@starci/hfs 4.11.21 → 4.12.0

package/runtime/scripts/hfs/rules/kinds.mjs

@@ -9,110 +9,117 @@
 import { loadSlotManifest, ruleParams } from '../slots.mjs';
 import { found } from './read.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
-
 const KIND_DECLARATION = 'BE_KIND_DECLARATION';
 const KIND_EMPTY = 'BE_KIND_EMPTY';
-
 const FEATURES = 'be/src/features/';
 const CLI = 'cli';
-
 let memo;
 /** The manifest facts the rules read: the trigger kinds, the patterns each kind needs, and the platform capability folders of each pattern. */
 const facts = () => {
-  if (memo) return memo;
-  const manifest = loadSlotManifest();
-  const platform = new Map();
-  for (const slot of manifest.slots) {
-    if (slot.pattern === undefined || slot.tier !== 'platform' || !slot.profiles.includes('be')) continue;
-    const folder = /^src\/modules\/platform\/([a-z][a-z0-9-]*)\/$/.exec(slot.path);
-    if (!folder) continue;
-    if (!platform.has(slot.pattern)) platform.set(slot.pattern, []);
-    platform.get(slot.pattern).push(folder[1]);
-  }
-  memo = { triggerKinds: manifest.triggerKinds ?? [], kindPatterns: ruleParams(manifest, 'be').kindPatterns, platform };
-  return memo;
+    if (memo)
+        return memo;
+    const manifest = loadSlotManifest();
+    const platform = new Map();
+    for (const slot of manifest.slots) {
+        if (slot.pattern === undefined || slot.tier !== 'platform' || !slot.profiles.includes('be'))
+            continue;
+        const folder = /^src\/modules\/platform\/([a-z][a-z0-9-]*)\/$/.exec(slot.path);
+        if (!folder)
+            continue;
+        if (!platform.has(slot.pattern))
+            platform.set(slot.pattern, []);
+        platform.get(slot.pattern).push(folder[1]);
+    }
+    memo = { triggerKinds: manifest.triggerKinds ?? [], kindPatterns: ruleParams(manifest, 'be').kindPatterns, platform };
+    return memo;
 };
-
 /** The path parts below the features root of a file inside a known kind folder, else null. */
 function kindPathParts(file, kindFolders) {
-  if (!file.startsWith(FEATURES)) return null;
-  const rest = file.slice(FEATURES.length).split('/');
-  return rest.length < 2 || !kindFolders.has(rest[0]) ? null : rest;
+    if (!file.startsWith(FEATURES))
+        return null;
+    const rest = file.slice(FEATURES.length).split('/');
+    return rest.length < 2 || !kindFolders.has(rest[0]) ? null : rest;
 }
-
 function kindUsageOf(files, kindFolders) {
-  const findings = [];
-  const instances = new Map();
-  const sources = new Map();
-  const roots = new Set();
-  for (const file of files) {
-    const rest = kindPathParts(file, kindFolders);
-    if (!rest) continue;
-    const [first, second] = rest;
-    if (first === CLI) { roots.add(CLI); continue; }
-    if (rest.length === 2) {
-      findings.push(found(KIND_EMPTY, file, `${file} sits directly in the kind folder ${FEATURES}${first}/, which holds only instance folders (${first}/<name>/); an empty kind folder is never kept: run \`starci app add\` to create the first member.`, { kind: first }));
-      continue;
+    const findings = [];
+    const instances = new Map();
+    const sources = new Map();
+    const roots = new Set();
+    for (const file of files) {
+        const rest = kindPathParts(file, kindFolders);
+        if (!rest)
+            continue;
+        const [first, second] = rest;
+        if (first === CLI) {
+            roots.add(CLI);
+            continue;
+        }
+        if (rest.length === 2) {
