rigortype 0.2.8 → 0.3.0

data/lib/rigor/source/node_children.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Source
+    # Allocation-free replacement for the `node.compact_child_nodes.each { … }` idiom.
+    #
+    # `Prism::Node#compact_child_nodes` allocates a fresh Array on every call — for the ~43 leaf node classes
+    # (`IntegerNode`, `LocalVariableReadNode`, `NilNode`, …) it is literally `def compact_child_nodes; []; end`.
+    # Rigor's tree walkers call it unconditionally on every node of every walk, so one full-tree walk allocates one
+    # Array per node visited. On leaf-heavy sources (a Ragel-generated parser has hundreds of thousands of
+    # integer-literal leaves) these throwaway arrays are the single largest allocation source in a run — over half
+    # of all allocations on mail's `lib`.
+    #
+    # Loading this file compiles a `#rigor_each_child` method onto every `Prism::*Node` class (additive reopening of
+    # a dependency's class, the `Cache::RbsEnvironmentMarshalPatch` precedent; the `rigor_` prefix keeps it
+    # collision-free). It yields the same child nodes, in the same order, without materialising the intermediate
+    # array: each child-bearing field is read directly in field declaration order — exactly the order
+    # `compact_child_nodes` emits — and a `NodeListField`'s already-materialised array is iterated in place (the
+    # reader returns the stored array, not a copy). Nil optional children and nil list elements are skipped,
+    # mirroring `compact_child_nodes`'s "compact" semantics. Leaf classes compile to an empty method.
+    #
+    # A method compiled onto the node class is the fastest dispatch available for this shape — one virtual send on
+    # the receiver, the same mechanism `compact_child_nodes` itself uses, with zero allocation. The reflective
+    # alternatives were measured and rejected: a `public_send`-per-field loop is ~45 % *slower* than
+    # `compact_child_nodes` on a full-tree walk (dynamic dispatch per field swamps the allocation win), and a
+    # central generated-method table dispatched via `Module#send` + a per-class Hash lookup still regressed
+    # Rails-corpus wall ~5 % under YJIT. Walkers therefore call `node.rigor_each_child { … }` directly.
+    #
+    # The field map is derived once at load from `Prism::Reflection`, so it tracks whatever `prism` version resolves
+    # at runtime (ADR-79) instead of a hand-maintained table. `spec/rigor/source/node_children_spec.rb` is the
+    # binding contract: over a corpus of real source it asserts — for every node reached — that both
+    # `#rigor_each_child` and {each_child} yield output element-for-element identical (object identity and order) to
+    # `compact_child_nodes`.
+    module NodeChildren
+      module_function
+
+      # The concrete `Prism::*Node` classes (`< Prism::Node`).
+      NODE_CLASSES =
+        Prism.constants.grep(/Node\z/).filter_map do |name|
+          const = Prism.const_get(name)
+          const if const.is_a?(Class) && const < Prism::Node
+        end.freeze
+
+      # Shared frozen empty entry for leaf classes. Identity (`equal?`) distinguishes a leaf entry from a
+      # childless-in-practice non-leaf.
+      EMPTY = [].freeze
+
+      # node class => frozen Array of `[reader_symbol, :node | :node_optional | :list]` pairs, in field declaration
+      # order (the order `compact_child_nodes` emits its children). Leaf classes map to {EMPTY}. This is the source
+      # of truth the per-class methods are compiled from, exposed for introspection and the equivalence spec.
+      CHILD_READERS =
+        NODE_CLASSES.each_with_object({}) do |klass, map|
+          pairs = Prism::Reflection.fields_for(klass).filter_map do |field|
+            case field
+            when Prism::Reflection::OptionalNodeField
+              [field.name, :node_optional].freeze
+            when Prism::Reflection::NodeField
+              [field.name, :node].freeze
+            when Prism::Reflection::NodeListField
+              [field.name, :list].freeze
+            end
+          end
+          map[klass] = pairs.empty? ? EMPTY : pairs.freeze
+        end.freeze
+
+      # The leaf classes — no child-bearing field, so `compact_child_nodes` is always `[]` and `#rigor_each_child`
+      # compiles to an empty method. Exposed for the equivalence spec and introspection.
+      LEAF_CLASSES = NODE_CLASSES.select { |klass| CHILD_READERS[klass].equal?(EMPTY) }.to_set.freeze
+
+      # Codegen (not per-call reflection) so iteration reads fields directly at hand-written speed — see the module
+      # comment for the measurements ruling out the reflective forms. Each statement mirrors `compact_child_nodes`'s
+      # own form for that field kind exactly: a required `NodeField` is yielded unconditionally (`compact <<
+      # predicate`), an `OptionalNodeField` behind a truthiness guard (`compact << receiver if receiver`), and a
+      # `NodeListField`'s stored array is iterated unfiltered (`compact.concat(requireds)`) — no extra nil checks
+      # beyond what Prism itself performs. The explicit `self.` receiver keeps a hypothetical future field named
+      # `child` from parsing as the just-assigned local. For a `CallNode` (three optional-node fields) the emitted
+      # source is:
+      #
+      #   def rigor_each_child
+      #     child = self.receiver
+      #     yield child if child
+      #     child = self.arguments
+      #     yield child if child
+      #     child = self.block
+      #     yield child if child
+      #   end
+      NODE_CLASSES.each do |klass|
+        statements = CHILD_READERS[klass].map do |reader, kind|
+          case kind
+          when :list          then "self.#{reader}.each { |child| yield child }"
+          when :node_optional then "child = self.#{reader}\n  yield child if child"
+          else                     "yield self.#{reader}"
+          end
+        end
+        klass.class_eval(<<~RUBY, __FILE__, __LINE__ + 1) # rubocop:disable Style/DocumentDynamicEvalDefinition
+          def rigor_each_child
+            #{statements.join("\n  ")}
+          end
+        RUBY
+      end
+
+      # Yield each direct child `Prism::Node` of `node` in `compact_child_nodes` order, without allocating an
+      # intermediate array. Nil / non-node input yields nothing (an optional field can be nil, so a caller may pass
+      # e.g. `node.body`). Pure and re-entrant; `break` / `next` / `return` in the block behave exactly as they
+      # would with `compact_child_nodes.each`. Walkers holding a known `Prism::Node` call `#rigor_each_child`
+      # directly; this wrapper is the nil-tolerant entry.
+      #
+      # @yieldparam child [Prism::Node]
+      def each_child(node, &)
+        node.rigor_each_child(&) if node.is_a?(Prism::Node)
+      end
+    end
+  end
+end

