@ogygie/core 0.1.0

package/src/tenant.ts

@@ -0,0 +1,207 @@
+/**
+ * @intent Structural multi-tenancy (AGENTS.md §Multi-tenant). The core exposes a
+ * GENERIC TenantContext — it knows no word of the product domain (DECISIONS.md D10):
+ * the product defines its own alias and binds the tenant column key.
+ * `tenantDb(ctx)` is the only sanctioned way to touch tenant-scoped tables: it
+ * injects the tenant column on insert and filters on it for select/update/delete,
+ * making cross-tenant leaks impossible by construction rather than by vigilance.
+ */
+import type { InferInsertModel, InferSelectModel, SQL } from "drizzle-orm";
+import { and, eq, getTableColumns } from "drizzle-orm";
+import type { PgColumn, PgTable } from "drizzle-orm/pg-core";
+import { z } from "zod";
+import { OgygieFailure, ogygieError } from "./error.schema.js";
+import type { Database } from "./db.js";
+
+export const TenantContextSchema = z.object({
+  tenantId: z.uuid(),
+  userId: z.uuid(),
+});
+
+/**
+ * Tenant context built EXCLUSIVELY by the product's auth middleware — never from
+ * client-provided identifiers (body/query/params are hostile). Besides the two
+ * identity fields it carries the effect bindings: the request-scoped db and the
+ * TS property key of the tenant column on the product's Drizzle tables. Nothing
+ * else needs to be injected into repositories.
+ */
+export interface TenantContext<TenantColumnKey extends string = string>
+  extends z.infer<typeof TenantContextSchema> {
+  readonly db: Database;
+  readonly tenantColumnKey: TenantColumnKey;
+}
+
+/** Rows come back untyped from the generic facade; repositories narrow them. */
+type RawRow = Record<string, unknown>;
+
+/*
+ * Generic-bridge helpers. Drizzle's builder generics only resolve for a
+ * concrete table type, so these helpers work on the abstract `PgTable` with
+ * untyped rows. Runtime correctness is guaranteed by the concrete table
+ * schema; the facade's public signatures below stay fully typed for callers.
+ */
+async function rawInsertReturning(db: Database, table: PgTable, values: object): Promise<RawRow[]> {
+  return db.insert(table).values(values).returning();
+}
+
+async function rawInsert(db: Database, table: PgTable, values: object): Promise<void> {
+  await db.insert(table).values(values);
+}
+
+async function rawSelect(db: Database, table: PgTable, condition: SQL): Promise<RawRow[]> {
+  return db.select().from(table).where(condition);
+}
+
+async function rawUpdate(db: Database, table: PgTable, values: object, condition: SQL): Promise<void> {
+  await db.update(table).set(values).where(condition);
+}
+
+async function rawDelete(db: Database, table: PgTable, condition: SQL): Promise<void> {
+  await db.delete(table).where(condition);
+}
+
+function tenantColumnOf(table: PgTable, tenantColumnKey: string): PgColumn {
+  const columns: Record<string, PgColumn> = getTableColumns(table);
+  const column = columns[tenantColumnKey];
+  if (column === undefined) {
+    throw new OgygieFailure(
+      ogygieError({
+        code: "TENANT_COLUMN_MISSING",
+        message: `Table has no tenant column with TS key "${tenantColumnKey}" — it cannot be accessed through tenantDb.`,
+        file: "packages/ogygie-core/src/tenant.ts",
+        cause: `getTableColumns() returned no column for key "${tenantColumnKey}"`,
+        suggestedFix:
+          "Add the tenant column to the table's Drizzle schema, or — for a genuinely shared table — declare it `shared: true` in the manifest and do not use tenantDb.",
+      }),
+      500,
+    );
+  }
+  return column;
+}
+
+/**
+ * Public contract of the tenant-scoped facade. Named (rather than inferred)
+ * because `transaction` hands the SAME contract back to its callback: the
+ * transactional facade offers exactly what the plain one does — including
+ * nested transactions (Postgres savepoints via drizzle).
+ */
+export interface TenantDb<Key extends string> {
+  insert<T extends PgTable>(table: T): {
+    values(values: Omit<InferInsertModel<T>, Key>): {
+      returning(): Promise<InferSelectModel<T>[]>;
+      execute(): Promise<void>;
+    };
+  };
+  select<T extends PgTable>(table: T): {
+    /** All rows of the tenant matching the extra condition (if any). */
+    where(condition?: SQL): Promise<InferSelectModel<T>[]>;
+    /** All rows of the tenant. */
