@starci/hfs 4.11.22 → 4.12.0

package/runtime/scripts/hfs/architecture/injection-token-exported.d.mts

@@ -0,0 +1,21 @@
+import type { MachineInput } from './machine-ast.mjs';
+import type { Violation } from './ast-walks.mjs';
+export interface InjectionTokenExportedResult {
+    violations: Violation[];
+    coverage: {
+        status: 'checked';
+        decorators: number;
+        files: number;
+    };
+}
+/**
+ * R85 `injection-token-exported` (BE_RAW_INJECT), the injection law's last obligation: a spec can only provide a token it
+ * can import. Every `Inject<Thing>()` decorator that a service constructor uses resolves to a token (the argument of its
+ * `injector<T>(TOKEN)`), and that token must be EXPORTED, by name, from the file of the decorator (`<cap>.decorators.ts`),
+ * from the `<cap>.decorators.ts` that declares it, or from the index.ts of the capability that owns either file. A token
+ * that is a private (non-exported) const, or one only a sibling file of the capability can reach, cannot be provided by a
+ * unit spec and is a finding. A token that a package declares (a Nest options token, say) is the package's export.
+ * The finding sits on the decorator's `injector(...)` call, once per decorator, however many services use it.
+ */
+export declare const INJECTION_TOKEN_EXPORTED_RULE_IDS: string[];
+export declare function checkInjectionTokenExported(input: MachineInput): InjectionTokenExportedResult;

package/runtime/scripts/hfs/architecture/injection-token-exported.mjs

@@ -1,7 +1,8 @@
 import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
 import { constructorDependencies, serviceClasses } from './constructor-deps.mjs';
-
+const hasInjector = (dependency) => 'decoratorDeclaration' in dependency && 'injectorCall' in dependency
+    && Boolean(dependency.decoratorDeclaration) && Boolean(dependency.injectorCall);
 /**
  * R85 `injection-token-exported` (BE_RAW_INJECT), the injection law's last obligation: a spec can only provide a token it
  * can import. Every `Inject<Thing>()` decorator that a service constructor uses resolves to a token (the argument of its
@@ -12,56 +13,57 @@ import { constructorDependencies, serviceClasses } from './constructor-deps.mjs'
  * The finding sits on the decorator's `injector(...)` call, once per decorator, however many services use it.
  */
 export const INJECTION_TOKEN_EXPORTED_RULE_IDS = ['BE_RAW_INJECT'];
-
 const RULE = 'BE_RAW_INJECT';
-
 const exportedVariableHasName = (ts, kit, statement, name) => {
-  if (!ts.isVariableStatement(statement) || !kit.isExported(statement)) return false;
-  return statement.declarationList.declarations.some(declaration =>
-    (ts.isIdentifier(declaration.name) && declaration.name.text === name)
-    || (ts.isObjectBindingPattern(declaration.name) && declaration.name.elements.some(element => ts.isIdentifier(element.name) && element.name.text === name)));
+    // The modifier flags are read off the statement itself; the kit types its argument as a declaration.
