@starci/eslint-canon-fe 9.4.7 → 9.5.0

package/dist/callback-shape.js

@@ -1,396 +0,0 @@
-import { stringOf, walk } from "./lib/ast.js";
-import { patternPath } from "./lib/bindings.js";
-import { normalizePath } from "./lib/path.js";
-import { ownerExportKind } from "./lib/pure-owner-helper.js";
-import { defineRule } from "./lib/rule.js";
-import { classifyImport, inSlot, resolveImport } from "./lib/scope.js";
-/** A value a well-formed tree always has; its absence stops the run as reading it always has. */
-const must = (value, what) => {
-    if (value === null || value === undefined)
-        throw new TypeError(`missing ${what}`);
-    return value;
-};
-/** The node a runtime wrapper wraps, or undefined when the node wraps nothing. */
-const wrapped = (node) => {
-    if (node.type === "AwaitExpression")
-        return node.argument;
-    if (node.type === "ChainExpression" || node.type === "TSAsExpression" || node.type === "TSTypeAssertion" || node.type === "TSNonNullExpression" || node.type === "TSInstantiationExpression")
-        return node.expression;
-    return undefined;
-};
-const WRAPPERS = new Set(["AwaitExpression", "ChainExpression", "TSAsExpression", "TSTypeAssertion", "TSNonNullExpression", "TSInstantiationExpression"]);
-/** Runtime expression wrappers that preserve the value's source. */
-const unwrap = (input) => {
-    let node = input;
-    while (node && WRAPPERS.has(node.type))
-        node = wrapped(node);
-    return node;
-};
-/** A member's static key, including a bracketed string spelling. */
-const memberName = (node) => node.computed ? stringOf(node.property) : node.property.name;
-/** The name an identifier-like node spells, or undefined. */
-const nameOf = (node) => ("name" in node && typeof node.name === "string" ? node.name : undefined);
-/** The lexical binding of an identifier, including shadowing inside the handler. */
-const bindingOf = (sourceCode, node) => {
-    const name = nameOf(node);
-    for (let scope = sourceCode.getScope(node); scope; scope = scope.upper) {
-        const variable = name === undefined ? undefined : scope.set.get(name);
-        if (variable)
-            return variable;
-    }
-    return null;
-};
-/** Whether an identifier refers to the actual unshadowed platform global. */
-const isGlobal = (sourceCode, node, name) => node?.type === "Identifier" && node.name === name && !(bindingOf(sourceCode, node)?.defs.length);
-/** Route configuration is inert; a second HTTP door or an exported helper is not. */
-const CONFIG_EXPORTS = new Set(["runtime", "dynamic", "revalidate", "fetchCache", "preferredRegion", "maxDuration"]);
-const FUNCTIONS = new Set(["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"]);
-const FORBIDDEN = new Set(["AssignmentExpression", "UpdateExpression", "ImportExpression", "TaggedTemplateExpression", "ClassDeclaration", "ClassExpression", "ForStatement", "ForInStatement", "ForOfStatement", "WhileStatement", "DoWhileStatement", "ThrowStatement", "YieldExpression", "SpreadElement", "ArrayPattern", "JSXElement", "JSXFragment"]);
-const TEXT = new Set(["text", "code", "otp-type"]);
-const CALLS = new Set(["factory", "exchange", "verify-otp", "pure", "redirect", "params-get", "params-has", "text-guard"]);
-/** What a pure owner helper may be given: query text, the page URL or request, and plain values; never the credential itself. */
-const PURE_ARGUMENTS = new Set(["text", "otp-type", "scalar", "url", "request"]);
-const URL_TEXT = new Set(["origin", "href", "pathname", "search", "hash", "host", "hostname", "protocol"]);
-const CALL_RESULTS = new Map([["factory", "client"], ["exchange", "exchange-result"], ["verify-otp", "exchange-result"], ["pure", "text"], ["redirect", "redirect-result"], ["params-has", "scalar"], ["text-guard", "scalar"]]);
-const MEMBERS = new Map([
-    ["request", new Map([["nextUrl", "url"], ["url", "text"]])],
-    ["url", new Map([["searchParams", "params"], ...[...URL_TEXT].map((key) => [key, "text"])])],
-    ["params", new Map([["get", "params-get"], ["has", "params-has"]])],
-    ["client", new Map([["auth", "auth"]])],
-    ["auth", new Map([["exchangeCodeForSession", "exchange"], ["verifyOtp", "verify-otp"]])],
-    ["next-response", new Map([["redirect", "redirect"]])],
-    ["exchange-result", new Map([["error", "exchange-error"], ["success", "scalar"], ["ok", "scalar"]])],
-]);
-const TEXT_GUARDS = ["startsWith", "endsWith", "includes"];
-const UNSAFE_KEYS = ["__proto__", "constructor", "prototype"];
-const REDIRECT_TARGETS = ["text", "url"];
-const REDIRECT_STATUSES = [301, 302, 303, 307, 308];
-/** The query parameters whose provenance an exchange requires: the PKCE code, and the email link's token hash and type. */
