tova 0.10.3 → 0.11.12

package/src/analyzer/auth-analyzer.js

@@ -0,0 +1,123 @@
+// Auth-specific analyzer methods for the Tova language
+// Extracted from analyzer.js for lazy loading — only loaded when auth { } blocks are encountered.
+
+export function installAuthAnalyzer(AnalyzerClass) {
+  if (AnalyzerClass.prototype._authAnalyzerInstalled) return;
+  AnalyzerClass.prototype._authAnalyzerInstalled = true;
+
+  AnalyzerClass.prototype.visitAuthBlock = function(node) {
+    const validHookEvents = new Set(['signup', 'login', 'logout', 'oauth_link']);
+    const providerTypes = new Set();
+    let hasProvider = false;
+
+    for (const stmt of node.body) {
+      if (stmt.type === 'AuthConfigField') {
+        if (stmt.key === 'secret' && stmt.value.type === 'StringLiteral') {
+          this.warnings.push({
+            message: 'Auth secret should use env() — hardcoded secrets are insecure',
+            loc: stmt.loc, code: 'W_AUTH_HARDCODED_SECRET', category: 'auth',
+          });
+        }
+        if (stmt.key === 'token_expires' && stmt.value.type === 'NumberLiteral' && stmt.value.value < 300) {
+          this.warnings.push({
+            message: 'Access token expires too quickly (< 5 minutes) — may cause frequent logouts',
+            loc: stmt.loc, code: 'W_AUTH_SHORT_TOKEN', category: 'auth',
+          });
+        }
+        if (stmt.key === 'refresh_expires' && stmt.value.type === 'NumberLiteral' && stmt.value.value > 2592000) {
+          this.warnings.push({
+            message: 'Refresh token lives longer than 30 days — consider shorter lifetime',
+            loc: stmt.loc, code: 'W_AUTH_LONG_REFRESH', category: 'auth',
+          });
+        }
+        if (stmt.key === 'storage' && stmt.value.type === 'StringLiteral' && stmt.value.value === 'local') {
+          this.warnings.push({
+            message: 'localStorage tokens are vulnerable to XSS — prefer storage: "cookie"',
+            loc: stmt.loc, code: 'W_AUTH_LOCAL_STORAGE', category: 'auth',
+          });
+        }
+      }
+
+      if (stmt.type === 'AuthProviderDeclaration') {
+        hasProvider = true;
+        const key = stmt.providerType + (stmt.name ? ':' + stmt.name : '');
+        if (providerTypes.has(key)) {
+          this.warnings.push({
+            message: `Duplicate auth provider '${key}'`,
+            loc: stmt.loc, code: 'W_AUTH_DUPLICATE_PROVIDER', category: 'auth',
+          });
+        }
+        providerTypes.add(key);
+
+        if (stmt.providerType === 'email') {
+          if (!stmt.config.confirm_email) {
+            this.warnings.push({
+              message: 'Email provider without confirm_email — consider requiring email verification',
+              loc: stmt.loc, code: 'W_AUTH_NO_CONFIRM', category: 'auth',
+            });
+          }
+          if (stmt.config.password_min && stmt.config.password_min.type === 'NumberLiteral' && stmt.config.password_min.value < 8) {
+            this.warnings.push({
+              message: 'Minimum password length less than 8 — weak passwords allowed',
+              loc: stmt.loc, code: 'W_AUTH_WEAK_PASSWORD', category: 'auth',
+            });
+          }
+        }
+      }
+
+      if (stmt.type === 'AuthHookDeclaration') {
+        if (!validHookEvents.has(stmt.event)) {
+          this.warnings.push({
+            message: `Unknown auth hook event '${stmt.event}' — valid: ${[...validHookEvents].join(', ')}`,
+            loc: stmt.loc, code: 'W_AUTH_UNKNOWN_HOOK', category: 'auth',
+          });
+        }
+      }
+