+    if (!ts.isVariableStatement(statement) || !kit.isExported(statement))
+        return false;
+    return statement.declarationList.declarations.some(declaration => (ts.isIdentifier(declaration.name) && declaration.name.text === name)
+        || (ts.isObjectBindingPattern(declaration.name) && declaration.name.elements.some(element => ts.isIdentifier(element.name) && element.name.text === name)));
 };
-
 const exportedDeclarationHasName = (ts, statement, name) => {
-  if (!ts.isExportDeclaration(statement)) return false;
-  const clause = statement.exportClause;
-  return clause !== undefined && ts.isNamedExports(clause) && clause.elements.some(element => element.name.text === name);
+    if (!ts.isExportDeclaration(statement))
+        return false;
+    const clause = statement.exportClause;
+    return clause !== undefined && ts.isNamedExports(clause) && clause.elements.some(element => element.name.text === name);
 };
-
-const exportsName = (ts, kit, file, name) => file?.sourceFile.statements.some(statement =>
-  exportedVariableHasName(ts, kit, statement, name) || exportedDeclarationHasName(ts, statement, name)) === true;
-
+const exportsName = (ts, kit, file, name) => file?.sourceFile.statements.some(statement => exportedVariableHasName(ts, kit, statement, name) || exportedDeclarationHasName(ts, statement, name)) === true;
 const indexOf = (graph, file) => (file?.owner ? graph.files.get(`${file.owner.root}/index.ts`) : null);
-
+/** The graph file declaring `declaration`, when the program holds it. */
+const graphFileOf = (graph, kit, declaration) => {
+    const rel = kit.graphPath(declaration);
+    return rel === null ? undefined : graph.files.get(rel);
+};
 const injectionViolationFor = (graph, kit, ts, dependency) => {
-  const decoratorFile = graph.files.get(kit.graphPath(dependency.decoratorDeclaration));
-  if (dependency.kind === 'unresolved') {
-    return decoratorFile ? { ruleId: RULE, path: decoratorFile.rel, ...kit.at(decoratorFile.rel, decoratorFile.sourceFile, dependency.injectorCall), decorator: dependency.decorator,
-      message: `${dependency.decorator}() cannot be followed to its token (${dependency.reason}); name an exported \`unique symbol\` const so a unit spec can provide it.` } : null;
-  }
-  const tokenFile = dependency.declaration ? graph.files.get(kit.graphPath(dependency.declaration)) : null;
-  const homes = [decoratorFile, tokenFile && path.posix.basename(tokenFile.rel).endsWith('.decorators.ts') ? tokenFile : null, indexOf(graph, decoratorFile), indexOf(graph, tokenFile)];
-  if (!decoratorFile || homes.some(home => exportsName(ts, kit, home, dependency.name))) return null;
-  return { ruleId: RULE, path: decoratorFile.rel, ...kit.at(decoratorFile.rel, decoratorFile.sourceFile, dependency.injectorCall), decorator: dependency.decorator, token: dependency.name,
-    message: `${dependency.decorator}() injects ${dependency.name}, which is not exported from ${path.posix.basename(decoratorFile.rel)} nor from the capability index.ts; export the token so a unit spec can provide it (\`{ provide: ${dependency.name}, useValue: double }\`).` };
+    const decoratorFile = graphFileOf(graph, kit, dependency.decoratorDeclaration);
+    if (dependency.kind === 'unresolved') {
+        return decoratorFile ? { ruleId: RULE, path: decoratorFile.rel, ...kit.at(decoratorFile.rel, decoratorFile.sourceFile, dependency.injectorCall), decorator: dependency.decorator,
+            message: `${dependency.decorator}() cannot be followed to its token (${dependency.reason}); name an exported \`unique symbol\` const so a unit spec can provide it.` } : null;
+    }
+    const tokenFile = dependency.declaration ? graphFileOf(graph, kit, dependency.declaration) : null;
+    const homes = [decoratorFile, tokenFile && path.posix.basename(tokenFile.rel).endsWith('.decorators.ts') ? tokenFile : null, indexOf(graph, decoratorFile), indexOf(graph, tokenFile)];
+    if (!decoratorFile || homes.some(home => exportsName(ts, kit, home, dependency.name)))
+        return null;
+    return { ruleId: RULE, path: decoratorFile.rel, ...kit.at(decoratorFile.rel, decoratorFile.sourceFile, dependency.injectorCall), decorator: dependency.decorator, token: dependency.name,
