@gspothq/cli 0.1.1 → 0.2.0

package/configurations/platform/supabase/manifest.toml

@@ -1,9 +1,10 @@
 allowed_words = ["Supabase"]
+
 [configuration]
-title = "Supabase"
+description = "A Supabase project: edge functions under Deno. Every storage bucket has a policy, and privileged keys stay in their allowed files."
 requires = ["postgres", "javascript"]
 suggests = ["typescript"]
-description = "A Supabase project: a project file that parses, edge functions under Deno, and migrations named as the CLI names them. Every storage bucket has a policy, and privileged keys stay in their allowed files."
+title = "Supabase"
 
 [detect]
 paths = ["**/supabase/config.toml"]
@@ -12,101 +13,87 @@ project_files = ["supabase/config.toml"]
 [files]
 paths = ["supabase/config.toml", "supabase/functions/**", "supabase/seed.sql"]
 
+[defaults]
+"postgres.client_schemas" = ["public"]
+"tools.squawk.assume_in_transaction" = true
+
 [[tool]]
-name = "deno"
-version = "2.6.6"
-min_version = "2.0.0"
-mise = "deno"
 brew = "deno"
 github = { name = "denoland/deno", version = "v2.6.6" }
+min_version = "2.0.0"
+mise = "deno"
+name = "deno"
 scoop = "deno"
+version = "2.6.6"
 
 [[tool]]
-name = "supabase"
-system = true
-version_command = ["--version"]
+brew = "supabase/tap/supabase"
 min_version = "2.0.0"
 mise = "supabase"
-brew = "supabase/tap/supabase"
+name = "supabase"
 npm = "supabase"
 scoop = "supabase"
+system = true
+version_command = ["--version"]
 
-[[check]]
-name = "project-file"
-example = "A function entry in `supabase/config.toml` naming a function absent from the repository reports a stale function configuration. Restore the function source or remove its obsolete configuration table."
-level = "recommended"
-stage = "commit"
-runs = "scope"
-summary = "Checks that the project file parses, and that every function it configures has a folder with an index file."
-why = "The CLI reads this file at every deploy, and a function it configures with no code fails there."
-help = "Correct the file at the place the message names, or remove the table of a function the repository does not hold."
+[[tool_file]]
+per_scope = true
+target = ".gspot/config/semgrep/supabase.yml"
+tool = "semgrep"
+when = { configuration = "security" }
 
 [[check]]
-name = "migration-names"
-example = "A Supabase migration named `add_users.sql` lacks the required timestamp prefix. Create it with `supabase migration new add_users`, then move the intended SQL into the generated migration file."
+example = "A storage bucket with no policy on `storage.objects` reports a finding. Add a migration that defines access for that bucket."
+help = "Add a policy on storage.objects for the bucket in a migration."
 level = "recommended"
-stage = "commit"
-runs = "scope"
-summary = "Checks that every migration is named fourteen digits, an underscore, and snake case words."
-why = "The CLI orders and records migrations by this name, and it skips a file it cannot read a version from."
-help = "Create the migration with supabase migration new `<name>`, which writes the name."
-
-[[check]]
 name = "storage-policies"
-example = "A declared storage bucket with no matching policy on `storage.objects` reports missing access policy. Add a migration defining the intended access policy for that bucket and rerun."
-level = "recommended"
-stage = "commit"
 runs = "scope"
+stage = "commit"
 summary = "Checks that every storage bucket in the project file has a policy on storage.objects that names it."
-why = "A bucket with no policy is closed to everyone or, when it is public, open to everyone, and neither is a decision anybody wrote down."
-help = "Add a policy on storage.objects for the bucket in a migration."
+why = "A bucket with no policy stays closed to every user, or open to anyone when public, and nobody recorded that choice."
 
