@starci/hfs 4.0.10 → 4.2.0

package/runtime/scripts/hfs/rules/deps.mjs

@@ -18,48 +18,80 @@ const HOISTED = /^node_modules\/((?:@[^/]+\/)?[^/]+)$/;
 /** Every package.json a repository tracks: the root and each workspace's. */
 const manifestsOf = (files) => files.filter((file) => file === 'package.json' || (file.endsWith('/package.json') && !file.includes('node_modules/')));
 
-/** The findings of R14 over the tracked paths `files` of `repoRoot`. */
-export function depFindings({ repoRoot, files }) {
-  const findings = [];
-  const specs = new Map();
-  for (const file of manifestsOf(files)) {
-    const pkg = readJson(repoRoot, file);
-    if (!pkg) continue;
-    for (const section of SECTIONS) {
-      for (const [name, spec] of Object.entries(pkg[section] ?? {})) {
-        if (typeof spec !== 'string' || LINK.test(spec)) continue;
-        if (!specs.has(name)) specs.set(name, new Map());
-        const at = specs.get(name);
-        if (!at.has(spec)) at.set(spec, []);
-        at.get(spec).push(file);
-      }
-    }
+function recordDependencySpec(specs, file, name, spec) {
+  if (typeof spec !== 'string' || LINK.test(spec)) return;
+  if (!specs.has(name)) specs.set(name, new Map());
+  const at = specs.get(name);
+  if (!at.has(spec)) at.set(spec, []);
+  at.get(spec).push(file);
+}
+
+function collectManifestSpecs(repoRoot, file, specs) {
+  const pkg = readJson(repoRoot, file);
+  if (!pkg) return;
+  for (const section of SECTIONS) {
+    for (const [name, spec] of Object.entries(pkg[section] ?? {})) recordDependencySpec(specs, file, name, spec);
   }
+}
+
+function versionSkewFindings(specs) {
+  const findings = [];
   for (const [name, bySpec] of specs) {
     if (bySpec.size < 2) continue;
     const list = [...bySpec].map(([spec, where]) => `${spec} (${where.join(', ')})`);
     findings.push(found(DEP_VERSION_SKEW, [...bySpec.values()][0][0], `${name} is declared at ${bySpec.size} versions in the workspace: ${list.join('; ')}; keep one`, { dependency: name, versions: [...bySpec.keys()] }));
   }
-  const overrides = readJson(repoRoot, 'package.json')?.overrides;
+  return findings;
+}
+
+function overrideFindings(specs, overrides) {
+  const findings = [];
   for (const [name, pin] of Object.entries(overrides && typeof overrides === 'object' ? overrides : {})) {
     if (typeof pin !== 'string' || pin.startsWith('$') || !specs.has(name)) continue;
     const off = [...specs.get(name)].filter(([spec]) => spec !== pin);
-    if (off.length) findings.push(found(DEP_VERSION_SKEW, off[0][1][0], `${name} is pinned to ${pin} by the root overrides but declared at ${off.map(([spec, where]) => `${spec} (${where.join(', ')})`).join('; ')}; declare the pinned version`, { dependency: name, versions: off.map(([spec]) => spec), pinned: pin }));
-  }
-  const lock = files.includes('package-lock.json') ? readJson(repoRoot, 'package-lock.json') : null;
-  if (lock?.packages) {
-    const declared = new Set(specs.keys());
-    const hoisted = new Map();
-    for (const [key, entry] of Object.entries(lock.packages)) {
-      const top = HOISTED.exec(key);
-      if (top && !entry.link) hoisted.set(top[1], entry.version);
-    }
-    for (const [key, entry] of Object.entries(lock.packages)) {
-      const nested = NESTED.exec(key);
-      if (!nested || entry.link || entry.inBundle || HOISTED.test(key) || !declared.has(nested[1])) continue;
-      const name = nested[1];
-      findings.push(found(DEP_VERSION_SKEW, 'package-lock.json', `${key} is a nested copy of ${name}${entry.version ? ` ${entry.version}` : ''}${hoisted.has(name) ? ` next to the hoisted ${hoisted.get(name)}` : ''}; the workspace keeps one copy (align the ranges or add a root override)`, { dependency: name, lockPath: key, version: entry.version }));
+    if (off.length) {
+      const declarations = off.map(([spec, where]) => `${spec} (${where.join(', ')})`).join('; ');
+      findings.push(found(DEP_VERSION_SKEW, off[0][1][0], `${name} is pinned to ${pin} by the root overrides but declared at ${declarations}; declare the pinned version`, { dependency: name, versions: off.map(([spec]) => spec), pinned: pin }));
     }
   }
   return findings;
 }
+
+/** The versions of the top-level (hoisted) packages of a lockfile, by package name. */
+function hoistedVersions(packages) {
+  const hoisted = new Map();
+  for (const [key, entry] of Object.entries(packages)) {
+    const top = HOISTED.exec(key);
+    if (top && !entry.link) hoisted.set(top[1], entry.version);
+  }
+  return hoisted;
+}
+
