@rigour-labs/core 6.4.0 → 6.4.2

package/dist/semantic/rules/ecosystem/imports-barrel-cycle.js

@@ -0,0 +1,78 @@
+/**
+ * imports/barrel-cycle: a runtime re-export (`export … from './x'`) whose target
+ * imports this file back, directly or through other project modules.
+ *
+ * A barrel in an import cycle evaluates before the modules it re-exports have
+ * run: exports are undefined at first use, and HMR updates loop through the
+ * cycle. TanStack Start's `Hydrate` re-export pulled the app's router into a
+ * cycle and caused circular HMR updates. Type-only edges are erased, so they
+ * are ignored.
+ */
+import ts from 'typescript';
+import { finding } from './shared.js';
+const MAX_VISITED = 2000;
+const edgesByChecker = new WeakMap();
+export const importsBarrelCycle = {
+    id: 'imports/barrel-cycle',
+    check(ctx) {
+        const { sourceFile, checker } = ctx;
+        const findings = [];
+        for (const statement of sourceFile.statements) {
+            if (!ts.isExportDeclaration(statement) || statement.isTypeOnly || !statement.moduleSpecifier)
+                continue;
+            const target = moduleFile(checker, statement.moduleSpecifier);
+            if (!target || !reaches(checker, target, sourceFile))
+                continue;
+            findings.push(finding(ctx, 'imports/barrel-cycle', statement, 'medium', `This re-export of \`${statement.moduleSpecifier.text}\` closes an import cycle back to this file; its exports can be undefined at first use and HMR updates loop.`, 'Re-export from a module outside the cycle (a dedicated subpath entry), or break the back-import.'));
+        }
+        return findings;
+    },
+};
+function reaches(checker, from, to) {
+    const seen = new Set([from]);
+    const queue = [from];
+    while (queue.length && seen.size < MAX_VISITED) {
+        for (const next of edges(checker, queue.shift())) {
+            if (next === to)
+                return true;
+            if (!seen.has(next)) {
+                seen.add(next);
+                queue.push(next);
+            }
+        }
+    }
+    return false;
+}
+/** Runtime imports and re-exports of a project file, to other project files. */
+function edges(checker, file) {
+    let cache = edgesByChecker.get(checker);
+    if (!cache)
+        edgesByChecker.set(checker, cache = new Map());
+    const cached = cache.get(file);
+    if (cached)
+        return cached;
+    const targets = [];
+    for (const statement of file.statements) {
+        const specifier = runtimeSpecifier(statement);
+        const target = specifier && moduleFile(checker, specifier);
+        if (target)
+            targets.push(target);
+    }
+    cache.set(file, targets);
+    return targets;
+}
+function runtimeSpecifier(statement) {
+    if (ts.isImportDeclaration(statement)) {
+        const clause = statement.importClause;
+        return clause?.isTypeOnly ? undefined : statement.moduleSpecifier;
+    }
+    if (ts.isExportDeclaration(statement) && !statement.isTypeOnly)
+        return statement.moduleSpecifier;
+    return undefined;
+}
+function moduleFile(checker, specifier) {
+    const declaration = checker.getSymbolAtLocation(specifier)?.valueDeclaration;
+    if (!declaration || !ts.isSourceFile(declaration) || declaration.isDeclarationFile)
+        return undefined;
+    return declaration.fileName.includes('/node_modules/') ? undefined : declaration;
+}

package/dist/semantic/rules/ecosystem/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Ecosystem rules: framework, library and packaging knowledge, each gated on the
+ * file's own dependencies or shape.
+ *
+ * A rule runs by default only once it passes validation on repositories it was
+ * not designed from (driftbench rlaif/rules): it catches real fixes, is quiet on
+ * code as it stands, and its hits are right. Candidates run when named in
+ * `gates.semantic_bugs.rules` or `rigour scan-rules --rules`, until their hits
+ * are labelled.
+ */
+import type { SemanticRule } from '../../types.js';
+/** Validated: catch a documented upstream fix, silent on eight unrelated repositories. */
+export declare const ECOSYSTEM_RULES: SemanticRule[];
+/** Candidates: they fire on code as it stands, and those hits are not yet labelled. Opt-in. */
+export declare const CANDIDATE_RULES: SemanticRule[];

