@noctcore/lint-meta-rules 0.5.0 → 0.6.0

package/README.md

@@ -106,3 +106,27 @@ needs the optional peer `eslint`. Neither is in `RULE_FACTORIES`: both need the
 | --- | --- | --- |
 | [`createTenantModelRegistryParityRule`](./docs/rules/tenant-model-registry-parity.md) | config | Every tenant-bearing schema model is scoped at runtime or exempt with a reason, and the tenant lint rules resolve with exactly that registry. |
 | [`createPrismaMethodSurfaceRule`](./docs/rules/prisma-method-surface.md) | config | The reads and writes the rules police are exactly the generated client's delegate methods, so a Prisma upgrade cannot add an unguarded one. |
+
+### `@noctcore/lint-meta-rules/session`
+
+Fences around the one seam that turns an authenticated principal into a session. Each rule is inert
+until you name that seam: the method that mints, the gate in front of it, the files allowed to call it,
+the landings a sign-in can end in. None is in `RULE_FACTORIES`. They load nothing beyond the harness
+contract. Ported from a production NestJS app, where each one exists because its bug shipped once.
+
+| Factory | Category | What it enforces |
+| --- | --- | --- |
+| [`createSessionMintCallersRule`](./docs/rules/session-mint-callers.md) | source-text | The method that mints a session is called only from allowlisted files, so a new sign-in entry point cannot skip the gate in front of it. |
+| [`createSessionKindStampedRule`](./docs/rules/session-kind-stamped.md) | source-text | Every mint stamps the principal kind onto the session, or sits in an allowlisted, provably single-kind flow. |
+| [`createSessionEpochCapturedRule`](./docs/rules/session-epoch-captured.md) | source-text | Every call into the sign-in seam passes the revocation epoch captured before the credential was read. |
+| [`createSessionLandingDeclaredRule`](./docs/rules/session-landing-declared.md) | source-text | Every file that opens a door into a session declares its landing, and a door whose landing demands a return shape has it. |
+
+### `@noctcore/lint-meta-rules/trpc`
+
+Cross-tree checks between tRPC routers and the clients that call them. The decorator shape defaults to
+`nestjs-trpc`'s; the rule is inert until you name the middleware and the two trees. Not in
+`RULE_FACTORIES`.
+
+| Factory | Category | What it enforces |
+| --- | --- | --- |
+| [`createIdempotencyKeyParityRule`](./docs/rules/idempotency-key-parity.md) | source-text | A procedure guarded by an idempotency middleware has a client caller that sends the key, or no client caller at all. |

package/dist/{chunk-Z7TXSZR4.js → chunk-OYFQKSJN.js}

@@ -47,6 +47,13 @@ function unquote(value) {
 function anywhereGlobs(baseNames) {
   return baseNames.flatMap((name) => [`**/${name}`, `**/.*/**/${name}`]);
 }
+function readSourceText(read, rel) {
+  try {
+    return read(rel);
+  } catch {
+    return null;
+  }
+}
 
 export {
   dirOf,
@@ -59,5 +66,6 @@ export {
   globFiles,
   stripYamlComment,
   unquote,
-  anywhereGlobs
+  anywhereGlobs,
+  readSourceText
 };

package/dist/i18n.js

@@ -2,7 +2,7 @@ import {
   DEFAULT_SKIP_DIRS,
   escapeRegExp,
   globFiles
-} from "./chunk-Z7TXSZR4.js";
+} from "./chunk-OYFQKSJN.js";
 
 // src/i18n/translation-dead-keys.ts
 import path from "path";

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   recursiveGlobs,
   stripYamlComment,
   unquote
-} from "./chunk-Z7TXSZR4.js";
+} from "./chunk-OYFQKSJN.js";
 
 // src/rules/agents-doc-presence.ts
 function createAgentsDocPresenceRule(options = {}) {

package/dist/prisma.js

@@ -1,11 +1,11 @@
-import {
-  globFiles
-} from "./chunk-Z7TXSZR4.js";
 import {
   firstOptionOf,
   resolveRules,
   severityOf
 } from "./chunk-VFCX3QKZ.js";
+import {
+  globFiles
+} from "./chunk-OYFQKSJN.js";
 
