@endora-commerce/cli 0.100.0

package/dist/rules/channel-resolution.js

@@ -0,0 +1,382 @@
+/**
+ * CI check — Sales-Channel Resolution Unification (feature 053, FR-011).
+ *
+ * Locks the invariant established by feature 053: the current sales channel
+ * for a request is resolved EXACTLY ONCE, by the canonical resolver
+ * (`kernel/sales-channels/sales-channel-resolver.middleware.ts`, relocated from
+ * the `sales_channels` module by feature 072 T019), and exposed on the request
+ * scope, read through `getResolvedChannel()` / `currentSalesChannel()` (feature
+ * 072 T028 moved it off the `request.salesChannel` property). No
+ * storefront-facing module may re-derive it.
+ *
+ * Three static signals are flagged (TypeScript compiler API, no DB, no new
+ * dependency — mirrors `check-entity-tenant-classification.ts`):
+ *
+ *  1. RAW CHANNEL HEADER READ — any string literal `x-sales-channel` or
+ *     `x-sales-channel-id` anywhere under `src/**` outside the resolver's own
+ *     directory. Legitimate code never reads these headers; only the resolver
+ *     does. Global scope = strongest guard.
+ *
+ *  2. REQUEST-CHANNEL RE-RESOLUTION — inside the storefront "surface" files
+ *     (routes.public / routes.storefront / *storefront-resolver / the catalog
+ *     & search query services / product-link service): a `SalesChannel`
+ *     entity query (`em.findOne/find(SalesChannel, …)`) or a raw
+ *     `from sales_channels` SQL string used to derive the request channel.
+ *     Scoped to surfaces so admin CRUD / membership / seeds that legitimately
+ *     query channels are not false-positived.
+ *
+ *     **Issue #256 — measured, and the SQL shape was drained rather than made
+ *     visible.** MR !775 found four public storefront endpoints re-resolving
+ *     the request channel with `select id from sales_channels where code = ?`
+ *     while this check reported clean, and the filed diagnosis was that the
+ *     signal cannot see SQL. It can: 2b above is exactly that shape. What it
+ *     could not see was the *population* — all four sat in
+ *     `settings/services/*-resolver.ts`, which is no storefront surface by the
+ *     predicate above. Widening the population was rejected on measurement,
+ *     not on taste: at the time the question was asked, module code held eight
+ *     raw reads of `sales_channels`, and every one of them was the
+ *     administration this signal deliberately spares — enumerating every
+ *     channel in a boot seed, or fetching one by an admin-supplied id. None
+ *     was keyed by a request-supplied code, so a widened signal would have
+ *     reported eight false positives and nothing else. Feature 075's D-87
+ *     drain then took all eight through the kernel's `SalesChannel` entity, so
+ *     `src/modules` now holds **no** raw `sales_channels` statement at all; the
+ *     only live one left in `src/` is the kernel's own, in
+ *     `sales-channel-membership.service.ts`. A second predicate over that
+ *     shape would report a vacuous green from its first run, which is why this
+ *     paragraph exists and the predicate does not.
+ *
+ *  3. SETTINGS-CHANNEL LITERAL (feature 072, D-42) — a `.get` / `.getMany`
+ *     call on a `settings`-ish receiver whose channel argument can be a string
+ *     that is not a channel uuid, or is the nil uuid. Both are spellings of "I
+ *     have no channel", and since D-41 that has a real one: `null`. The literal
+ *     `'default'` — a channel **code**, against a `sales_channel_id uuid`
+ *     column — made PostgreSQL reject the comparison outright, and the caller's
+ *     `catch` reported it as "not configured yet"; three settings were
+ *     therefore ignored on every deployment. The nil uuid resolved to the right
+ *     tier, but by accident.
+ *
+ *  4. INVENTED CHANNEL IDENTIFIER (feature 072, D-48) — the two *positions*
+ *     signal 3 could not see, because it only ever inspected the channel
+ *     argument of a settings read:
+ *
+ *       a. a **default parameter value**: `salesChannelId: string = 'default'`.
+ *          `quick_order`'s `OneClickService` carried exactly that — a fifth
+ *          constructor argument production never passed — so one-click buy was
+ *          off on every deployment while its unit test, which *did* pass the
+ *          argument, stayed green (issue #99).