 [[check]]
-name = "service-role-key"
-example = "A client source reading a Supabase secret or service-role key reports an administrative-key boundary finding. Move privileged operations and the key read to a server-only path, exposing only the required server operation to the client."
+example = "Client code that reads a Supabase service-role key reports a finding. Move the key and the privileged work into an edge function."
+help = "Move code to edge functions or tests, or run `gspot ignore supabase/service-role-key` with a reason."
 level = "recommended"
-stage = "commit"
+name = "service-role-key"
 runs = "scope"
-summary = "Checks that secret and service role keys are named only in edge functions and test files."
+stage = "commit"
+summary = "Checks that only edge functions and test files name a secret or service role key."
 why = "Secret and service role keys bypass row level security, so a client bundle that holds either exposes privileged database access."
-help = "Move code to edge functions or tests, or run gspot ignore supabase/service-role-key with a reason."
 
 [[check]]
-name = "deno-lint"
-example = "An Edge Function declaring `var greeting = \"hello\";` reports `no-var`. Use `const greeting = \"hello\";` when the value does not change, then rerun with the pinned Deno tool available."
+example = "An Edge Function declaring `var greeting = \"hello\";` reports `no-var`. Use `const greeting = \"hello\";` instead."
+help = "Change the code the way the rule says; `deno lint --rules` explains each one."
 level = "recommended"
-stage = "commit"
+name = "deno-lint"
 runs = "scope"
+stage = "commit"
+summary = "Runs `deno lint` over every edge function with its own deno.json."
 tool = "deno"
-summary = "Runs deno lint over every edge function, with the function's own deno.json."
-why = "Edge functions run under Deno, and its linter knows the runtime the Node rules do not."
-help = "Change the code the way the rule says; deno lint --rules explains each one."
+why = "Edge functions run under Deno, and its linter covers runtime APIs that the Node rules miss."
 
 [[check]]
-name = "deno-check"
-example = "An Edge Function assigning a string to a number-typed variable reports a Deno type error. Correct the value or type to match the intended contract, then rerun."
+example = "An edge function that assigns a string to a number variable reports a type error. Correct the value or the type."
+help = "Fix the first error Deno prints; later ones often come from the same mistake."
 level = "recommended"
-stage = "push"
+name = "deno-check"
 runs = "scope"
+stage = "push"
+summary = "Runs `deno check` on the entry file of every edge function."
 tool = "deno"
-summary = "Type checks the entry file of every edge function with deno check."
-why = "The project compiler does not resolve the import map of a function, so only Deno sees its types."
-help = "Fix the first error Deno prints; later ones are often the same mistake."
+why = "The project compiler cannot resolve the import map of a function, so only Deno can check its types."
 
 [[check]]
-name = "stale-types"
 command = ["supabase", "gen", "types", "typescript", "--local", "{each:--schema:supabase.schemas}"]
-generated_paths = [{ stdout = "{setting:supabase.types_file}" }]
-example = "A database types file that differs from the configured local Supabase schema reports drift. With the local database ready, regenerate using `supabase gen types typescript --local`, write the output to the configured file, and rerun."
+example = "A types file that differs from the local Supabase schema reports drift. With the local database running, write the output of `supabase gen types typescript --local` to that file."
+generator_outputs = [{ stdout = "{setting:supabase.types_file}" }]
+help = "Run `supabase gen types typescript --local` and write the output to the file."
 level = "recommended"
-stage = "push"
+name = "stale-types"
+needs = ["docker"]
 runs = "scope"
+stage = "push"
+summary = "Compares `supabase.types_file` with the output the Supabase CLI writes from the local database."
 tool = "supabase"
-needs = ["docker"]
-summary = "Compares supabase.types_file with the types the CLI writes from the local database."
 why = "Stale types let code compile against a column the database dropped."
-help = "Run supabase gen types typescript --local and write the output to the file."
-
-[defaults]
-"postgres.client_schemas" = ["public"]
-"tools.squawk.assume_in_transaction" = true

package/configurations/platform/supabase/rules/SUPABASE.md

@@ -1,7 +1,8 @@
 # Supabase
 
-Layout, database access, storage, Edge Functions, configuration, and secrets of a Supabase
-project, on top of the Postgres rules. Supabase uses the API roles `anon`, `authenticated`, and
+Read this rule when you change Supabase migrations, storage, Edge Functions, or `config.toml`.
+
+Follow the Postgres rules too. Supabase uses the API roles `anon`, `authenticated`, and
 `service_role`.
 