-const PARAM_ORIGINS = new Map([["code", "code"], ["token_hash", "token-hash"], ["type", "otp-type"]]);
-/** True for a function node. */
-const isFunctionNode = (node) => FUNCTIONS.has(node.type);
-/** A locally exported binding's implementation. */
-const exportValue = (sourceCode, entry) => {
-    const definition = bindingOf(sourceCode, entry.local)?.defs[0]?.node;
-    return unwrap(definition?.type === "VariableDeclarator" ? definition.init : definition);
-};
-/** The spelling of an export or import name: an identifier's name or a string literal's value. */
-const moduleExportName = (node) => node.type === "Identifier" ? node.name : node.value;
-/** The runtime names introduced by one local named export. */
-const namedExports = (statement, sourceCode) => {
-    const declaration = statement.declaration;
-    if (declaration?.type === "FunctionDeclaration")
-        return [{ name: must(declaration.id, "function name").name, value: declaration }];
-    if (declaration?.type === "VariableDeclaration") {
-        if (declaration.declarations.some((entry) => entry.id.type !== "Identifier"))
-            return null;
-        return declaration.declarations.map((entry) => ({ name: must(nameOf(entry.id), "variable name"), value: unwrap(entry.init) }));
-    }
-    if (declaration)
-        return [];
-    return statement.specifiers.filter((entry) => entry.exportKind !== "type")
-        .map((entry) => ({ name: moduleExportName(entry.exported), value: exportValue(sourceCode, entry) }));
-};
-/** Collect runtime exports, refusing reexports and default exports. */
-const exportsOf = (program, sourceCode) => {
-    const exported = [];
-    for (const statement of program.body) {
-        if (statement.type === "ExportDefaultDeclaration" || statement.type === "ExportAllDeclaration")
-            return null;
-        if (statement.type !== "ExportNamedDeclaration" || statement.exportKind === "type")
-            continue;
-        if (statement.source)
-            return null;
-        const entries = namedExports(statement, sourceCode);
-        if (!entries)
-            return null;
-        exported.push(...entries);
-    }
-    return exported;
-};
-/** Find the one locally implemented GET export and its single request parameter. */
-const handlerOf = (program, sourceCode) => {
-    const exported = exportsOf(program, sourceCode);
-    if (!exported || exported.some((entry) => entry.name !== "GET" && !CONFIG_EXPORTS.has(entry.name)))
-        return null;
-    const handlers = exported.filter((entry) => entry.name === "GET");
-    if (handlers.length !== 1)
-        return null;
-    const handler = must(handlers[0], "GET export").value;
-    if (!handler || !isFunctionNode(handler) || !handler.async || handler.generator)
-        return null;
-    return handler.params.length === 1 && handler.params[0]?.type === "Identifier" ? handler : null;
-};
-/** Framework imports retain their actual owner even under a local alias. */
-const frameworkImportKind = (source, name) => {
-    if (source === "next/server" && name === "NextResponse")
-        return "next-response";
-    if (source === "next/server" && name === "NextRequest")
-        return "request-type";
-    if (source === "next/navigation" && name === "redirect")
-        return "redirect";
-    return null;
-};
-/** Only the server auth entry exposes the cookie-owning exchangeAuthCode helper. */
-const isServerAuthImport = (context, source) => {
-    const target = normalizePath(resolveImport(context, source));
-    return target.endsWith("/modules/auth/server") || target.endsWith("/modules/auth/server.ts");
-};
-/** A directory import resolves to its index, before the generic modules slot's hypothetical routes.ts. */
-const isRoutesImport = (context, source, slot) => slot === "fe.modules.routes" || classifyImport(context, `${source}/index`)?.slot === "fe.modules.routes";
-const CLIENT_NAMES = ["supabase", "supabaseClient", "authClient"];
-/** The exchange, client and factory names of the auth owner. */
-const authImportKind = (context, source, name) => {
-    if (name === "exchangeAuthCode" && isServerAuthImport(context, source))
-        return "exchange";
-    if (name === "verifyOtp" && isServerAuthImport(context, source))
-        return "verify-otp";
-    if (name === "exchangeCodeForSession")
-        return "exchange";
-    if (/^(?:create|get)\w*Client$/.test(name ?? ""))
-        return "factory";
-    if (CLIENT_NAMES.includes(name))
-        return "client";
-    return null;
-};
-/** Auth helpers and static route values must come from their declared HFS owners; any other export of `modules/routes` or `modules/auth` counts only as a pure helper or a static table. */