+        message: `${dependency.decorator}() injects ${dependency.name}, which is not exported from ${path.posix.basename(decoratorFile.rel)} nor from the capability index.ts; export the token so a unit spec can provide it (\`{ provide: ${dependency.name}, useValue: double }\`).` };
 };
-
 export function checkInjectionTokenExported(input) {
-  const { graph } = input;
-  const kit = machineKit(input);
-  const { ts } = kit;
-  const violations = [];
-  const seen = new Set();
-  let decorators = 0;
-
-  for (const { file, declaration } of serviceClasses(kit, graph)) {
-    for (const dependency of constructorDependencies(kit, file, declaration)) {
-      if (dependency.external || !dependency.decoratorDeclaration || !dependency.injectorCall || seen.has(dependency.injectorCall)) continue;
-      seen.add(dependency.injectorCall);
-      decorators += 1;
-      const violation = injectionViolationFor(graph, kit, ts, dependency);
-      if (violation) violations.push(violation);
+    const { graph } = input;
+    const kit = machineKit(input);
+    const { ts } = kit;
+    const violations = [];
+    const seen = new Set();
+    let decorators = 0;
+    for (const { file, declaration } of serviceClasses(kit, graph)) {
+        for (const dependency of constructorDependencies(kit, file, declaration)) {
+            if (!hasInjector(dependency) || (dependency.kind === 'token' && dependency.external) || seen.has(dependency.injectorCall))
+                continue;
+            seen.add(dependency.injectorCall);
+            decorators += 1;
+            const violation = injectionViolationFor(graph, kit, ts, dependency);
+            if (violation)
+                violations.push(violation);
+        }
     }
-  }
-  return { violations, coverage: { status: 'checked', decorators, files: graph.files.size } };
+    return { violations, coverage: { status: 'checked', decorators, files: graph.files.size } };
 }

package/runtime/scripts/hfs/architecture/jwt-ast.d.mts

@@ -0,0 +1,16 @@
+import type { CallExpression, Expression, Node, TypeChecker } from 'typescript';
+import type { TypeScriptApi } from './config.mjs';
+import type { ArchitectureViolation, GraphFile } from './hfs-graph.mjs';
+import type { MachineKit } from './machine-ast.mjs';
+export { accessName as memberName } from '../../lib/ts-ast.mjs';
+export declare const moduleNameOf: (ts: TypeScriptApi, node: Node) => string | null;
+export declare const importedFrom: (kit: MachineKit, checker: TypeChecker, node: Node, modules: Set<string>, names?: Set<string> | null) => boolean;
+export declare function unwrap(ts: TypeScriptApi, node: Expression): Expression;
+export declare function unwrap(ts: TypeScriptApi, node: Expression | undefined): Expression | undefined;
+export declare const callName: (ts: TypeScriptApi, call: Node) => string | null;
+export declare const chainParts: (ts: TypeScriptApi, expression: Expression) => string[];
+export declare const reportAt: (violations: ArchitectureViolation[], kit: MachineKit, ruleId: string, file: GraphFile, node: Node, message: string, extra?: Record<string, unknown>) => void;
+/** Trace an issuer or audience to typed configuration values through local URL/string transformations. */
+export declare const fromConfig: (ts: TypeScriptApi, checker: TypeChecker, expression: Expression | undefined, seen?: Set<Node>) => boolean | undefined;
+/** R260 is shared by the architecture machine and the published typed ESLint rule. */
+export declare const jwtPolicyProblems: (ts: TypeScriptApi, checker: TypeChecker, call: CallExpression) => string[];

package/runtime/scripts/hfs/architecture/jwt-ast.mjs

@@ -3,210 +3,229 @@
 import { unwrapExpression } from '../../lib/ts-analysis.mjs';
 import { accessName as memberName, hasAnyFlag } from '../../lib/ts-ast.mjs';
 export { accessName as memberName } from '../../lib/ts-ast.mjs';
-
 export const moduleNameOf = (ts, node) => {
-  if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) return node.moduleSpecifier.text;
-  if (!ts.isCallExpression(node)) return null;
-  const dynamic = node.expression.kind === ts.SyntaxKind.ImportKeyword;
-  const required = ts.isIdentifier(node.expression) && node.expression.text === 'require';
-  return (dynamic || required) && node.arguments.length === 1 && ts.isStringLiteralLike(node.arguments[0]) ? node.arguments[0].text : null;
+    if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier))
