@fedify/lint 2.4.0-dev.2155 → 2.4.0-dev.2159

package/deno.json

@@ -1,12 +1,13 @@
 {
   "name": "@fedify/lint",
-  "version": "2.4.0-dev.2155+2ccc5085",
+  "version": "2.4.0-dev.2159+bb072eda",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",
     "./oxlint": "./src/oxlint.ts"
   },
   "imports": {
+    "@fedify/fixture": "jsr:@fedify/fixture@^2.2.14",
     "eslint": "npm:eslint@^9.0.0",
     "estree": "npm:@types/estree@^1.0.8",
     "oxlint": "npm:oxlint@^1.66.0"

package/dist/index.cjs

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_outbox_listener_delivery_required = require("./outbox-listener-delivery-required-rhAvEA9G.cjs");
+const require_outbox_listener_delivery_required = require("./outbox-listener-delivery-required-Hs9elJlF.cjs");
 let _fxts_core = require("@fxts/core");
 let _typescript_eslint_parser = require("@typescript-eslint/parser");
 _typescript_eslint_parser = __toESM(_typescript_eslint_parser, 1);

package/dist/index.js

@@ -1,4 +1,4 @@
-import { A as name, C as eslint$5, D as eslint$11, E as eslint$10, O as eslint$21, S as eslint$4, T as eslint$13, _ as eslint$15, a as eslint$23, b as eslint$2, c as eslint$16, d as eslint$22, f as eslint$6, g as eslint$14, h as eslint$9, i as eslint$27, j as version, k as RULE_IDS, l as eslint$17, m as eslint$8, n as eslint$25, o as eslint$18, p as eslint$7, r as eslint$26, s as eslint$19, t as eslint$24, u as eslint$20, v as eslint$1, w as eslint$12, x as eslint$3, y as eslint } from "./outbox-listener-delivery-required-vNt3zM_a.js";
+import { A as name, C as eslint$5, D as eslint$11, E as eslint$10, O as eslint$21, S as eslint$4, T as eslint$13, _ as eslint$15, a as eslint$23, b as eslint$2, c as eslint$16, d as eslint$22, f as eslint$6, g as eslint$14, h as eslint$9, i as eslint$27, j as version, k as RULE_IDS, l as eslint$17, m as eslint$8, n as eslint$25, o as eslint$18, p as eslint$7, r as eslint$26, s as eslint$19, t as eslint$24, u as eslint$20, v as eslint$1, w as eslint$12, x as eslint$3, y as eslint } from "./outbox-listener-delivery-required-Cz_XWiEU.js";
 import { fromEntries, keys, map, pipe } from "@fxts/core";
 import parser from "@typescript-eslint/parser";
 //#region src/index.ts

package/dist/{outbox-listener-delivery-required-vNt3zM_a.js → outbox-listener-delivery-required-Cz_XWiEU.js}

@@ -1,7 +1,7 @@
 import { always, every, head, isEmpty, isObject, negate, pipe, pipeLazy, prop, some, toArray, unless, when } from "@fxts/core";
 //#region deno.json
 var name = "@fedify/lint";
-var version = "2.4.0-dev.2155+2ccc5085";
+var version = "2.4.0-dev.2159+bb072eda";
 //#endregion
 //#region src/lib/const.ts
 /**
@@ -621,7 +621,7 @@ const eslint$4 = {
 //#endregion
 //#region src/rules/media-uploader-authorization-required.ts
 const MESSAGE$3 = "setMediaUploader() should be protected with .authorize(); without it the endpoint accepts uploads from anyone who can reach the URL.  Add .authorize() unless a public upload endpoint is intended.";
-function getParent(node) {
+function getParent$1(node) {
 	if (node == null || typeof node !== "object") return null;
 	const parent = node.parent;
 	return isNode(parent) ? parent : null;
@@ -631,11 +631,11 @@ function getParent(node) {
 * `.authorize(...)`, i.e. `federation.setMediaUploader(...).authorize(...)`.
 */
 function isDirectlyAuthorized(callNode) {
-	const member = getParent(callNode);
+	const member = getParent$1(callNode);
 	if (member == null || member.type !== "MemberExpression" || member.computed === true) return false;
 	const property = member.property;
 	if (!isNode(property) || property.type !== "Identifier" || property.name !== "authorize") return false;
-	const call = getParent(member);
+	const call = getParent$1(member);
 	return call != null && call.type === "CallExpression" && call.callee === member;
 }
 function createRule$3(buildReport) {
@@ -653,7 +653,7 @@ function createRule$3(buildReport) {
 				}
 				if (!hasMemberExpressionCallee(node) || !hasIdentifierProperty(node) || !hasMethodName("setMediaUploader")(node) || !federationTracker.isFederationObject(node.callee.object)) return;
 				if (isDirectlyAuthorized(node)) return;
-				const parent = getParent(node);
+				const parent = getParent$1(node);
 				let varName = null;
 				if (parent != null && parent.type === "VariableDeclarator") {
 					const id = parent.id;
@@ -692,7 +692,7 @@ const eslint$3 = {
 //#region src/rules/media-uploader-object-uri-required.ts
 const MESSAGE$2 = "setMediaUploader() callbacks should return a value derived from ctx.getObjectUri(): either return ctx.getObjectUri(...) directly, or an object whose id is ctx.getObjectUri(...).";
 const GETTER_NAME = "getObjectUri";
-const getMemberPropertyName$1 = (node) => {
+const getMemberPropertyName$2 = (node) => {
 	if (node.type !== "MemberExpression") return null;
 	const property = node.property;
 	if (property.type === "Identifier") return property.name;
@@ -722,7 +722,7 @@ const resolveCallbackReference = (expr, bindings, seen = /* @__PURE__ */ new Set
 	if (expr.type === "MemberExpression" && expr.object.type === "Identifier" && !expr.computed) {
 		const binding = bindings.get(expr.object.name);
 		if (binding == null || !isNode(binding) || binding.type !== "ObjectExpression") return null;
-		const propertyName = getMemberPropertyName$1(expr);
+		const propertyName = getMemberPropertyName$2(expr);
 		if (propertyName == null) return null;
 		for (const prop of binding.properties) {
 			if (!isNode(prop) || prop.type !== "Property") continue;
@@ -815,7 +815,7 @@ function toNode(value) {
 function isPromiseResolveCall(expr) {
 	if (expr.type !== "CallExpression") return false;
 	const callee = toNode(expr.callee);
-	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$1(callee) !== "resolve") return false;
