@neat.is/types 0.7.5 → 0.7.7

package/dist/index.cjs

@@ -55,6 +55,7 @@ __export(index_exports, {
   EdgeTypeSchema: () => EdgeTypeSchema,
   ErrorEventSchema: () => ErrorEventSchema,
   ExtractionCoverageSchema: () => ExtractionCoverageSchema,
+  FieldGuardRuleSchema: () => FieldGuardRuleSchema,
   FileNodeSchema: () => FileNodeSchema,
   FrontierNodeSchema: () => FrontierNodeSchema,
   GraphDiffResultSchema: () => GraphDiffResultSchema,
@@ -101,6 +102,7 @@ __export(index_exports, {
   SearchMatchSchema: () => SearchMatchSchema,
   SearchResponseSchema: () => SearchResponseSchema,
   SerializedGraphSchema: () => SerializedGraphSchema,
+  ServerActionNodeSchema: () => ServerActionNodeSchema,
   ServiceNodeSchema: () => ServiceNodeSchema,
   SingleProjectResponseSchema: () => SingleProjectResponseSchema,
   SpanAttributesSchema: () => SpanAttributesSchema,
@@ -137,11 +139,13 @@ __export(index_exports, {
   parseGrpcMethodId: () => parseGrpcMethodId,
   parseInfraId: () => parseInfraId,
   parseRouteId: () => parseRouteId,
+  parseServerActionId: () => parseServerActionId,
   parseServiceId: () => parseServiceId,
   parseSymbolId: () => parseSymbolId,
   parseWebsocketChannelId: () => parseWebsocketChannelId,
   passesExtractedFloor: () => passesExtractedFloor,
   routeId: () => routeId,
+  serverActionId: () => serverActionId,
   serviceId: () => serviceId,
   symbolId: () => symbolId,
   websocketChannelId: () => websocketChannelId
@@ -252,7 +256,22 @@ var NodeType = {
   // file (observed-first edges, one grain finer than §4 file grain). The node is
   // language-neutral; the per-language tree-sitter extractor is the adapter. See
   // docs/contracts/static-extraction.md and docs/contracts/file-awareness.md §1.
-  SymbolNode: "SymbolNode"
+  SymbolNode: "SymbolNode",
+  // A Next.js Server Action at (service, module, exportName) granularity
+  // (ADR-168). A Server Action is the RPC boundary of an App Router app: the
+  // client posts to it, Next serialises the call to an opaque `Next-Action`
+  // hash, and it runs on the server. At HTTP grain the whole surface collapses
+  // onto one POST edge — like a GraphQL operation — so this node recovers the
+  // per-action topology the client actually names. It is EXTRACTED-first: the
+  // static extractor mints one per exported action from a `"use server"`
+  // directive (module-level or in-body) and the file owns it through a
+  // `file ──CONTAINS──▶ action` edge; a client reference to the imported action
+  // binding lands a `file ──CALLS──▶ action` edge, so the client→action call
+  // path is a real edge the reasoning core walks like any other. OBSERVED
+  // fusion is deferred (the `Next-Action` hash carries no action name), the
+  // same posture GraphQLOperationNode took before its static extractor. See
+  // docs/contracts/static-extraction.md and docs/contracts/file-awareness.md.
+  ServerActionNode: "ServerActionNode"
 };
 var NodeTypeSchema = import_zod.z.enum([
   NodeType.ServiceNode,
@@ -265,7 +284,8 @@ var NodeTypeSchema = import_zod.z.enum([
   NodeType.GraphQLOperationNode,
   NodeType.GrpcMethodNode,
   NodeType.WebSocketChannelNode,
-  NodeType.SymbolNode
+  NodeType.SymbolNode,
+  NodeType.ServerActionNode
 ]);
 
 // src/nodes.ts
@@ -436,7 +456,15 @@ var ConfigNodeSchema = import_zod3.z.object({
 var ColumnAttrSchema = import_zod3.z.object({
   name: import_zod3.z.string(),
   provenances: import_zod3.z.array(ProvenanceSchema),
-  confidence: import_zod3.z.number().min(0).max(1)
+  confidence: import_zod3.z.number().min(0).max(1),
+  // Which SDK wrote this field, for a `firestore-collection` node (ADR-167): a
+  // deduped set, the write-side analog of `provenances`. `client` =
+  // firebase/firestore (governed by security rules), `admin` =
+  // firebase-admin/firestore (bypasses rules entirely). This is the seam the
+  // field-guard policy (ADR-169) joins on — client-written fields must be guarded
+  // — and is absent on a non-Firestore column. Optional growth, no version step
+  // (`kind` is an open string); folded by `foldSdkWrites`, never `foldColumns`.
