@starci/eslint-canon-be 3.2.13 → 3.2.15

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -86,9 +86,9 @@ export const MANIFEST_KINDS = [APP_KIND, RUNTIME_KIND];
 export const manifestKind = (m) => (isPlainObject(m) && m.kind !== undefined ? m.kind : APP_KIND);
 const strList = (v) => stringList(v);
 
-const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'anonymousActions'];
+const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome'];
 /** The fields a slot's `lite` overlay may hold: the same keys it would carry in the slot body, resolved under edition lite. */
-const LITE_OVERLAY_KEYS = ['path', 'requires', 'allows', 'forbids', 'minInstances', 'requiredInstances'];
+const LITE_OVERLAY_KEYS = ['path', 'requires', 'allows', 'forbids', 'minInstances', 'requiredInstances', 'why'];
 /** A runtime slot has no app kind, side composition, layer or managed template; it may name the generator of a generated copy. */
 const RUNTIME_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'minInstances', 'requires', 'allows', 'forbids', 'budget', 'rules', 'goesTo', 'why', 'since', 'generatedBy', 'parent', 'coverage'];
 
@@ -197,6 +197,7 @@ function slotLiteOverlayProblems(slot, at) {
   if (slot.lite === undefined) return [];
   const ok = isPlainObject(slot.lite) && Object.keys(slot.lite).length && Object.keys(slot.lite).every((key) => LITE_OVERLAY_KEYS.includes(key))
     && (slot.lite.path === undefined || (typeof slot.lite.path === 'string' && slot.lite.path))
+    && (slot.lite.why === undefined || (typeof slot.lite.why === 'string' && slot.lite.why.trim()))
     && ['requires', 'allows', 'forbids'].every((key) => slot.lite[key] === undefined || strList(slot.lite[key]))
     && (slot.lite.minInstances === undefined || (Number.isInteger(slot.lite.minInstances) && slot.lite.minInstances >= 1))
     && (slot.lite.requiredInstances === undefined || (isPlainObject(slot.lite.requiredInstances) && Object.values(slot.lite.requiredInstances).every((v) => strList(v) && v.length)));
@@ -211,7 +212,6 @@ function slotEntryProblems(slot, at) {
     else if (typeof slot.path !== 'string' || !slot.path.endsWith('/') || slot.owner === true) bad.push(`${at}: entries belong to a directory slot that is not an owner (they name extra public entries of the owner that holds it)`);
     else if (Array.isArray(slot.allows) && slot.entries.some((entry) => !slot.allows.includes(entry))) bad.push(`${at}: every entry must be one of the names the slot allows`);
   }
-  if (slot.anonymousActions !== undefined && !(strList(slot.anonymousActions) && slot.anonymousActions.length > 0 && new Set(slot.anonymousActions).size === slot.anonymousActions.length && slot.anonymousActions.every(relPath) && typeof slot.path === 'string' && slot.path.endsWith('/'))) bad.push(`${at}: anonymousActions must be a non-empty list of unique relative file paths of a directory slot`);
   if (slot.outcomeHome !== undefined && !(slot.outcomeHome === true && typeof slot.path === 'string' && slot.path && !slot.path.endsWith('/'))) bad.push(`${at}: outcomeHome is true and belongs to a file slot (the one file that declares the repository's Outcome union)`);
   return bad;
 }

package/runtime/scripts/hfs/rule-catalog.mjs

@@ -15,7 +15,9 @@ const RULE_KINDS = Object.freeze(['codemod', 'lint', 'check', 'design']);
 const FINDING_CODE = /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/;
 const ENFORCER_ID = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const FILE_ENFORCERS = new Set(['machine', 'hfs', 'work-validate', 'sonar', 'runtime']);
-const RULE_KEYS = new Set(['id', 'code', 'law', 'scope', 'kinds', 'gates', 'failureCodes', 'editions', 'enforcers']);
+const RULE_KEYS = new Set(['id', 'code', 'law', 'scope', 'kinds', 'gates', 'failureCodes', 'editions', 'enforcers', 'cases']);
+const CASE_KEYS = new Set(['id', 'date', 'source', 'ruling', 'quote']);
+const CASE_DATE = /^\d{4}-\d{2}-\d{2}$/;
 const ENFORCER_KEYS = new Set(['kind', 'id', 'status', 'at', 'editions']);
 
