@webpieces/code-rules 0.4.467 → 0.4.469

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/code-rules",
-  "version": "0.4.467",
+  "version": "0.4.469",
   "description": "Standalone code validation rules extracted from architecture-validators, no Nx dependency required",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -20,7 +20,7 @@
     "directory": "packages/tooling/code-rules"
   },
   "dependencies": {
-    "@webpieces/rules-config": "0.4.467",
+    "@webpieces/rules-config": "0.4.469",
     "@inversifyjs/binding-decorators": "1.1.5",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"

package/src/code-rules-config-table.js

@@ -22,6 +22,7 @@ exports.CONFIG_BINDINGS = [
     [rules_config_1.NoUnmanagedExceptionsConfig, 'no-unmanaged-exceptions'],
     [rules_config_1.AngularNoDirectApiInResolverConfig, 'angular-no-direct-api-in-resolver'],
     [rules_config_1.NoSymbolDiTokensConfig, 'no-symbol-di-tokens'],
+    [rules_config_1.NoClientCreationOutsideServerOrClientConfig, 'no-client-creation-outside-server-or-client'],
     [rules_config_1.NoCustomCssConfig, 'no-custom-css'],
     [rules_config_1.NoProcessExitOutsideMainConfig, 'no-process-exit-outside-main'],
     [rules_config_1.NoFunctionOutsideClassConfig, 'no-function-outside-class'],

package/src/code-rules-config-table.js.map

@@ -1 +1 @@
-{"version":3,"file":"code-rules-config-table.js","sourceRoot":"","sources":["../../../../../packages/tooling/code-rules/src/code-rules-config-table.ts"],"names":[],"mappings":";;;AAAA,0DAsBiC;AAKjC;;;;;GAKG;AACU,QAAA,eAAe,GAAqE;IAC7F,CAAC,mCAAoB,EAAE,kBAAkB,CAAC;IAC1C,CAAC,iCAAkB,EAAE,gBAAgB,CAAC;IACtC,CAAC,sCAAuB,EAAE,qBAAqB,CAAC;IAChD,CAAC,yCAA0B,EAAE,yBAAyB,CAAC;IACvD,CAAC,iCAAkB,EAAE,gBAAgB,CAAC;IACtC,CAAC,kCAAmB,EAAE,iBAAiB,CAAC;IACxC,CAAC,uCAAwB,EAAE,sBAAsB,CAAC;IAClD,CAAC,oCAAqB,EAAE,kBAAkB,CAAC;IAC3C,CAAC,kCAAmB,EAAE,gBAAgB,CAAC;IACvC,CAAC,sCAAuB,EAAE,qBAAqB,CAAC;IAChD,CAAC,0CAA2B,EAAE,yBAAyB,CAAC;IACxD,CAAC,iDAAkC,EAAE,mCAAmC,CAAC;IACzE,CAAC,qCAAsB,EAAE,qBAAqB,CAAC;IAC/C,CAAC,gCAAiB,EAAE,eAAe,CAAC;IACpC,CAAC,6CAA8B,EAAE,8BAA8B,CAAC;IAChE,CAAC,2CAA4B,EAAE,2BAA2B,CAAC;IAC3D,CAAC,8DAA+C,EAAE,iDAAiD,CAAC;IACpG,CAAC,iCAAkB,EAAE,eAAe,CAAC;IACrC,CAAC,4BAAa,EAAE,UAAU,CAAC;CAC9B,CAAC","sourcesContent":["import {\n    BaseRuleConfig,\n    WebpiecesRulesConfig,\n    MaxMethodLinesConfig,\n    MaxFileLinesConfig,\n    RequireReturnTypeConfig,\n    NoInlineTypeLiteralsConfig,\n    NoAnyUnknownConfig,\n    NoImplicitAnyConfig,\n    PrismaValidateDtosConfig,\n    PrismaConverterConfig,\n    NoDestructureConfig,\n    CatchErrorPatternConfig,\n    NoUnmanagedExceptionsConfig,\n    AngularNoDirectApiInResolverConfig,\n    NoSymbolDiTokensConfig,\n    NoCustomCssConfig,\n    NoProcessExitOutsideMainConfig,\n    NoFunctionOutsideClassConfig,\n    InjectAnnotationNotNeededForConcreteClassConfig,\n    FrameworkTagConfig,\n    RoleTagConfig,\n} from '@webpieces/rules-config';\n\n/** A rule config class usable as an inversify inject-by-type token. */\nexport type ConfigCtor = new () => BaseRuleConfig;\n\n/**\n * The 1:1 table of `[config class, webpieces.config.json rule key]`. The composition root iterates it\n * to bind each rule's config into the container (`bind(ConfigClass).toConstantValue(config[key] ??\n * new ConfigClass())`), so every `@provideSingleton` validator injects its config by type. Data only\n * — the binding loop lives inline in the bin (an inline loop, exempt from no-function-outside-class).\n */\nexport const CONFIG_BINDINGS: ReadonlyArray<readonly [ConfigCtor, keyof WebpiecesRulesConfig]> = [\n    [MaxMethodLinesConfig, 'max-method-lines'],\n    [MaxFileLinesConfig, 'max-file-lines'],\n    [RequireReturnTypeConfig, 'require-return-type'],\n    [NoInlineTypeLiteralsConfig, 'no-inline-type-literals'],\n    [NoAnyUnknownConfig, 'no-any-unknown'],\n    [NoImplicitAnyConfig, 'no-implicit-any'],\n    [PrismaValidateDtosConfig, 'prisma-validate-dtos'],\n    [PrismaConverterConfig, 'prisma-converter'],\n    [NoDestructureConfig, 'no-destructure'],\n    [CatchErrorPatternConfig, 'catch-error-pattern'],\n    [NoUnmanagedExceptionsConfig, 'no-unmanaged-exceptions'],\n    [AngularNoDirectApiInResolverConfig, 'angular-no-direct-api-in-resolver'],\n    [NoSymbolDiTokensConfig, 'no-symbol-di-tokens'],\n    [NoCustomCssConfig, 'no-custom-css'],\n    [NoProcessExitOutsideMainConfig, 'no-process-exit-outside-main'],\n    [NoFunctionOutsideClassConfig, 'no-function-outside-class'],\n    [InjectAnnotationNotNeededForConcreteClassConfig, 'inject-annotation-not-needed-for-concrete-class'],\n    [FrameworkTagConfig, 'framework-tag'],\n    [RoleTagConfig, 'role-tag'],\n];\n"]}
+{"version":3,"file":"code-rules-config-table.js","sourceRoot":"","sources":["../../../../../packages/tooling/code-rules/src/code-rules-config-table.ts"],"names":[],"mappings":";;;AAAA,0DAuBiC;AAKjC;;;;;GAKG;AACU,QAAA,eAAe,GAAqE;IAC7F,CAAC,mCAAoB,EAAE,kBAAkB,CAAC;IAC1C,CAAC,iCAAkB,EAAE,gBAAgB,CAAC;IACtC,CAAC,sCAAuB,EAAE,qBAAqB,CAAC;IAChD,CAAC,yCAA0B,EAAE,yBAAyB,CAAC;IACvD,CAAC,iCAAkB,EAAE,gBAAgB,CAAC;IACtC,CAAC,kCAAmB,EAAE,iBAAiB,CAAC;IACxC,CAAC,uCAAwB,EAAE,sBAAsB,CAAC;IAClD,CAAC,oCAAqB,EAAE,kBAAkB,CAAC;IAC3C,CAAC,kCAAmB,EAAE,gBAAgB,CAAC;IACvC,CAAC,sCAAuB,EAAE,qBAAqB,CAAC;IAChD,CAAC,0CAA2B,EAAE,yBAAyB,CAAC;IACxD,CAAC,iDAAkC,EAAE,mCAAmC,CAAC;IACzE,CAAC,qCAAsB,EAAE,qBAAqB,CAAC;IAC/C,CAAC,0DAA2C,EAAE,6CAA6C,CAAC;IAC5F,CAAC,gCAAiB,EAAE,eAAe,CAAC;IACpC,CAAC,6CAA8B,EAAE,8BAA8B,CAAC;IAChE,CAAC,2CAA4B,EAAE,2BAA2B,CAAC;IAC3D,CAAC,8DAA+C,EAAE,iDAAiD,CAAC;IACpG,CAAC,iCAAkB,EAAE,eAAe,CAAC;IACrC,CAAC,4BAAa,EAAE,UAAU,CAAC;CAC9B,CAAC","sourcesContent":["import {\n    BaseRuleConfig,\n    WebpiecesRulesConfig,\n    MaxMethodLinesConfig,\n    MaxFileLinesConfig,\n    RequireReturnTypeConfig,\n    NoInlineTypeLiteralsConfig,\n    NoAnyUnknownConfig,\n    NoImplicitAnyConfig,\n    PrismaValidateDtosConfig,\n    PrismaConverterConfig,\n    NoDestructureConfig,\n    CatchErrorPatternConfig,\n    NoUnmanagedExceptionsConfig,\n    AngularNoDirectApiInResolverConfig,\n    NoSymbolDiTokensConfig,\n    NoClientCreationOutsideServerOrClientConfig,\n    NoCustomCssConfig,\n    NoProcessExitOutsideMainConfig,\n    NoFunctionOutsideClassConfig,\n    InjectAnnotationNotNeededForConcreteClassConfig,\n    FrameworkTagConfig,\n    RoleTagConfig,\n} from '@webpieces/rules-config';\n\n/** A rule config class usable as an inversify inject-by-type token. */\nexport type ConfigCtor = new () => BaseRuleConfig;\n\n/**\n * The 1:1 table of `[config class, webpieces.config.json rule key]`. The composition root iterates it\n * to bind each rule's config into the container (`bind(ConfigClass).toConstantValue(config[key] ??\n * new ConfigClass())`), so every `@provideSingleton` validator injects its config by type. Data only\n * — the binding loop lives inline in the bin (an inline loop, exempt from no-function-outside-class).\n */\nexport const CONFIG_BINDINGS: ReadonlyArray<readonly [ConfigCtor, keyof WebpiecesRulesConfig]> = [\n    [MaxMethodLinesConfig, 'max-method-lines'],\n    [MaxFileLinesConfig, 'max-file-lines'],\n    [RequireReturnTypeConfig, 'require-return-type'],\n    [NoInlineTypeLiteralsConfig, 'no-inline-type-literals'],\n    [NoAnyUnknownConfig, 'no-any-unknown'],\n    [NoImplicitAnyConfig, 'no-implicit-any'],\n    [PrismaValidateDtosConfig, 'prisma-validate-dtos'],\n    [PrismaConverterConfig, 'prisma-converter'],\n    [NoDestructureConfig, 'no-destructure'],\n    [CatchErrorPatternConfig, 'catch-error-pattern'],\n    [NoUnmanagedExceptionsConfig, 'no-unmanaged-exceptions'],\n    [AngularNoDirectApiInResolverConfig, 'angular-no-direct-api-in-resolver'],\n    [NoSymbolDiTokensConfig, 'no-symbol-di-tokens'],\n    [NoClientCreationOutsideServerOrClientConfig, 'no-client-creation-outside-server-or-client'],\n    [NoCustomCssConfig, 'no-custom-css'],\n    [NoProcessExitOutsideMainConfig, 'no-process-exit-outside-main'],\n    [NoFunctionOutsideClassConfig, 'no-function-outside-class'],\n    [InjectAnnotationNotNeededForConcreteClassConfig, 'inject-annotation-not-needed-for-concrete-class'],\n    [FrameworkTagConfig, 'framework-tag'],\n    [RoleTagConfig, 'role-tag'],\n];\n"]}

