@harperfast/template-react-ts-studio 1.12.3 → 1.12.5

package/agent/skills/harper-best-practices/rules/custom-resources.md

@@ -6,9 +6,9 @@ metadata:
   sources:
     - reference/v5/resources/overview.md#Custom External Data Source
     - reference/v5/resources/overview.md#Exporting Resources as Endpoints
-    - reference/v5/components/javascript-environment.md#Module Loading
-  sourceCommit: f37a8c4021e20d5c74c1d339a6b6c8c196b5603e
-  inputHash: df69870433c0b3e5
+    - reference/v5/components/javascript-environment.md#Module Formats
+  sourceCommit: 9e6ecf87dd25bb488ad44dc2876ca6439ccd682e
+  inputHash: 86858206e33925f0
 ---
 
 # Custom Resources
@@ -17,11 +17,11 @@ Instructions for the agent to follow when defining custom REST endpoints with Ja
 
 ## When to Use
 
-Apply this rule when creating custom HTTP endpoints, wrapping external APIs, or registering routes programmatically in a Harper application. Use it any time business logic must live outside a table-backed schema, or when a specific URL shape is required.
+Apply this rule when creating custom HTTP endpoints, wrapping external APIs, or registering routes programmatically in a Harper application. Use it any time business logic must live outside a table-backed resource or when a specific URL shape is required.
 
 ## How It Works
 
-1. **Import `Resource` from `harper`**: Always import from the `harper` package rather than relying on globals.
+1. **Import `Resource` from the `harper` package**: Always import explicitly rather than relying on globals.
 
    ```javascript
    import { tables, Resource } from 'harper';
@@ -39,7 +39,7 @@ Apply this rule when creating custom HTTP endpoints, wrapping external APIs, or
    }
    ```
 
-3. **Use `async` static methods for external calls**: Await fetch or other async operations inside `static` handlers.
+3. **Use `async` static methods to call external services**: Return or forward the response directly.
 
    ```javascript
    export class MyExternalData extends Resource {
@@ -57,7 +57,7 @@ Apply this rule when creating custom HTTP endpoints, wrapping external APIs, or
    }
    ```
 
-4. **Export the class to create an endpoint**: The export form controls the resulting URL. Choose the form that matches the URL shape you need.
+4. **Export the class to expose it as an endpoint**: The export form controls the resulting URL. Choose the form that matches the URL shape you need.
 
    | Export form                                 | URL             | Notes                                                           |
    | ------------------------------------------- | --------------- | --------------------------------------------------------------- |
@@ -68,12 +68,17 @@ Apply this rule when creating custom HTTP endpoints, wrapping external APIs, or
    | `static path = '/widget/:id'` (class field) | `/widget/:id`   | Declare path on the class; overrides the export name.           |
    | `server.resources.set('my-path', Foo);`     | `/my-path/`     | Programmatic registration for dynamic paths.                    |
 
-   URL path matching is case-sensitive — `/Foo/` and `/foo/` are different endpoints.
+5. **Register programmatically when the path is dynamic**: Use `server.resources.set(` with a path string and the resource class.
 
-5. **Declare path parameters with `static path`**: Use `:name` for a single segment and `*name` as a catch-all. Matched values are bound onto `target.<name>`.
+   ```javascript
+   server.resources.set('my-path', Foo);
+   ```
+
+6. **Declare dynamic path segments with `static path`**: Use `:name` for a single segment and `*name` as a catch-all. Matched values are bound onto `target.<name>`.
 
    ```javascript
    export class Widget extends Resource {
+   	// GET /widget/10/action/jump  ->  target.id === '10', target.action === 'jump'
    	static path = '/widget/:id/action/:action';
    	static get(target) {
    		return { id: target.id, action: target.action };
@@ -81,22 +86,11 @@ Apply this rule when creating custom HTTP endpoints, wrapping external APIs, or
    }
    ```
 
-   A `static path` takes precedence over the export name. A leading `/` makes the path root-relative (top-level). A leading `./` or bare name resolves relative to the component directory.
-
-6. **Register programmatically when the path is dynamic**: Use `server.resources.set(` when the path cannot be known at export time.
-
-   ```javascript
-   server.resources.set('my-path', Foo);
-   ```
-
-7. **Optionally source a table from a custom resource**: Use the resource as a caching layer for a local table.
-   ```javascript
-   tables.MyCache.sourcedFrom(MyExternalData);
-   ```
+7. **Resolve path precedence correctly**: Exact and static paths always win over parameterized ones. Among parameterized routes, more specific paths win: a literal segment beats a `:param`, which beats a `*` wildcard, compared left to right.
 
