@endora-commerce/cli 0.100.0

package/dist/lib/specifiers.js

@@ -0,0 +1,130 @@
+/**
+ * Every module specifier a TypeScript source names, in every shape a specifier
+ * can take.
+ *
+ * Extracted from `check-kernel-boundary.ts` (feature 075, MR-0) rather than
+ * written fresh: two independently written walkers drift, and the shape one
+ * forgets is the shape the next violation uses. `check-kernel-boundary.ts` and
+ * `check-module-boundary.ts` police opposite directions across the same
+ * boundary, so a specifier that is invisible to one of them is a hole in both.
+ *
+ * The eight shapes, and why each is here rather than assumed away:
+ *
+ *   - `value-import`        `import { X } from '…'`
+ *   - `type-only-import`    `import type { X } from '…'` — erased at runtime and
+ *                           still a real edge: types resolve at build time, and
+ *                           ESLint's `prefer: 'type-imports'` rewrites value
+ *                           imports into this shape automatically.
+ *   - `mixed-type-specifier` `import { type A, B } from '…'` — a *value* import
+ *                           whose first specifier is typed. A classifier that
+ *                           reads the first token calls it type-only; one that
+ *                           requires every specifier to be typed calls it a
+ *                           value import. Both are edges, so the kind records
+ *                           which reading was taken instead of hiding it.
+ *   - `re-export`           `export { X } from '…'` / `export * from '…'`
+ *   - `side-effect-import`  `import '…'`
+ *   - `dynamic-import`      `await import('…')` — invisible to a reviewer
+ *                           scanning the import block, and to a bundler.
+ *   - `require-call`        `require('…')`
+ *   - `import-type-node`    `let x: import('…').T` — erased by tsc, permitted by
+ *                           this repository's ESLint config
+ *                           (`disallowTypeAnnotations: false`), and invisible to
+ *                           a check that only walks import declarations.
+ *
+ * Static analysis through the TypeScript compiler API, so a specifier mentioned
+ * in a comment or in a string literal is not a finding.
+ */
+import ts from 'typescript';
+function importBindings(node) {
+    if (ts.isImportDeclaration(node)) {
+        const clause = node.importClause;
+        if (!clause)
+            return [];
+        const names = [];
+        if (clause.name)
+            names.push(clause.name.text);
+        const bound = clause.namedBindings;
+        if (bound) {
+            if (ts.isNamespaceImport(bound))
+                names.push(`* as ${bound.name.text}`);
+            else
+                for (const element of bound.elements)
+                    names.push(element.name.text);
+        }
+        return names;
+    }
+    if (ts.isExportDeclaration(node)) {
+        const clause = node.exportClause;
+        if (!clause)
+            return ['*'];
+        if (ts.isNamespaceExport(clause))
+            return [`* as ${clause.name.text}`];
+        return clause.elements.map((element) => element.name.text);
+    }
+    return [];
+}
+/**
+ * Which of the four import-declaration shapes this is.
+ *
+ * A declaration with no import clause takes nothing and is therefore a
+ * side-effect import; `import type` marks the clause; `import { type A, B }`
+ * marks individual elements, which is the shape a first-token classifier gets
+ * wrong.
+ */
+function importDeclarationKind(node) {
+    const clause = node.importClause;
+    if (!clause)
+        return 'side-effect-import';
+    if (clause.isTypeOnly)
+        return 'type-only-import';
+    const bound = clause.namedBindings;
+    if (bound && ts.isNamedImports(bound) && bound.elements.some((element) => element.isTypeOnly)) {
+        return 'mixed-type-specifier';
+    }
+    return 'value-import';
+}
+/**
+ * Every module specifier `source` names, in source order.
+ *
+ * `file` is used only for the source-file name the compiler API wants and for
+ * line numbers; nothing here touches disk, so a caller may pass a path that does
+ * not exist — which is what lets both checks' fixtures enter at the top.
+ */
+export function namedSpecifiers(source, file) {
+    const sf = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true);
+    const found = [];
+    const record = (specifier, kind, bindings) => {
+        found.push({
+            text: specifier.text,
+            kind,
+            bindings,
+            line: sf.getLineAndCharacterOfPosition(specifier.getStart(sf)).line + 1,
+        });
+    };
+    const visit = (node) => {
+        if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&
+            node.moduleSpecifier &&
+            ts.isStringLiteral(node.moduleSpecifier)) {
+            record(node.moduleSpecifier, ts.isImportDeclaration(node) ? importDeclarationKind(node) : 're-export', importBindings(node));
+        }
+        if (ts.isCallExpression(node)) {
+            const callee = node.expression;
+            const isDynamicImport = callee.kind === ts.SyntaxKind.ImportKeyword;
+            const isRequire = ts.isIdentifier(callee) && callee.text === 'require';
+            const [first] = node.arguments;
+            if ((isDynamicImport || isRequire) && first && ts.isStringLiteral(first)) {
+                record(first, isDynamicImport ? 'dynamic-import' : 'require-call', []);
+            }
+        }
+        if (ts.isImportTypeNode(node)) {
+            const argument = node.argument;
+            if (ts.isLiteralTypeNode(argument) && ts.isStringLiteral(argument.literal)) {
+                record(argument.literal, 'import-type-node', node.qualifier ? [node.qualifier.getText(sf)] : []);
+            }
+        }
+        node.forEachChild(visit);
+    };
+    sf.forEachChild(visit);
+    return found;
+}
+//# sourceMappingURL=specifiers.js.map

