@rdjperron/lint 0.7.0 → 0.8.0

package/dist/index.mjs

@@ -1,4 +1,5 @@
 import { defineRule, eslintCompatPlugin } from "@oxlint/plugins";
+import { existsSync } from "node:fs";
 //#region src/anti-slop/shared/array-method.ts
 /** Unwrap syntax-only wrappers when inspecting array methods and accumulator references. */
 function unwrapArrayExpression(node) {
@@ -633,7 +634,7 @@ function functionParameterBindingName(parameter, sourceCode) {
 //#endregion
 //#region src/anti-slop/shared/scope.ts
 /** Resolve an identifier to its binding by walking lexical scopes upward. */
-function resolveVariable(sourceCode, identifier) {
+function resolveVariable$1(sourceCode, identifier) {
 	let scope = sourceCode.getScope(identifier);
 	while (scope !== null) {
 		const variable = scope.set.get(identifier.name);
@@ -661,7 +662,7 @@ function hasKnownEvidence(sourceCode, expression, visitedVariables = /* @__PURE_
 	if (isKnownEvidenceExpression(expression)) return true;
 	const unwrapped = unwrapExpression(expression);
 	if (unwrapped.type !== "Identifier") return false;
-	const variable = resolveVariable(sourceCode, unwrapped);
+	const variable = resolveVariable$1(sourceCode, unwrapped);
 	if (variable === null || visitedVariables.has(variable)) return false;
 	const declarator = variableDeclarator$1(variable);
 	if (declarator === null || declarator.init === null || !isStableConstVariable(variable, declarator)) return false;
@@ -675,7 +676,7 @@ function localFunctionForCall(sourceCode, callee) {
 	const unwrapped = unwrapExpression(callee);
 	if (isFunctionExpression(unwrapped)) return unwrapped;
 	if (unwrapped.type !== "Identifier") return null;
-	const variable = resolveVariable(sourceCode, unwrapped);
+	const variable = resolveVariable$1(sourceCode, unwrapped);
 	if (variable === null || variable.defs.length !== 1) return null;
 	const [definition] = variable.defs;
 	if (definition === void 0) return null;
@@ -707,7 +708,7 @@ function hasKnownCallArgumentEvidence(sourceCode, expression, environment, visit
 		return returnType !== void 0 && hasInformativeType(returnType, environment);
 	}
 	if (expression.type !== "Identifier") return isKnownEvidenceExpression(expression);
-	const variable = resolveVariable(sourceCode, expression);
+	const variable = resolveVariable$1(sourceCode, expression);
 	if (variable === null || visitedVariables.has(variable)) return false;
 	const annotation = variableTypeAnnotation(sourceCode, variable);
 	if (annotation !== null) return hasInformativeType(annotation.typeAnnotation, environment);
@@ -798,7 +799,7 @@ const noKnownValueWideningRule = defineRule({
 			},
 			AssignmentExpression(node) {
 				if (node.operator !== "=" || node.left.type !== "Identifier") return;
-				const variable = resolveVariable(context.sourceCode, node.left);
+				const variable = resolveVariable$1(context.sourceCode, node.left);
 				if (variable === null) return;
 				const declarator = variableDeclarator$1(variable);
 				if (declarator === null || declarator.id.type !== "Identifier") return;
@@ -859,7 +860,7 @@ function importedName$1(node) {
 function isTestFrameworkObject(sourceCode, expression) {
 	if (expression.type !== "Identifier") return false;
 	if ((expression.name === "vi" || expression.name === "jest") && sourceCode.isGlobalReference(expression)) return true;
-	const variable = resolveVariable(sourceCode, expression);
+	const variable = resolveVariable$1(sourceCode, expression);
 	if (variable === null || variable.defs.length === 0) return expression.name === "vi" || expression.name === "jest";
 	return variable.defs.some((definition) => {
 		if (definition.type !== "ImportBinding" || definition.parent?.type !== "ImportDeclaration") return false;
@@ -1025,7 +1026,7 @@ const noReduceAccumulatorCopyRule = defineRule({
 function isGlobalReflect(sourceCode, expression) {
 	if (expression.type !== "Identifier" || expression.name !== "Reflect") return false;