 ## Examples
 
-### External API wrapper with GET and PUT
+**Wrapping an external API and using it as a cache source:**
 
 ```javascript
 import { tables, Resource } from 'harper';
@@ -119,19 +113,9 @@ export class MyExternalData extends Resource {
 tables.MyCache.sourcedFrom(MyExternalData);
 ```
 
-### Path parameters with `static path`
+**Catch-all wildcard path:**
 
 ```javascript
-import { Resource } from 'harper';
-
-export class Widget extends Resource {
-	// GET /widget/10/action/jump  ->  target.id === '10', target.action === 'jump'
-	static path = '/widget/:id/action/:action';
-	static get(target) {
-		return { id: target.id, action: target.action };
-	}
-}
-
 export class Files extends Resource {
 	// GET /files/a/b/c.txt  ->  target.rest === 'a/b/c.txt'
 	static path = '/files/*rest';
@@ -141,25 +125,24 @@ export class Files extends Resource {
 }
 ```
 
-### Programmatic registration
+**Root-relative fixed route:**
 
 ```javascript
-import { Resource } from 'harper';
-
-export class Foo extends Resource {
+export class AcmeChallenge extends Resource {
+	static path = '/.well-known/acme-challenge/:token';
 	static get(target) {
-		return { data: doSomething() };
+		return { token: target.token };
 	}
 }
-
-server.resources.set('my-path', Foo);
 ```
 
 ## Notes
 
-- A bare `*` wildcard (no name) binds under `target.wildcard`. A wildcard must be the final segment of the path.
-- Resolution order: exact/static paths always win over parameterized ones. Among parameterized routes, more specific paths win — a literal segment beats `:param`, which beats `*`, compared left to right.
-- Parameterized routes appear in the generated OpenAPI document as templated paths (e.g. `/widget/{id}/action/{action}`) and in MCP `resources/templates/list` as `{param}` URI templates.
-- If a resource `extends` an existing table, avoid conflicting exports between the schema and the JavaScript implementation.
+- URL path matching is case-sensitive — `/Foo/` and `/foo/` are different endpoints.
+- A leading `/` in `static path` makes the path root-relative (top-level), independent of the file's location.
+- A leading `./` or a bare name in `static path` resolves relative to the component directory.
+- A bare `*` (no name) binds under `target.wildcard`. A wildcard must be the final segment of the path.
+- `static path` takes precedence over the export name when both are present.
+- Parameterized routes appear in the generated OpenAPI document as templated paths (e.g. `/widget/{id}/action/{action}`) and in MCP `resources/templates/list` as URI templates.
+- When a resource `extends` an existing table, avoid conflicting exports between the schema and the JavaScript implementation.
 - Link the `harper` package in your component directory to ensure correct typings: `npm link harper`. All installed components have `harper` automatically linked.
-- Harper runs as a single process — `tables`, `databases`, and other APIs are the same live, process-wide objects regardless of which component accesses them.

package/agent/skills/harper-best-practices/rules/programmatic-table-requests.md

@@ -13,30 +13,32 @@ metadata:
     - >-
       reference/v5/resources/resource-api.md#`addTo(property: string, value:
       number)`
-    - reference/v5/components/javascript-environment.md#Module Loading
-  sourceCommit: 677ad213d67822e109c83619e181ca23a59823db
-  inputHash: ce2181ecade6522f
+    - reference/v5/components/javascript-environment.md#Module Formats
+  sourceCommit: 9e6ecf87dd25bb488ad44dc2876ca6439ccd682e
+  inputHash: f5629f73cde74764
 ---
 
 # Programmatic Table Requests
 
-Instructions for the agent to interact with Harper tables programmatically using the `tables` object, including querying, transactions, and module integration.
+Instructions for the agent to interact with Harper tables programmatically using the `tables` object, the Query API, and transactions.
 