-const ownerImportKind = (context, source, name) => {
-    const slot = classifyImport(context, source)?.slot;
-    if (name === "APP_ROUTES" && isRoutesImport(context, source, slot))
-        return "routes";
-    const authKind = slot === "fe.modules.auth" ? authImportKind(context, source, name) : null;
-    if (authKind || !(slot === "fe.modules.auth" || isRoutesImport(context, source, slot)))
-        return authKind;
-    // A default or namespace import names no export, so no export of the owner can match it.
-    return name === undefined ? null : ownerExportKind(context, source, name);
-};
-/** The imported name of a specifier; undefined for a default or namespace import. */
-const importedName = (specifier) => specifier.type === "ImportSpecifier" ? moduleExportName(specifier.imported) : undefined;
-/** Register the allowed bindings in a single import statement. */
-const addImportBindings = (context, sourceCode, statement, imports) => {
-    const source = String(statement.source.value);
-    if (source === "server-only" && statement.specifiers.length === 0)
-        return true;
-    if (statement.specifiers.length === 0)
-        return false;
-    const variables = sourceCode.getDeclaredVariables(statement);
-    for (const specifier of statement.specifiers) {
-        if (specifier.type === "ImportSpecifier" && specifier.importKind === "type")
-            continue;
-        const name = importedName(specifier);
-        const kind = frameworkImportKind(source, name) ?? ownerImportKind(context, source, name);
-        if (!kind)
-            return false;
-        imports.set(variables.find((entry) => entry.name === specifier.local.name), kind);
-    }
-    return true;
-};
-/** Every runtime import is restricted, even if it is unused in the handler. */
-const importsOf = (context, program, sourceCode) => {
-    const imports = new Map();
-    for (const statement of program.body) {
-        if (statement.type !== "ImportDeclaration" || statement.importKind === "type")
-            continue;
-        if (!addImportBindings(context, sourceCode, statement, imports))
-            return null;
-    }
-    return imports;
-};
-/** Select a known property without granting arbitrary methods on the selected value. */
-const memberKind = (kind, key) => {
-    if (kind === "routes" && typeof key === "string" && !UNSAFE_KEYS.includes(key))
-        return "text";
-    if (TEXT.has(kind) && TEXT_GUARDS.includes(key))
-        return "text-guard";
-    return MEMBERS.get(kind)?.get(key) ?? null;
-};
-/** An identifier keeps the provenance of its one initializer or the GET request parameter. */
-const identifierOrigin = (node, seen, env, origin) => {
-    const variable = bindingOf(env.sourceCode, node);
-    if (env.imports.has(variable))
-        return env.imports.get(variable) ?? null;
-    if (!variable || seen.has(variable) || variable.defs.length !== 1)
-        return null;
-    const definition = must(variable.defs[0], "definition");
-    if (definition.type === "Parameter" && definition.node === env.handler)
-        return "request";
-    if (definition.node.type !== "VariableDeclarator")
-        return null;
-    const path = patternPath(definition.node.id, node.name);
-    const nextSeen = new Set([...seen, variable]);
-    return path?.reduce((kind, key) => memberKind(kind, key), origin(definition.node.init, nextSeen)) ?? null;
-};
-/** Combining known primitive values cannot introduce user-defined coercion. */
-const combinedOrigin = (kinds, conditional = false) => {
-    if (conditional && kinds[0] === kinds[1])
-        return kinds[0];
-    if (kinds.every((kind) => TEXT.has(kind)))
-        return "text";
-    if (!conditional && kinds.every((kind) => TEXT.has(kind) || kind === "scalar"))
-        return "scalar";
-    return null;
-};
-/** The source of a call's return value, independent of argument validation. */
-const callOrigin = (node, seen, origin) => {
-    const kind = origin(node.callee, seen);
-    if (kind === "params-get")
-        return PARAM_ORIGINS.get(stringOf(node.arguments[0])) ?? "text";
-    return CALL_RESULTS.get(kind) ?? null;
-};
-/** Composite expressions retain provenance only for supported primitive operations. */
-const expressionOrigin = (node, seen, env, origin) => {
-    if (node.type === "TemplateLiteral")
-        return node.expressions.every((expression) => TEXT.has(origin(expression, seen)) || origin(expression, seen) === "scalar") ? "text" : null;
-    if (node.type === "MemberExpression")
-        return memberKind(origin(node.object, seen), memberName(node));
