@objectstack/lint 17.1.0 → 17.2.0

package/dist/{runtime-s3X9D9hm.d.cts → runtime-cV-l_vtC.d.cts}

@@ -35,7 +35,13 @@ interface AuthoringFinding {
     rule: string;
     /** Human-readable location, e.g. `object "leave_request"`. */
     where: string;
-    /** Config path, e.g. `objects[3].sharingModel`. */
+    /**
+     * Config path, e.g. `objects[3].sharingModel`. Positional as RULES emit it;
+     * on the runtime gate's wire surface the top-level collection index of a
+     * collection-resident finding is rewritten to the entry's NAME
+     * (`objects.acme_invoice.sharingModel`) — see `nameKeyFindingPath` in
+     * `runtime-gate.ts` (#10064).
+     */
     path: string;
     /** What is wrong. */
     message: string;
@@ -117,6 +123,19 @@ type AuthoringRuleInputTier = 'normalized' | 'parsed';
 interface AuthoringRuleContext {
     /** ADR-0080 SDUI component manifest, when the project ships one. */
     sduiManifest?: unknown;
+    /**
+     * [#9313] The singular metadata type of the per-write snapshot being judged
+     * — set by the runtime publish gate (`runtime-gate.ts`) on every gated
+     * write, ABSENT on the three CLI commands (`runAuthoringRules` never sets
+     * it). Exists for the one entry that is itself a registry: the
+     * reference-integrity suite dispatches its MEMBERS by this
+     * (`ReferenceIntegrityRule.runtimeTypes`), because the entry-level
+     * `runtimeTypes` can only say which writes reach the suite, not which
+     * members can judge a partial per-write snapshot without inventing
+     * findings. No other rule reads it, and none should without the same
+     * argument.
+     */
+    runtimeWriteType?: string;
 }
 interface AuthoringRule {
     /** The exported function's name — the id the wiring guard asserts on. */

package/dist/{runtime-s3X9D9hm.d.ts → runtime-cV-l_vtC.d.ts}

@@ -35,7 +35,13 @@ interface AuthoringFinding {
     rule: string;
     /** Human-readable location, e.g. `object "leave_request"`. */
     where: string;
-    /** Config path, e.g. `objects[3].sharingModel`. */
+    /**
+     * Config path, e.g. `objects[3].sharingModel`. Positional as RULES emit it;
+     * on the runtime gate's wire surface the top-level collection index of a
+     * collection-resident finding is rewritten to the entry's NAME
+     * (`objects.acme_invoice.sharingModel`) — see `nameKeyFindingPath` in
+     * `runtime-gate.ts` (#10064).
+     */
     path: string;
     /** What is wrong. */
     message: string;
@@ -117,6 +123,19 @@ type AuthoringRuleInputTier = 'normalized' | 'parsed';
 interface AuthoringRuleContext {
     /** ADR-0080 SDUI component manifest, when the project ships one. */
     sduiManifest?: unknown;
+    /**
+     * [#9313] The singular metadata type of the per-write snapshot being judged
+     * — set by the runtime publish gate (`runtime-gate.ts`) on every gated
+     * write, ABSENT on the three CLI commands (`runAuthoringRules` never sets
+     * it). Exists for the one entry that is itself a registry: the
+     * reference-integrity suite dispatches its MEMBERS by this
+     * (`ReferenceIntegrityRule.runtimeTypes`), because the entry-level
+     * `runtimeTypes` can only say which writes reach the suite, not which
+     * members can judge a partial per-write snapshot without inventing
+     * findings. No other rule reads it, and none should without the same
+     * argument.
