@filipebraida/adonis-function-points 0.2.0 → 0.3.0

package/build/{pipeline-DySlMWcN.js → pipeline-CIAydCcT.js}

@@ -1,7 +1,7 @@
-import { a as rootSymbolOf, c as toPosix, i as hooksFiredBy, n as resolveCall, o as collectEventBindings, r as detectAccess, s as samePath, t as BUILTIN_CALL_RESOLVERS } from "./resolvers-MFjRl2ef.js";
-import { Node, Project, SyntaxKind } from "ts-morph";
+import { a as rootSymbolOf, c as toPosix, i as hooksFiredBy, n as resolveCall, o as collectEventBindings, r as detectAccess, s as samePath, t as BUILTIN_CALL_RESOLVERS } from "./resolvers-CRB6lXoo.js";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { Node, Project, SyntaxKind } from "ts-morph";
 import { createHash } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
@@ -956,7 +956,21 @@ function collectJsonSchemas(app) {
 		skipFileDependencyResolution: true,
 		compilerOptions: { allowJs: false }
 	});
-	for (const root of app.scanRoots) project.addSourceFilesAtPaths(`${root}/**/*.ts`);
+	/**
+	* Wider than `scanRoots`, and only here.
+	*
+	* `database/` is excluded from the application roots on purpose: test factories
+	* and migrations contain real persistence calls, and scanning them would turn a
+	* test write into a counted function. But `node ace make:seeder` puts seeders in
+	* `database/seeders`, which is where seed data — and therefore a form's schema —
+	* normally lives. Reading a literal counts nothing, so there is no conflict: the
+	* exclusion protects the call graph, not the schema catalogue.
+	*
+	* Without this, `overrides.detFromSchema` naming a schema declared in a seeder
+	* reported "not declared anywhere in the code" and left the DET count at the
+	* floor — the exact case the override exists for.
+	*/
+	for (const root of [...app.scanRoots.map(toPosix), `${toPosix(app.root)}/database`]) project.addSourceFilesAtPaths(`${root}/**/*.ts`);
 	const found = /* @__PURE__ */ new Map();
 	for (const file of project.getSourceFiles()) for (const declaration of file.getVariableDeclarations()) {
 		const literal = unwrap(declaration.getInitializer())?.asKind(SyntaxKind.ObjectLiteralExpression);
@@ -1224,6 +1238,7 @@ function isNoiseMember(file, member) {
 */
 function validatorFieldsIn(body, file, app) {
 	const fields = [];
+	const opaque = [];
 	for (const call of body.getDescendantsOfKind(SyntaxKind.CallExpression)) {
 		const expression = call.getExpression();
 		if (!Node.isPropertyAccessExpression(expression)) continue;
@@ -1233,9 +1248,18 @@ function validatorFieldsIn(body, file, app) {
 		const name = argument.getText();
 		const declaration = findValidator(name, file, app);
 		if (!declaration) continue;
-		for (const leaf of leavesOf(declaration)) fields.push(`${name}.${leaf}`);
+		const { leaves, opaque: unreadable } = leavesOf(declaration);
+		const isOpaque = new Set(unreadable);
+		for (const leaf of leaves) {
+			const field = `${name}.${leaf}`;
+			fields.push(field);
+			if (isOpaque.has(leaf)) opaque.push(field);
+		}
 	}
-	return fields;
+	return {
+		fields,
+		opaque
+	};
 }
 /**
 * Fields read straight off the request, with no validator in between.
@@ -1320,11 +1344,14 @@ function findValidator(name, file, app) {
 	}
 	return null;
 }
-/** leaves of a VineJS schema, per the table in §7 */
 function leavesOf(node) {
 	const object = node.getFirstDescendantByKind(SyntaxKind.ObjectLiteralExpression);
-	if (!object) return [];
+	if (!object) return {
+		leaves: [],
+		opaque: []
+	};
 	const leaves = [];
+	const opaque = [];
 	const walk = (literal, prefix) => {
 		for (const property of literal.getProperties()) {
 			if (!Node.isPropertyAssignment(property)) continue;
@@ -1332,14 +1359,36 @@ function leavesOf(node) {
 			const text = property.getText();
 			const nested = property.getFirstDescendantByKind(SyntaxKind.ObjectLiteralExpression);
 			if (nested && /vine\.object/.test(text)) {
-				walk(nested, prefix ? `${prefix}.${name}` : name);
+				const path = prefix ? `${prefix}.${name}` : name;
+				/**
+				* An object declaring no properties enumerates nothing. It is the field
+				* itself that crosses the boundary, so it counts once — never zero,
+				* which would make it cheaper than a plain string.