package/dist/semantic/rules/ecosystem/index.js

@@ -0,0 +1,22 @@
+import { depsCodegenUndeclaredImport } from './deps-codegen-undeclared-import.js';
+import { depsInternalSymbol } from './deps-internal-symbol.js';
+import { domSelfQueryInComponent } from './dom-self-query-in-component.js';
+import { envBareBrowserGlobal } from './env-bare-browser-global.js';
+import { exportsConditionParity } from './exports-condition-parity.js';
+import { exportsForgottenType } from './exports-forgotten-type.js';
+import { importsBarrelCycle } from './imports-barrel-cycle.js';
+import { pathsUnnormalizedModuleKey } from './paths-unnormalized-module-key.js';
+import { reactInlineHtmlObject } from './react-inline-html-object.js';
+import { solidJsxAndConditional } from './solid-jsx-and-conditional.js';
+import { tsInternalInPublicSignature } from './ts-internal-in-public-signature.js';
+import { viteRollupOnlyHookField } from './vite-rollup-only-hook-field.js';
+import { vueStaticComputed } from './vue-static-computed.js';
+/** Validated: catch a documented upstream fix, silent on eight unrelated repositories. */
+export const ECOSYSTEM_RULES = [
+    vueStaticComputed, reactInlineHtmlObject, tsInternalInPublicSignature, depsInternalSymbol,
+    depsCodegenUndeclaredImport, viteRollupOnlyHookField, domSelfQueryInComponent, exportsConditionParity,
+];
+/** Candidates: they fire on code as it stands, and those hits are not yet labelled. Opt-in. */
+export const CANDIDATE_RULES = [
+    solidJsxAndConditional, pathsUnnormalizedModuleKey, envBareBrowserGlobal, exportsForgottenType, importsBarrelCycle,
+];

package/dist/semantic/rules/ecosystem/paths-unnormalized-module-key.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const pathsUnnormalizedModuleKey: SemanticRule;

package/dist/semantic/rules/ecosystem/paths-unnormalized-module-key.js

@@ -0,0 +1,87 @@
+/**
+ * paths/unnormalized-module-key: a bundler module's file path is used as a map
+ * key or compared with another path without POSIX normalization.
+ *
+ * Rspack and webpack report modules by OS path (`nameForCondition()`,
+ * `.resource`, `.userRequest`), which on Windows uses backslashes, while route
+ * generators and Vite ids use forward slashes. The lookup silently misses on
+ * Windows only. TanStack Start lost every route's CSS on Windows this way.
+ */
+import ts from 'typescript';
+import { enclosingFunction, forEachNode, forEachOwnNode, symbolOf, unwrap } from '../../ast.js';
+import { finding } from './shared.js';
+const BUNDLERS = ['@rspack/core', 'webpack', '@rsbuild/core'];
+const OS_PATH_PROPERTIES = new Set(['resource', 'userRequest', 'rawRequest']);
+const OS_PATH_METHODS = new Set(['nameForCondition']);
+const NORMALIZER = /normali[sz]e|posix|slash|toUnix|replace(?:All)?$/i;
+export const pathsUnnormalizedModuleKey = {
+    id: 'paths/unnormalized-module-key',
+    check(ctx) {
+        const { sourceFile, checker, project } = ctx;
+        if (!project.declares(sourceFile.fileName, ...BUNDLERS))
+            return [];
+        const findings = [];
+        const tainted = new Set();
+        forEachNode(sourceFile, (node) => {
+            if (!ts.isVariableDeclaration(node) || !ts.isIdentifier(node.name) || !node.initializer)
+                return;
+            if (!readsOsPath(checker, node.initializer, tainted))
+                return;
+            const symbol = checker.getSymbolAtLocation(node.name);
+            const fn = enclosingFunction(node);
+            if (!symbol || !fn)
+                return;
+            tainted.add(symbol); // a later variable built from this one carries the OS path too
+            const use = keyUse(checker, fn, symbol);
+            if (use) {
+                findings.push(finding(ctx, 'paths/unnormalized-module-key', node, 'medium', `\`${node.name.text}\` holds a bundler module path in OS form and is used as a lookup key; on Windows it has backslashes and never matches.`, 'Normalize it to POSIX separators first (e.g. `.replace(/\\\\/g, \'/\')` or a normalizePath helper).'));
+            }
+        });
+        return findings;
+    },
+};
+/**
+ * The expression reads an OS path (from a bundler module, or from a variable that
+ * holds one) and is not normalized on the way.
+ */
+function readsOsPath(checker, expr, tainted) {
+    let reads = false;
+    let normalized = false;
+    const walk = (node) => {
+        if (ts.isCallExpression(node)) {
+            const callee = node.expression;
+            const name = ts.isPropertyAccessExpression(callee) ? callee.name.text : ts.isIdentifier(callee) ? callee.text : '';
+            if (NORMALIZER.test(name))
+                normalized = true;
+            if (OS_PATH_METHODS.has(name))
+                reads = true;
+        }
+        if (ts.isPropertyAccessExpression(node) && OS_PATH_PROPERTIES.has(node.name.text))
+            reads = true;
+        if (ts.isIdentifier(node) && tainted.size > 0) {
+            const symbol = symbolOf(checker, node);
+            if (symbol && tainted.has(symbol))
+                reads = true;
+        }
+        ts.forEachChild(node, walk);
+    };
+    walk(unwrap(expr));
+    return reads && !normalized;
+}
+/** A use of the variable as a Map key, an object key, or one side of an equality. */
+function keyUse(checker, fn, symbol) {
+    let use;
+    forEachOwnNode(fn, (node) => {
+        if (use || !ts.isIdentifier(node) || symbolOf(checker, node) !== symbol)
+            return;
+        const parent = node.parent;
+        if (ts.isCallExpression(parent) && parent.arguments[0] === node && ts.isPropertyAccessExpression(parent.expression)
+            && ['get', 'set', 'has'].includes(parent.expression.name.text))
+            use = parent;
+        else if (ts.isElementAccessExpression(parent) && parent.argumentExpression === node)
+            use = parent;
+        else if (ts.isBinaryExpression(parent) && [ts.SyntaxKind.EqualsEqualsEqualsToken, ts.SyntaxKind.EqualsEqualsToken].includes(parent.operatorToken.kind))
+            use = parent;
+    });
+    return use;
+}

