@ultimat3/cli 11.2.0 → 12.0.0

package/src/verify-checks.ts

@@ -19,6 +19,7 @@ import { checkAppBoundaries } from './app-boundaries';
 import { envExampleFindings } from './app-env';
 import { appManifest, readAppManifest } from './app-manifest';
 import { OPENAPI_FILE, openApiJson } from './app-openapi';
+import { policyFindings } from './app-permissions';
 import { APP_CONFIG_FILE } from './app-root';
 import { checkBudgets, readBuildStats } from './budgets';
 import { checkDestructiveMigrations } from './db-destructive';
@@ -265,6 +266,15 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
     applies: async (ctx) => existsSync(join(ctx.root, APP_CONFIG_FILE)),
     run: async (ctx) => fromFindings(await catalogFindings(ctx.root)),
   },
+  {
+    name: 'policy',
+    summary: 'every permission this app grants or requires is one it declares',
+    // A repo with no `app.config.ts` is the framework monorepo, which declares no roles and
+    // registers no routes — SKIPPED there, never passed, for the reason `i18n` gives: a step that
+    // answers `ok` about nothing is the vacuous green these checks exist to refuse.
+    applies: async (ctx) => existsSync(join(ctx.root, APP_CONFIG_FILE)),
+    run: async (ctx) => fromFindings(await policyFindings(ctx.root)),
+  },
   {
     name: 'manifest',
     summary: 'the files an agent reads: generated facts, hand-written conventions, the env example',
@@ -283,6 +293,7 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
     async run(ctx) {
       const agents = await checkAgentsMd(ctx.root);
       const findings = [
+        ...manifestMissingFindings(ctx.root),
         ...(await driftFindings(ctx.root)),
         ...(await envExampleFindings(ctx.root)),
         ...floorProblemFindings(await readVerifyFloor(ctx.root)),
@@ -312,6 +323,31 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
   },
 ];
 
+/**
+ * The half that had never been asked: is the file there at all? `driftFindings` returns nothing
+ * when it is absent — correctly, it has nothing to compare — and `AGENTS.md` line 3 tells an agent
+ * that facts live in `x.manifest.json`, `x dev` prints its path, and `x manifest` is the only
+ * thing that writes it. Nothing ran it: after `x new`, `bin/setup` and all thirteen generators,
+ * `find . -name '*.manifest.json'` returned nothing while this step reported green (#F7).
+ *
+ * An app root, never this repo: the framework monorepo emits `framework.manifest.json` and has no
+ * `x.manifest.json` to be missing, so the `app.config.ts` is what decides — the same discriminator
+ * `drift`, `budgets`, `seo`, `i18n` and `policy` each use.
+ */
+function manifestMissingFindings(root: string): readonly Finding[] {
+  if (!existsSync(join(root, APP_CONFIG_FILE))) return [];
+  if (existsSync(join(root, MANIFEST_FILENAME))) return [];
+  return [
+    {
+      code: 'X_MANIFEST_MISSING',
+      cause: `${MANIFEST_FILENAME} does not exist, so every fact an agent reads about this app — route table, action schemas, policies, error codes — is unavailable`,
+      fix: 'x manifest',
+      docs: ERROR_DOCS_URL,
+      at: MANIFEST_FILENAME,
+    },
+  ];
+}
+
 /** `assertNoDrift` throws `X_MANIFEST_DRIFT`; a step reports, so the error becomes a finding. */
 async function driftFindings(root: string): Promise<readonly Finding[]> {
   const path = join(root, MANIFEST_FILENAME);

package/src/verify-step.ts

@@ -41,6 +41,14 @@ export const VERIFY_STEP_NAMES = [
   // registries that load filled. Until it existed, an app could ship every user-facing string as
   // `⟦key⟧` with `x verify` green, because nothing in the gate ever asked (issue #249).
   'i18n',
+  // Twentieth, by the same test `seo` and `i18n` each passed: a rider must ask the SAME question
+  // off the same data, and "was this import legal?" is not "does the permission this app grants
+  // and requires exist?". Reported under `budgets` it would hand the reader a byte budget for an
+  // authz defect (axiom 4). Until it existed, `x new` shipped an app that answered HTTP 500 with
+  // X_PERMISSION_UNKNOWN on two of its three routes under a green gate: `defineRoles()` accepts an
+  // undeclared grant in silence and `RouteGuard.permission` is a bare string. It costs no second
+  // app load — `budgets` already imported every module, and this reads the registries that filled.
+  'policy',
   'manifest',
   'roadmap',
 ] as const;