 	if (sourceCode.isGlobalReference(expression)) return true;
-	const variable = resolveVariable(sourceCode, expression);
+	const variable = resolveVariable$1(sourceCode, expression);
 	return variable === null || variable.defs.length === 0;
 }
 /** Reports whether a call target names one method on the global Reflect object. */
@@ -1699,6 +1700,356 @@ const requireSafetyCommentForTypeAssertionRule = defineRule({
 	}
 });
 //#endregion
+//#region src/shared/convex.ts
+const PUBLIC_REGISTRARS = /* @__PURE__ */ new Set([
+	"query",
+	"mutation",
+	"action"
+]);
+const REGISTRARS = /* @__PURE__ */ new Set([
+	...PUBLIC_REGISTRARS,
+	"internalQuery",
+	"internalMutation",
+	"internalAction"
+]);
+const PUBLIC_GENERICS = /* @__PURE__ */ new Set([
+	"queryGeneric",
+	"mutationGeneric",
+	"actionGeneric"
+]);
+const GENERICS = /* @__PURE__ */ new Set([
+	...PUBLIC_GENERICS,
+	"internalQueryGeneric",
+	"internalMutationGeneric",
+	"internalActionGeneric"
+]);
+const IDENTITY_READERS = /* @__PURE__ */ new Set(["getAuthUserId", "getAuthSessionId"]);
+const SOURCE_EXTENSION = /\.(?:[cm]?[jt]sx?)$/u;
+function slashes(path) {
+	return path.replaceAll("\\", "/");
+}
+function isAbsolute(path) {
+	return path.startsWith("/") || /^[A-Za-z]:\//u.test(path);
+}
+function normalize(path) {
+	const out = [];
+	for (const segment of slashes(path).split("/")) {
+		if (segment === "." || segment === "" && out.length > 0) continue;
+		if (segment === ".." && out.length > 0 && out.at(-1) !== ".." && out.at(-1) !== "") {
+			out.pop();
+			continue;
+		}
+		out.push(segment);
+	}
+	return out.join("/");
+}
+function withoutExtension(path) {
+	return path.replace(SOURCE_EXTENSION, "");
+}
+const TYPESCRIPT_SOURCE = /* @__PURE__ */ new Map([
+	[".js", [".ts", ".tsx"]],
+	[".jsx", [".tsx"]],
+	[".mjs", [".mts"]],
+	[".cjs", [".cts"]]
+]);
+/** The file itself, its spelling with no extension, or the `.js` spelling of a `.ts` file. */
+function resolvesTo(target, file) {
+	if (target === file || target === withoutExtension(file)) return true;
+	const extension = /\.[cm]?jsx?$/u.exec(target)?.[0];
+	if (extension === void 0) return false;
+	const stem = target.slice(0, -extension.length);
+	return (TYPESCRIPT_SOURCE.get(extension) ?? []).some((source) => `${stem}${source}` === file);
+}
+function directoryOf(path) {
+	return path.slice(0, path.lastIndexOf("/"));
+}
+const placed = /* @__PURE__ */ new Map();
+/**
+* oxlint gives a rule the process's working directory, not the config's, so a relative wrapper
+* is looked for from there upward and the first directory that holds it is the root. Found
+* nowhere, it is taken from the working directory as written. An absolute one is used as is.
+*/
+function placeWrapper(cwd, option, imports) {
+	const key = `${cwd}\0${option}\0${imports.join("\0")}`;
+	const known = placed.get(key);
+	if (known !== void 0) return known;
+	const written = normalize(option);
+	let file = written;
+	if (!isAbsolute(written)) {
+		let root = normalize(cwd);
+		file = `${root}/${written}`;
+		while (root !== "" && root.includes("/")) {
+			if (existsSync(`${root}/${written}`)) {
+				file = `${root}/${written}`;
+				break;
+			}
+			root = directoryOf(root);
+		}
+	}
+	const wrapper = {
+		file,
+		imports: new Set(imports)
+	};
+	placed.set(key, wrapper);
+	return wrapper;
+}
+/** Another backend's file with the same path tail is not the wrapper. */
+function isWrapperFile(filename, wrapper) {
+	return normalize(filename) === wrapper.file;
+}
+/**
+* A relative specifier reaches the wrapper only by resolving to its file; `/index` is not
+* collapsed, so a sibling `functions/index.ts` stays a different module. Any other spelling is an
+* alias from a bundler or tsconfig this rule cannot read, so it names the wrapper only when the
+* config lists it as written, and nothing about it depends on where `vp lint` runs.