data/lib/rigor/source/node_locator.rb

@@ -2,6 +2,8 @@
 
 require "prism"
 
+require_relative "node_children"
+
 module Rigor
   module Source
     # Locates the deepest Prism AST node enclosing a given source position.
@@ -83,7 +85,7 @@ module Rigor
         return nil unless node.is_a?(Prism::Node)
         return nil unless contains?(node, offset)
 
-        node.compact_child_nodes.each do |child|
+        node.rigor_each_child do |child|
           deeper = descend(child, offset)
           return deeper if deeper
         end

data/lib/rigor/source/node_walker.rb

@@ -2,6 +2,8 @@
 
 require "prism"
 
+require_relative "node_children"
+
 module Rigor
   module Source
     # Yields every `Prism::Node` reachable from a root in DFS pre-order.
@@ -28,7 +30,7 @@ module Rigor
         return unless node.is_a?(Prism::Node)
 
         yield node
-        node.compact_child_nodes.each { |child| walk(child, &) }
+        node.rigor_each_child { |child| walk(child, &) }
       end
 
       # Like {.each}, but also yields the node's lexical ancestor chain (outermost first, EXCLUDING the node
@@ -51,7 +53,7 @@ module Rigor
 
         block.call(node, ancestors)
         ancestors.push(node)
-        node.compact_child_nodes.each { |child| walk_with_ancestors(child, ancestors, &block) }
+        node.rigor_each_child { |child| walk_with_ancestors(child, ancestors, &block) }
         ancestors.pop
       end
     end

data/lib/rigor/source.rb

@@ -10,6 +10,7 @@ module Rigor
   end
 end
 
+require_relative "source/node_children"
 require_relative "source/node_locator"
 require_relative "source/node_walker"
 require_relative "source/literals"

