@objectstack/lint 17.0.0 → 17.1.0

package/dist/{runtime-H-nDodRy.d.cts → runtime-s3X9D9hm.d.cts}

@@ -252,7 +252,8 @@ type AnyRec = Record<string, unknown>;
  * from this shape and keeps the two from drifting. The set is deliberately
  * BOUNDED to what the runtime-wired rules actually read (measured, not
  * projected): the three cross-collection security rules compare
- * objects × permissions × books, and nothing on the runtime surface reads
+ * objects × permissions × books, `validateWidgetBindings` resolves widget
+ * bindings against datasets (#7529), and nothing on the runtime surface reads
  * `positions` / `apps` — so those are NOT carried. Widening the snapshot is a
  * one-key edit here plus a `CONTEXT_STACK_KEYS` entry, made when a rule that
  * reads the collection actually crosses the wall, never in advance.
@@ -288,7 +289,81 @@ interface RuntimeStackContext {
      * the differential for every other write type.
      */
     books?: readonly unknown[];
+    /**
+     * The live dataset declarations (stack key `datasets`).
+     *
+     * [#7529] The resolution universe `validateWidgetBindings` links a widget's
+     * `dataset` / `dimensions` / `values` against. Without it a per-write
+     * dashboard snapshot holds no datasets at all, so every widget on a fully
+     * legitimate board reads as dangling — measured as 3 phantom
+     * `widget-dataset-unknown` errors on a 3-widget board bound to a real
+     * dataset, vs 0 with the collection carried (and the genuinely dangling
+     * binding still yields exactly its 1 true error). Carrying it in BOTH
+     * passes also cancels dataset-level findings (`measure-aggregate-incoherent`
+     * is judged per dataset, independent of any widget) in the differential, so
+     * a stored dataset's pre-existing condition is not this write's to answer
+     * for (#4463 D4).
+     */
+    datasets?: readonly unknown[];
 }
+/**
+ * Which package a write belongs to, and what that package is allowed to reach.
+ *
+ * [#9612] The maintainer's ruling, verbatim, is the product decision this type
+ * exists for:
+ *
+ * > 大客户(420 个对象),就不应该出现在一个软件包中啊,这就是划分软件包的价值。
+ * > 客户开发开发,校验是否也应该基于软件包
+ * > 当然这里面要考虑系统对象
+ *
+ * A tenant that has grown to 420 objects is not ONE package — it is many — and
+ * judging one package's write against all 420 is validating against the wrong
+ * unit, not merely validating slowly. A package's declared `dependencies`
+ * bound what it MAY reference, so `package + declared deps + platform/system`
+ * is a closure the platform computes EXACTLY rather than estimates. That is
+ * what separates this from "narrow to whatever the rule can be proven to
+ * reach", which was considered and refused: a per-rule proof is a second
+ * opinion that drifts the moment a rule changes.
+ *
+ * ⛔ Absent — or carrying a package whose dependency declaration cannot be
+ * read — narrows NOTHING. The whole collection is handed over, exactly as
+ * before. The fallback direction is deliberate and is the opposite of a size
+ * threshold: an unknown provenance buys MORE validation input, never less, so
+ * the gate never stops judging (the #9798 / #9261 / ADR-0110 D3 fail-open
+ * shape this card was explicitly forbidden from re-creating).
+ */
+interface RuntimePackageScope {
+    /** The package the written item belongs to. */
+    packageId: string;
+    /**
+     * Every OTHER package this one may reference — the transitive closure of the
+     * written package's declared `dependencies`. Resolved by the host, which is
+     * the side that holds the package registry; this module only reads the set.
+     */
+    dependencies: readonly string[];
+}
+/**
+ * `objects` reduced to the written item's package closure (#9612).
+ *
+ * An object survives when ANY of these holds — the four limbs are the closure
+ * the ruling names, and each one is load-bearing:
+ *
+ *  1. it is a **platform / system object** ({@link isSystemObject}, imported
+ *     rather than re-decided). ⛔ Unconditional: a package legitimately
+ *     references `sys_*` objects it never declares a dependency on, and a
+ *     closure that dropped them would manufacture "unresolved reference"
+ *     findings that describe nothing — the false-positive class PR #7886
+ *     already paid for on the `permissions` collection;
+ *  2. it carries **no package provenance** — a tenant-authored overlay row.
+ *     Nothing declares what such a row may reference, so nothing bounds it and
+ *     it is kept. Conservative by construction;
+ *  3. it belongs to the **written package** itself;
+ *  4. it belongs to one of that package's **declared dependencies**.
+ *
+ * Pure, allocation-light, and total: a non-object member is kept rather than
+ * inspected, because deciding it is not this function's job.
+ */
+declare function narrowObjectsToPackageClosure(objects: readonly unknown[], scope: RuntimePackageScope | undefined): readonly unknown[];
 /** One rule's verdict at the runtime surface, carrying which rule produced it. */
 interface RuntimeGateResult {
     /** Findings the written item ADDED, severity `error` — the reason to refuse the write. */
@@ -351,6 +426,12 @@ declare function buildRuntimeWriteSnapshots(args: {
     item: unknown;
     /** Live resolution context from the host runtime. */
     context?: RuntimeStackContext;
+    /**
+     * [#9612] The written item's package and what it may reach. Omitted — or
+     * carrying a package whose dependencies the host could not read — hands the
+     * rules the WHOLE `objects` collection, exactly as before.
+     */
+    packageScope?: RuntimePackageScope;
 }): {
     baseline: AnyRec;
     candidate: AnyRec;
@@ -372,8 +453,14 @@ declare function runRuntimeAuthoringRules(args: {
     item: unknown;
     /** Live resolution context from the host runtime. */
     context?: RuntimeStackContext;
+    /**
+     * [#9612] The written item's package closure. Omit to judge against the
+     * whole collection — the pre-#9612 behaviour, and the behaviour every caller
+     * that cannot state a package keeps.
+     */
+    packageScope?: RuntimePackageScope;
     /** ADR-0080 SDUI manifest, when the host has one. */
     sduiManifest?: unknown;
 }): RuntimeGateResult;
 