+	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$2(callee) !== "resolve") return false;
 	const object = toNode(callee.object);
 	return object != null && object.type === "Identifier" && object.name === "Promise";
 }
@@ -846,7 +846,7 @@ function isGetObjectUriCall(expr, ctx) {
 	if (expr.type !== "CallExpression") return false;
 	if (ctx.ctxName == null) return false;
 	const callee = toNode(expr.callee);
-	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$1(callee) !== GETTER_NAME) return false;
+	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$2(callee) !== GETTER_NAME) return false;
 	const object = unwrapExpression(callee.object);
 	return object != null && object.type === "Identifier" && object.name === ctx.ctxName;
 }
@@ -1012,23 +1012,23 @@ const eslint$2 = {
 };
 //#endregion
 //#region src/lib/outbox-listener.ts
-const DELIVERY_METHOD_NAMES = /* @__PURE__ */ new Set(["sendActivity", "forwardActivity"]);
-const isChainedFromOutboxListeners = (expr, federationTracker) => {
+const DELIVERY_METHOD_NAMES$1 = /* @__PURE__ */ new Set(["sendActivity", "forwardActivity"]);
+const isChainedFromOutboxListeners$1 = (expr, federationTracker) => {
 	if (expr.type !== "CallExpression") return false;
 	if (!hasMemberExpressionCallee(expr) || !hasIdentifierProperty(expr)) return false;
 	const methodName = expr.callee.property.name;
 	if (methodName === "setOutboxListeners") return federationTracker.isFederationObject(expr.callee.object);
-	if (methodName === "authorize" || methodName === "onError" || methodName === "on") return isChainedFromOutboxListeners(expr.callee.object, federationTracker);
+	if (methodName === "authorize" || methodName === "onError" || methodName === "on") return isChainedFromOutboxListeners$1(expr.callee.object, federationTracker);
 	return false;
 };
-const getMemberPropertyName = (expr) => {
+const getMemberPropertyName$1 = (expr) => {
 	if (expr.type !== "MemberExpression") return null;
 	const property = expr.property;
 	if (property.type === "Identifier") return property.name;
 	if (property.type === "Literal" && typeof property.value === "string") return property.value;
 	return null;
 };
-function unwrapContextParam(node) {
+function unwrapContextParam$1(node) {
 	let current = node ?? null;
 	while (current?.type === "AssignmentPattern") current = current.left;
 	return current;
@@ -1054,7 +1054,7 @@ const resolveFunctionBinding = (expr, bindings, seen = /* @__PURE__ */ new Set()
 	if (expr.type === "MemberExpression" && expr.object.type === "Identifier" && !expr.computed) {
 		const binding = bindings.get(expr.object.name);
 		if (binding == null || !isNode(binding) || binding.type !== "ObjectExpression") return null;
-		const propertyName = getMemberPropertyName(expr);
+		const propertyName = getMemberPropertyName$1(expr);
 		if (propertyName == null) return null;
 		for (const prop of binding.properties) {
 			if (!isNode(prop) || prop.type !== "Property") continue;
@@ -1078,7 +1078,7 @@ function createOutboxListenerVisitor(onListener) {
 	const pendingCalls = [];
 	const inspectCall = (node) => {
 		if (!hasMemberExpressionCallee(node) || !hasIdentifierProperty(node) || !hasMethodName("on")(node) || node.arguments.length < 2) return;
-		if (!isChainedFromOutboxListeners(node.callee.object, federationTracker)) return;
+		if (!isChainedFromOutboxListeners$1(node.callee.object, federationTracker)) return;
 		const listener = node.arguments[1];
 		const resolvedListener = isNode(listener) && isFunction(listener) ? listener : isNode(listener) ? resolveFunctionBinding(listener, bindings) : null;
 		if (resolvedListener == null) return;
@@ -1737,7 +1737,7 @@ function deliveryAliasesOf(pattern, out) {
 		if (prop.type !== "Property") continue;
 		const key = asNode(get(prop, "key"));
 		const keyName = key?.type === "Identifier" ? key.name : key?.type === "Literal" && typeof key.value === "string" ? key.value : null;
-		if (keyName == null || !DELIVERY_METHOD_NAMES.has(keyName)) continue;
+		if (keyName == null || !DELIVERY_METHOD_NAMES$1.has(keyName)) continue;
 		const value = asNode(get(prop, "value"));
 		if (value?.type === "Identifier") out.add(value.name);
 		else if (value?.type === "AssignmentPattern") {
@@ -1755,7 +1755,7 @@ function deliveryAliasesOf(pattern, out) {
 */
 function findDeliveryTargets(listener, scopes) {
 	const aliases = /* @__PURE__ */ new Set();
-	const contextParam = unwrapContextParam(listener.params[0]);
+	const contextParam = unwrapContextParam$1(listener.params[0]);
 	const contextName = contextParam?.type === "Identifier" ? contextParam.name : null;
 	if (contextParam != null) deliveryAliasesOf(contextParam, aliases);
 	if (contextName != null) for (const scope of scopes) for (const statement of scope.statements) visitAll(statement, (node) => {
@@ -1771,7 +1771,7 @@ function findDeliveryTargets(listener, scopes) {
 		if (id.type !== "Identifier" || source.type !== "MemberExpression") return;
 		const object = unwrap(asNode(get(source, "object")) ?? source);
 		const name = memberName(source);
-		if (object.type === "Identifier" && object.name === contextName && name != null && DELIVERY_METHOD_NAMES.has(name)) aliases.add(id.name);
+		if (object.type === "Identifier" && object.name === contextName && name != null && DELIVERY_METHOD_NAMES$1.has(name)) aliases.add(id.name);
 	}, false);
 	return {
 		contextName,
@@ -1929,7 +1929,7 @@ function checkListener(listener, report) {
 		const callee = unwrap(call.callee);
 		if (callee.type === "MemberExpression") {
 			const name = memberName(callee);
-			if (name == null || !DELIVERY_METHOD_NAMES.has(name)) return false;
+			if (name == null || !DELIVERY_METHOD_NAMES$1.has(name)) return false;
 			const object = unwrap(asNode(get(callee, "object")) ?? callee);