+            findings.push(found(KIND_EMPTY, file, `${file} sits directly in the kind folder ${FEATURES}${first}/, which holds only instance folders (${first}/<name>/); an empty kind folder is never kept: run \`starci app add\` to create the first member.`, { kind: first }));
+            continue;
+        }
+        if (!instances.has(first))
+            instances.set(first, new Set());
+        instances.get(first).add(second);
+        const key = `${first}/${second}`;
+        sources.set(key, (sources.get(key) ?? 0) + (/\.[cm]?tsx?$/.test(file) ? 1 : 0));
     }
-    if (!instances.has(first)) instances.set(first, new Set());
-    instances.get(first).add(second);
-    const key = `${first}/${second}`;
-    sources.set(key, (sources.get(key) ?? 0) + (/\.[cm]?tsx?$/.test(file) ? 1 : 0));
-  }
-  return { findings, instances, sources, roots };
+    return { findings, instances, sources, roots };
 }
-
 function emptyInstanceFindings(sources) {
-  const findings = [];
-  for (const [key, count] of sources) {
-    if (count === 0) findings.push(found(KIND_EMPTY, `${FEATURES}${key}/`, `${FEATURES}${key}/ holds no TypeScript source: a kind member without code is an empty folder; add its files with \`starci app add\` or remove the folder.`, { kind: key.split('/')[0] }));
-  }
-  return findings;
+    const findings = [];
+    for (const [key, count] of sources) {
+        if (count === 0)
+            findings.push(found(KIND_EMPTY, `${FEATURES}${key}/`, `${FEATURES}${key}/ holds no TypeScript source: a kind member without code is an empty folder; add its files with \`starci app add\` or remove the folder.`, { kind: key.split('/')[0] }));
+    }
+    return findings;
 }
-
 function undeclaredKindFindings(present, declared) {
-  const findings = [];
-  for (const kind of [...present].sort(byCodeUnit)) {
-    if (!declared.has(kind)) findings.push(found(KIND_DECLARATION, 'hfs.json', `hfs.json sides.be.kinds does not declare the kind \`${kind}\`, which ${FEATURES}${kind}/ uses; declare every kind in use (\`starci app add\` registers it).`, { kind }));
-  }
-  return findings;
+    const findings = [];
+    for (const kind of [...present].sort(byCodeUnit)) {
+        if (!declared.has(kind))
+            findings.push(found(KIND_DECLARATION, 'hfs.json', `hfs.json sides.be.kinds does not declare the kind \`${kind}\`, which ${FEATURES}${kind}/ uses; declare every kind in use (\`starci app add\` registers it).`, { kind }));
+    }
+    return findings;
 }
-
 function kindPatternFindings(kind, { kindPatterns, patterns, platform, tracked }) {
-  const findings = [];
-  for (const pattern of kindPatterns[kind] ?? []) {
-    if (!patterns.has(pattern)) findings.push(found(KIND_DECLARATION, 'hfs.json', `the kind \`${kind}\` needs the pattern \`${pattern}\`, which hfs.json sides.be.patterns does not declare.`, { kind, pattern }));
-    for (const capability of platform.get(pattern) ?? []) {
-      if (!tracked.has(`be/src/modules/platform/${capability}/index.ts`)) findings.push(found(KIND_DECLARATION, `be/src/modules/platform/${capability}/`, `the kind \`${kind}\` needs the platform capability \`${capability}\` (pattern ${pattern}), which is not tracked at be/src/modules/platform/${capability}/; \`starci app add\` generates it with the first member of the kind.`, { kind, pattern, capability }));
+    const findings = [];
+    for (const pattern of kindPatterns[kind] ?? []) {
+        if (!patterns.has(pattern))
