@mondaydotcomorg/z2h-cli 0.29.1 → 0.29.3

package/dist/backend/ast.d.ts

@@ -1,6 +1,4 @@
-import type { AnyNode, Expression, Node, Pattern, Program, VariableDeclaration } from 'acorn';
-/** 1-based line a node starts on; requires the program to be parsed with `locations: true`. */
-export declare const lineOf: (node: Node) => number | undefined;
+import type { AnyNode, Expression, Pattern, Program, VariableDeclaration } from 'acorn';
 export interface Declaration {
     kind: VariableDeclaration['kind'];
     init: Expression | null | undefined;

package/dist/backend/ast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../src/backend/ast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAG9F,+FAA+F;AAC/F,eAAO,MAAM,MAAM,GAAI,MAAM,IAAI,KAAG,MAAM,GAAG,SAAiC,CAAC;AAI/E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,uFAAuF;IACvF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AA8CD,kFAAkF;AAClF,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,MAAM,EAAmD,CAAC;AAE1G,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CA4C1D;AA2BD,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,CA6B1F;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAWpF"}
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../src/backend/ast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAKxF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,uFAAuF;IACvF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AA8CD,kFAAkF;AAClF,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,MAAM,EAAmD,CAAC;AAE1G,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CA4C1D;AA2BD,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,CA6B1F;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAWpF"}

package/dist/backend/ast.js

@@ -2,8 +2,6 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 const acornWalk = require('acorn-walk');
 
-/** 1-based line a node starts on; requires the program to be parsed with `locations: true`. */
-const lineOf = (node) => node.loc?.start.line;
 /**
  * Every identifier a binding pattern introduces, with its property path from the
  * pattern's value. `path` is deliberately not defaulted: callers pass `[]` for
@@ -148,5 +146,4 @@ function collectApiDomains(program, paths) {
 exports.collectApiDomains = collectApiDomains;
 exports.collectBindings = collectBindings;
 exports.createPathResolver = createPathResolver;
-exports.lineOf = lineOf;
 exports.patternNames = patternNames;

package/dist/backend/validate.d.ts

@@ -9,9 +9,6 @@ export interface HandlerValidation {
  * top-level global, and imports/requires (which would resolve to nothing at
  * runtime) are rejected.
  *
- * Once the handler is structurally sound, capability-specific rules from
- * `./rules` run and every violation is reported at once.
- *
  * Unknown `ctx.api.v1.<domain>` usage is a warning, not a failure: this pass is
  * build-time DX feedback for agent-generated code, never a security boundary —
  * the isolate has no ambient capabilities regardless of what a handler contains.

package/dist/backend/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/backend/validate.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAuCrF"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/backend/validate.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAkCrF"}

package/dist/backend/validate.js

@@ -7,7 +7,6 @@ const backend_ast = require('./ast.js');
 const backend_handlerDeclaration = require('./handler-declaration.js');
 const backend_messages = require('./messages.js');
 const backend_parse = require('./parse.js');
-const backend_rules_index = require('./rules/index.js');
 
 const KNOWN_API_DOMAINS = [...z2hSharedUtils.ALWAYS_ON_CHANNELS, ...z2hSharedUtils.DECLARED_INTEGRATIONS];
 /**
@@ -17,9 +16,6 @@ const KNOWN_API_DOMAINS = [...z2hSharedUtils.ALWAYS_ON_CHANNELS, ...z2hSharedUti
  * top-level global, and imports/requires (which would resolve to nothing at
  * runtime) are rejected.
  *
- * Once the handler is structurally sound, capability-specific rules from
- * `./rules` run and every violation is reported at once.
- *
  * Unknown `ctx.api.v1.<domain>` usage is a warning, not a failure: this pass is
  * build-time DX feedback for agent-generated code, never a security boundary —
  * the isolate has no ambient capabilities regardless of what a handler contains.
@@ -49,10 +45,6 @@ function validateHandlerSource(file, source) {
     }
     const paths = backend_ast.createPathResolver(bindings, backend_handlerDeclaration.handlerContextParamName(declaration));
     const apiDomains = backend_ast.collectApiDomains(program, paths);
-    const violations = backend_rules_index.HANDLER_RULES.flatMap(rule => rule.check({ file, program, bindings, paths }));
-    if (violations.length > 0) {
-        throw new Error(violations.join('\n'));
-    }
     for (const domain of apiDomains) {
         if (!KNOWN_API_DOMAINS.includes(domain)) {
             util_logger.warn(`${file}: ctx.api.v1.${domain} is not a known capability (available: ${KNOWN_API_DOMAINS.join(', ')})`);

package/dist/esm/backend/ast.d.ts

@@ -1,6 +1,4 @@
-import type { AnyNode, Expression, Node, Pattern, Program, VariableDeclaration } from 'acorn';
-/** 1-based line a node starts on; requires the program to be parsed with `locations: true`. */
-export declare const lineOf: (node: Node) => number | undefined;
+import type { AnyNode, Expression, Pattern, Program, VariableDeclaration } from 'acorn';
 export interface Declaration {
     kind: VariableDeclaration['kind'];
     init: Expression | null | undefined;

package/dist/esm/backend/ast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../../src/backend/ast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAG9F,+FAA+F;AAC/F,eAAO,MAAM,MAAM,GAAI,MAAM,IAAI,KAAG,MAAM,GAAG,SAAiC,CAAC;AAI/E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,uFAAuF;IACvF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AA8CD,kFAAkF;AAClF,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,MAAM,EAAmD,CAAC;AAE1G,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CA4C1D;AA2BD,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,CA6B1F;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAWpF"}
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../../src/backend/ast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAKxF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,uFAAuF;IACvF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AA8CD,kFAAkF;AAClF,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,MAAM,EAAmD,CAAC;AAE1G,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CA4C1D;AA2BD,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,CA6B1F;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAWpF"}

package/dist/esm/backend/ast.mjs

@@ -1,7 +1,5 @@
 import { full, simple } from 'acorn-walk';
 