 			return object.type === "Identifier" && object.name === targets.contextName;
 		}
@@ -2012,6 +2012,122 @@ const eslint$1 = {
 //#endregion
 //#region src/rules/outbox-listener-delivery-required.ts
 const MESSAGE = "Outbox listeners should deliver posted activities explicitly with ctx.sendActivity() or ctx.forwardActivity().";
+const isChainedFromOutboxListeners = (expr, federationTracker) => {
+	if (expr.type !== "CallExpression") return false;
+	if (!hasMemberExpressionCallee(expr) || !hasIdentifierProperty(expr)) return false;
+	const methodName = expr.callee.property.name;
+	if (methodName === "setOutboxListeners") return federationTracker.isFederationObject(expr.callee.object);
+	if (methodName === "authorize" || methodName === "onError" || methodName === "on") return isChainedFromOutboxListeners(expr.callee.object, federationTracker);
+	return false;
+};
+const DELIVERY_METHOD_NAMES = /* @__PURE__ */ new Set(["sendActivity", "forwardActivity"]);
+const getMemberPropertyName = (expr) => {
+	if (expr.type !== "MemberExpression") return null;
+	const property = expr.property;
+	if (property.type === "Identifier" && !expr.computed) return property.name;
+	if (property.type === "Literal" && typeof property.value === "string") return property.value;
+	return null;
+};
+function unwrapContextParam(node) {
+	let current = node ?? null;
+	while (current?.type === "AssignmentPattern") current = current.left;
+	return current;
+}
+const getParent = (node) => node.parent ?? null;
+const isFunctionLike = (node) => node.type === "FunctionDeclaration" || isFunction(node);
+function bindPattern(node, bindings) {
+	switch (node.type) {
+		case "Identifier":
+			bindings.set(node.name, { value: null });
+			break;
+		case "AssignmentPattern":
+			bindPattern(node.left, bindings);
+			break;
+		case "RestElement":
+			bindPattern(node.argument, bindings);
+			break;
+		case "ObjectPattern":
+			for (const property of node.properties) bindPattern(property.type === "Property" ? property.value : property, bindings);
+			break;
+		case "ArrayPattern":
+			for (const element of node.elements) if (element != null) bindPattern(element, bindings);
+			break;
+	}
+}
+function createBindingIndex() {
+	const scopes = /* @__PURE__ */ new Map();
+	const scopeBindings = (scope) => {
+		let bindings = scopes.get(scope);
+		if (bindings == null) {
+			bindings = /* @__PURE__ */ new Map();
+			scopes.set(scope, bindings);
+			if (isFunctionLike(scope)) {
+				if (scope.type === "FunctionExpression" && scope.id != null) bindings.set(scope.id.name, { value: scope });
+				for (const param of scope.params) bindPattern(param, bindings);
+			}
+			if (scope.type === "ClassExpression" && scope.id != null) bindings.set(scope.id.name, { value: null });
+			if (scope.type === "CatchClause" && scope.param != null) bindPattern(scope.param, bindings);
+		}
+		return bindings;
+	};
+	const enclosingScope = (node, functionScope = false) => {
+		let scope = getParent(node);
+		while (scope.type !== "Program" && scope.type !== "StaticBlock" && scope.type !== "TSModuleBlock" && !isFunctionLike(scope) && (functionScope || ![
+			"BlockStatement",
+			"ForStatement",
+			"ForInStatement",
+			"ForOfStatement",
+			"SwitchStatement",
+			"CatchClause"
+		].includes(scope.type))) scope = getParent(scope);
+		return scope;
+	};
+	const lookup = (node, name) => {
+		for (let scope = node; scope != null; scope = getParent(scope)) {
+			const binding = scopeBindings(scope).get(name);
+			if (binding != null) return binding;
+		}
+		return null;
+	};
+	return {
+		lookup,
+		declare(node, pattern, value, hoisted = false) {
+			const bindings = scopeBindings(enclosingScope(node, hoisted));
+			if (pattern.type === "Identifier") {
+				if (hoisted && value == null && bindings.has(pattern.name)) return;
+				if (node.type === "FunctionDeclaration" && bindings.get(pattern.name)?.initializedVariable) return;
+				bindings.set(pattern.name, {
+					value,
+					initializedVariable: node.type === "VariableDeclarator" && value != null
+				});
+			} else bindPattern(pattern, bindings);
+		}
+	};
+}
+const resolveBindingValue = (expr, bindings, seen = /* @__PURE__ */ new Set()) => {
+	if (expr.type !== "Identifier") return expr;
+	const binding = bindings.lookup(expr, expr.name);
+	if (binding == null || binding.value == null || seen.has(binding)) return null;
+	seen.add(binding);
+	return resolveBindingValue(binding.value, bindings, seen);
+};
+const resolveListenerReference = (expr, bindings) => {
+	const target = resolveBindingValue(expr, bindings);
+	if (target == null) return null;
+	if (isFunctionLike(target)) return target;
+	if (target.type !== "MemberExpression") return null;
+	const object = resolveBindingValue(target.object, bindings);
+	if (object?.type !== "ObjectExpression") return null;
+	const propertyName = getMemberPropertyName(target);
+	if (propertyName == null) return null;
+	for (const prop of object.properties) {
+		if (prop.type !== "Property") continue;
+		if ((prop.key.type === "Identifier" && !prop.computed ? prop.key.name : prop.key.type === "Literal" && typeof prop.key.value === "string" ? prop.key.value : null) !== propertyName) continue;
+		const value = resolveBindingValue(prop.value, bindings);
+		if (value != null && isFunctionLike(value)) return value;
+	}
+	return null;
+};
 function escapeRegExp(value) {
 	return value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -2177,11 +2293,52 @@ function collectDeliveryScanCode(sourceCode, root, used, visited) {
 		return result;
 	}).join("\n");
 }
-const listenerCallsDeliveryMethod = (sourceCode, listener) => {
+function unwrapArgument(node) {
+	while (node.type === "TSAsExpression" || node.type === "TSTypeAssertion" || node.type === "TSNonNullExpression") node = node.expression;