 // src/prisma/prisma-method-surface.ts
 import { PRISMA_READ_METHODS, PRISMA_WRITE_METHODS } from "@noctcore/eslint-plugin-prisma";

package/dist/session.cjs

@@ -0,0 +1,297 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/session.ts
+var session_exports = {};
+__export(session_exports, {
+  callArguments: () => callArguments,
+  createSessionEpochCapturedRule: () => createSessionEpochCapturedRule,
+  createSessionKindStampedRule: () => createSessionKindStampedRule,
+  createSessionLandingDeclaredRule: () => createSessionLandingDeclaredRule,
+  createSessionMintCallersRule: () => createSessionMintCallersRule
+});
+module.exports = __toCommonJS(session_exports);
+
+// src/rules/shared.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var DEFAULT_SKIP_DIRS = [
+  "node_modules",
+  ".git",
+  "dist",
+  ".turbo",
+  "coverage"
+];
+function globFiles(glob, globs, skipDirs = []) {
+  const skip = new Set(skipDirs);
+  const found = /* @__PURE__ */ new Set();
+  for (const pattern of globs) {
+    for (const rel of glob(pattern)) {
+      if (!rel.split("/").some((segment) => skip.has(segment))) found.add(rel);
+    }
+  }
+  return [...found].sort();
+}
+function readSourceText(read, rel) {
+  try {
+    return read(rel);
+  } catch {
+    return null;
+  }
+}
+
+// src/session/scan.ts
+var DEFAULT_EXCLUDE_SUFFIXES = [
+  ".spec.ts",
+  ".spec.tsx",
+  ".test.ts",
+  ".test.tsx"
+];
+function scopedSources(ctx, options) {
+  const skipDirs = options.skipDirs ?? DEFAULT_SKIP_DIRS;
+  const excludeSuffixes = options.excludeSuffixes ?? DEFAULT_EXCLUDE_SUFFIXES;
+  const matched = globFiles(ctx.glob, options.sourceGlobs ?? [], skipDirs).map(toPosix);
+  const sources = [];
+  for (const file of matched) {
+    if (excludeSuffixes.some((suffix) => file.endsWith(suffix))) continue;
+    const text = readSourceText(ctx.read, file);
+    if (text !== null) sources.push({ file, text });
+  }
+  return { matched: new Set(matched), sources };
+}
+function toPosix(file) {
+  return file.replace(/\\/gu, "/").replace(/^\.\//u, "");
+}
+function pathSet(files) {
+  return new Set((files ?? []).map(toPosix));
+}
+function callsMethod(source, method) {
+  return new RegExp(`\\.${escapeRegExp(method)}\\s*\\(`, "u").test(source);
+}
+function callArguments(source, method) {
+  const needle = `.${method}`;
+  const calls = [];
+  let from = 0;
+  for (; ; ) {
+    const hit = source.indexOf(needle, from);
+    if (hit === -1) break;
+    from = hit + needle.length;
+    const open = source.indexOf("(", from);
+    if (open === -1) break;
+    if (source.slice(from, open).trim() !== "") continue;
+    let depth = 0;
+    let end = open;
+    for (; end < source.length; end += 1) {
+      const char = source[end];
+      if (char === "(") depth += 1;
+      else if (char === ")") {
+        depth -= 1;
+        if (depth === 0) break;
+      }
+    }
+    calls.push(source.slice(open + 1, end));
+    from = end;
+  }
+  return calls;
+}
+function mentionsIdentifier(text, identifier) {
+  return new RegExp(`\\b${escapeRegExp(identifier)}\\b`, "u").test(text);
+}
+function withHint(message, hint) {
+  return hint === void 0 || hint === "" ? message : `${message} ${hint}`;
+}
+
+// src/session/session-epoch-captured.ts
+var DEFAULT_ID = "session-epoch-captured";
+var DEFAULT_FIELD = "epoch";
+function createSessionEpochCapturedRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID;
+  const call = options.call ?? "";
+  const field = options.field ?? DEFAULT_FIELD;
+  const exempt = pathSet(options.exempt);
+  return {
+    id,
+    category: "source-text",
+    ciCritical: options.ciCritical ?? true,
+    description: "Every call into the sign-in seam must pass the session epoch captured before the credential was read, or a revocation landing during the credential check loses the race.",
+    run(ctx) {