+				*/
+				if (nested.getProperties().length === 0) {
+					leaves.push(path);
+					opaque.push(path);
+					continue;
+				}
+				walk(nested, path);
 				continue;
 			}
 			leaves.push(prefix ? `${prefix}.${name}` : name);
 		}
 	};
 	walk(object, "");
-	return leaves;
+	/**
+	* The whole validator is an open object: nothing is enumerable, and the body
+	* that carries it is measured at the floor. Counted as one, reported as such.
+	*/
+	if (leaves.length === 0 && object.getProperties().length === 0) return {
+		leaves: ["*"],
+		opaque: ["*"]
+	};
+	return {
+		leaves,
+		opaque
+	};
 }
 /** file name, to identify the unresolved call without dumping the full path */
 const pathOf = (file) => file.split("/").pop()?.replace(/\.ts$/, "") ?? file;
@@ -1440,7 +1489,7 @@ function createAnalyzer(app, stores, options = {}) {
 		const accesses = [];
 		const followUps = [];
 		const unresolved = [];
-		const validators = validatorFieldsIn(body, file, app);
+		const validator = validatorFieldsIn(body, file, app);
 		const request = requestFieldsIn(body);
 		for (const call of body.getDescendantsOfKind(SyntaxKind.CallExpression)) {
 			const access = detectAccess(call, symbols, relationsByStore);
@@ -1449,9 +1498,14 @@ function createAnalyzer(app, stores, options = {}) {
 					store: access.store,
 					write: access.mode === "write"
 				});
+				/**
+				* A relation reached by `preload`/`load` is read; one written through
+				* `related('files').create(…)` is written. Assuming read either way made
+				* a table maintained only through a relation come out as an EIF.
+				*/
 				if (access.viaRelation) accesses.push({
 					store: access.viaRelation,
-					write: false
+					write: access.relationWritten === true
 				});
 				/**
 				* counting-decisions §3: a hook belongs to the transaction that fired
@@ -1499,7 +1553,8 @@ function createAnalyzer(app, stores, options = {}) {
 			accesses,
 			followUps,
 			unresolved,
-			validators,
+			validators: validator.fields,
+			opaqueValidators: validator.opaque,
 			requestFields: request.fields,
 			opaqueRequest: request.opaque,
 			bodyHash: hashOf(body)
@@ -1527,7 +1582,15 @@ function createAnalyzer(app, stores, options = {}) {
 			if (symbols.size === 0) continue;
 			for (const call of file.getDescendantsOfKind(SyntaxKind.CallExpression)) {
 				const access = detectAccess(call, symbols, relationsByStore);
-				if (access?.mode === "write") written.add(access.store);
+				if (access?.mode !== "write") continue;
+				written.add(access.store);
+				/**
+				* `distribution.related('files').create(…)` maintains the related table.
+				* Recording only the parent left a table written exclusively that way
+				* looking like somebody else's — reported by a production application as
+				* an EIF it was sure it maintained.
+				*/
+				if (access.viaRelation && access.relationWritten) written.add(access.viaRelation);
 			}
 		}
 		return written;
@@ -1541,6 +1604,7 @@ function createAnalyzer(app, stores, options = {}) {
 	function run(handler) {
 		const touches = /* @__PURE__ */ new Set();
 		const inputFields = /* @__PURE__ */ new Set();
+		const opaqueInputFields = /* @__PURE__ */ new Set();
 		const requestFields = /* @__PURE__ */ new Set();
 		let opaqueRequest = false;
 		const trace = [];
@@ -1580,6 +1644,7 @@ function createAnalyzer(app, stores, options = {}) {
 			}
 			unresolved.push(...facts.unresolved);
 			for (const field of facts.validators) inputFields.add(field);
+			for (const field of facts.opaqueValidators) opaqueInputFields.add(field);
 			for (const field of facts.requestFields) requestFields.add(field);
 			if (facts.opaqueRequest) opaqueRequest = true;
 			trace.push({
@@ -1606,6 +1671,7 @@ function createAnalyzer(app, stores, options = {}) {
 			writes,
 			touches: [...touches].sort(),
 			inputFields: [...inputFields].sort(),
+			opaqueInputFields: [...opaqueInputFields].sort(),
 			requestFields: [...requestFields].sort(),
 			opaqueRequest,
 			trace,
@@ -1957,6 +2023,12 @@ function pointsOf(type, complexity, weights = DEFAULT_WEIGHTS) {
 }
 //#endregion
 //#region src/albrecht/data_functions.ts
+/**
+* A column whose shape says nothing about what it holds. Marked in the rationale
+* because `detFromSchema` replaces exactly this placeholder, and because a reader
+* deserves to know which of the DETs is a floor rather than a count.