+*/
+function moduleOf(filename, specifier, wrapper) {
+	if (specifier === "convex/server") return "convexServer";
+	if (specifier === "@convex-dev/auth/server") return "authLibrary";
+	const relative = specifier.startsWith("./") || specifier.startsWith("../");
+	const target = normalize(relative ? `${directoryOf(slashes(filename))}/${specifier}` : specifier);
+	const module = withoutExtension(target);
+	if (module === "_generated/server" || module.endsWith("/_generated/server")) return "generated";
+	if (wrapper === void 0) return null;
+	if (relative) return resolvesTo(target, wrapper.file) ? "wrapper" : null;
+	return wrapper.imports.has(specifier) ? "wrapper" : null;
+}
+function isGenerated(filename) {
+	return slashes(filename).includes("/_generated/");
+}
+function unwrapTypeScript(node) {
+	let current = node;
+	while (current.type === "TSAsExpression" || current.type === "TSSatisfiesExpression" || current.type === "TSNonNullExpression" || current.type === "TSTypeAssertion" || current.type === "TSInstantiationExpression" || current.type === "ParenthesizedExpression") current = current.expression;
+	return current;
+}
+function exportName(name) {
+	return name.type === "Literal" ? name.value : name.name;
+}
+function keyName(key, computed) {
+	if (key.type === "Identifier" && !computed) return key.name;
+	if (key.type === "Literal" && typeof key.value === "string") return key.value;
+	return null;
+}
+function resolveVariable(sourceCode, identifier) {
+	let scope = sourceCode.getScope(identifier);
+	for (;;) {
+		const variable = scope.set.get(identifier.name);
+		if (variable !== void 0) return variable;
+		if (scope.upper === null) return null;
+		scope = scope.upper;
+	}
+}
+function staticString(node) {
+	if (node.type === "Literal") return typeof node.value === "string" ? node.value : null;
+	if (node.type === "TemplateLiteral" && node.expressions.length === 0) return node.quasis[0]?.value.cooked ?? null;
+	return null;
+}
+function buildsFunction(origin, withHttp) {
+	if (origin === null || origin.name === null) return false;
+	switch (origin.module) {
+		case "generated":
+		case "global": return REGISTRARS.has(origin.name) || withHttp && origin.name === "httpAction";
+		case "convexServer": return GENERICS.has(origin.name) || withHttp && origin.name === "httpActionGeneric";
+		case "wrapper": return origin.name !== "httpAction" || withHttp;
+		default: return false;
+	}
+}
+/**
+* Where a value is not definitely known it is unknown, and the rules report nothing on it rather
+* than guess. Cycles are guarded per path, so an object met twice is read twice.
+*/
+function analyse(sourceCode, filename, wrapper) {
+	const active = /* @__PURE__ */ new Set();
+	const guarded = (node, fallback, run) => {
+		if (active.has(node)) return fallback;
+		active.add(node);
+		try {
+			return run();
+		} finally {
+			active.delete(node);
+		}
+	};
+	const constDeclarator = (variable) => {
+		const definition = variable?.defs.length === 1 ? variable.defs[0] : void 0;
+		if (definition?.type !== "Variable") return null;
+		const declarator = definition.node;
+		const declaration = definition.parent;
+		if (declarator.type !== "VariableDeclarator" || declarator.init === null) return null;
+		return declaration?.type === "VariableDeclaration" && declaration.kind === "const" ? declarator : null;
+	};
+	const staticValue = (node) => {
+		const value = unwrapTypeScript(node);
+		if (value.type === "ObjectExpression" || value.type === "FunctionExpression" || value.type === "ArrowFunctionExpression") return value;
+		if (value.type !== "Identifier") return null;
+		const variable = resolveVariable(sourceCode, value);
+		const definition = variable?.defs.length === 1 ? variable.defs[0] : void 0;
+		if (definition?.type === "FunctionName" && definition.node.type === "FunctionDeclaration") return definition.node;
+		const declarator = constDeclarator(variable);
+		if (declarator?.id.type !== "Identifier" || declarator.init === null) return null;
+		const { init } = declarator;
+		return guarded(declarator, null, () => staticValue(init));
+	};
+	const namespaceMember = (whole, key) => whole?.name === null && whole.excluded?.has(key) !== true ? {
+		module: whole.module,
+		name: key