 ## Layout and migrations
@@ -11,13 +12,12 @@ project, on top of the Postgres rules. Supabase uses the API roles `anon`, `auth
 
 ## Database access
 
-- `[api].schemas` in `config.toml` lists the schemas the Data API exposes. Treat those schemas as
+- `[api].schemas` in `config.toml` lists the schemas the Data API exposes. Treat them as
   externally reachable.
-- row level security (RLS) with no policy denies access through the API roles. Use that choice for tables that clients
-  must not read.
+- A table with row level security (RLS) on and no policy denies access to the API roles. Use that choice for tables
+  that clients must not read.
 - Roles Supabase creates for auth, cron, or storage stay scoped to the functions and schemas they need.
-- Each policy chooses `TO anon`, `TO authenticated`, or `TO service_role` deliberately. The service
-  role never stands in for precise grants or hides a missing policy.
+- Name the Supabase roles in `TO`: `anon`, `authenticated`, or `service_role`.
 - A table can skip the foreign key to `auth.users` so its history survives account deletion.
 - Keep `[api].max_rows` conservative to bound accidental or malicious payloads.
 
@@ -25,17 +25,16 @@ project, on top of the Postgres rules. Supabase uses the API roles `anon`, `auth
 
 Choose the Supabase connection mode for the workload.
 
-| Workload                                        | Connection choice                                                     |
-| ----------------------------------------------- | --------------------------------------------------------------------- |
-| Short-lived serverless application requests     | Transaction pooler, with a compatible driver                          |
-| Persistent server with direct network access    | Direct connection with a bounded application pool                     |
-| Persistent server on an IPv4-only network       | Session pooler when the direct endpoint is unavailable                |
-| Migrations, dumps, or session-dependent tooling | Direct connection; use a supported session alternative when necessary |
-
-A separate migration credential holds schema privileges. The application role holds only what
-runtime needs
-See [connection modes](https://supabase.com/docs/guides/database/connecting-to-postgres). Postgres.js
-uses the transaction pooler's supported configuration.
+| Workload                                      | Connection choice                                                     |
+| --------------------------------------------- | --------------------------------------------------------------------- |
+| Short-lived serverless application requests   | Transaction pooler, with a compatible driver                          |
+| Persistent server with direct network access  | Direct connection with a bounded application pool                     |
+| Persistent server on an IPv4-only network     | Session pooler when the server cannot reach the direct endpoint       |
+| Migrations, dumps, or session-dependent tools | Direct connection; use a supported session alternative when necessary |
+
+A separate migration credential holds schema privileges. The application role holds only the privileges it needs at runtime.
+See [connection modes](https://supabase.com/docs/guides/database/connecting-to-postgres).
+
 Set explicit connection, idle, and query timeouts. Budget connections across instances and
 workers. With Postgres.js through transaction pooling, set `prepare: false` and confirm the setting
 after a driver or pooler change.
@@ -46,16 +45,16 @@ maps the identity to a fixed set of allowed roles, then opens a transaction on a
 connection. Use parameterized transaction-local `set_config` for claims and fixed trusted SQL for
 the role. Every protected query uses that transaction. Commit or rollback ends its context.
 
-When Drizzle generates migrations that the Supabase CLI applies, keep the CLI's migration format
+When Drizzle generates migrations that the Supabase CLI applies, keep the CLI migration format
 and one authoritative applied-history ledger. Declare provider-managed schemas and roles as
-existing. Check replay through the chosen runner. See
+existing. Check replay with the project migration tool. See
 [migration history](https://supabase.com/docs/guides/local-development/database-migrations) and
 [verified claims](https://supabase.com/docs/reference/javascript/auth-getclaims).
 