+        return node.moduleSpecifier.text;
+    if (!ts.isCallExpression(node))
+        return null;
+    const dynamic = node.expression.kind === ts.SyntaxKind.ImportKeyword;
+    const required = ts.isIdentifier(node.expression) && node.expression.text === 'require';
+    const first = node.arguments[0];
+    return (dynamic || required) && node.arguments.length === 1 && first && ts.isStringLiteralLike(first) ? first.text : null;
 };
-
 export const importedFrom = (kit, checker, node, modules, names = null) => {
-  const binding = kit.importBinding(checker, node);
-  return Boolean(binding && modules.has(binding.module) && (names === null || names.has(binding.name)));
+    const binding = kit.importBinding(checker, node);
+    return Boolean(binding && modules.has(binding.module) && (names === null || names.has(binding.name)));
 };
-
-export const unwrap = (ts, node) => unwrapExpression(ts, node, { awaitExpressions: true, satisfiesExpressions: false });
-
+export function unwrap(ts, node) {
+    return unwrapExpression(ts, node, { awaitExpressions: true, satisfiesExpressions: false });
+}
 export const callName = (ts, call) => ts.isCallExpression(call) ? memberName(ts, call.expression) : null;
-
 export const chainParts = (ts, expression) => {
-  const names = [];
-  let current = unwrap(ts, expression);
-  while (current) {
-    if (ts.isCallExpression(current)) {
-      current = unwrap(ts, current.expression);
-      continue;
+    const names = [];
+    let current = unwrap(ts, expression);
+    while (current) {
+        if (ts.isCallExpression(current)) {
+            current = unwrap(ts, current.expression);
+            continue;
+        }
+        if (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+            const name = memberName(ts, current);
+            if (name)
+                names.unshift(name);
+            current = unwrap(ts, current.expression);
+            continue;
+        }
+        break;
     }
-    if (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
-      const name = memberName(ts, current);
-      if (name) names.unshift(name);
-      current = unwrap(ts, current.expression);
-      continue;
-    }
-    break;
-  }
-  return names;
+    return names;
 };
-
 export const reportAt = (violations, kit, ruleId, file, node, message, extra = {}) => {
-  violations.push({ ruleId, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
+    violations.push({ ruleId, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
 };
-
 const declarationsOf = (ts, checker, node) => {
-  const target = ts.isPropertyAccessExpression(node) ? node.name : node;
-  // A shorthand property (`issuer,`) names the variable it reads, not the property it creates.
-  let symbol = ts.isShorthandPropertyAssignment(target.parent ?? {}) && target.parent.name === target
-    ? checker.getShorthandAssignmentValueSymbol(target.parent)
-    : checker.getSymbolAtLocation(target);
-  if (symbol && hasAnyFlag(symbol.flags, ts.SymbolFlags.Alias)) symbol = checker.getAliasedSymbol(symbol);
-  return symbol?.declarations ?? [];
-};
-
+    const target = ts.isPropertyAccessExpression(node) ? node.name : node;
+    const parent = target.parent;
+    // A shorthand property (`issuer,`) names the variable it reads, not the property it creates.
+    let symbol = parent && ts.isShorthandPropertyAssignment(parent) && parent.name === target
+        ? checker.getShorthandAssignmentValueSymbol(parent)
+        : checker.getSymbolAtLocation(target);
+    if (symbol && hasAnyFlag(symbol.flags, ts.SymbolFlags.Alias))
+        symbol = checker.getAliasedSymbol(symbol);
+    return symbol?.declarations ?? [];
+};
 const configType = (checker, node) => {
-  const type = checker.getTypeAtLocation(node);
-  return [type.symbol, type.aliasSymbol].some(symbol => symbol?.declarations?.some(declaration =>
-    /(?:\.config|\.options|\.env)\.ts$|\/modules\/config\/|\/node_modules\/@nestjs\/config\//u.test(String(declaration.getSourceFile().fileName).replaceAll('\\', '/'))
-    || /(?:Config|Options|Env)$/u.test(symbol.name)));
+    const type = checker.getTypeAtLocation(node);
+    return [type.symbol, type.aliasSymbol].some(symbol => symbol?.declarations?.some(declaration => /(?:\.config|\.options|\.env)\.ts$|\/modules\/config\/|\/node_modules\/@nestjs\/config\//u.test(String(declaration.getSourceFile().fileName).replaceAll('\\', '/'))