+    all(): Promise<InferSelectModel<T>[]>;
+  };
+  update<T extends PgTable>(table: T): {
+    set(values: Partial<Omit<InferInsertModel<T>, Key>>): {
+      where(condition?: SQL): Promise<void>;
+    };
+  };
+  delete<T extends PgTable>(table: T): {
+    where(condition?: SQL): Promise<void>;
+  };
+  /**
+   * Runs `work` inside ONE database transaction: every write made through the
+   * callback's facade commits or rolls back together. The callback receives a
+   * facade with the same tenant guarantees (injection on insert, filtering on
+   * select/update/delete) — never a raw query builder. Born from a product
+   * review: multi-write decisions must be atomic, and repositories had no
+   * sanctioned way to get a transaction without touching the raw db.
+   */
+  transaction<R>(work: (transactionDb: TenantDb<Key>) => Promise<R>): Promise<R>;
+}
+
+/**
+ * Tenant-scoped facade over Drizzle. Deliberately minimal (insert/select/update/
+ * delete/transaction): repositories never see an unfiltered query builder. The
+ * tenant value always comes from ctx, never from the caller's values or
+ * conditions.
+ */
+export function tenantDb<Key extends string>(ctx: TenantContext<Key>): TenantDb<Key> {
+  return {
+    insert<T extends PgTable>(table: T) {
+      tenantColumnOf(table, ctx.tenantColumnKey);
+      return {
+        values(values: Omit<InferInsertModel<T>, Key>) {
+          const complete = {
+            ...values,
+            [ctx.tenantColumnKey]: ctx.tenantId,
+          };
+          return {
+            returning: async (): Promise<InferSelectModel<T>[]> => {
+              const rows = await rawInsertReturning(ctx.db, table, complete);
+              return rows as InferSelectModel<T>[];
+            },
+            execute: async (): Promise<void> => {
+              await rawInsert(ctx.db, table, complete);
+            },
+          };
+        },
+      };
+    },
+
+    select<T extends PgTable>(table: T) {
+      const tenantFilter = eq(tenantColumnOf(table, ctx.tenantColumnKey), ctx.tenantId);
+      return {
+        /** All rows of the tenant matching the extra condition (if any). */
+        where: async (condition?: SQL): Promise<InferSelectModel<T>[]> => {
+          const combined =
+            condition === undefined ? tenantFilter : and(tenantFilter, condition);
+          const rows = await rawSelect(ctx.db, table, combined ?? tenantFilter);
+          return rows as InferSelectModel<T>[];
+        },
+        /** All rows of the tenant. */
+        all: async (): Promise<InferSelectModel<T>[]> => {
+          const rows = await rawSelect(ctx.db, table, tenantFilter);
+          return rows as InferSelectModel<T>[];
+        },
+      };
+    },
+
+    update<T extends PgTable>(table: T) {
+      const tenantFilter = eq(tenantColumnOf(table, ctx.tenantColumnKey), ctx.tenantId);
+      return {
+        set(values: Partial<Omit<InferInsertModel<T>, Key>>) {
+          return {
+            where: async (condition?: SQL): Promise<void> => {
+              const combined =
+                condition === undefined ? tenantFilter : and(tenantFilter, condition);
+              await rawUpdate(ctx.db, table, values, combined ?? tenantFilter);
+            },
+          };
+        },
+      };
+    },
+
+    delete<T extends PgTable>(table: T) {
+      const tenantFilter = eq(tenantColumnOf(table, ctx.tenantColumnKey), ctx.tenantId);
+      return {
+        where: async (condition?: SQL): Promise<void> => {
+          const combined =
+            condition === undefined ? tenantFilter : and(tenantFilter, condition);
+          await rawDelete(ctx.db, table, combined ?? tenantFilter);
+        },
+      };
+    },
+
+    async transaction<R>(work: (transactionDb: TenantDb<Key>) => Promise<R>): Promise<R> {
+      return ctx.db.transaction(async (transactionScopedDb) => {
+        // Rebuilt field by field (not spread) so the type system proves the
+        // transactional context carries exactly the tenant contract.
+        const transactionCtx: TenantContext<Key> = {
+          tenantId: ctx.tenantId,
+          userId: ctx.userId,
+          tenantColumnKey: ctx.tenantColumnKey,
+          db: transactionScopedDb,
+        };
+        return work(tenantDb(transactionCtx));
+      });
+    },
+  };
+}