+      if (call === "") return [];
+      const violations = [];
+      for (const { file, text } of scopedSources(ctx, options).sources) {
+        if (exempt.has(file)) continue;
+        for (const args of callArguments(text, call)) {
+          if (mentionsIdentifier(args, field)) continue;
+          violations.push({
+            file,
+            rule: id,
+            message: withHint(
+              `${call}() must be passed \`${field}\`, captured${options.captureCall === void 0 ? "" : ` with ${options.captureCall}`} BEFORE this flow reads the credential it authenticates on. Without it the epoch fence starts at the session write, so a revocation landing during the credential check loses the race.`,
+              options.hint
+            )
+          });
+        }
+      }
+      return violations;
+    }
+  };
+}
+
+// src/session/session-kind-stamped.ts
+var DEFAULT_ID2 = "session-kind-stamped";
+var DEFAULT_FIELD2 = "kind";
+function createSessionKindStampedRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID2;
+  const mintCall = options.mintCall ?? "";
+  const field = options.field ?? DEFAULT_FIELD2;
+  const allowUnstamped = pathSet(options.allowUnstamped);
+  return {
+    id,
+    category: "source-text",
+    ciCritical: options.ciCritical ?? true,
+    description: "Every call that mints a session must stamp the principal kind onto it, or sit in an allowlisted, provably single-kind flow; a session read without the kind falls back to a default and can silently promote one kind of account into another.",
+    run(ctx) {
+      if (mintCall === "") return [];
+      const violations = [];
+      for (const { file, text } of scopedSources(ctx, options).sources) {
+        if (allowUnstamped.has(file)) continue;
+        const calls = callArguments(text, mintCall);
+        if (calls.length === 0) continue;
+        const fileStamps = mentionsIdentifier(text, field);
+        for (const args of calls) {
+          const stamped = args.includes("{") ? mentionsIdentifier(args, field) : fileStamps;
+          if (stamped) continue;
+          violations.push({
+            file,
+            rule: id,
+            message: withHint(
+              `${mintCall}() must stamp \`${field}\` onto the session it mints${options.stampExample === void 0 ? "" : `: add \`${options.stampExample}\` to the options`}. A session read without \`${field}\` falls back to the reader's default, so an unstamped mint can silently promote one kind of account into another. If this flow provably can never mint for an account that needs the field, add the file to \`allowUnstamped\` with the proof.`,
+              options.hint
+            )
+          });
+        }
+      }
+      return violations;
+    }
+  };
+}
+
+// src/session/session-landing-declared.ts
+var DEFAULT_ID3 = "session-landing-declared";
+function createSessionLandingDeclaredRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID3;
+  const doorCalls = (options.doorCalls ?? []).filter((name) => name !== "");
+  const doors = (options.doors ?? []).map((door) => ({ ...door, file: toPosix(door.file) }));
+  const landings = options.landings ?? {};
+  const landingNames = Object.keys(landings);
+  const callList = doorCalls.join(" or ");
+  return {
+    id,
+    category: "source-text",
+    ciCritical: options.ciCritical ?? true,
+    description: "Every file that opens a door into a session must declare where it leaves the caller, and a door whose landing demands a return shape (the one that carries the principal kind to the client) must have it.",
+    run(ctx) {
+      if (doorCalls.length === 0) return [];
+      const violations = [];
+      const report = (file, message) => {
+        violations.push({ file, rule: id, message: withHint(message, options.hint) });
+      };
+      for (const door of doors) {