data/lib/rigor/type/difference.rb

@@ -48,6 +48,30 @@ module Rigor
         base.erase_to_rbs
       end
 
+      # True when `removed` is the *empty witness* of `base` — the single value whose removal makes this
+      # difference one of the catalogued `non-empty-*` / `non-zero-int` refinements (`""` for String, `0`
+      # for Integer, `[]` for Array, `{}` for Hash).
+      #
+      # This is the shared recogniser for the whole engine: the display side (`canonical_name` below),
+      # `ShapeDispatch`'s refinement-aware projections, and `MutationWidening`'s invalidation arm all ask
+      # this one question, so the recognised set cannot drift between them.
+      def removes_empty_witness?
+        return false unless base.is_a?(Nominal)
+
+        predicate = EMPTY_WITNESS_PREDICATES[base.class_name]
+        !!predicate && predicate.call(removed)
+      end
+
+      EMPTY_WITNESS_PREDICATES = {
+        "String" => ->(removed) { removed.is_a?(Constant) && removed.value == "" },
+        "Integer" => lambda { |removed|
+          removed.is_a?(Constant) && removed.value.is_a?(Integer) && removed.value.zero?
+        },
+        "Array" => ->(removed) { removed.is_a?(Tuple) && removed.elements.empty? },
+        "Hash" => ->(removed) { removed.is_a?(HashShape) && removed.pairs.empty? }
+      }.freeze
+      private_constant :EMPTY_WITNESS_PREDICATES
+
       def top
         Trinary.no
       end
@@ -80,47 +104,27 @@ module Rigor
       # The recognised set is kept in sync with the imported-built-in catalogue
       # ([`imported-built-in-types.md`](docs/type-specification/imported-built-in-types.md)).
       def canonical_name
-        return nil unless base.is_a?(Nominal)
+        return nil unless removes_empty_witness?
 
-        send(CANONICAL_HANDLERS[base.class_name] || :no_canonical_name)
+        send(CANONICAL_HANDLERS[base.class_name])
       end
 
       CANONICAL_HANDLERS = {
         "String" => :string_canonical_name,
         "Integer" => :integer_canonical_name,
-        "Array" => :array_canonical_name_if_empty,
-        "Hash" => :hash_canonical_name_if_empty
+        "Array" => :array_canonical_name,
+        "Hash" => :hash_canonical_name
       }.freeze
       private_constant :CANONICAL_HANDLERS
 
-      def no_canonical_name
-        nil
-      end
-
       def string_canonical_name
-        return nil unless removed.is_a?(Constant) && removed.value == ""
-
         "non-empty-string"
       end
 
       def integer_canonical_name
-        return nil unless removed.is_a?(Constant) && removed.value.is_a?(Integer) && removed.value.zero?
-
         "non-zero-int"
       end
 
-      def array_canonical_name_if_empty
-        return nil unless removed.is_a?(Tuple) && removed.elements.empty?
-
-        array_canonical_name
-      end
-
-      def hash_canonical_name_if_empty
-        return nil unless removed.is_a?(HashShape) && removed.pairs.empty?
-
-        hash_canonical_name
-      end
-
       def array_canonical_name
         elem = base.type_args.first
         return "non-empty-array" if elem.nil?

