchChange?.(appConfig, action, result);
+            }));
+            // A failed change ends no watch: its reasons show, and watching goes on
+            for (const result of results) {
+                if (result.status === 'rejected') {
+                    this.logError(result.reason?.message ?? String(result.reason));
+                }
             }
         }
         /* eslint-enable no-await-in-loop */

package/dist/remote-app-command.d.ts

@@ -88,9 +88,9 @@ export declare abstract class RemoteAppCommand extends AppCommand {
         removed: string[];
     }>;
     protected pushRemoteFile(config: AppConfig, log?: boolean): Promise<any>;
+    protected runTogether(tasks: Promise<unknown>[]): Promise<void>;
     protected removeLocalFile(config: AppConfig, log?: boolean): Promise<any>;
     protected removeRemoteFile(config: AppConfig, log?: boolean): Promise<any>;
-    protected showErrors(errors: any, spinnerError?: () => void): void;
     storefrontFrontendUrl(storeId: string, storefront?: any, branchId?: string, preview?: boolean): string;
     protected swellRcPath(): string;
     protected timestampStyled(): string;

package/dist/remote-app-command.js

@@ -1,11 +1,13 @@
 import { confirm, select } from '@inquirer/prompts';
-import { inflect } from 'inflection';
 import sortBy from 'lodash/sortBy.js';
 import * as path from 'node:path';
 import { default as ora } from 'ora';
 import { AppCommand } from './app-command.js';
+import { errorReasons } from './lib/api-errors.js';
 import { readRcFile, writeRcFile } from './lib/app-config.js';
-import { AppConfig, ConfigType, FunctionProcessingError, IgnoringFileError, SwellJsonFields, allBaseFilesInDir, allConfigFilesPaths, appConfigFromFile, batchAppFilesByType, deleteFile, writeFile, writeJsonFile, PUSH_CONCURRENCY, } from './lib/apps/index.js';
+import { isUnloadableComponentFile } from './lib/apps/components.js';
+import { AppConfig, ConfigType, FunctionProcessingError, IgnoringFileError, SwellJsonFields, allBaseFilesInDir, allConfigFilesPaths, appConfigFromFile, batchAppFilesByType, deleteFile, kebabCaseFilePath, writeFile, writeJsonFile, PUSH_CONCURRENCY, } from './lib/apps/index.js';
+import { isCredentialFile } from './lib/apps/paths.js';
 import { default as localConfig } from './lib/config.js';
 import { getAppFrontendHost, getLocalFrontendHost, getLoginHost, getStorefrontFrontendHost, } from './lib/constants.js';
 import { toAppId } from './lib/create/index.js';
@@ -402,38 +404,37 @@ export class RemoteAppCommand extends AppCommand {
         });
         return versionsResponse.results || [];
     }
+    // A refused request fails with every reason the API gives, so that they
+    // reach stderr together with the failure
     async handleRequestErrors(request, spinnerError) {
-        let showedErrors = false;
+        let response;
         try {
-            const response = await request();
-            if (response?.status !== 200 && response?.errors) {
-                this.showErrors(response.errors, spinnerError);
-                showedErrors = true;
-                this.error('Something went wrong.');
-            }
-            return response;
+            response = await request();
         }
         catch (error) {
             let jsonError;
             try {
                 jsonError = JSON.parse(error.message);
             }
-            catch (error) {
+            catch (parseError) {
                 // Skip JSON parse error
-                if (!(error instanceof SyntaxError)) {
-                    throw error;
+                if (!(parseError instanceof SyntaxError)) {
+                    throw parseError;
                 }
             }
-            if (!showedErrors) {
-                if (jsonError && jsonError.error) {
-                    this.showErrors(jsonError, spinnerError);
-                }
-                else if (typeof error.message === 'string') {
-                    this.showErrors(error, spinnerError);
-                }
+            spinnerError?.();
+            const reasons = jsonError?.error ? errorReasons(jsonError) : [];
+            if (reasons.length > 0) {
+                this.error(reasons.join('\n'));
             }
             throw error;
         }
+        if (response?.status !== 200 && response?.errors) {
+            spinnerError?.();
+            const reasons = errorReasons(response.errors);
+            this.error(reasons.length > 0 ? reasons.join('\n') : 'Something went wrong.');
+        }
+        return response;
     }
     async init() {
         await super.init();
@@ -486,7 +487,11 @@ export class RemoteAppCommand extends AppCommand {
         const removed = [];
         const [localConfigs, remoteConfigs] = await Promise.all([
             this.getLocalAppConfigs(),
-            this.pullAppJsonAndRemoteConfigs().then((remoteConfigs) => this.cleanRemoteConfigs(remoteConfigs, false)),
+            this.pullAppJsonAndRemoteConfigs()
+                .then((remoteConfigs) => this.cleanRemoteConfigs(remoteConfigs, false))
+                // An older push could send .env and .dev.vars files, which must not
+                // replace the local ones
+                .then((remoteConfigs) => remoteConfigs.filter((config) => !isCredentialFile(config.filePath))),
         ]);
         const batches = batchAppFilesByType(remoteConfigs);
         for (const batch of batches) {
@@ -629,7 +634,7 @@ export class RemoteAppCommand extends AppCommand {
             if (pushFiles.length > 0) {
                 while (pushFiles.length > 0) {
                     // eslint-disable-next-line no-await-in-loop
-                    await Promise.all(pushFiles.splice(0, batch.concurrency).map(async (config) => {
