@amityco/social-plus-vise 1.3.0 → 1.4.0

package/rules/sdk-lifecycle.yaml

@@ -401,6 +401,143 @@
         "invalid region"
       ]
     },
+    {
+      "id": "flutter.setup.sync-initialization",
+      "version": 1,
+      "title": "Flutter setup should complete SDK service initialization before login or live queries",
+      "severity": "warning",
+      "rationale": "Flutter builds can pass while runtime fails with `MessageDbAdapter not ready` if login or live SDK queries start before the SDK service locator finishes initializing. Use `sycInitialization: true` on AmityCoreClient.setup, or provide equivalent readiness gating before login/query.",
+      "applies_when": {
+        "platforms": [
+          "flutter"
+        ],
+        "outcomes": [
+          "setup-sdk",
+          "setup-push",
+          "setup-live-data",
+          "add-feed",
+          "add-chat",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "flutter.setup.sync-initialization"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "readiness_gate",
+              "description": "Source evidence that setup waits for SDK service initialization or gates login/query until adapters are ready.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": [
+        "MessageDbAdapter not ready",
+        "service locator not ready",
+        "blank Flutter splash after setup"
+      ]
+    },
+    {
+      "id": "flutter.session.initial-login-kickoff",
+      "version": 1,
+      "title": "Flutter session observer must also kick off the initial login path",
+      "severity": "warning",
+      "rationale": "A Flutter screen that only calls login from an observeSessionState listener can stay forever on a signing-in/loading state if the observer does not emit the initial NotLoggedIn state in the captured runtime. Subscribe to session changes, but also seed/kick the current session path immediately after setup/subscription so login or post-login queries run.",
+      "applies_when": {
+        "platforms": [
+          "flutter"
+        ],
+        "outcomes": [
+          "setup-sdk",
+          "setup-live-data",
+          "add-feed",
+          "add-comments",
+          "add-chat",
+          "add-community",
+          "add-follow",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "flutter.session.initial-login-kickoff"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "initial_session_kickoff",
+              "description": "Source or runtime evidence that login/session-ready work is kicked off immediately as well as on later session-state changes.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": [
+        "Signing into team circles",
+        "Opening the clubhouse",
+        "logging in forever",
+        "session state never leaves NotLoggedIn"
+      ]
+    },
+    {
+      "id": "flutter.dependency.dio-compatible",
+      "version": 1,
+      "title": "Flutter Amity SDK 7.x must resolve a Dio version below 5.10.0",
+      "severity": "warning",
+      "rationale": "amity_sdk 7.x allows dio ^5.4.0, so a fresh pub resolution can select dio 5.10.0. dio 5.10.0 adds DioExceptionType.transformTimeout, which makes the SDK's DioExceptionType switch non-exhaustive and fails Android builds even when analyze/test pass.",
+      "applies_when": {
+        "platforms": [
+          "flutter"
+        ],
+        "outcomes": [
+          "setup-sdk",
+          "setup-live-data",
+          "add-feed",
+          "add-community",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "flutter.dependency.dio-compatible"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "pubspec_resolution",
+              "description": "pubspec.yaml/pubspec.lock evidence that dio resolves below 5.10.0, or SDK release notes proving the selected amity_sdk version no longer has this switch issue.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": [
+        "DioExceptionType.transformTimeout",
+        "The type 'DioExceptionType' is not exhaustively matched",
+        "Gradle task assembleDebug failed after resolving dio 5.10.0"
+      ]
+    },
     {
       "id": "flutter.login.present",
       "version": 1,
@@ -557,6 +694,272 @@
         }
       }
     },
+    {
+      "id": "react-native.dependency.async-storage",
+      "version": 1,
+      "title": "React Native SDK must include AsyncStorage native dependency",
+      "severity": "warning",
+      "rationale": "The React Native social.plus SDK uses AsyncStorage at runtime. React Native autolinking only includes native modules declared by the app, so a TypeScript/Gradle build can pass while the APK crashes with `NativeModule: AsyncStorage is null`.",
+      "applies_when": {
+        "platforms": [
+          "react-native"
+        ],
+        "outcomes": [
+          "setup-sdk",
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "react-native.dependency.async-storage"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "package_manifest",
+              "description": "package.json or package manager catalog showing @react-native-async-storage/async-storage as an app dependency.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "id": "react-native.dependency.async-storage-compatible",
+      "version": 1,
+      "title": "React Native SDK AsyncStorage dependency must be SDK-compatible",