+  sdkWrites: import_zod3.z.array(import_zod3.z.enum(["client", "admin"])).optional()
 });
 var InfraNodeSchema = import_zod3.z.object({
   id: import_zod3.z.string(),
@@ -449,7 +477,15 @@ var InfraNodeSchema = import_zod3.z.object({
   // Absent on a non-table InfraNode (a project node, a queue, a route). Optional
   // schema growth (ADR-031); ADR-157 stamps the snapshot version because the field
   // records a new grain the graph can now carry. See docs/contracts/schema.md.
-  columns: import_zod3.z.array(ColumnAttrSchema).optional()
+  columns: import_zod3.z.array(ColumnAttrSchema).optional(),
+  // Guard set folded from a checked-in declared policy artifact (ADR-169): for a
+  // `firestore-collection` node, the fields `firestore.rules` explicitly names on
+  // the client write path, read by the standalone rules producer. The
+  // `field-guard` policy asserts every client-written column appears here. Absent
+  // ⇒ the collection's guard is indeterminate ⇒ the check stays silent. Optional
+  // growth (ADR-031); no version step — it only appears on nodes a post-ADR-169
+  // pass folds it onto.
+  guardedFields: import_zod3.z.array(import_zod3.z.string()).optional()
 });
 var FrontierNodeSchema = import_zod3.z.object({
   id: import_zod3.z.string(),
@@ -542,6 +578,17 @@ var SymbolNodeSchema = import_zod3.z.object({
   relPath: import_zod3.z.string(),
   discoveredVia: DiscoveredViaSchema.optional()
 });
+var ServerActionNodeSchema = import_zod3.z.object({
+  id: import_zod3.z.string(),
+  type: import_zod3.z.literal(NodeType.ServerActionNode),
+  name: import_zod3.z.string(),
+  service: import_zod3.z.string(),
+  module: import_zod3.z.string(),
+  exportName: import_zod3.z.string(),
+  path: import_zod3.z.string().optional(),
+  line: import_zod3.z.number().int().nonnegative().optional(),
+  discoveredVia: DiscoveredViaSchema.optional()
+});
 var GraphNodeSchema = import_zod3.z.discriminatedUnion("type", [
   ServiceNodeSchema,
   DatabaseNodeSchema,
@@ -553,7 +600,8 @@ var GraphNodeSchema = import_zod3.z.discriminatedUnion("type", [
   GraphQLOperationNodeSchema,
   GrpcMethodNodeSchema,
   WebSocketChannelNodeSchema,
-  SymbolNodeSchema
+  SymbolNodeSchema,
+  ServerActionNodeSchema
 ]);
 
 // src/events.ts
@@ -706,6 +754,7 @@ var GRAPHQL_OP_PREFIX = "graphql:";
 var GRPC_METHOD_PREFIX = "grpc:";
 var WEBSOCKET_CHANNEL_PREFIX = "ws:";
 var SYMBOL_PREFIX = "symbol:";
+var SERVER_ACTION_PREFIX = "action:";
 var ENV_UNKNOWN = "unknown";
 function serviceId(name, env) {
   if (env === void 0 || env === ENV_UNKNOWN) return `${SERVICE_PREFIX}${name}`;
@@ -853,6 +902,23 @@ function parseSymbolId(id) {
   if (qualname.length === 0) return null;
   return { service, relPath, qualname, ...disambiguator !== void 0 ? { disambiguator } : {} };
 }
+function serverActionId(service, module2, exportName) {
+  return `${SERVER_ACTION_PREFIX}${service}:${module2}#${exportName}`;
+}
+function parseServerActionId(id) {
+  if (!id.startsWith(SERVER_ACTION_PREFIX)) return null;
+  const rest = id.slice(SERVER_ACTION_PREFIX.length);
+  const colon = rest.indexOf(":");
+  if (colon === -1) return null;
+  const service = rest.slice(0, colon);
+  const tail = rest.slice(colon + 1);
+  const hash = tail.lastIndexOf("#");
+  if (hash === -1) return null;
+  const module2 = tail.slice(0, hash);
+  const exportName = tail.slice(hash + 1);
+  if (service.length === 0 || module2.length === 0 || exportName.length === 0) return null;
+  return { service, module: module2, exportName };
+}
 var EDGE_ARROW = "->";
 function extractedEdgeId(source, target, type) {
   return `${type}:${source}${EDGE_ARROW}${target}`;
@@ -939,12 +1005,29 @@ var BlastRadiusRuleSchema = import_zod6.z.object({
   // default (10) when omitted.