+ *       b. a **channel id falling back to `randomUUID()`**. `orders` stamped
+ *          `salesChannelId: channel?.id ?? randomUUID()` onto every order
+ *          placed without an explicit channel (issue #85) — an identifier
+ *          invented at write time, in a column other reads join on. Restricted
+ *          to `randomUUID()` deliberately: a *string* fallback off a channel id
+ *          is caught by signal 3 wherever it reaches a settings read, and
+ *          flagging every one of them here turns twenty ordinary
+ *          `channel?.defaultCurrency ?? 'PLN'` defaults into noise.
+ *
+ *     `?? null` is never flagged, in either signal: that is the sanctioned
+ *     platform-wide read, and it is the answer all four of these were reaching
+ *     for. **Signal 4 is deliberately not the settings seam** — L2 and L4 were
+ *     not settings calls at all, which is part of why D-42's check read clean
+ *     across all four.
+ *
+ * Reading `channel.isPublic` (price-visibility) off an already-resolved
+ * channel is NOT a violation — it is a property read, neither signal.
+ *
+ * ## One analysis, two hosts
+ *
+ * This file is the analysis (`specs/101-endora-check/contracts/package-scope-layout.md`
+ * §6). `backend/scripts/check-channel-resolution.ts` hosts it over this
+ * repository's module walk roots and carries the rollout allow-list, which is a
+ * statement about *this* tree; `endora check` hosts it over one module package's
+ * declared source layer, where every violation is blocking because a stranger's
+ * package is in no rollout of ours.
+ */
+import { readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import ts from 'typescript';
+/**
+ * The whole of `src/` is scanned, not `modules/` plus `kernel/`.
+ *
+ * Feature 072 T019 moved the resolver, its service and its cache into the
+ * kernel, so scanning the kernel is what keeps the one place the header may
+ * legally be read from being the one place nothing checks. D-42 widened it
+ * again: of the settings-channel family's ten sites, two lived in
+ * `composition.ts` and two in a module's `scripts/` directory, so a
+ * `modules/**`-only scan would have missed nearly half of it.
+ */
+/** Header names that only the canonical resolver may read. */
+const CHANNEL_HEADERS = new Set(['x-sales-channel', 'x-sales-channel-id']);
+/**
+ * Resolution is owned by the kernel's `sales-channels/` directory and by what
+ * is left of the `sales_channels` module (its admin CRUD service and routes,
+ * which legitimately query channels) — never scanned.
+ *
+ * The kernel half is matched **wherever the kernel is**, not at one prefix. The
+ * relocation moved it into `@endora-commerce/platform`, so `layout.keyOf` spells
+ * it `packages/platform/src/kernel/sales-channels/…`; an anchored prefix stopped
+ * matching and the canonical resolver reported *itself* for reading the
+ * `x-sales-channel` header, which is the one file whose whole job that is.
+ */
+function isResolverOwned(relPath) {
+    return relPath.startsWith('modules/sales_channels/') || /(^|\/)kernel\/sales-channels\//.test(relPath);
+}
+/** Storefront surfaces where re-resolving the request channel is forbidden. */
+function isStorefrontSurface(relPath) {
+    return (relPath.endsWith('/routes.public.ts') ||
+        relPath.endsWith('/routes.storefront.ts') ||
+        relPath.endsWith('storefront-resolver.ts') ||
+        relPath.endsWith('/catalog-query.service.ts') ||
+        relPath.endsWith('/search-query.service.ts') ||
+        relPath.endsWith('/product-link.service.ts'));
+}
+const RAW_CHANNEL_SQL = /\bfrom\s+sales_channels\b/i;
+/** The shape `sales_channels.id` has. */
+const CHANNEL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const NIL_UUID = '00000000-0000-0000-0000-000000000000';
+/**
+ * Which `.get(…)` calls are settings reads. Syntactic and receiver-based,
+ * because the check has no type information: `settingsReadPort`,
+ * `settingsService`, `this.settings`, `options.settings`, `deps.settingsRead`.
+ * A `cache.get(code, 'default')` or a `dictionaries.get(…)` is not one.
+ */
+function isSettingsReceiver(receiver) {
+    const last = receiver.split('.').pop() ?? receiver;
+    return /settings/i.test(last);
+}
+/**
+ * True when this literal cannot be a sales-channel id, or is the nil uuid.