-/** 1-based line a node starts on; requires the program to be parsed with `locations: true`. */
-const lineOf = (node) => node.loc?.start.line;
 /**
  * Every identifier a binding pattern introduces, with its property path from the
  * pattern's value. `path` is deliberately not defaulted: callers pass `[]` for
@@ -143,4 +141,4 @@ function collectApiDomains(program, paths) {
     return apiDomains;
 }
 
-export { collectApiDomains, collectBindings, createPathResolver, lineOf, patternNames };
+export { collectApiDomains, collectBindings, createPathResolver, patternNames };

package/dist/esm/backend/validate.d.ts

@@ -9,9 +9,6 @@ export interface HandlerValidation {
  * top-level global, and imports/requires (which would resolve to nothing at
  * runtime) are rejected.
  *
- * Once the handler is structurally sound, capability-specific rules from
- * `./rules` run and every violation is reported at once.
- *
  * Unknown `ctx.api.v1.<domain>` usage is a warning, not a failure: this pass is
  * build-time DX feedback for agent-generated code, never a security boundary —
  * the isolate has no ambient capabilities regardless of what a handler contains.

package/dist/esm/backend/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/backend/validate.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAuCrF"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/backend/validate.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAkCrF"}

package/dist/esm/backend/validate.mjs

@@ -5,7 +5,6 @@ import { collectBindings, createPathResolver, collectApiDomains } from './ast.mj
 import { findHandlerDeclaration, NEVER_A_FUNCTION, handlerContextParamName } from './handler-declaration.mjs';
 import { messages } from './messages.mjs';
 import { parseOrThrow } from './parse.mjs';
-import { HANDLER_RULES } from './rules/index.mjs';
 
 const KNOWN_API_DOMAINS = [...ALWAYS_ON_CHANNELS, ...DECLARED_INTEGRATIONS];
 /**
@@ -15,9 +14,6 @@ const KNOWN_API_DOMAINS = [...ALWAYS_ON_CHANNELS, ...DECLARED_INTEGRATIONS];
  * top-level global, and imports/requires (which would resolve to nothing at
  * runtime) are rejected.
  *
- * Once the handler is structurally sound, capability-specific rules from
- * `./rules` run and every violation is reported at once.
- *
  * Unknown `ctx.api.v1.<domain>` usage is a warning, not a failure: this pass is
  * build-time DX feedback for agent-generated code, never a security boundary —
  * the isolate has no ambient capabilities regardless of what a handler contains.
@@ -47,10 +43,6 @@ function validateHandlerSource(file, source) {
     }
     const paths = createPathResolver(bindings, handlerContextParamName(declaration));
     const apiDomains = collectApiDomains(program, paths);
-    const violations = HANDLER_RULES.flatMap(rule => rule.check({ file, program, bindings, paths }));
-    if (violations.length > 0) {
-        throw new Error(violations.join('\n'));
-    }
     for (const domain of apiDomains) {
         if (!KNOWN_API_DOMAINS.includes(domain)) {
             warn(`${file}: ctx.api.v1.${domain} is not a known capability (available: ${KNOWN_API_DOMAINS.join(', ')})`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/z2h-cli",
-  "version": "0.29.1",
+  "version": "0.29.3",
   "bin": "./bin/z2h-cli.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -52,7 +52,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.706.0",
     "@mondaydotcomorg/z2h-dashboard-templates": "^0.3.4",
-    "@mondaydotcomorg/z2h-shared-utils": "^0.6.1",
+    "@mondaydotcomorg/z2h-shared-utils": "^0.6.2",
     "acorn": "^8.14.0",
     "acorn-walk": "^8.3.4",
     "chokidar": "^3.6.0",

package/src/backend/__tests__/validate.test.ts

@@ -112,47 +112,6 @@ describe('validateHandlerSource — syntax errors', () => {
   });
 });
 
