volaro 0.1.0-alpha.11 → 0.1.0-alpha.13

package/README.md

@@ -1,6 +1,6 @@
 # Volaro
 
-**Limited alpha** (this is `0.1.0-alpha.11`), published under both the
+**Limited alpha** (this is `0.1.0-alpha.13`), published under both the
 `latest` and `alpha` dist-tags: `npm install volaro`.
 
 Volaro is an experimental application language intended for AI authoring and

package/compiler/SOURCE_INFO.json

@@ -1,6 +1,6 @@
 {
-  "revision": "5f9c32d19082250fc91ab3664ae6726aa2cfd0a0",
+  "revision": "d6e19b4e656bee01bf90048117fb24b598abdf3b",
   "source": "git",
   "dirty": false,
-  "content_sha256": "53474ecb82ebaf7ff2861f647b7796dc9c84cce73d7061ee64a65c90365a80ae"
+  "content_sha256": "64c762006f1fceda3601d6c6b3a6de4ba99590d93aa14d04a749f318a840aa17"
 }

package/compiler/SOURCE_REV

@@ -1 +1 @@
-5f9c32d19082250fc91ab3664ae6726aa2cfd0a0
+d6e19b4e656bee01bf90048117fb24b598abdf3b

package/compiler/validator/vlcheck/__main__.py

@@ -24,7 +24,7 @@ from .checks import check
 from .diagnostics import LineIndex, Severity
 from .lexer import Lexer
 from .parser import Parser
-from .resolve import resolve
+from .resolve import resolve, resolve_page_server
 from .project_config import load_config, ConfigError
 from .diagnostics import Diagnostic
 from .layoutcompose import check_all as check_project_composition
@@ -59,21 +59,25 @@ def check_source(src: str, filename: str, strict_names: bool = False,
     # (spec §10.2): handlers and an `errors` block, no module items. Every
     # other basename parses as an ordinary module.
     base = os.path.basename(filename)
+    resolver = resolve
     if base in ("page.server.vl", "_server.vl"):
         if base == "page.server.vl":
             mod = parser.parse_page_server()
+            # Handler bodies resolve like service route bodies, against the
+            # project's app.vl, the handler's params and the `_server.vl`
+            # context providers above the file (resolve.resolve_page_server).
+            resolver = resolve_page_server
         else:
             mod = parser.parse_server_ctx()
-        # The resolver walks module items (services, views, use graphs); a
-        # page-server file has none of those, so skip it here. Folder-param
-        # matching against the route manifest is a later stage.
-        do_resolve = False
+            # A `_server.vl` holds only `context` providers; the resolver
+            # has no pass for them yet.
+            do_resolve = False
     else:
         mod = parser.parse_module()
     diags = (list(lx.diags) + list(parser.diags)
              + check(mod, filename, li, strict_names=strict_names, release=release))
     if do_resolve:
-        diags += resolve(mod, filename, li)
+        diags += resolver(mod, filename, li)
     diags.sort(key=lambda d: (d.start, 0 if d.severity == Severity.ERROR else 1, d.code))
     return li, diags
 