-    if (node.type === "NewExpression" && isGlobal(env.sourceCode, node.callee, "URL"))
-        return "url";
-    if (node.type === "LogicalExpression" || node.type === "BinaryExpression")
-        return combinedOrigin([origin(node.left, seen), origin(node.right, seen)]);
-    if (node.type === "ConditionalExpression")
-        return combinedOrigin([origin(node.consequent, seen), origin(node.alternate, seen)], true);
-    if (node.type === "CallExpression")
-        return callOrigin(node, seen, origin);
-    return null;
-};
-/** Follow lexical aliases rather than trusting the spelling of an identifier. */
-const originOf = (env) => {
-    const origin = (input, seen = new Set()) => {
-        const node = unwrap(input);
-        if (!node)
-            return null;
-        if (node.type === "Identifier")
-            return identifierOrigin(node, seen, env, origin);
-        if (node.type === "Literal")
-            return typeof node.value === "string" || node.value === null ? "text" : "scalar";
-        return expressionOrigin(node, seen, env, origin);
-    };
-    return origin;
-};
-/** The closest enclosing function must be the GET handler. */
-const insideHandler = (node, handler) => {
-    for (let parent = node.parent; parent; parent = parent.parent)
-        if (FUNCTIONS.has(parent.type))
-            return parent === handler;
-    return false;
-};
-/** Await must wrap the actual exchange call before its enclosing statement ends. */
-const isAwaited = (node, handler) => {
-    for (let parent = node.parent; parent && parent !== handler; parent = parent.parent) {
-        if (parent.type === "AwaitExpression")
-            return true;
-        if (parent.type.endsWith("Statement"))
-            return false;
-    }
-    return false;
-};
-/** The static key of a plain `init` property, or null for a computed, method or accessor property and for a spread. */
-const plainKey = (property) => {
-    if (property.type !== "Property" || property.computed || property.method || property.kind !== "init")
-        return null;
-    const key = property.key;
-    return key.type === "Identifier" ? key.name : key.value;
-};
-/** Only a literal redirect status is allowed in an options object. */
-const isRedirectStatus = (property) => {
-    if (property.type !== "Property" || property.computed || property.method || property.kind !== "init")
-        return false;
-    return plainKey(property) === "status" && property.value.type === "Literal" && REDIRECT_STATUSES.includes(property.value.value);
-};
-/** Arbitrary objects can invoke getters or toString during coercion; only redirect options belong here. */
-const isRedirectOptions = (node, origin) => node.parent.type === "CallExpression" && origin(node.parent.callee) === "redirect" && node.parent.arguments[1] === node && node.properties.every(isRedirectStatus);
-/** The one object `verifyOtp` takes: exactly `token_hash` read from the query `token_hash` and `type` read from the query `type`. */
-const isOtpArguments = (node, origin) => {
-    if (node.parent.type !== "CallExpression" || origin(node.parent.callee) !== "verify-otp" || node.parent.arguments[0] !== node)
-        return false;
-    const expected = new Map([["token_hash", "token-hash"], ["type", "otp-type"]]);
-    return node.properties.length === expected.size && node.properties.every((property) => property.type === "Property" && expected.get(plainKey(property)) === origin(property.value))
-        && new Set(node.properties.map(plainKey)).size === expected.size;
-};
-/** Non-call expressions must preserve the callback's narrow set of values and effects. */
-const validExpression = (node, env, origin) => {
-    if (node.type === "MemberExpression")
-        return Boolean(origin(node));
-    if (node.type === "ObjectExpression")
-        return isRedirectOptions(node, origin) || isOtpArguments(node, origin);
-    if (node.type === "VariableDeclarator" && node.id.type === "ObjectPattern")
-        return env.sourceCode.getDeclaredVariables(node).every((variable) => origin(variable.identifiers[0]));
-    if (node.type === "NewExpression")
-        return isGlobal(env.sourceCode, node.callee, "URL") && node.arguments.length >= 1 && node.arguments.length <= 2 && node.arguments.every((argument) => TEXT.has(origin(argument)));
-    if (node.type === "ReturnStatement")
-        return insideHandler(node, env.handler) && origin(node.argument) === "redirect-result";
-    if (node === env.handler && env.handler.body.type !== "BlockStatement")
-        return origin(env.handler.body) === "redirect-result";
-    return true;
-};
-/** Validate arguments to each permitted operation. */
