@colixsystems/widget-sdk 0.86.0 → 0.88.0

package/dist/hooks.js

@@ -941,11 +941,29 @@ export function useGeolocation(options) {
  * error message, populated when the datastore returned a structured
  * 400/422 payload with `errors: [{ field, code }, ...]`.
  */
+// sc-4986 — the datastore refusals retrying the same call can never clear.
+// The default for a hand-constructed error; the mappers pass the status-derived
+// answer explicitly (see isRetryableDomainStatus).
+const NON_RETRYABLE_DATASTORE_CODES = new Set([
+  "CONSTRAINT_VIOLATION",
+  "FORBIDDEN",
+  "NOT_FOUND",
+  "VALIDATION",
+]);
+
 export class DatastoreError extends Error {
   constructor(code, message, opts) {
     super(message);
     this.name = "DatastoreError";
     this.code = code;
+    // sc-4986 — the HTTP status behind the code, when there was one. null for a
+    // transport failure or a locally-raised wiring error.
+    this.status =
+      opts && typeof opts.status === "number" ? opts.status : null;
+    this.retryable =
+      opts && opts.retryable !== undefined
+        ? Boolean(opts.retryable)
+        : !NON_RETRYABLE_DATASTORE_CODES.has(code);
     if (opts && opts.fieldErrors && typeof opts.fieldErrors === "object") {
       this.fieldErrors = opts.fieldErrors;
     }
@@ -960,50 +978,113 @@ export class DatastoreError extends Error {
  * a DatastoreError with a stable `.code`. Reads `error.response.status` if
  * present (axios shape) and falls back to inspecting the message string.
  */
+/* ===========================================================================
+ * sc-4986 — reading a refusal's real reason off a rejected domain-client call
+ * ==========================================================================*/
+
+/**
+ * The one envelope read the three data-domain mappers share.
+ *
+ * A rejected call arrives in one of TWO shapes and both have to be read, which
+ * is the whole bug this exists to fix:
+ *
+ *   - the `@colixsystems/*-client` packages throw their own typed errors
+ *     (`ForbiddenError`, `ValidationError`, …) carrying `.code` / `.status` /
+ *     `.details` — the parsed envelope — and **no `.response`**;
+ *   - the older host path throws an axios-shaped error with `.response`.
+ *
+ * Reading only `.response` (what these mappers used to do) meant every typed
+ * client rejection fell through every branch and became `INTERNAL`, so a 403
+ * was indistinguishable from a dropped socket.
+ *
+ * `status` is the signal the code is derived from, never the client's own
+ * `.code`: an axios transport failure carries `code: "ECONNABORTED"`, which is
+ * not a domain code and must never be mistaken for one. The typed client errors
+ * always set a numeric `.status`, and axios keeps its status on `.response`, so
+ * the two reads together cover both shapes.
+ */
+function readDomainErrorEnvelope(err) {
+  const response = (err && err.response) || null;
+  const body = (response && response.data) || (err && err.details) || null;
+  const status =
+    response && typeof response.status === "number"
+      ? response.status
+      : err && typeof err.status === "number" && err.status
+        ? err.status
+        : null;
+  // `message` is the canonical envelope's field (REQ-GEN-05, errorResponse.ts
+  // emits `{ statusCode, message, ...extras }`); `error` is the ad-hoc key a
+  // few older surfaces still emit. The envelope has never carried BOTH.
+  const envelopeMessage = body && (body.message || body.error);
+  return {
+    status,
+    code: body && typeof body.code === "string" && body.code ? body.code : null,
+    message: typeof envelopeMessage === "string" ? envelopeMessage : null,
+    fieldErrors: readEnvelopeFieldErrors(body),
+  };
+}
+
+/**
+ * A flat `field -> message` map from an envelope's `errors: [{ field, code,
+ * message }]` array (the shape `errorResponse(res, 4xx, msg, { errors })`
+ * emits). Returns undefined when the body carries none, so the caller can leave
+ * the property off the error entirely.
+ */
+function readEnvelopeFieldErrors(body) {
+  if (!body || !Array.isArray(body.errors)) return undefined;
+  const map = {};
+  for (const entry of body.errors) {
+    if (entry && typeof entry.field === "string") {
+      map[entry.field] = entry.message || entry.code || "Invalid value";
+    }
+  }
+  return Object.keys(map).length > 0 ? map : undefined;
+}
+
+/**
+ * Whether retrying the SAME data call could plausibly succeed.
+ *
+ * A timeout, a rate limit, a 5xx or a dropped socket is worth another attempt;
+ * a refusal (403), a missing row (404), a bad body (400/422) or a conflict
+ * (409) never clears until the caller, the record or the workspace changes.
+ * An absent status is a transport failure, so it counts as transient.
+ *
+ * Deliberately NOT shared with `NON_RETRYABLE_PAYMENT_CODES`: a payment's 402
+ * DECLINED IS worth another attempt with a different card, so the payments
+ * contract genuinely differs here (CLAUDE.md §3 — the divergence is the point,
+ * not an accident).
+ */
+function isRetryableDomainStatus(status) {
+  if (status === null) return true;
+  if (status === 408 || status === 429) return true;
+  return status >= 500;
+}
+
 function toDatastoreError(err) {
+  // An already-mapped SDK error passes straight through. NOTE: the datastore
+  // CLIENT exports its own class of the same name, so a client rejection does
+  // NOT match here — it is handled by the envelope read below, which is exactly
+  // what used to be missing (sc-4986).
   if (err instanceof DatastoreError) return err;
-  const status =
-    err && err.response && typeof err.response.status === "number"
-      ? err.response.status
-      : null;
-  const bodyMessage =
-    err &&
-    err.response &&
-    err.response.data &&
-    typeof err.response.data.error === "string"
-      ? err.response.data.error
-      : null;
-  const fallbackMessage =
-    bodyMessage ||
-    (err && typeof err.message === "string"
-      ? err.message
-      : "Datastore call failed");
+  const { status, message, fieldErrors } = readDomainErrorEnvelope(err);
   let code = "INTERNAL";
   if (status === 400 || status === 422) code = "VALIDATION";
   else if (status === 409) code = "CONSTRAINT_VIOLATION";
   else if (status === 403) code = "FORBIDDEN";
   else if (status === 404) code = "NOT_FOUND";
-  // Surface a structured fieldErrors map when the server emitted one
-  // (record.controller.js shapes 422 bodies as `{ errors: [{ field, code }] }`).
-  let fieldErrors;
-  if (
-    err &&
-    err.response &&
-    err.response.data &&
-    Array.isArray(err.response.data.errors)
-  ) {
-    const map = {};
-    for (const entry of err.response.data.errors) {
-      if (entry && typeof entry.field === "string") {
-        map[entry.field] = entry.message || entry.code || "Invalid value";
-      }
-    }
-    if (Object.keys(map).length > 0) fieldErrors = map;
-  }
-  return new DatastoreError(code, fallbackMessage, {
-    cause: err,
-    fieldErrors,
-  });
+  return new DatastoreError(
+    code,
+    message ||
+      (err && typeof err.message === "string"
+        ? err.message
+        : "Datastore call failed"),
+    {
+      cause: err,
+      status,
+      retryable: isRetryableDomainStatus(status),
+      fieldErrors,
+    },
+  );
 }
 
