@webjsdev/server 0.8.51 → 0.8.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.51",
+  "version": "0.8.53",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

package/src/check.js

@@ -129,11 +129,6 @@ export const RULES = [
     description:
       'A `\'use server\'` action file that declares HTTP-verb config (any of `method` / `cache` / `tags` / `invalidates` / `validate`, #488) must export exactly ONE callable action function. The config is file-level (it applies to the action in the file), so a second exported function would silently inherit the same verb / cache, which is almost never intended and makes the contract ambiguous. Move the extra function to its own `.server.ts` file (the one-function-per-file convention), or, if it is a private helper, do not export it. Files with no verb config are unaffected.',
   },
-  {
-    name: 'no-scaffold-placeholder',
-    description:
-      'The one sentinel-based check, and the deliberate exception to the "objectively broken code" framing of the other rules: it flags scaffold example content that has not been replaced, so a delivered app contains only what the user intended and never leftover scaffold code. `webjs create` marks its example/demo files (the example homepage in app/page.ts, the example app chrome in app/layout.ts) with a one-line marker comment carrying the literal token `webjs-scaffold-placeholder`. The rule scans raw source (the marker lives in a comment, which the redacted scan view would hide) and fails for every file that still carries the token. A freshly scaffolded app fails this rule BY DESIGN until its placeholders are addressed: replace the example content, or deliberately keep it, and in either case delete the marker line. No finished app legitimately ships a literal remove-me marker, so this still qualifies as a check rather than a convention. The marker is acknowledge-and-remove, so keeping a piece is a one-line deletion rather than a forced rewrite.',
-  },
   {
     name: 'no-redirect-in-api-route',
     description:
@@ -240,74 +235,70 @@ function isArrayTypeText(type) {
 function findFieldInitializers(classBody, props) {
   /** @type {string[]} */
   const out = [];
-  // Walk the body, tracking brace depth. At depth 0, look for
-  // class-field-shaped lines.
+  const n = classBody.length;
+  // Match class-field declarations. Two shapes:
+  // 1. With initializer: `count = 0`, `count: number = 0`, `public count = 0`
+  // 2. Type-only (no initializer): `count!: number`, `count?: number`, `count: number`
+  // Both compile to Object.defineProperty after super() under modern class-field
+  // semantics, clobbering the reactive accessor.
+  // The initializer regex: optional modifier, identifier, optional type, then `=`.
+  const initRe = /^\s*(?:(public|private|protected|readonly)\s+)?([A-Za-z_$][\w$]*)\s*(?::\s*[^=;]+)?\s*=\s*[^=>]/;
+  // The type-only regex: optional modifier, identifier, then `!:` or `?:` or `:` with a type.
+  const typeOnlyRe = /^\s*(?:(public|private|protected|readonly)\s+)?([A-Za-z_$][\w$]*)\s*[!?]?\s*:\s*\S/;
+  const examineLine = (lineStart) => {
+    let j = lineStart;
+    while (j < n && classBody[j] !== '\n') j++;
+    const line = classBody.slice(lineStart, j);
+    const initM = initRe.exec(line);
+    const typeM = typeOnlyRe.exec(line);
+    // Prefer the initializer match; if neither, skip.
+    const name = initM ? initM[2] : (typeM ? typeM[2] : null);
+    // `declare`, `static`, and `this.` patterns shouldn't reach here
+    // (declare/static start with their keyword, this.x has the dot in
+    // the regex group), but guard against matching keywords as names:
+    if (name && name !== 'declare' && name !== 'static' && props.has(name)) out.push(name);
+  };
+  // Walk the body char by char, tracking brace depth. A class field lives at
+  // the class-body top level (depth 0). We examine a line ONCE, at its first
+  // non-whitespace char, only while depth is 0, and WITHOUT skipping the braces
+  // on that line: an opening brace on the line (`method() {`, `field = {`) must
+  // still be counted so the lines inside its block are seen at depth > 0. The
+  // earlier version jumped `i` past the whole examined line, which dropped that
+  // line's braces and let object-literal keys inside a method body (`{ game:
+  // ..., scoreboard: ... }`) be misread as depth-0 class fields (#934).
   let depth = 0;
   let i = 0;
   let lineStart = 0;
+  let examined = false;
   let str = '';
-  while (i < classBody.length) {
+  while (i < n) {
     const c = classBody[i];
     if (str) {
       if (c === '\\') { i += 2; continue; }
       if (c === str) str = '';
-      else if (str === '`' && c === '$' && classBody[i + 1] === '{') {
-        depth++;
-        i += 2;
-        continue;
-      }
-      i++;
-      continue;
-    }
-    if (c === '\n') {
-      lineStart = i + 1;
       i++;
       continue;
     }
+    if (c === '\n') { lineStart = i + 1; examined = false; i++; continue; }
     if (c === '/' && classBody[i + 1] === '/') {
-      while (i < classBody.length && classBody[i] !== '\n') i++;
+      while (i < n && classBody[i] !== '\n') i++;
       continue;
     }
     if (c === '/' && classBody[i + 1] === '*') {
       i += 2;
-      while (i < classBody.length && !(classBody[i] === '*' && classBody[i + 1] === '/')) i++;
+      while (i < n && !(classBody[i] === '*' && classBody[i + 1] === '/')) i++;
       i += 2;
       continue;
     }
     if (c === "'" || c === '"' || c === '`') { str = c; i++; continue; }
+    // First non-whitespace char of a class-body top-level line: examine it for
+    // a field declaration BEFORE consuming any brace it opens.
+    if (depth === 0 && !examined && !/\s/.test(c)) {
+      examined = true;
+      examineLine(lineStart);
+    }
     if (c === '{') { depth++; i++; continue; }
     if (c === '}') { depth--; i++; continue; }
-    // At class-body top level, examine candidate lines starting at lineStart.
-    if (depth === 0 && i === lineStart || (depth === 0 && /\s/.test(c) && i === lineStart)) {
-      // Take the rest of the line up to a newline.
-      let j = lineStart;
-      while (j < classBody.length && classBody[j] !== '\n') j++;
-      const line = classBody.slice(lineStart, j);
-      // Match class-field declarations. Two shapes:
-      // 1. With initializer: `count = 0`, `count: number = 0`, `public count = 0`
-      // 2. Type-only (no initializer): `count!: number`, `count?: number`, `count: number`
-      // Both compile to Object.defineProperty after super() under modern class-field
-      // semantics, clobbering the reactive accessor.
-      // The initializer regex: optional modifier, identifier, optional type, then `=`.
-      const initRe = /^\s*(?:(public|private|protected|readonly)\s+)?([A-Za-z_$][\w$]*)\s*(?::\s*[^=;]+)?\s*=\s*[^=>]/;
-      // The type-only regex: optional modifier, identifier, then `!:` or `?:` or `:` with a type.
-      const typeOnlyRe = /^\s*(?:(public|private|protected|readonly)\s+)?([A-Za-z_$][\w$]*)\s*[!?]?\s*:\s*\S/;
-      const initM = initRe.exec(line);
-      const typeM = typeOnlyRe.exec(line);
-      // Prefer the initializer match; if neither, skip.
-      const name = initM ? initM[2] : (typeM ? typeM[2] : null);
-      if (name) {
-        // `declare`, `static`, and `this.` patterns shouldn't reach here
-        // (declare/static start with their keyword, this.x has the dot in
-        // the regex group), but guard against matching keywords as names:
-        if (name !== 'declare' && name !== 'static' && props.has(name)) {
-          out.push(name);
-        }
-      }
-      // Advance past this line so we don't re-match.
-      i = j;
-      continue;
-    }
     i++;
   }
   return out;
@@ -668,27 +659,6 @@ export async function checkConventions(appDir) {
     }
   }
 