+            findings.push(found(KIND_DECLARATION, 'hfs.json', `the kind \`${kind}\` needs the pattern \`${pattern}\`, which hfs.json sides.be.patterns does not declare.`, { kind, pattern }));
+        for (const capability of platform.get(pattern) ?? []) {
+            if (!tracked.has(`be/src/modules/platform/${capability}/index.ts`))
+                findings.push(found(KIND_DECLARATION, `be/src/modules/platform/${capability}/`, `the kind \`${kind}\` needs the platform capability \`${capability}\` (pattern ${pattern}), which is not tracked at be/src/modules/platform/${capability}/; \`starci app add\` generates it with the first member of the kind.`, { kind, pattern, capability }));
+        }
     }
-  }
-  return findings;
+    return findings;
 }
-
 function declaredKindFindings({ declared, present, kindPatterns, patterns, platform, tracked }) {
-  const findings = [];
-  for (const kind of [...declared].sort(byCodeUnit)) {
-    if (present.has(kind)) findings.push(...kindPatternFindings(kind, { kindPatterns, patterns, platform, tracked }));
-    else findings.push(found(KIND_DECLARATION, 'hfs.json', `hfs.json sides.be.kinds declares \`${kind}\` but no feature of that kind exists; a kind is declared only when it is used, so remove it or add its first member with \`starci app add\`.`, { kind }));
-  }
-  return findings;
+    const findings = [];
+    for (const kind of [...declared].sort(byCodeUnit)) {
+        if (present.has(kind))
+            findings.push(...kindPatternFindings(kind, { kindPatterns, patterns, platform, tracked }));
+        else
+            findings.push(found(KIND_DECLARATION, 'hfs.json', `hfs.json sides.be.kinds declares \`${kind}\` but no feature of that kind exists; a kind is declared only when it is used, so remove it or add its first member with \`starci app add\`.`, { kind }));
+    }
+    return findings;
 }
-
 /** Findings of BE_KIND_DECLARATION and BE_KIND_EMPTY. */
 export function kindFindings({ files, repo }) {
-  const be = repo.sides?.be;
-  if (!be) return [];
-  const { triggerKinds, kindPatterns, platform } = facts();
-  const kindFolders = new Set(triggerKinds);
-  const tracked = new Set(files);
-  const usage = kindUsageOf(files, kindFolders);
-  const findings = usage.findings;
-  const instances = usage.instances;
-  const roots = usage.roots;
-  findings.push(...emptyInstanceFindings(usage.sources));
-  const present = new Set([...instances.keys(), ...roots]);
-  const declared = new Set(be.kinds ?? []);
-  const patterns = new Set(be.patterns ?? []);
-  findings.push(...undeclaredKindFindings(present, declared), ...declaredKindFindings({ declared, present, kindPatterns, patterns, platform, tracked }));
-  return findings;
+    const be = repo.sides?.be;
+    if (!be)
+        return [];
+    const { triggerKinds, kindPatterns, platform } = facts();
+    const kindFolders = new Set(triggerKinds);
+    const tracked = new Set(files);
+    const usage = kindUsageOf(files, kindFolders);
+    const findings = usage.findings;
+    const instances = usage.instances;
+    const roots = usage.roots;
+    findings.push(...emptyInstanceFindings(usage.sources));
+    const present = new Set([...instances.keys(), ...roots]);
+    const declared = new Set(be.kinds ?? []);
+    const patterns = new Set(be.patterns ?? []);
+    findings.push(...undeclaredKindFindings(present, declared), ...declaredKindFindings({ declared, present, kindPatterns, patterns, platform, tracked }));
+    return findings;
 }