-const validCall = (node, kind, env, origin) => {
-    if (!insideHandler(node, env.handler) || !CALLS.has(kind) || node.arguments.some((argument) => argument.type === "SpreadElement"))
-        return false;
-    if (kind === "exchange")
-        return isAwaited(node, env.handler) && node.arguments.length === 1 && origin(node.arguments[0]) === "code";
-    if (kind === "verify-otp")
-        return isAwaited(node, env.handler) && node.arguments.length === 1 && node.arguments[0]?.type === "ObjectExpression";
-    if (kind === "pure")
-        return node.arguments.length <= 4 && node.arguments.every((argument) => PURE_ARGUMENTS.has(origin(argument)));
-    if (kind === "redirect")
-        return node.arguments.length >= 1 && node.arguments.length <= 2 && REDIRECT_TARGETS.includes(origin(node.arguments[0]));
-    if (kind === "factory")
-        return node.arguments.length <= 1 && node.arguments.every((argument) => origin(argument) === "request");
-    return node.arguments.length === 1 && TEXT.has(origin(node.arguments[0]));
-};
-/** Syntactic forms that add work beyond the one handler are refused outright. */
-const forbiddenNode = (node, handler) => FORBIDDEN.has(node.type) || (FUNCTIONS.has(node.type) && node !== handler) || (node.type === "UnaryExpression" && node.operator === "delete");
-/** Walk all runtime syntax, counting the single exchange and permitted redirects. */
-const validOperations = (program, env) => {
-    const origin = originOf(env);
-    const counts = new Map();
-    let valid = true;
-    walk(env.sourceCode, program, (node) => {
-        if (!valid)
-            return false;
-        valid = !forbiddenNode(node, env.handler) && validExpression(node, env, origin);
-        if (!valid || node.type !== "CallExpression")
-            return undefined;
-        const kind = origin(node.callee);
-        valid = validCall(node, kind, env, origin);
-        counts.set(kind, (counts.get(kind) ?? 0) + 1);
-        return undefined;
-    });
-    const exchanges = (counts.get("exchange") ?? 0) + (counts.get("verify-otp") ?? 0);
-    return valid && exchanges >= 1 && (counts.get("exchange") ?? 0) <= 1 && (counts.get("verify-otp") ?? 0) <= 1 && (counts.get("factory") ?? 0) <= 1 && (counts.get("redirect") ?? 0) > 0;
-};
-/** The callback's request, imports and operations must all have known owners. */
-const callbackVerdict = (context, program) => {
-    const sourceCode = context.sourceCode ?? context.getSourceCode();
-    const handler = handlerOf(program, sourceCode);
-    if (!handler)
-        return false;
-    const imports = importsOf(context, program, sourceCode);
-    return imports !== null && validOperations(program, { sourceCode, handler, imports });
-};
-/** A callback stays a PKCE exchange and redirect, with every side effect owned by the auth helper. */
-export const callbackShape = defineRule({
-    meta: {
-        type: "problem",
-        docs: { description: "R287 FE_CALLBACK_SHAPE: the Supabase callback reads the PKCE code or the email-link token_hash and type, exchanges it through modules/auth (exchangeAuthCode or verifyOtp), and redirects only." },
-        schema: [],
-        messages: {
-            shape: "FE_CALLBACK_SHAPE: the auth callback must export an async GET that reads the query code (or the email-link token_hash and type), awaits one exchangeAuthCode(code) from modules/auth/server or auth.exchangeCodeForSession(code) and, for an email link, one verifyOtp({ token_hash, type }) built from exactly those two query values, may call pure text helpers of modules/routes or modules/auth (no I/O, no await) to compute the target and validate next, and redirects with NextResponse.redirect or next/navigation redirect. Create the client in modules/auth; keep data access, cookie writes, other calls and additional HTTP handlers outside the callback.",
-        },
-    },
-    create(context) {
-        if (!inSlot(context, "fe.route.callback"))
-            return {};
-        return {
-            "Program:exit"(program) {
-                if (!callbackVerdict(context, program))
-                    context.report({ node: program, messageId: "shape" });
-            },
-        };
-    },
-});
-/** The rule R287 contributes to the front-end plugin. */
-export const rules = { "callback-shape": callbackShape };
-/** Every callback shape violation is an error. */
-export const recommended = { "starci-fe/callback-shape": "error" };

package/dist/lib/pure-owner-helper.d.ts

@@ -1,10 +0,0 @@
-import type { AnyContext } from "./rule.js";
-/**
- * What an import of the callback's owner modules is: `"pure"` (a pure text-returning helper), `"routes"` (a static route table) or null.