+     */
+    runtimeWriteType?: string;
 }
 interface AuthoringRule {
     /** The exported function's name — the id the wiring guard asserts on. */

package/dist/runtime.cjs

@@ -2190,6 +2190,26 @@ function validateSearchableFields(stack) {
     if (!isRec3(view)) continue;
     const viewLabel2 = strName3(view.name) ?? strName3(view.objectName) ?? `#${vi}`;
     const viewObject = strName3(view.objectName) ?? strName3(view.object);
+    if (view.viewKind === "list" && !isRec3(view.config)) {
+      check(
+        view.searchableFields,
+        listViewObject(view) ?? viewObject,
+        `view "${viewLabel2}" (flattened list overlay)`,
+        `views[${vi}].searchableFields`,
+        "list-view searchableFields",
+        "narrowing"
+      );
+    }
+    if (view.viewKind === "list" && isRec3(view.config)) {
+      check(
+        view.config.searchableFields,
+        listViewObject(view.config) ?? viewObject,
+        `view "${viewLabel2}" (ViewItem record)`,
+        `views[${vi}].config.searchableFields`,
+        "list-view searchableFields",
+        "narrowing"
+      );
+    }
     if (isRec3(view.list)) {
       check(
         view.list.searchableFields,
@@ -2225,6 +2245,7 @@ function listViewObject(listView) {
 var import_data8 = require("@objectstack/spec/data");
 var SORT_FIELD_UNKNOWN = "sort-field-unknown";
 var SORT_FIELD_UNSORTABLE = "sort-field-unsortable";
+var SORT_FIELD_UNPROVISIONED = "sort-field-unprovisioned";
 function isRec4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
@@ -2287,7 +2308,7 @@ function distance3(a, b) {
   }
   return prev[n];
 }
-function checkSortDeclaration(declared, objectName, fieldsByObject, where, path, subject) {
+function checkSortDeclaration(declared, objectName, fieldsByObject, where, path, subject, unprovisionedAnchors) {
   const findings = [];
   if (declared === void 0 || declared === null) return findings;
   if (!objectName) return findings;
@@ -2295,10 +2316,23 @@ function checkSortDeclaration(declared, objectName, fieldsByObject, where, path,
   const target = fieldsByObject.get(objectName);
   if (!target) return findings;
   const known = target.names;
+  const anchors = unprovisionedAnchors?.get(objectName);
   for (const key of readSortKeys(declared)) {
     const name = key.field;
     const head = name.split(".")[0];
-    if (SYSTEM_FIELDS.has(head)) continue;
+    if (SYSTEM_FIELDS.has(head)) {
+      if (!name.includes(".") && anchors?.has(head)) {
+        findings.push({
+          severity: "warning",
+          rule: SORT_FIELD_UNPROVISIONED,
+          where,
+          path: `${path}${key.at}`,
+          message: `${subject} orders by "${name}", which resolves on object "${objectName}", but ${unprovisionedAnchorCause(objectName, name)} \u2014 so the ORDER BY reaches the driver, finds no column, and is dropped. Measured on a federated object over a real remote table, 'asc' and 'desc' return BYTE-IDENTICAL row order under a 200 while the same query on a real column reverses. Unlike this rule's other two verdicts nothing refuses it: the REST ingress (#6994) and the engine (#7095) both judge only 'formula', so the view's FIRST fetch \u2014 and every fetch after it \u2014 silently answers in an arbitrary order, which 'limit'/'offset' then slice into an arbitrary page.`,
+          hint: unprovisionedAnchorHint(objectName, name)
+        });
+      }
+      continue;
+    }
     if (!known.has(head)) {
       const dotted = name.includes(".");
       findings.push({
@@ -2331,9 +2365,18 @@ function validateSortableFields(stack) {
   if (!isRec4(stack)) return findings;
   const objects = Array.isArray(stack.objects) ? stack.objects : isRec4(stack.objects) ? Object.entries(stack.objects).map(([name, def]) => ({ name, ...def })) : [];
   const fieldsByObject = indexObjectSearchTargets(stack);
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const check = (declared, objectName, where, path, subject) => {
     findings.push(