+ *
+ * The nil uuid is included deliberately: it *is* well-formed, which is exactly
+ * why it survived in three modules. It addresses no row, so resolution fell
+ * through to `global_value ?? default_value` — the right answer, reached by
+ * accident and unreadably. A reader cannot tell `'00000000-…'` meaning
+ * "platform-wide" from `'00000000-…'` meaning "somebody had to put something
+ * here", and that ambiguity is what let `'default'` survive beside it.
+ */
+function isNotAChannelId(literal) {
+    return !CHANNEL_UUID.test(literal) || literal.toLowerCase() === NIL_UUID;
+}
+/**
+ * Naming the header in a CORS policy is not reading it.
+ *
+ * `http/server.ts` must list `X-Sales-Channel` under `allowedHeaders`, or the
+ * browser strips the very header the canonical resolver exists to read. Signal
+ * 1 is a global-scope rule and stays one; this exempts the shape that declares
+ * a header rather than consuming it — a string inside an array literal on a
+ * `…Headers` property — so the exemption cannot quietly cover a real read.
+ * Feature 072 (D-42) widened the scan from `modules/**` + `kernel/**` to all of
+ * `src/**`, which is what first brought this file into range.
+ */
+function isCorsHeaderDeclaration(node) {
+    const array = node.parent;
+    if (array === undefined || !ts.isArrayLiteralExpression(array))
+        return false;
+    const property = array.parent;
+    if (property === undefined || !ts.isPropertyAssignment(property))
+        return false;
+    const name = property.name;
+    return (ts.isIdentifier(name) || ts.isStringLiteralLike(name)) && /Headers$/.test(name.text);
+}
+/**
+ * Every TypeScript source under `dir`, with the rule's own prunes applied.
+ *
+ * Exported because the population is part of the rule: two hosts computing
+ * "which files this check reads" two ways is the shape that lets one of them go
+ * half-blind.
+ */
+export function collectChannelSources(dir, out = []) {
+    for (const name of readdirSync(dir)) {
+        const full = join(dir, name);
+        if (statSync(full).isDirectory()) {
+            if (name === 'node_modules' || name === 'dist')
+                continue;
+            collectChannelSources(full, out);
+        }
+        else if (name.endsWith('.ts') && !name.endsWith('.test.ts') && !name.endsWith('.d.ts')) {
+            out.push(full);
+        }
+    }
+    return out;
+}
+/**
+ * A parameter that holds a sales-channel **id**. Name-based, because the check
+ * has no type information — and a name is what a reader has too. `channelCode`
+ * and `salesChannelCode` deliberately do not match: a code default is a
+ * legitimate thing to have (the reconciler seeds one), an id default is not.
+ */
+const CHANNEL_ID_PARAM = /channelid$/i;
+/**
+ * "This expression is a resolved channel **id**." Text-based, since the check
+ * has no type information, and narrow on purpose: signal 4b is about inventing
+ * an *identifier*, so it must not fire on a property read off an
+ * already-resolved channel. `channel?.defaultCurrency ?? 'PLN'` and
+ * `channel?.defaultLanguage ?? 'en-US'` are ordinary defaults for ordinary
+ * fields — twenty of them exist in the tree — and neither is a channel id.
+ */
+function isChannelIdExpression(text) {
+    const trimmed = text.trim();
+    if (/(^|[^a-z0-9_])(sales)?channelid$/i.test(trimmed))
+        return true;
+    return /\??\.id$/.test(trimmed) && /channel|getSystemDefault/i.test(trimmed);
+}
+/** Analyze one source string. Exported for the unit self-test. */
+export function analyzeSource(source, relPath) {
+    if (isResolverOwned(relPath))
+        return [];
+    const surface = isStorefrontSurface(relPath);
+    const sf = ts.createSourceFile(relPath, source, ts.ScriptTarget.Latest, true);
+    const violations = [];
+    const at = (node) => sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+    /**
+     * Same-file `const X = '…'` and `const X = a ?? '…'` initializers.
+     *
+     * D-42 recorded a single value and followed one hop, which is exactly the
+     * reach `branding.service.ts` escaped on: `const scopeId = salesChannelId ??
+     * GLOBAL_SENTINEL` is two hops and a `??`. What is recorded now is the set of
+     * **string values the name can hold**, which is the question signal 3 was
+     * always asking. A channel id that arrives as a parameter or through DI still
+     * contributes nothing and is what the runtime seam guard in `SettingsService`
+     * is for.
