@objectstack/lint 17.0.0-rc.6 → 17.0.0

package/dist/{runtime-B50yywI_.d.cts → runtime-H-nDodRy.d.cts}

@@ -1,4 +1,4 @@
-type AnyRec = Record<string, unknown>;
+type AnyRec$1 = Record<string, unknown>;
 /** The three commands that hold a stack to the same author-time bar. */
 declare const AUTHORING_COMMANDS: readonly ["validate", "build", "lint"];
 type AuthoringCommand = (typeof AUTHORING_COMMANDS)[number];
@@ -152,7 +152,7 @@ interface AuthoringRule {
     runtimeTypes?: readonly string[];
     /** REQUIRED when `surfaces` omits `'runtime-publish'`: why the runtime gate does not run it. */
     surfaceReason?: string;
-    run: (stack: AnyRec, ctx: AuthoringRuleContext) => readonly AuthoringFinding[];
+    run: (stack: AnyRec$1, ctx: AuthoringRuleContext) => readonly AuthoringFinding[];
 }
 /**
  * `ExprIssue` is the one rule finding that carries no rule id of its own — it
@@ -168,12 +168,12 @@ declare const AUTHORING_RULES: readonly AuthoringRule[];
 /** The stack tiers a command has in hand when it runs the registry. */
 interface AuthoringRuleRun extends AuthoringRuleContext {
     /** `normalizeStackInput` output — pre-Zod-parse. Always required. */
-    normalized: AnyRec;
+    normalized: AnyRec$1;
     /**
      * Post-Zod-parse stack. Omitted by `os lint`, which does not parse; `parsed`
      * rules then read `normalized` (see `AuthoringRuleInputTier`).
      */
-    parsed?: AnyRec;
+    parsed?: AnyRec$1;
 }
 /** The rules `command` runs, in registry order. */
 declare function authoringRulesFor(command: AuthoringCommand): readonly AuthoringRule[];
@@ -243,7 +243,20 @@ declare function splitBySeverity(findings: readonly AuthoringFinding[]): {
  * a draft autosave). That is the correct place to spend it.
  */
 