package/src/code-rules-engine.d.ts

@@ -15,6 +15,7 @@ import { CatchErrorPatternValidator } from './validate-catch-error-pattern';
 import { NoUnmanagedExceptionsValidator } from './validate-no-unmanaged-exceptions';
 import { NoDirectApiResolverValidator } from './validate-no-direct-api-resolver';
 import { NoSymbolDiTokensValidator } from './validate-no-symbol-di-tokens';
+import { NoClientCreationOutsideServerOrClientValidator } from './validate-no-client-creation-outside-server-or-client';
 import { NoCustomCssValidator } from './validate-no-custom-css';
 import { NoProcessExitOutsideMainValidator } from './validate-no-process-exit-outside-main';
 import { NoFunctionOutsideClassValidator } from './validate-no-function-outside-class';
@@ -45,14 +46,15 @@ export declare class CodeRulesEngine {
     private readonly noUnmanagedExceptions;
     private readonly noDirectApiResolver;
     private readonly noSymbolDiTokens;
+    private readonly noClientCreationOutsideServerOrClient;
     private readonly noCustomCss;
     private readonly noProcessExitOutsideMain;
     private readonly noFunctionOutsideClass;
     private readonly injectAnnotationNotNeeded;
     private readonly frameworkTag;
     private readonly roleTag;
-    constructor(workspace: WorkspaceRoot, reporter: RuleReporter, matchRules: MatchRulesHolder, matchChecker: MatchRulesChecker, maxMethodLines: MaxMethodLinesValidator, maxFileLines: MaxFileLinesValidator, requireReturnType: RequireReturnTypeValidator, noInlineTypeLiterals: NoInlineTypeLiteralsValidator, noAnyUnknown: NoAnyUnknownValidator, noImplicitAny: NoImplicitAnyValidator, prismaValidateDtos: PrismaValidateDtosValidator, prismaConverter: PrismaConverterValidator, noDestructure: NoDestructureValidator, catchErrorPattern: CatchErrorPatternValidator, noUnmanagedExceptions: NoUnmanagedExceptionsValidator, noDirectApiResolver: NoDirectApiResolverValidator, noSymbolDiTokens: NoSymbolDiTokensValidator, noCustomCss: NoCustomCssValidator, noProcessExitOutsideMain: NoProcessExitOutsideMainValidator, noFunctionOutsideClass: NoFunctionOutsideClassValidator, injectAnnotationNotNeeded: InjectAnnotationNotNeededForConcreteClassValidator, frameworkTag: FrameworkTagValidator, roleTag: RoleTagValidator);
-    /** The 19 injected built-in validators, in run order. */
+    constructor(workspace: WorkspaceRoot, reporter: RuleReporter, matchRules: MatchRulesHolder, matchChecker: MatchRulesChecker, maxMethodLines: MaxMethodLinesValidator, maxFileLines: MaxFileLinesValidator, requireReturnType: RequireReturnTypeValidator, noInlineTypeLiterals: NoInlineTypeLiteralsValidator, noAnyUnknown: NoAnyUnknownValidator, noImplicitAny: NoImplicitAnyValidator, prismaValidateDtos: PrismaValidateDtosValidator, prismaConverter: PrismaConverterValidator, noDestructure: NoDestructureValidator, catchErrorPattern: CatchErrorPatternValidator, noUnmanagedExceptions: NoUnmanagedExceptionsValidator, noDirectApiResolver: NoDirectApiResolverValidator, noSymbolDiTokens: NoSymbolDiTokensValidator, noClientCreationOutsideServerOrClient: NoClientCreationOutsideServerOrClientValidator, noCustomCss: NoCustomCssValidator, noProcessExitOutsideMain: NoProcessExitOutsideMainValidator, noFunctionOutsideClass: NoFunctionOutsideClassValidator, injectAnnotationNotNeeded: InjectAnnotationNotNeededForConcreteClassValidator, frameworkTag: FrameworkTagValidator, roleTag: RoleTagValidator);
+    /** The 20 injected built-in validators, in run order. */
     private builtIns;
     /**
      * Every ACTIVE run: an injected built-in validator whose `shouldRun()` is true, or an injected

package/src/code-rules-engine.js

@@ -20,6 +20,7 @@ const validate_catch_error_pattern_1 = require("./validate-catch-error-pattern")
 const validate_no_unmanaged_exceptions_1 = require("./validate-no-unmanaged-exceptions");
 const validate_no_direct_api_resolver_1 = require("./validate-no-direct-api-resolver");
 const validate_no_symbol_di_tokens_1 = require("./validate-no-symbol-di-tokens");
+const validate_no_client_creation_outside_server_or_client_1 = require("./validate-no-client-creation-outside-server-or-client");
 const validate_no_custom_css_1 = require("./validate-no-custom-css");
 const validate_no_process_exit_outside_main_1 = require("./validate-no-process-exit-outside-main");
 const validate_no_function_outside_class_1 = require("./validate-no-function-outside-class");
@@ -50,6 +51,7 @@ let CodeRulesEngine = class CodeRulesEngine {
     noUnmanagedExceptions;
     noDirectApiResolver;
     noSymbolDiTokens;
+    noClientCreationOutsideServerOrClient;
     noCustomCss;
     noProcessExitOutsideMain;
     noFunctionOutsideClass;
@@ -57,7 +59,7 @@ let CodeRulesEngine = class CodeRulesEngine {
     frameworkTag;
     roleTag;
     // webpieces-disable max-lines-new-methods -- the built-in validator set is flat; each is one injected field
-    constructor(workspace, reporter, matchRules, matchChecker, maxMethodLines, maxFileLines, requireReturnType, noInlineTypeLiterals, noAnyUnknown, noImplicitAny, prismaValidateDtos, prismaConverter, noDestructure, catchErrorPattern, noUnmanagedExceptions, noDirectApiResolver, noSymbolDiTokens, noCustomCss, noProcessExitOutsideMain, noFunctionOutsideClass, injectAnnotationNotNeeded, frameworkTag, roleTag) {
+    constructor(workspace, reporter, matchRules, matchChecker, maxMethodLines, maxFileLines, requireReturnType, noInlineTypeLiterals, noAnyUnknown, noImplicitAny, prismaValidateDtos, prismaConverter, noDestructure, catchErrorPattern, noUnmanagedExceptions, noDirectApiResolver, noSymbolDiTokens, noClientCreationOutsideServerOrClient, noCustomCss, noProcessExitOutsideMain, noFunctionOutsideClass, injectAnnotationNotNeeded, frameworkTag, roleTag) {
         this.workspace = workspace;
         this.reporter = reporter;
         this.matchRules = matchRules;
@@ -75,6 +77,7 @@ let CodeRulesEngine = class CodeRulesEngine {
         this.noUnmanagedExceptions = noUnmanagedExceptions;
         this.noDirectApiResolver = noDirectApiResolver;
         this.noSymbolDiTokens = noSymbolDiTokens;
+        this.noClientCreationOutsideServerOrClient = noClientCreationOutsideServerOrClient;
         this.noCustomCss = noCustomCss;
         this.noProcessExitOutsideMain = noProcessExitOutsideMain;
         this.noFunctionOutsideClass = noFunctionOutsideClass;
@@ -82,13 +85,14 @@ let CodeRulesEngine = class CodeRulesEngine {
         this.frameworkTag = frameworkTag;
         this.roleTag = roleTag;
     }
-    /** The 19 injected built-in validators, in run order. */
+    /** The 20 injected built-in validators, in run order. */
     builtIns() {
         return [
             this.maxMethodLines, this.maxFileLines, this.requireReturnType, this.noInlineTypeLiterals,
             this.noAnyUnknown, this.noImplicitAny, this.prismaValidateDtos, this.prismaConverter,
             this.noDestructure, this.catchErrorPattern, this.noUnmanagedExceptions, this.noDirectApiResolver,
-            this.noSymbolDiTokens, this.noCustomCss, this.noProcessExitOutsideMain, this.noFunctionOutsideClass,
+            this.noSymbolDiTokens, this.noClientCreationOutsideServerOrClient, this.noCustomCss,
+            this.noProcessExitOutsideMain, this.noFunctionOutsideClass,
             this.injectAnnotationNotNeeded, this.frameworkTag, this.roleTag,
         ];
     }
@@ -148,6 +152,7 @@ exports.CodeRulesEngine = CodeRulesEngine = tslib_1.__decorate([
         validate_no_unmanaged_exceptions_1.NoUnmanagedExceptionsValidator,
         validate_no_direct_api_resolver_1.NoDirectApiResolverValidator,
         validate_no_symbol_di_tokens_1.NoSymbolDiTokensValidator,
+        validate_no_client_creation_outside_server_or_client_1.NoClientCreationOutsideServerOrClientValidator,
         validate_no_custom_css_1.NoCustomCssValidator,
         validate_no_process_exit_outside_main_1.NoProcessExitOutsideMainValidator,
         validate_no_function_outside_class_1.NoFunctionOutsideClassValidator,