+        || /(?:Config|Options|Env)$/u.test(symbol.name)));
 };
-
 /** Trace an issuer or audience to typed configuration values through local URL/string transformations. */
 export const fromConfig = (ts, checker, expression, seen = new Set()) => {
-  const node = unwrap(ts, expression);
-  if (!node || seen.has(node)) return false;
-  const next = new Set(seen).add(node);
-  if (ts.isIdentifier(node)) {
-    return declarationsOf(ts, checker, node).some(declaration => {
-      if (ts.isVariableDeclaration(declaration) && declaration.initializer) return fromConfig(ts, checker, declaration.initializer, next);
-      if (ts.isParameter(declaration) || ts.isPropertyDeclaration(declaration)) return configType(checker, node);
-      return /(?:\.config|\.env)\.ts$|\/modules\/config\//u.test(String(declaration.getSourceFile().fileName).replaceAll('\\', '/'));
-    });
-  }
-  if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
-    return fromConfig(ts, checker, node.expression, next) || declarationsOf(ts, checker, node).some(declaration =>
-      (ts.isParameter(declaration) || ts.isPropertyDeclaration(declaration)) && !declaration.initializer && configType(checker, node));
-  }
-  if (ts.isTemplateExpression(node)) return node.templateSpans.some(span => fromConfig(ts, checker, span.expression, next));
-  if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
-    return fromConfig(ts, checker, node.left, next) || fromConfig(ts, checker, node.right, next);
-  }
-  if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
-    return fromConfig(ts, checker, node.expression, next) || node.arguments?.some(argument => fromConfig(ts, checker, argument, next));
-  }
-  return false;
-};
-
+    const node = unwrap(ts, expression);
+    if (!node || seen.has(node))
+        return false;
+    const next = new Set(seen).add(node);
+    if (ts.isIdentifier(node)) {
+        return declarationsOf(ts, checker, node).some(declaration => {
+            if (ts.isVariableDeclaration(declaration) && declaration.initializer)
+                return fromConfig(ts, checker, declaration.initializer, next);
+            if (ts.isParameter(declaration) || ts.isPropertyDeclaration(declaration))
+                return configType(checker, node);
+            return /(?:\.config|\.env)\.ts$|\/modules\/config\//u.test(String(declaration.getSourceFile().fileName).replaceAll('\\', '/'));
+        });
+    }
+    if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
+        return fromConfig(ts, checker, node.expression, next) || declarationsOf(ts, checker, node).some(declaration => (ts.isParameter(declaration) || ts.isPropertyDeclaration(declaration)) && !declaration.initializer && configType(checker, node));
+    }
+    if (ts.isTemplateExpression(node))
+        return node.templateSpans.some(span => fromConfig(ts, checker, span.expression, next));
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+        return fromConfig(ts, checker, node.left, next) || fromConfig(ts, checker, node.right, next);
+    }
+    if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
+        return fromConfig(ts, checker, node.expression, next) || node.arguments?.some(argument => fromConfig(ts, checker, argument, next));
+    }
+    return false;
+};
 const objectValue = (ts, checker, expression) => {
-  const node = unwrap(ts, expression);
-  if (!node) return null;
-  if (ts.isObjectLiteralExpression(node)) return node;
-  if (!ts.isIdentifier(node)) return null;
-  return declarationsOf(ts, checker, node).find(declaration => ts.isVariableDeclaration(declaration)
-    && declaration.initializer && ts.isObjectLiteralExpression(unwrap(ts, declaration.initializer)))?.initializer ?? null;
-};
-
+    const node = unwrap(ts, expression);
+    if (!node)
+        return null;
+    if (ts.isObjectLiteralExpression(node))
+        return node;
+    if (!ts.isIdentifier(node))
+        return null;
+    const declared = declarationsOf(ts, checker, node).find((declaration) => ts.isVariableDeclaration(declaration)
+        && declaration.initializer !== undefined && ts.isObjectLiteralExpression(unwrap(ts, declaration.initializer)));
+    // The declaration is the one whose initializer unwraps to an object literal, so the unwrapped node is what is returned.