 // sc-1579 — consecutive renders with a different serialized query before
@@ -1422,43 +1503,54 @@ export function useDatastoreMutation(table) {
  *   - "CONFLICT"   — 409 (e.g. trying to edit a template-derived row).
  *   - "INTERNAL"   — anything else (network, 5xx).
  */
+// sc-4986 — the permission refusals retrying the same call can never clear.
+// This mapper's code set is OPEN (the server's own code wins), so the status is
+// the primary signal and this set only backstops a hand-constructed error.
+const NON_RETRYABLE_PERMISSION_CODES = new Set([
+  "CONFLICT",
+  "FORBIDDEN",
+  "NOT_FOUND",
+  "TEMPLATE_DERIVED",
+  "VALIDATION",
+]);
+
 export class PermissionError extends Error {
   constructor(code, message, opts) {
     super(message);
     this.name = "PermissionError";
     this.code = code;
     if (opts && opts.status !== undefined) this.status = opts.status;
+    // sc-4986 — lets a widget tell "this will never work" from "try again".
+    this.retryable =
+      opts && opts.retryable !== undefined
+        ? Boolean(opts.retryable)
+        : !NON_RETRYABLE_PERMISSION_CODES.has(code);
     if (opts && opts.cause) this.cause = opts.cause;
   }
 }
 