-  // --- Rule: no-scaffold-placeholder ---
-  // `webjs create` marks its example/demo files (app/page.ts, app/layout.ts)
-  // with a one-line marker comment so a delivered app cannot silently ship
-  // leftover scaffold content. Scan RAW `content`: the marker lives in a
-  // comment, which the `scan` view redacts to whitespace. One violation per
-  // still-marked file. The token is assembled here so this source does not
-  // itself carry the contiguous literal.
-  {
-    const MARKER = 'webjs-scaffold-' + 'placeholder';
-    for (const { rel, content } of files) {
-      if (!content.includes(MARKER)) continue;
-      violations.push({
-        rule: 'no-scaffold-placeholder',
-        file: rel,
-        message:
-          'Scaffold placeholder marker still present. This file is unmodified example content from `webjs create`, and the delivered app should contain only what the user intended, not leftover scaffold code.',
-        fix: `Replace the example content (or deliberately keep it), then delete the marker comment line carrying the ${MARKER} token.`,
-      });
-    }
-  }
-
   // --- Rule: no-redirect-in-api-route ---
   // `redirect()` from `@webjsdev/core` throws a control-flow signal designed
   // for the SSR page renderer. In a `route.ts` API handler it goes uncaught

package/src/component-elision.js

@@ -93,7 +93,7 @@ export const REACTIVE_IMPORTS = new Set([
  * defines `render`, and the SSR walker calls it directly. `constructor`
  * is absent for the same reason (it runs during SSR to seed first
  * paint). Keep this list in lockstep with the lifecycle table in
- * agent-docs/components.md.
+ * the skill's references/components.md.
  *
  * @type {readonly string[]}
  */
@@ -134,7 +134,7 @@ export const CLIENT_METHOD_CALLS = ['addController', 'removeController', 'reques
  * `lifecycle-coverage.test.js` via prototype introspection), there is no
  * enumerable runtime source of "all static conventions", so the contract is
  * a documented one: a new interactivity static field MUST be added here AND
- * to the lifecycle table in agent-docs/components.md. `sigil-coverage.test.js`
+ * to the lifecycle table in the skill's references/components.md. `sigil-coverage.test.js`
  * asserts each entry is honoured as a ship signal.
  *
  *   - `shadow`: Declarative Shadow DOM attaches ONLY during HTML parsing, so a
@@ -448,7 +448,7 @@ function importsClientRouter(src, literals) {
  * `customElements.define` at module top level) imported via a binding clause
  * is NOT caught here, so eliding the importer drops that registration and the
  * element silently does not upgrade. This is the cross-module-registration
- * caveat documented in agent-docs/components.md and server AGENTS invariant 7;
+ * caveat documented in the skill's references/components.md and server AGENTS invariant 7;
  * the fix is `.server.{js,ts}` for genuinely server-only deps, or an
  * interactivity signal on the consumer. (It is not caught by an SSR crash:
  * the SSR `customElements` shim makes `define` a no-op server-side.)