@brighterly/lib-fe-codestyle 0.4.1 → 0.5.1

package/dist/invariants/util.d.ts

@@ -4,7 +4,7 @@
  *
  * No dependencies — this runs in pre-commit, so it must not need an install.
  */
-import type { DanglingRefInput, Finding, Level, Levels } from './types.js';
+import type { DanglingRefInput, Finding, Level, Levels, MetaRuleId } from './types.js';
 /**
  * Minimal glob → RegExp. Supports `**`, `*`, `?` and `{a,b}`.
  * Deliberately not a full glob implementation: rule scopes are simple by
@@ -37,14 +37,22 @@ export declare const parseIgnores: (source: string) => {
     }[];
 };
 /**
- * Blank out comment bodies while preserving every line number and offset, so a
- * rule that greps for an identifier does not fire on prose. Handles `//`,
- * block comments and HTML comments.
+ * Blanks comment bodies in place: every line and every non-comment character stays where it was,
+ * so line numbers and offsets survive. Two grammars:
  *
- * Known limitation: a `//` inside a string literal (a URL) blanks the rest of
- * that line. Harmless for identifier scans; do not use this for parsing.
+ * - script (TS/JS/JSON): a tokenizer that knows string literals, template literals with `${}`
+ *   nesting and regex literals, so `'…/**'` in a glob or `'http://'` in a URL opens nothing. The
+ *   regex version this replaces turned the first such glob in a rule file into an open block
+ *   comment and hid the rest of the file from every rule that reads `code` (land-app, 2026-09-23);
+ * - the template part of a .vue file: HTML comments only — a script tokenizer over prose would take
+ *   "child's" as an open string. Script blocks inside the SFC get the script grammar.
+ *
+ * Markdown and HTML get HTML comments only; no rule reads code out of them. The regex-vs-division
+ * call for `/` is the usual heuristic (what precedes it); a regex right after `)` reads as division,
+ * which leaves its body unparsed — never blanked, so the failure mode is a missed comment, not
+ * hidden code.
  */
-export declare const stripCodeComments: (source: string) => string;
+export declare const stripCodeComments: (source: string, file?: string) => string;
 /** Line number (1-based) of a character offset. */
 export declare const lineOf: (source: string, index: number) => number;
 /**
@@ -67,6 +75,17 @@ export declare const stringKeysOf: (literal: string) => Set<string>;
  * self-test can exercise it without touching the repo.
  */
 export declare const findDanglingRuleRefs: (input: DanglingRefInput) => Finding[];
+/**
+ * `invariant-ignore` comments that name a rule declared `noIgnore` (IG2). The
+ * runner never honours such a comment; reporting it makes the attempt visible so a
+ * reviewer sees the intent and an AI author learns the rule cannot be argued with
+ * in the file under check.
+ */
+export declare const findForbiddenSuppressions: (ignores: {
+    file: string;
+    line: number;
+    ids: string[];
+}[], noIgnoreIds: Set<string>) => Finding[];
 /**
  * Severity of one finding, from three inputs that used to be one.
  *
@@ -101,7 +120,7 @@ export declare const knownRuleIds: (parts: {
     fileScan: string[];
     specs: string[];
     linter: string[];
-    meta?: string[];
+    meta?: MetaRuleId[];
 }) => Set<string>;
 /**
  * The severity override for a rule, or undefined.
@@ -111,3 +130,9 @@ export declare const knownRuleIds: (parts: {
  * accessor keeps every caller from having to care.
  */
 export declare const levelOverrideOf: (levels: Levels, id: string) => Level | undefined;
+/**
+ * The `until YYYY-MM-DD` an allowlist reason may carry. A rule may require one — a coverage gap is
+ * a debt with a date, not a permanent exemption — and report the entry once the date has passed.
+ * ISO dates compare as strings, so the caller needs no Date arithmetic.
+ */
+export declare const exemptionExpiry: (reason: string) => string | null;

package/dist/invariants/util.js

@@ -135,19 +135,166 @@ export const parseIgnores = (source) => {
     return { suppressions, unreasoned, comments };
 };
 /**
- * Blank out comment bodies while preserving every line number and offset, so a
- * rule that greps for an identifier does not fire on prose. Handles `//`,
- * block comments and HTML comments.