+    const initializer = unwrap(ts, declared?.initializer);
+    return initializer && ts.isObjectLiteralExpression(initializer) ? initializer : null;
+};
 const literalString = (ts, checker, expression) => {
-  const node = unwrap(ts, expression);
-  if (!node) return null;
-  if (ts.isStringLiteralLike(node)) return node.text;
-  const type = checker.getTypeAtLocation(node);
-  return type.isStringLiteral?.() ? type.value : null;
+    const node = unwrap(ts, expression);
+    if (!node)
+        return null;
+    if (ts.isStringLiteralLike(node))
+        return node.text;
+    const type = checker.getTypeAtLocation(node);
+    return type.isStringLiteral?.() ? type.value : null;
 };
-
 /** A role read must belong to the payload produced by this verification, including destructuring aliases. */
 const verifiedPayload = (ts, checker, expression, call, seen = new Set()) => {
-  const node = unwrap(ts, expression);
-  if (!node || seen.has(node)) return false;
-  const next = new Set(seen).add(node);
-  if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && memberName(ts, node) === 'payload') {
-    const value = unwrap(ts, node.expression);
-    if (value === call) return true;
-    if (ts.isIdentifier(value)) return declarationsOf(ts, checker, value).some(declaration =>
-      ts.isVariableDeclaration(declaration) && unwrap(ts, declaration.initializer) === call);
-  }
-  if (!ts.isIdentifier(node)) return false;
-  return declarationsOf(ts, checker, node).some(declaration => {
-    if (ts.isVariableDeclaration(declaration)) return declaration.initializer && verifiedPayload(ts, checker, declaration.initializer, call, next);
-    if (!ts.isBindingElement(declaration) || (declaration.propertyName ?? declaration.name).getText() !== 'payload') return false;
-    return unwrap(ts, declaration.parent.parent.initializer) === call;
-  });
-};
-
+    const node = unwrap(ts, expression);
+    if (!node || seen.has(node))
+        return false;
+    const next = new Set(seen).add(node);
+    if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && memberName(ts, node) === 'payload') {
+        const value = unwrap(ts, node.expression);
+        if (value === call)
+            return true;
+        if (ts.isIdentifier(value))
+            return declarationsOf(ts, checker, value).some(declaration => ts.isVariableDeclaration(declaration) && unwrap(ts, declaration.initializer) === call);
+    }
+    if (!ts.isIdentifier(node))
+        return false;
+    return declarationsOf(ts, checker, node).some(declaration => {
+        if (ts.isVariableDeclaration(declaration))
+            return declaration.initializer && verifiedPayload(ts, checker, declaration.initializer, call, next);
+        if (!ts.isBindingElement(declaration) || (declaration.propertyName ?? declaration.name).getText() !== 'payload')
+            return false;
+        return unwrap(ts, declaration.parent.parent.initializer) === call;
+    });
+};
 const rejects = (ts, statement) => {
-  if (ts.isBlock(statement)) {
-    const exit = statement.statements.find(item => ts.isThrowStatement(item) || ts.isReturnStatement(item));
-    return Boolean(exit && rejects(ts, exit));
-  }
-  if (ts.isThrowStatement(statement)) return true;
-  if (!ts.isReturnStatement(statement)) return false;
-  const value = statement.expression && unwrap(ts, statement.expression);
-  return !value || value.kind === ts.SyntaxKind.NullKeyword || value.kind === ts.SyntaxKind.FalseKeyword
-    || (ts.isCallExpression(value) && /^(?:refused|err|fail|failure)$/u.test(value.expression.getText()));
-};
-
+    if (ts.isBlock(statement)) {
+        const exit = statement.statements.find(item => ts.isThrowStatement(item) || ts.isReturnStatement(item));
+        return Boolean(exit && rejects(ts, exit));
+    }
+    if (ts.isThrowStatement(statement))
+        return true;
+    if (!ts.isReturnStatement(statement))
+        return false;
+    const value = statement.expression && unwrap(ts, statement.expression);
+    return !value || value.kind === ts.SyntaxKind.NullKeyword || value.kind === ts.SyntaxKind.FalseKeyword
+        || (ts.isCallExpression(value) && /^(?:refused|err|fail|failure)$/u.test(value.expression.getText()));
+};
 const roleCondition = (ts, checker, condition, call, equality = false) => {