 function vocabularyProblems(catalog, key, names, bad) {
@@ -59,6 +61,23 @@ function checkRuleText(rule, label, bad) {
   if (rule.scope !== undefined && rule.scope !== 'runtime') bad.push(`${label}.scope is absent or runtime`);
 }
 
+/** The dated owner cases of a rule: each {id case-N, date, source owner, ruling, quote?}, ids unique (an owner ruling recorded where the law lives). */
+function checkRuleCases(rule, label, bad) {
+  if (rule.cases === undefined) return;
+  if (!Array.isArray(rule.cases) || !rule.cases.length) { bad.push(`${label}.cases must be a non-empty list`); return; }
+  const ids = new Set();
+  rule.cases.forEach((item, index) => {
+    const at = `${label}.cases[${index}]`;
+    if (!isPlainObject(item)) { bad.push(`${at} is not a map`); return; }
+    for (const key of Object.keys(item)) if (!CASE_KEYS.has(key)) bad.push(`${at} has unknown key ${key}`);
+    if (typeof item.id !== 'string' || !/^case-[1-9][0-9]*$/.test(item.id) || ids.has(item.id)) bad.push(`${at}.id must be a unique case-N`);
+    ids.add(item.id);
+    if (typeof item.date !== 'string' || !CASE_DATE.test(item.date)) bad.push(`${at}.date must be YYYY-MM-DD`);
+    if (item.source !== 'owner') bad.push(`${at}.source must be owner`);
+    for (const key of ['ruling', ...(item.quote === undefined ? [] : ['quote'])]) if (typeof item[key] !== 'string' || !item[key].trim()) bad.push(`${at}.${key} must be text`);
+  });
+}
+
 function checkRuleGates(label, gates, bad) {
   if (!gates.length) return;
   if (!gates.includes('land')) bad.push(`${label} must run at the land gate (every rule does)`);
@@ -120,6 +139,7 @@ function checkRule(rule, index, catalog, codeOwner, bad) {
   }
   checkRuleIdentity(rule, index, catalog, at, label, bad);
   checkRuleText(rule, label, bad);
+  checkRuleCases(rule, label, bad);
   enumListProblems(rule, label, 'kinds', RULE_KINDS, bad);
   bad.push(...ruleEditionProblems(rule, label));
   const gates = enumListProblems(rule, label, 'gates', RULE_GATES, bad);

package/runtime/scripts/hfs/rules/fe-no-tests.mjs

@@ -12,13 +12,12 @@ import { found, readJson } from './read.mjs';
 export const FE_NO_TESTS = 'FE_NO_TESTS';
 const SPEC_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/;
 const TEST_DIRECTORY = /(?:^|\/)(?:e2e|__tests__|__mocks__|test-support)\//;
-export const TEST_TOOL_FILE = /(?:^|\/)(?:(?:vitest|jest|playwright)\.[^/]+|cypress\.config\.[^/]+|tsconfig\.e2e\.json|e2e\.ya?ml)$/;
-// The edition rule (rules/edition.mjs, L01) applies the same lists to the whole app tree in lite: they are the test vocabulary.
-export const TEST_SCRIPT_NAME = /^(?:pre|post)?test(?::|$)/;
+const TEST_TOOL_FILE = /(?:^|\/)(?:(?:vitest|jest|playwright)\.[^/]+|cypress\.config\.[^/]+|tsconfig\.e2e\.json|e2e\.ya?ml)$/;
+const TEST_SCRIPT_NAME = /^(?:pre|post)?test(?::|$)/;
 const TEST_RUNNER_COMMAND_SOURCE = String.raw`(?:^|[\s&|;(])(?:npx\s+)?(?:vitest|jest|playwright|cypress|mocha)(?=$|[\s&|;)])|\bnode\s+(?:--\S+\s+)*--test\b`;
-export const TEST_RUNNER_COMMAND = new RegExp(TEST_RUNNER_COMMAND_SOURCE);
+const TEST_RUNNER_COMMAND = new RegExp(TEST_RUNNER_COMMAND_SOURCE);
 const TEST_DEPENDENCY_SOURCE = String.raw`^(?:vitest|@vitest\/.+|playwright|playwright-core|@playwright\/.+|jest|@jest\/.+|ts-jest|babel-jest|@types\/jest|jest-[\w-]+|mocha|@types\/mocha|cypress|@testing-library\/.+|jsdom|@types\/jsdom|happy-dom|axe-core|@axe-core\/.+|vitest-axe|@starci\/(?:vitest|jest|playwright)-preset)$`;
-export const TEST_DEPENDENCY = new RegExp(TEST_DEPENDENCY_SOURCE);
+const TEST_DEPENDENCY = new RegExp(TEST_DEPENDENCY_SOURCE);
 export const DEPENDENCY_SECTIONS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
 