+     */
+    const stringConsts = new Map();
+    /**
+     * The string values an expression can evaluate to, as far as syntax can tell.
+     * `null`, `undefined` and anything dynamic contribute nothing — so `x ?? null`
+     * yields the empty set and is never flagged, which is the whole point.
+     */
+    const possibleStrings = (node, depth = 0) => {
+        if (depth > 8)
+            return [];
+        if (ts.isParenthesizedExpression(node))
+            return possibleStrings(node.expression, depth + 1);
+        if (ts.isStringLiteralLike(node))
+            return [node.text];
+        if (ts.isIdentifier(node))
+            return stringConsts.get(node.text) ?? [];
+        if (ts.isConditionalExpression(node)) {
+            return [
+                ...possibleStrings(node.whenTrue, depth + 1),
+                ...possibleStrings(node.whenFalse, depth + 1),
+            ];
+        }
+        if (ts.isBinaryExpression(node) &&
+            (node.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken ||
+                node.operatorToken.kind === ts.SyntaxKind.BarBarToken)) {
+            return [...possibleStrings(node.left, depth + 1), ...possibleStrings(node.right, depth + 1)];
+        }
+        return [];
+    };
+    const collectConsts = (node) => {
+        if (ts.isVariableDeclaration(node) &&
+            ts.isIdentifier(node.name) &&
+            node.initializer !== undefined) {
+            const values = possibleStrings(node.initializer);
+            if (values.length > 0)
+                stringConsts.set(node.name.text, values);
+        }
+        ts.forEachChild(node, collectConsts);
+    };
+    // Twice: a `const` may be initialized from one declared later in the file
+    // (a module-scope constant read inside a function), and one pass records the
+    // literals the second pass then resolves through.
+    collectConsts(sf);
+    collectConsts(sf);
+    /** `randomUUID()` — an identifier invented on the spot (issue #85). */
+    const isRandomUuidCall = (node) => ts.isCallExpression(node) && /(^|\.)randomUUID$/.test(node.expression.getText(sf));
+    const visit = (node) => {
+        // Signal 3 — a settings read whose channel argument can be a string that is
+        // not a channel id (feature 072, D-42, widened by D-48).
+        if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+            const method = node.expression.name.text;
+            const channelArg = node.arguments[1];
+            if ((method === 'get' || method === 'getMany') &&
+                channelArg !== undefined &&
+                isSettingsReceiver(node.expression.expression.getText(sf))) {
+                const offending = possibleStrings(channelArg).find(isNotAChannelId);
+                if (offending !== undefined) {
+                    violations.push({
+                        file: relPath,
+                        line: at(node),
+                        kind: 'settings-channel-literal',
+                        detail: `settings.${method}(…) can read channel '${offending}', which is not a ` +
+                            `sales-channel id — pass a channel uuid, or null for a platform-wide read`,
+                    });
+                }
+            }
+        }
+        // Signal 4a — a default parameter value standing in for a channel id.
+        if (ts.isParameter(node) &&
+            ts.isIdentifier(node.name) &&
+            CHANNEL_ID_PARAM.test(node.name.text) &&
+            node.initializer !== undefined) {
+            const offending = possibleStrings(node.initializer).find(isNotAChannelId);
+            if (offending !== undefined) {
+                violations.push({
+                    file: relPath,
+                    line: at(node),
+                    kind: 'invented-channel-identifier',
+                    detail: `default parameter '${node.name.text} = ${JSON.stringify(offending)}' invents a ` +
+                        `sales-channel id — a parameter production never passes is a hole, not a default`,
+                });
+            }
+        }
+        // Signal 4b — a channel resolution with an invented fallback.
+        if (ts.isBinaryExpression(node) &&
+            (node.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken ||
+                node.operatorToken.kind === ts.SyntaxKind.BarBarToken) &&
+            isChannelIdExpression(node.left.getText(sf))) {
+            if (isRandomUuidCall(node.right)) {
+                violations.push({
+                    file: relPath,
+                    line: at(node),
+                    kind: 'invented-channel-identifier',
+                    detail: `a channel id falls back to randomUUID(), which addresses no sales_channels row — ` +
+                        `the system default always exists (D-47/D-48), so resolve it; use null only where ` +
+                        `"no channel" is a real answer`,
+                });
+            }
+        }
+        // Signal 1 — raw channel-header read (global scope).