+	return node;
+}
+function functionCallsDelivery(sourceCode, listener, bindings, calls, contextIndex = 0, visited = /* @__PURE__ */ new Map()) {
+	let indices = visited.get(listener);
+	if (indices?.has(contextIndex)) return false;
+	if (indices == null) visited.set(listener, indices = /* @__PURE__ */ new Set());
+	indices.add(contextIndex);
+	if (listenerCallsDeliveryMethod(sourceCode, listener, contextIndex)) return true;
+	const param = unwrapContextParam(listener.params[contextIndex]);
+	if (param?.type !== "Identifier") return false;
+	const contextBinding = bindings.lookup(listener, param.name);
+	const reachable = [];
+	collectReachableStatements(listener.body, reachable);
+	for (const call of calls) {
+		let child = call;
+		let owner = getParent(child);
+		while (owner != null && !isFunctionLike(owner)) {
+			const field = owner;
+			if ((field.type === "PropertyDefinition" || field.type === "AccessorProperty") && !field.static && field.value === child) break;
+			child = owner;
+			owner = getParent(owner);
+		}
+		if (owner !== listener) continue;
+		const [callStart, callEnd] = getRange(call);
+		if (!reachable.some((statement) => {
+			const [start, end] = getRange(statement);
+			return start <= callStart && callEnd <= end;
+		})) continue;
+		const helper = resolveListenerReference(call.callee, bindings);
+		if (helper == null || "generator" in helper && helper.generator) continue;
+		for (const [index, argument] of call.arguments.entries()) {
+			if (argument.type === "SpreadElement") break;
+			const arg = unwrapArgument(argument);
+			if (arg.type !== "Identifier" || arg.name !== param.name || bindings.lookup(arg, arg.name) !== contextBinding || helper.params[index]?.type === "RestElement") continue;
+			if (functionCallsDelivery(sourceCode, helper, bindings, calls, index, visited)) return true;
+		}
+	}
+	return false;
+}
+const listenerCallsDeliveryMethod = (sourceCode, listener, contextIndex = 0) => {
 	const used = computeUsedFunctions(listener.body);
 	const code = stripCommentsAndStrings(collectDeliveryScanCode(sourceCode, listener.body, used, /* @__PURE__ */ new Set()));
 	const aliases = /* @__PURE__ */ new Set();
-	const contextParam = unwrapContextParam(listener.params[0]);
+	const contextParam = unwrapContextParam(listener.params[contextIndex]);
 	const contextName = contextParam?.type === "Identifier" ? contextParam.name : null;
 	if (contextParam?.type === "ObjectPattern") for (const prop of contextParam.properties) {
 		if (!isNode(prop) || prop.type !== "Property") continue;
@@ -2209,14 +2366,48 @@ const listenerCallsDeliveryMethod = (sourceCode, listener) => {
 };
 function createRule(buildReport) {
 	return (context) => {
+		const federationTracker = trackFederationVariables();
+		const bindings = createBindingIndex();
+		const pendingCalls = [];
 		const sourceCode = context.sourceCode;
-		return createOutboxListenerVisitor((listener) => {
-			if (listenerCallsDeliveryMethod(sourceCode, listener)) return;
+		const inspectCall = (node) => {
+			if (!hasMemberExpressionCallee(node) || !hasIdentifierProperty(node) || !hasMethodName("on")(node) || node.arguments.length < 2) return;
+			if (!isChainedFromOutboxListeners(node.callee.object, federationTracker)) return;
+			const listener = node.arguments[1];
+			const resolvedListener = isNode(listener) && isFunction(listener) ? listener : isNode(listener) ? resolveListenerReference(listener, bindings) : null;
+			if (resolvedListener == null) return;
+			if (functionCallsDelivery(sourceCode, resolvedListener, bindings, pendingCalls)) return;
 			context.report({
-				node: listener,
+				node: resolvedListener,
 				...buildReport
 			});
-		});
+		};
+		return {
+			VariableDeclarator(node) {
+				federationTracker.VariableDeclarator(node);
+				const declaration = getParent(node);
+				bindings.declare(node, node.id, node.init, declaration?.kind === "var");
+			},
+			FunctionDeclaration(node) {
+				if (node.id == null) return;
+				const parent = getParent(node);
+				const owner = parent == null ? null : getParent(parent);
+				const inVarBody = parent?.type === "BlockStatement" && owner != null && (owner.type === "StaticBlock" || isFunctionLike(owner) && owner.body === parent);
+				bindings.declare(node, node.id, node, inVarBody);
+			},
+			ImportDeclaration(node) {
+				for (const specifier of node.specifiers) bindings.declare(node, specifier.local, null);
+			},
+			ClassDeclaration(node) {
+				if (node.id != null) bindings.declare(node, node.id, null);
+			},
+			CallExpression(node) {
+				pendingCalls.push(node);
+			},
+			"Program:exit"() {
+				for (const node of pendingCalls) inspectCall(node);
+			}
+		};
 	};
 }
 const eslint = {

package/dist/{outbox-listener-delivery-required-rhAvEA9G.cjs → outbox-listener-delivery-required-Hs9elJlF.cjs}

@@ -1,7 +1,7 @@
 let _fxts_core = require("@fxts/core");
 //#region deno.json
 var name = "@fedify/lint";
-var version = "2.4.0-dev.2155+2ccc5085";
+var version = "2.4.0-dev.2159+bb072eda";
 //#endregion
 //#region src/lib/const.ts
 /**
@@ -621,7 +621,7 @@ const eslint$4 = {
 //#endregion
 //#region src/rules/media-uploader-authorization-required.ts
 const MESSAGE$3 = "setMediaUploader() should be protected with .authorize(); without it the endpoint accepts uploads from anyone who can reach the URL.  Add .authorize() unless a public upload endpoint is intended.";
-function getParent(node) {
+function getParent$1(node) {
 	if (node == null || typeof node !== "object") return null;
 	const parent = node.parent;
 	return isNode(parent) ? parent : null;
@@ -631,11 +631,11 @@ function getParent(node) {
 * `.authorize(...)`, i.e. `federation.setMediaUploader(...).authorize(...)`.