-export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimeStackContext as l, authoringRulesFor as m, buildRuntimeWriteSnapshots as n, runRuntimeAuthoringRules as o, runtimeAuthoringRulesFor as p, runtimeGatedTypes as q, runAuthoringRules as r, splitBySeverity as s, stackKeyForType as t };
+export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimePackageScope as l, type RuntimeStackContext as m, authoringRulesFor as n, buildRuntimeWriteSnapshots as o, narrowObjectsToPackageClosure as p, runRuntimeAuthoringRules as q, runAuthoringRules as r, runtimeAuthoringRulesFor as s, runtimeGatedTypes as t, splitBySeverity as u, stackKeyForType as v };

package/dist/{runtime-H-nDodRy.d.ts → runtime-s3X9D9hm.d.ts}

@@ -252,7 +252,8 @@ type AnyRec = Record<string, unknown>;
  * from this shape and keeps the two from drifting. The set is deliberately
  * BOUNDED to what the runtime-wired rules actually read (measured, not
  * projected): the three cross-collection security rules compare
- * objects × permissions × books, and nothing on the runtime surface reads
+ * objects × permissions × books, `validateWidgetBindings` resolves widget
+ * bindings against datasets (#7529), and nothing on the runtime surface reads
  * `positions` / `apps` — so those are NOT carried. Widening the snapshot is a
  * one-key edit here plus a `CONTEXT_STACK_KEYS` entry, made when a rule that
  * reads the collection actually crosses the wall, never in advance.
@@ -288,7 +289,81 @@ interface RuntimeStackContext {
      * the differential for every other write type.
      */
     books?: readonly unknown[];
+    /**
+     * The live dataset declarations (stack key `datasets`).
+     *
+     * [#7529] The resolution universe `validateWidgetBindings` links a widget's
+     * `dataset` / `dimensions` / `values` against. Without it a per-write
+     * dashboard snapshot holds no datasets at all, so every widget on a fully
+     * legitimate board reads as dangling — measured as 3 phantom
+     * `widget-dataset-unknown` errors on a 3-widget board bound to a real
+     * dataset, vs 0 with the collection carried (and the genuinely dangling
+     * binding still yields exactly its 1 true error). Carrying it in BOTH
+     * passes also cancels dataset-level findings (`measure-aggregate-incoherent`
+     * is judged per dataset, independent of any widget) in the differential, so
+     * a stored dataset's pre-existing condition is not this write's to answer
+     * for (#4463 D4).
+     */
+    datasets?: readonly unknown[];
 }
+/**
+ * Which package a write belongs to, and what that package is allowed to reach.
+ *
+ * [#9612] The maintainer's ruling, verbatim, is the product decision this type
+ * exists for:
+ *
+ * > 大客户(420 个对象),就不应该出现在一个软件包中啊,这就是划分软件包的价值。
+ * > 客户开发开发,校验是否也应该基于软件包
+ * > 当然这里面要考虑系统对象
+ *
+ * A tenant that has grown to 420 objects is not ONE package — it is many — and
+ * judging one package's write against all 420 is validating against the wrong
+ * unit, not merely validating slowly. A package's declared `dependencies`
+ * bound what it MAY reference, so `package + declared deps + platform/system`
+ * is a closure the platform computes EXACTLY rather than estimates. That is
+ * what separates this from "narrow to whatever the rule can be proven to
+ * reach", which was considered and refused: a per-rule proof is a second
+ * opinion that drifts the moment a rule changes.
+ *
+ * ⛔ Absent — or carrying a package whose dependency declaration cannot be
+ * read — narrows NOTHING. The whole collection is handed over, exactly as
+ * before. The fallback direction is deliberate and is the opposite of a size
+ * threshold: an unknown provenance buys MORE validation input, never less, so