+        if (!Object.hasOwn(landings, door.landing)) {
+          report(
+            door.file,
+            `\`doors\` declares this file with landing \`${door.landing}\`, which is not one of the configured landings (${landingNames.join(", ") || "none"}).`
+          );
+        }
+        if (door.because.trim() === "") {
+          report(door.file, "`doors` declares this file with an empty `because`. Write down why its landing is the right one.");
+        }
+      }
+      const { matched, sources } = scopedSources(ctx, options);
+      for (const { file, text } of sources) {
+        if (!doorCalls.some((name) => callsMethod(text, name))) continue;
+        const declared = doors.find((door) => door.file === file);
+        if (declared === void 0) {
+          report(
+            file,
+            `This file opens a door into a session (${callList}) and does not declare where it leaves the caller. Add it to \`doors\` with one of the landings (${landingNames.join(", ") || "none"}) and a \`because\`: can this door end a sign-in for an account the client must route by kind? Then declare the landing that returns the kind. Does the caller already hold a session? Or can such an account provably never reach it? Say so in \`because\`.`
+          );
+          continue;
+        }
+        const required = landings[declared.landing];
+        if (typeof required === "string" && required !== "" && !text.includes(required)) {
+          report(
+            file,
+            `This door is declared \`${declared.landing}\` but its source never contains \`${required}\`, so the sign-in it completes hands the client nothing to route the account by. Return it, or reclassify the door in \`doors\` with the proof that it cannot end such a sign-in.`
+          );
+        }
+      }
+      for (const door of doors) {
+        if (!matched.has(door.file)) {
+          report(
+            door.file,
+            "`doors` names a file that no longer exists, or that `sourceGlobs` do not reach. Remove the entry, or point it at the file the door moved to."
+          );
+        }
+      }
+      return violations;
+    }
+  };
+}
+
+// src/session/session-mint-callers.ts
+var DEFAULT_ID4 = "session-mint-callers";
+function createSessionMintCallersRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID4;
+  const mintCall = options.mintCall ?? "";
+  const allowed = pathSet(options.allowedCallers);
+  const gate = options.gateCall;
+  return {
+    id,
+    category: "source-text",
+    ciCritical: options.ciCritical ?? true,
+    description: "The method that mints a session may only be called from allowlisted files; a new sign-in entry point must route through the gate in front of it so the gate cannot be bypassed.",
+    run(ctx) {
+      if (mintCall === "") return [];
+      const violations = [];
+      const allowedList = [...allowed].join(", ") || "none";
+      for (const { file, text } of scopedSources(ctx, options).sources) {
+        if (allowed.has(file)) continue;
+        if (!callsMethod(text, mintCall)) continue;
+        violations.push({
+          file,
+          rule: id,
+          message: withHint(
+            `${mintCall}() may only be called from the allowlisted files (${allowedList}).${gate === void 0 ? "" : ` A sign-in or OAuth entry point must call ${gate}() instead, so the checks it runs before minting are not bypassed.`} If this is a genuine mint that passes no gate (a signup, or a re-issue to a caller who already holds a session), add the file to \`allowedCallers\` with a justification.`,
+            options.hint
+          )
+        });
+      }
+      return violations;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  callArguments,
+  createSessionEpochCapturedRule,
+  createSessionKindStampedRule,
+  createSessionLandingDeclaredRule,
+  createSessionMintCallersRule
+});