+        if (ts.isStringLiteralLike(node) &&
+            CHANNEL_HEADERS.has(node.text.toLowerCase()) &&
+            !isCorsHeaderDeclaration(node)) {
+            violations.push({
+                file: relPath,
+                line: at(node),
+                kind: 'raw-channel-header',
+                detail: `reads the '${node.text}' header — use getResolvedChannel()`,
+            });
+        }
+        if (surface) {
+            // Signal 2a — em.findOne/find/findOneOrFail(SalesChannel, …)
+            if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+                const method = node.expression.name.text;
+                if ((method === 'findOne' || method === 'find' || method === 'findOneOrFail') &&
+                    node.arguments[0] &&
+                    ts.isIdentifier(node.arguments[0]) &&
+                    node.arguments[0].text === 'SalesChannel') {
+                    violations.push({
+                        file: relPath,
+                        line: at(node),
+                        kind: 'request-channel-reresolution',
+                        detail: `${method}(SalesChannel, …) re-resolves the request channel — call getResolvedChannel()`,
+                    });
+                }
+            }
+            // Signal 2b — raw `from sales_channels` SQL.
+            if (ts.isStringLiteralLike(node) && RAW_CHANNEL_SQL.test(node.text)) {
+                violations.push({
+                    file: relPath,
+                    line: at(node),
+                    kind: 'request-channel-reresolution',
+                    detail: `raw 'from sales_channels' query re-resolves the request channel — call getResolvedChannel()`,
+                });
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sf);
+    return violations;
+}
+//# sourceMappingURL=channel-resolution.js.map

package/dist/rules/channel-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-resolution.js","sourceRoot":"","sources":["../../src/rules/channel-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B;;;;;;;;;GASG;AAEH,8DAA8D;AAC9D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAE3E;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzG,CAAC;AAED,+EAA+E;AAC/E,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACzC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAC1C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC5C,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD,yCAAyC;AACzC,MAAM,YAAY,GAAG,iEAAiE,CAAC;AACvF,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAExD;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;IACnD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,uBAAuB,CAAC,IAAa;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,MAAgB,EAAE;IACnE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,MAAM;gBAAE,SAAS;YACzD,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/E,CAAC;AAcD,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAe;IAC3D,IAAI,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,IAAa,EAAU,EAAE,CACnC,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAE/D;;;;;;;;;;OAUG;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEjD;;;;OAIG;IACH,MAAM,eAAe,GAAG,CAAC,IAAa,EAAE,KAAK,GAAG,CAAC,EAAY,EAAE;QAC7D,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;YAAE,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3F,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACpE,IAAI,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC;gBAC5C,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,CAAC;aAC9C,CAAC;QACJ,CAAC;QACD,IACE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAC3B,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,qBAAqB;gBAC9D,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EACxD,CAAC;YACD,OAAO,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,IAAa,EAAQ,EAAE;QAC5C,IACE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;YAC9B,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,WAAW,KAAK,SAAS,EAC9B,CAAC;YACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClE,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC,CAAC;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,kDAAkD;IAClD,aAAa,CAAC,EAAE,CAAC,CAAC;IAClB,aAAa,CAAC,EAAE,CAAC,CAAC;IAElB,uEAAuE;IACvE,MAAM,gBAAgB,GAAG,CAAC,IAAa,EAAW,EAAE,CAClD,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAErF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,4EAA4E;QAC5E,yDAAyD;QACzD,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACrC,IACE,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,CAAC;gBAC1C,UAAU,KAAK,SAAS;gBACxB,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAC1D,CAAC;gBACD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC5B,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO;wBACb,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,0BAA0B;wBAChC,MAAM,EACJ,YAAY,MAAM,yBAAyB,SAAS,oBAAoB;4BACxE,0EAA0E;qBAC7E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IACE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;YACpB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,IAAI,CAAC,WAAW,KAAK,SAAS,EAC9B,CAAC;YACD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,6BAA6B;oBACnC,MAAM,EACJ,sBAAsB,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc;wBACjF,iFAAiF;iBACpF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,IACE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAC3B,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,qBAAqB;gBAC9D,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;YACxD,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAC5C,CAAC;YACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,6BAA6B;oBACnC,MAAM,EACJ,mFAAmF;wBACnF,mFAAmF;wBACnF,+BAA+B;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IACE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAC5B,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAC9B,CAAC;YACD,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,cAAc,IAAI,CAAC,IAAI,qCAAqC;aACrE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,6DAA6D;YAC7D,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChF,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzC,IACE,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,eAAe,CAAC;oBACzE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;oBACjB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAClC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,EACzC,CAAC;oBACD,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO;wBACb,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,8BAA8B;wBACpC,MAAM,EAAE,GAAG,MAAM,+EAA+E;qBACjG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,6CAA6C;YAC7C,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpE,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,8BAA8B;oBACpC,MAAM,EAAE,6FAA6F;iBACtG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/rules/command-coverage.d.ts

@@ -0,0 +1,210 @@
+/**
+ * Command-coverage check — feature 054 (FR-009 / FR-010, Constitution Principle XIII).