data/lib/rigor/type/hash_shape.rb

@@ -11,9 +11,12 @@ module Rigor
     # inhabit the corresponding value types. RBS records correspond to the exact closed subset; Rigor
     # extends that carrier with optional keys, read-only entry views, and an open/closed extra-key policy.
     #
-    # Keys are restricted to Symbol and String values. Exact closed symbol-keyed shapes erase to the RBS
-    # record syntax `{ a: Integer, ?b: String }`; all other shapes degrade to `Hash[K, V]` or raw `Hash`
-    # when no useful bounds are available.
+    # Keys are restricted to value-pinned scalar literals: Symbol, String, Integer, Float, and the
+    # `true` / `false` / `nil` singletons. Exact closed symbol-keyed shapes erase to the RBS record
+    # syntax `{ a: Integer, ?b: String }`; all other shapes degrade to `Hash[K, V]` or raw `Hash` when
+    # no useful bounds are available. Key identity follows Ruby's own `Hash` `eql?` semantics because
+    # the pairs are stored in a native Ruby Hash — `1` and `1.0` are DISTINCT keys (`1.eql?(1.0)` is
+    # false), while `1.0` and `1.00` are the same key.
     #
     # Equality and hashing are structural over the (key -> Rigor::Type) pair set and policy fields. Hash
     # insertion order is preserved by the underlying storage but does NOT affect equality (matching
@@ -22,7 +25,7 @@ module Rigor
     # See docs/type-specification/rbs-compatible-types.md (records) and
     # docs/type-specification/rigor-extensions.md (hash shape).
     class HashShape
-      ALLOWED_KEY_CLASSES = [Symbol, String].freeze
+      ALLOWED_KEY_CLASSES = [Symbol, String, Integer, Float, TrueClass, FalseClass, NilClass].freeze
       EXTRA_KEY_POLICIES = %i[open closed].freeze
       POLICY_KEYWORDS = %i[required_keys optional_keys read_only_keys extra_keys].freeze
       # A Symbol whose text matches renders as a bare RBS record key (`lang:`) in {#erase_to_rbs};
@@ -128,7 +131,8 @@ module Rigor
         pairs.each_key do |key|
           next if ALLOWED_KEY_CLASSES.any? { |klass| key.is_a?(klass) }
 
-          raise ArgumentError, "HashShape keys must be Symbol or String, got #{key.class}"
+          raise ArgumentError,
+                "HashShape keys must be one of #{ALLOWED_KEY_CLASSES.join(', ')}, got #{key.class}"
         end
       end
 
@@ -190,17 +194,28 @@ module Rigor
         prefix = []
         prefix << "readonly" if read_only_key?(key)
         rendered_key = optional_key?(key) ? "?#{render_key(key)}" : render_key(key)
-        prefix << "#{rendered_key}:"
+        prefix << "#{rendered_key}#{key_separator(key)}"
         "#{prefix.join(' ')} #{value.describe(verbosity)}"
       end
 
       # `describe` is a human-facing display contract (it feeds diagnostic messages, never a parser),
-      # so it keeps the compact `"a":` form for a quoted key. The RBS-erasure path uses
-      # {#erase_key_prefix} instead, which must emit a parseable key.
+      # so it keeps the compact `"a":` form for a quoted key. Non-(Symbol|String) scalar keys render in
+      # the natural hashrocket spelling (`1 => 2`, `1.0 => 4`, `nil => 0`) via {#key_separator}; their
+      # `inspect` is the canonical Ruby literal, so describe stays deterministic. The RBS-erasure path
+      # uses {#erase_key_prefix} instead, which must emit a parseable key.
       def render_key(key)
         case key
         when Symbol then key.to_s
-        when String then key.inspect
+        else key.inspect
+        end
+      end
+
+      # Symbol / String keys keep the compact colon form (`a: 1`, `"k": 2`); every other scalar key uses
+      # the hashrocket (`1 => 2`) — the form the user would have to write in source.
+      def key_separator(key)
+        case key
+        when Symbol, String then ":"
+        else " =>"
         end
       end
 
@@ -230,8 +245,17 @@ module Rigor
         "Hash[#{key_type.erase_to_rbs}, #{value_type.erase_to_rbs}]"
       end
 
+      # Conservative per-key-class bound for the `Hash[K, V]` degradation. Symbol / String / Integer /
+      # Float keys widen to their class nominal; the `true` / `false` / `nil` singletons keep their
+      # literal carrier (the constant IS the class's whole value set, and RBS spells the literal — `nil`
+      # reads better than `NilClass`).
       def hash_erasure_key_type
-        key_types = pairs.keys.map { |key| Type::Combinator.nominal_of(key.class) }
+        key_types = pairs.keys.map do |key|
+          case key
+          when true, false, nil then Type::Combinator.constant_of(key)
+          else Type::Combinator.nominal_of(key.class)
+          end
+        end
         Type::Combinator.union(*key_types)
       end
     end

data/lib/rigor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rigor
-  VERSION = "0.2.8"
+  VERSION = "0.3.0"
 end