+ * the gate never stops judging (the #9798 / #9261 / ADR-0110 D3 fail-open
+ * shape this card was explicitly forbidden from re-creating).
+ */
+interface RuntimePackageScope {
+    /** The package the written item belongs to. */
+    packageId: string;
+    /**
+     * Every OTHER package this one may reference — the transitive closure of the
+     * written package's declared `dependencies`. Resolved by the host, which is
+     * the side that holds the package registry; this module only reads the set.
+     */
+    dependencies: readonly string[];
+}
+/**
+ * `objects` reduced to the written item's package closure (#9612).
+ *
+ * An object survives when ANY of these holds — the four limbs are the closure
+ * the ruling names, and each one is load-bearing:
+ *
+ *  1. it is a **platform / system object** ({@link isSystemObject}, imported
+ *     rather than re-decided). ⛔ Unconditional: a package legitimately
+ *     references `sys_*` objects it never declares a dependency on, and a
+ *     closure that dropped them would manufacture "unresolved reference"
+ *     findings that describe nothing — the false-positive class PR #7886
+ *     already paid for on the `permissions` collection;
+ *  2. it carries **no package provenance** — a tenant-authored overlay row.
+ *     Nothing declares what such a row may reference, so nothing bounds it and
+ *     it is kept. Conservative by construction;
+ *  3. it belongs to the **written package** itself;
+ *  4. it belongs to one of that package's **declared dependencies**.
+ *
+ * Pure, allocation-light, and total: a non-object member is kept rather than
+ * inspected, because deciding it is not this function's job.
+ */
+declare function narrowObjectsToPackageClosure(objects: readonly unknown[], scope: RuntimePackageScope | undefined): readonly unknown[];
 /** One rule's verdict at the runtime surface, carrying which rule produced it. */
 interface RuntimeGateResult {
     /** Findings the written item ADDED, severity `error` — the reason to refuse the write. */
@@ -351,6 +426,12 @@ declare function buildRuntimeWriteSnapshots(args: {
     item: unknown;
     /** Live resolution context from the host runtime. */
     context?: RuntimeStackContext;
+    /**
+     * [#9612] The written item's package and what it may reach. Omitted — or
+     * carrying a package whose dependencies the host could not read — hands the
+     * rules the WHOLE `objects` collection, exactly as before.
+     */
+    packageScope?: RuntimePackageScope;
 }): {
     baseline: AnyRec;
     candidate: AnyRec;
@@ -372,8 +453,14 @@ declare function runRuntimeAuthoringRules(args: {
     item: unknown;
     /** Live resolution context from the host runtime. */
     context?: RuntimeStackContext;
+    /**
+     * [#9612] The written item's package closure. Omit to judge against the
+     * whole collection — the pre-#9612 behaviour, and the behaviour every caller
+     * that cannot state a package keeps.
+     */
+    packageScope?: RuntimePackageScope;
     /** ADR-0080 SDUI manifest, when the host has one. */
     sduiManifest?: unknown;
 }): RuntimeGateResult;
 
-export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimeStackContext as l, authoringRulesFor as m, buildRuntimeWriteSnapshots as n, runRuntimeAuthoringRules as o, runtimeAuthoringRulesFor as p, runtimeGatedTypes as q, runAuthoringRules as r, splitBySeverity as s, stackKeyForType as t };
+export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimePackageScope as l, type RuntimeStackContext as m, authoringRulesFor as n, buildRuntimeWriteSnapshots as o, narrowObjectsToPackageClosure as p, runRuntimeAuthoringRules as q, runAuthoringRules as r, runtimeAuthoringRulesFor as s, runtimeGatedTypes as t, splitBySeverity as u, stackKeyForType as v };