+*/
+const OPAQUE_TYPE$1 = /^(object|any|unknown|Record<|Json|JSON)/;
 function countDataFunctions(stores, usage, options) {
 	const counted = [];
 	for (const store of stores) {
@@ -1993,7 +2065,7 @@ function countDataFunctions(stores, usage, options) {
 			points: pointsOf(type, complexity, options.weights),
 			rationale: {
 				rule: options.externallyMaintained.has(store.name) ? "afp:6.5.4 externally maintained by boundary configuration -> EIF" : maintained ? "afp:6.5.4 maintained by an application transaction -> ILF" : "afp:6.5.4 used but not maintained -> EIF",
-				detSources: detAttributes.map((attribute) => `${store.columnSource}:${store.table ?? store.name}.${attribute.name}`),
+				detSources: detAttributes.map((attribute) => `${store.columnSource}:${store.table ?? store.name}.${attribute.name}` + (attribute.type && OPAQUE_TYPE$1.test(attribute.type) ? " (opaque)" : "")),
 				refSources: options.retStrategy === "composition" ? ["1 (main group)", ...store.subgroups.map((s) => `composition:${s}`)] : ["1 (constant: a logical subgroup is not derivable from code)"]
 			}
 		});
@@ -2077,7 +2149,14 @@ function detsFor(entry, behavior, touched, type, options) {
 		sources.push(source);
 	};
 	for (const param of entry.signature.match(/:[A-Za-z_][\w]*/g) ?? []) add(param.slice(1), `param:${param}`);
-	for (const field of behavior.inputFields) add(field.split(".").pop(), `validator:${field}`);
+	/**
+	* `(opaque)` is not decoration: `detFromSchema` replaces the opaque placeholder
+	* with a schema's fields, and it used to assume there was exactly one and that
+	* it was worth 1. An open `vine.object` counted zero, so the subtraction ate a
+	* real field — off by one, in the direction of undercounting.
+	*/
+	const opaqueInputs = new Set(behavior.opaqueInputFields);
+	for (const field of behavior.inputFields) add(field.split(".").pop(), `validator:${field}${opaqueInputs.has(field) ? " (opaque)" : ""}`);
 	/**
 	* §7.2 asks whether a user-recognisable field crosses the boundary, not how it
 	* was declared. `request.input('title')` does, and counted for nothing while
@@ -2141,6 +2220,17 @@ function isTechnical(store, patterns = DEFAULT_TECHNICAL_PATTERNS) {
 	for (const { label, pattern } of patterns) if (pattern.test(table)) return `${label} (AFP §6.5.2.1.3: ${pattern.source})`;
 	return null;
 }
+//#endregion
+//#region src/albrecht/counter.ts
+/**
+* Assembles the count from the inventory.
+*
+* The order is not arbitrary: data functions depend on HOW transactions use
+* each store (AFP §6.5.4), and transactional functions depend on which stores
+* ended up counted. Hence: usage first, then the technical filter, then data,
+* then transactions.
+*/
+const RULESET = "afp";
 /**
 * Version of the rule set.
 *
@@ -2149,14 +2239,18 @@ function isTechnical(store, patterns = DEFAULT_TECHNICAL_PATTERNS) {
 * change rather than the work.
 *
 * It must be bumped by ANY change that moves the number for unchanged code, and
-* that is easy to forget: four such changes landed in 1.1.0 — maintenance read
+* that is easy to forget. Four such changes landed in 1.1.0 — maintenance read
 * across the whole project rather than from routes alone, a job followed into
 * `process`, an event followed into its listeners, and `request.input(…)` counted
-* as a DET. Without the bump, a baseline saved by the previous version would have
-* compared cleanly against this one and billed the tool's own improvement as work
-* done. The guard exists for exactly that, and only this constant arms it.
+* as a DET — and three more in 1.2.0: an open input object counting 1 instead of 0,
+* `detFromSchema` no longer subtracting a placeholder that was not there, and a
+* write through `related(…)` maintaining the related table.
+*
+* Without the bump, a baseline saved by the previous version compares cleanly
+* against this one and bills the tool's own improvement as work done. The guard
+* exists for exactly that, and only this constant arms it.