package/dist/session.d.cts

@@ -0,0 +1,226 @@
+import { IMetaRule } from '@noctcore/harness';
+
+/**
+ * The source scope every session rule shares: which files are read, and which
+ * of them are left alone because they drive the seam directly (tests).
+ */
+interface SessionSourceScopeOptions {
+    /**
+     * Globs of the application source that can open a session, relative to the
+     * repo root. Empty (the default) makes the rule inert: it reads nothing and
+     * reports nothing. Point it at shipped code only; a lint-meta rule module that
+     * quotes the call in its own pattern is not a call site.
+     */
+    readonly sourceGlobs?: readonly string[];
+    /** Paths with any of these segments are skipped. Default `node_modules`, `.git`, `dist`, `.turbo`, `coverage`. */
+    readonly skipDirs?: readonly string[];
+    /**
+     * Files ending in any of these are skipped: tests drive the seam directly,
+     * including shapes production never produces. Default
+     * `['.spec.ts', '.spec.tsx', '.test.ts', '.test.tsx']`.
+     */
+    readonly excludeSuffixes?: readonly string[];
+}
+/**
+ * The argument text of each `.<method>(...)` call in `source`.
+ *
+ * Scanned by balancing parentheses rather than matched with a regex: an options
+ * object spans lines and holds its own braces and parens, and a non-greedy
+ * regex either stops early or runs on into the next call. A scanner that never
+ * finds the closing paren returns what it has, which is the fail-closed
+ * direction (more text to search, never less). `.<method>Something(` is not a
+ * call of `method`: only whitespace may sit between the name and the paren.
+ */
+declare function callArguments(source: string, method: string): string[];
+
+/**
+ * Options for {@link createSessionEpochCapturedRule}.
+ *
+ * Ported from Settly, which hardcoded the seam (`beginOrEstablish`), the field
+ * (`epoch`) and the seam's own file. With no `call` the rule is inert.
+ */
+interface SessionEpochCapturedOptions extends SessionSourceScopeOptions {
+    /** Rule id, for running more than one instance. Default `session-epoch-captured`. */
+    readonly id?: string;
+    /**
+     * The post-credential seam every sign-in passes through on its way to a
+     * session, matched as `.<call>(`. Unset or empty = inert.
+     */
+    readonly call?: string;
+    /** The argument every call must mention: the epoch captured before the credential was read. Default `epoch`. */
+    readonly field?: string;
+    /**
+     * Repo-relative files skipped outright: the seam's own home, which defines
+     * the method and may call itself without a captured value. Default: none.
+     */
+    readonly exempt?: readonly string[];
+    /** How the epoch is captured (e.g. `sessions.readEpoch(userId)`), quoted in the message. Optional. */
+    readonly captureCall?: string;
+    /** Appended to every message: a pointer to the project's own docs. */
+    readonly hint?: string;
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/**
+ * Every call into the sign-in seam passes the session epoch it captured before
+ * reading the credential.
+ *
+ * A revoke-all bumps a per-user epoch and a mint refuses to write a session
+ * under a stale one. Captured inside the mint, the fence covers the store write
+ * and nothing else: the whole credential check (a password hash verify, an
+ * OAuth token exchange) is a window in which a sign-in that already read the
+ * revoked state still mints a surviving session. So each entry point captures
+ * the epoch first and hands it to the seam, and this rule fails any call whose
+ * arguments never mention it.
+ */
+declare function createSessionEpochCapturedRule(options?: SessionEpochCapturedOptions): IMetaRule;
+
+/**
+ * Options for {@link createSessionKindStampedRule}.
+ *
+ * Ported from Settly, which hardcoded the mint (`establishSession`), the field
+ * (`kind`) and the one staff-only exemption. With no `mintCall` the rule is inert.
+ */
+interface SessionKindStampedOptions extends SessionSourceScopeOptions {
+    /** Rule id, for running more than one instance. Default `session-kind-stamped`. */
+    readonly id?: string;
+    /** The method whose call mints a session, matched as `.<mintCall>(`. Unset or empty = inert. */
+    readonly mintCall?: string;
+    /** The session field every mint must stamp. Default `kind`. */
+    readonly field?: string;
+    /**
+     * Repo-relative files whose mints may stamp nothing because they provably can
+     * never mint for a principal that needs the field (a self-signup that only
+     * ever creates the default kind). Keep it short and write the proof next to
+     * each entry. Default: none.
+     */
+    readonly allowUnstamped?: readonly string[];
+    /** An example of the stamp, quoted in the message (e.g. a conditional spread). Optional. */
+    readonly stampExample?: string;
+    /** Appended to every message: a pointer to the project's own docs. */
+    readonly hint?: string;
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/**
+ * Every session mint stamps the principal's kind onto the session it writes.
+ *
+ * When the request pipeline reads the kind from the SESSION rather than the
+ * database, a session minted without it reads as whatever the reader defaults
+ * to. For a fence between two kinds of account that is a silent promotion of
+ * one into the other, and every gate stays green because nothing looks.
+ *
+ * The check, in order of precision:
+ *
+ * 1. A call whose arguments contain an object LITERAL must mention the field in
+ *    that literal. Each literal is checked on its own, so one stamped mint does