package/src/code-rules-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"code-rules-engine.js","sourceRoot":"","sources":["../../../../../packages/tooling/code-rules/src/code-rules-engine.ts"],"names":[],"mappings":";;;;AACA,yCAA2D;AAE3D,qDAA0E;AAC1E,mDAA+C;AAC/C,6DAAuE;AACvE,iEAA2D;AAC3D,2EAAsE;AACtE,uEAAkE;AAClE,mEAAqE;AACrE,yEAA2E;AAC3E,uEAAkE;AAClE,yEAAoE;AACpE,mDAA8D;AAC9D,6EAAwE;AACxE,uEAAmE;AACnE,iFAA4E;AAC5E,yFAAoF;AACpF,uFAAiF;AACjF,iFAA2E;AAC3E,qEAAgE;AAChE,mGAA4F;AAC5F,6FAAuF;AACvF,yIAAgI;AAChI,qEAAiE;AACjE,2DAAuD;AAEvD;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IAGH;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAxBrB,4GAA4G;IAC5G,YACqB,SAAwB,EACxB,QAAsB,EACtB,UAA4B,EAC5B,YAA+B,EAC/B,cAAuC,EACvC,YAAmC,EACnC,iBAA6C,EAC7C,oBAAmD,EACnD,YAAmC,EACnC,aAAqC,EACrC,kBAA+C,EAC/C,eAAyC,EACzC,aAAqC,EACrC,iBAA6C,EAC7C,qBAAqD,EACrD,mBAAiD,EACjD,gBAA2C,EAC3C,WAAiC,EACjC,wBAA2D,EAC3D,sBAAuD,EACvD,yBAA6E,EAC7E,YAAmC,EACnC,OAAyB;QAtBzB,cAAS,GAAT,SAAS,CAAe;QACxB,aAAQ,GAAR,QAAQ,CAAc;QACtB,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAmB;QAC/B,mBAAc,GAAd,cAAc,CAAyB;QACvC,iBAAY,GAAZ,YAAY,CAAuB;QACnC,sBAAiB,GAAjB,iBAAiB,CAA4B;QAC7C,yBAAoB,GAApB,oBAAoB,CAA+B;QACnD,iBAAY,GAAZ,YAAY,CAAuB;QACnC,kBAAa,GAAb,aAAa,CAAwB;QACrC,uBAAkB,GAAlB,kBAAkB,CAA6B;QAC/C,oBAAe,GAAf,eAAe,CAA0B;QACzC,kBAAa,GAAb,aAAa,CAAwB;QACrC,sBAAiB,GAAjB,iBAAiB,CAA4B;QAC7C,0BAAqB,GAArB,qBAAqB,CAAgC;QACrD,wBAAmB,GAAnB,mBAAmB,CAA8B;QACjD,qBAAgB,GAAhB,gBAAgB,CAA2B;QAC3C,gBAAW,GAAX,WAAW,CAAsB;QACjC,6BAAwB,GAAxB,wBAAwB,CAAmC;QAC3D,2BAAsB,GAAtB,sBAAsB,CAAiC;QACvD,8BAAyB,GAAzB,yBAAyB,CAAoD;QAC7E,iBAAY,GAAZ,YAAY,CAAuB;QACnC,YAAO,GAAP,OAAO,CAAkB;IAC3C,CAAC;IAEJ,yDAAyD;IACjD,QAAQ;QACZ,OAAO;YACH,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,oBAAoB;YACzF,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,eAAe;YACpF,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,mBAAmB;YAChG,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,sBAAsB;YACnG,IAAI,CAAC,yBAAyB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO;SAClE,CAAC;IACN,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,IAAY;QAC3B,MAAM,IAAI,GAAc,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,SAAS,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAO,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAO,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG;QACL,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;QACzG,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAA;AA3EY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAIL,kCAAa;QACd,4BAAY;QACV,qCAAgB;QACd,wCAAiB;QACf,mDAAuB;QACzB,+CAAqB;QAChB,kDAA0B;QACvB,wDAA6B;QACrC,+CAAqB;QACpB,iDAAsB;QACjB,2CAA2B;QAC9B,qDAAwB;QAC1B,gDAAsB;QAClB,yDAA0B;QACtB,iEAA8B;QAChC,8DAA4B;QAC/B,wDAAyB;QAC9B,6CAAoB;QACP,yEAAiC;QACnC,oEAA+B;QAC5B,6GAAkD;QAC/D,8CAAqB;QAC1B,oCAAgB;GAzBrC,eAAe,CA2E3B","sourcesContent":["import { BaseRuleConfig } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nimport { CodeValidator, ExecutorResult, RuleRun } from './code-validator';\nimport { RuleReporter } from './rule-reporter';\nimport { WorkspaceRoot, MatchRulesHolder } from './code-rules-context';\nimport { MatchRulesChecker } from './validate-match-rules';\nimport { MaxMethodLinesValidator } from './validate-modified-methods';\nimport { MaxFileLinesValidator } from './validate-modified-files';\nimport { RequireReturnTypeValidator } from './validate-return-types';\nimport { NoInlineTypeLiteralsValidator } from './validate-no-inline-types';\nimport { NoAnyUnknownValidator } from './validate-no-any-unknown';\nimport { NoImplicitAnyValidator } from './validate-no-implicit-any';\nimport { PrismaValidateDtosValidator } from './validate-dtos';\nimport { PrismaConverterValidator } from './validate-prisma-converters';\nimport { NoDestructureValidator } from './validate-no-destructure';\nimport { CatchErrorPatternValidator } from './validate-catch-error-pattern';\nimport { NoUnmanagedExceptionsValidator } from './validate-no-unmanaged-exceptions';\nimport { NoDirectApiResolverValidator } from './validate-no-direct-api-resolver';\nimport { NoSymbolDiTokensValidator } from './validate-no-symbol-di-tokens';\nimport { NoCustomCssValidator } from './validate-no-custom-css';\nimport { NoProcessExitOutsideMainValidator } from './validate-no-process-exit-outside-main';\nimport { NoFunctionOutsideClassValidator } from './validate-no-function-outside-class';\nimport { InjectAnnotationNotNeededForConcreteClassValidator } from './validate-inject-annotation-not-needed-for-concrete-class';\nimport { FrameworkTagValidator } from './validate-framework-tag';\nimport { RoleTagValidator } from './validate-role-tag';\n\n/**\n * Owns running the code-rules suite. Every built-in validator is injected as a singleton (its config\n * is bound in the container at bootstrap), so this class IS the code-rules DI DAG the design graph\n * draws. The per-entry match-rules validators are the one exception — they are config-per-instance,\n * so they are built from the injected {@link MatchRulesHolder}.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class CodeRulesEngine {\n    // webpieces-disable max-lines-new-methods -- the built-in validator set is flat; each is one injected field\n    constructor(\n        private readonly workspace: WorkspaceRoot,\n        private readonly reporter: RuleReporter,\n        private readonly matchRules: MatchRulesHolder,\n        private readonly matchChecker: MatchRulesChecker,\n        private readonly maxMethodLines: MaxMethodLinesValidator,\n        private readonly maxFileLines: MaxFileLinesValidator,\n        private readonly requireReturnType: RequireReturnTypeValidator,\n        private readonly noInlineTypeLiterals: NoInlineTypeLiteralsValidator,\n        private readonly noAnyUnknown: NoAnyUnknownValidator,\n        private readonly noImplicitAny: NoImplicitAnyValidator,\n        private readonly prismaValidateDtos: PrismaValidateDtosValidator,\n        private readonly prismaConverter: PrismaConverterValidator,\n        private readonly noDestructure: NoDestructureValidator,\n        private readonly catchErrorPattern: CatchErrorPatternValidator,\n        private readonly noUnmanagedExceptions: NoUnmanagedExceptionsValidator,\n        private readonly noDirectApiResolver: NoDirectApiResolverValidator,\n        private readonly noSymbolDiTokens: NoSymbolDiTokensValidator,\n        private readonly noCustomCss: NoCustomCssValidator,\n        private readonly noProcessExitOutsideMain: NoProcessExitOutsideMainValidator,\n        private readonly noFunctionOutsideClass: NoFunctionOutsideClassValidator,\n        private readonly injectAnnotationNotNeeded: InjectAnnotationNotNeededForConcreteClassValidator,\n        private readonly frameworkTag: FrameworkTagValidator,\n        private readonly roleTag: RoleTagValidator,\n    ) {}\n\n    /** The 19 injected built-in validators, in run order. */\n    private builtIns(): CodeValidator<BaseRuleConfig>[] {\n        return [\n            this.maxMethodLines, this.maxFileLines, this.requireReturnType, this.noInlineTypeLiterals,\n            this.noAnyUnknown, this.noImplicitAny, this.prismaValidateDtos, this.prismaConverter,\n            this.noDestructure, this.catchErrorPattern, this.noUnmanagedExceptions, this.noDirectApiResolver,\n            this.noSymbolDiTokens, this.noCustomCss, this.noProcessExitOutsideMain, this.noFunctionOutsideClass,\n            this.injectAnnotationNotNeeded, this.frameworkTag, this.roleTag,\n        ];\n    }\n\n    /**\n     * Every ACTIVE run: an injected built-in validator whose `shouldRun()` is true, or an injected\n     * match-rule check per configured entry that is active. Built as {@link RuleRun} value objects\n     * (name + thunk) so NO DAG member is `new`-ed — the validators and the checker are injected.\n     */\n    private activeRuns(root: string): RuleRun[] {\n        const runs: RuleRun[] = [];\n        for (const v of this.builtIns()) {\n            if (v.shouldRun()) runs.push(new RuleRun(v.name, () => v.run(root)));\n        }\n        for (const mr of this.matchRules.rules) {\n            if (this.matchChecker.shouldRun(mr)) runs.push(new RuleRun(mr.name, () => this.matchChecker.runForConfig(mr, root)));\n        }\n        return runs;\n    }\n\n    /**\n     * Run all configured code validators against the workspace. A validator runs only when\n     * `shouldRun()` is true (mode not OFF and no branch/epoch escape hatch). Per-run isolation lives\n     * in {@link RuleReporter} so one validator can never abort the rest.\n     */\n    async run(): Promise<ExecutorResult> {\n        const runs = this.activeRuns(this.workspace.path);\n        if (runs.length === 0) {\n            console.log('\\n⏭️  Skipping all code validations (all modes: OFF)\\n');\n            return { success: true };\n        }\n\n        console.log('\\n📏 Running Code Validations\\n');\n        console.log(`   Active rules: ${runs.map((r: RuleRun) => r.name).join(', ')}`);\n        console.log('');\n\n        const result = await this.reporter.runValidators(runs);\n        console.log(result.success ? '\\n✅ All code validations passed\\n' : '\\n❌ Some code validations failed\\n');\n        return result;\n    }\n}\n"]}
+{"version":3,"file":"code-rules-engine.js","sourceRoot":"","sources":["../../../../../packages/tooling/code-rules/src/code-rules-engine.ts"],"names":[],"mappings":";;;;AACA,yCAA2D;AAE3D,qDAA0E;AAC1E,mDAA+C;AAC/C,6DAAuE;AACvE,iEAA2D;AAC3D,2EAAsE;AACtE,uEAAkE;AAClE,mEAAqE;AACrE,yEAA2E;AAC3E,uEAAkE;AAClE,yEAAoE;AACpE,mDAA8D;AAC9D,6EAAwE;AACxE,uEAAmE;AACnE,iFAA4E;AAC5E,yFAAoF;AACpF,uFAAiF;AACjF,iFAA2E;AAC3E,iIAAwH;AACxH,qEAAgE;AAChE,mGAA4F;AAC5F,6FAAuF;AACvF,yIAAgI;AAChI,qEAAiE;AACjE,2DAAuD;AAEvD;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IAGH;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAzBrB,4GAA4G;IAC5G,YACqB,SAAwB,EACxB,QAAsB,EACtB,UAA4B,EAC5B,YAA+B,EAC/B,cAAuC,EACvC,YAAmC,EACnC,iBAA6C,EAC7C,oBAAmD,EACnD,YAAmC,EACnC,aAAqC,EACrC,kBAA+C,EAC/C,eAAyC,EACzC,aAAqC,EACrC,iBAA6C,EAC7C,qBAAqD,EACrD,mBAAiD,EACjD,gBAA2C,EAC3C,qCAAqF,EACrF,WAAiC,EACjC,wBAA2D,EAC3D,sBAAuD,EACvD,yBAA6E,EAC7E,YAAmC,EACnC,OAAyB;QAvBzB,cAAS,GAAT,SAAS,CAAe;QACxB,aAAQ,GAAR,QAAQ,CAAc;QACtB,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAmB;QAC/B,mBAAc,GAAd,cAAc,CAAyB;QACvC,iBAAY,GAAZ,YAAY,CAAuB;QACnC,sBAAiB,GAAjB,iBAAiB,CAA4B;QAC7C,yBAAoB,GAApB,oBAAoB,CAA+B;QACnD,iBAAY,GAAZ,YAAY,CAAuB;QACnC,kBAAa,GAAb,aAAa,CAAwB;QACrC,uBAAkB,GAAlB,kBAAkB,CAA6B;QAC/C,oBAAe,GAAf,eAAe,CAA0B;QACzC,kBAAa,GAAb,aAAa,CAAwB;QACrC,sBAAiB,GAAjB,iBAAiB,CAA4B;QAC7C,0BAAqB,GAArB,qBAAqB,CAAgC;QACrD,wBAAmB,GAAnB,mBAAmB,CAA8B;QACjD,qBAAgB,GAAhB,gBAAgB,CAA2B;QAC3C,0CAAqC,GAArC,qCAAqC,CAAgD;QACrF,gBAAW,GAAX,WAAW,CAAsB;QACjC,6BAAwB,GAAxB,wBAAwB,CAAmC;QAC3D,2BAAsB,GAAtB,sBAAsB,CAAiC;QACvD,8BAAyB,GAAzB,yBAAyB,CAAoD;QAC7E,iBAAY,GAAZ,YAAY,CAAuB;QACnC,YAAO,GAAP,OAAO,CAAkB;IAC3C,CAAC;IAEJ,yDAAyD;IACjD,QAAQ;QACZ,OAAO;YACH,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,oBAAoB;YACzF,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,eAAe;YACpF,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,mBAAmB;YAChG,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,qCAAqC,EAAE,IAAI,CAAC,WAAW;YACnF,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,sBAAsB;YAC1D,IAAI,CAAC,yBAAyB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO;SAClE,CAAC;IACN,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,IAAY;QAC3B,MAAM,IAAI,GAAc,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,SAAS,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAO,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAO,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG;QACL,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;QACzG,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAA;AA7EY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAIL,kCAAa;QACd,4BAAY;QACV,qCAAgB;QACd,wCAAiB;QACf,mDAAuB;QACzB,+CAAqB;QAChB,kDAA0B;QACvB,wDAA6B;QACrC,+CAAqB;QACpB,iDAAsB;QACjB,2CAA2B;QAC9B,qDAAwB;QAC1B,gDAAsB;QAClB,yDAA0B;QACtB,iEAA8B;QAChC,8DAA4B;QAC/B,wDAAyB;QACJ,qGAA8C;QACxE,6CAAoB;QACP,yEAAiC;QACnC,oEAA+B;QAC5B,6GAAkD;QAC/D,8CAAqB;QAC1B,oCAAgB;GA1BrC,eAAe,CA6E3B","sourcesContent":["import { BaseRuleConfig } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nimport { CodeValidator, ExecutorResult, RuleRun } from './code-validator';\nimport { RuleReporter } from './rule-reporter';\nimport { WorkspaceRoot, MatchRulesHolder } from './code-rules-context';\nimport { MatchRulesChecker } from './validate-match-rules';\nimport { MaxMethodLinesValidator } from './validate-modified-methods';\nimport { MaxFileLinesValidator } from './validate-modified-files';\nimport { RequireReturnTypeValidator } from './validate-return-types';\nimport { NoInlineTypeLiteralsValidator } from './validate-no-inline-types';\nimport { NoAnyUnknownValidator } from './validate-no-any-unknown';\nimport { NoImplicitAnyValidator } from './validate-no-implicit-any';\nimport { PrismaValidateDtosValidator } from './validate-dtos';\nimport { PrismaConverterValidator } from './validate-prisma-converters';\nimport { NoDestructureValidator } from './validate-no-destructure';\nimport { CatchErrorPatternValidator } from './validate-catch-error-pattern';\nimport { NoUnmanagedExceptionsValidator } from './validate-no-unmanaged-exceptions';\nimport { NoDirectApiResolverValidator } from './validate-no-direct-api-resolver';\nimport { NoSymbolDiTokensValidator } from './validate-no-symbol-di-tokens';\nimport { NoClientCreationOutsideServerOrClientValidator } from './validate-no-client-creation-outside-server-or-client';\nimport { NoCustomCssValidator } from './validate-no-custom-css';\nimport { NoProcessExitOutsideMainValidator } from './validate-no-process-exit-outside-main';\nimport { NoFunctionOutsideClassValidator } from './validate-no-function-outside-class';\nimport { InjectAnnotationNotNeededForConcreteClassValidator } from './validate-inject-annotation-not-needed-for-concrete-class';\nimport { FrameworkTagValidator } from './validate-framework-tag';\nimport { RoleTagValidator } from './validate-role-tag';\n\n/**\n * Owns running the code-rules suite. Every built-in validator is injected as a singleton (its config\n * is bound in the container at bootstrap), so this class IS the code-rules DI DAG the design graph\n * draws. The per-entry match-rules validators are the one exception — they are config-per-instance,\n * so they are built from the injected {@link MatchRulesHolder}.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class CodeRulesEngine {\n    // webpieces-disable max-lines-new-methods -- the built-in validator set is flat; each is one injected field\n    constructor(\n        private readonly workspace: WorkspaceRoot,\n        private readonly reporter: RuleReporter,\n        private readonly matchRules: MatchRulesHolder,\n        private readonly matchChecker: MatchRulesChecker,\n        private readonly maxMethodLines: MaxMethodLinesValidator,\n        private readonly maxFileLines: MaxFileLinesValidator,\n        private readonly requireReturnType: RequireReturnTypeValidator,\n        private readonly noInlineTypeLiterals: NoInlineTypeLiteralsValidator,\n        private readonly noAnyUnknown: NoAnyUnknownValidator,\n        private readonly noImplicitAny: NoImplicitAnyValidator,\n        private readonly prismaValidateDtos: PrismaValidateDtosValidator,\n        private readonly prismaConverter: PrismaConverterValidator,\n        private readonly noDestructure: NoDestructureValidator,\n        private readonly catchErrorPattern: CatchErrorPatternValidator,\n        private readonly noUnmanagedExceptions: NoUnmanagedExceptionsValidator,\n        private readonly noDirectApiResolver: NoDirectApiResolverValidator,\n        private readonly noSymbolDiTokens: NoSymbolDiTokensValidator,\n        private readonly noClientCreationOutsideServerOrClient: NoClientCreationOutsideServerOrClientValidator,\n        private readonly noCustomCss: NoCustomCssValidator,\n        private readonly noProcessExitOutsideMain: NoProcessExitOutsideMainValidator,\n        private readonly noFunctionOutsideClass: NoFunctionOutsideClassValidator,\n        private readonly injectAnnotationNotNeeded: InjectAnnotationNotNeededForConcreteClassValidator,\n        private readonly frameworkTag: FrameworkTagValidator,\n        private readonly roleTag: RoleTagValidator,\n    ) {}\n\n    /** The 20 injected built-in validators, in run order. */\n    private builtIns(): CodeValidator<BaseRuleConfig>[] {\n        return [\n            this.maxMethodLines, this.maxFileLines, this.requireReturnType, this.noInlineTypeLiterals,\n            this.noAnyUnknown, this.noImplicitAny, this.prismaValidateDtos, this.prismaConverter,\n            this.noDestructure, this.catchErrorPattern, this.noUnmanagedExceptions, this.noDirectApiResolver,\n            this.noSymbolDiTokens, this.noClientCreationOutsideServerOrClient, this.noCustomCss,\n            this.noProcessExitOutsideMain, this.noFunctionOutsideClass,\n            this.injectAnnotationNotNeeded, this.frameworkTag, this.roleTag,\n        ];\n    }\n\n    /**\n     * Every ACTIVE run: an injected built-in validator whose `shouldRun()` is true, or an injected\n     * match-rule check per configured entry that is active. Built as {@link RuleRun} value objects\n     * (name + thunk) so NO DAG member is `new`-ed — the validators and the checker are injected.\n     */\n    private activeRuns(root: string): RuleRun[] {\n        const runs: RuleRun[] = [];\n        for (const v of this.builtIns()) {\n            if (v.shouldRun()) runs.push(new RuleRun(v.name, () => v.run(root)));\n        }\n        for (const mr of this.matchRules.rules) {\n            if (this.matchChecker.shouldRun(mr)) runs.push(new RuleRun(mr.name, () => this.matchChecker.runForConfig(mr, root)));\n        }\n        return runs;\n    }\n\n    /**\n     * Run all configured code validators against the workspace. A validator runs only when\n     * `shouldRun()` is true (mode not OFF and no branch/epoch escape hatch). Per-run isolation lives\n     * in {@link RuleReporter} so one validator can never abort the rest.\n     */\n    async run(): Promise<ExecutorResult> {\n        const runs = this.activeRuns(this.workspace.path);\n        if (runs.length === 0) {\n            console.log('\\n⏭️  Skipping all code validations (all modes: OFF)\\n');\n            return { success: true };\n        }\n\n        console.log('\\n📏 Running Code Validations\\n');\n        console.log(`   Active rules: ${runs.map((r: RuleRun) => r.name).join(', ')}`);\n        console.log('');\n\n        const result = await this.reporter.runValidators(runs);\n        console.log(result.success ? '\\n✅ All code validations passed\\n' : '\\n❌ Some code validations failed\\n');\n        return result;\n    }\n}\n"]}