-      ...checkSortDeclaration(declared, objectName, fieldsByObject, where, path, subject)
+      ...checkSortDeclaration(
+        declared,
+        objectName,
+        fieldsByObject,
+        where,
+        path,
+        subject,
+        unprovisionedAnchors
+      )
     );
   };
   for (let oi = 0; oi < objects.length; oi++) {
@@ -2362,6 +2405,24 @@ function validateSortableFields(stack) {
     if (!isRec4(view)) continue;
     const viewLabel2 = strName4(view.name) ?? strName4(view.objectName) ?? `#${vi}`;
     const viewObject = strName4(view.objectName) ?? strName4(view.object);
+    if (view.viewKind === "list" && !isRec4(view.config)) {
+      check(
+        view.sort,
+        listViewObject2(view) ?? viewObject,
+        `view "${viewLabel2}" (flattened list overlay)`,
+        `views[${vi}].sort`,
+        "list-view sort"
+      );
+    }
+    if (view.viewKind === "list" && isRec4(view.config)) {
+      check(
+        view.config.sort,
+        listViewObject2(view.config) ?? viewObject,
+        `view "${viewLabel2}" (ViewItem record)`,
+        `views[${vi}].config.sort`,
+        "list-view sort"
+      );
+    }
     if (isRec4(view.list)) {
       check(
         view.list.sort,
@@ -4542,6 +4603,38 @@ function validateAiAgentAuthoring(stack) {
 // src/validate-hook-body-writes.ts
 var import_node_module = require("module");
 var import_shared = require("@objectstack/spec/shared");
+
+// src/checked-parse.ts
+function createSourceFileChecked(tsc, fileName, source, options) {
+  const sourceFile = tsc.createSourceFile(
+    fileName,
+    source,
+    options.target,
+    options.setParentNodes,
+    options.scriptKind
+  );
+  const diagnostics = sourceFile.parseDiagnostics;
+  if (!diagnostics || diagnostics.length === 0) return { sourceFile };
+  const first = diagnostics[0];
+  const { line, character } = sourceFile.getLineAndCharacterOfPosition(first.start ?? 0);
+  const offset = options.synthesizedLinesBefore ?? 0;
+  return {
+    sourceFile,
+    failure: {
+      message: tsc.flattenDiagnosticMessageText(first.messageText, " "),
+      line: Math.max(1, line + 1 - offset),
+      column: character + 1,
+      count: diagnostics.length
+    }
+  };
+}
+function describeParseFailure(failure) {
+  const more = failure.count > 1 ? `; ${failure.count} syntax errors in total` : "";
+  return `line ${failure.line}, column ${failure.column}: ${failure.message}${more}`;
+}
+var PARSE_FAILURE_HINT = "The source is parsed (never executed) so it can be checked. A source with syntax errors is only partially recovered, so the checks that follow may have skipped real problems \u2014 fix the syntax error and re-run to get a verdict that covers the whole source.";
+
+// src/validate-hook-body-writes.ts
 var import_meta = {};
 var cachedTs = null;
 function loadTypeScript() {
@@ -4557,6 +4650,7 @@ function loadTypeScript() {
   return cachedTs;
 }
 var HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
+var HOOK_BODY_SOURCE_UNPARSEABLE = "hook-body-source-unparseable";
 var HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR = "hook-body-write-unprovisioned-anchor";
 var HOOK_BODY_WRITE_PATTERNS = [
   {
@@ -4656,23 +4750,23 @@ function judgeableFieldsOf(index, objectName) {
   if (!declared || declared.size === 0) return void 0;
   return declared;
 }
-function extractHookBodyWrites(source) {
-  return extractHookBodyWriteSet(source).writes;
-}
 function extractHookBodyWriteSet(source) {
   if (!/\bctx\b/.test(source) && !/\bObject\b/.test(source)) {
     return { writes: [], ctxRecordEscapes: false };
   }
   const tsc = loadTypeScript();
-  const sf = tsc.createSourceFile(
+  const { sourceFile: sf, failure: parseFailure } = createSourceFileChecked(
+    tsc,
     "hook-body.ts",
     `async function __body(ctx) {
 ${source}
 }`,
-    tsc.ScriptTarget.Latest,
-    /* setParentNodes */
-    false,
-    tsc.ScriptKind.TS
+    {
+      target: tsc.ScriptTarget.Latest,
+      setParentNodes: false,
+      scriptKind: tsc.ScriptKind.TS,
+      synthesizedLinesBefore: 1