+	} : null;
+	const memberOf = (object, key) => guarded(object, { kind: "unknown" }, () => {
+		let found = { kind: "absent" };
+		for (const property of object.properties) {
+			if (property.type === "SpreadElement") {
+				const spread = staticValue(property.argument);
+				if (spread?.type === "ObjectExpression") {
+					const inner = memberOf(spread, key);
+					if (inner.kind !== "absent") found = inner;
+					continue;
+				}
+				const origin = namespaceMember(originOf(property.argument), key);
+				found = origin === null ? { kind: "unknown" } : {
+					kind: "origin",
+					origin
+				};
+				continue;
+			}
+			const name = keyName(property.key, property.computed);
+			if (name === key) found = {
+				kind: "value",
+				value: property.value
+			};
+			else if (name === null) found = { kind: "unknown" };
+		}
+		return found;
+	});
+	const memberOrigin = (base, key) => {
+		const object = staticValue(base);
+		if (object?.type === "ObjectExpression") {
+			const member = memberOf(object, key);
+			if (member.kind === "origin") return member.origin;
+			return member.kind === "value" ? originOf(member.value) : null;
+		}
+		return namespaceMember(originOf(base), key);
+	};
+	const fromBinding = (variable, name) => {
+		const definition = variable.defs.length === 1 ? variable.defs[0] : void 0;
+		if (definition?.type === "ImportBinding") {
+			const declaration = definition.parent;
+			if (declaration?.type !== "ImportDeclaration" || declaration.importKind === "type") return null;
+			const module = moduleOf(filename, declaration.source.value, wrapper);
+			const specifier = definition.node;
+			if (module === null) return null;
+			if (specifier.type === "ImportNamespaceSpecifier") return {
+				module,
+				name: null
+			};
+			if (specifier.type === "ImportDefaultSpecifier") return {
+				module,
+				name: "default"
+			};
+			if (specifier.type !== "ImportSpecifier" || specifier.importKind === "type") return null;
+			return {
+				module,
+				name: exportName(specifier.imported)
+			};
+		}
+		const declarator = constDeclarator(variable);
+		if (declarator === null || declarator.init === null) return null;
+		const { id, init } = declarator;
+		if (id.type === "Identifier") return originOf(init);
+		if (id.type !== "ObjectPattern") return null;
+		const holder = (name.parent?.type === "AssignmentPattern" ? name.parent : name).parent;
+		if (holder?.type === "RestElement" && holder.parent === id) {
+			const whole = originOf(init);
+			if (whole?.name !== null || whole === null) return null;
+			const taken = new Set(whole.excluded);
+			for (const property of id.properties) {
+				if (property.type !== "Property") continue;
+				const key = keyName(property.key, property.computed);
+				if (key === null) return null;
+				taken.add(key);
+			}
+			return {
+				module: whole.module,
+				name: null,
+				excluded: taken
+			};
+		}
+		if (holder?.type !== "Property" || holder.parent !== id) return null;
+		const key = keyName(holder.key, holder.computed);
+		return key === null ? null : memberOrigin(init, key);
+	};
+	const originOf = (node) => {
+		const expression = unwrapTypeScript(node);
+		return guarded(expression, null, () => {
+			if (expression.type === "Identifier") {
+				const variable = resolveVariable(sourceCode, expression);
+				if (variable === null || variable.defs.length === 0) return {
+					module: "global",
+					name: expression.name
+				};
+				return fromBinding(variable, variable.defs[0]?.name ?? expression);
+			}
+			if (expression.type === "MemberExpression") {
+				const key = keyName(expression.property, expression.computed);
+				return key === null ? null : memberOrigin(expression.object, key);
+			}
+			if (expression.type === "AwaitExpression") {
+				const imported = unwrapTypeScript(expression.argument);
+				if (imported.type !== "ImportExpression") return null;
+				const specifier = staticString(imported.source);
+				const module = specifier === null ? null : moduleOf(filename, specifier, wrapper);
+				return module === null ? null : {
+					module,
+					name: null
+				};
+			}
+			return null;
+		});
+	};
+	const directWrites = (variable) => variable.references.flatMap((reference) => {
+		const written = reference.writeExpr;