-describe('validateHandlerSource — capability rules', () => {
-  it('runs the rule set once the handler is structurally valid', () => {
-    expect(() => validate('async function handler(ctx) { return ctx.api.v1.snowflake.query(ctx.input.sql); }')).toThrow(
-      /snowflake\.query must receive SQL written in the handler/
-    );
-  });
-
-  it('runs snowflake SQL rules through a renamed handler parameter', () => {
-    expect(() =>
-      validate('async function handler(context) { return context.api.v1.snowflake.query(context.input.sql); }')
-    ).toThrow(/snowflake\.query must receive SQL written in the handler/);
-  });
-
-  it('runs snowflake SQL rules through computed channel access', () => {
-    expect(() =>
-      validate('async function handler(ctx) { return ctx.api.v1["snowflake"].query(ctx.input.sql); }')
-    ).toThrow(/snowflake\.query must receive SQL written in the handler/);
-  });
-
-  it('runs snowflake SQL rules through a wrapped handler with a renamed parameter', () => {
-    expect(() =>
-      validate(
-        'const handler = wrap(async (context) => context.api.v1.snowflake.query(context.input.sql)); function wrap(f) { return f; }'
-      )
-    ).toThrow(/snowflake\.query must receive SQL written in the handler/);
-  });
-
-  it('reports structural problems before rule violations', () => {
-    expect(() => validate('async function main(ctx) { return ctx.api.v1.snowflake.query(ctx.input.sql); }')).toThrow(
-      /must define a handler/
-    );
-  });
-
-  it('still returns api domains when every rule passes', () => {
-    expect(
-      validate('async function handler(ctx) { return ctx.api.v1.snowflake.query("select 1", { id: ctx.input.id }); }')
-        .apiDomains
-    ).toEqual(['snowflake']);
-  });
-});
-
 describe('validateHandlerSource — ctx.api.v1 domains', () => {
   it('returns every domain touched, sorted and unique', () => {
     const { apiDomains } = validate(

package/src/backend/ast.ts

@@ -1,9 +1,6 @@
-import type { AnyNode, Expression, Node, Pattern, Program, VariableDeclaration } from 'acorn';
+import type { AnyNode, Expression, Pattern, Program, VariableDeclaration } from 'acorn';
 import { full as walkFull, simple as walkSimple } from 'acorn-walk';
 
-/** 1-based line a node starts on; requires the program to be parsed with `locations: true`. */
-export const lineOf = (node: Node): number | undefined => node.loc?.start.line;
-
 // ─────────── Bindings ───────────
 
 export interface Declaration {

package/src/backend/validate.ts

@@ -5,7 +5,6 @@ import { collectApiDomains, collectBindings, createPathResolver } from './ast';
 import { findHandlerDeclaration, handlerContextParamName, NEVER_A_FUNCTION } from './handler-declaration';
 import { messages } from './messages';
 import { parseOrThrow } from './parse';
-import { HANDLER_RULES } from './rules';
 
 const KNOWN_API_DOMAINS: readonly string[] = [...ALWAYS_ON_CHANNELS, ...DECLARED_INTEGRATIONS];
 
@@ -21,9 +20,6 @@ export interface HandlerValidation {
  * top-level global, and imports/requires (which would resolve to nothing at
  * runtime) are rejected.
  *
- * Once the handler is structurally sound, capability-specific rules from
- * `./rules` run and every violation is reported at once.
- *
  * Unknown `ctx.api.v1.<domain>` usage is a warning, not a failure: this pass is
  * build-time DX feedback for agent-generated code, never a security boundary —
  * the isolate has no ambient capabilities regardless of what a handler contains.
@@ -58,11 +54,6 @@ export function validateHandlerSource(file: string, source: string): HandlerVali
   const paths = createPathResolver(bindings, handlerContextParamName(declaration));
   const apiDomains = collectApiDomains(program, paths);
 
-  const violations = HANDLER_RULES.flatMap(rule => rule.check({ file, program, bindings, paths }));
-  if (violations.length > 0) {
-    throw new Error(violations.join('\n'));
-  }
-
   for (const domain of apiDomains) {
     if (!KNOWN_API_DOMAINS.includes(domain)) {
       warn(`${file}: ctx.api.v1.${domain} is not a known capability (available: ${KNOWN_API_DOMAINS.join(', ')})`);

package/dist/backend/rules/__tests__/snowflake-static-sql.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=snowflake-static-sql.test.d.ts.map

package/dist/backend/rules/__tests__/snowflake-static-sql.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"snowflake-static-sql.test.d.ts","sourceRoot":"","sources":["../../../../src/backend/rules/__tests__/snowflake-static-sql.test.ts"],"names":[],"mappings":""}

package/dist/backend/rules/index.d.ts

@@ -1,5 +0,0 @@
-import type { HandlerRule } from './types';
-export type { HandlerRule, RuleContext } from './types';
-/** Every rule the validator runs, in order. Add new capability rules here. */
-export declare const HANDLER_RULES: readonly HandlerRule[];
-//# sourceMappingURL=index.d.ts.map

package/dist/backend/rules/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backend/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAG3C,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAExD,8EAA8E;AAC9E,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAAmC,CAAC"}

package/dist/backend/rules/index.js

@@ -1,8 +0,0 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-
-const backend_rules_snowflakeStaticSql = require('./snowflake-static-sql.js');
-
-/** Every rule the validator runs, in order. Add new capability rules here. */
-const HANDLER_RULES = [new backend_rules_snowflakeStaticSql.SnowflakeStaticSqlRule()];
-
-exports.HANDLER_RULES = HANDLER_RULES;

package/dist/backend/rules/snowflake-static-sql.d.ts

@@ -1,15 +0,0 @@
-import type { HandlerRule, RuleContext } from './types';
-/**
- * `ctx.api.v1.snowflake.query(sql, params?, options?)` — the SQL text must live
- * in the handler. The frontend chooses *which* handler to call and supplies
- * `params` / `options`; it never ships SQL. Binding placeholders (`:name`) are
- * how client values reach the query.
- *
- * The call is matched through `const` aliases of the channel
- * (`const sf = ctx.api.v1.snowflake; sf.query(…)`), see `PathResolver`.
- */
-export declare class SnowflakeStaticSqlRule implements HandlerRule {
-    readonly name = "snowflake/static-sql";
-    check({ file, program, bindings, paths }: RuleContext): string[];
-}
-//# sourceMappingURL=snowflake-static-sql.d.ts.map