+                    await this.runTogether(pushFiles.splice(0, batch.concurrency).map(async (config) => {
                         const pushedConfig = await this.pushRemoteFile(config);
                         if (pushedConfig) {
                             pushed.push(pushedConfig.id);
@@ -644,7 +649,7 @@ export class RemoteAppCommand extends AppCommand {
             if (filesToRemove.length > 0) {
                 while (filesToRemove.length > 0) {
                     // eslint-disable-next-line no-await-in-loop
-                    await Promise.all(filesToRemove.splice(0, batch.concurrency).map(async (config) => {
+                    await this.runTogether(filesToRemove.splice(0, batch.concurrency).map(async (config) => {
                         await this.removeRemoteFile(config);
                         removed.push(config.id);
                     }));
@@ -659,15 +664,43 @@ export class RemoteAppCommand extends AppCommand {
     }
     async pushRemoteFile(config, log = true) {
         const spinner = ora();
+        // A file the app already has keeps deploying under its name
+        const unloadable = isUnloadableComponentFile(config.filePath);
+        const pushedBefore = this.app?.configs?.some((remote) => remote.filePath === config.filePath);
+        if (unloadable && !pushedBefore) {
+            log &&
+                spinner.fail(`${config.filePath} would never load: name a component with letters, digits and dashes only`);
+            this.failedFiles.push(config.filePath);
+            return;
+        }
         log && spinner.start(`Pushing ${config.filePath}`);
+        // A refused push has failed the spinner, and its reasons end the command
+        let isRefused = false;
         try {
             const postData = await config.postData();
             if (!postData) {
                 spinner.stop();
                 return;
             }
-            const result = await this.handleRequestErrors(async () => this.postConfigData(postData), () => log && spinner.fail(`Error pushing ${config.filePath}`));
+            const result = await this.handleRequestErrors(async () => this.postConfigData(postData), () => {
+                isRefused = true;
+                log && spinner.fail(`Error pushing ${config.filePath}`);
+            });
             log && spinner.succeed(`${this.timestampStyled()} ${config.filePath}`);
+            // A config named in its values deploys under that name instead of its
+            // file's, and a model as its collection, whatever name it gives
+            const deployName = config.type === ConfigType.MODEL
+                ? postData.values?.collection
+                : postData.name;
+            const kebabPath = deployName === config.name
+                ? kebabCaseFilePath(config.filePath)
+                : undefined;
+            if (log && kebabPath) {
+                ora().warn(`${config.filePath} deploys as '${config.name}': use kebab-case: ${kebabPath}`);
+            }
+            if (log && unloadable) {
+                ora().warn(`${config.filePath} never loads: name a component with letters, digits and dashes only`);
+            }
             return result;
         }
         catch (error) {
@@ -683,10 +716,31 @@ export class RemoteAppCommand extends AppCommand {
                 this.failedFiles.push(config.filePath);
                 return;
             }
+            if (isRefused) {
+                // Each reason names its file, as a batch fails with all of them
+                this.error(error.message
+                    .split('\n')
+                    .map((reason) => `${config.filePath}: ${reason}`)
+                    .join('\n'));
+            }
             log && spinner.fail(error.message);
             throw error;
         }
     }
+    // Runs pushes or removals together and, when some fail, fails once with
+    // the reasons of each of them, not only the first
+    async runTogether(tasks) {
+        const results = await Promise.allSettled(tasks);
+        const failures = results.flatMap((result) => result.status === 'rejected' ? [result.reason] : []);
+        if (failures.length === 1) {
+            throw failures[0];
+        }
+        if (failures.length > 1) {
+            this.error(failures
+                .map((failure) => failure?.message ?? String(failure))
+                .join('\n'));
+        }
+    }
     async removeLocalFile(config, log = true) {
         if (!config.fileData) {
             return;
@@ -706,29 +760,6 @@ export class RemoteAppCommand extends AppCommand {
             spinner.warn(`${this.timestampStyled()} ${style.strike(config.filePath)}`);
         return result;
     }
-    showErrors(errors, spinnerError) {
-        const actualErrors = Object.keys(errors).filter((err) => Object.prototype.hasOwnProperty.call(errors, err));
-        if (spinnerError) {
-            spinnerError();
-        }
-        else {
-            this.logError(inflect('Error', actualErrors.length));
-        }
-        for (const err of actualErrors) {
-            if (!errors[err]?.message)
-                continue;
-            // we need to display `id` instead of `private_id`
-            // developers don't have any knowledge of private ids
-            const displayErr = err === 'private_id' ? 'id' : err;
-            this.logError([
-                '  -',
-                `${displayErr}:`.toLowerCase().replace(/^error:/, ''),
-                errors[err].message,
-            ]
-                .filter(Boolean)
-                .join(' '));
-        }
-    }
     storefrontFrontendUrl(storeId, storefront, branchId, preview = true) {
         const storefrontSlug = storefront && preview
             ? `${storeId}--${storefront.id.toLowerCase()}--preview`