-  const node = unwrap(ts, condition);
-  if (!node || !ts.isBinaryExpression(node)) return false;
-  const combined = equality ? ts.SyntaxKind.AmpersandAmpersandToken : ts.SyntaxKind.BarBarToken;
-  if (node.operatorToken.kind === combined) return roleCondition(ts, checker, node.left, call, equality) || roleCondition(ts, checker, node.right, call, equality);
-  const operators = equality ? [ts.SyntaxKind.EqualsEqualsEqualsToken, ts.SyntaxKind.EqualsEqualsToken]
-    : [ts.SyntaxKind.ExclamationEqualsEqualsToken, ts.SyntaxKind.ExclamationEqualsToken];
-  if (!operators.includes(node.operatorToken.kind)) return false;
-  const role = expression => (ts.isPropertyAccessExpression(expression) || ts.isElementAccessExpression(expression))
-    && memberName(ts, expression) === 'role' && verifiedPayload(ts, checker, expression.expression, call);
-  return (role(node.left) && literalString(ts, checker, node.right) === 'authenticated')
-    || (role(node.right) && literalString(ts, checker, node.left) === 'authenticated');
-};
-
+    const node = unwrap(ts, condition);
+    if (!node || !ts.isBinaryExpression(node))
+        return false;
+    const combined = equality ? ts.SyntaxKind.AmpersandAmpersandToken : ts.SyntaxKind.BarBarToken;
+    if (node.operatorToken.kind === combined)
+        return roleCondition(ts, checker, node.left, call, equality) || roleCondition(ts, checker, node.right, call, equality);
+    const operators = equality ? [ts.SyntaxKind.EqualsEqualsEqualsToken, ts.SyntaxKind.EqualsEqualsToken]
+        : [ts.SyntaxKind.ExclamationEqualsEqualsToken, ts.SyntaxKind.ExclamationEqualsToken];
+    if (!operators.includes(node.operatorToken.kind))
+        return false;
+    const role = (expression) => (ts.isPropertyAccessExpression(expression) || ts.isElementAccessExpression(expression))
+        && memberName(ts, expression) === 'role' && verifiedPayload(ts, checker, expression.expression, call);
+    return (role(node.left) && literalString(ts, checker, node.right) === 'authenticated')
+        || (role(node.right) && literalString(ts, checker, node.left) === 'authenticated');
+};
 const returnsPrincipal = (ts, statement) => {
-  let accepted = false;
-  const visit = node => {
-    if (ts.isFunctionLike(node)) return;
-    if (ts.isReturnStatement(node) && !rejects(ts, node)) accepted = true;
-    ts.forEachChild(node, visit);
-  };
-  visit(statement);
-  return accepted;
-};
-
+    let accepted = false;
+    const visit = (node) => {
+        if (ts.isFunctionLike(node))
+            return;
+        if (ts.isReturnStatement(node) && !rejects(ts, node))
+            accepted = true;
+        ts.forEachChild(node, visit);
+    };
+    visit(statement);
+    return accepted;
+};
 const statementsAfterVerify = (ts, call) => {
-  let statement = call;
-  while (statement.parent && !ts.isBlock(statement.parent)) statement = statement.parent;
-  const block = statement.parent;
-  if (!block || !ts.isBlock(block)) return [];
-  return block.statements.slice(block.statements.indexOf(statement) + 1);
+    let statement = call;
+    while (statement.parent && !ts.isBlock(statement.parent))
+        statement = statement.parent;
+    const block = statement.parent;
+    if (!block || !ts.isBlock(block))
+        return [];
+    const siblings = block.statements;
+    return block.statements.slice(siblings.indexOf(statement) + 1);
 };
-
 const rejectsRoleGuard = (ts, checker, statement, call) => {
-  if (!ts.isIfStatement(statement)) return false;
-  if (roleCondition(ts, checker, statement.expression, call) && rejects(ts, statement.thenStatement)) return true;
-  return Boolean(statement.elseStatement && roleCondition(ts, checker, statement.expression, call, true) && rejects(ts, statement.elseStatement));
+    if (!ts.isIfStatement(statement))
+        return false;
+    if (roleCondition(ts, checker, statement.expression, call) && rejects(ts, statement.thenStatement))
+        return true;
+    return Boolean(statement.elseStatement && roleCondition(ts, checker, statement.expression, call, true) && rejects(ts, statement.elseStatement));
 };
-
 const rejectsOtherRoles = (ts, checker, call) => {
-  for (const item of statementsAfterVerify(ts, call)) {
-    if (ts.isReturnStatement(item) || ts.isThrowStatement(item)) return false;