+		const { parent } = reference.identifier;
+		if (written === null || !reference.isWrite()) return [];
+		return parent?.type === "VariableDeclarator" && parent.id === reference.identifier || parent?.type === "AssignmentExpression" && parent.left === reference.identifier ? [unwrapTypeScript(written)] : [];
+	});
+	const variableValues = (variable) => {
+		const definition = variable.defs[0];
+		if (definition?.type !== "Variable") return [];
+		return guarded(definition.name, [], () => directWrites(variable).flatMap((value) => {
+			if (value.type !== "Identifier") return [value];
+			const source = resolveVariable(sourceCode, value);
+			const writes = source?.references.filter((reference) => reference.isWrite()) ?? [];
+			return source !== null && writes.length === 1 ? variableValues(source) : [];
+		}));
+	};
+	const valuesOf = (identifier) => {
+		const variable = resolveVariable(sourceCode, identifier);
+		return variable === null ? [] : variableValues(variable);
+	};
+	const isUndefined = (node) => {
+		const value = unwrapTypeScript(node);
+		if (value.type === "UnaryExpression") return value.operator === "void";
+		if (value.type !== "Identifier") return false;
+		const variable = resolveVariable(sourceCode, value);
+		if (variable === null || variable.defs.length === 0) return value.name === "undefined";
+		const declarator = constDeclarator(variable);
+		if (declarator?.id.type !== "Identifier" || declarator.init === null) return false;
+		const { init } = declarator;
+		return guarded(declarator, false, () => isUndefined(init));
+	};
+	return {
+		originOf,
+		memberOf,
+		staticValue,
+		valuesOf,
+		variableValues,
+		isUndefined
+	};
+}
+function definitionOf(analysis, call) {
+	const [first] = call.arguments;
+	if (first === void 0 || first.type === "SpreadElement") return null;
+	return analysis.staticValue(first);
+}
+//#endregion
 //#region src/shared/rule-options.ts
 /**
 * Rule options arrive as parsed JSON from the linter config, so this is the one
@@ -1713,6 +2064,337 @@ function stringOption(options, key) {
 	const value = firstOptionObject(options)[key];
 	return typeof value === "string" ? value : void 0;
 }
+/** A boolean-valued key of the first option object, or undefined when absent or not a boolean. */
+function booleanOption(options, key) {
+	const value = firstOptionObject(options)[key];
+	return typeof value === "boolean" ? value : void 0;
+}
+/** A string-array key of the first option object; anything else reads as empty. */
+function stringsOption(options, key) {
+	const value = firstOptionObject(options)[key];
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+//#endregion
+//#region src/rules/convex-checked-constructors.ts
+const CONTEXT_NAME = "ctx";
+function bannedAs(origin) {
+	if (origin === null || origin.name === null) return null;
+	if (origin.module === "generated" && PUBLIC_REGISTRARS.has(origin.name)) return "rawConstructor";
+	if (origin.module === "convexServer" && PUBLIC_GENERICS.has(origin.name)) return "rawConstructor";
+	if (origin.module === "authLibrary" && IDENTITY_READERS.has(origin.name)) return "identityReader";
+	return null;
+}
+function holdsBanned(module) {
+	return module === "generated" || module === "convexServer" || module === "authLibrary";
+}
+function copiesBanned(module, taken) {
+	return [...module === "generated" ? PUBLIC_REGISTRARS : module === "convexServer" ? PUBLIC_GENERICS : module === "authLibrary" ? IDENTITY_READERS : /* @__PURE__ */ new Set()].some((name) => !taken.has(name));
+}
+function authProperty(pattern) {
+	const target = pattern.type === "AssignmentPattern" ? pattern.left : pattern;
+	if (target.type !== "ObjectPattern") return null;
+	for (const property of target.properties) if (property.type === "Property" && keyName(property.key, property.computed) === "auth") return property;
+	return null;
+}
+function outermost(identifier) {
+	let value = identifier;
+	let parent = identifier.parent;
+	while (parent !== null && (parent.type === "TSAsExpression" || parent.type === "TSSatisfiesExpression" || parent.type === "TSNonNullExpression" || parent.type === "TSTypeAssertion" || parent.type === "ParenthesizedExpression")) {
+		value = parent;
+		parent = parent.parent;
+	}