+      if (stmt.type === 'AuthProtectedRoute') {
+        if (!stmt.config.redirect) {
+          this.warnings.push({
+            message: `Protected route '${stmt.pattern}' has no redirect`,
+            loc: stmt.loc, code: 'W_AUTH_PROTECTED_NO_REDIRECT', category: 'auth',
+          });
+        }
+      }
+    }
+
+    if (!hasProvider) {
+      this.warnings.push({
+        message: 'Auth block has no providers — add at least one',
+        loc: node.loc, code: 'W_AUTH_MISSING_PROVIDER', category: 'auth',
+      });
+    }
+  };
+
+  AnalyzerClass.prototype._validateAuthCrossBlock = function() {
+    const securityRoles = new Set();
+    for (const node of this.ast.body) {
+      if (node.type === 'SecurityBlock') {
+        for (const stmt of node.body) {
+          if (stmt.type === 'SecurityRoleDeclaration') {
+            securityRoles.add(stmt.name);
+          }
+        }
+      }
+    }
+
+    for (const node of this.ast.body) {
+      if (node.type === 'AuthBlock') {
+        for (const stmt of node.body) {
+          if (stmt.type === 'AuthProtectedRoute' && stmt.config.require) {
+            const roleName = stmt.config.require.type === 'Identifier' ? stmt.config.require.name : null;
+            if (roleName && securityRoles.size > 0 && !securityRoles.has(roleName)) {
+              this.warnings.push({
+                message: `Protected route requires role '${roleName}' not defined in security block`,
+                loc: stmt.loc, code: 'W_AUTH_UNKNOWN_ROLE', category: 'auth',
+              });
+            }
+          }
+        }
+      }
+    }
+  };
+}

package/src/analyzer/cli-analyzer.js

@@ -0,0 +1,91 @@
+// CLI-specific analyzer methods for the Tova language
+// Extracted from analyzer.js for lazy loading — only loaded when cli { } blocks are encountered.
+
+import { Symbol } from './scope.js';
+
+export function installCliAnalyzer(AnalyzerClass) {
+  if (AnalyzerClass.prototype._cliAnalyzerInstalled) return;
+  AnalyzerClass.prototype._cliAnalyzerInstalled = true;
+
+  AnalyzerClass.prototype.visitCliBlock = function(node) {
+    const validKeys = new Set(['name', 'version', 'description']);
+
+    // Validate config keys
+    for (const field of node.config) {
+      if (!validKeys.has(field.key)) {
+        this.warnings.push({
+          message: `Unknown cli config key '${field.key}' — valid keys are: ${[...validKeys].join(', ')}`,
+          loc: field.loc,
+          code: 'W_UNKNOWN_CLI_CONFIG',
+        });
+      }
+    }
+
+    // Validate commands
+    const commandNames = new Set();
+    for (const cmd of node.commands) {
+      // Duplicate command names
+      if (commandNames.has(cmd.name)) {
+        this.warnings.push({
+          message: `Duplicate cli command '${cmd.name}'`,
+          loc: cmd.loc,
+          code: 'W_DUPLICATE_CLI_COMMAND',
+        });
+      }
+      commandNames.add(cmd.name);
+
+      // Check for positional args after flags
+      let seenFlag = false;
+      for (const param of cmd.params) {
+        if (param.isFlag) {
+          seenFlag = true;
+        } else if (seenFlag) {
+          this.warnings.push({
+            message: `Positional argument '${param.name}' after flag in command '${cmd.name}' — positionals should come before flags`,
+            loc: param.loc,
+            code: 'W_POSITIONAL_AFTER_FLAG',
+          });
+        }
+      }
+
+      // Visit command body with params in scope
+      this.pushScope('function');
+      for (const param of cmd.params) {
+        this.currentScope.define(param.name,