package/src/test-kit.ts

@@ -0,0 +1,30 @@
+/**
+ * @intent Test kit: in-memory Postgres (PGlite) + frozen clock. No network, no
+ * real DB — feature tests must pass in seconds (AGENTS.md principle 7).
+ * The core knows nothing about product tables: the product passes the content
+ * of its own migration files.
+ */
+import { PGlite } from "@electric-sql/pglite";
+import { drizzle } from "drizzle-orm/pglite";
+import type { Database } from "./db.js";
+
+export { fixedClock } from "./clock.js";
+
+export interface InMemoryDb {
+  db: Database;
+  /** Raw PGlite client, for SQL-level assertions in tests. */
+  raw: PGlite;
+  close(): Promise<void>;
+}
+
+/** Creates an in-memory Postgres and applies the given SQL migrations in order. */
+export async function createInMemoryDb(
+  migrationsSql: readonly string[],
+): Promise<InMemoryDb> {
+  const client = new PGlite();
+  for (const sql of migrationsSql) {
+    await client.exec(sql);
+  }
+  const db: Database = drizzle(client);
+  return { db, raw: client, close: () => client.close() };
+}

package/src/vocabulary.test.ts

@@ -0,0 +1,46 @@
+/**
+ * @intent Mutation tests of the vocabulary CHECKER itself (D22): the matching
+ * semantics — word start, case-insensitivity, hyphens, regex escaping — are
+ * what the whole gate rests on, so each one is proven with INVENTED stems.
+ * The real forbidden list, and the scan of the core's files against it, live
+ * in product-vocabulary.scan.test.ts (the only file allowed to write the
+ * forbidden words).
+ */
+import { describe, expect, it } from "vitest";
+import { findProductVocabulary } from "./vocabulary.js";
+
+describe("findProductVocabulary — sémantique du matching", () => {
+  it("détecte un stem en début de mot, jamais en plein milieu", () => {
+    expect(findProductVocabulary("the embedder policy", ["bed"])).toEqual([]);
+    expect(findProductVocabulary("const bedCount = 2;", ["bed"])).toEqual(["bed"]);
+  });
+
+  it("un stem attrape ses dérivés camelCase et ses pluriels", () => {
+    expect(findProductVocabulary("relayGadgets(gadgetId)", ["gadget"])).toEqual(["gadget"]);
+  });
+
+  it("insensible à la casse", () => {
+    expect(findProductVocabulary("import { Gadget } from x", ["gadget"])).toEqual(["gadget"]);
+  });
+
+  it("un tiret est un début de mot : un id kebab-case déclenche chacun de ses stems", () => {
+    expect(findProductVocabulary("the gadget-registry feature", ["gadget-registry", "registry"])).toEqual([
+      "gadget-registry",
+      "registry",
+    ]);
+  });
+
+  it("rend les stems dans l'ordre de la liste, une seule fois chacun", () => {
+    const source = "a gadget, another gadget, a widget";
+    expect(findProductVocabulary(source, ["widget", "gadget"])).toEqual(["widget", "gadget"]);
+  });
+
+  it("échappe les caractères spéciaux de regex dans les stems", () => {
+    expect(findProductVocabulary("uses c++ everywhere", ["c++"])).toEqual(["c++"]);
+    expect(findProductVocabulary("plain c here", ["c++"])).toEqual([]);
+  });
+
+  it("une source sans aucun stem interdit rend une liste vide", () => {
+    expect(findProductVocabulary("generic relay of manifest routes", ["gadget"])).toEqual([]);
+  });
+});