 ## Storage
 
 - Define buckets in migrations and mirror them in `config.toml`. A change to `public`,
-  `file_size_limit`, or `allowed_mime_types` updates both in the same change.
+  `file_size_limit`, or `allowed_mime_types` updates both at once.
 - Bucket restrictions enforce file size and MIME type, not only application validation.
 - RLS policies on `storage.objects` and `storage.buckets` control access. The service controls metadata in the `storage` schema: migrations add only policies, indexes for RLS or validation, triggers,
   and bucket configuration. Object rows change only through the Storage API.
@@ -79,15 +78,15 @@ existing. Check replay through the chosen runner. See
 
 ## Edge functions
 
-- Each deployable function lives under `functions/<function-name>/` in the CLI's functions root,
-  with a `[functions.<name>]` entry whose `entrypoint` starts from the configuration file directory.
+- Each deployable function lives under `functions/<function-name>/` in the CLI functions root,
+  with a `[functions.<name>]` table whose `entrypoint` path starts from the folder of `config.toml`.
   Shared code lives in `functions/_shared/`, which Supabase never deploys.
 - Name a function folder in kebab-case for its callable operation, not its technology:
-  `submit-order`, never `SubmitOrder` or `provider_handler`. The folder, configuration entry, and
-  deployed name match.
+  `submit-order`, never `SubmitOrder` or `provider_handler`. The folder, the `config.toml` table, and
+  the deployed name match.
 - Edge Functions run on Deno, and the Deno rules hold.
 - Keep `verify_jwt = true` for user-authenticated functions. Set it to `false` only when the function
-  exposes only public, harmless behavior, verifies a provider webhook signature, checks a service secret, or takes
+  exposes nothing but public, harmless behavior, verifies a provider webhook signature, checks a service secret, or takes
   a Vault secret from cron.
 - A publishable or secret API key differs from a user JSON Web Token (JWT). Never send that key as
   `Authorization: Bearer <key>`. Forward the caller's `Authorization` header to the Supabase
@@ -99,7 +98,7 @@ existing. Check replay through the chosen runner. See
   in `functions/_shared/`.
 - Functions have runtime, CPU, memory, bundle-size, and log-rate limits, so long CPU-heavy work
   runs elsewhere. Raw Supabase errors that expose credentials stay out of logs.
-- When you write tests, cover function logic in unit tests. Integration tests against a local
+- When you write tests, cover function logic at the unit level. Integration tests against a local
   database and function server cover the client, auth, RLS, and the invocation path.
 
 ## Configuration and secrets
@@ -108,7 +107,7 @@ existing. Check replay through the chosen runner. See
 
 Ask the user before changing signup, anonymous sign-in, providers, hooks, JWT expiry, or password policy.
 Also ask before weakening auth settings, row-level security, grants, or `verify_jwt`.
-Proceed when the task already authorizes the change. Write the reason in the commit when the user authorizes a commit.
+Proceed when the task already authorizes the change. When the user authorizes a commit, write the reason in it.
 
 - Service keys, Edge secrets, Vault values, database URLs, and provider API keys stay backend-only.
   They never appear in app code, checked-in files, logs, migration comments, tests, or test data.

package/configurations/testing/jest/manifest.toml

@@ -1,7 +1,7 @@
 [configuration]
-title = "Jest"
+description = "Jest lint rules and coverage floors for the repository test suites."
 requires = ["javascript", "coverage"]
-description = "Jest test rules and coverage floors for repository-owned test suites."
+title = "Jest"
 
 [detect]
 dependencies = ["jest"]
@@ -15,27 +15,35 @@ name = "jest"
 system = true
 
 [[tool]]
+kind = "library"
 name = "eslint-plugin-jest"
+npm = "eslint-plugin-jest"
 rule_prefix = "jest"
-kind = "library"
 version = "29.16.6"
-npm = "eslint-plugin-jest"
+
+[eslint]
+all_level_rules = ["jest/prefer-strict-equal"]
+
+[[tool_file]]
+fragment = true
+required_tools = ["eslint-plugin-jest"]
+target = ".gspot/config/eslint.config.mjs"
+tool = "eslint"
 