package/dist/semantic/rules/ecosystem/react-inline-html-object.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const reactInlineHtmlObject: SemanticRule;

package/dist/semantic/rules/ecosystem/react-inline-html-object.js

@@ -0,0 +1,30 @@
+/**
+ * react/inline-html-object: `dangerouslySetInnerHTML={{ __html }}` built inline
+ * in a React 19 component.
+ *
+ * React 19 compares the `__html` object by identity, so a fresh literal on every
+ * render rewrites the element's innerHTML each time: inline <style> and <script>
+ * tags re-apply and re-execute. TanStack Router fixed its head assets by
+ * memoizing the object.
+ */
+import ts from 'typescript';
+import { forEachNode, unwrap } from '../../ast.js';
+import { finding, isJsxFile } from './shared.js';
+export const reactInlineHtmlObject = {
+    id: 'react/inline-html-object',
+    check(ctx) {
+        const { sourceFile, project } = ctx;
+        if (!isJsxFile(sourceFile) || (project.majorVersion(sourceFile.fileName, 'react') ?? 0) < 19)
+            return [];
+        const findings = [];
+        forEachNode(sourceFile, (node) => {
+            if (!ts.isJsxAttribute(node) || !ts.isIdentifier(node.name) || node.name.text !== 'dangerouslySetInnerHTML')
+                return;
+            const value = node.initializer && ts.isJsxExpression(node.initializer) && node.initializer.expression;
+            if (value && ts.isObjectLiteralExpression(unwrap(value))) {
+                findings.push(finding(ctx, 'react/inline-html-object', node, 'medium', 'A new `{ __html }` object on every render makes React 19 rewrite this element\'s innerHTML each render.', 'Memoize it: `const html = useMemo(() => ({ __html }), [source])`.'));
+            }
+        });
+        return findings;
+    },
+};

package/dist/semantic/rules/ecosystem/shared.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Shared pieces of the ecosystem rules: framework and library knowledge that
+ * no type checker has (Solid's JSX, Vue reactivity, TypeScript's declaration
+ * emit, bundler plugin contracts). Each rule is gated on the file's own
+ * declared dependencies and imports, so it only speaks where it applies.
+ */
+import ts from 'typescript';
+import type { Provenance, Severity } from '../../../types/index.js';
+import type { RuleContext, SemanticFinding } from '../../types.js';
+export declare function finding(ctx: RuleContext, rule: string, node: ts.Node, severity: Severity, message: string, hint: string, provenance?: Provenance): SemanticFinding;
+/** Module specifiers the file imports or re-exports. */
+export declare function importedModules(sourceFile: ts.SourceFile): string[];
+export declare function importsAny(sourceFile: ts.SourceFile, packages: string[]): boolean;
+/** The package a bare specifier names: `@scope/name/sub` -> `@scope/name`, `name/sub` -> `name`. */
+export declare function packageOf(specifier: string): string | undefined;
+export declare function isJsxFile(sourceFile: ts.SourceFile): boolean;
+/** Leading comments of the statement that contains `node`, and of the line above it. */
+export declare function leadingCommentText(sourceFile: ts.SourceFile, node: ts.Node): string;