 function toPermissionError(err) {
+  // See the note in toDatastoreError — a client rejection is read from the
+  // envelope below rather than matching this instanceof.
   if (err instanceof PermissionError) return err;
-  const status =
-    err && err.response && typeof err.response.status === "number"
-      ? err.response.status
-      : null;
-  const bodyCode =
-    err && err.response && err.response.data && err.response.data.code;
-  const bodyMessage =
-    err && err.response && err.response.data && err.response.data.error;
+  const { status, code: envelopeCode, message } = readDomainErrorEnvelope(err);
   let code = "INTERNAL";
   if (status === 403) code = "FORBIDDEN";
   else if (status === 404) code = "NOT_FOUND";
   else if (status === 409) code = "CONFLICT";
   else if (status === 400 || status === 422) code = "VALIDATION";
-  if (typeof bodyCode === "string" && bodyCode) {
-    // Preserve the server's stable code over the status-derived one when
-    // the server volunteered it (e.g. TEMPLATE_DERIVED on edit/delete of
-    // an inherit/template row).
-    code = bodyCode;
-  }
-  const message =
-    (typeof bodyMessage === "string" && bodyMessage) ||
-    (err && typeof err.message === "string"
-      ? err.message
-      : "Record permission call failed");
-  return new PermissionError(code, message, { status, cause: err });
+  // Preserve the server's stable code over the status-derived one when the
+  // server volunteered it (e.g. TEMPLATE_DERIVED on edit/delete of an
+  // inherit/template row) — this mapper's documented code set is open.
+  if (envelopeCode) code = envelopeCode;
+  return new PermissionError(
+    code,
+    message ||
+      (err && typeof err.message === "string"
+        ? err.message
+        : "Record permission call failed"),
+    { cause: err, status, retryable: isRetryableDomainStatus(status) },
+  );
 }
 
 const _NOOP_PERMISSIONS_RESULT = Object.freeze({
@@ -2727,41 +2819,53 @@ export function useFolderPermissions(folderId, options = {}) {
  *                     is invite-only and the email is not on the list.
  *   - "INTERNAL"    — anything else (network, 5xx).
  */
+// sc-4986 — the directory refusals retrying the same call can never clear.
+const NON_RETRYABLE_DIRECTORY_CODES = new Set([
+  "FORBIDDEN",
+  "INVITE_ONLY",
+  "NOT_FOUND",
+  "VALIDATION",
+]);
+
 export class DirectoryError extends Error {
   constructor(code, message, opts) {
     super(message);
     this.name = "DirectoryError";
     this.code = code;
+    // sc-4986 — the HTTP status behind the code, when there was one.
+    this.status =
+      opts && typeof opts.status === "number" ? opts.status : null;
+    this.retryable =
+      opts && opts.retryable !== undefined
+        ? Boolean(opts.retryable)
+        : !NON_RETRYABLE_DIRECTORY_CODES.has(code);
     if (opts && opts.cause) this.cause = opts.cause;
   }
 }
 
 function toDirectoryError(err) {
+  // See the note in toDatastoreError: the directory CLIENT has a same-named
+  // class, so a client rejection is read from the envelope below, not here.
   if (err instanceof DirectoryError) return err;
-  const status =
-    err && err.response && typeof err.response.status === "number"
-      ? err.response.status
-      : null;
-  const bodyCode =
-    err && err.response && err.response.data && err.response.data.code;
-  const bodyMessage =
-    err && err.response && err.response.data && err.response.data.error;
+  const { status, code: envelopeCode, message } = readDomainErrorEnvelope(err);
   let code = "INTERNAL";
-  if (bodyCode === "INVITE_ONLY") code = "INVITE_ONLY";
+  if (envelopeCode === "INVITE_ONLY") code = "INVITE_ONLY";
   else if (status === 403) code = "FORBIDDEN";
   else if (status === 404) code = "NOT_FOUND";
   else if (status === 400 || status === 422) code = "VALIDATION";
   else if (status === 409) {
     // 409 is invite-only on the invite endpoints; treat the rest as
     // validation conflicts (duplicate email, etc.).
-    code = bodyCode === "INVITE_ONLY" ? "INVITE_ONLY" : "VALIDATION";
+    code = envelopeCode === "INVITE_ONLY" ? "INVITE_ONLY" : "VALIDATION";
   }
-  const message =
-    (typeof bodyMessage === "string" && bodyMessage) ||
-    (err && typeof err.message === "string"
-      ? err.message
-      : "Directory call failed");
-  return new DirectoryError(code, message, { cause: err });
+  return new DirectoryError(
+    code,
+    message ||
+      (err && typeof err.message === "string"
+        ? err.message
+        : "Directory call failed"),
+    { cause: err, status, retryable: isRetryableDomainStatus(status) },
+  );
 }
 