package/compiler/validator/vlcheck/checks.py

@@ -105,12 +105,13 @@ _METHOD_FN_FORM = {
     "matches": "matches", "match": "matches", "test": "matches",
     "first_char": "first_char", "split": "split", "join": "join",
     "filter": "filter", "map": "map", "take": "take", "count": "count",
+    "some": "any", "every": "all",
     "sum": "sum", "sort_by": "sort_by", "group_by": "group_by",
     "chunk": "chunk", "concat": "concat", "append": "append", "push": "append",
     "keys": "keys", "values": "values", "get_or": "get_or",
 }
 _LIST_FNS = {"filter", "map", "take", "count", "sum", "sort_by", "group_by",
-             "chunk", "concat", "append", "join"}
+             "chunk", "concat", "append", "join", "any", "all"}
 # Other common carry-overs with a Volaro spelling that is not a function call.
 _METHOD_OTHER_FIX = {
     "length": "`{r}.len()`", "size": "`{r}.len()`",
@@ -124,64 +125,200 @@ _METHOD_OTHER_FIX = {
 # Names a page-server / service body has in scope that are ambient objects,
 # not user values.
 _AMBIENT_RECEIVERS = {"session", "request"}
-# Free functions the spec shows but no emitter lowers as a bare call (not in
-# vlbuild's STD_FNS). Only an error where the build emits the call -- a view
-# or a service route; a module-level `fn` body is never emitted into either.
+# The std free-function surface, in one place. Every std function name the
+# checker knows is in exactly one of the two tables below:
+#
+#   STD_BUILT_FNS  -- vlbuild lowers `name(...)` to `VL.std.name(...)`.
+#                     vlbuild's `emit.STD_FNS` IS this set (imported, not
+#                     copied), and `VL.std` in `assets/vlrt.js` defines each
+#                     one; server.js embeds that same `VL.std` block, so a
+#                     route body gets the identical function.
+#   _FN_NOT_BUILT  -- a name the spec, the corpus or an agent uses that this
+#                     build has no function for. A bare call where the build
+#                     emits it (a view or a service route) is E-FN-NOT-BUILT
+#                     with this fix line; a module-level `fn` body is never
+#                     emitted into either, so it is not judged there.
+#
+# resolve.py's known-name list is derived from these two, so a name cannot be
+# "known" without being classified. `test_std_fn_parity` in vlbuild's
+# tests/test_build.py calls every known name through the real checker and
+# requires each accepted one to exist in the emitter, `vlrt.js`, its minified
+# copy and server.js. This replaced five hand-synced tables: `unique` was
+# known to the resolver, missing from the other four, and built to a bare
+# `unique(...)` that crashed every page (Testing Lab search brief, Example
+# Demo 2.3).
+STD_BUILT_FNS = frozenset({
+    # std.list
+    "filter", "map", "take", "count", "sum", "sort_by", "group_by", "chunk",
+    # list growth (spec section 20.9): the only way to combine or grow a list
+    "concat", "append",
+    # `unique(xs)`: first occurrence of each distinct value, in order
+    "unique",
+    # `any(xs, f)` / `all(xs, f)`: whether some / every item passes `f`
+    "any", "all",
+    # std.str (spec section 13: split, join, trim, case, replace, contains,
+    # regex -- `matches`)
+    "join", "split", "first_char", "trim", "upper", "lower", "replace",
+    "contains", "matches",
+    # std.map
+    "keys", "values", "get_or",
+    # numeric conversion
+    "int_to_float", "float_to_int",
+})
+
+_FOLD_FIX = "a `for` loop over a `let mut` accumulator"
 _FN_NOT_BUILT = {
-    "sorted": "sort_by(xs, fn(x) x)", "first": "xs[0] (check xs.len() > 0 first)",
-    "fold": "a `for` loop over a `let mut` accumulator",
+    # in the spec (section 13 or its examples), not built
+    "fold": _FOLD_FIX,
     "merge": "a record literal naming every field",
     "to_int": "no string-to-int conversion is built yet; keep the value an int",
+    "now": ("a `model` field default (`created_at time = now()`); a view or "
+            "route cannot read the clock in this build"),
+    # names the checker has accepted, not built
+    "sorted": "sort_by(xs, fn(x) x)",
+    "first": "xs[0] (check xs.len() > 0 first)",
+    "reduce": _FOLD_FIX,
+    "flatten": _FOLD_FIX + " and `concat(acc, x)`",
+    "reverse": _FOLD_FIX + " and `concat([x], acc)`",
+    "zip": "a `for i in 0..xs.len()` loop reading `xs[i]` and `ys[i]`",
+    "enumerate": "a `for i in 0..xs.len()` loop reading `xs[i]`",