package/runtime/scripts/hfs/rules/lexicon.d.mts

@@ -0,0 +1,9 @@
+import type { Repo } from './rule-types.mjs';
+export declare const HFS_APP_LEXICON = "HFS_APP_LEXICON";
+/** Removed product words in the tracked source and docs of this root/side scope, once per word and line. */
+export declare function lexiconFindings({ repoRoot, files, repo, inScope }: {
+    repoRoot: string;
+    files: string[];
+    repo: Repo;
+    inScope?: (file: string) => boolean;
+}): import("./rule-types.mjs").Finding[];

package/runtime/scripts/hfs/rules/lexicon.mjs

@@ -3,7 +3,6 @@
 import path from 'node:path';
 import { escapeRegExp } from '../../lib/regex.mjs';
 import { found, readJson, readText } from './read.mjs';
-
 export const HFS_APP_LEXICON = 'HFS_APP_LEXICON';
 const SOURCE_OR_DOC = /\.(?:[cm]?[jt]sx?|css|scss|sass|vue|svelte|gql|graphql|sql|sh|md|mdx|rst|adoc|txt)$/i;
 const SOURCE_JSON = /(?:^|\/)(?:src|messages|locales)\/.*\.json$/i;
@@ -11,52 +10,56 @@ const OUTSIDE = /(?:^|\/)(?:node_modules|\.git|dist|build|secrets)\/|(?:^|\/)(?:
 const LETTER_OR_NUMBER = /[\p{L}\p{N}]/u;
 const LOWER = /\p{Ll}/u;
 const UPPER = /\p{Lu}/u;
-
 // A whole word also forms one segment of camelCase/PascalCase, a kebab name or a SCREAMING_SNAKE identifier.
 function boundary(text, at) {
-  const left = text[at - 1];
-  const right = text[at];
-  return !left || !right || !LETTER_OR_NUMBER.test(left) || !LETTER_OR_NUMBER.test(right)
-    || (LOWER.test(left) && UPPER.test(right))
-    || (UPPER.test(left) && UPPER.test(right) && LOWER.test(text[at + 1] ?? ''));
+    const left = text[at - 1];
+    const right = text[at];
+    return !left || !right || !LETTER_OR_NUMBER.test(left) || !LETTER_OR_NUMBER.test(right)
+        || (LOWER.test(left) && UPPER.test(right))
+        || (UPPER.test(left) && UPPER.test(right) && LOWER.test(text[at + 1] ?? ''));
 }
-
 function removedWords(repoRoot, repo) {
-  if (typeof repoRoot !== 'string') return [];
-  // Resolved side declarations contain the edition and slots, so read product metadata from the root declaration.
-  const root = repo.profile === 'be' || repo.profile === 'fe' ? path.dirname(repoRoot) : repoRoot;
-  const lexicon = repo.lexicon ?? readJson(root, 'hfs.json')?.lexicon;
-  return Array.isArray(lexicon?.removed) ? [...new Set(lexicon.removed.filter((word) => typeof word === 'string' && word.trim()).map((word) => word.trim()))] : [];
+    if (typeof repoRoot !== 'string')
+        return [];
+    // Resolved side declarations contain the edition and slots, so read product metadata from the root declaration.
+    const root = repo.profile === 'be' || repo.profile === 'fe' ? path.dirname(repoRoot) : repoRoot;
+    const lexicon = repo.lexicon ?? readJson(root, 'hfs.json')?.lexicon;
+    return Array.isArray(lexicon?.removed) ? [...new Set(lexicon.removed.filter((word) => typeof word === 'string' && word.trim()).map((word) => word.trim()))] : [];