 /**

package/dist/host.d.ts

@@ -25,6 +25,12 @@ export type ThemeComponentStyle = Record<
 >;
 export type ThemeComponents = Record<string, ThemeComponentStyle>;
 
+// REQ-THEME-ELEMENT: app-wide style values keyed by widget MANIFEST ID, then by
+// that widget's own styleSchema field name. Values are structural (the
+// authoritative type is the widget's own schema), so this mirrors
+// ThemeComponentStyle rather than naming a closed vocabulary.
+export type ThemeWidgetStyles = Record<string, ThemeComponentStyle>;
+
 /**
  * REQ-THEME-15 host helper: validates a raw `themeConfig.components` blob down
  * to `CONTRACT.themeComponents` — unknown scopes/tokens and malformed values are
@@ -33,6 +39,14 @@ export type ThemeComponents = Record<string, ThemeComponentStyle>;
  */
 export function normaliseThemeComponents(raw: unknown): ThemeComponents;
 
+/**
+ * REQ-THEME-ELEMENT host helper: validates a raw `themeConfig.widgetStyles` blob.
+ * Structural only — the key space is the workspace's widget catalog, not the
+ * contract, so the authoritative field type is the widget's own styleSchema.
+ * Bounded by `CONTRACT.themeWidgetStyles`.
+ */
+export function normaliseWidgetStyles(raw: unknown): ThemeWidgetStyles;
+
 /**
  * REQ-THEME-15 host render-boundary helper: folds the theme's per-component
  * tokens into a widget's props as `style` DEFAULTS, with the author's
@@ -41,6 +55,81 @@ export function normaliseThemeComponents(raw: unknown): ThemeComponents;
  */
 export function applyThemeComponentStyle<T = Record<string, unknown>>(
   manifestId: string,
-  theme: { components?: ThemeComponents } | null | undefined,
+  theme:
+    | { components?: ThemeComponents; widgetStyles?: ThemeWidgetStyles }
+    | null
+    | undefined,
   props: T,
+  styleSchema?: Record<string, unknown> | null,
 ): T;
+
+// sc-4939 — the host half of `useToast()`. A widget only ever calls the hook;
+// these are what a platform host puts behind `WidgetContext.toast`.
+
+export type ToastKind = "success" | "error" | "warning" | "info";
+
+export interface ToastPayload {
+  kind?: ToastKind | string;
+  message?: string;
+}
+
+export interface HostToast {
+  id: string;
+  kind: ToastKind;
+  message: string;
+}
+
+/** Resolved values a host paints one toast with. `elevation` is the React
+ *  Native style object; `boxShadow` is the CSS string derived from it. */
+export interface ToastTokens {
+  kind: ToastKind;
+  accent: string;
+  surface: string;
+  text: string;
+  border: string;
+  radius: number;
+  padding: number;
+  gap: number;
+  stackGap: number;
+  accentBarWidth: number;
+  fontFamily?: string;
+  fontSize: number;
+  elevation: Record<string, unknown>;
+  boxShadow: string;
+}
+
+export interface ToastController {
+  /** Enqueue a toast. Returns its id, or null when the message is empty. */
+  show(payload: ToastPayload): string | null;
+  dismiss(id: string): void;
+  getToasts(): HostToast[];
+  /** Subscribe to the queue; returns an unsubscribe function. */
+  subscribe(listener: (toasts: HostToast[]) => void): () => void;
+  /** Clear every pending timer and listener. */
+  destroy(): void;
+}
+
+export interface ToastControllerOptions {
+  durationMs?: number;
+  maxVisible?: number;
+  setTimer?: (fn: () => void, ms: number) => unknown;
+  clearTimer?: (handle: unknown) => void;
+}
+
+export const TOAST_DEFAULTS: { durationMs: number; maxVisible: number };
+
+export function normalizeToastKind(kind: unknown): ToastKind;
+
+export function resolveToastTokens(
+  theme: unknown,
+  kind: ToastKind | string,
+): ToastTokens;
+
+/**
+ * The host-side toast queue: newest-first stacking capped at `maxVisible`,
+ * auto-dismiss after `durationMs`, injectable timers. Shared by the web Player
+ * and the compiler's native WidgetHost so the two cannot drift.
+ */
+export function createToastController(
+  opts?: ToastControllerOptions,
+): ToastController;