+/** The finding for a lockfile entry that nests a second copy of a declared dependency, or null. */
+function nestedCopyFinding(key, entry, declared, hoisted) {
+  const nested = NESTED.exec(key);
+  if (!nested || entry.link || entry.inBundle || HOISTED.test(key) || !declared.has(nested[1])) return null;
+  const name = nested[1];
+  const versionNote = entry.version ? ` ${entry.version}` : '';
+  const hoistedNote = hoisted.has(name) ? ` next to the hoisted ${hoisted.get(name)}` : '';
+  return found(DEP_VERSION_SKEW, 'package-lock.json', `${key} is a nested copy of ${name}${versionNote}${hoistedNote}; the workspace keeps one copy (align the ranges or add a root override)`, { dependency: name, lockPath: key, version: entry.version });
+}
+
+function nestedLockFindings(specs, lock) {
+  if (!lock?.packages) return [];
+  const declared = new Set(specs.keys());
+  const hoisted = hoistedVersions(lock.packages);
+  return Object.entries(lock.packages).map(([key, entry]) => nestedCopyFinding(key, entry, declared, hoisted)).filter(Boolean);
+}
+
+/** The findings of R14 over the tracked paths `files` of `repoRoot`. */
+export function depFindings({ repoRoot, files }) {
+  const specs = new Map();
+  for (const file of manifestsOf(files)) collectManifestSpecs(repoRoot, file, specs);
+  const findings = versionSkewFindings(specs);
+  const overrides = readJson(repoRoot, 'package.json')?.overrides;
+  findings.push(...overrideFindings(specs, overrides));
+  const lock = files.includes('package-lock.json') ? readJson(repoRoot, 'package-lock.json') : null;
+  findings.push(...nestedLockFindings(specs, lock));
+  return findings;
+}

package/runtime/scripts/hfs/rules/docker.mjs

@@ -78,49 +78,52 @@ function envOf(stage) {
   return env;
 }
 
+/** True when a header comment states `docker build -f <wanted> ... .`. */
+const statesBuildCommand = (parsed, wanted) => parsed.comments.some((comment) => {
+  const parts = words(comment.text);
+  const build = parts.findIndex((part, index) => part === 'docker' && parts[index + 1] === 'build');
+  if (build < 0) return false;
+  const flag = parts.indexOf('-f', build);
+  return flag > 0 && parts[flag + 1] === wanted && parts.at(-1) === '.';
+});
+
+function copySourceFindings(file, item) {
+  const findings = [];
+  const parts = words(item.text).filter((part) => !part.startsWith('--'));
+  const sources = parts.slice(0, -1);
+  const fromStage = words(item.text).some((part) => part.startsWith('--from='));
+  if (fromStage) return findings;
+  for (const source of sources) {
+    if (/^[a-z]+:\/\//i.test(source)) continue;
+    const segments = source.split('/');
+    if (source.startsWith('/') || segments.includes('..')) findings.push(found(DOCKER_BUILD_CONTEXT, file, `${file}:${item.line} ${item.keyword} source ${source} leaves the build context; every source is a path inside the app root.`, { line: item.line, source }));
+  }
+  return findings;
+}
+
 /** R187: the header states this app's build command, and the build never reaches outside its context. */
 function contextFindings(file, parsed, side, app) {
   const findings = [];
   const wanted = dockerfilePath(side, app);
-  const named = parsed.comments.some((comment) => {
-    const parts = words(comment.text);
-    const build = parts.findIndex((part, index) => part === 'docker' && parts[index + 1] === 'build');
-    if (build < 0) return false;
-    const flag = parts.indexOf('-f', build);
-    return flag > 0 && parts[flag + 1] === wanted && parts.at(-1) === '.';
-  });
-  if (!named) findings.push(found(DOCKER_BUILD_CONTEXT, file, `${file} does not state its build command in a header comment: \`docker build -f ${wanted} -t <image> .\` (the context is the app root, the folder with the one package.json and lockfile).`, { expected: wanted }));
-  for (const item of parsed.instructions.filter((entry) => entry.keyword === 'COPY' || entry.keyword === 'ADD')) {
-    const parts = words(item.text).filter((part) => !part.startsWith('--'));
-    const sources = parts.slice(0, -1);
-    const fromStage = words(item.text).some((part) => part.startsWith('--from='));
-    if (fromStage) continue;
-    for (const source of sources) {
-      if (/^[a-z]+:\/\//i.test(source)) continue;
-      const segments = source.split('/');
-      if (source.startsWith('/') || segments.includes('..')) findings.push(found(DOCKER_BUILD_CONTEXT, file, `${file}:${item.line} ${item.keyword} source ${source} leaves the build context; every source is a path inside the app root.`, { line: item.line, source }));
-    }
-  }