data/lib/rigortype.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# Nothing in an application should ever load Rigor: it is a command-line tool
+# that reads a project from the outside, not a library (ADR-27). This file
+# exists only because `Bundler.require` — the default for every Gemfile entry,
+# and what Rails runs at boot — requires a gem by its *gem* name, `rigortype`,
+# while the library entry point is `rigor.rb`.
+#
+# Without this file that call raises a bare `LoadError` naming `rigortype`, so
+# a `bundle add rigortype` succeeds and the *next* `rails s` dies with no
+# explanation of what went wrong or what to do instead. The file is a guardrail,
+# not an entry point: it warns and defines nothing. `require "rigor"` remains
+# the (analyzer-internal) way in.
+warn(<<~MESSAGE)
+  rigortype: `require "rigortype"` does nothing — Rigor is a command-line tool, not a library.
+
+  This usually means Rigor is in your Gemfile, where `Bundler.require` loads it at boot. Rigor
+  analyses your project from the outside and runs on its own Ruby, so a Gemfile entry constrains
+  your application's Ruby and dependency resolution without giving you anything. Remove it and
+  install Rigor independently: https://github.com/rigortype/rigor/blob/master/docs/install.md
+
+  To keep the Gemfile entry anyway, mark it `gem "rigortype", require: false` — that silences
+  this warning, but the resolution constraints remain.
+MESSAGE

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable/channel_discoverer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "rigor/source/node_children"
+
 require "prism"
 
 require_relative "channel_index"
@@ -76,7 +78,7 @@ module Rigor
           when Prism::ClassNode then visit_class(node, lexical_path, &)
           when Prism::ModuleNode then visit_module(node, lexical_path, &)
           else
-            node.compact_child_nodes.each { |child| walk_for_channels(child, lexical_path, &) }
+            node.rigor_each_child { |child| walk_for_channels(child, lexical_path, &) }
           end
         end
 
@@ -138,7 +140,7 @@ module Rigor
             end
           end
 
-          node.compact_child_nodes.each do |child|
+          node.rigor_each_child do |child|
             names, dynamic = collect_stream_registrations(child, names: names, dynamic: dynamic)
           end
           [names, dynamic]

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer/mailer_discoverer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "rigor/source/node_children"
+
 require "prism"
 require "rigor/source/literals"
 
@@ -97,7 +99,7 @@ module Rigor
           when Prism::ClassNode then visit_class(node, lexical_path, &)
           when Prism::ModuleNode then visit_module(node, lexical_path, &)
           else
-            node.compact_child_nodes.each { |child| walk_for_mailers(child, lexical_path, &) }
+            node.rigor_each_child { |child| walk_for_mailers(child, lexical_path, &) }
           end
         end
 
@@ -124,7 +126,7 @@ module Rigor
           return [] if body.nil?
 
           names = []
-          body.compact_child_nodes.each do |node|
+          body.rigor_each_child do |node|
             next unless node.is_a?(Prism::CallNode) && node.receiver.nil? && node.name == :include
 
             (node.arguments&.arguments || []).each do |arg|
@@ -158,7 +160,7 @@ module Rigor
             inner = local_name ? lexical_path + [local_name.delete_prefix("::")] : lexical_path
             collect_module_actions(node.body, inner, accumulator) if node.body
           else
-            node.compact_child_nodes.each { |child| collect_module_actions(child, lexical_path, accumulator) }
+            node.rigor_each_child { |child| collect_module_actions(child, lexical_path, accumulator) }
           end
         end
 
@@ -231,7 +233,7 @@ module Rigor
           private_names = []
           callback_names = []
 
-          body.compact_child_nodes.each do |node|
+          body.rigor_each_child do |node|
             next unless node.is_a?(Prism::CallNode) && node.receiver.nil?
 
             args = (node.arguments&.arguments || []).filter_map do |arg|

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/analyzer.rb

@@ -58,6 +58,12 @@ module Rigor
         # receiver is `params.require(:symbol)`.
         STRONG_PARAMS_RECEIVER_NAMES = %i[require permit_params strong_params].freeze
 