package/src/index.d.ts

@@ -11,6 +11,8 @@ export { NoUnmanagedExceptionsValidator } from './validate-no-unmanaged-exceptio
 export { NoDestructureValidator } from './validate-no-destructure';
 export { NoDirectApiResolverValidator } from './validate-no-direct-api-resolver';
 export { NoSymbolDiTokensValidator } from './validate-no-symbol-di-tokens';
+export { NoClientCreationOutsideServerOrClientValidator } from './validate-no-client-creation-outside-server-or-client';
+export { ProjectRoleResolver } from './project-role-resolver';
 export { NoProcessExitOutsideMainValidator } from './validate-no-process-exit-outside-main';
 export { NoFunctionOutsideClassValidator } from './validate-no-function-outside-class';
 export { InjectAnnotationNotNeededForConcreteClassValidator, findRedundantInjectInSource } from './validate-inject-annotation-not-needed-for-concrete-class';

package/src/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateCode = exports.PrismaConverterValidator = exports.PrismaValidateDtosValidator = exports.RoleTagValidator = exports.FrameworkTagValidator = exports.findRedundantInjectInSource = exports.InjectAnnotationNotNeededForConcreteClassValidator = exports.NoFunctionOutsideClassValidator = exports.NoProcessExitOutsideMainValidator = exports.NoSymbolDiTokensValidator = exports.NoDirectApiResolverValidator = exports.NoDestructureValidator = exports.NoUnmanagedExceptionsValidator = exports.CatchErrorPatternValidator = exports.NoInlineTypeLiteralsValidator = exports.RequireReturnTypeValidator = exports.MaxFileLinesValidator = exports.runNewMethods = exports.runModifiedMethods = exports.MaxMethodLinesValidator = exports.NoImplicitAnyValidator = exports.NoAnyUnknownValidator = exports.CodeValidator = void 0;
+exports.validateCode = exports.PrismaConverterValidator = exports.PrismaValidateDtosValidator = exports.RoleTagValidator = exports.FrameworkTagValidator = exports.findRedundantInjectInSource = exports.InjectAnnotationNotNeededForConcreteClassValidator = exports.NoFunctionOutsideClassValidator = exports.NoProcessExitOutsideMainValidator = exports.ProjectRoleResolver = exports.NoClientCreationOutsideServerOrClientValidator = exports.NoSymbolDiTokensValidator = exports.NoDirectApiResolverValidator = exports.NoDestructureValidator = exports.NoUnmanagedExceptionsValidator = exports.CatchErrorPatternValidator = exports.NoInlineTypeLiteralsValidator = exports.RequireReturnTypeValidator = exports.MaxFileLinesValidator = exports.runNewMethods = exports.runModifiedMethods = exports.MaxMethodLinesValidator = exports.NoImplicitAnyValidator = exports.NoAnyUnknownValidator = exports.CodeValidator = void 0;
 const tslib_1 = require("tslib");
 var code_validator_1 = require("./code-validator");
 Object.defineProperty(exports, "CodeValidator", { enumerable: true, get: function () { return code_validator_1.CodeValidator; } });
@@ -29,6 +29,10 @@ var validate_no_direct_api_resolver_1 = require("./validate-no-direct-api-resolv
 Object.defineProperty(exports, "NoDirectApiResolverValidator", { enumerable: true, get: function () { return validate_no_direct_api_resolver_1.NoDirectApiResolverValidator; } });
 var validate_no_symbol_di_tokens_1 = require("./validate-no-symbol-di-tokens");
 Object.defineProperty(exports, "NoSymbolDiTokensValidator", { enumerable: true, get: function () { return validate_no_symbol_di_tokens_1.NoSymbolDiTokensValidator; } });
+var validate_no_client_creation_outside_server_or_client_1 = require("./validate-no-client-creation-outside-server-or-client");
+Object.defineProperty(exports, "NoClientCreationOutsideServerOrClientValidator", { enumerable: true, get: function () { return validate_no_client_creation_outside_server_or_client_1.NoClientCreationOutsideServerOrClientValidator; } });
+var project_role_resolver_1 = require("./project-role-resolver");
+Object.defineProperty(exports, "ProjectRoleResolver", { enumerable: true, get: function () { return project_role_resolver_1.ProjectRoleResolver; } });
 var validate_no_process_exit_outside_main_1 = require("./validate-no-process-exit-outside-main");
 Object.defineProperty(exports, "NoProcessExitOutsideMainValidator", { enumerable: true, get: function () { return validate_no_process_exit_outside_main_1.NoProcessExitOutsideMainValidator; } });
 var validate_no_function_outside_class_1 = require("./validate-no-function-outside-class");