package/src/vocabulary.ts

@@ -0,0 +1,36 @@
+/**
+ * @intent Testable heart of the vocabulary gate (DECISIONS.md D10 rule 1: a
+ * framework module names NO product concept — no domain word, no product name,
+ * no feature id). Pure function — source text and stems in, findings out — so
+ * the scan test and the mutation tests required by D22 feed it directly.
+ * Extracted on its THIRD occurrence (rule of three, AGENTS.md §Workflow 5):
+ * the first two copies lived in the vocabulary tests of the manifest-derived
+ * gateway and client. The stems themselves are product configuration and do
+ * NOT live here: the caller owns its forbidden list.
+ */
+
+/**
+ * Every forbidden stem the source names, in the order of the given list —
+ * one entry per stem, however many times it appears.
+ *
+ * A stem matches case-insensitively at a WORD START (`(?<![\p{L}\p{N}])`),
+ * not as a bare substring: "embedder" must not trip on a stem "bed", but a
+ * camel-case usage like "tenantId" must trip on a stem "tenant". Hyphens are
+ * word starts too, so a kebab-case id is caught both as a full id and through
+ * every stem it contains.
+ */
+export function findProductVocabulary(
+  source: string,
+  forbiddenStems: readonly string[],
+): string[] {
+  const found: string[] = [];
+  for (const stem of forbiddenStems) {
+    // No "-" in this class: in unicode mode an escaped hyphen is itself an
+    // invalid escape, and a hyphen needs no escaping outside a class.
+    const escaped = stem.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (new RegExp(`(?<![\\p{L}\\p{N}])${escaped}`, "iu").test(source)) {
+      found.push(stem);
+    }
+  }
+  return found;
+}

package/src/web-lint.test.ts

@@ -0,0 +1,100 @@
+/**
+ * @intent Mutation tests of the web lint gate (D22): each KNOWN violation is
+ * proven detected, and each legitimate pattern is proven accepted.
+ */
+import { describe, expect, it } from "vitest";
+import {
+  findAbsoluteApiUrls,
+  findArbitraryTailwindValues,
+  findHardcodedJsxText,
+} from "./web-lint.js";
+
+describe("web-lint — chaînes en dur dans le JSX", () => {
+  it("MUTATION : un texte JSX hors <Trans> est détecté", () => {
+    const source = `export function Screen() { return <p>Ajoutez votre première entrée</p>; }`;
+    const violations = findHardcodedJsxText(source);
+    expect(violations).toHaveLength(1);
+    expect(violations[0]?.excerpt).toContain("Ajoutez");
+  });
+
+  it("un texte enveloppé dans <Trans> passe (fr est la locale source)", () => {
+    const source = `export function Screen() { return <p><Trans>Ajoutez votre première entrée</Trans></p>; }`;
+    expect(findHardcodedJsxText(source)).toHaveLength(0);
+  });
+
+  it("MUTATION : un texte dans un élément IMBRIQUÉ hors Trans est détecté même si un Trans existe ailleurs", () => {
+    const source = `export function Screen() {
+      return <div><Trans>Bonjour</Trans><span>texte oublié</span></div>;
+    }`;
+    const violations = findHardcodedJsxText(source);
+    expect(violations).toHaveLength(1);
+    expect(violations[0]?.excerpt).toBe("texte oublié");
+  });
+
+  it("l'échappement délibéré {\"Acme\"} (donnée non traduisible) passe", () => {