+      "severity": "warning",
+      "rationale": "The React Native social.plus SDK 7.x depends on AsyncStorage v1.x. Installing the latest AsyncStorage 2.x/3.x can leave duplicate JS packages in node_modules; Gradle may still autolink a native package, but the SDK's nested JS copy can crash with `NativeModule: AsyncStorage is null`.",
+      "applies_when": {
+        "platforms": [
+          "react-native"
+        ],
+        "outcomes": [
+          "setup-sdk",
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "react-native.dependency.async-storage-compatible"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "package_manifest",
+              "description": "package.json or lockfile showing a single SDK-compatible AsyncStorage v1.x package.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "id": "react-native.dependency.netinfo",
+      "version": 1,
+      "title": "React Native SDK must include NetInfo native dependency",
+      "severity": "warning",
+      "rationale": "The React Native social.plus SDK imports @react-native-community/netinfo at runtime. React Native autolinking only includes native modules declared by the app, so TypeScript and Gradle can pass while the APK crashes with `@react-native-community/netinfo: NativeModule.RNCNetInfo is null`.",
+      "applies_when": {
+        "platforms": [
+          "react-native"
+        ],
+        "outcomes": [
+          "setup-sdk",
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "react-native.dependency.netinfo"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "package_manifest",
+              "description": "package.json or package manager catalog showing @react-native-community/netinfo as an app dependency.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "id": "react-native.client.session-state-after-create",
+      "version": 1,
+      "title": "React Native client session state reads must happen after client creation",
+      "severity": "warning",
+      "rationale": "React Native can execute module code and React state initializers before the social.plus client is created. Calling Client.isConnected() too early throws `Amity SDK (800000): There is no active client`, which TypeScript and Gradle builds do not catch.",
+      "applies_when": {
+        "platforms": [
+          "react-native"
+        ],
+        "outcomes": [
+          "setup-sdk",
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "react-native.client.session-state-after-create"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "readiness_guard",
+              "description": "Code evidence that Client.isConnected() is called only after createClient has run, or that a safe not-ready state is returned before setup.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "id": "react-native.sdk.no-internal-imports",
+      "version": 1,
+      "title": "React Native SDK imports must use public package exports",
+      "severity": "warning",
+      "rationale": "Deep-importing internal social.plus SDK files such as `dist/client/...` can pass TypeScript or Jest while Metro/release bundling fails because those paths are not public package exports.",
+      "applies_when": {
+        "platforms": [
+          "react-native"
+        ],
+        "outcomes": [
+          "setup-sdk",
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "react-native.sdk.no-internal-imports"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "import_source",
+              "description": "Public package-root import that replaces the internal SDK subpath.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "id": "typescript.client.session-state-after-create",
+      "version": 1,
+      "title": "TypeScript client session state reads must happen after client creation",
+      "severity": "warning",
+      "rationale": "Client.isConnected() requires an active social.plus client. Reading it from module scope or a startup state initializer before Client.createClient can throw at runtime even when the build passes.",
+      "applies_when": {
+        "platforms": [
+          "typescript"
+        ],
+        "outcomes": [
+          "setup-sdk",
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "typescript.client.session-state-after-create"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "readiness_guard",
+              "description": "Code evidence that Client.isConnected() is called only after createClient has run, or that a safe not-ready state is returned before setup.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "id": "typescript.sdk.no-internal-imports",
+      "version": 1,
+      "title": "TypeScript SDK imports must use public package exports",
+      "severity": "warning",
+      "rationale": "Deep-importing internal social.plus SDK files such as `dist/client/...` can pass a narrow type check while production bundlers fail because those paths are not public package exports.",
+      "applies_when": {
+        "platforms": [
+          "typescript"
+        ],
+        "outcomes": [
+          "setup-sdk",
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "typescript.sdk.no-internal-imports"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "import_source",