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/tooling/code-rules/src/index.ts"],"names":[],"mappings":";;;;AAAA,mDAAiE;AAAxD,+GAAA,aAAa,OAAA;AAEtB,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,uEAAoE;AAA3D,kIAAA,sBAAsB,OAAA;AAC/B,yEAA0F;AAAjF,oIAAA,uBAAuB,OAAA;AAAE,+HAAA,kBAAkB,OAAA;AACpD,+DAAuD;AAA9C,qHAAA,aAAa,OAAA;AACtB,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,iEAAqE;AAA5D,mIAAA,0BAA0B,OAAA;AACnC,uEAA2E;AAAlE,yIAAA,6BAA6B,OAAA;AACtC,+EAA4E;AAAnE,0IAAA,0BAA0B,OAAA;AACnC,uFAAoF;AAA3E,kJAAA,8BAA8B,OAAA;AACvC,qEAAmE;AAA1D,iIAAA,sBAAsB,OAAA;AAC/B,qFAAiF;AAAxE,+IAAA,4BAA4B,OAAA;AACrC,+EAA2E;AAAlE,yIAAA,yBAAyB,OAAA;AAClC,iGAA4F;AAAnF,0JAAA,iCAAiC,OAAA;AAC1C,2FAAuF;AAA9E,qJAAA,+BAA+B,OAAA;AACxC,uIAA6J;AAApJ,8LAAA,kDAAkD,OAAA;AAAE,uKAAA,2BAA2B,OAAA;AACxF,mEAAiE;AAAxD,+HAAA,qBAAqB,OAAA;AAC9B,yDAAuD;AAA9C,qHAAA,gBAAgB,OAAA;AACzB,iDAA8D;AAArD,4HAAA,2BAA2B,OAAA;AACpC,2EAAwE;AAA/D,sIAAA,wBAAwB,OAAA;AACjC,iDAA0D;AAAjD,sIAAA,OAAO,OAAgB","sourcesContent":["export { CodeValidator, ExecutorResult } from './code-validator';\n\nexport { NoAnyUnknownValidator } from './validate-no-any-unknown';\nexport { NoImplicitAnyValidator } from './validate-no-implicit-any';\nexport { MaxMethodLinesValidator, runModifiedMethods } from './validate-modified-methods';\nexport { runNewMethods } from './validate-new-methods';\nexport { MaxFileLinesValidator } from './validate-modified-files';\nexport { RequireReturnTypeValidator } from './validate-return-types';\nexport { NoInlineTypeLiteralsValidator } from './validate-no-inline-types';\nexport { CatchErrorPatternValidator } from './validate-catch-error-pattern';\nexport { NoUnmanagedExceptionsValidator } from './validate-no-unmanaged-exceptions';\nexport { NoDestructureValidator } from './validate-no-destructure';\nexport { NoDirectApiResolverValidator } from './validate-no-direct-api-resolver';\nexport { NoSymbolDiTokensValidator } from './validate-no-symbol-di-tokens';\nexport { NoProcessExitOutsideMainValidator } from './validate-no-process-exit-outside-main';\nexport { NoFunctionOutsideClassValidator } from './validate-no-function-outside-class';\nexport { InjectAnnotationNotNeededForConcreteClassValidator, findRedundantInjectInSource } from './validate-inject-annotation-not-needed-for-concrete-class';\nexport { FrameworkTagValidator } from './validate-framework-tag';\nexport { RoleTagValidator } from './validate-role-tag';\nexport { PrismaValidateDtosValidator } from './validate-dtos';\nexport { PrismaConverterValidator } from './validate-prisma-converters';\nexport { default as validateCode } from './validate-code';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/tooling/code-rules/src/index.ts"],"names":[],"mappings":";;;;AAAA,mDAAiE;AAAxD,+GAAA,aAAa,OAAA;AAEtB,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,uEAAoE;AAA3D,kIAAA,sBAAsB,OAAA;AAC/B,yEAA0F;AAAjF,oIAAA,uBAAuB,OAAA;AAAE,+HAAA,kBAAkB,OAAA;AACpD,+DAAuD;AAA9C,qHAAA,aAAa,OAAA;AACtB,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,iEAAqE;AAA5D,mIAAA,0BAA0B,OAAA;AACnC,uEAA2E;AAAlE,yIAAA,6BAA6B,OAAA;AACtC,+EAA4E;AAAnE,0IAAA,0BAA0B,OAAA;AACnC,uFAAoF;AAA3E,kJAAA,8BAA8B,OAAA;AACvC,qEAAmE;AAA1D,iIAAA,sBAAsB,OAAA;AAC/B,qFAAiF;AAAxE,+IAAA,4BAA4B,OAAA;AACrC,+EAA2E;AAAlE,yIAAA,yBAAyB,OAAA;AAClC,+HAAwH;AAA/G,sLAAA,8CAA8C,OAAA;AACvD,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,iGAA4F;AAAnF,0JAAA,iCAAiC,OAAA;AAC1C,2FAAuF;AAA9E,qJAAA,+BAA+B,OAAA;AACxC,uIAA6J;AAApJ,8LAAA,kDAAkD,OAAA;AAAE,uKAAA,2BAA2B,OAAA;AACxF,mEAAiE;AAAxD,+HAAA,qBAAqB,OAAA;AAC9B,yDAAuD;AAA9C,qHAAA,gBAAgB,OAAA;AACzB,iDAA8D;AAArD,4HAAA,2BAA2B,OAAA;AACpC,2EAAwE;AAA/D,sIAAA,wBAAwB,OAAA;AACjC,iDAA0D;AAAjD,sIAAA,OAAO,OAAgB","sourcesContent":["export { CodeValidator, ExecutorResult } from './code-validator';\n\nexport { NoAnyUnknownValidator } from './validate-no-any-unknown';\nexport { NoImplicitAnyValidator } from './validate-no-implicit-any';\nexport { MaxMethodLinesValidator, runModifiedMethods } from './validate-modified-methods';\nexport { runNewMethods } from './validate-new-methods';\nexport { MaxFileLinesValidator } from './validate-modified-files';\nexport { RequireReturnTypeValidator } from './validate-return-types';\nexport { NoInlineTypeLiteralsValidator } from './validate-no-inline-types';\nexport { CatchErrorPatternValidator } from './validate-catch-error-pattern';\nexport { NoUnmanagedExceptionsValidator } from './validate-no-unmanaged-exceptions';\nexport { NoDestructureValidator } from './validate-no-destructure';\nexport { NoDirectApiResolverValidator } from './validate-no-direct-api-resolver';\nexport { NoSymbolDiTokensValidator } from './validate-no-symbol-di-tokens';\nexport { NoClientCreationOutsideServerOrClientValidator } from './validate-no-client-creation-outside-server-or-client';\nexport { ProjectRoleResolver } from './project-role-resolver';\nexport { NoProcessExitOutsideMainValidator } from './validate-no-process-exit-outside-main';\nexport { NoFunctionOutsideClassValidator } from './validate-no-function-outside-class';\nexport { InjectAnnotationNotNeededForConcreteClassValidator, findRedundantInjectInSource } from './validate-inject-annotation-not-needed-for-concrete-class';\nexport { FrameworkTagValidator } from './validate-framework-tag';\nexport { RoleTagValidator } from './validate-role-tag';\nexport { PrismaValidateDtosValidator } from './validate-dtos';\nexport { PrismaConverterValidator } from './validate-prisma-converters';\nexport { default as validateCode } from './validate-code';\n"]}

package/src/project-role-resolver.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Resolves the `role:` nx tag VALUE of the project owning a given source file.
+ *
+ * The role-tag rule ({@link ../tag-rule}) only checks a `role:` tag is PRESENT; a few rules
+ * (e.g. no-client-creation-outside-server-or-client) additionally need the tag's VALUE to decide
+ * whether a construct is allowed in that kind of project. This is the single home for that lookup:
+ * walk up from the file to its nearest `project.json`, read its `tags`, and return the first
+ * `role:<value>` value (or null when the file belongs to no project, or its project carries no role).
+ *
+ * Injectable so it composes into the code-rules DI DAG and can be shared by any validator.
+ */
+export declare class ProjectRoleResolver {
+    /** The `role:` value of the project owning `relFile`, or null when unknown/untagged. */
+    roleOf(workspaceRoot: string, relFile: string): string | null;
+    /** Nearest ancestor directory of `relFile` that holds a project.json (repo-relative), or null. */
+    private findOwningProjectJson;
+    /** First `role:<value>` tag value in a project.json, or null. Never throws — a malformed
+     *  project.json is the role-tag rule's concern, not this resolver's. */
+    private readRole;
+}

package/src/project-role-resolver.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * Resolves the `role:` nx tag VALUE of the project owning a given source file.
+ *
+ * The role-tag rule ({@link ../tag-rule}) only checks a `role:` tag is PRESENT; a few rules
+ * (e.g. no-client-creation-outside-server-or-client) additionally need the tag's VALUE to decide
+ * whether a construct is allowed in that kind of project. This is the single home for that lookup:
+ * walk up from the file to its nearest `project.json`, read its `tags`, and return the first
+ * `role:<value>` value (or null when the file belongs to no project, or its project carries no role).
+ *
+ * Injectable so it composes into the code-rules DI DAG and can be shared by any validator.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjectRoleResolver = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const rules_config_1 = require("@webpieces/rules-config");
+const inversify_1 = require("inversify");
+const ROLE_TAG_PREFIX = 'role:';
+let ProjectRoleResolver = class ProjectRoleResolver {
+    /** The `role:` value of the project owning `relFile`, or null when unknown/untagged. */
+    roleOf(workspaceRoot, relFile) {
+        const projectJsonPath = this.findOwningProjectJson(workspaceRoot, relFile);
+        if (projectJsonPath === null)
+            return null;
+        return this.readRole(path.join(workspaceRoot, projectJsonPath));
+    }
+    /** Nearest ancestor directory of `relFile` that holds a project.json (repo-relative), or null. */
+    findOwningProjectJson(workspaceRoot, relFile) {
+        let dir = path.dirname(relFile);
+        while (true) {
+            const candidate = path.join(dir, 'project.json');
+            if (fs.existsSync(path.join(workspaceRoot, candidate))) {
+                return candidate;
+            }
+            const parent = path.dirname(dir);
+            if (parent === dir || dir === '.' || dir === '') {
+                return null;
+            }
+            dir = parent;
+        }
+    }
+    /** First `role:<value>` tag value in a project.json, or null. Never throws — a malformed
+     *  project.json is the role-tag rule's concern, not this resolver's. */
+    readRole(fullPath) {
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            const parsed = JSON.parse(fs.readFileSync(fullPath, 'utf-8'));
+            const tags = Array.isArray(parsed.tags) ? parsed.tags : [];
+            for (const tag of tags) {
+                if (typeof tag !== 'string' || !tag.startsWith(ROLE_TAG_PREFIX))
+                    continue;
+                const value = tag.slice(ROLE_TAG_PREFIX.length).trim();
+                if (value.length > 0)
+                    return value;
+            }
+            return null;
+        }
+        catch (err) {
+            const error = (0, rules_config_1.toError)(err);
+            void error; // swallow — malformed project.json is not this resolver's concern
+            return null;
+        }
+    }
+};
+exports.ProjectRoleResolver = ProjectRoleResolver;
+exports.ProjectRoleResolver = ProjectRoleResolver = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton)
+], ProjectRoleResolver);
+//# sourceMappingURL=project-role-resolver.js.map