+  if (!statesBuildCommand(parsed, wanted)) findings.push(found(DOCKER_BUILD_CONTEXT, file, `${file} does not state its build command in a header comment: \`docker build -f ${wanted} -t <image> .\` (the context is the app root, the folder with the one package.json and lockfile).`, { expected: wanted }));
+  for (const item of parsed.instructions.filter((entry) => entry.keyword === 'COPY' || entry.keyword === 'ADD')) findings.push(...copySourceFindings(file, item));
   return findings;
 }
 
 /** R188: the stages and the install, the user and the build discipline of each. */
-function stageFindings(file, parsed, side, kind) {
+function stageInstallFindings(file, stages) {
   const findings = [];
-  const { stages } = parsed;
-  const names = stages.map((stage) => stage.name);
-  if (!names.includes(BUILD_STAGE) || stages.at(-1)?.name !== RUNTIME_STAGE || stages.length < 2) {
-    findings.push(found(DOCKER_STAGES, file, `${file} has stages ${JSON.stringify(names)}; an image is multi-stage: a stage named ${BUILD_STAGE} (installs and builds) and a last stage named ${RUNTIME_STAGE} (what ships).`, { stages: names }));
-    if (!stages.length) return findings;
-  }
   for (const stage of stages) {
     for (const command of commandsOf(stage)) {
       const call = npmCall(command.words);
       if (call && (call.verb === 'install' || call.verb === 'i') && !call.args.some((arg) => arg === '-g' || arg === '--global')) findings.push(found(DOCKER_STAGES, file, `${file}:${command.line} runs \`npm ${call.verb}\`; an image installs with \`npm ci\` from the lockfile.`, { line: command.line }));
     }
   }
-  const runtime = stages.at(-1);
-  if (runtime.name !== RUNTIME_STAGE) return findings;
+  return findings;
+}
+
+function runtimeStageFindings(file, runtime, side, kind) {
+  const findings = [];
   for (const command of commandsOf(runtime)) {
     if (isBuildCommand(command.words)) findings.push(found(DOCKER_STAGES, file, `${file}:${command.line} the ${RUNTIME_STAGE} stage runs the build (\`${command.words.join(' ')}\`); it only receives what the ${BUILD_STAGE} stage built.`, { line: command.line }));
   }
@@ -132,43 +135,79 @@ function stageFindings(file, parsed, side, kind) {
   return findings;
 }
 
+function stageFindings(file, parsed, side, kind) {
+  const findings = [];
+  const { stages } = parsed;
+  const names = stages.map((stage) => stage.name);
+  if (!names.includes(BUILD_STAGE) || stages.at(-1)?.name !== RUNTIME_STAGE || stages.length < 2) {
+    findings.push(found(DOCKER_STAGES, file, `${file} has stages ${JSON.stringify(names)}; an image is multi-stage: a stage named ${BUILD_STAGE} (installs and builds) and a last stage named ${RUNTIME_STAGE} (what ships).`, { stages: names }));
+    if (!stages.length) return findings;
+  }
+  findings.push(...stageInstallFindings(file, stages));
+  const runtime = stages.at(-1);
+  if (runtime.name !== RUNTIME_STAGE) return findings;
+  findings.push(...runtimeStageFindings(file, runtime, side, kind));
+  return findings;
+}
+
 /** The Next config's `output` property, read with TypeScript's parser: the string literal assigned to `output` in an object literal. */
 function nextOutput(ts, text) {
   return propertyText(ts, text, { file: 'next.config.ts', key: 'output' });
 }
 
+function listenerHealthFindings(file, runtime, exposes, health, none) {
+  const findings = [];
+  const port = envOf(runtime).get('PORT');
+  if (!port || !exposes.includes(port)) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage must set \`ENV PORT=<port>\` and \`EXPOSE\` the same port (found PORT ${JSON.stringify(port ?? null)}, EXPOSE ${JSON.stringify(exposes)}); a listening app declares the port it serves.`, { port: port ?? null, exposes }));
+  if (!health.length || none) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage has no HEALTHCHECK; an api or Next app answers a health probe the platform can run.`, {}));
+  return findings;
+}
+
+function oneShotHealthFindings(file, kind, exposes, none) {
+  const findings = [];
+  if (!none) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage must say \`HEALTHCHECK NONE\`; a ${kind} app is a one-shot command, not a service.`, { kind }));
+  if (exposes.length) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage EXPOSEs ${exposes.join(', ')}; a ${kind} app listens on nothing.`, { exposes }));
+  return findings;
+}
+
+function processHealthFindings(file, kind, exposes, health, none) {
+  const findings = [];
+  if (!health.length || none) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage has no process HEALTHCHECK; a ${kind} app serves nothing, so its healthcheck probes its process.`, { kind }));