-/** Everything the gate needs from the host runtime to build a snapshot. */
+type AnyRec = Record<string, unknown>;
+/**
+ * Everything the gate needs from the host runtime to build a snapshot.
+ *
+ * [#8309] Each key here doubles as the stack key the collection occupies in
+ * the per-write snapshot — see {@link CONTEXT_STACK_KEYS}, which is derived
+ * from this shape and keeps the two from drifting. The set is deliberately
+ * BOUNDED to what the runtime-wired rules actually read (measured, not
+ * projected): the three cross-collection security rules compare
+ * objects × permissions × books, and nothing on the runtime surface reads
+ * `positions` / `apps` — so those are NOT carried. Widening the snapshot is a
+ * one-key edit here plus a `CONTEXT_STACK_KEYS` entry, made when a rule that
+ * reads the collection actually crosses the wall, never in advance.
+ */
 interface RuntimeStackContext {
     /**
      * The live object declarations (registry + tenant overlay), as authored.
@@ -254,6 +267,27 @@ interface RuntimeStackContext {
      * package's config file and has to hedge.
      */
     objects?: readonly unknown[];
+    /**
+     * The live permission-set declarations (stack key `permissions`).
+     *
+     * [#8309] The collection the three cross-collection security rules compare
+     * against. Without it a per-write snapshot holds exactly ONE permission set
+     * (the written item), so `security-master-detail-ungranted` reads every
+     * detail object the tenant's OTHER sets grant as ungranted — measured as 38
+     * phantom findings per-write vs 4 whole-stack over the shipped corpus
+     * (PR #7886). `security-book-audience-unknown-set` needs the set NAMES to
+     * resolve a book's `audience.permissionSet` for the same reason.
+     */
+    permissions?: readonly unknown[];
+    /**
+     * The live documentation-book declarations (stack key `books`).
+     *
+     * [#8309] Carried so a `book` write is judged with its siblings present and
+     * replace-not-erase semantics apply to it (an updated book must not read as
+     * a second book of the same name), and so book-derived findings cancel in
+     * the differential for every other write type.
+     */
+    books?: readonly unknown[];
 }
 /** One rule's verdict at the runtime surface, carrying which rule produced it. */
 interface RuntimeGateResult {
@@ -275,6 +309,52 @@ declare function runtimeAuthoringRulesFor(type: string): readonly AuthoringRule[
 declare function runtimeGatedTypes(): string[];
 /** The stack key a metadata type occupies in a stack view, or null when unmapped. */
 declare function stackKeyForType(type: string): string | null;
+/**
+ * The baseline/candidate stack pair the gate judges one write against, or
+ * `null` when no snapshot can be built (unmapped type, non-object body).
+ *
+ * Exported (#8309) so the tests that measure per-write vs whole-stack
+ * agreement exercise the REAL construction instead of a hand-kept mirror —
+ * `validate-security-posture.runtime-surface.test.ts` used to mirror this
+ * logic in a local `wouldGateAdd`, which is exactly the drift surface a
+ * snapshot change here would have missed.
+ *
+ * Shape:
+ * - The baseline carries every context collection ({@link CONTEXT_STACK_KEYS})
+ *   WITHOUT the written item. Anything found there is somebody else's
+ *   pre-existing condition and is not this write's to answer for (#4463 D4 —
+ *   the gate blocks new writes, never stored rows). Carrying the sibling
+ *   collections in BOTH passes is what makes their findings cancel in the
+ *   diff — and what gives the cross-collection rules the sibling collection
+ *   they compare against, so the per-write verdict agrees with the
+ *   whole-stack one instead of inventing findings (the 38-vs-4 measurement,
+ *   PR #7886).
+ * - The candidate is the same context with this write's item added. When the
+ *   written type IS one of the context collections (an `object`, `permission`
+ *   or `book` write), the item REPLACES its stored self rather than appearing
+ *   beside it — otherwise an update reads as a duplicate name, and for
+ *   `objects` every lookup in the tenant's model would read as dangling. For
+ *   any other type the item is the sole member of its own collection, so
+ *   index-0 paths in the findings are unambiguously this write.
+ *
+ * Cost (the #4463 D2 question, measured rather than assumed): built per
+ * write, never cached. The construction is one filter + one spread over the
+ * written type's collection; the sibling collections are passed by reference.
+ * Over the shipped corpus (30 objects, 10 permission sets, 1 book) that is
+ * microseconds on a PUBLISH (never a draft autosave, D1) — a cache would buy
+ * nothing and would need cross-org invalidation the gate has no seam for.
+ */
+declare function buildRuntimeWriteSnapshots(args: {
+    /** Singular metadata type of the item being written. */
+    type: string;
+    /** The item body as it will be persisted. */
+    item: unknown;
+    /** Live resolution context from the host runtime. */
+    context?: RuntimeStackContext;
+}): {
+    baseline: AnyRec;
+    candidate: AnyRec;
+} | null;
 /**
  * Judge one about-to-be-published metadata item against the shared registry.
  *
@@ -296,4 +376,4 @@ declare function runRuntimeAuthoringRules(args: {
     sduiManifest?: unknown;
 }): RuntimeGateResult;
 