 [[check]]
-name = "coverage"
+command = ["jest", "--ci", "--rootDir={root}/{scope}", "--coverage", "--coverageReporters=text-summary", "--coverageThreshold={\"global\":{\"lines\":{setting:coverage.lines},\"branches\":{setting:coverage.branches},\"functions\":{setting:coverage.functions},\"statements\":{setting:coverage.statements}}}"]
+crash_pattern = "^No tests found|^  ● Test suite failed to run"
+cwd = "scope"
 example = "Jest reports `coverage threshold for lines (90%) not met: 85%`. Add tests for the lines its report marks uncovered."
+exit_codes = [1]
+help = "Correct failed tests and cover the reported branches, functions, lines, and statements."
 level = "recommended"
-stage = "push"
+name = "coverage"
 runs = "scope"
-cwd = "scope"
+stage = "push"
+summary = "Runs Jest and checks all four coverage floors."
 tool = "jest"
-command = ["jest", "--ci", "--rootDir={root}/{scope}", "--coverage", "--coverageReporters=text-summary", "--coverageThreshold={\"global\":{\"lines\":{setting:coverage.lines},\"branches\":{setting:coverage.branches},\"functions\":{setting:coverage.functions},\"statements\":{setting:coverage.statements}}}"]
-run_in_copy = true
-exit_codes = [1]
-crash_pattern = "^No tests found|^  ● Test suite failed to run"
-summary = "Runs Jest in a disposable source copy and checks all four coverage floors."
 why = "A coverage floor keeps new code from arriving untested."
-help = "Correct failed tests and cover the reported branches, functions, lines, and statements."
 
 [check.files]
 extensions = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]
@@ -43,12 +51,3 @@ extensions = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]
 [check.output]
 format = "regex"
 pattern = "^Jest: \"global\" (?<message>coverage threshold for .+ not met: .+)$"
-
-[eslint]
-all_level_rules = ["jest/prefer-strict-equal"]
-
-[[tool_file]]
-target = ".gspot/config/eslint.config.mjs"
-tool = "eslint"
-fragment = true
-required_tools = ["eslint-plugin-jest"]

package/configurations/testing/pytest/manifest.toml

@@ -1,53 +1,53 @@
 [configuration]
-title = "pytest"
+description = "pytest suites: Ruff style rules for tests, test-name prefixes, and a coverage floor at push."
 requires = ["python", "coverage"]
-description = "pytest suites: Ruff pytest style rules over the tests, pytest test-name prefixes, and a coverage floor at push."
+title = "pytest"
 
 [detect]
 dependencies = ["pytest"]
 filenames = ["conftest.py", "pytest.ini"]
 
+[[naming.override]]
+categories = ["functions", "methods"]
+ignored_prefix = "^test_"
+languages = ["python"]
+paths = ["**/test_*.py", "**/*_test.py", "**/tests/**/*.py", "**/conftest.py"]
+reason = "The test runner finds a test by this prefix."
+
 [[tool]]
-name = "pytest"
 install_hint = "Run: python -m pip install pytest"
-system = true
-suppression = { marker = "\\bpragma: ?no cover\\b", reason = "#[^#]*# ?(?<reason>\\S.*)" }
 min_version = "7.0.0"
+name = "pytest"
 pypi = "pytest"
+suppression = { marker = "\\bpragma: ?no cover\\b", reason = "#[^#]*# ?(?<reason>\\S.*)" }
+system = true
 version_pattern = "(\\d+\\.\\d+\\.\\d+)"
 
 [[tool]]
-name = "pytest-cov"
 install_hint = "Install pytest-cov in the Python environment used by pytest."
 kind = "library"
-system = true
+name = "pytest-cov"
 pypi = "pytest-cov"
+system = true
 version_command = ["pytest", "--version", "--version"]
 version_pattern = "pytest-cov-(\\d+(?:\\.\\d+)+)"
 