 }
-
 function wordFindings(file, text, word) {
-  const matches = text.matchAll(new RegExp(escapeRegExp(word), 'giu'));
-  const findings = [];
-  const reported = new Set();
-  for (const match of matches) {
-    const start = match.index;
-    const end = start + match[0].length;
-    if (!boundary(text, start) || !boundary(text, end)) continue;
-    const line = text.slice(0, start).split('\n').length;
-    if (reported.has(line)) continue;
-    reported.add(line);
-    const column = start - text.lastIndexOf('\n', start - 1);
-    findings.push(found(HFS_APP_LEXICON, file, `${file}:${line} uses removed product word ${JSON.stringify(word)}; replace it with the current product vocabulary`, { line, column, word }));
-  }
-  return findings;
+    const matches = text.matchAll(new RegExp(escapeRegExp(word), 'giu'));
+    const findings = [];
+    const reported = new Set();
+    for (const match of matches) {
+        const start = match.index;
+        const end = start + match[0].length;
+        if (!boundary(text, start) || !boundary(text, end))
+            continue;
+        const line = text.slice(0, start).split('\n').length;
+        if (reported.has(line))
+            continue;
+        reported.add(line);
+        const column = start - text.lastIndexOf('\n', start - 1);
+        findings.push(found(HFS_APP_LEXICON, file, `${file}:${line} uses removed product word ${JSON.stringify(word)}; replace it with the current product vocabulary`, { line, column, word }));
+    }
+    return findings;
 }
-
 /** Removed product words in the tracked source and docs of this root/side scope, once per word and line. */
 export function lexiconFindings({ repoRoot, files, repo, inScope = () => true }) {
-  if (repo.kind === 'runtime' || !['lite', 'full'].includes(repo.edition ?? 'full')) return [];
-  const words = removedWords(repoRoot, repo);
-  if (!words.length) return [];
-  const findings = [];
-  for (const file of files) {
-    if (!inScope(file) || OUTSIDE.test(file) || !(SOURCE_OR_DOC.test(file) || SOURCE_JSON.test(file))) continue;
-    const text = readText(repoRoot, file);
-    if (text === null) continue;
-    for (const word of words) findings.push(...wordFindings(file, text, word));
-  }
-  return findings;
+    if (repo.kind === 'runtime' || !['lite', 'full'].includes(repo.edition ?? 'full'))
+        return [];
+    const words = removedWords(repoRoot, repo);
+    if (!words.length)
+        return [];
+    const findings = [];
+    for (const file of files) {
+        if (!inScope(file) || OUTSIDE.test(file) || !(SOURCE_OR_DOC.test(file) || SOURCE_JSON.test(file)))
+            continue;
+        const text = readText(repoRoot, file);
+        if (text === null)
+            continue;
+        for (const word of words)
+            findings.push(...wordFindings(file, text, word));
+    }
+    return findings;
 }

