@vantageos/backend-doctor 0.1.6 → 0.1.8

package/dist/detectors/source/isolation.js

@@ -120,7 +120,9 @@ function discoverBuilders(files) {
 function definitionOpener(raw, set) {
     // longest builder names first so `authedQuery` wins over a `query` substring.
     const names = [...set].sort((a, z) => z.length - a.length);
-    const alt = names.map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    const alt = names
+        .map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .join("|");
     const re = new RegExp(`(?:export\\s+)?const\\s+([A-Za-z0-9_]+)\\s*=\\s*(${alt})\\s*\\(`);
     const m = re.exec(raw);
     return m ? { name: m[1], builder: m[2] } : null;
@@ -234,6 +236,12 @@ export function scanR50(files) {
     // Pass 1: discover the tree's query/mutation builders so a customQuery wrapper
     // (authedQuery, orgQuery, …) is recognised, not just the bare `query` base.
     const builders = discoverBuilders(files);
+    // Public queries that matched a definition opener but exhibit NO org-throw, NO
+    // fail-closed resolver, and NO isolation-contract marker. Not gated subjects, so
+    // historically SKIPPED — which, when EVERY public query is such a bare read,
+    // produced a false "no public query matched" abstain. Recorded for the
+    // otherwise-empty branch below.
+    const ungated = [];
     // A customQuery wrapper whose base is neither query nor internalQuery leaves the
     // public-query surface unknowable — REFUSE (could-not-judge), never a silent green.
     for (const a of builders.ambiguous) {
@@ -321,16 +329,21 @@ export function scanR50(files) {
             // so a commented-out throw does not count). The contract marker is, by
             // definition, a COMMENT — so it is read from the full block text INCLUDING
             // comment lines, not the code-only blockText.
-            const blockTextWithComments = block.lines
-                .map((l) => l.raw)
-                .join("\n");
+            const blockTextWithComments = block.lines.map((l) => l.raw).join("\n");
             const throwsOnNoOrg = ORG_THROW.test(blockText) || ORG_THROW_HELPER.test(blockText);
             const hasResolver = SAFE_RESOLVER.test(blockText);
             const hasMarker = CONTRACT_MARKER.test(blockTextWithComments);
             if (!throwsOnNoOrg && !hasResolver && !hasMarker) {
                 // query does neither org-isolation throw nor fail-closed resolve nor
                 // declare a contract — not R-50's subject (too ambiguous to judge
-                // mechanically; never a violation).
+                // mechanically; never a violation). Recorded so a tree whose ENTIRE
+                // public-read surface is bare is judged (CNJ-with-sites) rather than
+                // falsely abstained as "no public query matched".
+                ungated.push({
+                    rel: f.rel,
+                    n: block.lines[0].n,
+                    note: `${fn}: public query with no org-throw, no fail-closed resolver, and no isolation-contract marker — no org-isolation handling is visible in convex/, and whether a subscribing client can reach it before an org exists is not statically decidable; a reviewer must confirm this read isolates by org (never a silent clean bill)`,
+                });
                 continue;
             }
             // PRECEDENCE (Eta #13 REVISE seam): the THROW wins over a fail-closed
@@ -390,6 +403,18 @@ export function scanR50(files) {
             }
         }
     }
+    // A tree whose ENTIRE public-read surface is ungated (no throw / resolver / marker
+    // on ANY query) leaves the scan otherwise empty. The legacy abstain then claimed
+    // "no public query matched" — FALSE when bare public queries exist, and a silent
+    // pass over a fully-ungated backend. Surface those reads as could-not-judge sites
+    // so the verdict is CNJ-with-sites, not a misleading empty abstain. Gated on "scan
+    // otherwise empty" so a tree that already produced subjects (VP: 20 conform) is
+    // byte-for-byte unchanged.
+    if (scan.conform.length + scan.violate.length + scan.cnj.length === 0 &&
+        ungated.length > 0) {
+        for (const u of ungated)
+            scan.cnj.push(u);
+    }
     return scan;
 }
 export const R50 = srcDetector("R-50", "R-50 org isolation on a reactively-subscribed read returns a typed empty/unauthorized result, never an uncaught throw", "a public query that resolves org via a fail-closed non-throwing path or documents its client contract — it never throws on the missing-org path a subscribing client cannot catch", scanR50, "R-50: no public query matched in the scanned tree — no reactive read to certify. NOT a clean bill.");