+          new Symbol(param.name, 'parameter', null, false, param.loc));
+      }
+      this.visitNode(cmd.body);
+      this.popScope();
+    }
+  };
+
+  AnalyzerClass.prototype._validateCliCrossBlock = function() {
+    const cliBlocks = this.ast.body.filter(n => n.type === 'CliBlock');
+    if (cliBlocks.length === 0) return;
+
+    // Warn if cli + server coexist
+    const hasServer = this.ast.body.some(n => n.type === 'ServerBlock');
+    if (hasServer) {
+      this.warnings.push({
+        message: 'cli {} and server {} blocks in the same file — cli produces a standalone executable, not a web server',
+        loc: cliBlocks[0].loc,
+        code: 'W_CLI_WITH_SERVER',
+      });
+    }
+
+    // Check for missing name across all cli blocks
+    let hasName = false;
+    for (const block of cliBlocks) {
+      for (const field of block.config) {
+        if (field.key === 'name') hasName = true;
+      }
+    }
+    if (!hasName) {
+      this.warnings.push({
+        message: 'cli block has no name: field — consider adding name: "your-tool"',
+        loc: cliBlocks[0].loc,
+        code: 'W_CLI_MISSING_NAME',
+      });
+    }
+  };
+}

package/src/analyzer/concurrency-analyzer.js

@@ -0,0 +1,126 @@
+// Concurrency-specific analyzer methods for the Tova language
+// Extracted from analyzer.js for lazy loading — only loaded when concurrent { } blocks are encountered.
+
+import { Symbol } from './scope.js';
+
+export function installConcurrencyAnalyzer(AnalyzerClass) {
+  if (AnalyzerClass.prototype._concurrencyAnalyzerInstalled) return;
+  AnalyzerClass.prototype._concurrencyAnalyzerInstalled = true;
+
+  AnalyzerClass.prototype.visitConcurrentBlock = function(node) {
+    // Validate mode
+    const validModes = new Set(['all', 'cancel_on_error', 'first', 'timeout']);
+    if (!validModes.has(node.mode)) {
+      this.warn(`Unknown concurrent block mode '${node.mode}'`, node.loc, null, {
+        code: 'W_UNKNOWN_CONCURRENT_MODE',
+      });
+    }
+
+    // Validate timeout
+    if (node.mode === 'timeout' && !node.timeout) {
+      this.warn("concurrent timeout mode requires a timeout value", node.loc, null, {
+        code: 'W_MISSING_TIMEOUT',
+      });
+    }
+
+    // Warn on empty block
+    if (node.body.length === 0) {
+      this.warn("Empty concurrent block", node.loc, null, {
+        code: 'W_EMPTY_CONCURRENT',
+      });
+    }
+
+    // Track concurrent depth for spawn validation
+    this._concurrentDepth = (this._concurrentDepth || 0) + 1;
+
+    // Visit body statements (concurrent block does NOT create a new scope —
+    // variables assigned inside should be visible after the block)
+    for (const stmt of node.body) {
+      this.visitNode(stmt);
+    }
+
+    // Check spawned functions for WASM compatibility — warn if mixed WASM/non-WASM
+    let hasWasm = false;
+    let hasNonWasm = false;
+    for (const stmt of node.body) {
+      const spawn = (stmt.type === 'Assignment' && stmt.values && stmt.values[0] && stmt.values[0].type === 'SpawnExpression')
+        ? stmt.values[0]
+        : (stmt.type === 'ExpressionStatement' && stmt.expression && stmt.expression.type === 'SpawnExpression')
+          ? stmt.expression
+          : null;
+      if (!spawn) continue;
+      const calleeName = spawn.callee && spawn.callee.type === 'Identifier' ? spawn.callee.name : null;
+      if (calleeName) {
+        const sym = this.currentScope.lookup(calleeName);
+        if (sym && sym.isWasm) {
+          hasWasm = true;
+        } else {
+          hasNonWasm = true;
+        }
+      } else {