+    }
   );
   const writes = [];
   const recordRefs = [];
@@ -4769,7 +4863,8 @@ ${source}
   visit(sf);
   return {
     writes,
-    ctxRecordEscapes: recordRefs.some((ref) => !consumedRecordRefs.has(ref))
+    ctxRecordEscapes: recordRefs.some((ref) => !consumedRecordRefs.has(ref)),
+    ...parseFailure ? { parseFailure } : {}
   };
 }
 function validateHookBodyWrites(stack) {
@@ -4783,11 +4878,22 @@ function validateHookBodyWrites(stack) {
     if (!isRec15(body) || body.language !== "js") return;
     const source = body.source;
     if (typeof source !== "string" || source.trim() === "") return;
-    const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
+    const extracted = extractHookBodyWriteSet(source);
+    const hookName = typeof hook.name === "string" && hook.name ? hook.name : `#${hookIndex}`;
+    if (extracted.parseFailure) {
+      findings.push({
+        severity: "warning",
+        rule: HOOK_BODY_SOURCE_UNPARSEABLE,
+        where: `hook "${hookName}" \u203A body`,
+        path: `hooks[${hookIndex}].body.source`,
+        message: `L2 body did not parse (${describeParseFailure(extracted.parseFailure)}), so its write set was read from a partially recovered tree \u2014 an undeclared field write in the unread part is not reported.`,
+        hint: PARSE_FAILURE_HINT
+      });
+    }
+    const writes = extracted.writes.filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
     if (writes.length === 0) return;
     objectFields ?? (objectFields = indexObjectFields2(stack));
     anchors ?? (anchors = indexUnprovisionedAnchors(stack));
-    const hookName = typeof hook.name === "string" && hook.name ? hook.name : `#${hookIndex}`;
     const targets = (Array.isArray(hook.object) ? hook.object : [hook.object]).filter(
       (o) => typeof o === "string" && o.trim() !== ""
     );
@@ -4872,6 +4978,7 @@ function fixHint(field, declared) {
 var import_shared2 = require("@objectstack/spec/shared");
 var ACTION_BODY_WRITE_UNKNOWN_FIELD = "action-body-write-unknown-field";
 var ACTION_RECORD_WRITE_DISCARDED = "action-record-write-discarded";
+var ACTION_BODY_SOURCE_UNPARSEABLE = "action-body-source-unparseable";
 var ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR = "action-body-write-unprovisioned-anchor";
 var ACTION_BODY_WRITE_PATTERN_IDS = ["api-crud-literal"];
 var ACTION_RECORD_WRITE_PATTERN_IDS = ["record-property-assign"];
@@ -4929,11 +5036,21 @@ function validateActionBodyWrites(stack) {
   let anchors = null;
   for (const site of sites) {
     if (!/\bapi\b/.test(site.source) && !/\brecord\b/.test(site.source)) continue;
-    const { writes: allWrites, ctxRecordEscapes } = extractHookBodyWriteSet(site.source);
+    const { writes: allWrites, ctxRecordEscapes, parseFailure } = extractHookBodyWriteSet(site.source);
     const writes = allWrites.filter((w) => APPLICABLE_IDS.has(w.patternId));
     const recordWrites = allWrites.filter((w) => RECORD_WRITE_IDS.has(w.patternId));
-    if (writes.length === 0 && recordWrites.length === 0) continue;
     const where = `action "${site.name}" \u203A body`;
+    if (parseFailure) {
+      findings.push({
+        severity: "warning",
+        rule: ACTION_BODY_SOURCE_UNPARSEABLE,
+        where,
+        path: site.path,
+        message: `L2 body did not parse (${describeParseFailure(parseFailure)}), so its write set was read from a partially recovered tree \u2014 an undeclared field write in the unread part is not reported.`,
+        hint: PARSE_FAILURE_HINT
+      });
+    }
+    if (writes.length === 0 && recordWrites.length === 0) continue;
     if (recordWrites.length > 0 && !ctxRecordEscapes) {
       const reportedFields = /* @__PURE__ */ new Set();
       for (const w of recordWrites) {
@@ -5306,6 +5423,7 @@ function filterAttrValue(tsc, sf, attr) {
   };
   return perPosition(init.expression);
 }
+var REACT_PAGE_SOURCE_UNPARSEABLE = "react-page-source-unparseable";
 var REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