package/dist/host.js

@@ -18,5 +18,24 @@ export { resolveProps } from "./property-schema.js";
 // hosts, so the Player and the Expo export cannot diverge.
 export {
   normaliseThemeComponents,
+  normaliseWidgetStyles,
   applyThemeComponentStyle,
 } from "./theme-components.js";
+
+// REQ-THEME-SURFACE: the surface-token derivation both hosts apply per painted
+// surface — the page background and every container that carries its own fill.
+// Host plumbing, deliberately off the author entry point: a widget reads the
+// already-correct `useTheme().colors`, it never derives them itself.
+export { deriveSurfaceTokens } from "./contract.js";
+
+// REQ-WSDK-PLATFORM §6: the host half of `useToast()` — the queue, the
+// auto-dismiss timing, and the themed values a toast is painted with. The
+// widget-facing hook only forwards to `ctx.toast.showToast`; the host owns the
+// surface, and sharing everything but the JSX is what keeps the web Player and
+// the Expo export rendering the same notification (CLAUDE.md §8).
+export {
+  createToastController,
+  resolveToastTokens,
+  normalizeToastKind,
+  TOAST_DEFAULTS,
+} from "./toast-host.js";

package/dist/index.d.ts

@@ -1275,11 +1275,22 @@ export class DatastoreError extends Error {
     | "NOT_FOUND"
     | "INTERNAL";
   fieldErrors?: Record<string, string>;
+  /** sc-4986 — the HTTP status behind the code; null for a transport failure. */
+  status: number | null;
+  /**
+   * sc-4986 — whether retrying the SAME call could plausibly succeed. False
+   * for a refusal only the caller, the record or the workspace can clear
+   * (403/404/400/422/409); true for a timeout, a rate limit, a 5xx or a
+   * dropped socket. Branch on this instead of offering a blanket retry.
+   */
+  retryable: boolean;
   constructor(
     code: DatastoreError["code"],
     message: string,
     opts?: {
       fieldErrors?: Record<string, string>;
+      status?: number | null;
+      retryable?: boolean;
       cause?: unknown;
     },
   );
@@ -1297,10 +1308,18 @@ export class DirectoryError extends Error {
     | "NOT_FOUND"
     | "INVITE_ONLY"
     | "INTERNAL";
+  /** sc-4986 — the HTTP status behind the code; null for a transport failure. */
+  status: number | null;
+  /** sc-4986 — whether retrying the SAME call could plausibly succeed. */
+  retryable: boolean;
   constructor(
     code: DirectoryError["code"],
     message: string,
-    opts?: { cause?: unknown },
+    opts?: {
+      status?: number | null;
+      retryable?: boolean;
+      cause?: unknown;
+    },
   );
 }
 
@@ -1620,10 +1639,16 @@ export class PermissionError extends Error {
     | "INTERNAL"
     | string;
   status?: number;
+  /** sc-4986 — whether retrying the SAME call could plausibly succeed. */
+  retryable: boolean;
   constructor(
     code: PermissionError["code"],
     message: string,
-    opts?: { status?: number; cause?: unknown },
+    opts?: {
+      status?: number | null;
+      retryable?: boolean;
+      cause?: unknown;
+    },
   );
 }
 

package/dist/index.js

@@ -99,5 +99,7 @@ export {
   deriveAccentTints,
   gradientAngleToVector,
   normaliseComponentGradient,
+  clampSpacingScale,
+  scaleSpacing,
 } from "./contract.js";
 export { normalizeLucideIconName } from "./lucideIconName.js";

package/dist/index.native.js

@@ -97,5 +97,7 @@ export {
   deriveAccentTints,
   gradientAngleToVector,
   normaliseComponentGradient,
+  clampSpacingScale,
+  scaleSpacing,
 } from "./contract.js";
 export { normalizeLucideIconName } from "./lucideIconName.js";