+  if (exposes.length) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage EXPOSEs ${exposes.join(', ')}; a ${kind} app listens on nothing.`, { exposes }));
+  return findings;
+}
+
+function entryHealthFindings(file, runtime, side, kind, exposes, health, none) {
+  if (side === 'fe' || BE_KINDS_WITH_LISTENER.has(kind)) return listenerHealthFindings(file, runtime, exposes, health, none);
+  if (BE_KINDS_ONE_SHOT.has(kind)) return oneShotHealthFindings(file, kind, exposes, none);
+  return processHealthFindings(file, kind, exposes, health, none);
+}
+
+function nextEntryFindings({ repoRoot, file, parsed, app, project, ts }) {
+  const findings = [];
+  const build = parsed.stages.find((stage) => stage.name === BUILD_STAGE);
+  const filter = `--filter=@${project}/${app}`;
+  const builds = build && commandsOf(build).some((command) => command.words.some((word) => word === 'turbo' || word.endsWith('/turbo')) && command.words.includes('build') && command.words.includes(filter));
+  if (!builds) findings.push(found(DOCKER_ENTRY, file, `${file} ${BUILD_STAGE} stage does not run \`turbo run build ${filter}\`; a Next image builds its own workspace (and the packages it imports) through turbo.`, { expected: filter }));
+  const config = `fe/apps/${app}/next.config.ts`;
+  const text = readText(repoRoot, config);
+  if (text !== null && ts && nextOutput(ts, text) !== 'standalone') findings.push(found(DOCKER_ENTRY, config, `${config} does not set \`output: "standalone"\`; the runtime stage of ${file} ships the standalone output.`, { expected: 'standalone' }));
+  return findings;
+}
+
 /** R189: the entry, the port and the health of the runtime. */
 function entryFindings({ repoRoot, file, parsed, side, app, kind, project, ts }) {
   const findings = [];
   const runtime = parsed.stages.at(-1);
-  if (!runtime || runtime.name !== RUNTIME_STAGE) return findings;
+  if (runtime?.name !== RUNTIME_STAGE) return findings;
   const entry = side === 'be' ? beEntry(app) : feEntry(app);
   const starts = [...instructionsOf(runtime, 'ENTRYPOINT'), ...instructionsOf(runtime, 'CMD')].map((item) => execForm(item.text));
-  if (!starts.some((exec) => exec && exec[0] === 'node' && exec[1] === entry)) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage does not start \`["node", "${entry}"]\` in exec form (CMD or ENTRYPOINT); the app runs its own built entry.`, { expected: entry }));
+  if (!starts.some((exec) => exec?.[0] === 'node' && exec[1] === entry)) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage does not start \`["node", "${entry}"]\` in exec form (CMD or ENTRYPOINT); the app runs its own built entry.`, { expected: entry }));
   const exposes = instructionsOf(runtime, 'EXPOSE').flatMap((item) => words(item.text).map((port) => port.replace(/\/(tcp|udp)$/i, '')));
   const health = instructionsOf(runtime, 'HEALTHCHECK').map((item) => words(item.text));
   const none = health.some((parts) => parts[0]?.toUpperCase() === 'NONE');
-  const listens = side === 'fe' || BE_KINDS_WITH_LISTENER.has(kind);
-  if (listens) {
-    const port = envOf(runtime).get('PORT');
-    if (!port || !exposes.includes(port)) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage must set \`ENV PORT=<port>\` and \`EXPOSE\` the same port (found PORT ${JSON.stringify(port ?? null)}, EXPOSE ${JSON.stringify(exposes)}); a listening app declares the port it serves.`, { port: port ?? null, exposes }));
-    if (!health.length || none) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage has no HEALTHCHECK; an api or Next app answers a health probe the platform can run.`, {}));
-  } else if (BE_KINDS_ONE_SHOT.has(kind)) {
-    if (!none) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage must say \`HEALTHCHECK NONE\`; a ${kind} app is a one-shot command, not a service.`, { kind }));
-    if (exposes.length) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage EXPOSEs ${exposes.join(', ')}; a ${kind} app listens on nothing.`, { exposes }));
-  } else {
-    if (!health.length || none) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage has no process HEALTHCHECK; a ${kind} app serves nothing, so its healthcheck probes its process.`, { kind }));
-    if (exposes.length) findings.push(found(DOCKER_ENTRY, file, `${file} ${RUNTIME_STAGE} stage EXPOSEs ${exposes.join(', ')}; a ${kind} app listens on nothing.`, { exposes }));
-  }
-  if (side === 'fe') {
-    const build = parsed.stages.find((stage) => stage.name === BUILD_STAGE);