- *
- * @param context - The ESLint rule context.
- * @param source - The import specifier.
- * @param name - The imported name.
- * @returns The kind.
- */
-export declare function ownerExportKind(context: AnyContext, source: string, name: string): "pure" | "routes" | null;

package/dist/lib/pure-owner-helper.js

@@ -1,156 +0,0 @@
-/**
- * The owner exports an auth callback may use besides the exchange (R287 `FE_CALLBACK_SHAPE`, owner ruling `auth-callback-pure-helpers`,
- * 2026-10-17 "Theo y tro"): a PURE helper of the app's `modules/routes` or `modules/auth` that computes the redirect target or validates
- * `next`, and a static route table. Both are found by TypeScript symbol resolution to the declaration, never by the spelling of the name.
- *
- * A pure helper is a synchronous function that returns text (or null), holds no `await` or `yield`, reaches no I/O global (network, storage,
- * DOM, `process`, `require`, `console`) and calls only locals, language built-ins and other pure helpers of `modules/routes` or
- * `modules/auth` (followed through barrels). `modules/config` is the environment owner: a call to its readers is a configuration read, not I/O.
- * Anything else it imports, a library value included, makes it impure.
- */
-import ts from "typescript";
-import { reaching } from "./own-hook-origin.js";
-import { programFor } from "./program-for.js";
-import { resolveImport } from "./scope.js";
-/** Globals that reach the network, storage, the page, the process or the console. */
-const IO_GLOBALS = new Set(["fetch", "XMLHttpRequest", "WebSocket", "EventSource", "Request", "navigator", "localStorage", "sessionStorage", "indexedDB", "document", "window", "self", "globalThis", "process", "require", "console", "setTimeout", "setInterval", "queueMicrotask", "Worker", "BroadcastChannel"]);
-const OWNER_FILE = /\/modules\/(?:routes|auth)(?:\/|\.tsx?$)/;
-const CONFIG_FILE = /\/modules\/config(?:\/|\.tsx?$)/;
-const EXTENSIONS = ["", ".ts", ".tsx", "/index.ts", "/index.tsx"];
-const normal = (file) => file.fileName.replaceAll("\\", "/");
-/** The module file an import specifier names, or null when none exists on disk. */
-const moduleFile = (context, source) => {
-    const target = resolveImport(context, source);
-    if (target === null)
-        return null;
-    return EXTENSIONS.map((extension) => `${target}${extension}`).find((candidate) => ts.sys.fileExists(candidate)) ?? null;
-};
-/** The declaration an export of the module resolves to, after barrels and re-exports. */
-const exportedDeclaration = (context, source, name) => {
-    const file = moduleFile(context, source);
-    if (file === null)
-        return null;
-    const program = reaching(programFor(context), context.filename, file);
-    const checker = program.getTypeChecker();
-    const sourceFile = program.getSourceFile(file);
-    const moduleSymbol = sourceFile ? checker.getSymbolAtLocation(sourceFile) : undefined;
-    const exported = moduleSymbol ? checker.getExportsOfModule(moduleSymbol).find((symbol) => symbol.name === name) : undefined;
-    if (!exported)
-        return null;
-    const symbol = (exported.flags & ts.SymbolFlags.Alias) !== 0 ? checker.getAliasedSymbol(exported) : exported;
-    return { checker, declaration: symbol.declarations?.[0] ?? null };
-};
-/** Strip `as`, `satisfies` and parentheses. */
-const bare = (node) => {
-    let current = node;
-    while (current && (ts.isAsExpression(current) || ts.isSatisfiesExpression(current) || ts.isParenthesizedExpression(current)))
-        current = current.expression;
-    return current;
-};
-/** The function-like node of a function declaration or of a variable initialised with an arrow or function expression. */
-const functionOf = (declaration) => {
-    if (ts.isFunctionDeclaration(declaration))
-        return declaration;
-    const init = ts.isVariableDeclaration(declaration) ? bare(declaration.initializer) : undefined;
-    return init !== undefined && (ts.isArrowFunction(init) || ts.isFunctionExpression(init)) ? init : null;
-};
-const isInside = (node, root) => node.getSourceFile() === root.getSourceFile() && node.pos >= root.pos && node.end <= root.end;
-/** Whether an identifier names a declaration, a property or a member rather than referring to a binding. */