package/dist/backend/rules/snowflake-static-sql.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"snowflake-static-sql.d.ts","sourceRoot":"","sources":["../../../src/backend/rules/snowflake-static-sql.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAgDxD;;;;;;;;GAQG;AACH,qBAAa,sBAAuB,YAAW,WAAW;IACxD,QAAQ,CAAC,IAAI,0BAA0B;IAEvC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,WAAW,GAAG,MAAM,EAAE;CAcjE"}

package/dist/backend/rules/snowflake-static-sql.js

@@ -1,75 +0,0 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-
-const acornWalk = require('acorn-walk');
-const backend_ast = require('../ast.js');
-
-const SNOWFLAKE_QUERY = 'ctx.api.v1.snowflake.query';
-const message = (file, line) => `${file}${line ? `:${line}` : ''}: ${SNOWFLAKE_QUERY} must receive SQL written in the handler — a string literal, ` +
-    `or a variable bound to one. Client-supplied values go through params (\`:name\` bindings) and options, never into the SQL text.`;
-/**
- * True when every possible value of `node` is text authored in this file:
- * string literals, templates whose holes are themselves static, `+`
- * concatenation, either branch of a conditional, and identifiers that resolve
- * (within the file) to such values. Anything reaching outside the file —
- * `ctx.input`, calls, member reads, destructuring — is not static.
- */
-function isStaticSql(node, bindings, resolving) {
-    if (!node) {
-        return false;
-    }
-    const staticChild = (child) => isStaticSql(child, bindings, resolving);
-    switch (node.type) {
-        case 'Literal':
-            return typeof node.value === 'string';
-        case 'TemplateLiteral':
-            return node.expressions.every(staticChild);
-        case 'BinaryExpression':
-            return node.operator === '+' && staticChild(node.left) && staticChild(node.right);
-        case 'ConditionalExpression':
-            return staticChild(node.consequent) && staticChild(node.alternate);
-        case 'LogicalExpression':
-            return staticChild(node.left) && staticChild(node.right);
-        case 'Identifier': {
-            const { name } = node;
-            if (bindings.unpinnable.has(name) || resolving.has(name)) {
-                return false;
-            }
-            const decls = bindings.declarations.get(name);
-            if (!decls || decls.length === 0) {
-                return false;
-            }
-            const next = new Set(resolving).add(name);
-            return decls.every(d => d.path?.length === 0 && isStaticSql(d.init, bindings, next));
-        }
-        default:
-            return false;
-    }
-}
-/**
- * `ctx.api.v1.snowflake.query(sql, params?, options?)` — the SQL text must live
- * in the handler. The frontend chooses *which* handler to call and supplies
- * `params` / `options`; it never ships SQL. Binding placeholders (`:name`) are
- * how client values reach the query.
- *
- * The call is matched through `const` aliases of the channel
- * (`const sf = ctx.api.v1.snowflake; sf.query(…)`), see `PathResolver`.
- */
-class SnowflakeStaticSqlRule {
-    name = 'snowflake/static-sql';
-    check({ file, program, bindings, paths }) {
-        const violations = [];
-        acornWalk.simple(program, {
-            CallExpression(node) {
-                if (paths.pathOf(node.callee) !== SNOWFLAKE_QUERY) {
-                    return;
-                }
-                if (!isStaticSql(node.arguments[0], bindings, new Set())) {
-                    violations.push(message(file, backend_ast.lineOf(node)));
-                }
-            },
-        });
-        return violations;
-    }
-}
-
-exports.SnowflakeStaticSqlRule = SnowflakeStaticSqlRule;

package/dist/backend/rules/types.d.ts

@@ -1,29 +0,0 @@
-import type { Program } from 'acorn';
-import type { Bindings, PathResolver } from '../ast';
-export interface RuleContext {
-    /** Handler file name, used to prefix messages. */
-    file: string;
-    /** Parsed with `locations: true`, so rules can point at a line. */
-    program: Program;
-    /** Every variable binding in the file — see `collectBindings`. */
-    bindings: Bindings;
-    /** Resolves member chains through `const` aliases — see `createPathResolver`. */
-    paths: PathResolver;
-}
-/**
- * A capability-specific check that runs once the handler is structurally valid
- * (parses as a script, defines `handler`, imports nothing).
- *
- * Rules return human-readable violations rather than throwing so the validator
- * can report every problem in one pass — agent-generated handlers are fixed in
- * a loop, and one round-trip per violation is slow.
- *
- * Implement as a class (see `SnowflakeStaticSqlRule`) and add an instance to
- * `HANDLER_RULES` in `./index.ts` — keeps every rule the same shape to read.
- */
-export interface HandlerRule {
-    /** Stable identifier, e.g. `snowflake/static-sql`. */
-    name: string;
-    check(ctx: RuleContext): string[];
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/backend/rules/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/backend/rules/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,QAAQ,EAAE,QAAQ,CAAC;IACnB,iFAAiF;IACjF,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,EAAE,CAAC;CACnC"}

package/dist/backend/rules/types.js

@@ -1 +0,0 @@
-

package/dist/esm/backend/rules/__tests__/snowflake-static-sql.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=snowflake-static-sql.test.d.ts.map