+        // Lambda or complex expression — always non-WASM
+        hasNonWasm = true;
+      }
+    }
+    if (hasWasm && hasNonWasm) {
+      this.warn(
+        "concurrent block mixes @wasm and non-WASM tasks — non-WASM tasks will fall back to async JS execution",
+        node.loc, null, { code: 'W_SPAWN_WASM_FALLBACK' }
+      );
+    }
+
+    this._concurrentDepth--;
+  };
+
+  AnalyzerClass.prototype.visitSelectStatement = function(node) {
+    if (node.cases.length === 0) {
+      this.warn("Empty select block", node.loc, null, {
+        code: 'W_EMPTY_SELECT',
+      });
+    }
+
+    let defaultCount = 0;
+    let timeoutCount = 0;
+    for (const c of node.cases) {
+      if (c.kind === 'default') defaultCount++;
+      if (c.kind === 'timeout') timeoutCount++;
+    }
+
+    if (defaultCount > 1) {
+      this.warn("select block has multiple default cases", node.loc, null, {
+        code: 'W_DUPLICATE_SELECT_DEFAULT',
+      });
+    }
+    if (timeoutCount > 1) {
+      this.warn("select block has multiple timeout cases", node.loc, null, {
+        code: 'W_DUPLICATE_SELECT_TIMEOUT',
+      });
+    }
+    if (defaultCount > 0 && timeoutCount > 0) {
+      this.warn("select block has both default and timeout — default makes timeout unreachable", node.loc, null, {
+        code: 'W_SELECT_DEFAULT_TIMEOUT',
+      });
+    }
+
+    // Visit each case's expressions and body
+    for (const c of node.cases) {
+      if (c.channel) this.visitNode(c.channel);
+      if (c.value) this.visitNode(c.value);
+
+      if (c.kind === 'receive' && c.binding) {
+        // Create scope for the binding variable
+        this.pushScope('select-case');
+        this.currentScope.define(c.binding,
+          new Symbol(c.binding, 'variable', null, false, c.loc));
+        for (const stmt of c.body) {
+          this.visitNode(stmt);
+        }
+        this.popScope();
+      } else {
+        for (const stmt of c.body) {
+          this.visitNode(stmt);
+        }
+      }
+    }
+  };
+}

package/src/analyzer/edge-analyzer.js

@@ -0,0 +1,215 @@
+// Edge-specific analyzer methods for the Tova language
+// Extracted from analyzer.js for lazy loading — only loaded when edge { } blocks are encountered.
+
+export function installEdgeAnalyzer(AnalyzerClass) {
+  if (AnalyzerClass.prototype._edgeAnalyzerInstalled) return;
+  AnalyzerClass.prototype._edgeAnalyzerInstalled = true;
+
+  AnalyzerClass.prototype.visitEdgeBlock = function(node) {
+    const validTargets = new Set(['cloudflare', 'deno', 'vercel', 'lambda', 'bun']);
+    const validConfigKeys = new Set(['target']);
+    const bindingNames = new Set();
+
+    // Binding support matrix per target
+    const BINDING_SUPPORT = {
+      cloudflare: { kv: true, sql: true, storage: true, queue: true },
+      deno:       { kv: true, sql: false, storage: false, queue: false },
+      vercel:     { kv: false, sql: false, storage: false, queue: false },
+      lambda:     { kv: false, sql: false, storage: false, queue: false },
+      bun:        { kv: false, sql: true, storage: false, queue: false },
+    };
+
+    // Targets that support schedule/consume/middleware
+    const SCHEDULE_TARGETS = new Set(['cloudflare', 'deno']);
+    const CONSUME_TARGETS = new Set(['cloudflare']);
+
+    // Determine target from config fields
+    let target = 'cloudflare';
+    for (const stmt of node.body) {
+      if (stmt.type === 'EdgeConfigField' && stmt.key === 'target' && stmt.value.type === 'StringLiteral') {
+        target = stmt.value.value;
+      }
+    }