+	return {
+		value,
+		parent
+	};
+}
+/** Reject the raw public constructors and every read of the caller outside the wrapper. */
+const convexCheckedConstructorsRule = defineRule({
+	meta: {
+		type: "problem",
+		docs: { description: "Build public Convex functions with the project's checked constructors, and read the caller only where they are defined." },
+		messages: {
+			rawConstructor: "`{{name}}` from {{source}} builds a public function whose handler runs before anything checks the caller. Build it with one of the project's checked constructors.{{advice}}",
+			identityReader: "`{{name}}` reads the caller's identity, which the checked constructors resolve before the handler runs. Take the caller from the context the constructor hands the handler.{{advice}}",
+			reExportAll: "`export *` from {{source}} hands on what only the module building the checked constructors may use. Export the names you mean, one by one.{{advice}}",
+			namespaceCopy: "Copying every export of {{source}} hands on what only the module building the checked constructors may use. Take the names you mean, one by one.{{advice}}",
+			authRead: "Reading `auth` off a Convex context goes around the checked constructors, which resolve the caller before the handler runs. Take the caller from the context the constructor hands the handler.{{advice}}"
+		},
+		schema: [{
+			type: "object",
+			properties: {
+				wrapper: { type: "string" },
+				wrapperImports: {
+					type: "array",
+					items: { type: "string" }
+				},
+				hint: { type: "string" }
+			},
+			additionalProperties: false
+		}]
+	},
+	create(context) {
+		const { filename, sourceCode } = context;
+		if (isGenerated(filename)) return {};
+		const option = stringOption(context.options, "wrapper");
+		const wrapper = option === void 0 ? void 0 : placeWrapper(context.cwd, option, stringsOption(context.options, "wrapperImports"));
+		if (wrapper !== void 0 && isWrapperFile(filename, wrapper)) return {};
+		const hint = stringOption(context.options, "hint");
+		const advice = [option === void 0 ? "" : ` The checked constructors are in ${option}.`, hint === void 0 ? "" : ` ${hint}`].join("");
+		const analysis = analyse(sourceCode, filename, wrapper);
+		const origin = (node) => analysis.originOf(node);
+		const reported = /* @__PURE__ */ new Set();
+		const report = (node, messageId, data = {}) => {
+			if (reported.has(node)) return;
+			reported.add(node);
+			context.report({
+				node,
+				messageId,
+				data: {
+					...data,
+					advice
+				}
+			});
+		};
+		const reportBanned = (node, found, source) => {
+			const messageId = bannedAs(found);
+			if (messageId !== null && found?.name !== null && found !== null) report(node, messageId, {
+				name: found.name,
+				source
+			});
+		};
+		const sourceOf = (namespace) => sourceCode.getText(namespace);
+		const checkPattern = (pattern, init) => {
+			if (pattern.type !== "ObjectPattern") return;
+			const object = analysis.staticValue(init);
+			const whole = origin(init);
+			const taken = new Set(whole?.excluded);
+			for (const property of pattern.properties) {
+				if (property.type !== "Property") continue;
+				const name = keyName(property.key, property.computed);
+				if (name === null) continue;
+				taken.add(name);
+				if (object?.type === "ObjectExpression") {
+					const member = analysis.memberOf(object, name);
+					if (member.kind === "origin") reportBanned(property, member.origin, sourceOf(init));
+					if (member.kind === "value") reportBanned(property, origin(member.value), sourceOf(init));
+				} else if (whole?.name === null && whole.excluded?.has(name) !== true) reportBanned(property, {
+					module: whole.module,
+					name
+				}, sourceOf(init));
+			}
+			const rest = pattern.properties.find((property) => property.type === "RestElement");
+			if (rest !== void 0 && whole?.name === null && copiesBanned(whole.module, taken)) report(rest, "namespaceCopy", { source: sourceOf(init) });
+		};
+		const walked = /* @__PURE__ */ new Set();
+		const walkReferences = (references) => {
+			for (const reference of references) {
+				const { value, parent } = outermost(reference.identifier);
+				if (parent === null) continue;
+				if (parent.type === "MemberExpression" && parent.object === value) {
