@ultimat3/cli 19.2.0 → 19.3.1

package/src/verify-step.ts

@@ -29,19 +29,19 @@ export const VERIFY_STEP_NAMES = [
   'drift',
   'contract-diff',
   'budgets',
-  // Eighteenth, and a deliberate widening of a closed list rather than a `HostCheck`: an SEO gate
+  // A deliberate widening of a closed list rather than a `HostCheck`: an SEO gate
   // is a MECHANISM every app with a `site/` surface wants (axiom 8), not a rule one host repo
   // enforces — and `verifyCommand.run` passes no host checks at all, so the app path could not
   // have carried it. It runs beside `budgets` because both read the app the same load produced.
   'seo',
-  // Nineteenth, by the same test the SEO step above passed and for the same reason it is not a
-  // rider: `boundaries` asks whether an import was LEGAL and this asks whether a declaration
+  // Here by the same test the SEO step above passed, and not a rider for the same reason:
+  // `boundaries` asks whether an import was LEGAL and this asks whether a declaration
   // REACHED the running app, which is a different question with a different fix (axiom 4). It
   // costs no second app load — `budgets` already imported every module, and this reads the
   // registries that load filled. Until it existed, an app could ship every user-facing string as
   // `⟦key⟧` with `x verify` green, because nothing in the gate ever asked (issue #249).
   'i18n',
-  // Twentieth, by the same test `seo` and `i18n` each passed: a rider must ask the SAME question
+  // Here by the same test `seo` and `i18n` each passed: a rider must ask the SAME question
   // off the same data, and "was this import legal?" is not "does the permission this app grants
   // and requires exist?". Reported under `budgets` it would hand the reader a byte budget for an
   // authz defect (axiom 4). Until it existed, `x new` shipped an app that answered HTTP 500 with

package/src/verify-tests.ts

@@ -44,7 +44,9 @@ const TYPED_SUFFIXES = '{contract,live,job,e2e,eval}';
  * four sweeps. `type` is a closed union here and cannot be `'constructor'` today, which is
  * exactly the argument every one of those thirteen had before it stopped being true.
  *
- * Same repair, and the same reason, as `packages/i18n/src/catalog.ts`.
+ * Same repair, and the same reason, as `packages/i18n/src/catalog.ts`. The read itself is guarded
+ * too (`summaryOf`), because a construction three screens above a read is not something a static
+ * rule should have to reason about.
  */
 const SUMMARIES: Readonly<Record<TypedTest, string>> = Object.assign(
   Object.create(null) as Record<TypedTest, string>,
@@ -255,6 +257,16 @@ const evalStep: VerifyStep = {
   },
 };
 
+/**
+ * The one computed read of `SUMMARIES`, guarded. The table is already prototype-free
+ * (`Object.create(null)`), which is what makes the READ safe — and `scripts/proto-index.ts`
+ * recognises a guard on the read itself, not a construction three screens above it. So the guard
+ * is here: a rule that has to reason about how a table was built is one tightening away from
+ * reporting this line, and a pin is a rule with a hole in it.
+ */
+const summaryOf = (type: TypedTest): string =>
+  Object.hasOwn(SUMMARIES, type) ? SUMMARIES[type] : `${type} tests`;
+
 const stepFor = (type: TestType): VerifyStep => {
   if (type === 'unit') {
     return {
@@ -266,7 +278,7 @@ const stepFor = (type: TestType): VerifyStep => {
   if (type === 'eval') return evalStep;
   return {
     name: type,
-    summary: SUMMARIES[type],
+    summary: summaryOf(type),
     applies: async (ctx) => (await filesFor(ctx.root, type)).length > 0,
     run: (ctx) => runType(ctx, type),
   };