+              "description": "Public package-root import that replaces the internal SDK subpath.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    },
     {
       "id": "typescript.client.create",
       "version": 1,
@@ -1873,6 +2276,162 @@
           ]
         }
       }
+    },
+    {
+      "id": "typescript.sdk.source-used",
+      "version": 1,
+      "title": "TypeScript SDK dependency must be used by product source",
+      "severity": "warning",
+      "rationale": "Installing @amityco/ts-sdk is not an integration. The product source must import/use the SDK or UIKit provider, initialize/login, and query or create social.plus data.",
+      "applies_when": {
+        "platforms": ["typescript"],
+        "outcomes": ["setup-sdk", "setup-live-data", "add-feed", "add-comments", "add-chat", "add-community", "add-follow", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "typescript.sdk.source-used" }
+        ],
+        "attestation": {
+          "allowed": false,
+          "host_agent_min_confidence": "high",
+          "human_allowed": false,
+          "evidence_required": []
+        }
+      },
+      "symptoms": ["Dependency-only integration", "Static social shell", "No SDK-backed runtime data"]
+    },
+    {
+      "id": "react-native.sdk.source-used",
+      "version": 1,
+      "title": "React Native SDK dependency must be used by product source",
+      "severity": "warning",
+      "rationale": "Installing @amityco/ts-sdk-react-native is not an integration. The product source must import/use the SDK or UIKit provider, initialize/login, and query or create social.plus data.",
+      "applies_when": {
+        "platforms": ["react-native"],
+        "outcomes": ["setup-sdk", "setup-live-data", "add-feed", "add-comments", "add-chat", "add-community", "add-follow", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "react-native.sdk.source-used" }
+        ],
+        "attestation": {
+          "allowed": false,
+          "host_agent_min_confidence": "high",
+          "human_allowed": false,
+          "evidence_required": []
+        }
+      },
+      "symptoms": ["Dependency-only integration", "Static social shell", "No SDK-backed runtime data"]
+    },
+    {
+      "id": "react-native.ui.runtime-probe-copy",
+      "version": 1,
+      "title": "React Native product UI must not expose runtime probe copy",
+      "severity": "warning",
+      "rationale": "Runtime readiness belongs in evidence and handoff notes, not normal product UI. A visible Runtime/Probe/status panel can make a shallow SDK probe look like a finished integration while users still cannot use the actual social surface.",
+      "applies_when": {
+        "platforms": ["react-native"],
+        "outcomes": ["setup-sdk", "setup-live-data", "add-feed", "add-comments", "add-community", "add-follow", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "react-native.ui.runtime-probe-copy" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "product_ui_evidence",
+              "description": "Screenshot or source reference showing runtime proof moved to evidence/notes and the visible UI renders normal product social state.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": ["Visible Runtime panel", "Probe/status copy in product UI", "SDK readiness labels shown to end users"]
+    },
+    {
+      "id": "react-native.ui.hidden-sdk-noop-control",
+      "version": 1,
+      "title": "React Native SDK usage must not be hidden no-op UI",
+      "severity": "warning",
+      "rationale": "Hidden controls and `void Repository` markers can satisfy naive source scanners without giving users a real reaction/comment/post/report/follow affordance. The visible product UI should call the SDK through meaningful controls.",
+      "applies_when": {
+        "platforms": ["react-native"],
+        "outcomes": ["setup-sdk", "setup-live-data", "add-feed", "add-comments", "add-community", "add-follow", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "react-native.ui.hidden-sdk-noop-control" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "visible_affordance",
+              "description": "Source or screenshot evidence showing the SDK action is wired to a visible product control.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": ["Hidden reaction control", "void Repository marker", "Scanner-only SDK usage"]
+    },
+    {
+      "id": "flutter.sdk.source-used",
+      "version": 1,
+      "title": "Flutter SDK dependency must be used by product source",
+      "severity": "warning",
+      "rationale": "Installing amity_sdk is not an integration. The product source must import/use the SDK or UIKit manager, initialize/login, and query or create social.plus data.",
+      "applies_when": {
+        "platforms": ["flutter"],
+        "outcomes": ["setup-sdk", "setup-live-data", "add-feed", "add-comments", "add-chat", "add-community", "add-follow", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "flutter.sdk.source-used" }
+        ],
+        "attestation": {
+          "allowed": false,
+          "host_agent_min_confidence": "high",
+          "human_allowed": false,
+          "evidence_required": []
+        }
+      },
+      "symptoms": ["Dependency-only integration", "Static social shell", "No SDK-backed runtime data"]
+    },
+    {
+      "id": "flutter.ui.sdk-data-rendered",