   depth: import_zod6.z.number().int().positive().optional()
 });
+var FieldGuardRuleSchema = import_zod6.z.object({
+  type: import_zod6.z.literal("field-guard"),
+  // Node type the rule governs. InfraNode for the Firestore instance.
+  nodeType: NodeTypeSchema,
+  // Optional narrowing on InfraNode's free-string `kind` sub-type, so the rule
+  // applies to `firestore-collection` nodes without governing every InfraNode.
+  nodeKind: import_zod6.z.string().optional(),
+  // Set A — the named selector the evaluator resolves into the "must be covered"
+  // set. 'client-written-columns' reads ColumnAttr whose sdkWrites includes
+  // 'client'. A new instance adds a value here plus a resolver branch.
+  subjectSet: import_zod6.z.enum(["client-written-columns"]),
+  // Set B — the covering set: the node attribute (a string[]) whose members must
+  // include all of set A. 'guardedFields' for Firestore. Absent ⇒ indeterminate
+  // ⇒ silent.
+  guardSet: import_zod6.z.string()
+});
 var PolicyRuleSchema = import_zod6.z.discriminatedUnion("type", [
   StructuralRuleSchema,
   CompatibilityRuleSchema,
   ProvenanceRuleSchema,
   OwnershipRuleSchema,
-  BlastRadiusRuleSchema
+  BlastRadiusRuleSchema,
+  FieldGuardRuleSchema
 ]);
 var PolicySchema = import_zod6.z.object({
   // Unique within the file. Duplicates fail PolicyFileSchema.parse.
@@ -1003,7 +1086,7 @@ var ApplicablePolicySchema = import_zod6.z.object({
   // from policy.onViolation or the severity default. Shown for awareness only;
   // the soft guardrail never acts on it.
   onViolation: PolicyActionSchema,
-  ruleType: import_zod6.z.enum(["structural", "compatibility", "provenance", "ownership", "blast-radius"]),
+  ruleType: import_zod6.z.enum(["structural", "compatibility", "provenance", "ownership", "blast-radius", "field-guard"]),
   match: import_zod6.z.enum(["subject", "region"]),
   // Human-readable reason the policy applies here — rides into agent context.
   reason: import_zod6.z.string().min(1)
@@ -1022,7 +1105,7 @@ var PolicyViolationSchema = import_zod6.z.object({
   // Resolved at evaluation time — either the explicit policy.onViolation or
   // the severity-derived default per ADR-044.
   onViolation: PolicyActionSchema,
-  ruleType: import_zod6.z.enum(["structural", "compatibility", "provenance", "ownership", "blast-radius"]),
+  ruleType: import_zod6.z.enum(["structural", "compatibility", "provenance", "ownership", "blast-radius", "field-guard"]),
   subject: import_zod6.z.object({
     nodeId: import_zod6.z.string().optional(),
     edgeId: import_zod6.z.string().optional(),
@@ -1371,6 +1454,7 @@ function passesExtractedFloor(confidence) {
   EdgeTypeSchema,
   ErrorEventSchema,
   ExtractionCoverageSchema,
+  FieldGuardRuleSchema,
   FileNodeSchema,
   FrontierNodeSchema,
   GraphDiffResultSchema,
@@ -1417,6 +1501,7 @@ function passesExtractedFloor(confidence) {
   SearchMatchSchema,
   SearchResponseSchema,
   SerializedGraphSchema,
+  ServerActionNodeSchema,
   ServiceNodeSchema,
   SingleProjectResponseSchema,
   SpanAttributesSchema,
@@ -1453,11 +1538,13 @@ function passesExtractedFloor(confidence) {
   parseGrpcMethodId,
   parseInfraId,
   parseRouteId,
+  parseServerActionId,
   parseServiceId,
   parseSymbolId,
   parseWebsocketChannelId,
   passesExtractedFloor,
   routeId,
+  serverActionId,
   serviceId,
   symbolId,
   websocketChannelId