+					if (keyName(parent.property, parent.computed) === "auth") report(parent, "authRead");
+					continue;
+				}
+				if (parent.type === "VariableDeclarator" && parent.init === value) {
+					const taken = authProperty(parent.id);
+					if (taken !== null) report(taken, "authRead");
+					const declaration = parent.parent;
+					if (parent.id.type === "Identifier" && declaration.type === "VariableDeclaration" && declaration.kind === "const") for (const alias of sourceCode.getDeclaredVariables(parent)) walkContext(alias);
+					continue;
+				}
+				if (parent.type === "AssignmentExpression" && parent.right === value) {
+					const taken = authProperty(parent.left);
+					if (taken !== null) report(taken, "authRead");
+				}
+			}
+		};
+		const walkContext = (variable) => {
+			if (walked.has(variable)) return;
+			walked.add(variable);
+			walkReferences(variable.references);
+		};
+		const walkHandler = (handler) => {
+			const [first] = handler.params;
+			if (first === void 0 || first.type === "TSParameterProperty") return;
+			if (first.type === "RestElement") return;
+			const taken = authProperty(first);
+			if (taken !== null) report(taken, "authRead");
+			const binding = first.type === "AssignmentPattern" ? first.left : first;
+			if (binding.type !== "Identifier") return;
+			const variable = sourceCode.getDeclaredVariables(handler).find((candidate) => candidate.name === binding.name);
+			if (variable !== void 0) walkContext(variable);
+		};
+		return {
+			Program() {
+				for (const scope of sourceCode.scopeManager.scopes) {
+					const variable = scope.set.get(CONTEXT_NAME);
+					if (variable?.defs[0]?.type === "Parameter") walkContext(variable);
+				}
+			},
+			ImportDeclaration(node) {
+				if (node.importKind === "type") return;
+				const source = node.source.value;
+				for (const specifier of node.specifiers) {
+					if (specifier.type !== "ImportSpecifier" || specifier.importKind === "type") continue;
+					const module = moduleOf(filename, source, wrapper);
+					const name = exportName(specifier.imported);
+					reportBanned(specifier, module === null ? null : {
+						module,
+						name
+					}, source);
+				}
+			},
+			ExportNamedDeclaration(node) {
+				if (node.source === null || node.exportKind === "type") return;
+				const source = node.source.value;
+				const module = moduleOf(filename, source, wrapper);
+				if (module === null) return;
+				for (const specifier of node.specifiers) {
+					if (specifier.exportKind === "type") continue;
+					reportBanned(specifier, {
+						module,
+						name: exportName(specifier.local)
+					}, source);
+				}
+			},
+			ExportAllDeclaration(node) {
+				if (node.exportKind === "type") return;
+				const source = node.source.value;
+				if (holdsBanned(moduleOf(filename, source, wrapper))) report(node, "reExportAll", { source });
+			},
+			MemberExpression(node) {
+				reportBanned(node, origin(node), sourceOf(node.object));
+			},
+			VariableDeclarator(node) {
+				if (node.init !== null) checkPattern(node.id, node.init);
+			},
+			AssignmentExpression(node) {
+				checkPattern(node.left, node.right);
+			},
+			SpreadElement(node) {
+				if (node.parent.type !== "ObjectExpression") return;
+				const whole = origin(node.argument);
+				if (whole?.name === null && copiesBanned(whole.module, whole.excluded ?? /* @__PURE__ */ new Set())) report(node, "namespaceCopy", { source: sourceOf(node.argument) });
+			},
+			CallExpression(node) {
+				if (!buildsFunction(origin(node.callee), true)) return;
+				const definition = definitionOf(analysis, node);
+				if (definition === null) return;
+				if (definition.type !== "ObjectExpression") {
+					walkHandler(definition);
+					return;
+				}
+				const member = analysis.memberOf(definition, "handler");
+				const handler = member.kind === "value" ? analysis.staticValue(member.value) : null;
+				if (handler !== null && handler.type !== "ObjectExpression") walkHandler(handler);
+			}
+		};
+	}
+});
+//#endregion
+//#region src/rules/convex-require-validators.ts
+/**
+* Every value an export can hold: a binding's initializer and each later assignment, so a `let`
+* reassigned to another function is checked in both forms.