 ## When to Use
 
-Apply this rule when writing server-side Harper component code that reads from or writes to tables directly — bypassing REST endpoints — such as in request handlers, background jobs, timers, or SSR rendering. Use it whenever you need to construct queries with `conditions`, manage transactions explicitly, or perform CRDT-safe mutations.
+Apply this rule when writing server-side Harper component code that reads from or writes to tables directly — for example, in HTTP handlers, background jobs, timers, or SSR render functions. Use it whenever you need to construct queries with `conditions`, `sort`, `select`, `limit`, or `offset`, or when you need explicit transaction control via `transaction()`.
 
 ## How It Works
 
-1. **Import `tables` from `harper`**: Access all tables in the default `data` database via the `tables` object. Each table defined with `@table` in `schema.graphql` is a property.
+1. **Import `tables` (and other APIs) from `harper`**: Access every table defined in `schema.graphql` as a named property of `tables`. Each property is the table class implementing the Resource API.
 
    ```javascript
-   import { tables } from 'harper';
+   import { tables, transaction } from 'harper';
    const { Product } = tables;
-   // same as: databases.data.Product
+   // equivalent to: databases.data.Product
    ```
 
-2. **Define your schema with `@table`**: Tables must be declared in `schema.graphql`. Use `@indexed` on attributes you intend to sort or filter efficiently.
+   For standalone components, run `npm link harper` so imports resolve to the live runtime.
+
+2. **Define your schema with `@table`**: Tables must be declared in `schema.graphql`. Mark attributes you intend to sort or filter on with `@indexed`.
 
    ```graphql
    type Product @table {
@@ -46,7 +48,7 @@ Apply this rule when writing server-side Harper component code that reads from o
    }
    ```
 
-3. **Use `search(` to query records**: Pass a Query object to `search(`. Iterate results with `for await`.
+3. **Query records with `search(`**: Pass a Query object to `search(`. Iterate results with `for await`.
 
    ```javascript
    const query = {
@@ -57,7 +59,7 @@ Apply this rule when writing server-side Harper component code that reads from o
    }
    ```
 
-4. **Build `conditions` arrays to filter**: Each condition object supports these properties:
+4. **Build `conditions`**: Each condition object supports these properties:
 
    | Property     | Description                                                                                                                                              |
    | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -67,87 +69,79 @@ Apply this rule when writing server-side Harper component code that reads from o
    | `conditions` | Nested conditions array                                                                                                                                  |
    | `operator`   | `and` (default) or `or` for the nested `conditions`                                                                                                      |
 
-5. **Apply `select` to shape results**: Return only the fields you need. Supports arrays, nested relationship selects, and special properties.
+5. **Control result shape with `select`**: Pass an array of property names, a single string, or nested objects for relationships.
 
    ```javascript
-   // Array of fields
+   // Scalar fields only
    Product.search({ select: ['name', 'price'] });
 
-   // Nested relationship select
+   // Partial related record
    Book.get({ id: 42, select: ['id', 'title', { name: 'author', select: ['name'] }] });
    ```
 
    Special `select` values: `$id`, `$updatedtime`, `$distance`.
 
-6. **Apply `sort` with an `@indexed` attribute**: Harper uses an index to provide sort order. Sort by an `@indexed` attribute without requiring a condition, or provide at least one condition when sorting by a non-indexed attribute.
+6. **Paginate with `limit` and `offset`**:
 
    ```javascript
-   // Sort by primary key with an open-ended condition to avoid scan error
-   Product.search({
-   	conditions: [{ attribute: 'id', comparator: 'greater_than', value: '' }],
-   	sort: { attribute: 'id' },
-   });
+   Product.search({ conditions: [...], limit: 20, offset: 40 });
    ```
 
-   Sort object properties:
+7. **Sort with `sort`**: The `sort` object accepts `attribute`, `descending` (default `false`), and `next` for tie-breaking. Harper uses an index for sort order — the sort `attribute` must be `@indexed`, **or** at least one entry in `conditions` must be present.
+
+   Sorting by a non-indexed attribute with zero conditions raises:
 
-   | Property     | Description                                              |
-   | ------------ | -------------------------------------------------------- |
-   | `attribute`  | Property name or array for chained relationship property |
-   | `descending` | Sort descending if `true` (default: `false`)             |
-   | `next`       | Secondary sort to resolve ties (same structure)          |
+   > `HdbError: <attribute> is not indexed and not combined with any other conditions`
 