+    "index_of": "a `for i in 0..xs.len()` loop that compares `xs[i]`",
+    "slice": "take(xs, n) for a prefix, or a `for i in a..b` loop",
+    "range": "a `for i in 0..n` loop",
+    "none": "not any(xs, f)",
+    "avg": "sum(xs) / count(xs) (check count(xs) > 0 first)",
+    "min": "if (a < b) a else b",
+    "max": "if (a > b) a else b",
+    "abs": "if (x < 0) -x else x",
+    "round": "float_to_int(x + 0.5) for a non-negative x",
+    "floor": "float_to_int(x) for a non-negative x",
+    "ceil": "float_to_int(x) + 1 when x has a fraction, for a non-negative x",
+    "starts_with": "matches(s, \"^prefix\")",
+    "ends_with": "matches(s, \"suffix$\")",
+    "pad_start": "string interpolation: `\"{pad}{s}\"`",
+    "pad_end": "string interpolation: `\"{s}{pad}\"`",
+    "repeat": _FOLD_FIX + " building the string",
+    "uuid4": "let the database assign the id (`id uuid pk`)",
+    "random": "no random source is built yet",
 }
-
-# `use std.X { name, ... }` names `vlbuild` actually lowers to a working call
-# -- NOT the same list as `BUILTINS` above (that one is a generous, deliberately
-# loose allowlist for the W-UNDEF-NAME heuristic, and includes several names,
-# e.g. `merge`/`fold`/`first`/`to_int`, the spec shows but this build's emitter
-# has no lowering for). Duplicated from `vlbuild/emit.py`'s `STD_FNS` (plus
-# `now`, whose one working lowering — a `model` field default — lives in
-# `server_emit.py`'s `_sql_default`) rather than imported: `vlcheck` has no
-# dependency on `vlbuild` (the dependency runs the other way), so the two
-# packages cannot share this table directly. Keep in sync by hand; a mismatch
-# only makes this check too strict or too loose, never silently wrong, since
-# `vlbuild` is the actual authority on what it lowers.
+assert not (STD_BUILT_FNS & set(_FN_NOT_BUILT))
+BUILTINS.update(STD_BUILT_FNS, _FN_NOT_BUILT)
+# The names `use std.X { ... }` may import: every built function, plus `now`,
+# whose one working lowering -- a `model` field default -- is server_emit.py's
+# `_sql_default`.
 #
 # Found reproducing the login-page benchmark's Bug 3 (`test-only`
-# `login-page/volaro/NOTES.md`): `use std.http { post }` passes `vlcheck`
-# clean and compiles to a bare, undefined `post(...)` call in the emitted JS
-# (`emit.py`'s `_ex_Call` has no special case for an unrecognized `A.Name`
-# callee, so it falls through to emitting the call verbatim) -- a silent
-# ReferenceError at runtime, not a build-time diagnostic. `std.http` has no
-# member in either list below; nothing under it can pass this check.
-_STD_SUPPORTED_NAMES = {
-    "filter", "map", "take", "count", "sum", "sort_by", "group_by", "chunk",
-    "join", "split", "first_char", "int_to_float", "float_to_int",
-    "trim", "upper", "lower", "keys", "values", "get_or", "concat", "append",
-    "now",
-    # std.str's `regex` (spec section 13): `matches(s, pattern)`, added
-    # alongside its `vlbuild/emit.py` `STD_FNS` entry and `VL.std.matches`
-    # (assets/vlrt.js) -- keep all three in sync by hand.
-    "matches",
-    # std.str's `replace` (spec section 13's own std.str row already names
-    # it, alongside split/join/trim/case/regex, as part of the documented
-    # surface -- this build just had not implemented it yet). Added for
-    # feature 17 (export): CSV field escaping (RFC 4180 -- double an
-    # embedded '"') needs a literal substring replace-all; reproduced
-    # missing first (`use std.str { replace }` failed vlcheck with
-    # E-UNKNOWN-STD-IMPORT before this entry existed). Replace-ALL,
-    # literal-substring semantics (not regex, not first-occurrence-only) --
-    # keep this entry, `vlbuild/emit.py`'s `STD_FNS`, `assets/vlrt.js`'s
-    # `VL.std.replace`, and `server_emit.py`'s server-side `VL.std.replace`
-    # shim in sync by hand, same as `matches`/`split` above.
-    "replace",
-    # std.str's `contains(s, part) bool` (case-sensitive substring test).
-    # Also a `where()` predicate name (BUILTINS above); vlbuild lowers a
-    # `where(col: contains(x))` value as the predicate and every other call
-    # as `VL.std.contains`. Keep in sync with `vlbuild/emit.py`'s `STD_FNS`.
-    "contains",
+# `login-page/volaro/NOTES.md`): `use std.http { post }` passed `vlcheck`
+# clean and compiled to a bare, undefined `post(...)` call. `std.http` has no
+# member here; nothing under it can pass this check.
+_STD_SUPPORTED_NAMES = STD_BUILT_FNS | {"now"}
+