package/src/project-role-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-role-resolver.js","sourceRoot":"","sources":["../../../../../packages/tooling/code-rules/src/project-role-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;AAEH,+CAAyB;AACzB,mDAA6B;AAC7B,0DAAkD;AAClD,yCAA2D;AAE3D,MAAM,eAAe,GAAG,OAAO,CAAC;AAMzB,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC5B,wFAAwF;IACxF,MAAM,CAAC,aAAqB,EAAE,OAAe;QACzC,MAAM,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,eAAe,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,kGAAkG;IAC1F,qBAAqB,CAAC,aAAqB,EAAE,OAAe;QAChE,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,IAAI,EAAE,CAAC;YACV,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBACrD,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,GAAG,GAAG,MAAM,CAAC;QACjB,CAAC;IACL,CAAC;IAED;4EACwE;IAChE,QAAQ,CAAC,QAAgB;QAC7B,8DAA8D;QAC9D,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAmB,CAAC;YAChF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;oBAAE,SAAS;gBAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;YACvC,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,sBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,KAAK,KAAK,CAAC,CAAC,kEAAkE;YAC9E,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;CACJ,CAAA;AA3CY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,mBAAmB,CA2C/B","sourcesContent":["/**\n * Resolves the `role:` nx tag VALUE of the project owning a given source file.\n *\n * The role-tag rule ({@link ../tag-rule}) only checks a `role:` tag is PRESENT; a few rules\n * (e.g. no-client-creation-outside-server-or-client) additionally need the tag's VALUE to decide\n * whether a construct is allowed in that kind of project. This is the single home for that lookup:\n * walk up from the file to its nearest `project.json`, read its `tags`, and return the first\n * `role:<value>` value (or null when the file belongs to no project, or its project carries no role).\n *\n * Injectable so it composes into the code-rules DI DAG and can be shared by any validator.\n */\n\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { toError } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nconst ROLE_TAG_PREFIX = 'role:';\n\n/** The only field of a project.json this resolver reads. */\ntype RawProjectJson = { tags?: string[] };\n\n@injectable(bindingScopeValues.Singleton)\nexport class ProjectRoleResolver {\n    /** The `role:` value of the project owning `relFile`, or null when unknown/untagged. */\n    roleOf(workspaceRoot: string, relFile: string): string | null {\n        const projectJsonPath = this.findOwningProjectJson(workspaceRoot, relFile);\n        if (projectJsonPath === null) return null;\n        return this.readRole(path.join(workspaceRoot, projectJsonPath));\n    }\n\n    /** Nearest ancestor directory of `relFile` that holds a project.json (repo-relative), or null. */\n    private findOwningProjectJson(workspaceRoot: string, relFile: string): string | null {\n        let dir = path.dirname(relFile);\n        while (true) {\n            const candidate = path.join(dir, 'project.json');\n            if (fs.existsSync(path.join(workspaceRoot, candidate))) {\n                return candidate;\n            }\n            const parent = path.dirname(dir);\n            if (parent === dir || dir === '.' || dir === '') {\n                return null;\n            }\n            dir = parent;\n        }\n    }\n\n    /** First `role:<value>` tag value in a project.json, or null. Never throws — a malformed\n     *  project.json is the role-tag rule's concern, not this resolver's. */\n    private readRole(fullPath: string): string | null {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            const parsed = JSON.parse(fs.readFileSync(fullPath, 'utf-8')) as RawProjectJson;\n            const tags = Array.isArray(parsed.tags) ? parsed.tags : [];\n            for (const tag of tags) {\n                if (typeof tag !== 'string' || !tag.startsWith(ROLE_TAG_PREFIX)) continue;\n                const value = tag.slice(ROLE_TAG_PREFIX.length).trim();\n                if (value.length > 0) return value;\n            }\n            return null;\n        } catch (err: unknown) {\n            const error = toError(err);\n            void error; // swallow — malformed project.json is not this resolver's concern\n            return null;\n        }\n    }\n}\n"]}

package/src/validate-no-client-creation-outside-server-or-client.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Validate No Client Creation Outside Server Or Client
+ *
+ * Flags a project that CONSTRUCTS an rpc/pubsub transport client when the project's `role:` tag is
+ * not one of the runnable/entrypoint roles (`allowedRoles`, default server | client | app).
+ *
+ * ============================================================================
+ * WHY
+ * ============================================================================
+ * The runtime architecture graph draws a `uses` edge from every client-creation site to the api's
+ * implementer. When the site sits in a project with a declared identity (`serviceName`) or target
+ * (`callsService`) — a server, a client app, an app — the edge is attributable. When it sits in a
+ * `role:lib`, the target can't be attributed, so the graph falls back to a fan-out: one `uses` edge
+ * to EVERY implementer of the api, i.e. calls that cannot happen. A company-wide api (warmup,
+ * browser-log, auth) then draws every caller to every server — pure fiction. This rule removes the
+ * failure mode by construction: a reusable library takes the api INJECTED; the server/app module
+ * binds it to a client.
+ *
+ * ============================================================================
+ * VIOLATIONS (BAD) — flagged when the OWNING project's role is not in allowedRoles:
+ * ============================================================================
+ *   factory.createRpcClient(SomeApi, new ClientConfig('svc'))
+ *   clientCloudTasksFactory.createPubSubClient(SomeApi, config)
+ *
+ * ============================================================================
+ * ALLOWED
+ * ============================================================================
+ * - Any site in a project whose role IS in allowedRoles (server / client / app).
+ * - A project with NO `role:` tag (the role-tag rule owns "every project must declare a role").
+ * - Merely IMPORTING the api type or its DI token, or injecting the api — only constructing the
+ *   transport (a `.createRpcClient(` / `.createPubSubClient(` CALL) is a violation.
+ * - Files under allowedPaths, test files, and lines carrying the webpieces-disable escape.
+ *
+ * ============================================================================
+ * SEVERITY (WARN first, then error)
+ * ============================================================================
+ * severity "warn" (default) prints the violations + migration but PASSES the build, so an upgrade
+ * can't break an un-migrated Angular repo. Flip to "error" once libraries are migrated.
+ */
+import { NoClientCreationOutsideServerOrClientConfig } from '@webpieces/rules-config';
+import { CodeValidator, ExecutorResult } from './code-validator';
+import { ProjectRoleResolver } from './project-role-resolver';
+export declare class NoClientCreationOutsideServerOrClientValidator extends CodeValidator<NoClientCreationOutsideServerOrClientConfig> {
+    private readonly roleResolver;
+    constructor(config: NoClientCreationOutsideServerOrClientConfig, roleResolver: ProjectRoleResolver);
+    run(workspaceRoot: string): Promise<ExecutorResult>;
+    private allowedRoles;
+    private disableAllowed;
+    private allowedPaths;
+    private resolveMode;
+    private resolveBase;
+    /** Violations across changed files: a creation site in a project whose role is not allowed. In
+     *  NEW_AND_MODIFIED_CODE only sites on changed lines count; in NEW_AND_MODIFIED_FILES every site
+     *  in a changed file counts. */
+    private findViolations;
+    private isExempt;
+    private isTestFile;
+    /** Every client-creation call site in a file, ignoring occurrences inside comments. */
+    private scanFile;
+    /** The code-only text of each line: block comments (/* … *\/) and line comments (// …) blanked
+     *  out, so a `factory.createRpcClient(` in a JSDoc example is never matched. */
+    private stripComments;
+    private report;
+}