+
+    this.pushScope('edge');
+
+    let kvCount = 0;
+    const queueNames = new Set();
+    const consumers = [];
+
+    for (const stmt of node.body) {
+      // Validate config fields
+      if (stmt.type === 'EdgeConfigField') {
+        if (!validConfigKeys.has(stmt.key)) {
+          this.warnings.push({
+            message: `Unknown edge config key '${stmt.key}' — valid keys are: ${[...validConfigKeys].join(', ')}`,
+            loc: stmt.loc,
+            code: 'W_UNKNOWN_EDGE_CONFIG',
+          });
+        }
+        if (stmt.key === 'target' && stmt.value.type === 'StringLiteral') {
+          if (!validTargets.has(stmt.value.value)) {
+            this.warnings.push({
+              message: `Unknown edge target '${stmt.value.value}' — valid targets are: ${[...validTargets].join(', ')}`,
+              loc: stmt.loc,
+              code: 'W_UNKNOWN_EDGE_TARGET',
+            });
+          }
+        }
+        continue;
+      }
+
+      // Check for duplicate binding names
+      if (stmt.type === 'EdgeKVDeclaration' || stmt.type === 'EdgeSQLDeclaration' ||
+          stmt.type === 'EdgeStorageDeclaration' || stmt.type === 'EdgeQueueDeclaration') {
+        if (bindingNames.has(stmt.name)) {
+          this.warnings.push({
+            message: `Duplicate edge binding '${stmt.name}'`,
+            loc: stmt.loc,
+            code: 'W_DUPLICATE_EDGE_BINDING',
+          });
+        }
+        bindingNames.add(stmt.name);
+      }
+
+      // Track queue names for consume validation
+      if (stmt.type === 'EdgeQueueDeclaration') {
+        queueNames.add(stmt.name);
+      }
+
+      // Check for duplicate env/secret names
+      if (stmt.type === 'EdgeEnvDeclaration' || stmt.type === 'EdgeSecretDeclaration') {
+        if (bindingNames.has(stmt.name)) {
+          this.warnings.push({
+            message: `Duplicate edge binding '${stmt.name}'`,
+            loc: stmt.loc,
+            code: 'W_DUPLICATE_EDGE_BINDING',
+          });
+        }
+        bindingNames.add(stmt.name);
+      }
+
+      // Unsupported binding warnings (per target)
+      const support = BINDING_SUPPORT[target] || BINDING_SUPPORT.cloudflare;
+      if (stmt.type === 'EdgeKVDeclaration' && !support.kv) {
+        this.warnings.push({
+          message: `KV binding '${stmt.name}' is not supported on target '${target}' — it will be stubbed as null`,
+          loc: stmt.loc,
+          code: 'W_UNSUPPORTED_KV',
+        });
+      }
+      if (stmt.type === 'EdgeSQLDeclaration' && !support.sql) {
+        this.warnings.push({
+          message: `SQL binding '${stmt.name}' is not supported on target '${target}' — it will be stubbed as null`,
+          loc: stmt.loc,
+          code: 'W_UNSUPPORTED_SQL',
+        });
+      }
+      if (stmt.type === 'EdgeStorageDeclaration' && !support.storage) {
+        this.warnings.push({
+          message: `Storage binding '${stmt.name}' is not supported on target '${target}' — it will be stubbed as null`,
+          loc: stmt.loc,
+          code: 'W_UNSUPPORTED_STORAGE',
+        });
+      }
+      if (stmt.type === 'EdgeQueueDeclaration' && !support.queue) {
+        this.warnings.push({
+          message: `Queue binding '${stmt.name}' is not supported on target '${target}' — it will be stubbed as null`,
+          loc: stmt.loc,
+          code: 'W_UNSUPPORTED_QUEUE',
+        });
+      }
+
+      // Deno multi-KV warning
+      if (stmt.type === 'EdgeKVDeclaration') {
+        kvCount++;
+        if (kvCount > 1 && target === 'deno') {
+          this.warnings.push({