+ * Blanks comment bodies in place: every line and every non-comment character stays where it was,
+ * so line numbers and offsets survive. Two grammars:
  *
- * Known limitation: a `//` inside a string literal (a URL) blanks the rest of
- * that line. Harmless for identifier scans; do not use this for parsing.
+ * - script (TS/JS/JSON): a tokenizer that knows string literals, template literals with `${}`
+ *   nesting and regex literals, so `'…/**'` in a glob or `'http://'` in a URL opens nothing. The
+ *   regex version this replaces turned the first such glob in a rule file into an open block
+ *   comment and hid the rest of the file from every rule that reads `code` (land-app, 2026-09-23);
+ * - the template part of a .vue file: HTML comments only — a script tokenizer over prose would take
+ *   "child's" as an open string. Script blocks inside the SFC get the script grammar.
+ *
+ * Markdown and HTML get HTML comments only; no rule reads code out of them. The regex-vs-division
+ * call for `/` is the usual heuristic (what precedes it); a regex right after `)` reads as division,
+ * which leaves its body unparsed — never blanked, so the failure mode is a missed comment, not
+ * hidden code.
  */
-export const stripCodeComments = (source) => {
-    const blank = (m) => m.replace(/[^\n]/g, ' ');
-    return source
-        .replace(/<!--[\s\S]*?-->/g, blank)
-        .replace(/\/\*[\s\S]*?\*\//g, blank)
-        .replace(/(^|[^:])\/\/[^\n]*/g, (m, pre) => pre + blank(m.slice(pre.length)));
+export const stripCodeComments = (source, file = '') => {
+    if (/\.vue$/.test(file) || (file === '' && /<template[\s>]/.test(source) && /<script[\s>]/.test(source)))
+        return stripSfc(source);
+    if (/\.(?:md|html)$/.test(file))
+        return blankHtmlComments(source);
+    return stripScript(source);
+};
+const blankRun = (text) => text.replace(/[^\n]/g, ' ');
+const blankHtmlComments = (source) => source.replace(/<!--[\s\S]*?-->/g, blankRun);
+const stripSfc = (source) => {
+    let out = '';
+    let last = 0;
+    const re = /<script\b[^>]*>([\s\S]*?)<\/script>/g;
+    let m;
+    while ((m = re.exec(source)) !== null) {
+        const body = m[1] ?? '';
+        const bodyStart = m.index + m[0].length - body.length - '</script>'.length;
+        out += blankHtmlComments(source.slice(last, bodyStart));
+        out += stripScript(body);
+        last = bodyStart + body.length;
+    }
+    return out + blankHtmlComments(source.slice(last));
+};
+/** After one of these a `/` starts a regex literal, not a division. */
+const REGEX_PRECEDER = /[(,=:[!&|?{};+\-*%<>~^]$/;
+const REGEX_KEYWORD = /(?:^|[^\w$])(?:return|typeof|case|do|else|in|instanceof|new|throw|void|yield|await|delete)$/;
+const stripScript = (code) => {
+    const out = code.split('');
+    const n = code.length;
+    const blankAt = (i) => {
+        if (out[i] !== '\n')
+            out[i] = ' ';
+    };
+    const regexAllowed = (i) => {
+        let j = i - 1;
+        while (j >= 0 && /\s/.test(out[j] ?? ''))
+            j--;
+        if (j < 0)
+            return true;
+        const before = out.slice(Math.max(0, j - 12), j + 1).join('');
+        return REGEX_PRECEDER.test(before) || REGEX_KEYWORD.test(before);
+    };
+    const skipString = (start, quote) => {
+        let i = start + 1;
+        while (i < n && code[i] !== quote && code[i] !== '\n') {
+            if (code[i] === '\\')
+                i++;
+            i++;
+        }
+        return i + 1;
+    };
+    const skipRegex = (start) => {
+        let i = start + 1;
+        let inClass = false;
+        while (i < n && code[i] !== '\n') {
+            const ch = code[i];
+            if (ch === '\\') {
+                i += 2;
+                continue;
+            }
+            if (ch === '[')
+                inClass = true;
+            else if (ch === ']')
+                inClass = false;
+            else if (ch === '/' && !inClass) {
+                i++;
+                break;
+            }
+            i++;
+        }
+        while (i < n && /[a-z]/i.test(code[i] ?? ''))
+            i++;
+        return i;
+    };
+    // Returns the index it stopped at: `n`, or the `}` that closes a `${` when `untilBrace` is set.