package/dist/linter.cjs

@@ -845,6 +845,37 @@ function _paymentErrorHandlingRules(source) {
   ];
 }
 
+// sc-4986 — soft warning, the datastore twin of `payment-error-not-branched`.
+// A write can be refused for reasons a retry never clears (the table's grants,
+// a validation failure, a row that is gone), and the server sends a user-safe
+// sentence saying which. A widget that collapses every rejection into one
+// generic "something went wrong" throws that sentence away and leaves the user
+// pressing the button again. Reading `DatastoreError.retryable`, branching on
+// `code ===`, or rendering the error's own `.message` all satisfy it; strings
+// and comments are blanked so prose about errors never does.
+function _datastoreErrorHandlingRules(source) {
+  const code = _stripNonCode(source);
+  const call = /\buseDatastoreMutation\s*\(/.exec(code);
+  if (!call) return [];
+  if (/\bretryable\b/.test(code)) return [];
+  if (/\bcode\s*===/.test(code)) return [];
+  if (/\.message\b/.test(code)) return [];
+  const line = code.slice(0, call.index).split(/\r?\n/).length;
+  return [
+    {
+      rule: "datastore-error-not-branched",
+      severity: "warning",
+      label:
+        `writes with useDatastoreMutation() but never reports why a write ` +
+        `failed — read DatastoreError.retryable (or err.message) and show the ` +
+        `server's reason, so a refusal the user cannot clear is not offered ` +
+        `as "try again".`,
+      line,
+      snippet: (source.split(/\r?\n/)[line - 1] || "").trim().slice(0, 200),
+    },
+  ];
+}
+
 function _imagePercentHeightRules(source) {
   const findings = [];
   const code = _stripNonCode(source, { keepStrings: true });
@@ -1012,6 +1043,7 @@ function lintSource(source, options) {
   findings.push(..._paymentCurrencyRules(source));
   findings.push(..._hardcodedCurrencyLabelRules(source));
   findings.push(..._paymentErrorHandlingRules(source));
+  findings.push(..._datastoreErrorHandlingRules(source));
   findings.push(
     ..._scopeRules(source, options && options.manifest).map((f) => ({
       ...f,

package/dist/linter.js

@@ -977,6 +977,37 @@ function _paymentErrorHandlingRules(source) {
   ];
 }
 
+// sc-4986 — soft warning, the datastore twin of `payment-error-not-branched`.
+// A write can be refused for reasons a retry never clears (the table's grants,
+// a validation failure, a row that is gone), and the server sends a user-safe
+// sentence saying which. A widget that collapses every rejection into one
+// generic "something went wrong" throws that sentence away and leaves the user
+// pressing the button again. Reading `DatastoreError.retryable`, branching on
+// `code ===`, or rendering the error's own `.message` all satisfy it; strings
+// and comments are blanked so prose about errors never does.
+function _datastoreErrorHandlingRules(source) {
+  const code = _stripNonCode(source);
+  const call = /\buseDatastoreMutation\s*\(/.exec(code);
+  if (!call) return [];
+  if (/\bretryable\b/.test(code)) return [];
+  if (/\bcode\s*===/.test(code)) return [];
+  if (/\.message\b/.test(code)) return [];
+  const line = code.slice(0, call.index).split(/\r?\n/).length;
+  return [
+    {
+      rule: "datastore-error-not-branched",
+      severity: "warning",
+      label:
+        `writes with useDatastoreMutation() but never reports why a write ` +
+        `failed — read DatastoreError.retryable (or err.message) and show the ` +
+        `server's reason, so a refusal the user cannot clear is not offered ` +
+        `as "try again".`,
+      line,
+      snippet: (source.split(/\r?\n/)[line - 1] || "").trim().slice(0, 200),
+    },
+  ];
+}
+
 function _imagePercentHeightRules(source) {
   const findings = [];
   // Comments are blanked (string contents kept) so a commented-out example —
@@ -1174,6 +1205,7 @@ export function lintSource(source, options) {
   findings.push(..._paymentCurrencyRules(source));
   findings.push(..._hardcodedCurrencyLabelRules(source));
   findings.push(..._paymentErrorHandlingRules(source));
+  findings.push(..._datastoreErrorHandlingRules(source));
   // REQ-USERMGMT / REQ-ACL-SYS M3 — scope-aware rules. Run after the
   // line-by-line scan so banned-identifier findings stay first in the
   // output.