package/dist/esm/backend/rules/__tests__/snowflake-static-sql.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"snowflake-static-sql.test.d.ts","sourceRoot":"","sources":["../../../../../src/backend/rules/__tests__/snowflake-static-sql.test.ts"],"names":[],"mappings":""}

package/dist/esm/backend/rules/index.d.ts

@@ -1,5 +0,0 @@
-import type { HandlerRule } from './types';
-export type { HandlerRule, RuleContext } from './types';
-/** Every rule the validator runs, in order. Add new capability rules here. */
-export declare const HANDLER_RULES: readonly HandlerRule[];
-//# sourceMappingURL=index.d.ts.map

package/dist/esm/backend/rules/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/backend/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAG3C,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAExD,8EAA8E;AAC9E,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAAmC,CAAC"}

package/dist/esm/backend/rules/index.mjs

@@ -1,6 +0,0 @@
-import { SnowflakeStaticSqlRule } from './snowflake-static-sql.mjs';
-
-/** Every rule the validator runs, in order. Add new capability rules here. */
-const HANDLER_RULES = [new SnowflakeStaticSqlRule()];
-
-export { HANDLER_RULES };

package/dist/esm/backend/rules/snowflake-static-sql.d.ts

@@ -1,15 +0,0 @@
-import type { HandlerRule, RuleContext } from './types';
-/**
- * `ctx.api.v1.snowflake.query(sql, params?, options?)` — the SQL text must live
- * in the handler. The frontend chooses *which* handler to call and supplies
- * `params` / `options`; it never ships SQL. Binding placeholders (`:name`) are
- * how client values reach the query.
- *
- * The call is matched through `const` aliases of the channel
- * (`const sf = ctx.api.v1.snowflake; sf.query(…)`), see `PathResolver`.
- */
-export declare class SnowflakeStaticSqlRule implements HandlerRule {
-    readonly name = "snowflake/static-sql";
-    check({ file, program, bindings, paths }: RuleContext): string[];
-}
-//# sourceMappingURL=snowflake-static-sql.d.ts.map

package/dist/esm/backend/rules/snowflake-static-sql.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"snowflake-static-sql.d.ts","sourceRoot":"","sources":["../../../../src/backend/rules/snowflake-static-sql.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAgDxD;;;;;;;;GAQG;AACH,qBAAa,sBAAuB,YAAW,WAAW;IACxD,QAAQ,CAAC,IAAI,0BAA0B;IAEvC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,WAAW,GAAG,MAAM,EAAE;CAcjE"}

package/dist/esm/backend/rules/snowflake-static-sql.mjs

@@ -1,73 +0,0 @@
-import { simple } from 'acorn-walk';
-import { lineOf } from '../ast.mjs';
-
-const SNOWFLAKE_QUERY = 'ctx.api.v1.snowflake.query';
-const message = (file, line) => `${file}${line ? `:${line}` : ''}: ${SNOWFLAKE_QUERY} must receive SQL written in the handler — a string literal, ` +
-    `or a variable bound to one. Client-supplied values go through params (\`:name\` bindings) and options, never into the SQL text.`;
-/**
- * True when every possible value of `node` is text authored in this file:
- * string literals, templates whose holes are themselves static, `+`
- * concatenation, either branch of a conditional, and identifiers that resolve
- * (within the file) to such values. Anything reaching outside the file —
- * `ctx.input`, calls, member reads, destructuring — is not static.
- */
-function isStaticSql(node, bindings, resolving) {
-    if (!node) {
-        return false;
-    }
-    const staticChild = (child) => isStaticSql(child, bindings, resolving);
-    switch (node.type) {
-        case 'Literal':
-            return typeof node.value === 'string';
-        case 'TemplateLiteral':
-            return node.expressions.every(staticChild);
-        case 'BinaryExpression':
-            return node.operator === '+' && staticChild(node.left) && staticChild(node.right);
-        case 'ConditionalExpression':
-            return staticChild(node.consequent) && staticChild(node.alternate);
-        case 'LogicalExpression':
-            return staticChild(node.left) && staticChild(node.right);
-        case 'Identifier': {
-            const { name } = node;
-            if (bindings.unpinnable.has(name) || resolving.has(name)) {
-                return false;
-            }
-            const decls = bindings.declarations.get(name);
-            if (!decls || decls.length === 0) {
-                return false;
-            }
-            const next = new Set(resolving).add(name);
-            return decls.every(d => d.path?.length === 0 && isStaticSql(d.init, bindings, next));
-        }
-        default:
-            return false;
-    }
-}
-/**
- * `ctx.api.v1.snowflake.query(sql, params?, options?)` — the SQL text must live
- * in the handler. The frontend chooses *which* handler to call and supplies
- * `params` / `options`; it never ships SQL. Binding placeholders (`:name`) are
- * how client values reach the query.
- *
- * The call is matched through `const` aliases of the channel
- * (`const sf = ctx.api.v1.snowflake; sf.query(…)`), see `PathResolver`.
- */
-class SnowflakeStaticSqlRule {
-    name = 'snowflake/static-sql';
-    check({ file, program, bindings, paths }) {
-        const violations = [];
-        simple(program, {
-            CallExpression(node) {
-                if (paths.pathOf(node.callee) !== SNOWFLAKE_QUERY) {
-                    return;
-                }
-                if (!isStaticSql(node.arguments[0], bindings, new Set())) {
-                    violations.push(message(file, lineOf(node)));
-                }
-            },
-        });
-        return violations;
-    }
-}
-
-export { SnowflakeStaticSqlRule };