+    const scan = (start, untilBrace) => {
+        let i = start;
+        let depth = 0;
+        while (i < n) {
+            const c = code[i];
+            const next = code[i + 1];
+            if (c === '"' || c === '\'') {
+                i = skipString(i, c);
+                continue;
+            }
+            if (c === '`') {
+                i = skipTemplate(i);
+                continue;
+            }
+            if (c === '/' && next === '/') {
+                while (i < n && code[i] !== '\n') {
+                    blankAt(i);
+                    i++;
+                }
+                continue;
+            }
+            if (c === '/' && next === '*') {
+                blankAt(i);
+                blankAt(i + 1);
+                i += 2;
+                while (i < n && !(code[i] === '*' && code[i + 1] === '/')) {
+                    blankAt(i);
+                    i++;
+                }
+                if (i < n) {
+                    blankAt(i);
+                    blankAt(i + 1);
+                    i += 2;
+                }
+                continue;
+            }
+            if (c === '/' && regexAllowed(i)) {
+                i = skipRegex(i);
+                continue;
+            }
+            if (untilBrace) {
+                if (c === '{')
+                    depth++;
+                else if (c === '}') {
+                    if (depth === 0)
+                        return i;
+                    depth--;
+                }
+            }
+            i++;
+        }
+        return i;
+    };
+    const skipTemplate = (start) => {
+        let i = start + 1;
+        while (i < n && code[i] !== '`') {
+            if (code[i] === '\\') {
+                i += 2;
+                continue;
+            }
+            if (code[i] === '$' && code[i + 1] === '{') {
+                i = scan(i + 2, true) + 1;
+                continue;
+            }
+            i++;
+        }
+        return i + 1;
+    };
+    scan(0, false);
+    return out.join('');
 };
 /** Line number (1-based) of a character offset. */
 export const lineOf = (source, index) => source.slice(0, index).split('\n').length;
@@ -238,6 +385,17 @@ export const findDanglingRuleRefs = (input) => {
     }
     return out;
 };
+/**
+ * `invariant-ignore` comments that name a rule declared `noIgnore` (IG2). The
+ * runner never honours such a comment; reporting it makes the attempt visible so a
+ * reviewer sees the intent and an AI author learns the rule cannot be argued with
+ * in the file under check.
+ */
+export const findForbiddenSuppressions = (ignores, noIgnoreIds) => ignores.flatMap(({ file, line, ids }) => ids.filter(id => noIgnoreIds.has(id)).map(id => ({
+    file,
+    line,
+    message: `invariant-ignore names "${id}", a noIgnore rule — this suppression is inert and the attempt is reported`,
+})));
 const LEVEL_RANK = { off: 0, warn: 1, error: 2 };
 /**
  * Severity of one finding, from three inputs that used to be one.
@@ -284,3 +442,9 @@ export const knownRuleIds = (parts) => new Set([...parts.fileScan, ...parts.spec
  * accessor keeps every caller from having to care.
  */
 export const levelOverrideOf = (levels, id) => levels[id]?.level;
+/**
+ * The `until YYYY-MM-DD` an allowlist reason may carry. A rule may require one — a coverage gap is
+ * a debt with a date, not a permanent exemption — and report the entry once the date has passed.
+ * ISO dates compare as strings, so the caller needs no Date arithmetic.
+ */
+export const exemptionExpiry = (reason) => reason.match(/\buntil\s+(\d{4}-\d{2}-\d{2})\b/)?.[1] ?? null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brighterly/lib-fe-codestyle",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "type": "module",
   "license": "UNLICENSED",
   "description": "Shared invariant-validator engine, rule pack and ESLint config for Brighterly Nuxt frontend apps",