-    if (rejectsRoleGuard(ts, checker, item, call)) return true;
-    if (returnsPrincipal(ts, item)) return false;
-  }
-  return false;
-};
-
+    for (const item of statementsAfterVerify(ts, call)) {
+        if (ts.isReturnStatement(item) || ts.isThrowStatement(item))
+            return false;
+        if (rejectsRoleGuard(ts, checker, item, call))
+            return true;
+        if (returnsPrincipal(ts, item))
+            return false;
+    }
+    return false;
+};
 /** R260 is shared by the architecture machine and the published typed ESLint rule. */
 export const jwtPolicyProblems = (ts, checker, call) => {
-  const problems = [];
-  const options = objectValue(ts, checker, call.arguments[2]);
-  const property = name => options?.properties.findLast(entry =>
-    (ts.isPropertyAssignment(entry) || ts.isShorthandPropertyAssignment(entry))
-    && (ts.isIdentifier(entry.name) || ts.isStringLiteralLike(entry.name)) && entry.name.text === name);
-  const value = name => {
-    const entry = property(name);
-    return entry && unwrap(ts, ts.isPropertyAssignment(entry) ? entry.initializer : entry.name);
-  };
-  const algorithms = value('algorithms');
-  const secure = new Set(['ES256', 'RS256', 'EdDSA']);
-  if (!algorithms || !ts.isArrayLiteralExpression(algorithms) || !algorithms.elements.length
-    || algorithms.elements.some(item => !ts.isStringLiteralLike(item) || !secure.has(item.text))
-    || options?.properties.some(entry => ts.isSpreadAssignment(entry))) {
-    problems.push('BE_JWT_ALG_PINNED: algorithms must be a non-empty literal subset of ES256, RS256 and EdDSA.');
-  }
-  if (!fromConfig(ts, checker, value('issuer'))) problems.push('BE_JWT_ALG_PINNED: issuer must derive from typed configuration.');
-  // The principal is bound either by an audience of typed configuration (an OIDC client such as Keycloak, the app's own
-  // Passport tokens) or, where the audience is shared by every token of the issuer (Supabase's literal 'authenticated'),
-  // by rejecting every role other than authenticated before the principal is returned.
-  if (!fromConfig(ts, checker, value('audience')) && !rejectsOtherRoles(ts, checker, call)) {
-    problems.push('BE_JWT_ALG_PINNED: an OIDC verifier audience must derive from typed configuration, or the verified principal must reject every role other than authenticated before returning it.');
-  }
-  return problems;
+    const problems = [];
+    const options = objectValue(ts, checker, call.arguments[2]);
+    const property = (name) => options?.properties.findLast((entry) => (ts.isPropertyAssignment(entry) || ts.isShorthandPropertyAssignment(entry))
+        && (ts.isIdentifier(entry.name) || ts.isStringLiteralLike(entry.name)) && entry.name.text === name);
+    const value = (name) => {
+        const entry = property(name);
+        return entry && unwrap(ts, ts.isPropertyAssignment(entry) ? entry.initializer : entry.name);
+    };
+    const algorithms = value('algorithms');
+    const secure = new Set(['ES256', 'RS256', 'EdDSA']);
+    if (!algorithms || !ts.isArrayLiteralExpression(algorithms) || !algorithms.elements.length
+        || algorithms.elements.some(item => !ts.isStringLiteralLike(item) || !secure.has(item.text))
+        || options?.properties.some(entry => ts.isSpreadAssignment(entry))) {
+        problems.push('BE_JWT_ALG_PINNED: algorithms must be a non-empty literal subset of ES256, RS256 and EdDSA.');
+    }
+    if (!fromConfig(ts, checker, value('issuer')))
+        problems.push('BE_JWT_ALG_PINNED: issuer must derive from typed configuration.');
+    // The principal is bound either by an audience of typed configuration (an OIDC client such as Keycloak, the app's own
+    // Passport tokens) or, where the audience is shared by every token of the issuer (Supabase's literal 'authenticated'),
+    // by rejecting every role other than authenticated before the principal is returned.
+    if (!fromConfig(ts, checker, value('audience')) && !rejectsOtherRoles(ts, checker, call)) {
+        problems.push('BE_JWT_ALG_PINNED: an OIDC verifier audience must derive from typed configuration, or the verified principal must reject every role other than authenticated before returning it.');
+    }
+    return problems;
 };