package/dist/lib/specifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"specifiers.js","sourceRoot":"","sources":["../../src/lib/specifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,MAAM,YAAY,CAAC;AAuB5B,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;;gBAClE,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,QAAQ,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,IAA0B;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,oBAAoB,CAAC;IACzC,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,kBAAkB,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9F,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY;IAC1D,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAqB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,CACb,SAA+B,EAC/B,IAAmB,EACnB,QAA2B,EACrB,EAAE;QACR,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;SACxE,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IACE,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe;YACpB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EACxC,CAAC;YACD,MAAM,CACJ,IAAI,CAAC,eAAe,EACpB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EACxE,cAAc,CAAC,IAAI,CAAC,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YACpE,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;YACvE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAC/B,IAAI,CAAC,eAAe,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzE,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC/B,IAAI,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3E,MAAM,CACJ,QAAQ,CAAC,OAAO,EAChB,kBAAkB,EAClB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CACnD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/sql-tables.d.ts

@@ -0,0 +1,166 @@
+/**
+ * SQL table identifiers, read out of TypeScript sources through the compiler
+ * API (feature 077, D-87).
+ *
+ * `check-module-boundary.ts` polices one rule — a module does not reach into
+ * another module's internals — through two predicates, and this file is the
+ * syntax half of the second one. The first predicate reads import specifiers
+ * (`lib/specifiers.ts`); a raw `select … from another_module_table` names no
+ * specifier at all, compiles, runs, and returns rows.
+ *
+ * Two extractions live here, and both are deliberately **syntactic only**:
+ * ownership is decided by the check, which is the file that knows what a module
+ * is.
+ *
+ *   - {@link sqlTableAccesses} — the table identifiers a source *uses*, through
+ *     two recognition paths: a **statement** literal, and a knex query
+ *     **builder** (issue #187).
+ *   - {@link declaredTableNames} — the table names a source *declares*, from an
+ *     `@Entity()` class or from `create table` DDL. Both sources are needed: an
+ *     owner map built from entity classes alone maps 220 tables and misses every
+ *     join table and every channel bridge, which is 39 of the 157 findings the
+ *     D-87 sweep measured — including the one carrying a live defect.
+ *
+ * ## Why this reads literal **nodes** and never source text
+ *
+ * The first spike for D-87 was a regex over source text. It hallucinated a dozen
+ * tables — `every`, `bumps`, `used`, `path` — because an apostrophe in an
+ * English comment opens a string literal that runs to the next apostrophe, and
+ * the prose in between parses as SQL often enough to matter. Reading
+ * `ts.StringLiteral` / template-literal nodes removes comments from the
+ * population by construction rather than by an exclusion someone has to
+ * maintain, which is why `sql-in-a-comment` is one of the check's red proofs.
+ *
+ * ## What a statement has to look like
+ *
+ * A literal joins the population when it *starts* with `select`, `insert into`,
+ * `update`, `delete from` or `with`, **and** carries the rest of that statement's
+ * skeleton: a `select` needs a `from`, an `update` needs a `set`, a `with` needs
+ * a `select`. The second half is not decoration — `'Update products in the
+ * catalog'` is English prose that a start-anchored test alone reads as an
+ * `UPDATE` against `products`, and a check that reports it teaches its readers
+ * to ignore it.
+ *
+ * ## What a builder has to look like (issue #187)
+ *
+ * A knex builder names its table as an **argument to a call**, so no statement
+ * literal exists to anchor on:
+ *
+ * ```ts
+ * await knexForStock('warehouse_channel_assignments as a')
+ *   .join('warehouses as w', 'w.id', 'a.warehouse_id')
+ * ```
+ *
+ * Both tables are `inventory`'s, read from inside `orders`' placement
+ * transaction, and both predicates were blind to them — the import predicate
+ * because a builder names no specifier, the statement path because there is no
+ * statement. **Ten** such accesses, in six files, stood outside a `sql=111` that
+ * read as the whole coupling, which is exactly the "`violations=0` licenses a
+ * package split the tree has not earned" failure D-87 exists to end. The grep
+ * that raised the issue found seven; the three it missed are the aliasing object
+ * form (`knex({ p: 'products' })`) and two reaches into **kernel** tables, which
+ * is the argument for reading nodes rather than grepping a spelling.
+ *
+ * Two shapes are recognised, and the population is bounded twice over — by the
+ * argument position and by the check's table→owner map, which only knows real
+ * tables:
+ *
+ *   - **{@link TABLE_ARGUMENT_METHODS}** — a string literal in the *first*
+ *     argument of `from`, `into`, `table` or a member of the join family. The
+ *     list is enumerated rather than "any string on any builder method" because
+ *     `where('status', …)`, `select('id')` and `orderBy(…)` take **columns**: a
+ *     column spelled like another module's table would flood the ledger and the