-7. **Use `limit` and `offset` for pagination**:
+   Note: `@primaryKey` alone is treated as not indexed for sort purposes. To scan the whole table in primary-key order, add an open-ended condition:
 
    ```javascript
-   Product.search({ conditions: [...], limit: 20, offset: 40 });
+   Product.search({
+   	conditions: [{ attribute: 'id', comparator: 'greater_than', value: '' }],
+   	sort: { attribute: 'id' },
+   });
    ```
 
-8. **Use `explain` and `enforceExecutionOrder` for debugging**:
+   Alternatively, pass `allowFullScan: true` to permit an unconditional ordered scan, or omit `sort` entirely to iterate without an index requirement.
+
+8. **Debug query planning with `explain` and `enforceExecutionOrder`**:
    - `explain: true` — returns conditions reordered as Harper will execute them.
    - `enforceExecutionOrder: true` — forces conditions to execute in the order supplied, disabling automatic re-ordering.
 
 9. **Use `addTo` for concurrent-safe numeric updates**: `addTo` uses CRDT incrementation, safe across threads and nodes.
 
    ```javascript
-   static async post(target, data) {
-     const record = await this.update(target.id);
-     record.addTo('quantity', -1); // decrement safely across nodes
-   }
+   const record = await Product.update(32);
+   record.addTo('quantity', -1);
    ```
 
-10. **Wrap background work in `transaction()`**: HTTP handlers get a transaction automatically. Use `transaction()` explicitly for timers, background jobs, or any code outside a natural transaction context.
+10. **Wrap background work in `transaction()`**: HTTP handlers get a transaction automatically. Use `transaction()` explicitly for timers, background jobs, or any code outside a request context. Always `await` the call and `catch` errors.
 
     ```javascript
-    import { tables } from 'harper';
-    const { MyTable } = tables;
-
-    if (isMainThread) {
-    	setInterval(async () => {
-    		let data = await (await fetch('https://example.com/data')).json();
-    		transaction(async (txn) => {
-    			for (let item of data) {
-    				await MyTable.put(item, txn);
-    			}
-    		});
-    	}, 3600000); // every hour
-    }
+    await transaction(async (txn) => {
+    	for (let item of data) {
+    		await MyTable.put(item, txn);
+    	}
+    });
     ```
 
-    The `txn` object members:
+    The `txn` object exposes:
+
+    | Member                | Description                                            |
+    | --------------------- | ------------------------------------------------------ |
+    | `commit()`            | Commits the current transaction                        |
+    | `abort()`             | Aborts and resets the transaction                      |
+    | `resetReadSnapshot()` | Resets the read snapshot to the latest committed state |
+    | `timestamp`           | Timestamp associated with the current transaction      |
 
-    | Member                | Type            | Description                                            |
-    | --------------------- | --------------- | ------------------------------------------------------ |
-    | `commit()`            | `() => Promise` | Commits the current transaction                        |
-    | `abort()`             | `() => void`    | Aborts the transaction and resets it                   |
-    | `resetReadSnapshot()` | `() => void`    | Resets the read snapshot to the latest committed state |
-    | `timestamp`           | `number`        | Timestamp associated with the current transaction      |
+    **Atomicity**: all tables in the same database share one transactional context — writes across multiple tables commit atomically. Tables in different databases each get their own transaction with no cross-database atomicity guarantee.
 
-11. **Understand atomicity boundaries**: All tables within the same database share one transactional context — writes across multiple tables commit atomically. Tables in different databases each get their own transaction with no cross-database atomicity guarantee.
+    If `transaction()` is called with a context that already has an active transaction, it reuses that transaction — safe to call defensively.
 
-12. **Keep `harper` external in bundlers**: When using SSR bundlers, mark `harper` as external so it resolves to the live runtime. In `vite.config`:
+11. **Keep `harper` external when bundling for SSR**: In `vite.config`, mark `harper` as external so it resolves to the runtime rather than being bundled.
 