+            message: `Deno Deploy supports only one KV store — '${stmt.name}' will share the same store as the first KV binding`,
+            loc: stmt.loc,
+            code: 'W_DENO_MULTI_KV',
+          });
+        }
+      }
+
+      // Validate schedule cron expressions + target support
+      if (stmt.type === 'EdgeScheduleDeclaration') {
+        const parts = stmt.cron.split(/\s+/);
+        if (parts.length < 5 || parts.length > 6) {
+          this.warnings.push({
+            message: `Invalid cron expression '${stmt.cron}' — expected 5 or 6 space-separated fields`,
+            loc: stmt.loc,
+            code: 'W_INVALID_CRON',
+          });
+        }
+        if (!SCHEDULE_TARGETS.has(target)) {
+          this.warnings.push({
+            message: `Scheduled tasks are not supported on target '${target}' — schedule '${stmt.name}' will be ignored. Supported targets: ${[...SCHEDULE_TARGETS].join(', ')}`,
+            loc: stmt.loc,
+            code: 'W_UNSUPPORTED_SCHEDULE',
+          });
+        }
+      }
+
+      // Collect consume declarations for post-loop validation
+      if (stmt.type === 'EdgeConsumeDeclaration') {
+        consumers.push(stmt);
+        if (!CONSUME_TARGETS.has(target)) {
+          this.warnings.push({
+            message: `Queue consumers are not supported on target '${target}' — consume '${stmt.queue}' will be ignored. Supported targets: ${[...CONSUME_TARGETS].join(', ')}`,
+            loc: stmt.loc,
+            code: 'W_UNSUPPORTED_CONSUME',
+          });
+        }
+      }
+
+      // Visit child nodes — edge-specific types are noop in the registry,
+      // so explicitly visit bodies that contain statements
+      if (stmt.type === 'EdgeScheduleDeclaration' && stmt.body) {
+        for (const s of stmt.body.body || []) this.visitNode(s);
+      } else if (stmt.type === 'FunctionDeclaration' || stmt.type === 'RouteDeclaration') {
+        this.visitNode(stmt);
+      }
+    }
+
+    // Post-loop: validate consume references a declared queue
+    for (const consumer of consumers) {
+      if (!queueNames.has(consumer.queue)) {
+        this.warnings.push({
+          message: `consume '${consumer.queue}' references undeclared queue binding — add 'queue ${consumer.queue}' to the edge block`,
+          loc: consumer.loc,
+          code: 'W_CONSUME_UNKNOWN_QUEUE',
+        });
+      }
+    }
+
+    // Warn if edge block has no route or schedule handlers
+    const hasRoutes = node.body.some(s => s.type === 'RouteDeclaration');
+    const hasSchedules = node.body.some(s => s.type === 'EdgeScheduleDeclaration');
+    const hasConsumers = consumers.length > 0;
+    if (!hasRoutes && !hasSchedules && !hasConsumers) {
+      this.warnings.push({
+        message: 'edge block has no routes, schedules, or consumers — it will produce no handlers',
+        loc: node.loc,
+        code: 'W_EDGE_NO_HANDLERS',
+      });
+    }
+
+    this.popScope();
+  };
+
+  AnalyzerClass.prototype._validateEdgeCrossBlock = function() {
+    const edgeBlocks = this.ast.body.filter(n => n.type === 'EdgeBlock');
+    if (edgeBlocks.length === 0) return;
+
+    // Warn if edge + cli coexist (cli takes over with earlyReturn)
+    const hasCli = this.ast.body.some(n => n.type === 'CliBlock');
+    if (hasCli) {
+      this.warnings.push({
+        message: 'edge {} and cli {} blocks in the same file — cli produces a standalone executable, edge block will be ignored',
+        loc: edgeBlocks[0].loc,
+        code: 'W_EDGE_WITH_CLI',
+      });
+    }
+  };
+}