 */
-const RULESET_VERSION = "1.1.0";
+const RULESET_VERSION = "1.2.0";
 function count(input, options = {}) {
 	const warnings = [];
 	const usage = usageOf(input);
@@ -2208,6 +2302,7 @@ function count(input, options = {}) {
 	});
 	warnings.push(...opaqueColumnWarnings(countable, input));
 	warnings.push(...unreadableInputWarnings(input));
+	warnings.push(...openValidatorWarnings(input));
 	const functions = applyOverrides([...dataFunctions, ...transactionalFunctions], options.overrides ?? {}, input.jsonSchemas ?? /* @__PURE__ */ new Map(), tables, weights, warnings);
 	return {
 		ruleset: "afp",
@@ -2246,6 +2341,32 @@ function opaqueColumnWarnings(stores, input) {
 	return [`${found.length} opaque column(s), each counted as 1 DET. If the user recognises fields inside one, declare the count with \`overrides\` — counting-decisions §8:`, ...found];
 }
 /**
+* Input fields declared as an open object: `vine.object({}).allowUnknownProperties()`.
+*
+* The same blind spot as an opaque column and, until now, reported nowhere — the
+* opaque-column warning names stores, and this one is on the transaction side, so
+* a route whose whole form arrives through one of these was invisible in the
+* confidence block. On a production application that was the route that saves the
+* main document, and it was the reason its EI never looked wrong.
+*
+* It counts 1 DET, which is a floor. When the fields are declared in the code
+* somewhere — a seeder, a schema module — `detFromSchema` replaces the floor with
+* the real count, and §8 of counting-decisions says how.
+*/
+function openValidatorWarnings(input) {
+	const found = [];
+	for (const entry of input.entryPoints) {
+		const fields = input.behaviors.get(entry.id)?.opaqueInputFields ?? [];
+		for (const field of fields) found.push(`  ${entry.trigger} ${entry.signature} — ${field}`);
+	}
+	if (found.length === 0) return [];
+	return [
+		`${found.length} open input object(s), each counted as 1 DET. The fields the user fills are data, not code, so this is a FLOOR: if they are declared anywhere in the source, name that schema with \`overrides.detFromSchema\` — counting-decisions §8:`,
+		...found.slice(0, 10),
+		...found.length > 10 ? [`  … and ${found.length - 10} more`] : []
+	];
+}
+/**
 * Transactions that read the request in a way that enumerates nothing.
 *
 * `request.all()`, `request.body()`, `request.except([…])` — whatever arrives is
@@ -2319,8 +2440,20 @@ function applyOverrides(functions, overrides, schemas, tables, weights, warnings
 		if (override.detFromSchema) {
 			const schema = schemas.get(override.detFromSchema);
 			if (schema) {
-				det = Math.max(fn.det - 1, 0) + schema.fields;
+				/**
+				* Replaces the opaque placeholder — the one the rationale marks — rather
+				* than assuming there is one and that it is worth 1.
+				*
+				* That assumption was wrong twice over. An open `vine.object` counted
+				* ZERO, not 1, so subtracting 1 removed a field the analysis had read
+				* correctly: 86 DETs where 87 was right. And a function with no opaque
+				* DET at all was silently charged the subtraction too.
+				*/
+				const placeholders = fn.rationale.detSources.filter((source) => source.endsWith("(opaque)"));
+				det = Math.max(fn.det - Math.min(placeholders.length, 1), 0) + schema.fields;
 				by = `config:overrides.${fn.name} (from ${schema.name}: ${schema.fields} fields)`;
+				if (placeholders.length === 0) warnings.push(`override for "${fn.name}" names schema "${schema.name}", but this function has no opaque DET for it to stand in for: the ${schema.fields} fields were ADDED to the ${fn.det} already counted. Check the override is on the right function.`);
+				else if (placeholders.length > 1) warnings.push(`override for "${fn.name}" names one schema and the function has ${placeholders.length} opaque DETs (${placeholders.join(", ")}). Only one was replaced; the others still count 1 each.`);
 			} else warnings.push(`override for "${fn.name}" names schema "${override.detFromSchema}", which is not declared anywhere in the code: the DET count was left as found. A renamed or moved schema breaks the mapping, and this says so rather than counting on silently.`);
 		}
 		const refs = override.refs ?? fn.refs;
@@ -2524,6 +2657,13 @@ async function analyze(root, options = {}) {
 					by: "validator"
 				}
 			})),
+			opaqueInputFields: behavior.opaqueInputFields.map((name) => ({
+				name,
+				provenance: {
+					file: app.root,
+					by: "validator"
+				}
+			})),
 			requestFields: behavior.requestFields.map((name) => ({
 				name,
 				provenance: {
@@ -2561,4 +2701,4 @@ async function analyze(root, options = {}) {
 	};
 }
 //#endregion
-export { analyze as n, CoverageTooLowError as t };
+export { RULESET_VERSION as i, analyze as n, RULESET as r, CoverageTooLowError as t };