 var REACT_CHART_FIELD_UNPROVISIONED = "react-chart-field-unprovisioned";
 var REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
@@ -5634,11 +5752,20 @@ function validateReactPageProps(stack) {
     if (typeof source !== "string" || source.trim() === "") continue;
     const name = String(page.name ?? `#${p}`);
     const tsc = loadTypeScript2();
-    let sf;
-    try {
-      sf = tsc.createSourceFile("page.tsx", source, tsc.ScriptTarget.Latest, true, tsc.ScriptKind.TSX);
-    } catch {
-      continue;
+    const { sourceFile: sf, failure } = createSourceFileChecked(tsc, "page.tsx", source, {
+      target: tsc.ScriptTarget.Latest,
+      setParentNodes: true,
+      scriptKind: tsc.ScriptKind.TSX
+    });
+    if (failure) {
+      findings.push({
+        severity: "warning",
+        rule: REACT_PAGE_SOURCE_UNPARSEABLE,
+        where: `page "${name}"`,
+        path: `pages[${p}].source`,
+        message: `kind:'react' source did not parse (${describeParseFailure(failure)}), so the component-contract checks read a partially recovered tree and may have missed real problems.`,
+        hint: PARSE_FAILURE_HINT
+      });
     }
     const locals = localComponentNames(tsc, sf);
     const visit = (node) => {
@@ -5741,16 +5868,26 @@ function validateReactPageProps(stack) {
 }
 
 // src/reference-integrity-suite.ts
+var DEFAULT_MEMBER_RUNTIME_TYPES = ["flow"];
 var REFERENCE_INTEGRITY_RULES = [
   { name: "validateObjectReferences", run: validateObjectReferences },
-  { name: "validateSearchableFields", run: validateSearchableFields },
+  // [#9313] `runtimeTypes` gains `view` on this member and its sort sibling:
+  // both judge a LIST VIEW's field references, and a standalone list view is
+  // written through `PUT /api/v1/meta/view` — the only door a Studio tenant or
+  // an MCP/AI author has. Their walks read the flattened overlay shape that
+  // door carries (see each rule's `views[]` self rung), and they resolve only
+  // against `stack.objects`, which the per-write snapshot DOES carry — so the
+  // crossing has no missing-collection false-positive channel. Measured over
+  // the shipped view corpus before crossing (0 refusals; population in the
+  // #9313 PR).
+  { name: "validateSearchableFields", runtimeTypes: ["flow", "view"], run: validateSearchableFields },
   // [#9257] The same reading, one axis over: a list view's `sort` is a field
   // name written in metadata, resolved against the object's declared fields. It
   // gates (`error`) because the runtime does not tolerate a bad one at all —
   // `assertSortFieldsExist` (#6994) and `assertOrderByIsMaterializable` (#7095)
   // both answer `400 INVALID_SORT` — and a view's sort is its FIRST fetch, so
   // the refusal is the whole view, on every load, traced to nothing.
-  { name: "validateSortableFields", run: validateSortableFields },
+  { name: "validateSortableFields", runtimeTypes: ["flow", "view"], run: validateSortableFields },
   { name: "validateActionNameRefs", run: validateActionNameRefs },
   { name: "validatePageFieldBindings", run: validatePageFieldBindings },
   { name: "validateChartBindings", run: validateChartBindings },
@@ -5856,9 +5993,11 @@ var REFERENCE_INTEGRITY_RULES = [
   // — only a page that is actually `kind:'react'` loads the compiler.
   { name: "validateReactPageProps", run: validateReactPageProps }
 ];
-function validateReferenceIntegrity(stack) {
+function validateReferenceIntegrity(stack, options) {
   const findings = [];
+  const writeType = options?.runtimeWriteType;
   for (const rule of REFERENCE_INTEGRITY_RULES) {
+    if (writeType !== void 0 && !(rule.runtimeTypes ?? DEFAULT_MEMBER_RUNTIME_TYPES).includes(writeType)) continue;
     findings.push(...rule.run(stack));
   }
   return findings;
@@ -9996,9 +10135,31 @@ var AUTHORING_RULES = [
     // collection in the snapshot and return nothing, and the two that would
     // load `typescript` need a hook/action/react body the snapshot never
     // carries — which is what `runtime-lazy-deps.test.ts` pins.