 /** True for a path FE_NO_TESTS owns: a spec file, a test directory or a test-tool file. */

package/runtime/scripts/hfs/architecture/supabase-results.mjs

@@ -1,182 +0,0 @@
-import { chainParts, isSupabaseCall, isSupabaseValue, reportAt, unwrap } from './supabase-ast.mjs';
-import { machineKit } from './machine-ast.mjs';
-
-/**
- * The front-end Supabase result checks (FE_DB_RESULT_TYPED, FE_DB_ERROR_HANDLED): a query result keeps its inferred row type, a list read is
- * bounded, and the awaited result is either passed whole to `toOutcome` or has its error read.
- */
-const FE_RESULT_TYPED = 'FE_DB_RESULT_TYPED';
-const FE_ERROR_HANDLED = 'FE_DB_ERROR_HANDLED';
-export const FE_DB_SLOTS = new Set(['fe.modules.db', 'fe.package.db', 'fe.modules.db.outcome']);
-const QUERY_TERMINALS = new Set(['single', 'maybeSingle', 'returns']);
-const QUERY_WRITES = new Set(['insert', 'update', 'upsert', 'delete']);
-const LIST_BOUNDS = new Set(['gt', 'gte', 'lt', 'lte', 'range']);
-
-export const symbolOf = (kit, checker, node) => kit.aliased(checker, kit.symbolAt(checker, node)) ?? kit.symbolAt(checker, node);
-
-export const sameSymbol = (kit, checker, node, symbol) => Boolean(symbol && symbolOf(kit, checker, node) === symbol);
-
-const fromAwaitedSupabase = (kit, checker, node, seen = new Set()) => {
-  const current = unwrap(kit.ts, node);
-  if (!current || seen.has(current)) return false;
-  seen.add(current);
-  if (kit.ts.isCallExpression(current)) return isSupabaseCall(kit, checker, current);
-  if (!kit.ts.isIdentifier(current)) return false;
-  for (const declaration of kit.declarationsOf(checker, current)) {
-    if (kit.ts.isVariableDeclaration(declaration) && declaration.initializer && fromAwaitedSupabase(kit, checker, declaration.initializer, seen)) return true;
-  }
-  return false;
-};
-
-const callIsToOutcome = (kit, checker, graph, call) => {
-  if (!kit.ts.isCallExpression(call)) return false;
-  const expression = call.expression;
-  let name = null;
-  if (kit.ts.isIdentifier(expression)) name = expression.text;
-  else if (kit.ts.isPropertyAccessExpression(expression)) name = expression.name.text;
-  if (name !== 'toOutcome') return false;
-  return kit.declarationsOf(checker, kit.ts.isPropertyAccessExpression(expression) ? expression.name : expression)
-    .some(declaration => {
-      const rel = kit.graphPath(declaration);
-      return rel !== null && FE_DB_SLOTS.has(graph.files.get(rel)?.slot);
-    });
-};
-
-const parentCall = (ts, node) => {
-  let current = node;
-  while (current.parent && ts.isParenthesizedExpression(current.parent)) current = current.parent;
-  return ts.isCallExpression(current.parent) ? current.parent : null;
-};
-
-/** True when `node` reads `.error` / `['error']` of the result symbol, or passes the result whole to toOutcome. */
-const readsResultError = (kit, checker, graph, node, result) => {
-  const { ts } = kit;
-  if (ts.isPropertyAccessExpression(node) && node.name.text === 'error' && sameSymbol(kit, checker, node.expression, result)) return true;
-  if (ts.isElementAccessExpression(node) && ts.isStringLiteralLike(node.argumentExpression) && node.argumentExpression.text === 'error' && sameSymbol(kit, checker, node.expression, result)) return true;
-  return ts.isCallExpression(node) && callIsToOutcome(kit, checker, graph, node)