     ```javascript
+    // vite.config
     ssr: {
     	external: ['harper'];
     }
@@ -155,7 +149,31 @@ Apply this rule when writing server-side Harper component code that reads from o
 
 ## Examples
 
-### Nested conditions query
+### Full CRUD sequence
+
+```javascript
+import { tables } from 'harper';
+const { Product } = tables;
+
+// Create
+const created = await Product.create({ name: 'Shirt', price: 9.5 });
+
+// Patch
+await Product.patch(created.id, { price: Math.round(created.price * 0.8 * 100) / 100 });
+
+// Retrieve by primary key
+const record = await Product.get(created.id);
+
+// Query with conditions
+const query = {
+	conditions: [{ attribute: 'price', comparator: 'less_than', value: 8.0 }],
+};
+for await (const record of Product.search(query)) {
+	// process record
+}
+```
+
+### Nested conditions with `or`
 
 ```javascript
 Product.search({
@@ -178,28 +196,35 @@ Product.search({
 Product.search({ conditions: [{ attribute: ['brand', 'name'], value: 'Harper' }] });
 ```
 
-### Full CRUD sequence
+### Background job with `transaction()`
 
 ```javascript
-// Create a new record (id auto-generated)
-const created = await Product.create({ name: 'Shirt', price: 9.5 });
-
-// Modify the record
-await Product.patch(created.id, { price: Math.round(created.price * 0.8 * 100) / 100 });
-
-// Retrieve by primary key
-const record = await Product.get(created.id);
-
-// Query with conditions
-const query = {
-	conditions: [{ attribute: 'price', comparator: 'less_than', value: 8.0 }],
-};
-for await (const record of Product.search(query)) {
-	// process record
+import { isMainThread } from 'node:worker_threads';
+import { tables, transaction } from 'harper';
+const { MyTable } = tables;
+
+if (isMainThread) {
+	let running = false;
+	setInterval(async () => {
+		if (running) return;
+		running = true;
+		try {
+			let data = await (await fetch('https://example.com/data')).json();
+			await transaction(async (txn) => {
+				for (let item of data) {
+					await MyTable.put(item, txn);
+				}
+			});
+		} catch (error) {
+			logger.error('hourly import failed', error);
+		} finally {
+			running = false;
+		}
+	}, 3600000);
 }
 ```
 
-### SSR rendering with `tables`
+### SSR render with `tables`
 
 ```typescript
 import { tables } from 'harper';
@@ -210,20 +235,9 @@ export async function render(url: string): Promise<string> {
 }
 ```
 
-### Mutable update with `addTo`
-
-```javascript
-const product = await Product.update(32);
-product.status = 'active';
-product.subtractFrom('quantity', 1);
-product.save();
-```
-
 ## Notes
 
-- `tables` calls run in a trusted server-side context and do **not** automatically apply the target table's role permissions. Enforce authorization in your own application logic.
-- Destructive operations (`update`, `patch`, `delete`) act on live data and are not easily reversible. Always scope with specific `conditions`, validate the affected set before writing, and gate behind authorization controls.
-- Sorting by the bare `@primaryKey` alone with no conditions triggers `HdbError: <attribute> is not indexed and not combined with any other conditions`. Add an open-ended range condition or pass `allowFullScan: true` to permit an unconditional scan.
-- Selecting a relationship field without filtering on it behaves as a **LEFT JOIN**; adding a condition on a related attribute behaves as an **INNER JOIN**.
-- `transaction()` is safe to call defensively — if a transaction is already active on the context, it reuses it and executes the callback immediately.
-- Link the `harper` package for correct typings in standalone component directories: `npm link harper`.
+- `tables` and `databases` do **not** automatically apply role permissions — calls run in a trusted server-side context. Apply your own authorization controls before exposing results.
+- Destructive operations (`update`, `patch`, `delete`) act on live data and are not easily reversible. Scope them with specific `conditions` and validate the affected set before writing.
+- `tables` is the same live, process-wide object whether accessed as a global or via `import { tables } from 'harper'`. A record written through one component is immediately visible to every other.
+- Run `npm link harper` for components in their own directory to ensure typings match the running installation.