+    //
+    // [#9313] `view` joins, and the granularity decision #4463 P2 reserved is
+    // taken HERE, in writing: the entry-level `runtimeTypes` says which WRITES
+    // dispatch the suite, and the suite's own per-member `runtimeTypes`
+    // (`ReferenceIntegrityRule`, default `['flow']`) says which MEMBERS judge
+    // that snapshot — the gate passes the written type through
+    // `ctx.runtimeWriteType`. A `view` write therefore reaches exactly the two
+    // members that judge a list view's field references and resolve only
+    // against the `objects` collection the snapshot carries
+    // (`validateSearchableFields`, `validateSortableFields`). The whole suite
+    // is NOT the right granularity for this door, measured not assumed, and
+    // the crossing fails differently per body shape — both ways wrong:
+    // `validateActionNameRefs` (error-tier) resolves `views[].list` /
+    // `views[].listViews.*` action names against `stack.actions`, a collection
+    // no per-write snapshot carries, so on a CONTAINER view write it would
+    // refuse every stack-level action the body names (measured:
+    // `action-name-undefined` on the snapshot shape, clean on the full stack)
+    // — RUNTIME_NEEDS_FULL_SNAPSHOT's exact sentence, on the hottest write
+    // type the gate has. On a FLATTENED overlay it has no rung at all, so the
+    // crossing would be a silent no-op that reads as coverage — the very shape
+    // #9313 was filed about. Flow snapshots are unchanged: every member keeps
+    // the default `flow` declaration.
     surfaces: CLI_AND_RUNTIME,
-    runtimeTypes: ["flow"],
-    run: (stack) => validateReferenceIntegrity(stack)
+    runtimeTypes: ["flow", "view"],
+    run: (stack, ctx) => validateReferenceIntegrity(stack, ctx)
   },
   // ADR-0078 / #5068 — the SDUI component-props gate. `PageComponent.properties`
   // is `z.record(z.string(), z.unknown())` and ADR-0089 D3a strictness does not
@@ -10827,6 +10988,20 @@ function buildRuntimeWriteSnapshots(args) {
   };
   return { baseline, candidate };
 }
+var NAME_KEYED_STACK_KEYS = ["objects", "permissions", "books"];
+var PATH_SAFE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var TOP_LEVEL_INDEX = /^(objects|permissions|books)\[(\d+)\](.*)$/;
+function nameKeyFindingPath(path, candidate) {
+  const m = TOP_LEVEL_INDEX.exec(path);
+  if (!m) return path;
+  const [, stackKey, index, rest] = m;
+  if (!NAME_KEYED_STACK_KEYS.includes(stackKey)) return path;
+  const collection = candidate[stackKey];
+  const entry = collection?.[Number(index)];
+  const name = entry && typeof entry === "object" ? entry.name : void 0;
+  if (typeof name !== "string" || !PATH_SAFE_NAME.test(name)) return path;
+  return `${stackKey}.${name}${rest}`;
+}
 function runRules(rules, stack, ctx) {
   const findings = [];
   for (const rule of rules) {
@@ -10856,9 +11031,12 @@ function runRuntimeAuthoringRules(args) {
     ...args.packageScope !== void 0 ? { packageScope: args.packageScope } : {}
   });
   if (!snapshots) return empty;
-  const ctx = { sduiManifest: args.sduiManifest };
+  const ctx = { sduiManifest: args.sduiManifest, runtimeWriteType: args.type };
   const before = new Set(runRules(rules, snapshots.baseline, ctx).map(fingerprint));
-  const added = runRules(rules, snapshots.candidate, ctx).filter((f) => !before.has(fingerprint(f)));
+  const added = runRules(rules, snapshots.candidate, ctx).filter((f) => !before.has(fingerprint(f))).map((f) => {
+    const path = nameKeyFindingPath(f.path, snapshots.candidate);
+    return path === f.path ? f : { ...f, path };
+  });
   return {
     errors: added.filter((f) => f.severity === "error"),
     advisories: added.filter((f) => f.severity !== "error"),