-    && node.arguments.some(argument => sameSymbol(kit, checker, unwrap(ts, argument), result));
-};
-
-/** A result bound to one identifier is handled when the file reads its error or hands it whole to toOutcome. */
-const identifierResultHandled = (kit, checker, graph, awaitNode, declaration) => {
-  const result = symbolOf(kit, checker, declaration.name);
-  let handled = false;
-  kit.walk(awaitNode.getSourceFile(), node => {
-    if (readsResultError(kit, checker, graph, node, result)) handled = true;
-    return !handled;
-  });
-  return handled;
-};
-
-/** A result destructured into `{ error }` is handled when the bound error is referenced beyond its binding. */
-const destructuredResultHandled = (kit, checker, awaitNode, declaration) => {
-  const errorBinding = declaration.name.elements.find(element => {
-    const property = element.propertyName ?? element.name;
-    return kit.ts.isIdentifier(property) && property.text === 'error';
-  });
-  if (!errorBinding || !kit.ts.isIdentifier(errorBinding.name)) return false;
-  const error = symbolOf(kit, checker, errorBinding.name);
-  let references = 0;
-  kit.walk(awaitNode.getSourceFile(), node => {
-    if (kit.ts.isIdentifier(node) && sameSymbol(kit, checker, node, error)) references += 1;
-    return true;
-  });
-  return references > 1;
-};
-
-const handledAwait = (kit, checker, graph, awaitNode) => {
-  const direct = parentCall(kit.ts, awaitNode);
-  if (direct && callIsToOutcome(kit, checker, graph, direct) && direct.arguments.some(argument => argument === awaitNode || argument === awaitNode.parent)) return true;
-  let cursor = awaitNode;
-  while (cursor.parent && kit.ts.isParenthesizedExpression(cursor.parent)) cursor = cursor.parent;
-  const declaration = kit.ts.isVariableDeclaration(cursor.parent) ? cursor.parent : null;
-  if (!declaration) return false;
-  if (kit.ts.isIdentifier(declaration.name)) return identifierResultHandled(kit, checker, graph, awaitNode, declaration);
-  if (!kit.ts.isObjectBindingPattern(declaration.name)) return false;
-  return destructuredResultHandled(kit, checker, awaitNode, declaration);
-};
-
-const dataSymbolFromAwait = (kit, checker, identifier) => {
-  const symbol = symbolOf(kit, checker, identifier);
-  for (const declaration of symbol?.declarations ?? []) {
-    if (!kit.ts.isBindingElement(declaration) || !kit.ts.isObjectBindingPattern(declaration.parent)) continue;
-    const property = declaration.propertyName ?? declaration.name;
-    if (!kit.ts.isIdentifier(property) || property.text !== 'data') continue;
-    const variable = declaration.parent.parent;
-    if (kit.ts.isVariableDeclaration(variable) && variable.initializer && fromAwaitedSupabase(kit, checker, variable.initializer)) return symbol;
-  }
-  return null;
-};
-
-function inspectResultGeneric(scope, node) {
-  const { ts, kit, checker, report } = scope;
-  if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && QUERY_TERMINALS.has(node.expression.name.text)
-    && node.typeArguments?.length && isSupabaseValue(kit, checker, node.expression.expression)) {
-    report(FE_RESULT_TYPED, node, `${node.expression.name.text}<T>() supplies a result generic; derive the row type from Database and let the Supabase chain infer it.`);
-  }
-}
-
-function inspectResultCast(scope, node) {