+    const source = `export function Logo() { return <div>{"Acme"}</div>; }`;
+    expect(findHardcodedJsxText(source)).toHaveLength(0);
+  });
+
+  it("une expression dynamique ({order.code}) passe — c'est une donnée", () => {
+    const source = `export function Cell({ order }: { order: { code: string } }) { return <td>{order.code}</td>; }`;
+    expect(findHardcodedJsxText(source)).toHaveLength(0);
+  });
+
+  it("MUTATION : un attribut placeholder en dur est détecté", () => {
+    const source = `export function Field() { return <input placeholder="Votre email" />; }`;
+    const violations = findHardcodedJsxText(source);
+    expect(violations).toHaveLength(1);
+    expect(violations[0]?.rule).toContain("placeholder");
+  });
+
+  it("un attribut machine (className, id) n'est jamais flaggé", () => {
+    const source = `export function Box() { return <div className="flex items-center" id="racine-app" />; }`;
+    expect(findHardcodedJsxText(source)).toHaveLength(0);
+  });
+});
+
+describe("web-lint — valeurs Tailwind arbitraires", () => {
+  it("MUTATION : p-[13px] dans une className est détecté", () => {
+    const source = `export function Box() { return <div className="p-[13px] flex" />; }`;
+    const violations = findArbitraryTailwindValues(source);
+    expect(violations).toHaveLength(1);
+    expect(violations[0]?.excerpt).toBe("p-[13px]");
+  });
+
+  it("MUTATION : une valeur arbitraire dans un template literal est détectée", () => {
+    const source = "export function Box({ active }: { active: boolean }) { return <div className={`flex ${active ? \"text-[#ff0000]\" : \"text-text\"}`} />; }";
+    const violations = findArbitraryTailwindValues(source);
+    expect(violations).toHaveLength(1);
+    expect(violations[0]?.excerpt).toBe("text-[#ff0000]");
+  });
+
+  it("des utilitaires thémés (tokens) passent", () => {
+    const source = `export function Box() { return <div className="p-4 rounded-md bg-surface text-text-secondary tabular-nums" />; }`;
+    expect(findArbitraryTailwindValues(source)).toHaveLength(0);
+  });
+});
+
+describe("web-lint — URL absolue d'API (D27)", () => {
+  it("MUTATION : un fetch sur une URL absolue vers /api est détecté", () => {
+    const source = `export function useOrders() { return fetch("http://localhost:3000/api/orders"); }`;
+    const violations = findAbsoluteApiUrls(source);
+    expect(violations).toHaveLength(1);
+    expect(violations[0]?.excerpt).toContain("http://localhost:3000/api");
+  });
+
+  it("MUTATION : une URL absolue https dans un template literal est détectée", () => {
+    const source = "const base = `https://api.acme.example/api/${resource}`;";
+    expect(findAbsoluteApiUrls(source)).toHaveLength(1);
+  });
+
+  it("un appel relatif /api/... passe (la règle même de D27)", () => {
+    const source = `export function useOrders() { return fetch("/api/orders"); }`;
+    expect(findAbsoluteApiUrls(source)).toHaveLength(0);
+  });
+
+  it("une URL absolue SANS segment /api passe (lien documentaire légitime)", () => {
+    const source = `const docs = "https://example.com/api-reference-guide";`;
+    expect(findAbsoluteApiUrls(source)).toHaveLength(0);
+  });
+});