package/dist/detectors/source/jobs.js

@@ -168,8 +168,8 @@ export function scanR20(files) {
 // THAT site -> conform; else -> violate. A numeric/exception on a DIFFERENT
 // site does not carry.
 // ---------------------------------------------------------------------------
-const NUMERIC_WINDOW = /windowms\s*:\s*\d|\brate_?window\w*\s*=\s*\d|(\d[\d_]*)\s*(ms|_?000)\b|per\s+(minute|second|hour)/i;
-const NUMERIC_MAX = /maxperwindow\s*:\s*\d|\brate_?limit\w*\s*=\s*\d|\b\d+\s*(req|requests|per)\b/i;
+const NUMERIC_WINDOW = /windowms\s*:\s*\d|(?:^|[^A-Za-z])rate_?window\w*\s*=\s*\d|(\d[\d_]*)\s*(ms|_?000)\b|per\s+(minute|second|hour)/i;
+const NUMERIC_MAX = /maxperwindow\s*:\s*\d|(?:^|[^A-Za-z])rate_?limit\w*\s*=\s*\d|\b\d+\s*(req|requests|per)\b/i;
 const WRITTEN_EXCEPTION = /allow-unbounded|written exception|rate-limit exception/i;
 // A limiter DECLARATION/enforcement, not a mere keyword mention:
 //  - `maxPerWindow:` — the per-window MAX key (the definitive throttle signal;
@@ -180,7 +180,7 @@ const WRITTEN_EXCEPTION = /allow-unbounded|written exception|rate-limit exceptio
 // human-readable rejection strings (`"...5 registrations per minute per IP."`)
 // that are not control declarations. It survives only as a WINDOW confirmation
 // inside a site already anchored by a real limiter declaration.
-const RATE_CONTROL_DECL = /maxperwindow\s*:|\brate_?limit\w*\s*=\s*\d/i;
+const RATE_CONTROL_DECL = /maxperwindow\s*:|(?:^|[^A-Za-z])rate_?limit\w*\s*=\s*\d/i;
 // A schema table declaration or a validator field is never a control SITE —
 // this is what excludes `credentialsRateLimits: defineTable(...)` and
 // `maxPerWindow: v.number()` from anchoring a site.

package/dist/detectors/source/write-isolation.js

@@ -141,7 +141,9 @@ function discoverWriteBuilders(files) {
 }
 function definitionOpener(raw, set) {
     const names = [...set].sort((a, z) => z.length - a.length);
-    const alt = names.map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    const alt = names
+        .map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .join("|");
     const re = new RegExp(`(?:export\\s+)?const\\s+([A-Za-z0-9_]+)\\s*=\\s*(${alt})\\s*\\(`);
     const m = re.exec(raw);
     return m ? { name: m[1], builder: m[2] } : null;
@@ -169,6 +171,13 @@ function mutationBlock(lines, i) {
 export function scanR51(files) {
     const scan = emptyScan();
     const builders = discoverWriteBuilders(files);
+    // Public writes that matched a definition opener but exhibit NO org-throw, NO
+    // typed-unauthorized return, and NO write-contract marker. They are not gated
+    // subjects, so they were historically SKIPPED — which, when EVERY public write
+    // in the tree is such a bare write, produced a false "no public mutation
+    // matched" abstain (a silent pass over a fully-ungated public-write surface).
+    // Recorded here so the otherwise-empty branch below can surface them.
+    const ungated = [];
     for (const a of builders.ambiguous) {
         scan.cnj.push({
             rel: a.rel,
@@ -236,8 +245,17 @@ export function scanR51(files) {
             const throwsOnNoOrg = ORG_THROW.test(blockText) || WRITE_GATE_HELPER.test(blockText);
             const typedUnauth = TYPED_UNAUTH_RETURN.test(blockText);
             const hasMarker = CONTRACT_MARKER.test(blockAll);
-            if (!throwsOnNoOrg && !typedUnauth && !hasMarker)
-                continue; // not a subject
+            if (!throwsOnNoOrg && !typedUnauth && !hasMarker) {
+                // A bare public write with no visible org isolation. Not a gated
+                // subject — but recorded so a tree whose ENTIRE public-write surface
+                // is bare is judged (CNJ-with-sites) rather than falsely abstained.
+                ungated.push({
+                    rel: f.rel,
+                    n: block.lines[0].n,
+                    note: `${fn}: public mutation with no org-throw, no typed-unauthorized return, and no write-contract marker — no org-isolation handling is visible in convex/, and whether a client can reach it before an org exists is not statically decidable; a reviewer must confirm this write isolates by org (never a silent clean bill)`,
+                });
+                continue; // not a gated subject
+            }
             if (typedUnauth) {
                 // The write returns a shape on the no-org path — a pre-org client can render
                 // it, not an uncaught Server Error. Green.
@@ -295,6 +313,19 @@ export function scanR51(files) {
             }
         }
     }
+    // A tree whose ENTIRE public-write surface is ungated (no throw / typed-unauth /
+    // marker on ANY write) leaves the scan otherwise empty. The legacy abstain then
+    // claimed "no public mutation matched" — FALSE when bare public writes exist, and
+    // a silent pass over a fully-ungated backend. Surface those writes as
+    // could-not-judge sites so the verdict is CNJ-with-sites, not a misleading empty
+    // abstain. Gated on "scan otherwise empty" so a tree that already produced
+    // subjects (VP: 7 marker CNJ) is byte-for-byte unchanged — the bare-write
+    // disposition in a mixed tree is out of this fix's scope.
+    if (scan.conform.length + scan.violate.length + scan.cnj.length === 0 &&
+        ungated.length > 0) {
+        for (const u of ungated)
+            scan.cnj.push(u);
+    }
     return scan;
 }
 export const R51 = srcDetector("R-51", "R-51 a public mutation returns a typed unauthorized result on the no-org path, never an uncaught throw a pre-org client shell cannot render", "a public write either returns a typed unauthorized result / documents its client contract, or a human confirms a pre-org client cannot reach it — it never throws NO_ORG on a path an ordinary render can hit", scanR51, "R-51: no public mutation matched in the scanned tree — no write to certify. NOT a clean bill.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/backend-doctor",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "A conformance instrument that measures the VantagePeers backend against the pinned backend standard. The THIRD doctor built ON the @vantageos/mcp-doctor engine — never a third engine. It consumes runDoctor/renderTable and adds only detectors.",
   "type": "module",
   "main": "./dist/cli.js",