package/src/validate-no-client-creation-outside-server-or-client.js

@@ -0,0 +1,277 @@
+"use strict";
+/**
+ * Validate No Client Creation Outside Server Or Client
+ *
+ * Flags a project that CONSTRUCTS an rpc/pubsub transport client when the project's `role:` tag is
+ * not one of the runnable/entrypoint roles (`allowedRoles`, default server | client | app).
+ *
+ * ============================================================================
+ * WHY
+ * ============================================================================
+ * The runtime architecture graph draws a `uses` edge from every client-creation site to the api's
+ * implementer. When the site sits in a project with a declared identity (`serviceName`) or target
+ * (`callsService`) — a server, a client app, an app — the edge is attributable. When it sits in a
+ * `role:lib`, the target can't be attributed, so the graph falls back to a fan-out: one `uses` edge
+ * to EVERY implementer of the api, i.e. calls that cannot happen. A company-wide api (warmup,
+ * browser-log, auth) then draws every caller to every server — pure fiction. This rule removes the
+ * failure mode by construction: a reusable library takes the api INJECTED; the server/app module
+ * binds it to a client.
+ *
+ * ============================================================================
+ * VIOLATIONS (BAD) — flagged when the OWNING project's role is not in allowedRoles:
+ * ============================================================================
+ *   factory.createRpcClient(SomeApi, new ClientConfig('svc'))
+ *   clientCloudTasksFactory.createPubSubClient(SomeApi, config)
+ *
+ * ============================================================================
+ * ALLOWED
+ * ============================================================================
+ * - Any site in a project whose role IS in allowedRoles (server / client / app).
+ * - A project with NO `role:` tag (the role-tag rule owns "every project must declare a role").
+ * - Merely IMPORTING the api type or its DI token, or injecting the api — only constructing the
+ *   transport (a `.createRpcClient(` / `.createPubSubClient(` CALL) is a violation.
+ * - Files under allowedPaths, test files, and lines carrying the webpieces-disable escape.
+ *
+ * ============================================================================
+ * SEVERITY (WARN first, then error)
+ * ============================================================================
+ * severity "warn" (default) prints the violations + migration but PASSES the build, so an upgrade
+ * can't break an un-migrated Angular repo. Flip to "error" once libraries are migrated.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoClientCreationOutsideServerOrClientValidator = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const rules_config_1 = require("@webpieces/rules-config");
+const code_validator_1 = require("./code-validator");
+const inversify_1 = require("inversify");
+const resolve_mode_1 = require("./resolve-mode");
+const project_role_resolver_1 = require("./project-role-resolver");
+const RULE_NAME = rules_config_1.RULE_NAMES.NO_CLIENT_CREATION_OUTSIDE_SERVER_OR_CLIENT;
+const DEFAULT_ALLOWED_ROLES = ['server', 'client', 'app'];
+// A `.createRpcClient(` / `.createPubSubClient(` method CALL — the leading dot excludes the framework
+// method DEFINITIONS (`createRpcClient<T>(apiPrototype, ...)`, no receiver); the `[(<]` requires a call
+// or a generic call, so a bare property reference isn't matched.
+const CLIENT_CREATE_REGEX = /\.(createRpcClient|createPubSubClient)\s*[(<]/;
+/** One client-creation call site found in a file. */
+class CreationSite {
+    line;
+    context;
+    hasDisableComment;
+    constructor(line, context, hasDisableComment) {
+        this.line = line;
+        this.context = context;
+        this.hasDisableComment = hasDisableComment;
+    }
+}
+/** A reported violation: a client-creation site in a project whose role is not allowed. */
+class Violation {
+    file;
+    line;
+    context;
+    role;
+    constructor(file, line, context, role) {
+        this.file = file;
+        this.line = line;
+        this.context = context;
+        this.role = role;
+    }
+}
+let NoClientCreationOutsideServerOrClientValidator = class NoClientCreationOutsideServerOrClientValidator extends code_validator_1.CodeValidator {
+    roleResolver;
+    constructor(config, roleResolver) {
+        super(config, RULE_NAME);
+        this.roleResolver = roleResolver;
+    }
+    async run(workspaceRoot) {
+        const mode = this.resolveMode(this.config.mode ?? 'OFF');
+        if (mode === 'OFF') {
+            console.log(`\n⏭️  Skipping ${RULE_NAME} validation (mode: OFF)`);
+            console.log('');
+            return { success: true };
+        }
+        const severity = this.config.severity ?? 'warn';
+        console.log(`\n📏 Validating No Client Creation Outside Server Or Client\n`);
+        console.log(`   Mode: ${mode} · Severity: ${severity}`);
+        const base = this.resolveBase(workspaceRoot);
+        if (base === null)
+            return { success: true };
+        const head = process.env['NX_HEAD'];
+        console.log(`   Base: ${base}`);
+        console.log(`   Head: ${head ?? 'working tree (includes uncommitted changes)'}`);
+        console.log('');
+        const changedFiles = (0, rules_config_1.getChangedFiles)(workspaceRoot, base, head);
+        if (changedFiles.length === 0) {
+            console.log('✅ No TypeScript files changed');
+            return { success: true };
+        }
+        console.log(`📂 Checking ${changedFiles.length} changed file(s)...`);
+        const violations = this.findViolations(workspaceRoot, changedFiles, mode, base, head);
+        if (violations.length === 0) {
+            console.log('✅ No client-creation-in-a-library violations found');
+            return { success: true };
+        }
+        this.report(violations, severity);
+        // WARN reports but passes; only "error" fails the build.
+        return { success: severity !== 'error' };
+    }
+    allowedRoles() {
+        const configured = this.config.allowedRoles;
+        return configured && configured.length > 0 ? configured : DEFAULT_ALLOWED_ROLES;
+    }
+    disableAllowed() {
+        return this.config.disableAllowed ?? true;
+    }
+    allowedPaths() {
+        return this.config.allowedPaths ?? [];
+    }
+    resolveMode(normalMode) {
+        if (normalMode === 'OFF')
+            return normalMode;
+        const skip = (0, resolve_mode_1.shouldSkipRule)(this.config.ignoreModifiedUntilEpoch, this.config.ignoreRuleWhileOnBranch);
+        if (skip.skip) {
+            console.log(`\n⏭️  Skipping ${RULE_NAME} validation (${skip.reason})`);
+            console.log('');
+            return 'OFF';
+        }
+        return normalMode;
+    }
+    resolveBase(workspaceRoot) {
+        const envBase = process.env['NX_BASE'];
+        if (envBase)
+            return envBase;
+        const detected = (0, rules_config_1.detectBase)(workspaceRoot);
+        if (!detected) {
+            console.log(`\n⏭️  Skipping ${RULE_NAME} validation (could not detect base branch)`);
+            console.log('');
+            return null;
+        }
+        return detected;
+    }
+    /** Violations across changed files: a creation site in a project whose role is not allowed. In
+     *  NEW_AND_MODIFIED_CODE only sites on changed lines count; in NEW_AND_MODIFIED_FILES every site
+     *  in a changed file counts. */
+    findViolations(workspaceRoot, changedFiles, mode, base, head) {
+        const allowed = new Set(this.allowedRoles());
+        const violations = [];
+        for (const file of changedFiles) {
+            if (this.isExempt(file))
+                continue;
+            const role = this.roleResolver.roleOf(workspaceRoot, file);
+            // No role tag → role-tag rule owns it; an allowed role → fine. Either way, skip.
+            if (role === null || allowed.has(role))
+                continue;
+            const changedLines = mode === 'NEW_AND_MODIFIED_CODE'
+                ? (0, rules_config_1.getChangedLineNumbers)((0, rules_config_1.getFileDiff)(workspaceRoot, file, base, head))
+                : null;
+            if (changedLines !== null && changedLines.size === 0)
+                continue;
+            for (const site of this.scanFile(workspaceRoot, file)) {
+                if (this.disableAllowed() && site.hasDisableComment)
+                    continue;
+                if (changedLines !== null && !changedLines.has(site.line))
+                    continue;
+                violations.push(new Violation(file, site.line, site.context, role));
+            }
+        }
+        return violations;
+    }
+    isExempt(file) {
+        return this.isTestFile(file) || (0, rules_config_1.isPathExcluded)(file, this.allowedPaths());
+    }
+    isTestFile(filePath) {
+        return filePath.includes('.spec.ts') || filePath.includes('.test.ts') || filePath.includes('__tests__/');
+    }
+    /** Every client-creation call site in a file, ignoring occurrences inside comments. */
+    scanFile(workspaceRoot, relFile) {
+        const fullPath = path.join(workspaceRoot, relFile);
+        if (!fs.existsSync(fullPath))
+            return [];
+        const lines = fs.readFileSync(fullPath, 'utf-8').split('\n');
+        const code = this.stripComments(lines);
+        const sites = [];
+        for (let i = 0; i < code.length; i++) {
+            if (!CLIENT_CREATE_REGEX.test(code[i] ?? ''))
+                continue;
+            const raw = lines[i] ?? '';
+            const prev = i > 0 ? (lines[i - 1] ?? '') : '';
+            const disabled = (0, rules_config_1.hasDisable)(raw, RULE_NAME) || (0, rules_config_1.hasDisable)(prev, RULE_NAME);
+            sites.push(new CreationSite(i + 1, raw.trim(), disabled));
+        }
+        return sites;
+    }
+    /** The code-only text of each line: block comments (/* … *\/) and line comments (// …) blanked
+     *  out, so a `factory.createRpcClient(` in a JSDoc example is never matched. */
+    stripComments(lines) {
+        const out = [];
+        let inBlock = false;
+        for (const line of lines) {
+            let result = '';
+            let i = 0;
+            while (i < line.length) {
+                if (inBlock) {
+                    if (line[i] === '*' && line[i + 1] === '/') {
+                        inBlock = false;
+                        i += 2;
+                    }
+                    else {
+                        i += 1;
+                    }
+                    continue;
+                }
+                if (line[i] === '/' && line[i + 1] === '*') {
+                    inBlock = true;
+                    i += 2;
+                    continue;
+                }
+                if (line[i] === '/' && line[i + 1] === '/')
+                    break;
+                result += line[i];
+                i += 1;
+            }
+            out.push(result);
+        }
+        return out;
+    }
+    // webpieces-disable max-lines-new-methods -- console guidance block + violation list
+    report(violations, severity) {
+        const icon = severity === 'error' ? '❌' : '⚠️';
+        console.error('');
+        console.error(`${icon} A library (role:lib) must NOT construct an rpc/pubsub client!`);
+        console.error('');
+        console.error('   Only a runnable entrypoint (role:server / role:client / role:app) has a declared identity');
+        console.error('   (serviceName) or target (callsService), so a client built there is attributable in the');
+        console.error('   runtime graph. A client built in a library reaches the fan-out fallback — one "uses" edge');
+        console.error('   to EVERY implementer of the api, i.e. calls that cannot happen.');
+        console.error('');
+        console.error('   Migrate: the library takes the api INJECTED (constructor(private readonly api: SomeApi)),');
+        console.error('   and the server/app DI module constructs the client with factory.createRpcClient(SomeApi, ...).');
+        console.error('');
+        for (const v of violations) {
+            console.error(`  ${icon} ${v.file}:${v.line}   (role:${v.role})`);
+            console.error(`     ${v.context}`);
+        }
+        console.error('');
+        if (this.disableAllowed()) {
+            console.error('   Escape hatch (use sparingly):');
+            console.error(`   // webpieces-disable ${RULE_NAME} -- <reason>`);
+        }
+        else {
+            console.error('   Escape hatch: DISABLED (disableAllowed: false)');
+        }
+        console.error('');
+        if (severity !== 'error') {
+            console.error('   Severity: WARN — reported but NOT failing the build. Migrate, then set');
+            console.error(`   "severity": "error" on ${RULE_NAME} to enforce.`);
+            console.error('');
+        }
+    }
+};
+exports.NoClientCreationOutsideServerOrClientValidator = NoClientCreationOutsideServerOrClientValidator;
+exports.NoClientCreationOutsideServerOrClientValidator = NoClientCreationOutsideServerOrClientValidator = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
+    tslib_1.__metadata("design:paramtypes", [rules_config_1.NoClientCreationOutsideServerOrClientConfig,
+        project_role_resolver_1.ProjectRoleResolver])
+], NoClientCreationOutsideServerOrClientValidator);
+//# sourceMappingURL=validate-no-client-creation-outside-server-or-client.js.map