package/runtime/scripts/hfs/rules/lint-suppression.d.mts

@@ -0,0 +1,5 @@
+/** The findings of R104 over the tracked paths `files` of the repository at `repoRoot`. */
+export declare function lintSuppressionFindings({ repoRoot, files }: {
+    repoRoot: string;
+    files: string[];
+}): import("./rule-types.mjs").Finding[];

package/runtime/scripts/hfs/rules/lint-suppression.mjs

@@ -6,35 +6,37 @@
 //   - an `eslint.config.*` that names a suppressions configuration.
 // Comment-level suppression (`eslint-disable`) is the lint rule `no-inline-suppression`'s (R18).
 import { found, readJson, readText } from './read.mjs';
-
 const LINT_SUPPRESSION_FILE = 'HFS_LINT_SUPPRESSION_FILE';
 const SUPPRESSION_FILE = /(?:^|\/)eslint[.-]suppressions[^/]*$/;
 const SUPPRESSION_SCRIPT_NAME = /(?:^|:)suppressions$/;
 const SUPPRESSION_FLAG = /--(?:suppressions-location|suppress-all|suppress-rule|prune-suppressions)\b/;
 const ESLINT_CONFIG = /(?:^|\/)eslint\.config\.[cm]?[jt]s$/;
 const CONFIG_SUPPRESSION = /suppressions/i;
-
 function packageSuppressionFindings(file, pkg) {
-  const findings = [];
-  for (const [name, command] of Object.entries(pkg?.scripts ?? {})) {
-    if (SUPPRESSION_SCRIPT_NAME.test(name) || SUPPRESSION_FLAG.test(String(command))) findings.push(found(LINT_SUPPRESSION_FILE, file, `${file} script ${name} manages lint suppressions (${String(command).slice(0, 80)}); delete the script and fix the findings in the code`));
-  }
-  return findings;
+    const findings = [];
+    for (const [name, command] of Object.entries(pkg?.scripts ?? {})) {
+        if (SUPPRESSION_SCRIPT_NAME.test(name) || SUPPRESSION_FLAG.test(String(command)))
+            findings.push(found(LINT_SUPPRESSION_FILE, file, `${file} script ${name} manages lint suppressions (${String(command).slice(0, 80)}); delete the script and fix the findings in the code`));
+    }
+    return findings;
 }
-
 /** The findings of R104 over the tracked paths `files` of the repository at `repoRoot`. */
 export function lintSuppressionFindings({ repoRoot, files }) {
-  const findings = [];
-  for (const file of files) {
-    if (file.includes('node_modules/')) continue;
-    if (SUPPRESSION_FILE.test(file)) findings.push(found(LINT_SUPPRESSION_FILE, file, `${file} is a lint-suppression file; a finding is fixed in the code, never recorded in a file that lets it stay`));
-    else if (ESLINT_CONFIG.test(file)) {
-      const text = readText(repoRoot, file);
-      if (text !== null && CONFIG_SUPPRESSION.test(text)) findings.push(found(LINT_SUPPRESSION_FILE, file, `${file} passes a suppressions configuration to eslint; a repository suppresses nothing`));
-    } else if (file === 'package.json' || file.endsWith('/package.json')) {
-      const pkg = readJson(repoRoot, file);
-      findings.push(...packageSuppressionFindings(file, pkg));
+    const findings = [];
+    for (const file of files) {
+        if (file.includes('node_modules/'))
+            continue;
+        if (SUPPRESSION_FILE.test(file))
+            findings.push(found(LINT_SUPPRESSION_FILE, file, `${file} is a lint-suppression file; a finding is fixed in the code, never recorded in a file that lets it stay`));
+        else if (ESLINT_CONFIG.test(file)) {
+            const text = readText(repoRoot, file);
+            if (text !== null && CONFIG_SUPPRESSION.test(text))
+                findings.push(found(LINT_SUPPRESSION_FILE, file, `${file} passes a suppressions configuration to eslint; a repository suppresses nothing`));
+        }
+        else if (file === 'package.json' || file.endsWith('/package.json')) {
+            const pkg = readJson(repoRoot, file);
+            findings.push(...packageSuppressionFindings(file, pkg));
+        }
     }
-  }
-  return findings;
+    return findings;
 }

package/runtime/scripts/hfs/rules/lite-proof-lane.d.mts

@@ -0,0 +1,9 @@
+import type { Parsed, Repo } from './rule-types.mjs';
+/** Findings of R284 and R155 at the app root; side passes must not duplicate them. */
+export declare function liteProofLaneFindings({ repoRoot, files, all, repo, manifest }: {
+    repoRoot: string;
+    files: string[];
+    all?: string[];
+    repo: Repo;
+    manifest?: Parsed;
+}): import("./rule-types.mjs").Finding[];