package/dist/semantic/rules/ecosystem/shared.js

@@ -0,0 +1,43 @@
+/**
+ * Shared pieces of the ecosystem rules: framework and library knowledge that
+ * no type checker has (Solid's JSX, Vue reactivity, TypeScript's declaration
+ * emit, bundler plugin contracts). Each rule is gated on the file's own
+ * declared dependencies and imports, so it only speaks where it applies.
+ */
+import ts from 'typescript';
+import { lineOf, relativeFile, snippet } from '../../ast.js';
+export function finding(ctx, rule, node, severity, message, hint, provenance = 'traditional') {
+    const file = relativeFile(ctx.cwd, ctx.sourceFile);
+    return { rule, severity, provenance, file, line: lineOf(node), message, hint, evidence: [`${file}:${lineOf(node)} ${snippet(node, 70)}`] };
+}
+/** Module specifiers the file imports or re-exports. */
+export function importedModules(sourceFile) {
+    const modules = [];
+    for (const statement of sourceFile.statements) {
+        const specifier = (ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement)) ? statement.moduleSpecifier : undefined;
+        if (specifier && ts.isStringLiteral(specifier))
+            modules.push(specifier.text);
+    }
+    return modules;
+}
+export function importsAny(sourceFile, packages) {
+    return importedModules(sourceFile).some(m => packages.some(p => m === p || m.startsWith(`${p}/`)));
+}
+/** The package a bare specifier names: `@scope/name/sub` -> `@scope/name`, `name/sub` -> `name`. */
+export function packageOf(specifier) {
+    if (specifier.startsWith('.') || specifier.startsWith('/') || specifier.startsWith('node:') || specifier.startsWith('virtual:'))
+        return undefined;
+    const parts = specifier.split('/');
+    return specifier.startsWith('@') ? (parts.length > 1 ? `${parts[0]}/${parts[1]}` : undefined) : parts[0];
+}
+export function isJsxFile(sourceFile) {
+    return /\.[jt]sx$/i.test(sourceFile.fileName);
+}
+/** Leading comments of the statement that contains `node`, and of the line above it. */
+export function leadingCommentText(sourceFile, node) {
+    let statement = node;
+    while (statement.parent && !ts.isSourceFile(statement.parent) && !ts.isBlock(statement.parent))
+        statement = statement.parent;
+    const ranges = ts.getLeadingCommentRanges(sourceFile.text, statement.pos) ?? [];
+    return ranges.map(r => sourceFile.text.slice(r.pos, r.end)).join('\n');
+}

package/dist/semantic/rules/ecosystem/solid-jsx-and-conditional.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const solidJsxAndConditional: SemanticRule;

package/dist/semantic/rules/ecosystem/solid-jsx-and-conditional.js

@@ -0,0 +1,36 @@
+/**
+ * solid/jsx-and-conditional: `{cond && <X/>}` in a Solid component.
+ *
+ * The React idiom. In Solid, JSX expressions compile to reactive getters, so the
+ * branch is recreated whenever the expression re-runs and ownership of the
+ * element is not tracked; `<Show when={cond}>` is the keyed, disposed form.
+ * TanStack Router shipped this in its Solid adapter and fixed it with <Show>.
+ */
+import ts from 'typescript';
+import { forEachNode, unwrap } from '../../ast.js';
+import { finding, importsAny, isJsxFile } from './shared.js';
+export const solidJsxAndConditional = {
+    id: 'solid/jsx-and-conditional',
+    check(ctx) {
+        const { sourceFile } = ctx;
+        if (!isJsxFile(sourceFile) || !importsAny(sourceFile, ['solid-js']))
+            return [];
+        const findings = [];
+        forEachNode(sourceFile, (node) => {
+            if (!ts.isJsxExpression(node) || !node.expression || !isJsxChild(node))
+                return;
+            const expr = unwrap(node.expression);
+            if (ts.isBinaryExpression(expr) && expr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken && isJsx(unwrap(expr.right))) {
+                findings.push(finding(ctx, 'solid/jsx-and-conditional', node, 'medium', '`cond && <X/>` is the React idiom; in Solid the branch is not keyed or disposed when `cond` changes.', 'Use <Show when={cond}>…</Show>.'));
+            }
+        });
+        return findings;
+    },
+};
+/** Inside JSX children, not an attribute value. */
+function isJsxChild(node) {
+    return ts.isJsxElement(node.parent) || ts.isJsxFragment(node.parent);
+}
+function isJsx(node) {
+    return ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node);
+}