-export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimeStackContext as l, authoringRulesFor as m, runRuntimeAuthoringRules as n, runtimeAuthoringRulesFor as o, runtimeGatedTypes as p, stackKeyForType as q, runAuthoringRules as r, splitBySeverity as s };
+export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimeStackContext as l, authoringRulesFor as m, buildRuntimeWriteSnapshots as n, runRuntimeAuthoringRules as o, runtimeAuthoringRulesFor as p, runtimeGatedTypes as q, runAuthoringRules as r, splitBySeverity as s, stackKeyForType as t };

package/dist/{runtime-B50yywI_.d.ts → runtime-H-nDodRy.d.ts}

@@ -1,4 +1,4 @@
-type AnyRec = Record<string, unknown>;
+type AnyRec$1 = Record<string, unknown>;
 /** The three commands that hold a stack to the same author-time bar. */
 declare const AUTHORING_COMMANDS: readonly ["validate", "build", "lint"];
 type AuthoringCommand = (typeof AUTHORING_COMMANDS)[number];
@@ -152,7 +152,7 @@ interface AuthoringRule {
     runtimeTypes?: readonly string[];
     /** REQUIRED when `surfaces` omits `'runtime-publish'`: why the runtime gate does not run it. */
     surfaceReason?: string;
-    run: (stack: AnyRec, ctx: AuthoringRuleContext) => readonly AuthoringFinding[];
+    run: (stack: AnyRec$1, ctx: AuthoringRuleContext) => readonly AuthoringFinding[];
 }
 /**
  * `ExprIssue` is the one rule finding that carries no rule id of its own — it
@@ -168,12 +168,12 @@ declare const AUTHORING_RULES: readonly AuthoringRule[];
 /** The stack tiers a command has in hand when it runs the registry. */
 interface AuthoringRuleRun extends AuthoringRuleContext {
     /** `normalizeStackInput` output — pre-Zod-parse. Always required. */
-    normalized: AnyRec;
+    normalized: AnyRec$1;
     /**
      * Post-Zod-parse stack. Omitted by `os lint`, which does not parse; `parsed`
      * rules then read `normalized` (see `AuthoringRuleInputTier`).
      */
-    parsed?: AnyRec;
+    parsed?: AnyRec$1;
 }
 /** The rules `command` runs, in registry order. */
 declare function authoringRulesFor(command: AuthoringCommand): readonly AuthoringRule[];
@@ -243,7 +243,20 @@ declare function splitBySeverity(findings: readonly AuthoringFinding[]): {
  * a draft autosave). That is the correct place to spend it.
  */
 