 */
 function isDirectlyAuthorized(callNode) {
-	const member = getParent(callNode);
+	const member = getParent$1(callNode);
 	if (member == null || member.type !== "MemberExpression" || member.computed === true) return false;
 	const property = member.property;
 	if (!isNode(property) || property.type !== "Identifier" || property.name !== "authorize") return false;
-	const call = getParent(member);
+	const call = getParent$1(member);
 	return call != null && call.type === "CallExpression" && call.callee === member;
 }
 function createRule$3(buildReport) {
@@ -653,7 +653,7 @@ function createRule$3(buildReport) {
 				}
 				if (!hasMemberExpressionCallee(node) || !hasIdentifierProperty(node) || !hasMethodName("setMediaUploader")(node) || !federationTracker.isFederationObject(node.callee.object)) return;
 				if (isDirectlyAuthorized(node)) return;
-				const parent = getParent(node);
+				const parent = getParent$1(node);
 				let varName = null;
 				if (parent != null && parent.type === "VariableDeclarator") {
 					const id = parent.id;
@@ -692,7 +692,7 @@ const eslint$3 = {
 //#region src/rules/media-uploader-object-uri-required.ts
 const MESSAGE$2 = "setMediaUploader() callbacks should return a value derived from ctx.getObjectUri(): either return ctx.getObjectUri(...) directly, or an object whose id is ctx.getObjectUri(...).";
 const GETTER_NAME = "getObjectUri";
-const getMemberPropertyName$1 = (node) => {
+const getMemberPropertyName$2 = (node) => {
 	if (node.type !== "MemberExpression") return null;
 	const property = node.property;
 	if (property.type === "Identifier") return property.name;
@@ -722,7 +722,7 @@ const resolveCallbackReference = (expr, bindings, seen = /* @__PURE__ */ new Set
 	if (expr.type === "MemberExpression" && expr.object.type === "Identifier" && !expr.computed) {
 		const binding = bindings.get(expr.object.name);
 		if (binding == null || !isNode(binding) || binding.type !== "ObjectExpression") return null;
-		const propertyName = getMemberPropertyName$1(expr);
+		const propertyName = getMemberPropertyName$2(expr);
 		if (propertyName == null) return null;
 		for (const prop of binding.properties) {
 			if (!isNode(prop) || prop.type !== "Property") continue;
@@ -815,7 +815,7 @@ function toNode(value) {
 function isPromiseResolveCall(expr) {
 	if (expr.type !== "CallExpression") return false;
 	const callee = toNode(expr.callee);
-	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$1(callee) !== "resolve") return false;
+	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$2(callee) !== "resolve") return false;
 	const object = toNode(callee.object);
 	return object != null && object.type === "Identifier" && object.name === "Promise";
 }
@@ -846,7 +846,7 @@ function isGetObjectUriCall(expr, ctx) {
 	if (expr.type !== "CallExpression") return false;
 	if (ctx.ctxName == null) return false;
 	const callee = toNode(expr.callee);
-	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$1(callee) !== GETTER_NAME) return false;
+	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$2(callee) !== GETTER_NAME) return false;
 	const object = unwrapExpression(callee.object);
 	return object != null && object.type === "Identifier" && object.name === ctx.ctxName;
 }
@@ -1012,23 +1012,23 @@ const eslint$2 = {
 };
 //#endregion
 //#region src/lib/outbox-listener.ts
-const DELIVERY_METHOD_NAMES = /* @__PURE__ */ new Set(["sendActivity", "forwardActivity"]);
-const isChainedFromOutboxListeners = (expr, federationTracker) => {
+const DELIVERY_METHOD_NAMES$1 = /* @__PURE__ */ new Set(["sendActivity", "forwardActivity"]);
+const isChainedFromOutboxListeners$1 = (expr, federationTracker) => {
 	if (expr.type !== "CallExpression") return false;
 	if (!hasMemberExpressionCallee(expr) || !hasIdentifierProperty(expr)) return false;
 	const methodName = expr.callee.property.name;
 	if (methodName === "setOutboxListeners") return federationTracker.isFederationObject(expr.callee.object);
-	if (methodName === "authorize" || methodName === "onError" || methodName === "on") return isChainedFromOutboxListeners(expr.callee.object, federationTracker);
+	if (methodName === "authorize" || methodName === "onError" || methodName === "on") return isChainedFromOutboxListeners$1(expr.callee.object, federationTracker);
 	return false;
 };
-const getMemberPropertyName = (expr) => {
+const getMemberPropertyName$1 = (expr) => {
 	if (expr.type !== "MemberExpression") return null;
 	const property = expr.property;
 	if (property.type === "Identifier") return property.name;
 	if (property.type === "Literal" && typeof property.value === "string") return property.value;
 	return null;
 };
-function unwrapContextParam(node) {
+function unwrapContextParam$1(node) {
 	let current = node ?? null;
 	while (current?.type === "AssignmentPattern") current = current.left;
 	return current;
@@ -1054,7 +1054,7 @@ const resolveFunctionBinding = (expr, bindings, seen = /* @__PURE__ */ new Set()
 	if (expr.type === "MemberExpression" && expr.object.type === "Identifier" && !expr.computed) {
 		const binding = bindings.get(expr.object.name);
 		if (binding == null || !isNode(binding) || binding.type !== "ObjectExpression") return null;
-		const propertyName = getMemberPropertyName(expr);
+		const propertyName = getMemberPropertyName$1(expr);