+ *     check would be switched off. Only the first argument is read, because
+ *     `join(table, first, second)`'s remaining arguments are column references.
+ *   - **the knex callable itself** — `knex('products')`, which starts 36 of the
+ *     tree's 43 builder queries over a known table and which is not a method
+ *     call at all.
+ *     Its callee carries no name to key on, so the identifier must be **bound to
+ *     a `getKnex()` result in the same file**; nothing else opens that door.
+ *
+ * The method list is receiver-agnostic on purpose. `Array.prototype.join` and
+ * `path.join` share the `join` spelling, and the tree calls the first 238 times;
+ * what keeps them out is that their arguments (`', '`, a path segment) are not
+ * table names in the owner map. The alternative — requiring every builder chain
+ * to root syntactically in a knex binding — would refuse them by construction
+ * but go **silently** blind on the builder held in a variable or taken as a
+ * parameter, which `catalog-admin.service.ts` and `promotion-stats-service.ts`
+ * both do. A spelling collision is a visible finding a reader resolves; a
+ * receiver rule is a miss nobody sees, and this file's whole reason for existing
+ * is that the second kind of failure is the expensive one.
+ */
+import ts from 'typescript';
+/** Which way the statement moves rows through the table it names. */
+export type SqlAccessDirection = 'read' | 'write';
+/**
+ * Which recognition path named the table — a SQL statement literal, or a knex
+ * query builder (issue #187).
+ *
+ * Carried on the finding so a red proof can assert the path it is testing: a
+ * builder proof that only checked the table would go green off the statement
+ * path, which is how a new signal goes blind behind an existing one's red
+ * (issue #130).
+ */
+export type SqlAccessSyntax = 'statement' | 'builder';
+/** One table identifier a SQL literal or a query builder names. */
+export interface SqlTableAccess {
+    /** The identifier, lower-cased, alias and schema qualifier stripped. */
+    readonly table: string;
+    readonly direction: SqlAccessDirection;
+    readonly syntax: SqlAccessSyntax;
+    /** 1-based line of the literal that names it. */
+    readonly line: number;
+    /** The head of the statement, or of the builder chain, for the message. */
+    readonly statement: string;
+}
+/** Where a table name was declared — the two owner-map sources. */
+export type TableDeclarationSource = 'entity' | 'migration';
+/** One table name a source declares. */
+export interface TableDeclaration {
+    readonly table: string;
+    readonly source: TableDeclarationSource;
+}
+/**
+ * Every table identifier `source` names, through either recognition path.
+ *
+ * `file` is used for the source-file name the compiler API wants and for line
+ * numbers only; nothing here touches disk, so a caller may pass a path that does
+ * not exist. That is what lets the check's red proofs enter here, with source
+ * text, rather than below with a resolved table list.
+ */
+export declare function sqlTableAccesses(source: string, file: string): SqlTableAccess[];
+/**
+ * `em.getKnex()`, `em.getConnection().getKnex()`, `this.emFactory().getKnex()`.
+ *
+ * Exported because `check-transaction-context` refuses the same handle for a
+ * different reason (issue #200: it carries no transaction context), and two
+ * copies of "what a knex handle looks like" would drift — the receiver is
+ * spelled at least three ways in this tree already.
+ */
+export declare function isGetKnexCall(node: ts.Expression): boolean;
+/**
+ * How a class name becomes a table name when an `@Entity()` declares no
+ * `tableName`.
+ *
+ * It is a **parameter and has no default**, deliberately. The convention is the
+ * platform's own naming strategy (`PluralizingNamingStrategy`), which lives in
+ * the application's runtime sources and cannot be reached from here — this file
+ * is `@endora-commerce/cli`'s, and the application depends on the CLI as a
+ * development tool, never the other way round. Writing a copy of the pluralizer
+ * here would make two authors of one convention, which is the defect this whole
+ * estate exists against; asking the caller for it keeps the strategy the single
+ * author and makes a package-scope host supply whatever its own platform
+ * declares.
+ */
+export type EntityTableNameStrategy = (className: string) => string;
+/**
+ * The table names `source` declares, from either owner-map source.
+ *
+ * An `@Entity()` class declares its `tableName` option, or — for the classes
+ * that do not set one — the name `PluralizingNamingStrategy` derives from the
+ * class name, imported rather than reimplemented so the two cannot drift.
+ * `create table` DDL is read out of the same literal nodes as everything else,
+ * so a migration that mentions a table in a comment declares nothing.
+ */
+export declare function declaredTableNames(source: string, file: string, tableNameOf: EntityTableNameStrategy): TableDeclaration[];
+//# sourceMappingURL=sql-tables.d.ts.map

package/dist/lib/sql-tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-tables.d.ts","sourceRoot":"","sources":["../../src/lib/sql-tables.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AACH,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,SAAS,CAAC;AAEtD,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,mEAAmE;AACnE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE5D,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AA4ED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAK/E;AAuFD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,GAAG,OAAO,CAM1D;AAoID;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;AAEpE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,uBAAuB,GACnC,gBAAgB,EAAE,CAkCpB"}