package/src/island-solid-production.ts

@@ -1,129 +0,0 @@
-// Every `solid-js` import in an island chunk resolves to Solid's PRODUCTION browser build.
-// `Bun.build({ target: 'browser' })` always adds the `development` export condition and offers no
-// option that removes it — `conditions`, `production`, `env` and `define` were each measured under
-// Bun 1.4 and none of them does — so without this seam an island ships the dev bundle silently.
-
-// `node:path` by necessity: Bun ships no path API, and this file resolves a package entry back
-// to the directory its `exports` map is relative to.
-import { dirname, join } from 'node:path';
-import type { BunPlugin } from 'bun';
-import { IslandBuildFailedError } from './errors';
-
-/**
- * The conditions an island's `solid-js` subpath is resolved under. `development` is the one NOT in
- * the set, which is the whole point of the file; `production` is in it because an island chunk is
- * only ever built to be shipped — `x dev` serves the same chunk the container does, so a second
- * answer here would be a bundle the byte budget never measured.
- */
-const ISLAND_CONDITIONS: ReadonlySet<string> = new Set([
-  'production',
-  'browser',
-  'module',
-  'import',
-  'default',
-]);
-
-/** `solid-js` and its subpaths, and nothing else: Solid is the runtime an island is compiled for. */
-const SOLID_SPECIFIER = /^solid-js(?:\/|$)/;
-
-/**
- * Node's conditional-exports walk, restricted to what this file needs: the first key of the object
- * that the build's condition set contains, depth-first, with an array as an ordered fallback list.
- * Written out rather than delegated to `Bun.resolveSync` because the ONE thing it has to do
- * differently from Bun's resolver is refuse `development` — and `types` with it, which would
- * otherwise win on Solid's map and hand the bundler a `.d.ts`.
- */
-export function selectCondition(node: unknown, conditions: ReadonlySet<string>): string | null {
-  if (typeof node === 'string') return node;
-  if (Array.isArray(node)) {
-    for (const alternative of node as readonly unknown[]) {
-      const picked = selectCondition(alternative, conditions);
-      if (picked !== null) return picked;
-    }
-    return null;
-  }
-  if (typeof node !== 'object' || node === null) return null;
-  for (const [condition, value] of Object.entries(node)) {
-    if (!conditions.has(condition)) continue;
-    const picked = selectCondition(value, conditions);
-    if (picked !== null) return picked;
-  }
-  return null;
-}
-
-/** One parse per manifest: an island imports Solid from several files, and every file asks again. */
-const exportsCache = new Map<string, unknown>();
-
-async function exportsOf(manifest: string): Promise<unknown> {
-  const hit = exportsCache.get(manifest);
-  if (hit !== undefined || exportsCache.has(manifest)) return hit;
-  const parsed: unknown = JSON.parse(await Bun.file(manifest).text());
-  const field =
-    typeof parsed === 'object' && parsed !== null && 'exports' in parsed
-      ? (parsed as { readonly exports?: unknown }).exports
-      : undefined;
-  exportsCache.set(manifest, field);
-  return field;
-}
-
-/** Test seam: the cache is process-global because `x dev` rebuilds in one process. */
-export function clearSolidExportsCache(): void {
-  exportsCache.clear();
-}
-
-/**
- * The absolute file `specifier` must resolve to, or `null` for "Bun's own answer is already the
- * right one" — which is every subpath Solid declares as a plain string or a pattern, since a
- * declaration with no conditions on it cannot select the development build.
- */
-export async function solidProductionEntry(
-  specifier: string,
-  resolveDir: string,
-  importer: string,
-): Promise<string | null> {
-  let manifest: string;
-  try {
-    // `solid-js/package.json` is an `exports` entry of Solid's own map, so this reaches the exact
-    // copy the island would have imported — not a hoisted sibling at a different version.
-    manifest = Bun.resolveSync('solid-js/package.json', resolveDir);
-  } catch {
-    // Solid is not installed here. Bun's resolver says so, in its own words, naming the importer.
-    return null;
-  }
-  const field = await exportsOf(manifest);
-  const subpath = specifier === 'solid-js' ? '.' : `.${specifier.slice('solid-js'.length)}`;
-  if (typeof field !== 'object' || field === null || !(subpath in field)) return null;
-
-  const entry = selectCondition((field as Record<string, unknown>)[subpath], ISLAND_CONDITIONS);
-  const file = entry === null ? null : join(dirname(manifest), entry);
-  if (file === null || !(await Bun.file(file).exists())) {
-    throw new IslandBuildFailedError({
-      file: importer.length > 0 ? importer : specifier,
-      logs:
-        `${specifier} has no production browser entry: ${manifest} answers ` +
-        `${entry === null ? 'nothing' : JSON.stringify(entry)} under ` +
-        `[${[...ISLAND_CONDITIONS].join(', ')}], and an island may not ship Solid's ` +
-        'development build',
-    });
-  }
-  return file;
-}
-
-/**
- * The plugin `island-bundle.ts` hands `Bun.build`, beside `solidJsxPlugin`. Stateless apart from
- * the manifest cache, so one frozen descriptor serves every concurrent island build.
- *
- * The absolute path it answers with no longer matches `SOLID_SPECIFIER`, so Solid's own internal
- * `import … from 'solid-js'` is the only re-entry — and that one is wanted: it is how `web.js`
- * reaches `solid.js` rather than `dev.js`.
- */
-export const solidProductionPlugin: BunPlugin = {
-  name: 'ultimate-island-solid-production',
-  setup(build): void {
-    build.onResolve({ filter: SOLID_SPECIFIER }, async ({ path, importer, resolveDir }) => {
-      const from = resolveDir.length > 0 ? resolveDir : dirname(importer);
-      const entry = await solidProductionEntry(path, from, importer);
-      return entry === null ? undefined : { path: entry };
-    });
-  },
-};