 		if (propertyName == null) return null;
 		for (const prop of binding.properties) {
 			if (!isNode(prop) || prop.type !== "Property") continue;
@@ -1078,7 +1078,7 @@ function createOutboxListenerVisitor(onListener) {
 	const pendingCalls = [];
 	const inspectCall = (node) => {
 		if (!hasMemberExpressionCallee(node) || !hasIdentifierProperty(node) || !hasMethodName("on")(node) || node.arguments.length < 2) return;
-		if (!isChainedFromOutboxListeners(node.callee.object, federationTracker)) return;
+		if (!isChainedFromOutboxListeners$1(node.callee.object, federationTracker)) return;
 		const listener = node.arguments[1];
 		const resolvedListener = isNode(listener) && isFunction(listener) ? listener : isNode(listener) ? resolveFunctionBinding(listener, bindings) : null;
 		if (resolvedListener == null) return;
@@ -1737,7 +1737,7 @@ function deliveryAliasesOf(pattern, out) {
 		if (prop.type !== "Property") continue;
 		const key = asNode(get(prop, "key"));
 		const keyName = key?.type === "Identifier" ? key.name : key?.type === "Literal" && typeof key.value === "string" ? key.value : null;
-		if (keyName == null || !DELIVERY_METHOD_NAMES.has(keyName)) continue;
+		if (keyName == null || !DELIVERY_METHOD_NAMES$1.has(keyName)) continue;
 		const value = asNode(get(prop, "value"));
 		if (value?.type === "Identifier") out.add(value.name);
 		else if (value?.type === "AssignmentPattern") {
@@ -1755,7 +1755,7 @@ function deliveryAliasesOf(pattern, out) {
 */
 function findDeliveryTargets(listener, scopes) {
 	const aliases = /* @__PURE__ */ new Set();
-	const contextParam = unwrapContextParam(listener.params[0]);
+	const contextParam = unwrapContextParam$1(listener.params[0]);
 	const contextName = contextParam?.type === "Identifier" ? contextParam.name : null;
 	if (contextParam != null) deliveryAliasesOf(contextParam, aliases);
 	if (contextName != null) for (const scope of scopes) for (const statement of scope.statements) visitAll(statement, (node) => {
@@ -1771,7 +1771,7 @@ function findDeliveryTargets(listener, scopes) {
 		if (id.type !== "Identifier" || source.type !== "MemberExpression") return;
 		const object = unwrap(asNode(get(source, "object")) ?? source);
 		const name = memberName(source);
-		if (object.type === "Identifier" && object.name === contextName && name != null && DELIVERY_METHOD_NAMES.has(name)) aliases.add(id.name);
+		if (object.type === "Identifier" && object.name === contextName && name != null && DELIVERY_METHOD_NAMES$1.has(name)) aliases.add(id.name);
 	}, false);
 	return {
 		contextName,
@@ -1929,7 +1929,7 @@ function checkListener(listener, report) {
 		const callee = unwrap(call.callee);
 		if (callee.type === "MemberExpression") {
 			const name = memberName(callee);
-			if (name == null || !DELIVERY_METHOD_NAMES.has(name)) return false;
+			if (name == null || !DELIVERY_METHOD_NAMES$1.has(name)) return false;
 			const object = unwrap(asNode(get(callee, "object")) ?? callee);
 			return object.type === "Identifier" && object.name === targets.contextName;
 		}
@@ -2012,6 +2012,122 @@ const eslint$1 = {
 //#endregion
 //#region src/rules/outbox-listener-delivery-required.ts
 const MESSAGE = "Outbox listeners should deliver posted activities explicitly with ctx.sendActivity() or ctx.forwardActivity().";
+const isChainedFromOutboxListeners = (expr, federationTracker) => {
+	if (expr.type !== "CallExpression") return false;
+	if (!hasMemberExpressionCallee(expr) || !hasIdentifierProperty(expr)) return false;
+	const methodName = expr.callee.property.name;
+	if (methodName === "setOutboxListeners") return federationTracker.isFederationObject(expr.callee.object);
+	if (methodName === "authorize" || methodName === "onError" || methodName === "on") return isChainedFromOutboxListeners(expr.callee.object, federationTracker);
+	return false;
+};
+const DELIVERY_METHOD_NAMES = /* @__PURE__ */ new Set(["sendActivity", "forwardActivity"]);
+const getMemberPropertyName = (expr) => {
+	if (expr.type !== "MemberExpression") return null;
+	const property = expr.property;
+	if (property.type === "Identifier" && !expr.computed) return property.name;
+	if (property.type === "Literal" && typeof property.value === "string") return property.value;
+	return null;
+};
+function unwrapContextParam(node) {
+	let current = node ?? null;
+	while (current?.type === "AssignmentPattern") current = current.left;
+	return current;
+}
+const getParent = (node) => node.parent ?? null;
+const isFunctionLike = (node) => node.type === "FunctionDeclaration" || isFunction(node);
+function bindPattern(node, bindings) {
+	switch (node.type) {
+		case "Identifier":
+			bindings.set(node.name, { value: null });
+			break;
+		case "AssignmentPattern":
+			bindPattern(node.left, bindings);
+			break;
+		case "RestElement":
+			bindPattern(node.argument, bindings);
+			break;
+		case "ObjectPattern":
+			for (const property of node.properties) bindPattern(property.type === "Property" ? property.value : property, bindings);
+			break;
+		case "ArrayPattern":
+			for (const element of node.elements) if (element != null) bindPattern(element, bindings);
+			break;
+	}
+}
+function createBindingIndex() {
+	const scopes = /* @__PURE__ */ new Map();
+	const scopeBindings = (scope) => {