+ *
+ * `pnpm --filter backend run check:command-coverage -- [--strict] [--module <name> ...]`
+ *
+ * Flags, **per method/function/route handler** in every file a module owns:
+ *   1. an **unaudited sensitive write** — a method that performs a mutation call
+ *      (`persist*`, `nativeUpdate`, `nativeDelete`, `remove*`, `flush`) but
+ *      neither runs a Command (`commandBus.run(...)`) nor writes audit
+ *      (`.record*(...)`) in the same method;
+ *   2. a **double-audit** — a method that BOTH runs a Command AND writes audit by
+ *      hand (a converted write must remove its manual audit call, FR-010).
+ *
+ * Method-level (not file-level) so a partially-migrated file is judged per
+ * method: a converted `adjust` no longer masks an unaudited `grant` in the same
+ * file, and a Command in one method is not mistaken for a double-audit against a
+ * legacy `record()` in another.
+ *
+ * Escape hatch: a genuinely non-sensitive write (bookkeeping rows — progress
+ * counters, cache, queue state) can be exempted by putting a
+ * `command-coverage-ignore: <reason>` comment anywhere in the method. This keeps
+ * "build-breaking per module" honest without forcing audit onto non-domain writes,
+ * mirroring the audited `withSystemScope` escape hatch for tenancy.
+ *
+ * ## The escape hatch is a two-way ratchet (issue #116)
+ *
+ * 185 methods carry that comment, and until now nothing ever re-read one. An
+ * ignore written for a write that has since moved elsewhere — into a Command, or
+ * into another module's audited service — went on reading as a considered
+ * decision about a write that is no longer there, and the next person to add a
+ * write to that method inherited the exemption silently.
+ *
+ * So a marker on a method that **no longer writes at all** is reported as
+ * `stale-ignore`, in the idiom of `PORT_CATCHES_TO_DRAIN` and
+ * `BARE_SUBSCRIPTIONS_TO_DRAIN`: an unledgered violation fails the build, and an
+ * entry that no longer describes one fails it too. MR !532's marker in
+ * `orders/order-completion-reactor.ts` — added because a refactor made an
+ * *existing* write visible to this check — is exactly the entry that has to be
+ * re-verified rather than trusted, and now it is, on every run.
+ *
+ * **The staleness half looks for writes more widely than the flagging half**,
+ * and the asymmetry is deliberate: both errors then fall on the safe side. The
+ * flagging half only flags an ORM mutation call it is sure about; the staleness
+ * half additionally counts a raw SQL write statement (`conn.execute` with an
+ * `update`/`insert into`/`delete from`) and any write reached transitively
+ * through `this.<name>(…)` in the same file — so a marker guarding a real write
+ * this check cannot itself see is left alone, and only a marker guarding nothing
+ * is reported.
+ *
+ * **With one subtraction (D-89c): a downstream write that itself carries a
+ * marker does not keep the caller's marker alive.** The transitive rule exists
+ * so a marker over a write this check cannot see is not called stale; when the
+ * write it reaches is *already exempted where it happens*, the caller's marker
+ * is provably guarding nothing and the ratchet has to say so. The worked
+ * example carries the failure and its correction in one file:
+ * `payments/services/payment-reference-port.ts` marked `stampExternalReference`
+ * and `stampExternalReferenceIfAbsent`, neither of which writes, and later
+ * marked the private `stamp` that does the `flush` — with a comment explaining
+ * that the marker had to be repeated there "because the check reads the
+ * function that writes". Both redundant caller markers survived, and nothing
+ * could see them.