+ *    not excuse an unstamped one in the same file.
+ * 2. A call with no literal (options built elsewhere) falls back to the file:
+ *    the file must mention the field somewhere. Coarser, but no silent hole.
+ * 3. Otherwise the file must be on `allowUnstamped`.
+ *
+ * Residual gap, stated rather than hidden: a file that stamps the field on one
+ * delegated mint and forgets it on a second delegated mint passes clause 2.
+ */
+declare function createSessionKindStampedRule(options?: SessionKindStampedOptions): IMetaRule;
+
+/** One file that opens a door into a session, and where it leaves the caller. */
+interface SessionDoor {
+    /** Repo-relative path of the file. */
+    readonly file: string;
+    /** One of the keys of `landings`. */
+    readonly landing: string;
+    /** Why this landing is right for this door. Prose, read by whoever adds the next door. Must not be empty. */
+    readonly because: string;
+}
+/**
+ * Options for {@link createSessionLandingDeclaredRule}.
+ *
+ * Ported from Settly, which hardcoded the two door calls, its six doors and the
+ * three landings (`login-result`, which must return `Promise<ILoginResult>`,
+ * `reissue` and `staff-only`). All of them are options; with no `doorCalls` the
+ * rule is inert.
+ */
+interface SessionLandingDeclaredOptions extends SessionSourceScopeOptions {
+    /** Rule id, for running more than one instance. Default `session-landing-declared`. */
+    readonly id?: string;
+    /**
+     * The methods whose call opens a door into a session (the mint, and the gate
+     * in front of it), each matched as `.<name>(`. Empty (the default) = inert.
+     */
+    readonly doorCalls?: readonly string[];
+    /** Every door, declared. A file that calls a door method and is not here is reported. */
+    readonly doors?: readonly SessionDoor[];
+    /**
+     * The landings a door may declare, each mapped to the text a door with that
+     * landing must contain (the return type that carries the principal kind to the
+     * client, say), or `null` when the landing demands nothing of the source. A
+     * door whose landing is not a key here is reported. Default: none.
+     */
+    readonly landings?: Readonly<Record<string, string | null>>;
+    /** Appended to every message: a pointer to the project's own docs. */
+    readonly hint?: string;
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/**
+ * Every file that opens a door into a session declares where it leaves the
+ * caller, and a door that must hand the client the principal kind does.
+ *
+ * With two shells behind one sign-in, the client can only send an account to
+ * the right one if the response that ends the sign-in says which kind it is. A
+ * second door that finishes a sign-in from a different service can forget to,
+ * and nothing fails: the account signs in and lands in the wrong shell.
+ *
+ * The check is completeness first: a file that calls a door method and is not
+ * in `doors` fails the build until someone classifies it, which is what keeps
+ * the list an enumeration rather than a docblock nobody updates. Then each
+ * door's landing is checked against `landings`, and a declared door that no
+ * longer exists (or that `sourceGlobs` do not reach) is reported so the list
+ * cannot go stale.
+ */
+declare function createSessionLandingDeclaredRule(options?: SessionLandingDeclaredOptions): IMetaRule;
+
+/**
+ * Options for {@link createSessionMintCallersRule}.
+ *
+ * Ported from Settly's `establish-session-callers`, which hardcoded the method
+ * (`establishSession`), the gate (`beginOrEstablish`) and the five allowlisted
+ * files. All three are options here; with no `mintCall` the rule is inert.
+ */
+interface SessionMintCallersOptions extends SessionSourceScopeOptions {
+    /** Rule id, for running more than one instance. Default `session-mint-callers`. */
+    readonly id?: string;
+    /**
+     * The method whose call mints a session (sets the cookie, writes the store),
+     * matched as `.<mintCall>(`. Unset or empty = inert.
+     */
+    readonly mintCall?: string;
+    /**
+     * Repo-relative files that may call it: the method's own home, the gate in
+     * front of it, and flows with no gate to pass (signup, a re-issue to a caller
+     * who already holds a session). Matched exactly, so a same-named file in
+     * another directory is not allowed. Default: none.
+     */
+    readonly allowedCallers?: readonly string[];
+    /**
+     * The method a new sign-in entry point must route through instead (a second
+     * factor challenge, say), named in the message. Optional.
+     */
+    readonly gateCall?: string;
+    /** Appended to every message: a pointer to the project's own docs. */
+    readonly hint?: string;
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/**
+ * The method that mints a session is callable only from an allowlist of files.
+ *
+ * A session minted straight from a sign-in entry point skips whatever the gate
+ * in front of the mint enforces (a second factor, an epoch capture), and nothing
+ * else fails: the new flow signs the user in and every test passes. The mint is
+ * the one door into a session, so the rule fences the door by caller.
+ */
+declare function createSessionMintCallersRule(options?: SessionMintCallersOptions): IMetaRule;
+
+export { type SessionDoor, type SessionEpochCapturedOptions, type SessionKindStampedOptions, type SessionLandingDeclaredOptions, type SessionMintCallersOptions, type SessionSourceScopeOptions, callArguments, createSessionEpochCapturedRule, createSessionKindStampedRule, createSessionLandingDeclaredRule, createSessionMintCallersRule };