@neat.is/types 0.7.5 → 0.7.6

package/dist/index.js

@@ -102,7 +102,22 @@ var NodeType = {
   // file (observed-first edges, one grain finer than §4 file grain). The node is
   // language-neutral; the per-language tree-sitter extractor is the adapter. See
   // docs/contracts/static-extraction.md and docs/contracts/file-awareness.md §1.
-  SymbolNode: "SymbolNode"
+  SymbolNode: "SymbolNode",
+  // A Next.js Server Action at (service, module, exportName) granularity
+  // (ADR-168). A Server Action is the RPC boundary of an App Router app: the
+  // client posts to it, Next serialises the call to an opaque `Next-Action`
+  // hash, and it runs on the server. At HTTP grain the whole surface collapses
+  // onto one POST edge — like a GraphQL operation — so this node recovers the
+  // per-action topology the client actually names. It is EXTRACTED-first: the
+  // static extractor mints one per exported action from a `"use server"`
+  // directive (module-level or in-body) and the file owns it through a
+  // `file ──CONTAINS──▶ action` edge; a client reference to the imported action
+  // binding lands a `file ──CALLS──▶ action` edge, so the client→action call
+  // path is a real edge the reasoning core walks like any other. OBSERVED
+  // fusion is deferred (the `Next-Action` hash carries no action name), the
+  // same posture GraphQLOperationNode took before its static extractor. See
+  // docs/contracts/static-extraction.md and docs/contracts/file-awareness.md.
+  ServerActionNode: "ServerActionNode"
 };
 var NodeTypeSchema = z.enum([
   NodeType.ServiceNode,
@@ -115,7 +130,8 @@ var NodeTypeSchema = z.enum([
   NodeType.GraphQLOperationNode,
   NodeType.GrpcMethodNode,
   NodeType.WebSocketChannelNode,
-  NodeType.SymbolNode
+  NodeType.SymbolNode,
+  NodeType.ServerActionNode
 ]);
 
 // src/nodes.ts
@@ -286,7 +302,15 @@ var ConfigNodeSchema = z3.object({
 var ColumnAttrSchema = z3.object({
   name: z3.string(),
   provenances: z3.array(ProvenanceSchema),
-  confidence: z3.number().min(0).max(1)
+  confidence: z3.number().min(0).max(1),
+  // Which SDK wrote this field, for a `firestore-collection` node (ADR-167): a
+  // deduped set, the write-side analog of `provenances`. `client` =
+  // firebase/firestore (governed by security rules), `admin` =
+  // firebase-admin/firestore (bypasses rules entirely). This is the seam the
+  // field-guard policy (ADR-169) joins on — client-written fields must be guarded
+  // — and is absent on a non-Firestore column. Optional growth, no version step
+  // (`kind` is an open string); folded by `foldSdkWrites`, never `foldColumns`.
+  sdkWrites: z3.array(z3.enum(["client", "admin"])).optional()
 });
 var InfraNodeSchema = z3.object({
   id: z3.string(),
@@ -299,7 +323,15 @@ var InfraNodeSchema = z3.object({
   // Absent on a non-table InfraNode (a project node, a queue, a route). Optional
   // schema growth (ADR-031); ADR-157 stamps the snapshot version because the field
   // records a new grain the graph can now carry. See docs/contracts/schema.md.
-  columns: z3.array(ColumnAttrSchema).optional()
+  columns: z3.array(ColumnAttrSchema).optional(),
+  // Guard set folded from a checked-in declared policy artifact (ADR-169): for a
+  // `firestore-collection` node, the fields `firestore.rules` explicitly names on
+  // the client write path, read by the standalone rules producer. The
+  // `field-guard` policy asserts every client-written column appears here. Absent
+  // ⇒ the collection's guard is indeterminate ⇒ the check stays silent. Optional
+  // growth (ADR-031); no version step — it only appears on nodes a post-ADR-169
+  // pass folds it onto.
+  guardedFields: z3.array(z3.string()).optional()
 });
 var FrontierNodeSchema = z3.object({
   id: z3.string(),
@@ -392,6 +424,17 @@ var SymbolNodeSchema = z3.object({
   relPath: z3.string(),
   discoveredVia: DiscoveredViaSchema.optional()
 });
+var ServerActionNodeSchema = z3.object({
+  id: z3.string(),
+  type: z3.literal(NodeType.ServerActionNode),
+  name: z3.string(),
+  service: z3.string(),
+  module: z3.string(),
+  exportName: z3.string(),
+  path: z3.string().optional(),
+  line: z3.number().int().nonnegative().optional(),
+  discoveredVia: DiscoveredViaSchema.optional()
+});
 var GraphNodeSchema = z3.discriminatedUnion("type", [
   ServiceNodeSchema,
   DatabaseNodeSchema,
@@ -403,7 +446,8 @@ var GraphNodeSchema = z3.discriminatedUnion("type", [
   GraphQLOperationNodeSchema,
   GrpcMethodNodeSchema,
   WebSocketChannelNodeSchema,
-  SymbolNodeSchema
+  SymbolNodeSchema,
+  ServerActionNodeSchema
 ]);
 