+      "version": 1,
+      "title": "Flutter SDK data must be consumed by visible product UI",
+      "severity": "warning",
+      "rationale": "A Flutter screen can query social.plus data into state but still return the original product screen, making the SDK usage a hidden no-op. Runtime proof requires SDK-returned communities, posts, comments, or users to affect visible product UI or a rendered child widget.",
+      "applies_when": {
+        "platforms": ["flutter"],
+        "outcomes": ["setup-sdk", "setup-live-data", "add-feed", "add-comments", "add-chat", "add-community", "add-follow", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "flutter.ui.sdk-data-rendered" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "visible_data_binding",
+              "description": "Source or screenshot evidence showing SDK-returned data is rendered in the product UI or passed into a rendered child widget.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": ["SDK query result stored but never rendered", "Hidden SDK probe", "Original screen returned after SDK setup"]
     }
   ]
 }

package/rules/search.yaml

@@ -5,6 +5,7 @@
     {
       "id": "typescript.search.live-collection",
       "version": 1,
+      "symbol_anchored": { "platform": "typescript", "types": ["UserRepository"], "members": ["searchUserByDisplayName"], "basis": "names-only" },
       "title": "TypeScript search results should use the reactive, paginated Search LiveCollection",
       "severity": "warning",
       "rationale": "Search results are paginated Live Collections. A one-shot search (no callback) renders only the first page and never updates. Pass the live callback: searchUserByDisplayName(params, callback) / searchCommunities(params, callback).",
@@ -30,6 +31,7 @@
     {
       "id": "react-native.search.live-collection",
       "version": 1,
+      "symbol_anchored": { "platform": "react-native", "types": ["UserRepository"], "members": ["searchUserByDisplayName"], "basis": "names-only" },
       "title": "React Native search results should use the reactive, paginated Search LiveCollection",
       "severity": "warning",
       "rationale": "Search results are paginated Live Collections. A one-shot search (no callback) renders only the first page and never updates. Pass the live callback: searchUserByDisplayName(params, callback) / searchCommunities(params, callback).",
@@ -55,6 +57,7 @@
     {
       "id": "android.search.live-collection",
       "version": 1,
+      "symbol_anchored": { "platform": "android", "types": ["AmityUserRepository"], "members": ["searchUsers"], "basis": "names-only" },
       "title": "Android search results should use the reactive, paginated Search LiveCollection",
       "severity": "warning",
       "rationale": "Search results are paginated Live Collections. A one-shot fetch renders only the first page and never updates. Observe the PagingData stream instead: searchUsers(...).query().doOnNext { _: PagingData -> }.subscribe().",
@@ -80,6 +83,7 @@
     {
       "id": "ios.search.live-collection",
       "version": 1,
+      "symbol_anchored": { "platform": "ios", "types": ["AmityUserRepository"], "members": ["searchUsers"], "basis": "names-only" },
       "title": "iOS search results should use the reactive, paginated Search LiveCollection",
       "severity": "warning",
       "rationale": "Search results are paginated Live Collections. A one-shot fetch renders only the first page and never updates. Observe the collection instead: searchUsers(...).observe { ... }.",
@@ -105,6 +109,7 @@
     {
       "id": "flutter.search.live-collection",
       "version": 1,
+      "symbol_anchored": { "platform": "flutter", "types": ["UserRepository"], "members": ["searchUserByDisplayName"], "basis": "names-only" },
       "title": "Flutter search results should use the reactive, paginated Search LiveCollection",
       "severity": "warning",
       "rationale": "Search results are paginated Live Collections. A one-shot fetch renders only the first page and never updates. Wire a PagingController: PagingController(pageFuture: (token) => searchUserByDisplayName(kw).getPagingData(token: token, limit: 20)).",

package/rules/security.yaml

@@ -14,6 +14,18 @@
         "attestation": { "allowed": false, "host_agent_min_confidence": "high", "human_allowed": false, "evidence_required": [] }
       }
     },
+    {
+      "id": "typescript.security.no-unsafe-inner-html",
+      "version": 1,
+      "title": "TypeScript SDK/user content must not be rendered through raw HTML sinks",
+      "severity": "warning",
+      "rationale": "SDK and user-authored text can contain attacker-controlled markup. Rendering it through innerHTML, insertAdjacentHTML, or dangerouslySetInnerHTML creates an XSS surface; use text nodes or sanitize first.",
+      "applies_when": { "platforms": ["typescript"], "outcomes": ["setup-sdk", "setup-live-data", "add-feed", "add-comments", "add-chat", "add-community", "add-follow", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.security.no-unsafe-inner-html" }],
+        "attestation": { "allowed": false, "host_agent_min_confidence": "high", "human_allowed": false, "evidence_required": [] }
+      }
+    },
     {
       "id": "react-native.secret.inline-api-key",
       "version": 1,