package/dist/esm/backend/rules/types.d.ts

@@ -1,29 +0,0 @@
-import type { Program } from 'acorn';
-import type { Bindings, PathResolver } from '../ast';
-export interface RuleContext {
-    /** Handler file name, used to prefix messages. */
-    file: string;
-    /** Parsed with `locations: true`, so rules can point at a line. */
-    program: Program;
-    /** Every variable binding in the file — see `collectBindings`. */
-    bindings: Bindings;
-    /** Resolves member chains through `const` aliases — see `createPathResolver`. */
-    paths: PathResolver;
-}
-/**
- * A capability-specific check that runs once the handler is structurally valid
- * (parses as a script, defines `handler`, imports nothing).
- *
- * Rules return human-readable violations rather than throwing so the validator
- * can report every problem in one pass — agent-generated handlers are fixed in
- * a loop, and one round-trip per violation is slow.
- *
- * Implement as a class (see `SnowflakeStaticSqlRule`) and add an instance to
- * `HANDLER_RULES` in `./index.ts` — keeps every rule the same shape to read.
- */
-export interface HandlerRule {
-    /** Stable identifier, e.g. `snowflake/static-sql`. */
-    name: string;
-    check(ctx: RuleContext): string[];
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/esm/backend/rules/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/backend/rules/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,QAAQ,EAAE,QAAQ,CAAC;IACnB,iFAAiF;IACjF,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,EAAE,CAAC;CACnC"}