+		let bindings = scopes.get(scope);
+		if (bindings == null) {
+			bindings = /* @__PURE__ */ new Map();
+			scopes.set(scope, bindings);
+			if (isFunctionLike(scope)) {
+				if (scope.type === "FunctionExpression" && scope.id != null) bindings.set(scope.id.name, { value: scope });
+				for (const param of scope.params) bindPattern(param, bindings);
+			}
+			if (scope.type === "ClassExpression" && scope.id != null) bindings.set(scope.id.name, { value: null });
+			if (scope.type === "CatchClause" && scope.param != null) bindPattern(scope.param, bindings);
+		}
+		return bindings;
+	};
+	const enclosingScope = (node, functionScope = false) => {
+		let scope = getParent(node);
+		while (scope.type !== "Program" && scope.type !== "StaticBlock" && scope.type !== "TSModuleBlock" && !isFunctionLike(scope) && (functionScope || ![
+			"BlockStatement",
+			"ForStatement",
+			"ForInStatement",
+			"ForOfStatement",
+			"SwitchStatement",
+			"CatchClause"
+		].includes(scope.type))) scope = getParent(scope);
+		return scope;
+	};
+	const lookup = (node, name) => {
+		for (let scope = node; scope != null; scope = getParent(scope)) {
+			const binding = scopeBindings(scope).get(name);
+			if (binding != null) return binding;
+		}
+		return null;
+	};
+	return {
+		lookup,
+		declare(node, pattern, value, hoisted = false) {
+			const bindings = scopeBindings(enclosingScope(node, hoisted));
+			if (pattern.type === "Identifier") {
+				if (hoisted && value == null && bindings.has(pattern.name)) return;
+				if (node.type === "FunctionDeclaration" && bindings.get(pattern.name)?.initializedVariable) return;
+				bindings.set(pattern.name, {
+					value,
+					initializedVariable: node.type === "VariableDeclarator" && value != null
+				});
+			} else bindPattern(pattern, bindings);
+		}
+	};
+}
+const resolveBindingValue = (expr, bindings, seen = /* @__PURE__ */ new Set()) => {
+	if (expr.type !== "Identifier") return expr;
+	const binding = bindings.lookup(expr, expr.name);
+	if (binding == null || binding.value == null || seen.has(binding)) return null;
+	seen.add(binding);
+	return resolveBindingValue(binding.value, bindings, seen);
+};
+const resolveListenerReference = (expr, bindings) => {
+	const target = resolveBindingValue(expr, bindings);
+	if (target == null) return null;
+	if (isFunctionLike(target)) return target;
+	if (target.type !== "MemberExpression") return null;
+	const object = resolveBindingValue(target.object, bindings);
+	if (object?.type !== "ObjectExpression") return null;
+	const propertyName = getMemberPropertyName(target);
+	if (propertyName == null) return null;
+	for (const prop of object.properties) {
+		if (prop.type !== "Property") continue;
+		if ((prop.key.type === "Identifier" && !prop.computed ? prop.key.name : prop.key.type === "Literal" && typeof prop.key.value === "string" ? prop.key.value : null) !== propertyName) continue;
+		const value = resolveBindingValue(prop.value, bindings);
+		if (value != null && isFunctionLike(value)) return value;
+	}
+	return null;
+};
 function escapeRegExp(value) {
 	return value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -2177,11 +2293,52 @@ function collectDeliveryScanCode(sourceCode, root, used, visited) {
 		return result;
 	}).join("\n");
 }
-const listenerCallsDeliveryMethod = (sourceCode, listener) => {
+function unwrapArgument(node) {
+	while (node.type === "TSAsExpression" || node.type === "TSTypeAssertion" || node.type === "TSNonNullExpression") node = node.expression;
+	return node;
+}
+function functionCallsDelivery(sourceCode, listener, bindings, calls, contextIndex = 0, visited = /* @__PURE__ */ new Map()) {
+	let indices = visited.get(listener);
+	if (indices?.has(contextIndex)) return false;
+	if (indices == null) visited.set(listener, indices = /* @__PURE__ */ new Set());
+	indices.add(contextIndex);
+	if (listenerCallsDeliveryMethod(sourceCode, listener, contextIndex)) return true;
+	const param = unwrapContextParam(listener.params[contextIndex]);
+	if (param?.type !== "Identifier") return false;
+	const contextBinding = bindings.lookup(listener, param.name);
+	const reachable = [];
+	collectReachableStatements(listener.body, reachable);
+	for (const call of calls) {
+		let child = call;
+		let owner = getParent(child);
+		while (owner != null && !isFunctionLike(owner)) {
+			const field = owner;
+			if ((field.type === "PropertyDefinition" || field.type === "AccessorProperty") && !field.static && field.value === child) break;
+			child = owner;
+			owner = getParent(owner);
+		}
+		if (owner !== listener) continue;
+		const [callStart, callEnd] = getRange(call);
+		if (!reachable.some((statement) => {
+			const [start, end] = getRange(statement);
+			return start <= callStart && callEnd <= end;
+		})) continue;
+		const helper = resolveListenerReference(call.callee, bindings);
+		if (helper == null || "generator" in helper && helper.generator) continue;
+		for (const [index, argument] of call.arguments.entries()) {
+			if (argument.type === "SpreadElement") break;
+			const arg = unwrapArgument(argument);
+			if (arg.type !== "Identifier" || arg.name !== param.name || bindings.lookup(arg, arg.name) !== contextBinding || helper.params[index]?.type === "RestElement") continue;