package/dist/semantic/rules/ecosystem/ts-internal-in-public-signature.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const tsInternalInPublicSignature: SemanticRule;

package/dist/semantic/rules/ecosystem/ts-internal-in-public-signature.js

@@ -0,0 +1,66 @@
+/**
+ * ts/internal-in-public-signature: an exported function destructures an
+ * `@internal` property of its parameter while tsconfig sets `stripInternal`.
+ *
+ * `stripInternal` removes the property from the parameter's type in the emitted
+ * .d.ts, but the emitted signature still destructures it, so the published
+ * declarations do not type-check for consumers. TanStack Router shipped this in
+ * interpolatePath and fixed it with a rest parameter.
+ */
+import ts from 'typescript';
+import { finding } from './shared.js';
+export const tsInternalInPublicSignature = {
+    id: 'ts/internal-in-public-signature',
+    check(ctx) {
+        const { sourceFile, checker, project } = ctx;
+        if (sourceFile.isDeclarationFile || !project.compilerOptions(sourceFile.fileName).stripInternal)
+            return [];
+        const findings = [];
+        for (const fn of exportedFunctions(sourceFile)) {
+            for (const param of fn.parameters) {
+                if (!ts.isObjectBindingPattern(param.name))
+                    continue;
+                const type = checker.getTypeAtLocation(param);
+                for (const element of param.name.elements) {
+                    const name = element.propertyName ?? element.name;
+                    if (!ts.isIdentifier(name) || element.dotDotDotToken)
+                        continue;
+                    const property = type.getProperty(name.text);
+                    if (property && isInternal(property)) {
+                        findings.push(finding(ctx, 'ts/internal-in-public-signature', element, 'high', `Exported \`${functionName(fn)}\` destructures \`${name.text}\`, which is @internal; stripInternal removes it from the published type, so the emitted .d.ts does not compile.`, `Take the rest (\`...rest\`) and read \`rest.${name.text}\`, or stop marking the property @internal.`));
+                    }
+                }
+            }
+        }
+        return findings;
+    },
+};
+function exportedFunctions(sourceFile) {
+    const found = [];
+    for (const statement of sourceFile.statements) {
+        if (!isExported(statement))
+            continue;
+        if (ts.isFunctionDeclaration(statement))
+            found.push(statement);
+        if (ts.isVariableStatement(statement)) {
+            for (const decl of statement.declarationList.declarations) {
+                const init = decl.initializer;
+                if (init && (ts.isArrowFunction(init) || ts.isFunctionExpression(init)))
+                    found.push(init);
+            }
+        }
+    }
+    return found;
+}
+function isExported(statement) {
+    return ts.canHaveModifiers(statement) && !!ts.getModifiers(statement)?.some(m => m.kind === ts.SyntaxKind.ExportKeyword);
+}
+function isInternal(property) {
+    return (property.declarations ?? []).some(decl => ts.getJSDocTags(decl).some(tag => tag.tagName.text === 'internal'));
+}
+function functionName(fn) {
+    if (ts.isFunctionDeclaration(fn))
+        return fn.name?.text ?? 'default';
+    const decl = fn.parent;
+    return ts.isVariableDeclaration(decl) && ts.isIdentifier(decl.name) ? decl.name.text : 'function';
+}

package/dist/semantic/rules/ecosystem/vite-rollup-only-hook-field.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const viteRollupOnlyHookField: SemanticRule;