-const isNameOnly = (node) => {
-    const parent = node.parent;
-    if (ts.isPropertyAccessExpression(parent))
-        return parent.name === node;
-    if (ts.isPropertyAssignment(parent) || ts.isMethodDeclaration(parent) || ts.isPropertySignature(parent))
-        return parent.name === node;
-    return (ts.isParameter(parent) || ts.isVariableDeclaration(parent) || ts.isFunctionDeclaration(parent) || ts.isBindingElement(parent)) && parent.name === node;
-};
-/** A declaration of another file: an owner helper is followed, the environment owner is a leaf, everything else is impure. */
-const foreignPure = (env, declaration, root) => {
-    const file = normal(declaration.getSourceFile());
-    if (CONFIG_FILE.test(file))
-        return true;
-    if (!OWNER_FILE.test(file) || declaration.getSourceFile().isDeclarationFile)
-        return false;
-    return declarationPure(env, declaration, root);
-};
-/** A global of the language or of the lib files is pure unless it reaches I/O. */
-const globalPure = (symbol) => !IO_GLOBALS.has(symbol.getName());
-/** Whether one identifier reference stays inside the pure surface. */
-const referencePure = (env, node, root) => {
-    const symbol = env.checker.getSymbolAtLocation(node);
-    if (!symbol)
-        return node.text === "undefined";
-    const target = (symbol.flags & ts.SymbolFlags.Alias) !== 0 ? env.checker.getAliasedSymbol(symbol) : symbol;
-    const declarations = target.declarations ?? [];
-    if (declarations.length === 0)
-        return node.text === "undefined";
-    return declarations.every((declaration) => {
-        const file = declaration.getSourceFile();
-        if (isInside(declaration, root))
-            return true;
-        if (!ts.isExternalModule(file))
-            return globalPure(target);
-        return foreignPure(env, declaration, root);
-    });
-};
-/** Walk a node: no await or yield, no impure reference; type positions are not behaviour. */
-const nodePure = (env, node, root) => {
-    if (ts.isAwaitExpression(node) || ts.isYieldExpression(node))
-        return false;
-    if (ts.isTypeNode(node) && !ts.isExpressionWithTypeArguments(node))
-        return true;
-    if (ts.isIdentifier(node) && !isNameOnly(node) && !referencePure(env, node, root))
-        return false;
-    return ts.forEachChild(node, (child) => (nodePure(env, child, root) ? undefined : true)) !== true;
-};
-/** A declaration is pure when its function (or its constant initialiser) is. */
-function declarationPure(env, declaration, _root) {
-    if (env.seen.has(declaration))
-        return true;
-    env.seen.add(declaration);
-    const fn = functionOf(declaration);
-    if (fn)
-        return !("asteriskToken" in fn && fn.asteriskToken) && !fn.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) && (fn.body ? nodePure(env, fn.body, fn) : false);
-    if (ts.isVariableDeclaration(declaration) && declaration.initializer)
-        return nodePure(env, declaration.initializer, declaration.initializer);
-    return false;
-}
-/** Whether a function's declared or inferred return type is text, null or undefined. */
-const returnsText = (checker, declaration) => {
-    const signature = checker.getSignaturesOfType(checker.getTypeAtLocation(declaration), ts.SignatureKind.Call)[0];
-    if (!signature)
-        return false;
-    const type = checker.getReturnTypeOfSignature(signature);
-    const parts = type.isUnion() ? type.types : [type];
-    return parts.every((part) => (part.flags & (ts.TypeFlags.StringLike | ts.TypeFlags.Null | ts.TypeFlags.Undefined)) !== 0);
-};
-/** A static table: a constant object whose leaves are string literals or plain templates. */
-const isStaticTable = (node) => {
-    const value = bare(node);
-    if (!value)
-        return false;
-    if (ts.isStringLiteralLike(value))
-        return true;
-    if (ts.isObjectLiteralExpression(value))
-        return value.properties.every((property) => ts.isPropertyAssignment(property) && isStaticTable(property.initializer));
-    return false;
-};
-/**
- * What an import of the callback's owner modules is: `"pure"` (a pure text-returning helper), `"routes"` (a static route table) or null.