 // src/events.ts
@@ -556,6 +600,7 @@ var GRAPHQL_OP_PREFIX = "graphql:";
 var GRPC_METHOD_PREFIX = "grpc:";
 var WEBSOCKET_CHANNEL_PREFIX = "ws:";
 var SYMBOL_PREFIX = "symbol:";
+var SERVER_ACTION_PREFIX = "action:";
 var ENV_UNKNOWN = "unknown";
 function serviceId(name, env) {
   if (env === void 0 || env === ENV_UNKNOWN) return `${SERVICE_PREFIX}${name}`;
@@ -703,6 +748,23 @@ function parseSymbolId(id) {
   if (qualname.length === 0) return null;
   return { service, relPath, qualname, ...disambiguator !== void 0 ? { disambiguator } : {} };
 }
+function serverActionId(service, module, exportName) {
+  return `${SERVER_ACTION_PREFIX}${service}:${module}#${exportName}`;
+}
+function parseServerActionId(id) {
+  if (!id.startsWith(SERVER_ACTION_PREFIX)) return null;
+  const rest = id.slice(SERVER_ACTION_PREFIX.length);
+  const colon = rest.indexOf(":");
+  if (colon === -1) return null;
+  const service = rest.slice(0, colon);
+  const tail = rest.slice(colon + 1);
+  const hash = tail.lastIndexOf("#");
+  if (hash === -1) return null;
+  const module = tail.slice(0, hash);
+  const exportName = tail.slice(hash + 1);
+  if (service.length === 0 || module.length === 0 || exportName.length === 0) return null;
+  return { service, module, exportName };
+}
 var EDGE_ARROW = "->";
 function extractedEdgeId(source, target, type) {
   return `${type}:${source}${EDGE_ARROW}${target}`;
@@ -789,12 +851,29 @@ var BlastRadiusRuleSchema = z6.object({
   // default (10) when omitted.
   depth: z6.number().int().positive().optional()
 });
+var FieldGuardRuleSchema = z6.object({
+  type: z6.literal("field-guard"),
+  // Node type the rule governs. InfraNode for the Firestore instance.
+  nodeType: NodeTypeSchema,
+  // Optional narrowing on InfraNode's free-string `kind` sub-type, so the rule
+  // applies to `firestore-collection` nodes without governing every InfraNode.
+  nodeKind: z6.string().optional(),
+  // Set A — the named selector the evaluator resolves into the "must be covered"
+  // set. 'client-written-columns' reads ColumnAttr whose sdkWrites includes
+  // 'client'. A new instance adds a value here plus a resolver branch.
+  subjectSet: z6.enum(["client-written-columns"]),
+  // Set B — the covering set: the node attribute (a string[]) whose members must
+  // include all of set A. 'guardedFields' for Firestore. Absent ⇒ indeterminate
+  // ⇒ silent.
+  guardSet: z6.string()
+});
 var PolicyRuleSchema = z6.discriminatedUnion("type", [
   StructuralRuleSchema,
   CompatibilityRuleSchema,
   ProvenanceRuleSchema,
   OwnershipRuleSchema,
-  BlastRadiusRuleSchema
+  BlastRadiusRuleSchema,
+  FieldGuardRuleSchema
 ]);
 var PolicySchema = z6.object({
   // Unique within the file. Duplicates fail PolicyFileSchema.parse.
@@ -853,7 +932,7 @@ var ApplicablePolicySchema = z6.object({
   // from policy.onViolation or the severity default. Shown for awareness only;
   // the soft guardrail never acts on it.
   onViolation: PolicyActionSchema,
-  ruleType: z6.enum(["structural", "compatibility", "provenance", "ownership", "blast-radius"]),
+  ruleType: z6.enum(["structural", "compatibility", "provenance", "ownership", "blast-radius", "field-guard"]),
   match: z6.enum(["subject", "region"]),
   // Human-readable reason the policy applies here — rides into agent context.
   reason: z6.string().min(1)
@@ -872,7 +951,7 @@ var PolicyViolationSchema = z6.object({
   // Resolved at evaluation time — either the explicit policy.onViolation or
   // the severity-derived default per ADR-044.
   onViolation: PolicyActionSchema,
-  ruleType: z6.enum(["structural", "compatibility", "provenance", "ownership", "blast-radius"]),
+  ruleType: z6.enum(["structural", "compatibility", "provenance", "ownership", "blast-radius", "field-guard"]),
   subject: z6.object({
     nodeId: z6.string().optional(),
     edgeId: z6.string().optional(),
@@ -1220,6 +1299,7 @@ export {
   EdgeTypeSchema,
   ErrorEventSchema,
   ExtractionCoverageSchema,
+  FieldGuardRuleSchema,
   FileNodeSchema,
   FrontierNodeSchema,
   GraphDiffResultSchema,
@@ -1266,6 +1346,7 @@ export {
   SearchMatchSchema,
   SearchResponseSchema,
   SerializedGraphSchema,
+  ServerActionNodeSchema,
   ServiceNodeSchema,
   SingleProjectResponseSchema,
   SpanAttributesSchema,
@@ -1302,11 +1383,13 @@ export {
   parseGrpcMethodId,
   parseInfraId,
   parseRouteId,
+  parseServerActionId,
   parseServiceId,
   parseSymbolId,
   parseWebsocketChannelId,
   passesExtractedFloor,
   routeId,
+  serverActionId,
   serviceId,
   symbolId,
   websocketChannelId