package/runtime/scripts/hfs/rules/lite-proof-lane.mjs

@@ -6,7 +6,6 @@ import { loadSlotManifest, ruleParams } from '../slots.mjs';
 import { loadTypescript } from '../../lib/package-at.mjs';
 import { literalText } from '../../lib/ts-ast.mjs';
 import { found, readText } from './read.mjs';
-
 const LITE_PROOF_LANE_MISSING = 'BE_LITE_PROOF_LANE_MISSING';
 const PATTERN_SPEC_MISSING = 'BE_PATTERN_SPEC_MISSING';
 const HERE = path.dirname(fileURLToPath(import.meta.url));
@@ -14,76 +13,78 @@ const INTEGRATION_SPEC = /^be\/src\/tests\/integration\/.+\.integration-spec\.ts
 const PATTERNS = new Set(['logging', 'event-bus', 'queue', 'webhooks', 'realtime', 'fenced-job', 'projection', 'saga', 'idempotency']);
 // Fallback saga scenarios until the shared manifest provides its scenario table.
 const SAGA_SCENARIOS = ['compensation-on-failure', 'step-order', 'state-version-fences', 'consumer-dedupes'];
-
 /** A disabled test/suite must not contribute its own title or any nested test titles. */
 function disabledCall(ts, node) {
-  let callee = node.expression;
-  let disabled = false;
-  while (ts.isPropertyAccessExpression(callee) || ts.isCallExpression(callee)) {
-    if (ts.isPropertyAccessExpression(callee) && ['skip', 'todo'].includes(callee.name.text)) disabled = true;
-    callee = callee.expression;
-  }
-  return ts.isIdentifier(callee) && (callee.text === 'xdescribe'
-    || (disabled && ['it', 'test', 'describe'].includes(callee.text)));
+    let callee = node.expression;
+    let disabled = false;
+    while (ts.isPropertyAccessExpression(callee) || ts.isCallExpression(callee)) {
+        if (ts.isPropertyAccessExpression(callee) && ['skip', 'todo'].includes(callee.name.text))
+            disabled = true;
+        callee = callee.expression;
+    }
+    return ts.isIdentifier(callee) && (callee.text === 'xdescribe'
+        || (disabled && ['it', 'test', 'describe'].includes(callee.text)));
 }
-
 /** A test callback is an inline function or a reference to one, rather than a missing/placeholder value. */
 function hasCallback(ts, node) {
-  const callback = node.arguments[1];
-  return callback && (ts.isArrowFunction(callback) || ts.isFunctionExpression(callback)
-    || (ts.isIdentifier(callback) && callback.text !== 'undefined') || ts.isPropertyAccessExpression(callback));
+    const callback = node.arguments[1];
+    return callback && (ts.isArrowFunction(callback) || ts.isFunctionExpression(callback)
+        || (ts.isIdentifier(callback) && callback.text !== 'undefined') || ts.isPropertyAccessExpression(callback));
 }
-
 /** Add scenario ids from literal it/test titles with callbacks; disabled suites and source text provide no proof. */
 function addScenarios(ts, source, proven) {
-  const visit = (node) => {
-    if (ts.isCallExpression(node) && disabledCall(ts, node)) return;
-    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)
-      && ['it', 'test'].includes(node.expression.text) && hasCallback(ts, node)) {
-      const title = literalText(ts, node.arguments[0]);
-      const colon = title?.indexOf(':') ?? -1;
-      if (colon > 0) proven.add(title.slice(0, colon));
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(source);
+    const visit = (node) => {
+        if (ts.isCallExpression(node) && disabledCall(ts, node))
+            return;
+        if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)
+            && ['it', 'test'].includes(node.expression.text) && hasCallback(ts, node)) {
+            const title = literalText(ts, node.arguments[0]);
+            const colon = title?.indexOf(':') ?? -1;
+            if (title && colon > 0)
+                proven.add(title.slice(0, colon));
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
 }
-
 /** Only tracked, readable integration specs belong to lite's proof lane. */
 function integrationProof(ts, repoRoot, files) {
-  const proven = new Set();
-  const specs = [];
-  for (const file of files) {
-    if (!INTEGRATION_SPEC.test(file)) continue;
-    const text = readText(repoRoot, file);
-    if (text === null) continue;
-    specs.push(file);
-    if (ts) addScenarios(ts, ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true), proven);