package/dist/esm/backend/rules/types.mjs

@@ -1 +0,0 @@
-

package/src/backend/rules/__tests__/snowflake-static-sql.test.ts

@@ -1,175 +0,0 @@
-import { parse } from 'acorn';
-import { describe, expect, it } from 'vitest';
-import { collectBindings, createPathResolver } from '../../ast';
-import { findHandlerDeclaration, handlerContextParamName } from '../../handler-declaration';
-import { SnowflakeStaticSqlRule } from '../snowflake-static-sql';
-
-const rule = new SnowflakeStaticSqlRule();
-
-const check = (source: string) => {
-  const program = parse(source, { ecmaVersion: 'latest', sourceType: 'script', locations: true });
-  const bindings = collectBindings(program);
-  const declaration = findHandlerDeclaration(program.body);
-  return rule.check({
-    file: 'h.js',
-    program,
-    bindings,
-    paths: createPathResolver(bindings, declaration && handlerContextParamName(declaration)),
-  });
-};
-
-const inHandler = (body: string) => `async function handler(ctx) {\n${body}\n}`;
-
-describe('snowflake/static-sql — accepted', () => {
-  it.each([
-    ['a string literal', 'return ctx.api.v1.snowflake.query("select 1");'],
-    ['a template literal without holes', 'return ctx.api.v1.snowflake.query(`select 1`);'],
-    [
-      'a template literal whose holes are static',
-      'const t = "items"; return ctx.api.v1.snowflake.query(`select * from ${t}`);',
-    ],
-    ['a local const', 'const sql = "select 1"; return ctx.api.v1.snowflake.query(sql);'],
-    [
-      'a var declared before use',
-      'var sql = "select 1"; return ctx.api.v1.snowflake.query(sql, undefined, { identifier: "x" });',
-    ],
-    ['concatenated literals', 'return ctx.api.v1.snowflake.query("select 1" + " from dual");'],
-    [
-      'a variable chain',
-      'const base = "select 1"; const sql = base + " limit 1"; return ctx.api.v1.snowflake.query(sql);',
-    ],
-    [
-      'a conditional between two static queries',
-      'const sql = ctx.input.all ? "select 1" : "select 2"; return ctx.api.v1.snowflake.query(sql);',
-    ],
-    [
-      'a nullish fallback between static queries',
-      'return ctx.api.v1.snowflake.query(A ?? "select 1"); const A = "select 2";',
-    ],
-    [
-      'client values in params and options',
-      'return ctx.api.v1.snowflake.query("select :id", { id: ctx.input.id }, { timeoutMs: ctx.input.t });',
-    ],
-    ['optional chaining on the channel', 'return ctx?.api?.v1?.snowflake?.query("select 1");'],
-  ])('accepts %s', (_label, body) => {
-    expect(check(inHandler(body))).toEqual([]);
-  });
-
-  it('accepts a top-level const shared by several calls', () => {
-    expect(
-      check(
-        `const SQL = "select 1";\n${inHandler(
-          'await ctx.api.v1.snowflake.query(SQL); return ctx.api.v1.snowflake.query(SQL);'
-        )}`
-      )
-    ).toEqual([]);
-  });
-
-  it('ignores other snowflake members and other channels', () => {
-    expect(
-      check(inHandler('ctx.api.v1.snowflake.other(ctx.input.sql); return ctx.api.v1.monday.query(ctx.input.q);'))
-    ).toEqual([]);
-  });
-
-  it('accepts static SQL through a const alias of the channel', () => {
-    expect(
-      check(inHandler('const sf = ctx.api.v1.snowflake; return sf.query("select 1", { id: ctx.input.id });'))
-    ).toEqual([]);
-  });
-});
-
-describe('snowflake/static-sql — channel aliases', () => {
-  it.each([
-    ['a const alias of the channel', 'const sf = ctx.api.v1.snowflake; return sf.query(ctx.input.sql);'],
-    ['a const alias of the api root', 'const api = ctx.api.v1; return api.snowflake.query(ctx.input.sql);'],
-    ['a chain of const aliases', 'const api = ctx.api; const sf = api.v1.snowflake; return sf.query(ctx.input.sql);'],
-    ['a destructured channel', 'const { snowflake } = ctx.api.v1; return snowflake.query(ctx.input.sql);'],
-    ['a renamed destructured channel', 'const { snowflake: sf } = ctx.api.v1; return sf.query(ctx.input.sql);'],
-    ['a nested destructuring', 'const { api: { v1: { snowflake } } } = ctx; return snowflake.query(ctx.input.sql);'],
-    ['a destructured method', 'const { query } = ctx.api.v1.snowflake; return query(ctx.input.sql);'],
-    ['an optional-chained alias', 'const sf = ctx?.api?.v1?.snowflake; return sf.query(ctx.input.sql);'],
-    ['a computed string-literal channel', 'return ctx.api.v1["snowflake"].query(ctx.input.sql);'],
-    ['a computed alias', 'const sf = ctx.api.v1["snowflake"]; return sf.query(ctx.input.sql);'],
-  ])('sees through %s', (_label, body) => {
-    expect(check(inHandler(body))).toHaveLength(1);
-  });
-
-  it('follows a top-level const alias into the handler', () => {
-    expect(check(`const sf = ctx.api.v1.snowflake;\n${inHandler('return sf.query(ctx.input.sql);')}`)).toHaveLength(1);
-  });
-
-  it('sees through a renamed handler parameter', () => {
-    expect(
-      check('async function handler(context) { return context.api.v1.snowflake.query(context.input.sql); }')
-    ).toHaveLength(1);
-  });
-
-  it.each([
-    ['a let alias', 'let sf = ctx.api.v1.snowflake; return sf.query(ctx.input.sql);'],
-    ['a reassigned alias', 'var sf = ctx.api.v1.snowflake; sf = other; return sf.query(ctx.input.sql);'],
-    [
-      'an alias shadowed by a parameter',
-      'const sf = ctx.api.v1.snowflake; const run = (sf) => sf.query(ctx.input.sql); return run(fake);',
-    ],
-    [
-      'an alias declared twice',
-      'const sf = ctx.api.v1.snowflake; { const sf = fake; return sf.query(ctx.input.sql); }',
-    ],
-    ['an alias with a default value', 'const { snowflake: sf = fake } = ctx.api.v1; return sf.query(ctx.input.sql);'],
-  ])('does not follow %s — the binding cannot be pinned', (_label, body) => {
-    expect(check(inHandler(body))).toEqual([]);
-  });
-});
-
-describe('snowflake/static-sql — rejected', () => {
-  it.each([
-    ['ctx.input directly', 'return ctx.api.v1.snowflake.query(ctx.input.sql);'],
-    ['a variable bound to ctx.input', 'const sql = ctx.input.sql; return ctx.api.v1.snowflake.query(sql);'],
-    [
-      'a template literal with a ctx.input hole',
-      'return ctx.api.v1.snowflake.query(`select * from ${ctx.input.table}`);',
-    ],
-    ['concatenation with ctx.input', 'return ctx.api.v1.snowflake.query("select * from " + ctx.input.table);'],
-    [
-      'a conditional with one dynamic branch',
-      'return ctx.api.v1.snowflake.query(ctx.input.x ? "select 1" : ctx.input.sql);',
-    ],
-    ['a call result', 'return ctx.api.v1.snowflake.query(buildSql(ctx.input));'],
-    ['a destructured binding', 'const { sql } = ctx.input; return ctx.api.v1.snowflake.query(sql);'],
-    ['a reassigned variable', 'let sql = "select 1"; sql = ctx.input.sql; return ctx.api.v1.snowflake.query(sql);'],
-    [
-      'a compound-assigned variable',
-      'let sql = "select 1"; sql += ctx.input.where; return ctx.api.v1.snowflake.query(sql);',
-    ],
-    ['a function parameter', 'const run = (sql) => ctx.api.v1.snowflake.query(sql); return run(ctx.input.sql);'],
-    ['an undeclared identifier', 'return ctx.api.v1.snowflake.query(sql);'],
-    ['a spread argument', 'return ctx.api.v1.snowflake.query(...ctx.input.args);'],
-    ['a non-string literal', 'return ctx.api.v1.snowflake.query(1);'],
-    ['no arguments', 'return ctx.api.v1.snowflake.query();'],
-  ])('rejects %s', (_label, body) => {
-    const violations = check(inHandler(body));
-    expect(violations).toHaveLength(1);
-    expect(violations[0]).toMatch(/^h\.js:2: ctx\.api\.v1\.snowflake\.query must receive SQL written in the handler/);
-  });
-
-  it('rejects a variable shadowed by a parameter anywhere in the file', () => {
-    expect(
-      check(
-        `const sql = "select 1";\nfunction run(sql) { return ctx.api.v1.snowflake.query(sql); }\n${inHandler(
-          'return run(ctx.input.sql);'
-        )}`
-      )
-    ).toHaveLength(1);
-  });
-
-  it('does not loop on self-referential bindings', () => {
-    expect(check(inHandler('const a = b; const b = a; return ctx.api.v1.snowflake.query(a);'))).toHaveLength(1);
-  });
-
-  it('reports every offending call with its own line', () => {
-    const violations = check(
-      inHandler('await ctx.api.v1.snowflake.query(ctx.input.a);\nreturn ctx.api.v1.snowflake.query(ctx.input.b);')
-    );
-    expect(violations.map(v => v.slice(0, 6))).toEqual(['h.js:2', 'h.js:3']);
-  });
-});