+ *
+ * ## What "every service" was allowed to mean (issue #122)
+ *
+ * The walk matched `**​/services/<file>.ts` — **one level, nothing else**. Over
+ * the tree that is **472 of 1152** module files: 680 were never opened, 78 of
+ * them containing a write signal. Invisible were `pim_ergonode/services/import/`,
+ * `product_feeds/services/delivery/` and `services/queues/` (nested a level too
+ * deep), every `workers/`, `queues/` and `jobs/` file, every `commands/` file,
+ * every `routes*.ts`, every `backend.ts` boot hook, every `scripts/` entry point
+ * and every `seeds/` reconciler. Queue consumers and admin route handlers are
+ * exactly where writes live, so the check read clean over the two categories
+ * Principle XIII is most about.
+ *
+ * The boundary is now **every `.ts` file under `src/modules/` and `src/apps/`**.
+ * Four exclusions remain, and each is an argument rather than an omission:
+ *
+ *   - `migrations/` — DDL applied by the migrator with no request, no actor and
+ *     no undo; an audit entry for one would have nobody to attribute it to. The
+ *     migration registry and `db:fresh` are its gate.
+ *   - `*.test.ts` / `*.d.ts` — not shipped code.
+ *   - `audit_logs/` — the audit writer itself. Its writes *are* the audit
+ *     entries; requiring one for each is circular.
+ *
+ * Everything else is judged, including `seeds/` and `scripts/`: a CLI entry
+ * point creating an administrator and a boot reconciler writing predefined rows
+ * are operator-visible writes that happen to run outside a request, and a
+ * category-wide exemption for them is the same mistake one folder over.
+ *
+ * ## Two narrowings the widening forced
+ *
+ * A wider walk meets shapes a `services/` file rarely has, and a check that
+ * answers them with exemptions is lying about the tree rather than reading it:
+ *
+ *   1. **`remove` is only an ORM mutation off an EntityManager.** 30 of the 36
+ *      first-pass findings were `deps.<x>Service.remove(id)` in a route handler
+ *      — a call into an audited service. Every other name in the vocabulary
+ *      (`persist`, `persistAndFlush`, `nativeUpdate`, `nativeDelete`,
+ *      `removeAndFlush`, `flush`) is MikroORM's alone and still counts off any
+ *      receiver. The **staleness half keeps counting `remove` everywhere**, so
+ *      the asymmetry above survives: the narrowing can only add a report, never
+ *      silence one.
+ *   2. **A route file is judged per handler.** `registerXAdminRoutes` is not a
+ *      unit of work; each handler is. Read as one unit, a single
+ *      `commandBus.run` anywhere in the file clears every other handler in it —
+ *      the masking the per-method rule exists to prevent, one level up. It also
+ *      manufactured two `double-audit` reports across handlers that never met.
+ *
+ * ## What this check cannot see, and will not pretend to (D-89b)
+ *
+ * This check reads **call** shapes. A field assignment on a managed entity —
+ * `order.status = ref`, `refund.settlementState = outcome.state` — is a write
+ * the unit of work will flush and this check cannot see it. The unit is judged
+ * by the calls it makes, so an assignment is caught only when the same unit also
+ * calls one of the vocabulary. A unit that assigns and lets its caller flush is
+ * outside the population, **by construction and not by exemption**.
+ *
+ * That is refused deliberately rather than deferred. The shapes are not
+ * separable by a static name test: `x.y = z` is the most common statement form
+ * in the language, `x` is a managed entity only when the type checker says so,
+ * and this check does not build a program. Reading every assignment as a
+ * candidate write would put a finding on most methods in the tree and teach
+ * people to write exemptions; reading none of them keeps the check's green
+ * honest — provided the green is read as what it is. So: a green
+ * `check:command-coverage --strict` means *"no unaudited sensitive write of a
+ * shape this check can see"*, and it does not mean *"every sensitive write is
+ * audited"*. It cannot be made to mean the second at anything like this cost.
+ *
+ * Scope & staging: build-breaks (exit 1) for **migrated modules**
+ * (`MIGRATED_MODULES`, in the repository-scope host, or `--module`); any other
+ * module would be report-only. The platform-wide rollout is COMPLETE and CI runs
+ * with `--strict`, so a finding in ANY module, including a brand-new one not yet
+ * in the list, fails the build.