-  const { ts, kit, checker, report } = scope;
-  if ((ts.isAsExpression(node) || ts.isTypeAssertionExpression(node) || ts.isNonNullExpression(node)) && fromAwaitedSupabase(kit, checker, node.expression)) {
-    report(FE_RESULT_TYPED, node, 'A Supabase query result is cast or non-null asserted; narrow its typed data/error outcome instead.');
-  }
-}
-
-/** Counts a multi-row read and reports it when no limit, range or keyset bound applies. */
-function inspectListRead(scope, node, methods) {
-  const isListRead = methods.includes('select') && !methods.some(method => QUERY_WRITES.has(method)) && !methods.includes('single') && !methods.includes('maybeSingle');
-  if (!isListRead) return;
-  scope.counters.listReads += 1;
-  if (!methods.includes('limit') && !methods.some(method => LIST_BOUNDS.has(method))) {
-    scope.report(FE_RESULT_TYPED, node, 'A Supabase list read has no .limit(), .range(), or keyset bound (.gt/.gte/.lt/.lte); bound every multi-row read.');
-  }
-}
-
-function inspectAwaitedResult(scope, node) {
-  const { ts, kit, checker, report, graph, counters } = scope;
-  if (!ts.isAwaitExpression(node) || !isSupabaseValue(kit, checker, node.expression)) return;
-  const expression = unwrap(ts, node.expression);
-  if (!ts.isCallExpression(expression)) return;
-  counters.awaited += 1;
-  inspectListRead(scope, node, chainParts(ts, expression));
-  if (!handledAwait(kit, checker, graph, node)) {
-    report(FE_ERROR_HANDLED, node, 'The awaited Supabase result does not read its error and is not passed whole to toOutcome(result).');
-  }
-}
-
-function inspectSwallowedData(scope, node) {
-  const { ts, kit, checker, report } = scope;
-  if (!(ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken && ts.isArrayLiteralExpression(node.right) && node.right.elements.length === 0)) return;
-  const left = unwrap(ts, node.left);
-  const swallowed = ts.isIdentifier(left) ? Boolean(dataSymbolFromAwait(kit, checker, left))
-    : ts.isPropertyAccessExpression(left) && left.name.text === 'data' && fromAwaitedSupabase(kit, checker, left.expression);
-  if (swallowed) report(FE_ERROR_HANDLED, node, 'Supabase data is collapsed with ?? []; refused or unavailable is not empty data. Pass the whole result to toOutcome.');
-}
-
-function inspectQueryResultNode(scope, node) {
-  inspectResultGeneric(scope, node);
-  inspectResultCast(scope, node);
-  inspectAwaitedResult(scope, node);
-  inspectSwallowedData(scope, node);
-  return true;
-}
-
-export function checkFrontendQueryResults(input) {
-  const kit = machineKit(input);
-  const violations = [];
-  const counters = { awaited: 0, listReads: 0 };
-  for (const file of input.graph.files.values()) {
-    const checker = kit.checkerOf(file.sourceFile);
-    const seen = new Set();
-    const report = (ruleId, node, message) => {
-      const key = `${ruleId}:${node.pos}:${message}`;
-      if (seen.has(key)) return;
-      seen.add(key);
-      reportAt(violations, kit, ruleId, file, node, message);
-    };
-    const scope = { ts: kit.ts, kit, checker, report, graph: input.graph, counters };
-    kit.walk(file.sourceFile, node => inspectQueryResultNode(scope, node));
-  }
-  return { violations, coverage: { status: 'checked', awaited: counters.awaited, listReads: counters.listReads } };
-}