+			if (functionCallsDelivery(sourceCode, helper, bindings, calls, index, visited)) return true;
+		}
+	}
+	return false;
+}
+const listenerCallsDeliveryMethod = (sourceCode, listener, contextIndex = 0) => {
 	const used = computeUsedFunctions(listener.body);
 	const code = stripCommentsAndStrings(collectDeliveryScanCode(sourceCode, listener.body, used, /* @__PURE__ */ new Set()));
 	const aliases = /* @__PURE__ */ new Set();
-	const contextParam = unwrapContextParam(listener.params[0]);
+	const contextParam = unwrapContextParam(listener.params[contextIndex]);
 	const contextName = contextParam?.type === "Identifier" ? contextParam.name : null;
 	if (contextParam?.type === "ObjectPattern") for (const prop of contextParam.properties) {
 		if (!isNode(prop) || prop.type !== "Property") continue;
@@ -2209,14 +2366,48 @@ const listenerCallsDeliveryMethod = (sourceCode, listener) => {
 };
 function createRule(buildReport) {
 	return (context) => {
+		const federationTracker = trackFederationVariables();
+		const bindings = createBindingIndex();
+		const pendingCalls = [];
 		const sourceCode = context.sourceCode;
-		return createOutboxListenerVisitor((listener) => {
-			if (listenerCallsDeliveryMethod(sourceCode, listener)) return;
+		const inspectCall = (node) => {
+			if (!hasMemberExpressionCallee(node) || !hasIdentifierProperty(node) || !hasMethodName("on")(node) || node.arguments.length < 2) return;
+			if (!isChainedFromOutboxListeners(node.callee.object, federationTracker)) return;
+			const listener = node.arguments[1];
+			const resolvedListener = isNode(listener) && isFunction(listener) ? listener : isNode(listener) ? resolveListenerReference(listener, bindings) : null;
+			if (resolvedListener == null) return;
+			if (functionCallsDelivery(sourceCode, resolvedListener, bindings, pendingCalls)) return;
 			context.report({
-				node: listener,
+				node: resolvedListener,
 				...buildReport
 			});
-		});
+		};
+		return {
+			VariableDeclarator(node) {
+				federationTracker.VariableDeclarator(node);
+				const declaration = getParent(node);
+				bindings.declare(node, node.id, node.init, declaration?.kind === "var");
+			},
+			FunctionDeclaration(node) {
+				if (node.id == null) return;
+				const parent = getParent(node);
+				const owner = parent == null ? null : getParent(parent);
+				const inVarBody = parent?.type === "BlockStatement" && owner != null && (owner.type === "StaticBlock" || isFunctionLike(owner) && owner.body === parent);
+				bindings.declare(node, node.id, node, inVarBody);
+			},
+			ImportDeclaration(node) {
+				for (const specifier of node.specifiers) bindings.declare(node, specifier.local, null);
+			},
+			ClassDeclaration(node) {
+				if (node.id != null) bindings.declare(node, node.id, null);
+			},
+			CallExpression(node) {
+				pendingCalls.push(node);
+			},
+			"Program:exit"() {
+				for (const node of pendingCalls) inspectCall(node);
+			}
+		};
 	};
 }
 const eslint = {

package/dist/oxlint.cjs

@@ -1,4 +1,4 @@
-const require_outbox_listener_delivery_required = require("./outbox-listener-delivery-required-rhAvEA9G.cjs");
+const require_outbox_listener_delivery_required = require("./outbox-listener-delivery-required-Hs9elJlF.cjs");
 //#region src/oxlint.ts
 const rules = {
 	[require_outbox_listener_delivery_required.RULE_IDS.actorIdMismatch]: require_outbox_listener_delivery_required.eslint$18,

package/dist/oxlint.js

@@ -1,4 +1,4 @@
-import { A as name, C as eslint$5, D as eslint$11, E as eslint$10, O as eslint$21, S as eslint$4, T as eslint$13, _ as eslint$15, a as eslint$23, b as eslint$2, c as eslint$16, d as eslint$22, f as eslint$6, g as eslint$14, h as eslint$9, i as eslint$27, j as version, k as RULE_IDS, l as eslint$17, m as eslint$8, n as eslint$25, o as eslint$18, p as eslint$7, r as eslint$26, s as eslint$19, t as eslint$24, u as eslint$20, v as eslint$1, w as eslint$12, x as eslint$3, y as eslint } from "./outbox-listener-delivery-required-vNt3zM_a.js";
+import { A as name, C as eslint$5, D as eslint$11, E as eslint$10, O as eslint$21, S as eslint$4, T as eslint$13, _ as eslint$15, a as eslint$23, b as eslint$2, c as eslint$16, d as eslint$22, f as eslint$6, g as eslint$14, h as eslint$9, i as eslint$27, j as version, k as RULE_IDS, l as eslint$17, m as eslint$8, n as eslint$25, o as eslint$18, p as eslint$7, r as eslint$26, s as eslint$19, t as eslint$24, u as eslint$20, v as eslint$1, w as eslint$12, x as eslint$3, y as eslint } from "./outbox-listener-delivery-required-Cz_XWiEU.js";
 //#region src/oxlint.ts
 const rules = {
 	[RULE_IDS.actorIdMismatch]: eslint,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/lint",
-  "version": "2.4.0-dev.2155+2ccc5085",
+  "version": "2.4.0-dev.2159+bb072eda",
   "description": "Fedify linting rules and plugins",
   "keywords": [
     "Fedify",
@@ -51,7 +51,7 @@
   ],
   "peerDependencies": {
     "eslint": ">=9.0.0",
-    "@fedify/fedify": "^2.4.0-dev.2155+2ccc5085"
+    "@fedify/fedify": "^2.4.0-dev.2159+bb072eda"
   },
   "peerDependenciesMeta": {
     "eslint": {
@@ -71,7 +71,7 @@
     "tsdown": "^0.22.0",
     "typescript": "^6.0.0",
     "@fedify/fixture": "2.0.0",
-    "@fedify/vocab": "2.4.0-dev.2155+2ccc5085"
+    "@fedify/vocab": "2.4.0-dev.2159+bb072eda"
   },
   "scripts": {
     "build:self": "tsdown",