package/dist/semantic/rules/ecosystem/vite-rollup-only-hook-field.js

@@ -0,0 +1,31 @@
+/**
+ * vite/rollup-only-hook-field: a plugin hook returns `syntheticNamedExports`
+ * in a package built for Rolldown-based Vite.
+ *
+ * `syntheticNamedExports` is a Rollup feature Rolldown does not implement, so
+ * named imports from the module fail under rolldown-vite (and Vite 7+ on
+ * Rolldown). TanStack Start's import protection relied on it and had to emit
+ * explicit named exports instead.
+ */
+import ts from 'typescript';
+import { forEachNode, propertyNameText } from '../../ast.js';
+import { finding } from './shared.js';
+export const viteRollupOnlyHookField = {
+    id: 'vite/rollup-only-hook-field',
+    check(ctx) {
+        const { sourceFile, project } = ctx;
+        const file = sourceFile.fileName;
+        const onRolldown = project.declares(file, 'rolldown', 'rolldown-vite') || (project.majorVersion(file, 'vite') ?? 0) >= 7;
+        if (!onRolldown)
+            return [];
+        const findings = [];
+        forEachNode(sourceFile, (node) => {
+            if (ts.isPropertyAssignment(node) || ts.isShorthandPropertyAssignment(node)) {
+                if (propertyNameText(node.name) !== 'syntheticNamedExports')
+                    return;
+                findings.push(finding(ctx, 'vite/rollup-only-hook-field', node, 'medium', '`syntheticNamedExports` is Rollup-only; Rolldown-based Vite ignores it, so named imports from this module fail there.', 'Emit the named exports explicitly in the generated module.'));
+            }
+        });
+        return findings;
+    },
+};

package/dist/semantic/rules/ecosystem/vue-static-computed.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const vueStaticComputed: SemanticRule;

package/dist/semantic/rules/ecosystem/vue-static-computed.js

@@ -0,0 +1,51 @@
+/**
+ * vue/static-computed: `computed(() => snapshot)` where `snapshot` is a local
+ * built once in setup.
+ *
+ * A computed re-evaluates only when a reactive source it reads changes. Wrapping
+ * a value that setup computed once (say, from props read at setup time) yields
+ * a computed that never updates: the props change and the component keeps the
+ * first values. TanStack Router's Vue Link lost reactivity this way.
+ */
+import ts from 'typescript';
+import { enclosingFunction, forEachNode, symbolOf, unwrap } from '../../ast.js';
+import { finding, importsAny } from './shared.js';
+export const vueStaticComputed = {
+    id: 'vue/static-computed',
+    check(ctx) {
+        const { sourceFile, checker } = ctx;
+        if (!importsAny(sourceFile, ['vue']))
+            return [];
+        const findings = [];
+        forEachNode(sourceFile, (node) => {
+            if (!ts.isCallExpression(node) || !isComputedCall(node))
+                return;
+            const getter = node.arguments[0];
+            if (!getter || !ts.isArrowFunction(getter) || ts.isBlock(getter.body))
+                return;
+            const body = unwrap(getter.body);
+            if (!ts.isIdentifier(body))
+                return;
+            const declaration = symbolOf(checker, body)?.valueDeclaration;
+            if (!declaration || !ts.isVariableDeclaration(declaration) || !declaration.initializer)
+                return;
+            if (enclosingFunction(declaration) !== enclosingFunction(node) || !isSnapshot(declaration))
+                return;
+            findings.push(finding(ctx, 'vue/static-computed', node, 'medium', `\`computed(() => ${body.text})\` wraps a value setup built once, so it never recomputes when props or state change.`, 'Build the value inside the computed getter, reading props and refs there.'));
+        });
+        return findings;
+    },
+};
+/** `computed(...)` or `Vue.computed(...)`. */
+function isComputedCall(call) {
+    const callee = call.expression;
+    return (ts.isIdentifier(callee) && callee.text === 'computed')
+        || (ts.isPropertyAccessExpression(callee) && callee.name.text === 'computed');
+}
+/** A `const` whose initializer is a plain object or array literal: a value, not a reactive source. */
+function isSnapshot(declaration) {
+    const list = declaration.parent;
+    const isConst = ts.isVariableDeclarationList(list) && (list.flags & ts.NodeFlags.Const) !== 0;
+    const init = unwrap(declaration.initializer);
+    return isConst && (ts.isObjectLiteralExpression(init) || ts.isArrayLiteralExpression(init));
+}

