@kernlang/review 2.0.0 → 3.1.0

package/dist/rules/ground-layer.js

@@ -0,0 +1,132 @@
+/**
+ * Ground-layer KERN-IR lint rules.
+ *
+ * These operate on IRNode[], not ts-morph SourceFile.
+ * 4 are codegen errors (compilation fails via KernCodegenError).
+ * 7 are lint warnings/info (reported but compilation succeeds).
+ */
+import { createFingerprint } from '../types.js';
+// ── Helpers ──────────────────────────────────────────────────────────────
+function props(node) {
+    return node.props || {};
+}
+function children(node, type) {
+    const c = node.children || [];
+    return type ? c.filter(n => n.type === type) : c;
+}
+function loc(node) {
+    return { line: node.loc?.line || 0, col: node.loc?.col || 1 };
+}
+function finding(ruleId, severity, category, message, node, extra) {
+    const { line, col } = loc(node);
+    return {
+        source: 'kern',
+        ruleId,
+        severity,
+        category,
+        message,
+        primarySpan: { file: '', startLine: line, startCol: col, endLine: line, endCol: col },
+        fingerprint: createFingerprint(ruleId, line, col),
+        ...extra,
+    };
+}
+// ── Rules ────────────────────────────────────────────────────────────────
+/** guard without else action (lint warning) */
+export const guardWithoutElse = (nodes) => {
+    const findings = [];
+    for (const node of nodes) {
+        if (node.type === 'guard' && !props(node).else) {
+            findings.push(finding('guard-without-else', 'warning', 'pattern', `Guard '${props(node).name || 'unnamed'}' has no else action — failures will throw generic Error`, node));
+        }
+    }
+    return findings;
+};
+/** action missing idempotent annotation (lint info) */
+export const actionMissingIdempotent = (nodes) => {
+    const findings = [];
+    for (const node of nodes) {
+        if (node.type === 'action') {
+            const p = props(node);
+            if (p.idempotent !== 'true' && p.idempotent !== true) {
+                findings.push(finding('action-missing-idempotent', 'info', 'pattern', `Action '${p.name}' should declare idempotent=true/false for safety reasoning`, node));
+            }
+        }
+    }
+    return findings;
+};
+/** branch missing known variants (lint warning) */
+export const branchNonExhaustive = (nodes) => {
+    const findings = [];
+    for (const node of nodes) {
+        if (node.type === 'branch') {
+            const paths = children(node, 'path');
+            if (paths.length === 0) {
+                findings.push(finding('branch-non-exhaustive', 'warning', 'pattern', `Branch '${props(node).name || 'unnamed'}' has no paths defined`, node));
+            }
+        }
+    }
+    return findings;
+};
+/** collect without limit (lint info) */
+export const collectUnbounded = (nodes) => {
+    const findings = [];
+    for (const node of nodes) {
+        if (node.type === 'collect' && !props(node).limit) {
+            findings.push(finding('collect-unbounded', 'info', 'pattern', `Collect '${props(node).name || 'unnamed'}' has no limit — could return unbounded results`, node));
+        }
+    }
+    return findings;
+};
+/** reason without basis field (lint info) */
+export const reasonWithoutBasis = (nodes) => {
+    const findings = [];
+    for (const node of nodes) {
+        if (node.type === 'reason' && !props(node).basis) {
+            findings.push(finding('reason-without-basis', 'info', 'pattern', `Reason annotation missing basis field — adds low trust level`, node));
+        }
+    }
+    return findings;
+};
+/** assume with basis but no evidence (lint info — low trust) */
+export const assumeLowTrust = (nodes) => {
+    const findings = [];
+    for (const node of nodes) {
+        if (node.type === 'assume') {
+            const p = props(node);
+            // Check if any reason child has basis but the assume has no evidence
+            const reasonChild = children(node, 'reason')[0];
+            if (reasonChild && props(reasonChild).basis && !p.evidence) {
+                findings.push(finding('assume-low-trust', 'info', 'pattern', `Assume has basis but no evidence — low trust level`, node));
+            }
+        }
+    }
+    return findings;
+};
+/** expect range inverted (lint warning — min > max) */
+export const expectRangeInverted = (nodes) => {
+    const findings = [];
+    for (const node of nodes) {
+        if (node.type === 'expect') {
+            const p = props(node);
+            const within = p.within;
+            if (within && within.includes('..')) {
+                const [lo, hi] = within.split('..').map(Number);
+                if (!isNaN(lo) && !isNaN(hi) && lo > hi) {
+                    findings.push(finding('expect-range-inverted', 'warning', 'bug', `Expect '${p.name || 'unnamed'}' has inverted range: ${lo} > ${hi}`, node));
+                }
+            }
+        }
+    }
+    return findings;
+};
+// ── All ground-layer lint rules ──────────────────────────────────────────
+export const GROUND_LAYER_RULES = [
+    guardWithoutElse,
+    actionMissingIdempotent,
+    branchNonExhaustive,
+    collectUnbounded,
+    reasonWithoutBasis,
+    assumeLowTrust,
+    expectRangeInverted,
+];
+//# sourceMappingURL=ground-layer.js.map