package/src/validate-no-client-creation-outside-server-or-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-no-client-creation-outside-server-or-client.js","sourceRoot":"","sources":["../../../../../packages/tooling/code-rules/src/validate-no-client-creation-outside-server-or-client.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;;;;AAEH,+CAAyB;AACzB,mDAA6B;AAC7B,0DAWiC;AACjC,qDAAiE;AACjE,yCAA2D;AAC3D,iDAAgD;AAChD,mEAA8D;AAE9D,MAAM,SAAS,GAAG,yBAAU,CAAC,2CAA2C,CAAC;AACzE,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC1D,sGAAsG;AACtG,wGAAwG;AACxG,iEAAiE;AACjE,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAE5E,qDAAqD;AACrD,MAAM,YAAY;IAEM;IACA;IACA;IAHpB,YACoB,IAAY,EACZ,OAAe,EACf,iBAA0B;QAF1B,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAAQ;QACf,sBAAiB,GAAjB,iBAAiB,CAAS;IAC3C,CAAC;CACP;AAED,2FAA2F;AAC3F,MAAM,SAAS;IAES;IACA;IACA;IACA;IAJpB,YACoB,IAAY,EACZ,IAAY,EACZ,OAAe,EACf,IAAY;QAHZ,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAAQ;QACf,SAAI,GAAJ,IAAI,CAAQ;IAC7B,CAAC;CACP;AAGM,IAAM,8CAA8C,GAApD,MAAM,8CAA+C,SAAQ,8BAA0D;IAGrG;IAFrB,YACI,MAAmD,EAClC,YAAiC;QAElD,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAFR,iBAAY,GAAZ,YAAY,CAAqB;IAGtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,aAAqB;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,yBAAyB,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,QAAQ,GAA2B,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,QAAQ,EAAE,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEpC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,6CAA6C,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,YAAY,GAAG,IAAA,8BAAe,EAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,eAAe,YAAY,CAAC,MAAM,qBAAqB,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEtF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;YAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAClC,yDAAyD;QACzD,OAAO,EAAE,OAAO,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;IAC7C,CAAC;IAEO,YAAY;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC5C,OAAO,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpF,CAAC;IAEO,cAAc;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC9C,CAAC;IAEO,YAAY;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IAC1C,CAAC;IAEO,WAAW,CAAC,UAA4B;QAC5C,IAAI,UAAU,KAAK,KAAK;YAAE,OAAO,UAAU,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAA,6BAAc,EAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,gBAAgB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,UAAU,CAAC;IACtB,CAAC;IAEO,WAAW,CAAC,aAAqB;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAA,yBAAU,EAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,4CAA4C,CAAC,CAAC;YACrF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;oCAEgC;IACxB,cAAc,CAClB,aAAqB,EACrB,YAAsB,EACtB,IAAsB,EACtB,IAAY,EACZ,IAAwB;QAExB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAElC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YAC3D,iFAAiF;YACjF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEjD,MAAM,YAAY,GAAG,IAAI,KAAK,uBAAuB;gBACjD,CAAC,CAAC,IAAA,oCAAqB,EAAC,IAAA,0BAAW,EAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;gBAAE,SAAS;YAE/D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC;gBACpD,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,iBAAiB;oBAAE,SAAS;gBAC9D,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACpE,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YACxE,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC;IACtB,CAAC;IAEO,QAAQ,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAA,6BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IAEO,UAAU,CAAC,QAAgB;QAC/B,OAAO,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7G,CAAC;IAED,uFAAuF;IAC/E,QAAQ,CAAC,aAAqB,EAAE,OAAe;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAEvC,MAAM,KAAK,GAAmB,EAAE,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,SAAS;YACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAA,yBAAU,EAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC3E,KAAK,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;oFACgF;IACxE,aAAa,CAAC,KAAe;QACjC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,IAAI,OAAO,EAAE,CAAC;oBACV,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;wBAAC,OAAO,GAAG,KAAK,CAAC;wBAAC,CAAC,IAAI,CAAC,CAAC;oBAAC,CAAC;yBAAM,CAAC;wBAAC,CAAC,IAAI,CAAC,CAAC;oBAAC,CAAC;oBACzF,SAAS;gBACb,CAAC;gBACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC;oBAAC,CAAC,IAAI,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACjF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;oBAAE,MAAM;gBAClD,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC,IAAI,CAAC,CAAC;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,qFAAqF;IAC7E,MAAM,CAAC,UAAuB,EAAE,QAAgC;QACpE,MAAM,IAAI,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,gEAAgE,CAAC,CAAC;QACvF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAC9G,OAAO,CAAC,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC3G,OAAO,CAAC,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAC9G,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAC9G,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,2BAA2B,SAAS,cAAc,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;YAC3F,OAAO,CAAC,KAAK,CAAC,6BAA6B,SAAS,cAAc,CAAC,CAAC;YACpE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;CACJ,CAAA;AArMY,wGAA8C;yDAA9C,8CAA8C;IAD1D,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGzB,0DAA2C;QACpB,2CAAmB;GAH7C,8CAA8C,CAqM1D","sourcesContent":["/**\n * Validate No Client Creation Outside Server Or Client\n *\n * Flags a project that CONSTRUCTS an rpc/pubsub transport client when the project's `role:` tag is\n * not one of the runnable/entrypoint roles (`allowedRoles`, default server | client | app).\n *\n * ============================================================================\n * WHY\n * ============================================================================\n * The runtime architecture graph draws a `uses` edge from every client-creation site to the api's\n * implementer. When the site sits in a project with a declared identity (`serviceName`) or target\n * (`callsService`) — a server, a client app, an app — the edge is attributable. When it sits in a\n * `role:lib`, the target can't be attributed, so the graph falls back to a fan-out: one `uses` edge\n * to EVERY implementer of the api, i.e. calls that cannot happen. A company-wide api (warmup,\n * browser-log, auth) then draws every caller to every server — pure fiction. This rule removes the\n * failure mode by construction: a reusable library takes the api INJECTED; the server/app module\n * binds it to a client.\n *\n * ============================================================================\n * VIOLATIONS (BAD) — flagged when the OWNING project's role is not in allowedRoles:\n * ============================================================================\n *   factory.createRpcClient(SomeApi, new ClientConfig('svc'))\n *   clientCloudTasksFactory.createPubSubClient(SomeApi, config)\n *\n * ============================================================================\n * ALLOWED\n * ============================================================================\n * - Any site in a project whose role IS in allowedRoles (server / client / app).\n * - A project with NO `role:` tag (the role-tag rule owns \"every project must declare a role\").\n * - Merely IMPORTING the api type or its DI token, or injecting the api — only constructing the\n *   transport (a `.createRpcClient(` / `.createPubSubClient(` CALL) is a violation.\n * - Files under allowedPaths, test files, and lines carrying the webpieces-disable escape.\n *\n * ============================================================================\n * SEVERITY (WARN first, then error)\n * ============================================================================\n * severity \"warn\" (default) prints the violations + migration but PASSES the build, so an upgrade\n * can't break an un-migrated Angular repo. Flip to \"error\" once libraries are migrated.\n */\n\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport {\n    hasDisable,\n    RULE_NAMES,\n    isPathExcluded,\n    NoClientCreationOutsideServerOrClientConfig,\n    ClientCreationSeverity,\n    ModifiedCodeMode,\n    detectBase,\n    getChangedFiles,\n    getFileDiff,\n    getChangedLineNumbers,\n} from '@webpieces/rules-config';\nimport { CodeValidator, ExecutorResult } from './code-validator';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { shouldSkipRule } from './resolve-mode';\nimport { ProjectRoleResolver } from './project-role-resolver';\n\nconst RULE_NAME = RULE_NAMES.NO_CLIENT_CREATION_OUTSIDE_SERVER_OR_CLIENT;\nconst DEFAULT_ALLOWED_ROLES = ['server', 'client', 'app'];\n// A `.createRpcClient(` / `.createPubSubClient(` method CALL — the leading dot excludes the framework\n// method DEFINITIONS (`createRpcClient<T>(apiPrototype, ...)`, no receiver); the `[(<]` requires a call\n// or a generic call, so a bare property reference isn't matched.\nconst CLIENT_CREATE_REGEX = /\\.(createRpcClient|createPubSubClient)\\s*[(<]/;\n\n/** One client-creation call site found in a file. */\nclass CreationSite {\n    constructor(\n        public readonly line: number,\n        public readonly context: string,\n        public readonly hasDisableComment: boolean,\n    ) {}\n}\n\n/** A reported violation: a client-creation site in a project whose role is not allowed. */\nclass Violation {\n    constructor(\n        public readonly file: string,\n        public readonly line: number,\n        public readonly context: string,\n        public readonly role: string,\n    ) {}\n}\n\n@injectable(bindingScopeValues.Singleton)\nexport class NoClientCreationOutsideServerOrClientValidator extends CodeValidator<NoClientCreationOutsideServerOrClientConfig> {\n    constructor(\n        config: NoClientCreationOutsideServerOrClientConfig,\n        private readonly roleResolver: ProjectRoleResolver,\n    ) {\n        super(config, RULE_NAME);\n    }\n\n    async run(workspaceRoot: string): Promise<ExecutorResult> {\n        const mode = this.resolveMode(this.config.mode ?? 'OFF');\n        if (mode === 'OFF') {\n            console.log(`\\n⏭️  Skipping ${RULE_NAME} validation (mode: OFF)`);\n            console.log('');\n            return { success: true };\n        }\n\n        const severity: ClientCreationSeverity = this.config.severity ?? 'warn';\n        console.log(`\\n📏 Validating No Client Creation Outside Server Or Client\\n`);\n        console.log(`   Mode: ${mode} · Severity: ${severity}`);\n\n        const base = this.resolveBase(workspaceRoot);\n        if (base === null) return { success: true };\n        const head = process.env['NX_HEAD'];\n\n        console.log(`   Base: ${base}`);\n        console.log(`   Head: ${head ?? 'working tree (includes uncommitted changes)'}`);\n        console.log('');\n\n        const changedFiles = getChangedFiles(workspaceRoot, base, head);\n        if (changedFiles.length === 0) {\n            console.log('✅ No TypeScript files changed');\n            return { success: true };\n        }\n\n        console.log(`📂 Checking ${changedFiles.length} changed file(s)...`);\n        const violations = this.findViolations(workspaceRoot, changedFiles, mode, base, head);\n\n        if (violations.length === 0) {\n            console.log('✅ No client-creation-in-a-library violations found');\n            return { success: true };\n        }\n\n        this.report(violations, severity);\n        // WARN reports but passes; only \"error\" fails the build.\n        return { success: severity !== 'error' };\n    }\n\n    private allowedRoles(): string[] {\n        const configured = this.config.allowedRoles;\n        return configured && configured.length > 0 ? configured : DEFAULT_ALLOWED_ROLES;\n    }\n\n    private disableAllowed(): boolean {\n        return this.config.disableAllowed ?? true;\n    }\n\n    private allowedPaths(): string[] {\n        return this.config.allowedPaths ?? [];\n    }\n\n    private resolveMode(normalMode: ModifiedCodeMode): ModifiedCodeMode {\n        if (normalMode === 'OFF') return normalMode;\n        const skip = shouldSkipRule(this.config.ignoreModifiedUntilEpoch, this.config.ignoreRuleWhileOnBranch);\n        if (skip.skip) {\n            console.log(`\\n⏭️  Skipping ${RULE_NAME} validation (${skip.reason})`);\n            console.log('');\n            return 'OFF';\n        }\n        return normalMode;\n    }\n\n    private resolveBase(workspaceRoot: string): string | null {\n        const envBase = process.env['NX_BASE'];\n        if (envBase) return envBase;\n        const detected = detectBase(workspaceRoot);\n        if (!detected) {\n            console.log(`\\n⏭️  Skipping ${RULE_NAME} validation (could not detect base branch)`);\n            console.log('');\n            return null;\n        }\n        return detected;\n    }\n\n    /** Violations across changed files: a creation site in a project whose role is not allowed. In\n     *  NEW_AND_MODIFIED_CODE only sites on changed lines count; in NEW_AND_MODIFIED_FILES every site\n     *  in a changed file counts. */\n    private findViolations(\n        workspaceRoot: string,\n        changedFiles: string[],\n        mode: ModifiedCodeMode,\n        base: string,\n        head: string | undefined,\n    ): Violation[] {\n        const allowed = new Set(this.allowedRoles());\n        const violations: Violation[] = [];\n        for (const file of changedFiles) {\n            if (this.isExempt(file)) continue;\n\n            const role = this.roleResolver.roleOf(workspaceRoot, file);\n            // No role tag → role-tag rule owns it; an allowed role → fine. Either way, skip.\n            if (role === null || allowed.has(role)) continue;\n\n            const changedLines = mode === 'NEW_AND_MODIFIED_CODE'\n                ? getChangedLineNumbers(getFileDiff(workspaceRoot, file, base, head))\n                : null;\n            if (changedLines !== null && changedLines.size === 0) continue;\n\n            for (const site of this.scanFile(workspaceRoot, file)) {\n                if (this.disableAllowed() && site.hasDisableComment) continue;\n                if (changedLines !== null && !changedLines.has(site.line)) continue;\n                violations.push(new Violation(file, site.line, site.context, role));\n            }\n        }\n        return violations;\n    }\n\n    private isExempt(file: string): boolean {\n        return this.isTestFile(file) || isPathExcluded(file, this.allowedPaths());\n    }\n\n    private isTestFile(filePath: string): boolean {\n        return filePath.includes('.spec.ts') || filePath.includes('.test.ts') || filePath.includes('__tests__/');\n    }\n\n    /** Every client-creation call site in a file, ignoring occurrences inside comments. */\n    private scanFile(workspaceRoot: string, relFile: string): CreationSite[] {\n        const fullPath = path.join(workspaceRoot, relFile);\n        if (!fs.existsSync(fullPath)) return [];\n        const lines = fs.readFileSync(fullPath, 'utf-8').split('\\n');\n        const code = this.stripComments(lines);\n\n        const sites: CreationSite[] = [];\n        for (let i = 0; i < code.length; i++) {\n            if (!CLIENT_CREATE_REGEX.test(code[i] ?? '')) continue;\n            const raw = lines[i] ?? '';\n            const prev = i > 0 ? (lines[i - 1] ?? '') : '';\n            const disabled = hasDisable(raw, RULE_NAME) || hasDisable(prev, RULE_NAME);\n            sites.push(new CreationSite(i + 1, raw.trim(), disabled));\n        }\n        return sites;\n    }\n\n    /** The code-only text of each line: block comments (/* … *\\/) and line comments (// …) blanked\n     *  out, so a `factory.createRpcClient(` in a JSDoc example is never matched. */\n    private stripComments(lines: string[]): string[] {\n        const out: string[] = [];\n        let inBlock = false;\n        for (const line of lines) {\n            let result = '';\n            let i = 0;\n            while (i < line.length) {\n                if (inBlock) {\n                    if (line[i] === '*' && line[i + 1] === '/') { inBlock = false; i += 2; } else { i += 1; }\n                    continue;\n                }\n                if (line[i] === '/' && line[i + 1] === '*') { inBlock = true; i += 2; continue; }\n                if (line[i] === '/' && line[i + 1] === '/') break;\n                result += line[i];\n                i += 1;\n            }\n            out.push(result);\n        }\n        return out;\n    }\n\n    // webpieces-disable max-lines-new-methods -- console guidance block + violation list\n    private report(violations: Violation[], severity: ClientCreationSeverity): void {\n        const icon = severity === 'error' ? '❌' : '⚠️';\n        console.error('');\n        console.error(`${icon} A library (role:lib) must NOT construct an rpc/pubsub client!`);\n        console.error('');\n        console.error('   Only a runnable entrypoint (role:server / role:client / role:app) has a declared identity');\n        console.error('   (serviceName) or target (callsService), so a client built there is attributable in the');\n        console.error('   runtime graph. A client built in a library reaches the fan-out fallback — one \"uses\" edge');\n        console.error('   to EVERY implementer of the api, i.e. calls that cannot happen.');\n        console.error('');\n        console.error('   Migrate: the library takes the api INJECTED (constructor(private readonly api: SomeApi)),');\n        console.error('   and the server/app DI module constructs the client with factory.createRpcClient(SomeApi, ...).');\n        console.error('');\n        for (const v of violations) {\n            console.error(`  ${icon} ${v.file}:${v.line}   (role:${v.role})`);\n            console.error(`     ${v.context}`);\n        }\n        console.error('');\n        if (this.disableAllowed()) {\n            console.error('   Escape hatch (use sparingly):');\n            console.error(`   // webpieces-disable ${RULE_NAME} -- <reason>`);\n        } else {\n            console.error('   Escape hatch: DISABLED (disableAllowed: false)');\n        }\n        console.error('');\n        if (severity !== 'error') {\n            console.error('   Severity: WARN — reported but NOT failing the build. Migrate, then set');\n            console.error(`   \"severity\": \"error\" on ${RULE_NAME} to enforce.`);\n            console.error('');\n        }\n    }\n}\n"]}