package/agent/skills/harper-best-practices/rules.manifest.yaml

@@ -251,6 +251,18 @@ rules:
       - path: reference/v5/resources/resource-api.md
         section: '`getCurrentUser(): User | undefined`'
         role: primary
+      # Sourced for the `getContext()` anchor below, which was unsatisfiable
+      # without it: `getContext()` does not occur in any other sourced section
+      # (`Session and Login from a Resource` uses the `(target, data, context)`
+      # trailing-argument form throughout), so the anchor demanded a string the
+      # model could only invent — and the system prompt forbids inventing, so
+      # every run failed validation instead. This section also carries the
+      # instance-vs-static contract the rule needs: `getContext()` is an
+      # instance method, and a static verb must read the context from its
+      # trailing argument or use the `harper` module export.
+      - path: reference/v5/resources/resource-api.md
+        section: '`getContext(): Context`'
+        role: supplemental
       - path: reference/v5/resources/resource-api.md
         section: 'Session and Login from a Resource'
         role: primary
@@ -371,6 +383,13 @@ rules:
       - 'Basic Authentication'
       - 'server-to-server'
       - 'preferred over Basic Auth'
+    # Notation, not content. The old body wrote the dotted config path as one
+    # code span; the new one states the same requirement as a YAML block under
+    # `authentication:` plus prose, and the `enableSessions` anchor above still
+    # holds it. The fact-retention check compares whole code spans, so it
+    # cannot see that the two notations say the same thing.
+    allow_dropped:
+      - 'authentication.enableSessions: true'
     cross_links:
       - custom-resources
 
@@ -392,13 +411,29 @@ rules:
         section: 'Exporting Resources as Endpoints'
         role: primary
       - path: reference/v5/components/javascript-environment.md
-        section: 'Module Loading'
+        section: 'Module Formats'
         role: supplemental
     must_cover:
       - 'extends Resource'
       - 'export class'
       - 'server.resources.set('
       - 'static'
+    # Both surfaced by the fact-retention check and both judged notation
+    # rather than content:
+    #
+    # `{param}` — the old body illustrated MCP URI templates as "`{param}`
+    #   URI templates"; the new one keeps the same sentence with a concrete
+    #   `/widget/{id}/action/{action}` example, which is strictly clearer.
+    #
+    # `databases` — came from a Notes bullet asserting that `tables` and
+    #   `databases` are the same live objects "regardless of which component
+    #   accesses them". `programmatic-table-requests` owns that topic, and the
+    #   globals-vs-import framing of that bullet was flagged as contentious
+    #   during the #84 review (the docs assert it in one place and caution
+    #   against globals in another), so it is not re-pinned here.
+    allow_dropped:
+      - '{param}'
+      - 'databases'
 
   - rule: extending-tables
     description: How to add custom logic to automatically generated table resources in Harper.
@@ -442,7 +477,7 @@ rules:
         section: '`addTo(property: string, value: number)`'
         role: supplemental
       - path: reference/v5/components/javascript-environment.md
-        section: 'Module Loading'
+        section: 'Module Formats'
         role: supplemental
     must_cover:
       - 'tables'
@@ -476,10 +511,34 @@ rules:
       - 'atomicity'
       - 'limit'
       - 'offset'
-      # § Module Loading's one piece of actionable build guidance: keep `harper`
+      # § Module Formats' one piece of actionable build guidance: keep `harper`
       # external when bundling for SSR, or it is bundled instead of resolving
       # to the runtime. Only occurrence of `vite.config` in the sources.
       - 'vite.config'
+      # Both anchored after the fact-retention check caught this regeneration
+      # dropping them. The literal error string is how an agent matches the
+      # runtime failure to the fix; a body that only says "throws an error"
+      # (which is what regeneration produced) leaves it guessing. Anchored
+      # verbatim rather than as a `HdbError:` prefix, because retention
+      # compares whole code spans — a truncated variant would satisfy a short
+      # anchor and still register as a loss.
+      - 'HdbError: <attribute> is not indexed and not combined with any other conditions'
+      - 'npm link harper'
+    # The `txn` member table lost its Type column on regeneration. All four
+    # members and their behavior survived (and `resetReadSnapshot()` is
+    # anchored above), so what went is the type annotation, not the fact.
+    # Waived rather than anchored for two reasons: `number` is generic enough
+    # that requiring it pins nothing in particular, and the old `() => Promise`
+    # was already a degraded value — `commit()` returns `Promise<void>`, and
+    # the `<void>` had been stripped somewhere upstream of the rule.
+    #
+    # This is the fact-retention check's noise floor: it compares code spans,
+    # so a dropped table column reads the same as a dropped fact. Waiving is
+    # the intended response, and it stays visible here in review.
+    allow_dropped:
+      - '() => Promise'
+      - '() => void'
+      - 'number'
 
   - rule: typescript-type-stripping
     description: How to run TypeScript files directly in Harper without a build step.