package/src/backend/rules/index.ts

@@ -1,7 +0,0 @@
-import type { HandlerRule } from './types';
-import { SnowflakeStaticSqlRule } from './snowflake-static-sql';
-
-export type { HandlerRule, RuleContext } from './types';
-
-/** Every rule the validator runs, in order. Add new capability rules here. */
-export const HANDLER_RULES: readonly HandlerRule[] = [new SnowflakeStaticSqlRule()];

package/src/backend/rules/snowflake-static-sql.ts

@@ -1,78 +0,0 @@
-import type { AnyNode } from 'acorn';
-import { simple as walkSimple } from 'acorn-walk';
-import { type Bindings, lineOf } from '../ast';
-import type { HandlerRule, RuleContext } from './types';
-
-const SNOWFLAKE_QUERY = 'ctx.api.v1.snowflake.query';
-
-const message = (file: string, line: number | undefined) =>
-  `${file}${line ? `:${line}` : ''}: ${SNOWFLAKE_QUERY} must receive SQL written in the handler — a string literal, ` +
-  `or a variable bound to one. Client-supplied values go through params (\`:name\` bindings) and options, never into the SQL text.`;
-
-/**
- * True when every possible value of `node` is text authored in this file:
- * string literals, templates whose holes are themselves static, `+`
- * concatenation, either branch of a conditional, and identifiers that resolve
- * (within the file) to such values. Anything reaching outside the file —
- * `ctx.input`, calls, member reads, destructuring — is not static.
- */
-function isStaticSql(node: AnyNode | null | undefined, bindings: Bindings, resolving: ReadonlySet<string>): boolean {
-  if (!node) {
-    return false;
-  }
-  const staticChild = (child: AnyNode | null | undefined) => isStaticSql(child, bindings, resolving);
-  switch (node.type) {
-    case 'Literal':
-      return typeof node.value === 'string';
-    case 'TemplateLiteral':
-      return node.expressions.every(staticChild);
-    case 'BinaryExpression':
-      return node.operator === '+' && staticChild(node.left) && staticChild(node.right);
-    case 'ConditionalExpression':
-      return staticChild(node.consequent) && staticChild(node.alternate);
-    case 'LogicalExpression':
-      return staticChild(node.left) && staticChild(node.right);
-    case 'Identifier': {
-      const { name } = node;
-      if (bindings.unpinnable.has(name) || resolving.has(name)) {
-        return false;
-      }
-      const decls = bindings.declarations.get(name);
-      if (!decls || decls.length === 0) {
-        return false;
-      }
-      const next = new Set(resolving).add(name);
-      return decls.every(d => d.path?.length === 0 && isStaticSql(d.init, bindings, next));
-    }
-    default:
-      return false;
-  }
-}
-
-/**
- * `ctx.api.v1.snowflake.query(sql, params?, options?)` — the SQL text must live
- * in the handler. The frontend chooses *which* handler to call and supplies
- * `params` / `options`; it never ships SQL. Binding placeholders (`:name`) are
- * how client values reach the query.
- *
- * The call is matched through `const` aliases of the channel
- * (`const sf = ctx.api.v1.snowflake; sf.query(…)`), see `PathResolver`.
- */
-export class SnowflakeStaticSqlRule implements HandlerRule {
-  readonly name = 'snowflake/static-sql';
-
-  check({ file, program, bindings, paths }: RuleContext): string[] {
-    const violations: string[] = [];
-    walkSimple(program, {
-      CallExpression(node) {
-        if (paths.pathOf(node.callee) !== SNOWFLAKE_QUERY) {
-          return;
-        }
-        if (!isStaticSql(node.arguments[0], bindings, new Set())) {
-          violations.push(message(file, lineOf(node)));
-        }
-      },
-    });
-    return violations;
-  }
-}

package/src/backend/rules/types.ts

@@ -1,30 +0,0 @@
-import type { Program } from 'acorn';
-import type { Bindings, PathResolver } from '../ast';
-
-export interface RuleContext {
-  /** Handler file name, used to prefix messages. */
-  file: string;
-  /** Parsed with `locations: true`, so rules can point at a line. */
-  program: Program;
-  /** Every variable binding in the file — see `collectBindings`. */
-  bindings: Bindings;
-  /** Resolves member chains through `const` aliases — see `createPathResolver`. */
-  paths: PathResolver;
-}
-
-/**
- * A capability-specific check that runs once the handler is structurally valid
- * (parses as a script, defines `handler`, imports nothing).
- *
- * Rules return human-readable violations rather than throwing so the validator
- * can report every problem in one pass — agent-generated handlers are fixed in
- * a loop, and one round-trip per violation is slow.
- *
- * Implement as a class (see `SnowflakeStaticSqlRule`) and add an instance to
- * `HANDLER_RULES` in `./index.ts` — keeps every rule the same shape to read.
- */
-export interface HandlerRule {
-  /** Stable identifier, e.g. `snowflake/static-sql`. */
-  name: string;
-  check(ctx: RuleContext): string[];
-}