-/** Everything the gate needs from the host runtime to build a snapshot. */
+type AnyRec = Record<string, unknown>;
+/**
+ * Everything the gate needs from the host runtime to build a snapshot.
+ *
+ * [#8309] Each key here doubles as the stack key the collection occupies in
+ * the per-write snapshot — see {@link CONTEXT_STACK_KEYS}, which is derived
+ * from this shape and keeps the two from drifting. The set is deliberately
+ * BOUNDED to what the runtime-wired rules actually read (measured, not
+ * projected): the three cross-collection security rules compare
+ * objects × permissions × books, and nothing on the runtime surface reads
+ * `positions` / `apps` — so those are NOT carried. Widening the snapshot is a
+ * one-key edit here plus a `CONTEXT_STACK_KEYS` entry, made when a rule that
+ * reads the collection actually crosses the wall, never in advance.
+ */
 interface RuntimeStackContext {
     /**
      * The live object declarations (registry + tenant overlay), as authored.
@@ -254,6 +267,27 @@ interface RuntimeStackContext {
      * package's config file and has to hedge.
      */
     objects?: readonly unknown[];
+    /**
+     * The live permission-set declarations (stack key `permissions`).
+     *
+     * [#8309] The collection the three cross-collection security rules compare
+     * against. Without it a per-write snapshot holds exactly ONE permission set
+     * (the written item), so `security-master-detail-ungranted` reads every
+     * detail object the tenant's OTHER sets grant as ungranted — measured as 38
+     * phantom findings per-write vs 4 whole-stack over the shipped corpus
+     * (PR #7886). `security-book-audience-unknown-set` needs the set NAMES to
+     * resolve a book's `audience.permissionSet` for the same reason.
+     */
+    permissions?: readonly unknown[];
+    /**
+     * The live documentation-book declarations (stack key `books`).
+     *
+     * [#8309] Carried so a `book` write is judged with its siblings present and
+     * replace-not-erase semantics apply to it (an updated book must not read as
+     * a second book of the same name), and so book-derived findings cancel in
+     * the differential for every other write type.
+     */
+    books?: readonly unknown[];
 }
 /** One rule's verdict at the runtime surface, carrying which rule produced it. */
 interface RuntimeGateResult {
@@ -275,6 +309,52 @@ declare function runtimeAuthoringRulesFor(type: string): readonly AuthoringRule[
 declare function runtimeGatedTypes(): string[];
 /** The stack key a metadata type occupies in a stack view, or null when unmapped. */
 declare function stackKeyForType(type: string): string | null;
+/**
+ * The baseline/candidate stack pair the gate judges one write against, or
+ * `null` when no snapshot can be built (unmapped type, non-object body).
+ *
+ * Exported (#8309) so the tests that measure per-write vs whole-stack
+ * agreement exercise the REAL construction instead of a hand-kept mirror —
+ * `validate-security-posture.runtime-surface.test.ts` used to mirror this
+ * logic in a local `wouldGateAdd`, which is exactly the drift surface a
+ * snapshot change here would have missed.
+ *
+ * Shape:
+ * - The baseline carries every context collection ({@link CONTEXT_STACK_KEYS})
+ *   WITHOUT the written item. Anything found there is somebody else's
+ *   pre-existing condition and is not this write's to answer for (#4463 D4 —
+ *   the gate blocks new writes, never stored rows). Carrying the sibling
+ *   collections in BOTH passes is what makes their findings cancel in the
+ *   diff — and what gives the cross-collection rules the sibling collection
+ *   they compare against, so the per-write verdict agrees with the
+ *   whole-stack one instead of inventing findings (the 38-vs-4 measurement,
+ *   PR #7886).
+ * - The candidate is the same context with this write's item added. When the
+ *   written type IS one of the context collections (an `object`, `permission`
+ *   or `book` write), the item REPLACES its stored self rather than appearing
+ *   beside it — otherwise an update reads as a duplicate name, and for
+ *   `objects` every lookup in the tenant's model would read as dangling. For
+ *   any other type the item is the sole member of its own collection, so
+ *   index-0 paths in the findings are unambiguously this write.
+ *
+ * Cost (the #4463 D2 question, measured rather than assumed): built per
+ * write, never cached. The construction is one filter + one spread over the
+ * written type's collection; the sibling collections are passed by reference.
+ * Over the shipped corpus (30 objects, 10 permission sets, 1 book) that is
+ * microseconds on a PUBLISH (never a draft autosave, D1) — a cache would buy
+ * nothing and would need cross-org invalidation the gate has no seam for.
+ */
+declare function buildRuntimeWriteSnapshots(args: {
+    /** Singular metadata type of the item being written. */
+    type: string;
+    /** The item body as it will be persisted. */
+    item: unknown;
+    /** Live resolution context from the host runtime. */
+    context?: RuntimeStackContext;
+}): {
+    baseline: AnyRec;
+    candidate: AnyRec;
+} | null;
 /**
  * Judge one about-to-be-published metadata item against the shared registry.
  *
@@ -296,4 +376,4 @@ declare function runRuntimeAuthoringRules(args: {
     sduiManifest?: unknown;
 }): RuntimeGateResult;
 
-export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimeStackContext as l, authoringRulesFor as m, runRuntimeAuthoringRules as n, runtimeAuthoringRulesFor as o, runtimeGatedTypes as p, stackKeyForType as q, runAuthoringRules as r, splitBySeverity as s };
+export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimeStackContext as l, authoringRulesFor as m, buildRuntimeWriteSnapshots as n, runRuntimeAuthoringRules as o, runtimeAuthoringRulesFor as p, runtimeGatedTypes as q, runAuthoringRules as r, splitBySeverity as s, stackKeyForType as t };