package/dist/semantic/sites/call-sites.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Awaited call sites: the places where "should this call's failure be tolerated
+ * or passed up?" is a real question. Rigour exports them for training (the
+ * driftbench fix miner) and will ask the same question at the same sites at
+ * runtime, so training and inference read code through the same extraction.
+ *
+ * A site is an awaited call, or an element of an awaited Promise.all /
+ * Promise.allSettled. It is handled when the call already copes with failure.
+ */
+import ts from 'typescript';
+export type HandledBy = 'try' | 'call' | 'all-settled';
+export interface CallSite {
+    file: string;
+    line: number;
+    /** Name path of the enclosing function, e.g. `Loader.run>fetchAll`. */
+    function: string;
+    /** Callee text, e.g. `api.fetchUser`. */
+    callee: string;
+    /** Occurrence of this callee in the function, 0-based: pairs sites across versions of a file. */
+    ordinal: number;
+    handledBy: HandledBy | null;
+    /** The enclosing function's source, the text a model reads, capped at MAX_SOURCE_LINES. */
+    source: string;
+}
+export declare function findCallSites(cwd: string, checker: ts.TypeChecker, sourceFile: ts.SourceFile): CallSite[];

package/dist/semantic/sites/call-sites.js

@@ -0,0 +1,69 @@
+/**
+ * Awaited call sites: the places where "should this call's failure be tolerated
+ * or passed up?" is a real question. Rigour exports them for training (the
+ * driftbench fix miner) and will ask the same question at the same sites at
+ * runtime, so training and inference read code through the same extraction.
+ *
+ * A site is an awaited call, or an element of an awaited Promise.all /
+ * Promise.allSettled. It is handled when the call already copes with failure.
+ */
+import ts from 'typescript';
+import { enclosingFunction, forEachNode, lineOf, relativeFile, unwrap } from '../ast.js';
+import { handlesOwnFailure, isInsideTry, isPromiseAll, isPromiseAllSettled } from '../failure-handling.js';
+import { functionKeyOf } from '../learn/identity.js';
+const MAX_SOURCE_LINES = 120;
+export function findCallSites(cwd, checker, sourceFile) {
+    const sites = [];
+    const seen = new Map();
+    forEachNode(sourceFile, (node) => {
+        if (!ts.isAwaitExpression(node))
+            return;
+        for (const { call, settled, chained } of awaitedCalls(unwrap(node.expression))) {
+            const fn = enclosingFunction(call);
+            if (!fn)
+                continue;
+            const functionKey = functionKeyOf(call);
+            const callee = calleeText(call, sourceFile);
+            const slot = `${functionKey}\0${callee}`;
+            const ordinal = seen.get(slot) ?? 0;
+            seen.set(slot, ordinal + 1);
+            sites.push({
+                file: relativeFile(cwd, sourceFile),
+                line: lineOf(call),
+                function: functionKey,
+                callee,
+                ordinal,
+                handledBy: settled ? 'all-settled' : isInsideTry(call, fn) ? 'try' : chained || handlesOwnFailure(checker, call) ? 'call' : null,
+                source: fn.getText(sourceFile).split('\n').slice(0, MAX_SOURCE_LINES).join('\n'),
+            });
+        }
+    });
+    return sites;
+}
+/**
+ * The calls an await waits on: the call itself, or each element of Promise.all/allSettled.
+ * `x().catch(...)` is reported as `x()` handled by its chain, so the site keeps its
+ * identity when a fix adds the handler.
+ */
+function awaitedCalls(expr) {
+    if (!ts.isCallExpression(expr))
+        return [];
+    const settled = isPromiseAllSettled(expr);
+    if (isPromiseAll(expr) || settled) {
+        const [list] = expr.arguments;
+        if (!list || !ts.isArrayLiteralExpression(list))
+            return [];
+        return list.elements.map(e => unwrap(e)).filter(ts.isCallExpression).map(call => ({ ...unchain(call), settled }));
+    }
+    return [{ ...unchain(expr), settled: false }];
+}
+function unchain(call) {
+    const callee = call.expression;
+    const handler = ts.isPropertyAccessExpression(callee)
+        && (callee.name.text === 'catch' || callee.name.text === 'finally' || (callee.name.text === 'then' && call.arguments.length >= 2));
+    const inner = handler ? unwrap(callee.expression) : undefined;
+    return inner && ts.isCallExpression(inner) ? { call: inner, chained: true } : { call, chained: false };
+}
+function calleeText(call, sourceFile) {
+    return call.expression.getText(sourceFile).replace(/\s+/g, '');
+}

package/dist/semantic/sites/call-sites.test.d.ts

@@ -0,0 +1 @@
+export {};