+        # Max edit distance between a non-column permit key and a real column for the key to count as a
+        # typo (and fire `unknown-permit-key`) rather than a legitimate virtual attribute. A tight bound
+        # keeps genuine typos (`emial`→`email`, distance 2) while never firing on a virtual attribute,
+        # whose name is nothing like any column.
+        PERMIT_KEY_TYPO_MAX_DISTANCE = 2
+
         # One Action Pack observation. Carries no path — the caller (the `node_rule` block) positions
         # it via `Plugin::Base#diagnostic`. `location` is the Prism location the diagnostic should point
         # at (a call's `message_loc` for the call itself, or a sub-argument's location for
@@ -150,12 +156,11 @@ module Rigor
           return [] if entry.nil? # unknown model — skip; the model lookup is best-effort.
 
           columns = entry[:columns]
-          spell_checker = DidYouMean::SpellChecker.new(dictionary: columns)
-          literal_permit_keys(call_node).map do |key_node, key_name|
+          literal_permit_keys(call_node).filter_map do |key_node, key_name|
             if columns.include?(key_name)
               permit_call_violation(call_node, model_class, key_name)
             else
-              unknown_permit_key_violation(key_node, model_class, key_name, spell_checker)
+              unknown_permit_key_violation(key_node, model_class, key_name, columns)
             end
           end
         end
@@ -347,13 +352,23 @@ module Rigor
           )
         end
 
-        def unknown_permit_key_violation(key_node, model_class, key_name, spell_checker)
-          base = "Action Pack permit `#{key_name}` is not a column on `#{model_class}`."
-          suggestion = spell_checker.correct(key_name).first
-          message = suggestion ? "#{base} Did you mean `:#{suggestion}`?" : base
+        # A permit key that is not a column is only a violation when it is a near-miss TYPO of a real
+        # column. Permitting a non-column is ordinary Rails: a Devise virtual attribute (`password`,
+        # `remember_me`, `otp_attempt`), a state-machine `*_event`, an `attr_accessor` setter, or a nested
+        # `*_attributes` key are all mass-assignable but absent from the schema. So fire only when a column
+        # sits within a tight edit distance of the key (a typo like `emial`→`email`); a key with no close
+        # column is presumed a deliberate virtual attribute and passes silently. Firing on every non-column
+        # key false-positives across the whole strong-params surface of a Devise/state-machine app.
+        def unknown_permit_key_violation(key_node, model_class, key_name, columns)
+          nearest = columns.min_by { |col| DidYouMean::Levenshtein.distance(key_name, col) }
+          return nil if nearest.nil?
+          return nil if DidYouMean::Levenshtein.distance(key_name, nearest) > PERMIT_KEY_TYPO_MAX_DISTANCE
+
           Violation.new(
             location: key_node.location,
-            message: message, severity: :error, rule: "unknown-permit-key"
+            message: "Action Pack permit `#{key_name}` is not a column on `#{model_class}`. " \
+                     "Did you mean `:#{nearest}`?",
+            severity: :error, rule: "unknown-permit-key"
           )
         end
 

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_discoverer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "rigor/source/node_children"
+
 require "prism"
 
 require_relative "controller_index"
@@ -89,7 +91,7 @@ module Rigor
 
             walk_declarations(node.body, namespace: inner_namespace, &)
           else
-            node.compact_child_nodes.each do |child|
+            node.rigor_each_child do |child|
               walk_declarations(child, namespace: namespace, &)
             end
           end
@@ -142,7 +144,7 @@ module Rigor
           return accumulator unless node.is_a?(Prism::Node)
 
           accumulator << node.name if node.is_a?(Prism::DefNode) && node.receiver.nil?
-          node.compact_child_nodes.each { |child| collect_def_names(child, accumulator) }
+          node.rigor_each_child { |child| collect_def_names(child, accumulator) }
           accumulator
         end
 
@@ -160,7 +162,7 @@ module Rigor
             end
           end
 
-          node.compact_child_nodes.each { |child| collect_include_targets(child, accumulator) }
+          node.rigor_each_child { |child| collect_include_targets(child, accumulator) }
           accumulator
         end
 

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -182,6 +182,27 @@ module Rigor
         Rigor::Type::Combinator.nominal_of(class_name)
       end
 