+[ruff]
+all = ["PT001", "PT002", "PT003", "PT006", "PT007", "PT018", "PT019", "PT022", "PT023", "PT026"]
+recommended = ["PT008", "PT009", "PT010", "PT011", "PT012", "PT013", "PT014", "PT015", "PT016", "PT017", "PT020", "PT021", "PT024", "PT025", "PT027", "PT028", "PT030", "PT031"]
+
 [[check]]
-name = "coverage"
-tool = ["pytest", "pytest-cov"]
-example = "pytest-cov reports `FAIL Required test coverage of 90% not reached. Total coverage: 85%`. Add a Python test for the uncovered behavior."
-level = "recommended"
-stage = "push"
-runs = "scope"
-cwd = "scope"
 command = ["pytest", "-q", "--strict-markers", "--strict-config", "--cov", "--cov-fail-under={setting:coverage.lines}", "--no-header", "-p", "no:cacheprovider"]
+cwd = "scope"
+example = "pytest-cov reports `FAIL Required test coverage of 90% not reached. Total coverage: 85%`. Add a Python test for the uncovered behavior."
 exit_codes = [1]
 files = { extensions = [".py"] }
+help = "Fix the failed test, or cover the lines the report marks. Lower `coverage.lines` only with a reason."
+level = "recommended"
+name = "coverage"
 output = { format = "regex", pattern = "^(?<message>(?:FAIL Required test coverage|FAILED |ERROR ).*)$" }
-summary = "Runs the test suite with coverage, and fails when a test fails or the covered share falls under the floor."
-why = "Python coverage reveals branches and lines the test suite does not exercise before a push."
-help = "Fix the failing test, or add tests for the code the report shows uncovered. Lower coverage.lines with a reason."
-
-[ruff_rules]
-recommended = ["PT008", "PT009", "PT010", "PT011", "PT012", "PT013", "PT014", "PT015", "PT016", "PT017", "PT020", "PT021", "PT024", "PT025", "PT027", "PT028", "PT030", "PT031"]
-all = ["PT001", "PT002", "PT003", "PT006", "PT007", "PT018", "PT019", "PT022", "PT023", "PT026"]
-
-[[naming.override]]
-paths = ["**/test_*.py", "**/*_test.py", "**/tests/**/*.py", "**/conftest.py"]
-languages = ["python"]
-categories = ["functions", "methods"]
-ignored_prefix = "^test_"
-reason = "The test runner finds a test by this prefix."
+runs = "scope"
+stage = "push"
+summary = "Runs pytest with coverage, and fails on a broken test or a covered share under the floor."
+tool = ["pytest", "pytest-cov"]
+why = "Coverage shows the Python branches and lines that no test runs, before a push."

package/configurations/testing/swift-tests/manifest.toml

@@ -1,52 +1,41 @@
 [configuration]
-title = "Swift Tests"
+description = "Swift test files under XCTest and Swift Testing. A disabled test says why, and coverage holds a floor."
 requires = ["swift", "coverage"]
-description = "Swift test files under XCTest and Swift Testing. A disabled test says why, no test sleeps, and coverage holds a floor."
+title = "Swift Tests"
 
 [detect]
-tags = ["swift-test", "swift-test-target"]
 paths = ["**/*.xctestplan"]
+tags = ["swift-test", "swift-test-target"]
 
 [files]
-paths = ["**/*Tests/**/*.swift"]
 filenames = ["*.xctestplan"]
+paths = ["**/*Tests/**/*.swift"]
 
 [[tool_file]]
+per_scope = true
+pointer = { path = ".swiftlint.yml", folders = ["**/*Tests"], body = "parent_config: {target_json}\ndisabled_rules:\n    - force_unwrapping\n    - missing_docs\n    - no_magic_numbers\n" }
 target = ".gspot/config/swiftlint.yml"
 tool = "swiftlint"
-per_scope = true
-fragment = true
-pointer = { path = ".swiftlint.yml", directories = ["**/*Tests"], body = "parent_config: {target_json}\ndisabled_rules:\n    - force_unwrapping\n    - missing_docs\n    - no_magic_numbers\n" }
 