-  }
-  return { specs, proven };
+    const proven = new Set();
+    const specs = [];
+    for (const file of files) {
+        if (!INTEGRATION_SPEC.test(file))
+            continue;
+        const text = readText(repoRoot, file);
+        if (text === null)
+            continue;
+        specs.push(file);
+        if (ts)
+            addScenarios(ts, ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true), proven);
+    }
+    return { specs, proven };
 }
-
 /** Findings of R284 and R155 at the app root; side passes must not duplicate them. */
 export function liteProofLaneFindings({ repoRoot, files, all = files, repo, manifest }) {
-  if (repo.edition !== 'lite' || !repo.sides?.be) return [];
-  const patterns = [...new Set(repo.sides.be.patterns ?? [])].filter((pattern) => PATTERNS.has(pattern));
-  if (patterns.length === 0) return [];
-  const scenarios = ruleParams(manifest ?? loadSlotManifest(), 'be', 'lite').patternScenarios ?? {};
-  const ts = loadTypescript(repoRoot, HERE);
-  const { specs, proven } = integrationProof(ts, repoRoot, all);
-  const findings = [];
-  if (specs.length === 0) {
-    const declared = patterns.map((pattern) => `\`${pattern}\``).join(', ');
-    findings.push(found(LITE_PROOF_LANE_MISSING, 'hfs.json',
-      `Lite declares ${declared} but has no tracked integration spec in be/src/tests/integration; add *.integration-spec.ts with the declared patterns' scenario titles.`, { patterns }));
-  }
-  for (const pattern of patterns) {
-    const required = scenarios[pattern] ?? (pattern === 'saga' ? SAGA_SCENARIOS : []);
-    for (const scenario of required) {
-      const id = `${pattern}/${scenario}`;
-      if (!proven.has(id)) findings.push(found(PATTERN_SPEC_MISSING, 'hfs.json',
-        `The lite pattern \`${pattern}\` is declared but no integration spec in be/src/tests/integration holds a test titled \`${id}: ...\`; prove this scenario in the lite integration lane.`, { pattern, scenario: id }));
+    if (repo.edition !== 'lite' || !repo.sides?.be)
+        return [];
+    const patterns = [...new Set(repo.sides.be.patterns ?? [])].filter((pattern) => PATTERNS.has(pattern));
+    if (patterns.length === 0)
+        return [];
+    const scenarios = ruleParams(manifest ?? loadSlotManifest(), 'be', 'lite').patternScenarios ?? {};
+    const ts = loadTypescript(repoRoot, HERE);
+    const { specs, proven } = integrationProof(ts, repoRoot, all);
+    const findings = [];
+    if (specs.length === 0) {
+        const declared = patterns.map((pattern) => `\`${pattern}\``).join(', ');
+        findings.push(found(LITE_PROOF_LANE_MISSING, 'hfs.json', `Lite declares ${declared} but has no tracked integration spec in be/src/tests/integration; add *.integration-spec.ts with the declared patterns' scenario titles.`, { patterns }));
+    }
+    for (const pattern of patterns) {
+        const required = scenarios[pattern] ?? (pattern === 'saga' ? SAGA_SCENARIOS : []);
+        for (const scenario of required) {
+            const id = `${pattern}/${scenario}`;
+            if (!proven.has(id))
+                findings.push(found(PATTERN_SPEC_MISSING, 'hfs.json', `The lite pattern \`${pattern}\` is declared but no integration spec in be/src/tests/integration holds a test titled \`${id}: ...\`; prove this scenario in the lite integration lane.`, { pattern, scenario: id }));
+        }
     }
-  }
-  return findings;
+    return findings;
 }

package/runtime/scripts/hfs/rules/lite-secrets.d.mts

@@ -0,0 +1,12 @@
+import type { Finding, Parsed, Repo } from './rule-types.mjs';
+/** Raw L17 findings. The catalog-driven findings filter decides which editions judge them. */
+export declare function liteSecretCustodyFindings({ repoRoot, files, repo }: {
+    repoRoot: string;
+    files: string[];
+    repo: Repo;
+}): Finding[];
+/**
+ * Drop-in extension of secretFindings for scripts/hfs/check.mjs. When an L17 finding identifies the same file/line as
+ * the generic R06 scanner (a complete JWT, for example), the specific lite code wins so one physical issue is emitted once.
+ */
+export declare function liteSecretFindings(input: Parsed): Finding[];