+*/
+function exportedValues(analysis, sourceCode, program) {
+	const exported = [];
+	const add = (value) => {
+		const unwrapped = unwrapTypeScript(value);
+		if (unwrapped.type === "Identifier") exported.push(...analysis.valuesOf(unwrapped));
+		else exported.push(unwrapped);
+	};
+	for (const statement of program.body) {
+		if (statement.type === "ExportNamedDeclaration" && statement.source === null) {
+			if (statement.declaration?.type === "VariableDeclaration") for (const declarator of statement.declaration.declarations) for (const variable of sourceCode.getDeclaredVariables(declarator)) exported.push(...analysis.variableValues(variable));
+			for (const specifier of statement.specifiers) {
+				if (specifier.exportKind === "type" || specifier.local.type !== "Identifier") continue;
+				add(specifier.local);
+			}
+		}
+		if (statement.type === "ExportDefaultDeclaration") {
+			const { declaration } = statement;
+			if (isExpression(declaration)) add(declaration);
+		}
+	}
+	return exported;
+}
+function isExpression(node) {
+	return node.type !== "FunctionDeclaration" && node.type !== "ClassDeclaration" && node.type !== "TSInterfaceDeclaration" && node.type !== "TSDeclareFunction";
+}
+/** Require `args`, and `returns` unless switched off, on every exported Convex function. */
+const convexRequireValidatorsRule = defineRule({
+	meta: {
+		type: "problem",
+		docs: { description: "Require argument and return validators on every exported Convex function, including those built by the project's checked constructors." },
+		messages: {
+			missing: "This Convex function declares no `{{validator}}` validator, so Convex checks nothing {{what}} and the types are a claim the deployment never tests. Add `{{validator}}`, using `{{empty}}` when there is nothing.{{advice}}",
+			bareHandler: "This Convex function is a bare handler, which has no place for validators. Pass an object with {{fields}}.{{advice}}"
+		},
+		schema: [{
+			type: "object",
+			properties: {
+				wrapper: { type: "string" },
+				wrapperImports: {
+					type: "array",
+					items: { type: "string" }
+				},
+				returns: { type: "boolean" },
+				hint: { type: "string" }
+			},
+			additionalProperties: false
+		}]
+	},
+	create(context) {
+		const { filename, sourceCode } = context;
+		if (isGenerated(filename)) return {};
+		const option = stringOption(context.options, "wrapper");
+		const analysis = analyse(sourceCode, filename, option === void 0 ? void 0 : placeWrapper(context.cwd, option, stringsOption(context.options, "wrapperImports")));
+		const requireReturns = booleanOption(context.options, "returns") ?? true;
+		const hint = stringOption(context.options, "hint");
+		const advice = hint === void 0 ? "" : ` ${hint}`;
+		const required = requireReturns ? ["args", "returns"] : ["args"];
+		const checked = /* @__PURE__ */ new Set();
+		const check = (value) => {
+			if (value.type !== "CallExpression" || checked.has(value)) return;
+			checked.add(value);
+			if (!buildsFunction(analysis.originOf(value.callee), false)) return;
+			const definition = definitionOf(analysis, value);
+			if (definition === null) return;
+			if (definition.type !== "ObjectExpression") {
+				const fields = requireReturns ? "`args`, `returns` and `handler`" : "`args` and `handler`";
+				context.report({
+					node: value,
+					messageId: "bareHandler",
+					data: {
+						fields,
+						advice
+					}
+				});
+				return;
+			}
+			for (const validator of required) {
+				const member = analysis.memberOf(definition, validator);
+				if (!(member.kind === "absent" || member.kind === "value" && analysis.isUndefined(member.value))) continue;
+				const what = validator === "args" ? "a caller sends" : "the handler returns";
+				const empty = validator === "args" ? "{}" : "v.null()";
+				context.report({
+					node: definition,
+					messageId: "missing",
+					data: {
+						validator,
+						what,
+						empty,
+						advice
+					}
+				});
+			}
+		};
+		return { "Program:exit"(node) {
+			for (const value of exportedValues(analysis, sourceCode, node)) check(value);
+		} };
+	}
+});
 //#endregion
 //#region src/rules/no-hardcoded-jsx-text.ts
 const defaultWordPattern = String.raw`\p{L}{3,}`;
@@ -1893,6 +2575,8 @@ const staticPublicEnvRule = defineRule({
 const rdjperronPlugin = eslintCompatPlugin({
 	meta: { name: "rdjperron" },
 	rules: {
+		"convex-checked-constructors": convexCheckedConstructorsRule,
+		"convex-require-validators": convexRequireValidatorsRule,
 		"no-array-filter-map": noArrayFilterMapRule,
 		"no-chained-type-assertions": noChainedTypeAssertionsRule,
 		"no-conditional-empty-object-spread": noConditionalEmptyObjectSpreadRule,