-    const filter = `--filter=@${project}/${app}`;
-    const builds = build && commandsOf(build).some((command) => command.words.includes('turbo') && command.words.includes('build') && command.words.includes(filter));
-    if (!builds) findings.push(found(DOCKER_ENTRY, file, `${file} ${BUILD_STAGE} stage does not run \`turbo run build ${filter}\`; a Next image builds its own workspace (and the packages it imports) through turbo.`, { expected: filter }));
-    const config = `fe/apps/${app}/next.config.ts`;
-    const text = readText(repoRoot, config);
-    if (text !== null && ts && nextOutput(ts, text) !== 'standalone') findings.push(found(DOCKER_ENTRY, config, `${config} does not set \`output: "standalone"\`; the runtime stage of ${file} ships the standalone output.`, { expected: 'standalone' }));
-  }
+  findings.push(...entryHealthFindings(file, runtime, side, kind, exposes, health, none));
+  if (side === 'fe') findings.push(...nextEntryFindings({ repoRoot, file, parsed, app, project, ts }));
   return findings;
 }
 
@@ -180,7 +219,7 @@ function resolvedImage(parsed, image) {
     if (name && rest.length) defaults.set(name, rest.join('='));
   }
   let unresolved = false;
-  const text = image.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (whole, braced, bare) => {
+  const text = image.replace(/\$\{([A-Za-z_]\w*)\}|\$([A-Za-z_]\w*)/g, (whole, braced, bare) => {
     const value = defaults.get(braced ?? bare);
     if (value === undefined) unresolved = true;
     return value ?? whole;
@@ -209,23 +248,32 @@ const isSecretPath = (source) => {
   return env || segments.some((segment) => SECRET_FOLDERS.has(segment)) || SECRET_SUFFIXES.some((suffix) => base.endsWith(suffix)) || base.startsWith('kubeconfig');
 };
 
+function copySecretFindings(file, item) {
+  const findings = [];
+  const parts = words(item.text);
+  if (parts.some((part) => part.startsWith('--from='))) return findings;
+  const sources = parts.filter((part) => !part.startsWith('--')).slice(0, -1);
+  for (const source of sources) {
+    if (/^https?:\/\//i.test(source)) findings.push(found(DOCKER_SECRETS, file, `${file}:${item.line} ADD of a URL (${source}); a download is a checksum-verified stage, never an ADD.`, { line: item.line, source }));
+    else if (isSecretPath(source)) findings.push(found(DOCKER_SECRETS, file, `${file}:${item.line} ${item.keyword} of ${source}, which holds secret material; credentials are mounted at run time, never copied into an image.`, { line: item.line, source }));
+  }
+  return findings;
+}
+
+function variableSecretFindings(file, item) {
+  const findings = [];
+  const parts = words(item.text);
+  const names = item.keyword === 'ENV' && parts.length >= 2 && !parts[0].includes('=') ? [parts[0]] : parts.map((part) => part.split('=')[0]);
+  for (const name of names) if (isCredentialName(name)) findings.push(found(DOCKER_SECRETS, file, `${file}:${item.line} ${item.keyword} ${name} names a credential; an image carries none (an ARG or ENV stays in the image history). Mount it at run time; only NEXT_PUBLIC_* values, which are published by design, are build arguments.`, { line: item.line, name }));
+  return findings;
+}
+
 /** R191: no secret enters an image. */
 function secretFindings(file, parsed) {
   const findings = [];
   for (const item of parsed.instructions) {
-    if (item.keyword === 'COPY' || item.keyword === 'ADD') {
-      const parts = words(item.text);
-      if (parts.some((part) => part.startsWith('--from='))) continue;
-      const sources = parts.filter((part) => !part.startsWith('--')).slice(0, -1);
-      for (const source of sources) {
-        if (/^https?:\/\//i.test(source)) findings.push(found(DOCKER_SECRETS, file, `${file}:${item.line} ADD of a URL (${source}); a download is a checksum-verified stage, never an ADD.`, { line: item.line, source }));
-        else if (isSecretPath(source)) findings.push(found(DOCKER_SECRETS, file, `${file}:${item.line} ${item.keyword} of ${source}, which holds secret material; credentials are mounted at run time, never copied into an image.`, { line: item.line, source }));
-      }
-    } else if (item.keyword === 'ARG' || item.keyword === 'ENV') {
-      const parts = words(item.text);
-      const names = item.keyword === 'ENV' && parts.length >= 2 && !parts[0].includes('=') ? [parts[0]] : parts.map((part) => part.split('=')[0]);