package/dist/rules/ground-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ground-layer.js","sourceRoot":"","sources":["../../src/rules/ground-layer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIhD,4EAA4E;AAE5E,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAa;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9B,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,QAAsC,EACtC,QAAmC,EACnC,OAAe,EACf,IAAY,EACZ,KAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,WAAW,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;QACrF,WAAW,EAAE,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC;QACjD,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAiB,CAAC,KAAe,EAAE,EAAE;IAChE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,OAAO,CACnB,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAC1C,UAAU,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,0DAA0D,EACjG,IAAI,CACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,uBAAuB,GAAiB,CAAC,KAAe,EAAE,EAAE;IACvE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACrD,QAAQ,CAAC,IAAI,CAAC,OAAO,CACnB,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAC9C,WAAW,CAAC,CAAC,IAAI,6DAA6D,EAC9E,IAAI,CACL,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAiB,CAAC,KAAe,EAAE,EAAE;IACnE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,OAAO,CACnB,uBAAuB,EAAE,SAAS,EAAE,SAAS,EAC7C,WAAW,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,wBAAwB,EAChE,IAAI,CACL,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,wCAAwC;AACxC,MAAM,CAAC,MAAM,gBAAgB,GAAiB,CAAC,KAAe,EAAE,EAAE;IAChE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,OAAO,CACnB,mBAAmB,EAAE,MAAM,EAAE,SAAS,EACtC,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,iDAAiD,EAC1F,IAAI,CACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAiB,CAAC,KAAe,EAAE,EAAE;IAClE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC,OAAO,CACnB,sBAAsB,EAAE,MAAM,EAAE,SAAS,EACzC,8DAA8D,EAC9D,IAAI,CACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAiB,CAAC,KAAe,EAAE,EAAE;IAC9D,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACtB,qEAAqE;YACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CAAC,OAAO,CACnB,kBAAkB,EAAE,MAAM,EAAE,SAAS,EACrC,oDAAoD,EACpD,IAAI,CACL,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAiB,CAAC,KAAe,EAAE,EAAE;IACnE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,CAAC,CAAC,MAA4B,CAAC;YAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;oBACxC,QAAQ,CAAC,IAAI,CAAC,OAAO,CACnB,uBAAuB,EAAE,SAAS,EAAE,KAAK,EACzC,WAAW,CAAC,CAAC,IAAI,IAAI,SAAS,yBAAyB,EAAE,MAAM,EAAE,EAAE,EACnE,IAAI,CACL,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,4EAA4E;AAE5E,MAAM,CAAC,MAAM,kBAAkB,GAAmB;IAChD,gBAAgB;IAChB,uBAAuB;IACvB,mBAAmB;IACnB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,mBAAmB;CACpB,CAAC"}

package/dist/rules/index.d.ts

@@ -11,6 +11,6 @@
 import type { ReviewRule } from '../types.js';
 /**
  * Get all active review rules for a given target.
- * Base rules are always active; framework rules activate by target.
+ * Base + security + dead-logic + null-safety are always active; framework rules activate by target.
  */
 export declare function getActiveRules(target?: string): ReviewRule[];

package/dist/rules/index.js

@@ -9,18 +9,24 @@
  *   [nextjs]   Active when target = nextjs (on top of react)
  */
 import { baseRules } from './base.js';
+import { securityRules } from './security.js';
+import { securityV2Rules } from './security-v2.js';
+import { securityV3Rules } from './security-v3.js';
+import { securityV4Rules } from './security-v4.js';
+import { deadLogicRules } from './dead-logic.js';
 import { reactRules } from './react.js';
 import { vueRules } from './vue.js';
 import { nextjsRules } from './nextjs.js';
 import { expressRules } from './express.js';
+import { nullSafetyRules } from './null-safety.js';
 const REACT_TARGETS = new Set(['nextjs', 'tailwind', 'web', 'native']);
 const VUE_TARGETS = new Set(['vue', 'nuxt']);
 /**
  * Get all active review rules for a given target.
- * Base rules are always active; framework rules activate by target.
+ * Base + security + dead-logic + null-safety are always active; framework rules activate by target.
  */
 export function getActiveRules(target) {
-    const rules = [...baseRules];
+    const rules = [...baseRules, ...securityRules, ...securityV2Rules, ...securityV3Rules, ...securityV4Rules, ...deadLogicRules, ...nullSafetyRules];
     if (target && REACT_TARGETS.has(target)) {
         rules.push(...reactRules);
     }

package/dist/rules/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,MAAM,KAAK,GAAiB,CAAC,GAAG,SAAS,CAAC,CAAC;IAE3C,IAAI,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,MAAM,KAAK,GAAiB,CAAC,GAAG,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,eAAe,EAAE,GAAG,eAAe,EAAE,GAAG,eAAe,EAAE,GAAG,cAAc,EAAE,GAAG,eAAe,CAAC,CAAC;IAEhK,IAAI,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/rules/kern-source.d.ts

@@ -0,0 +1,16 @@
+/**
+ * .kern source review rules that operate on flattened IRNode[] plus file path.
+ *
+ * These are distinct from ground-layer lint rules because they need file-aware
+ * spans and scope-sensitive analysis over handler/expr bodies.
+ */
+import type { IRNode } from '@kernlang/core';
+import type { ReviewFinding } from '../types.js';
+export type KernSourceRule = (nodes: IRNode[], filePath: string) => ReviewFinding[];
+export declare const undefinedReference: KernSourceRule;
+export declare const typeModelMismatch: KernSourceRule;
+export declare const unusedState: KernSourceRule;
+export declare const handlerHeavy: KernSourceRule;
+export declare const missingConfidence: KernSourceRule;
+export declare function lintKernSourceIR(nodes: IRNode[], filePath: string, rules?: KernSourceRule[]): ReviewFinding[];
+export declare const KERN_SOURCE_RULES: KernSourceRule[];