package/src/web-lint.ts

@@ -0,0 +1,176 @@
+/**
+ * @intent Testable logic of the front part of the `pnpm lint` gate (the web
+ * shell spec's §Périmètre: "hardcoded string in JSX" and "arbitrary Tailwind
+ * value" both break the CI — D22: born with its mutation tests in
+ * web-lint.test.ts). Built on the TypeScript AST (not regexes): JSX text is
+ * only legitimate inside a <Trans> element (Lingui macro — fr is the source
+ * locale, so the French text IS the ICU source message), and human-facing
+ * attributes must go through the t`` macro.
+ * Deliberate escape hatch, documented: a string EXPRESSION ({"Acme"}) is not
+ * flagged — it marks non-translatable data (brand names, endonyms) on purpose.
+ */
+import ts from "typescript";
+
+export interface WebLintViolation {
+  line: number;
+  rule: string;
+  excerpt: string;
+}
+
+/** Attributes read by humans; everything else (className, id, to…) is machine-facing. */
+const HUMAN_FACING_ATTRIBUTES = new Set(["placeholder", "title", "alt", "aria-label"]);
+
+/** Two letters or more (any script) = a word a human will read. */
+const HUMAN_TEXT = /\p{L}{2}/u;
+
+/** Tailwind arbitrary value: `p-[13px]`, `text-[#0f0]`… (banned — tokens only). */
+const ARBITRARY_TAILWIND_VALUE = /[\w-]+-\[[^\]\s]+\]/;
+
+/** Absolute URL whose path enters /api — the front must never know the API
+ * origin (D27, AGENTS.md §Sécurité 8): it calls `/api/...` relatively. */
+const ABSOLUTE_API_URL = /https?:\/\/[^\s"'`]*\/api([/?#]|$)/;
+
+function lineOf(sourceFile: ts.SourceFile, node: ts.Node): number {
+  return sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+}
+
+function isInsideTransElement(node: ts.Node): boolean {
+  let current: ts.Node | undefined = node.parent;
+  while (current !== undefined) {
+    if (ts.isJsxElement(current)) {
+      const tagName = current.openingElement.tagName.getText();
+      if (tagName === "Trans") return true;
+    }
+    current = current.parent;
+  }
+  return false;
+}
+
+/** JSX text nodes (and human-facing string attributes) outside <Trans>. */
+export function findHardcodedJsxText(source: string, fileName = "file.tsx"): WebLintViolation[] {
+  const sourceFile = ts.createSourceFile(
+    fileName,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TSX,
+  );
+  const violations: WebLintViolation[] = [];
+
+  function visit(node: ts.Node): void {
+    if (ts.isJsxText(node) && HUMAN_TEXT.test(node.text) && !isInsideTransElement(node)) {
+      violations.push({
+        line: lineOf(sourceFile, node),
+        rule: "hardcoded JSX text — wrap in <Trans> (Lingui) or move to data ({\"…\"} for brand names)",
+        excerpt: node.text.trim().slice(0, 60),
+      });
+    }
+    if (
+      ts.isJsxAttribute(node) &&
+      HUMAN_FACING_ATTRIBUTES.has(node.name.getText()) &&
+      node.initializer !== undefined &&
+      ts.isStringLiteral(node.initializer) &&
+      HUMAN_TEXT.test(node.initializer.text)
+    ) {
+      violations.push({
+        line: lineOf(sourceFile, node),
+        rule: `hardcoded ${node.name.getText()} attribute — use the t\`\` macro (Lingui)`,
+        excerpt: node.initializer.text.slice(0, 60),
+      });
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(sourceFile);
+  return violations;
+}
+
+/** Absolute API URLs in any string or template literal (D27: `/api` stays
+ * relative — an absolute URL would tie the front to an API origin the
+ * gateway exists to hide). Scans .ts AND .tsx: data-access files are where
+ * such URLs appear first. */
+export function findAbsoluteApiUrls(source: string, fileName = "file.ts"): WebLintViolation[] {
+  const sourceFile = ts.createSourceFile(
+    fileName,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    fileName.endsWith(".tsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS,
+  );
+  const violations: WebLintViolation[] = [];
+
+  function visit(node: ts.Node): void {
+    if (
+      ts.isStringLiteral(node) ||
+      ts.isNoSubstitutionTemplateLiteral(node) ||
+      ts.isTemplateHead(node) ||
+      ts.isTemplateMiddle(node) ||
+      ts.isTemplateTail(node)
+    ) {
+      const match = ABSOLUTE_API_URL.exec(node.text);
+      if (match !== null) {
+        violations.push({
+          line: lineOf(sourceFile, node),
+          rule: "absolute API URL — the front calls /api/... RELATIVELY, it must not know the API origin (D27)",
+          excerpt: match[0].slice(0, 60),
+        });
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(sourceFile);
+  return violations;
+}
+
+/** Arbitrary Tailwind values in className strings/templates (tokens.json only). */
+export function findArbitraryTailwindValues(
+  source: string,
+  fileName = "file.tsx",
+): WebLintViolation[] {
+  const sourceFile = ts.createSourceFile(
+    fileName,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TSX,
+  );
+  const violations: WebLintViolation[] = [];
+
+  function checkText(text: string, node: ts.Node): void {
+    const match = ARBITRARY_TAILWIND_VALUE.exec(text);
+    if (match !== null) {
+      violations.push({
+        line: lineOf(sourceFile, node),
+        rule: "arbitrary Tailwind value — use a token from design/tokens.json (generated theme)",
+        excerpt: match[0],
+      });
+    }
+  }
+
+  function visit(node: ts.Node): void {
+    if (ts.isJsxAttribute(node) && node.name.getText() === "className" && node.initializer !== undefined) {
+      const initializer = node.initializer;
+      if (ts.isStringLiteral(initializer)) {
+        checkText(initializer.text, initializer);
+      } else if (ts.isJsxExpression(initializer) && initializer.expression !== undefined) {
+        // Covers template literals and conditional class expressions: every
+        // string-ish literal below the className expression is checked.
+        const scanLiterals = (expressionNode: ts.Node): void => {
+          if (
+            ts.isStringLiteral(expressionNode) ||
+            ts.isNoSubstitutionTemplateLiteral(expressionNode) ||
+            ts.isTemplateHead(expressionNode) ||
+            ts.isTemplateMiddle(expressionNode) ||
+            ts.isTemplateTail(expressionNode)
+          ) {
+            checkText(expressionNode.text, expressionNode);
+          }
+          ts.forEachChild(expressionNode, scanLiterals);
+        };
+        scanLiterals(initializer.expression);
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(sourceFile);
+  return violations;
+}