-      for (const name of names) if (isCredentialName(name)) findings.push(found(DOCKER_SECRETS, file, `${file}:${item.line} ${item.keyword} ${name} names a credential; an image carries none (an ARG or ENV stays in the image history). Mount it at run time; only NEXT_PUBLIC_* values, which are published by design, are build arguments.`, { line: item.line, name }));
-    }
+    if (item.keyword === 'COPY' || item.keyword === 'ADD') findings.push(...copySecretFindings(file, item));
+    else if (item.keyword === 'ARG' || item.keyword === 'ENV') findings.push(...variableSecretFindings(file, item));
   }
   return findings;
 }

package/runtime/scripts/hfs/rules/edition.mjs

@@ -1,111 +1,118 @@
-// edition.mjs - L01, the edition rule. An hfs.json edition is `full` or `lite` (absent means full); under lite the standard is a
-// filter plus a few additions over the same manifest, never a second engine. The slot layer already answers the paths lite
-// removed (slots lite excludes, or whose litePresence is forbidden, come back HFS_FORBIDDEN_PRESENT with their goesTo); this
-// rule reports what no path can state:
-//   - inside a package.json: a test script (`test`, `test:*`, `typecheck:tests`, a jest/vitest/playwright/mocha/cypress or
-//     `node --test` command) or a jest/vitest/playwright dependency - the same vocabulary FE_NO_TESTS scans on the fe side;
-//   - a test-tool configuration file no more specific slot already forbids;
-//   - a declaration of what lite does not have: a worker app, an event pattern (event-bus, queue, fenced-job, projection,
-//     saga) or its trigger kinds (saga, reactors, jobs, realtime). The forbidden names are DERIVED - a pattern, trigger or
-//     app kind is gone under lite exactly when every slot that carries it is litePresence: forbidden - so adding or
-//     restoring a kind is a manifest edit, not an edit here.
-// The edition is never tested here: a full app's view forbids none of these names and keeps its tests, so the rule answers [].
-import { found, readJson } from './read.mjs';
-import { DEPENDENCY_SECTIONS, TEST_DEPENDENCY, TEST_RUNNER_COMMAND, TEST_SCRIPT_NAME, TEST_TOOL_FILE } from './fe-no-tests.mjs';
-
-export const HFS_EDITION_FORBIDDEN_PRESENT = 'HFS_EDITION_FORBIDDEN_PRESENT';
-
-const PACKAGE_JSON = /(?:^|\/)package\.json$/;
-const TYPECHECK_TESTS = /^(?:pre|post)?typecheck:tests$/;
-
-/**
- * The names the edition cannot declare: for each of `pattern`, `trigger` and `appKind`, the value is gone when every slot of
- * the resolver's view that carries it is forbidden there. The view is the edition's own (full forbids none of them), so the
- * rule needs no edition test: a full app has nothing gone.
- */
-function editionGone(resolver) {
-  const tally = new Map();
-  for (const slot of resolver.slots()) {
-    const forbidden = slot.presence === 'forbidden';
-    for (const field of ['pattern', 'trigger', 'appKind']) {
-      if (slot[field] === undefined) continue;
-      const key = `${field}:${slot[field]}`;
-      const entry = tally.get(key) ?? { total: 0, forbidden: 0 };
-      entry.total += 1;
-      entry.forbidden += forbidden ? 1 : 0;
-      tally.set(key, entry);
-    }
-  }
-  const gone = { pattern: new Set(), trigger: new Set(), appKind: new Set() };
-  for (const [key, entry] of tally) {
-    if (entry.total !== entry.forbidden) continue;
-    const [field, name] = key.split(':');
-    gone[field].add(name);
-  }
-  return gone;
-}
-
-/** The findings one package.json's scripts and dependencies produce under lite. */
-function packageFindings(repoRoot, rel) {
-  const pkg = readJson(repoRoot, rel);
-  if (pkg === null || typeof pkg !== 'object' || Array.isArray(pkg)) return [];
-  const findings = [];
-  const scripts = typeof pkg.scripts === 'object' && pkg.scripts !== null && !Array.isArray(pkg.scripts) ? pkg.scripts : {};
-  for (const [name, command] of Object.entries(scripts)) {
-    if (TEST_SCRIPT_NAME.test(name) || TYPECHECK_TESTS.test(name) || TEST_RUNNER_COMMAND.test(String(command))) {
-      findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} has script ${JSON.stringify(name)}: the lite edition has no tests - a lite app does not typecheck or run a test world`, { name }));
-    }
-  }
-  for (const section of DEPENDENCY_SECTIONS) {
-    const deps = pkg[section];
-    if (typeof deps !== 'object' || deps === null || Array.isArray(deps)) continue;
-    for (const name of Object.keys(deps)) {
-      if (TEST_DEPENDENCY.test(name)) {
-        findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} ${section} has ${name}: the lite edition has no tests - the dependency belongs to the full edition`, { section, name }));
-      }
-    }
-  }
-  return findings;