+      # Phase 5b (2026-07-10) — keep the strong-parameters fluent chain typed. `params` types to
+      # `ActionController::Parameters` (above), but the chained `params.require(:user).permit(:name)` /
+      # `params.permit(...)` calls returned `Dynamic` at the first hop (Parameters ships no bundled RBS,
+      # so a call on it resolves lenient-to-Dynamic), leaking every downstream site (`.permit`, `.to_h`,
+      # `.each`) to unprotected. These three methods return another `Parameters`, so gate on a
+      # `Parameters` receiver and re-type the result as the same lenient nominal — the chain stays a
+      # concrete receiver end-to-end and `coverage --protection` counts the sites as protected.
+      #
+      # `require` may return a scalar for a flat key at runtime (`params.require(:id) → String`), but
+      # typing it as the RBS-less `Parameters` is FP-safe by the same argument as the readers: every
+      # method on a Parameters value stays engine-lenient (no `undefined-method`), and this types the
+      # container only, never a caller's argument (ADR-5). The GitLab strong-params survey (108 leaked
+      # `.permit` sites) is the demand.
+      STRONG_PARAMS_CHAIN_METHODS = %i[require permit permit!].freeze
+
+      dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:params]], methods: STRONG_PARAMS_CHAIN_METHODS do |call_node, _scope|
+        next nil unless call_node.is_a?(Prism::CallNode)
+
+        Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params])
+      end
+
       private
 
       # True when the current `self` is a controller — the enclosing class is one the discoverer

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/job_discoverer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "rigor/source/node_children"
+
 require "prism"
 
 require_relative "job_index"
@@ -66,7 +68,7 @@ module Rigor
           when Prism::ClassNode then visit_class(node, lexical_path, &)
           when Prism::ModuleNode then visit_module(node, lexical_path, &)
           else
-            node.compact_child_nodes.each { |child| walk_for_jobs(child, lexical_path, &) }
+            node.rigor_each_child { |child| walk_for_jobs(child, lexical_path, &) }
           end
         end
 
@@ -118,7 +120,7 @@ module Rigor
         def lookup_perform_def(body)
           return nil if body.nil?
 
-          body.compact_child_nodes.each do |node|
+          body.rigor_each_child do |node|
             next unless node.is_a?(Prism::DefNode) && node.name == :perform
             next if node.receiver.is_a?(Prism::SelfNode)
 

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/analyzer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "rigor/source/node_children"
+
 require "prism"
 
 module Rigor
@@ -50,7 +52,7 @@ module Rigor
           return if node.nil?
 
           yield node
-          node.compact_child_nodes.each { |child| walk(child, &) }
+          node.rigor_each_child { |child| walk(child, &) }
         end
 
         def visit_call(node)
@@ -90,7 +92,7 @@ module Rigor
           # than firing a false `unknown-column` against every key.
           return push_recognised(node, entry, keyword_pairs.map { |p| p[:key] }) if entry.column_names.empty?
 
-          unknown = keyword_pairs.reject { |pair| valid_query_key?(entry, pair[:key]) }
+          unknown = keyword_pairs.reject { |pair| nested_condition?(pair[:value]) || valid_query_key?(entry, pair[:key]) }
           if unknown.empty?
             keyword_pairs.each { |pair| validate_enum_value(node, entry, pair) }
             push_recognised(node, entry, keyword_pairs.map { |p| p[:key] })
@@ -129,6 +131,15 @@ module Rigor
           assoc && assoc[:kind] == :singular
         end
 
+        # A keyword pair with a Hash value is a nested / joined-table condition (`Approval.where(approvals:
+        # { user_id: 1 })`, `where(users: { name: 'x' })`), where the key names an association or a joined
+        # table, not a column on the receiver. Rails resolves it through the join, so it must not be checked
+        # against the receiver's own columns. (An Array value — `where(status: [:a, :b])` — is an IN query on
+        # a real column, not nested, so only a Hash is skipped.)
+        def nested_condition?(value_node)
+          value_node.is_a?(Prism::HashNode) || value_node.is_a?(Prism::KeywordHashNode)
+        end
+
         # When the column is an enum-bearing column AND the passed value is a Symbol literal, the value
         # MUST be one of the declared enum values. Non-Symbol values (variables, expressions) decline so
         # dynamic call sites stay silent. Sequences (`status: [:active, :archived]`) are intentionally NOT