 [[check]]
-name = "skip-reasons"
-example = "In a Swift test, `throw XCTSkip()` reports a missing reason. Restore the test, or supply a nonempty reason such as `throw XCTSkip(\"Requires the hardware test device\")`. The check requires a reason; it does not validate when the test will be enabled."
+example = "`throw XCTSkip()` in a Swift test reports a missing reason. Restore the test, or give a reason such as `throw XCTSkip(\"Requires the hardware test device\")`."
+files = { tags = ["swift-test"] }
+help = "Write why the test stays off and what turns it on again, or delete it."
 level = "recommended"
+name = "skip-reasons"
 stage = "commit"
-files = { tags = ["swift-test"] }
 summary = "Checks that skip calls and disabled traits name a nonempty reason, and unavailable tests carry an explanation."
-why = "A test turned off with no reason stays off, because nobody knows when it is safe to turn on."
-help = "Say why the test is off and what turns it back on, or delete the test."
-
-[[check]]
-name = "sleep"
-example = "A test using a fixed sleep to wait for asynchronous work reports a timing finding. Wait for the actual completion expectation or poll the required condition with a bounded timeout."
-level = "all"
-stage = "commit"
-files = { tags = ["swift-test"] }
-summary = "Refuses sleep calls in test files."
-why = "A sleep makes a test slow when it passes and flaky when the machine is slower than the number."
-help = "Wait on an expectation or a confirmation, or poll a condition with a timeout."
+why = "A skipped test with no reason stays off, because nobody can tell when to restore it."
 
 [[check]]
-name = "coverage"
 example = "A Swift target reports 85% line coverage against a 90% floor. Add a test that exercises its uncovered lines, then rerun the target."
+files = { extensions = [".swift"] }
+help = "Add tests for the target, or lower its floor with a reason."
 level = "recommended"
-stage = "push"
-runs = "scope"
+name = "coverage"
 needs = ["build"]
 operating_systems = ["macos", "linux"]
-files = { extensions = [".swift"] }
-summary = "Measures Xcode projects and Swift packages, holding each source target against coverage.lines and its coverage.override floor."
-why = "A target-specific coverage floor exposes Swift code that its test target has not exercised."
-help = "Add tests for the target, or lower its floor with a reason."
+runs = "scope"
+stage = "push"
+summary = "Measures each source target in Xcode projects and Swift packages against `coverage.lines` and its `coverage.swift_target` floor."
+why = "A floor for each target exposes Swift code that no test runs."

package/configurations/testing/swift-tests/rules/SWIFT-TESTS.md

@@ -1,6 +1,8 @@
 # Swift Tests
 
-When you write tests, these rules cover XCTest, Swift Testing, and snapshot tests.
+Read this rule when you write or change a Swift test.
+
+These rules cover XCTest, Swift Testing, and snapshot tests.
 
 ## What to test
 
@@ -11,7 +13,7 @@ When you write tests, these rules cover XCTest, Swift Testing, and snapshot test
 - When the project uses view models, assert state transitions and what the application shows to the user, never private method calls.
 - Test invalid payload mapping and validate external data when it enters the program.
 - Test cancellation and stale results for asynchronous operations.
-- Do not mock SwiftUI or test its framework behavior.
+- Do not mock SwiftUI.
 - Do not test trivial getters, setters, or framework behavior.
 - Do not add a protocol only to make a mock when the code already accepts the network or database client as an argument.
 
@@ -31,7 +33,7 @@ When you write tests, these rules cover XCTest, Swift Testing, and snapshot test
 
 - Test data shows the behavior under test.
 - Prefer private builders or stubs with sensible defaults when model construction hides the point of the test.
-- Keep test builders beside the tests that use them, unless many test files share them on purpose.
+- Keep builders beside the tests that use them, unless many test files share them on purpose.
 - Decode JSON test data only when the test covers decoding, mapping, or the format of an external payload.
 - Do not add a production default to make a test shorter.
 - Prefer stable identifiers, dates, clocks, and ordering.
@@ -48,7 +50,7 @@ private extension Message {
 }
 ```
 
-Test builders belong in test code. A test setup API never becomes a second model layer.
+A test setup API never becomes a second model layer.
 
 ## Style
 
@@ -57,7 +59,7 @@ Test builders belong in test code. A test setup API never becomes a second model
 - In XCTest, prefer throwing test methods with `try XCTUnwrap`.
 - In Swift Testing, prefer `try #require`.
 - Avoid `guard` in a test when an assertion helper states the failure directly.
-- Make test helpers and test data private unless several tests need them.
+- Make helpers and test data private unless several tests need them.
 
 ## Disabled tests