- *
- * @param context - The ESLint rule context.
- * @param source - The import specifier.
- * @param name - The imported name.
- * @returns The kind.
- */
-export function ownerExportKind(context, source, name) {
-    const found = exportedDeclaration(context, source, name);
-    if (!found?.declaration)
-        return null;
-    const { checker, declaration } = found;
-    if (ts.isVariableDeclaration(declaration) && !functionOf(declaration))
-        return (declaration.parent.flags & ts.NodeFlags.Const) !== 0 && isStaticTable(declaration.initializer) ? "routes" : null;
-    const fn = functionOf(declaration);
-    const env = { checker, seen: new Set() };
-    return fn !== null && returnsText(checker, fn) && declarationPure(env, declaration, fn) ? "pure" : null;
-}

package/runtime/scripts/hfs/architecture/supabase-tables.mjs

@@ -1,50 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-
-const CACHE = new Map();
-
-/** A static TypeScript property name, as emitted by `supabase gen types typescript`. */
-const propertyName = (typescript, name) => (typescript.isIdentifier(name) || typescript.isStringLiteralLike(name) ? name.text : null);
-
-/** The type-literal members below property `name`, or null when the generated shape is not statically readable. */
-const propertyMembers = (typescript, members, name) => {
-  const property = members.find(member => typescript.isPropertySignature(member) && propertyName(typescript, member.name) === name);
-  return property?.type && typescript.isTypeLiteralNode(property.type) ? property.type.members : null;
-};
-
-function addTableNames(typescript, members, tables) {
-  if (!members) return;
-  for (const member of members) {
-    if (!typescript.isPropertySignature(member)) continue;
-    const name = propertyName(typescript, member.name);
-    if (name) tables.add(name.toLowerCase());
-  }
-}
-
-function readTableNames(typescript, file, tables) {
-  const source = typescript.createSourceFile(file, fs.readFileSync(file, 'utf8'), typescript.ScriptTarget.Latest, true, typescript.ScriptKind.TS);
-  if (source.parseDiagnostics.length !== 0) return;
-  const database = source.statements.find(statement => typescript.isTypeAliasDeclaration(statement) && statement.name.text === 'Database');
-  const databaseMembers = database && typescript.isTypeLiteralNode(database.type) ? database.type.members : null;
-  const publicMembers = databaseMembers ? propertyMembers(typescript, databaseMembers, 'public') : null;
-  const tableMembers = publicMembers ? propertyMembers(typescript, publicMembers, 'Tables') : null;
-  addTableNames(typescript, tableMembers, tables);
-}
-
-/**
- * The lower-case keys of `Database['public']['Tables']`, parsed with the architecture context's target compiler.
- * An absent, malformed or unreadable contract proves no table. The result is cached once per app root.
- */
-export function supabaseTablesOf(appRoot, typescript) {
-  const root = path.resolve(appRoot);
-  if (CACHE.has(root)) return CACHE.get(root);
-  const tables = new Set();
-  const file = path.join(root, 'supabase', 'types', 'database.types.ts');
-  try {
-    readTableNames(typescript, file, tables);
-  } catch {
-    // Missing and unreadable generated contracts are fail-closed: no table is proven.
-  }
-  CACHE.set(root, tables);
-  return tables;
-}