-}
-
-/** The findings one be-side declaration produces under lite: a worker app, an event pattern or a gone trigger kind. */
-function declarationFindings(repo, gone) {
-  const findings = [];
-  for (const app of repo.apps ?? []) {
-    if (gone.appKind.has(app.kind)) {
-      findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, 'hfs.json', `hfs.json declares the ${app.kind} app ${app.name}: a ${app.kind} belongs to the full edition, a lite app has none`, { app: app.name, kind: app.kind }));
-    }
-  }
-  for (const [field, goneNames] of [['pattern', gone.pattern], ['trigger', gone.trigger]]) {
-    const declared = field === 'pattern' ? (repo.patterns ?? []) : (repo.kinds ?? []);
-    for (const name of declared) {
-      if (goneNames.has(name)) {
-        findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, 'hfs.json', `hfs.json ${field === 'pattern' ? 'declares' : 'names'} the ${name} ${field}: ${name} belongs to the full edition, a lite app has none`, { name }));
-      }
-    }
-  }
-  return findings;
-}
-
-/**
- * L01 for one scope (the app root or one side), over `files` (scope-relative). Both questions are answered by the
- * resolver's view of the edition: the names gone from it, and whether any slot of it still has tests. The declaration
- * findings are judged from the be side (its apps, patterns and kinds): the root scope looks at sides.be, a standalone
- * be-side check at its own view. `withDeclaration: false` (a side scope of a whole-app check) skips them: the root scope
- * already reported them on hfs.json, and the side scope would only repeat them on a path that is not this side's.
- */
-export function editionFindings({ repoRoot, files, repo, resolver, withDeclaration = true }) {
-  const gone = editionGone(resolver);
-  const noTestWorld = resolver.slots().every((slot) => slot.tests === 'none');
-  const beView = !withDeclaration ? null : (repo.profile === 'app' ? repo.sides?.be : (repo.profile === 'be' ? repo : null));
-  const findings = beView ? declarationFindings(beView, gone) : [];
-  for (const file of noTestWorld ? files : []) {
-    if (file.includes('node_modules/')) continue;
-    if (PACKAGE_JSON.test(file)) {
-      findings.push(...packageFindings(repoRoot, file));
-    } else if (TEST_TOOL_FILE.test(file) && resolver.classifyPath(file).status !== 'forbidden') {
-      findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, file, `${file} is test tooling: the lite edition has no tests - the file belongs to the full edition`));
-    }
-  }
-  return findings;
-}
+// edition.mjs - L01, the edition rule. An hfs.json edition is `full` or `lite` (absent means full); under lite the standard is a
+// filter plus a few additions over the same manifest, never a second engine. The slot layer already answers the paths lite
+// removed (slots lite excludes, or whose litePresence is forbidden, come back HFS_FORBIDDEN_PRESENT with their goesTo); this
+// rule reports what no path can state:
+//   - inside a package.json: a test script (`test`, `test:*`, `typecheck:tests`, a jest/vitest/playwright/mocha/cypress or
+//     `node --test` command) or a jest/vitest/playwright dependency - the same vocabulary FE_NO_TESTS scans on the fe side;
+//   - a test-tool configuration file no more specific slot already forbids;
+//   - a declaration of what lite does not have: a worker app, an event pattern (event-bus, queue, fenced-job, projection,
+//     saga) or its trigger kinds (saga, reactors, jobs, realtime). The forbidden names are DERIVED - a pattern, trigger or
+//     app kind is gone under lite exactly when every slot that carries it is litePresence: forbidden - so adding or
+//     restoring a kind is a manifest edit, not an edit here.
+// The edition is never tested here: a full app's view forbids none of these names and keeps its tests, so the rule answers [].
+import { found, readJson } from './read.mjs';
+import { DEPENDENCY_SECTIONS, TEST_DEPENDENCY, TEST_RUNNER_COMMAND, TEST_SCRIPT_NAME, TEST_TOOL_FILE } from './fe-no-tests.mjs';
+
+export const HFS_EDITION_FORBIDDEN_PRESENT = 'HFS_EDITION_FORBIDDEN_PRESENT';
+
+const PACKAGE_JSON = /(?:^|\/)package\.json$/;
+const TYPECHECK_TESTS = /^(?:pre|post)?typecheck:tests$/;
+
+/**
+ * The names the edition cannot declare: for each of `pattern`, `trigger` and `appKind`, the value is gone when every slot of
+ * the resolver's view that carries it is forbidden there. The view is the edition's own (full forbids none of them), so the
+ * rule needs no edition test: a full app has nothing gone.
