[Bug] download-model-app.js fails hard on a sitemap SubArea targeting a custom web resource ($webresource:<name>)

[JNSPK]

Plugin

model-apps

Plugin Version

2.4.2

Skill / Command

app-builder (download-model-app.js — edit flow)

Bug Description

The App Spec schema for appShell subAreas only supports 4 target kinds: entity, dashboard, url (http/https only), and page (generative page). There is no webresource kind to represent a sitemap SubArea whose Url attribute is a $webresource:<name> token — a standard, documented Site Map Designer feature (a fully custom navigation page backed by an HTML web resource).

In scripts/lib/hydrate-spec.js, subAreaToSpec() maps any subarea with sa.type === 'URL' straight to { ...base, url: sa.url }, without distinguishing a real http(s) link from a $webresource:... token (unlike the CustomPage case a few lines below, which is correctly dropped / returns null). The generic spec validator in scripts/lib/app-spec.js (isSafeHttpUrl(sa.url), around line 847) then rejects the non-http(s) value, and download-model-app.js fails immediately — writing NO spec file at all.

Net effect: the entire "download → edit → rebuild" flow is completely blocked for any app whose sitemap contains one such subarea, even when the requested edit has nothing to do with that subarea (e.g. just adding forms to unrelated tables). The existing --allow-lossy-download flag does not cover this case — it only handles primary-name column read failures.

Steps to Reproduce

1. Have a model-driven app whose sitemap contains a SubArea with Url="$webresource:<name>" (a custom web-resource-based navigation page, added via the Site Map Designer).
2. Run: node scripts/download-model-app.js --env <envUrl> --app <appId|uniqueName> --out <dir>
3. Observe the command fails immediately; no app-spec.json is written.

Expected Behavior

download-model-app.js should either (a) support a "webresource" subarea kind end-to-end (schema + build), or at minimum (b) drop the subarea gracefully like the CustomPage case, with a warning (e.g. "subarea '<title>' targets a custom web resource, not round-tripped — re-add manually after edit"), so the rest of the app can still be downloaded and edited.

Actual Behavior

Command fails immediately with no spec written:

{"ok":false,"error":"downloaded App Spec failed validation","errors":["sitemap subArea \"<title>\" url must be an http(s) URL (got '$webresource:<name>')"]}

Relevant Logs / Screenshots

{"ok":false,"error":"downloaded App Spec failed validation","errors":["sitemap subArea \"Home\" url must be an http(s) URL (got '$webresource:<name>')"]}

Source pointers:

• scripts/lib/hydrate-spec.js — subAreaToSpec(), ~line 32 (sa.type === 'URL' branch doesn't special-case $webresource://WebResources/ tokens)
• scripts/lib/app-spec.js — ~line 847 (isSafeHttpUrl(sa.url) check that rejects the token)

Environment

OS: Windows 11 (build 10.0.26200), via MINGW64/Git Bash
Claude Code: 2.1.221
PAC CLI: 2.9.3+ga17df1d (.NET Framework 4.8.9325.0)

---

🤖 This issue was created using the /report-issue skill.