+ *
+ * ## One analysis, two hosts
+ *
+ * This file is the analysis. `backend/scripts/check-command-coverage.ts` hosts it
+ * over this repository's module tree and owns the rollout ledger, which is a
+ * fact about *these* modules; `endora check` hosts it over one module package
+ * (`specs/101-endora-check/contracts/package-scope-layout.md` §6). A third-party
+ * package is in no rollout, so the package-scope host judges it strictly — which
+ * is what `--strict` already means here.
+ */
+export type FindingKind = 'unaudited-sensitive-write' | 'double-audit' | 'stale-ignore';
+export interface CoverageFinding {
+    filePath: string;
+    line: number | null;
+    method: string;
+    kind: FindingKind;
+    message: string;
+}
+/** Static, dependency-free per-method analysis of a single source file. */
+export declare function analyzeSource(filePath: string, source: string): CoverageFinding[];
+/** Whether a repo-relative module path belongs to a build-breaking (migrated) module. */
+export declare function isMigratedModulePath(relPath: string, migrated: readonly string[]): boolean;
+/**
+ * Registered modules {@link collectScannedFiles} excludes wholesale, so the
+ * population floor asks for the tree the check actually reads.
+ *
+ * One entry, and it is the argument in the header rather than a convenience:
+ * the audit writer's writes *are* the audit entries. Named here so the walk and
+ * the floor cannot disagree about it.
+ */
+export declare const EXCLUDED_MODULES: readonly string[];
+/**
+ * Directory names this rule's walk prunes wherever they occur under its root.
+ *
+ * `migrations` is the one that is a *rule* rather than a convenience: a
+ * migration is schema, not a service write, and judging one would put a finding
+ * on every table this platform creates.
+ *
+ * `test-support` is the second of that kind, and it arrived measured
+ * (`specs/134-paid-module-extraction/` T015). A module's test doubles and
+ * fixtures moved out of `backend/test/helpers/` into `src/test-support/`, which
+ * is inside this walk where the old location was outside it — so
+ * `seedXlInstallation()`, a fixture writer that has always existed, became an
+ * `unaudited-sensitive-write` on the day it moved and took `master` red in
+ * `moved-module-tree.test.ts` rather than in the check anybody had run. A
+ * fixture is not a service write for the same reason a migration is not: nothing
+ * an operator did is being recorded, and requiring a Command of one would put a
+ * finding on every seed in the tree. The layer is excluded exactly as
+ * `*.test.ts` is below, which is what it is — the test tree, one directory over.
+ */
+export declare const PRUNED_DIRECTORIES: readonly string[];
+/**
+ * Whether a file is in this rule's population — the **one** membership decision,
+ * asked by the walk and by anything that needs to know what the walk would open.
+ *
+ * It is one function called from two places on purpose, in the idiom
+ * `check-nul-bytes.ts` argues for in its own header: while the prune the walk
+ * does for speed and the rule the population states were two expressions of one
+ * predicate, one could go missing without the other noticing. The second caller
+ * is `endora check`'s package-scope floor, which has to know that a declared
+ * `./migrations` layer is **not** expected of this rule — otherwise a package
+ * that publishes migrations reports a short walk for a layer the rule excludes
+ * by design.
+ */
+export declare function isScannedPath(absolutePath: string, root: string): boolean;
+/**
+ * Every file the check judges, under `root` (`src/modules` or `src/apps`).
+ *
+ * Exported so the check's own test can assert the **real** tree is clean rather
+ * than only that the analyzer can go red on a fixture — the scan scope then has
+ * one definition, shared by the CLI and the test.
+ *
+ * The exclusions are argued in the header; each is a claim that the category
+ * cannot hold an operator-visible write, not a convenience.
+ */
+export declare function collectScannedFiles(root: string): string[];
+//# sourceMappingURL=command-coverage.d.ts.map

package/dist/rules/command-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-coverage.d.ts","sourceRoot":"","sources":["../../src/rules/command-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8IG;AA2IH,MAAM,MAAM,WAAW,GAAG,2BAA2B,GAAG,cAAc,GAAG,cAAc,CAAC;AAExF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAqTD,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE,CA+GjF;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAMT;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAmB,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAK/C,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAMzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAgB1D"}