+ */
+function editionGone(resolver) {
+  const tally = new Map();
+  for (const slot of resolver.slots()) {
+    const forbidden = slot.presence === 'forbidden';
+    for (const field of ['pattern', 'trigger', 'appKind']) {
+      if (slot[field] === undefined) continue;
+      const key = `${field}:${slot[field]}`;
+      const entry = tally.get(key) ?? { total: 0, forbidden: 0 };
+      entry.total += 1;
+      entry.forbidden += forbidden ? 1 : 0;
+      tally.set(key, entry);
+    }
+  }
+  const gone = { pattern: new Set(), trigger: new Set(), appKind: new Set() };
+  for (const [key, entry] of tally) {
+    if (entry.total !== entry.forbidden) continue;
+    const [field, name] = key.split(':');
+    gone[field].add(name);
+  }
+  return gone;
+}
+
+const isPlainObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+
+function testScriptFindings(rel, pkg) {
+  const scripts = isPlainObject(pkg.scripts) ? pkg.scripts : {};
+  return Object.entries(scripts)
+    .filter(([name, command]) => TEST_SCRIPT_NAME.test(name) || TYPECHECK_TESTS.test(name) || TEST_RUNNER_COMMAND.test(String(command)))
+    .map(([name]) => found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} has script ${JSON.stringify(name)}: the lite edition has no tests - a lite app does not typecheck or run a test world`, { name }));
+}
+
+function testDependencyFindings(rel, pkg) {
+  const findings = [];
+  for (const section of DEPENDENCY_SECTIONS) {
+    const deps = pkg[section];
+    if (!isPlainObject(deps)) continue;
+    for (const name of Object.keys(deps)) {
+      if (TEST_DEPENDENCY.test(name)) {
+        findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} ${section} has ${name}: the lite edition has no tests - the dependency belongs to the full edition`, { section, name }));
+      }
+    }
+  }
+  return findings;
+}
+
+/** The findings one package.json's scripts and dependencies produce under lite. */
+function packageFindings(repoRoot, rel) {
+  const pkg = readJson(repoRoot, rel);
+  if (!isPlainObject(pkg)) return [];
+  return [...testScriptFindings(rel, pkg), ...testDependencyFindings(rel, pkg)];
+}
+
+const goneAppFindings = (repo, gone) => (repo.apps ?? [])
+  .filter((app) => gone.appKind.has(app.kind))
+  .map((app) => found(HFS_EDITION_FORBIDDEN_PRESENT, 'hfs.json', `hfs.json declares the ${app.kind} app ${app.name}: a ${app.kind} belongs to the full edition, a lite app has none`, { app: app.name, kind: app.kind }));
+
+const goneNameFindings = (field, verb, declared, goneNames) => declared
+  .filter((name) => goneNames.has(name))
+  .map((name) => found(HFS_EDITION_FORBIDDEN_PRESENT, 'hfs.json', `hfs.json ${verb} the ${name} ${field}: ${name} belongs to the full edition, a lite app has none`, { name }));
+
+/** The findings one be-side declaration produces under lite: a worker app, an event pattern or a gone trigger kind. */
+function declarationFindings(repo, gone) {
+  return [
+    ...goneAppFindings(repo, gone),
+    ...goneNameFindings('pattern', 'declares', repo.patterns ?? [], gone.pattern),
+    ...goneNameFindings('trigger', 'names', repo.kinds ?? [], gone.trigger),
+  ];
+}
+
+/**
+ * L01 for one scope (the app root or one side), over `files` (scope-relative). Both questions are answered by the
+ * resolver's view of the edition: the names gone from it, and whether any slot of it still has tests. The declaration
+ * findings are judged from the be side (its apps, patterns and kinds): the root scope looks at sides.be, a standalone
+ * be-side check at its own view. `withDeclaration: false` (a side scope of a whole-app check) skips them: the root scope
+ * already reported them on hfs.json, and the side scope would only repeat them on a path that is not this side's.
+ */
+export function editionFindings({ repoRoot, files, repo, resolver, withDeclaration = true }) {
+  const gone = editionGone(resolver);
+  const noTestWorld = resolver.slots().every((slot) => slot.tests === 'none');
+  let beView = null;
+  if (withDeclaration && repo.profile === 'app') beView = repo.sides?.be;
+  else if (withDeclaration && repo.profile === 'be') beView = repo;
+  const findings = beView ? declarationFindings(beView, gone) : [];
+  for (const file of noTestWorld ? files : []) {
+    if (file.includes('node_modules/')) continue;
+    if (PACKAGE_JSON.test(file)) {
+      findings.push(...packageFindings(repoRoot, file));
+    } else if (TEST_TOOL_FILE.test(file) && resolver.classifyPath(file).status !== 'forbidden') {
+      findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, file, `${file} is test tooling: the lite edition has no tests - the file belongs to the full edition`));
+    }
+  }
+  return findings;
+}