+# Bare words the spec uses in argument position (`.order(created_at: desc)`,
+# `auth.start_oauth(google)`). They resolve as names; resolve.py reads this
+# set.
+CONTEXTUAL_WORDS = frozenset({"asc", "desc", "google", "github"})
+
+# Every other name the checker knows is not a function the build lowers, so
+# a bare call to one compiles to an undefined (or non-function) JavaScript
+# callee and throws when the page or route runs. Each is classified here by
+# the one place it may be called, if any; `_check_builtin_call` rejects the
+# call everywhere else in emitted code. `test_bare_call_parity` (vlbuild
+# tests/test_build.py, gate 2) calls every known name in every emitted
+# context and requires the checker to reject it or the build to lower it,
+# and `_unclassified_names()` must stay empty, so a name added to BUILTINS
+# cannot slip through unjudged. (Testing Lab, Example Demo 2.3: `unique`
+# was the std case; these are the rest of the class.)
+#
+# `where()` predicates (spec section 13.1): a predicate is only a
+# `.where(field: pred(x))` value (or a branch of an `if` that is one). The
+# fix is the operator that tests the same thing on a value. `contains` is
+# also a std.str function, so it is built everywhere.
+_WHERE_PREDICATE_FIX = {
+    "lt": "`a < b`", "lte": "`a <= b`", "gt": "`a > b`", "gte": "`a >= b`",
+    "ne": "`a != b`", "between": "`lo <= x and x <= hi`",
+    "any_of": "`any(xs, fn(v) v == x)`",
+}
+# Error codes (spec section 6): a code is constructed only as the argument of
+# `err(...)` in a service or page-server route body, where the build turns
+# it into the route's error response. `catch not_found` and a match arm name
+# a code without calling it.
+_ERROR_CODES = frozenset({
+    "not_found", "forbidden", "conflict", "rejected", "unexpected",
+    "out_of_range", "decode", "invalid_credentials", "unverified_email",
+    "totp_required", "rate_limited",
+})
+# The codes the compiler-owned auth endpoints fail with (`catch
+# weak_password`); vlbuild's emitter reads this set.
+AUTH_ERROR_CODES = frozenset({
+    "email_taken", "weak_password", "breached_password", "rate_limited",
+    "invalid_credentials", "unverified_email", "totp_required",
+    "provider_error", "invalid_token", "expired_token", "invalid_code",
+    "no_totp_enrolled",
+})
+# A route body's `catch <head>` tests the thrown error's code when <head> is
+# one of these (or a declared union variant); any other head binds the
+# caught error itself (`catch e`). resolve.py and vlbuild's `_route_try`
+# both read this set, so `err(e)` means the same thing to check and build.
+ROUTE_CATCH_CODES = (_ERROR_CODES | AUTH_ERROR_CODES
+                     | frozenset({"bad_request", "unauthorized"}))
+_ERR_ROUTE_FIX = ("`return err(not_found(\"...\"))` in a `service` or "
+                  "page.server route body; a view reports a failure by "
+                  "setting its own state")
+# Names that are never called: namespaces and ambient objects (call a member
+# instead), type names (no conversion function by that name), contextual
+# words, and names the spec's examples use that no build provides.
+_NO_BUILD_NAMESPACE = "no `%s` namespace is built yet"
+_NOT_CALLABLE = {
+    # namespaces / ambient objects
+    "env": "read a member: `env.NAME`",
+    "session": "read a member: `session.user`",
+    "request": "read a member: `request.headers`",
+    "route": "`route.to(\"/path\")`",
+    "auth": "a section 11.3 call: `auth.sign_in(email: e, password: p)`",
+    "db": "a query: `db.posts.where(...).all()?`",
+    "log": "`log.info(\"message\", value)`",
+    "api": "an `api` block endpoint: `client.endpoint(...)`",
+    "analytics": _NO_BUILD_NAMESPACE % "analytics",
+    "events": _NO_BUILD_NAMESPACE % "events",
+    "ws": _NO_BUILD_NAMESPACE % "ws",
+    "mailer": _NO_BUILD_NAMESPACE % "mailer",
+    "billing": _NO_BUILD_NAMESPACE % "billing",
+    # result constructor: a `T!` success is the plain value (spec section 6)
+    "ok": "return the value itself; a successful `T!` is the plain value",
+    # names from the spec's examples, not built-in functions
+    "create_guest": "no `create_guest` is built in; build the value inline",
+    "guest_user": "no `guest_user` is built in; build the value inline",
+    # contextual words
+    "asc": "an `.order(field: asc)` value, not a call",
+    "desc": "an `.order(field: desc)` value, not a call",
+    "google": "an `auth.start_oauth(google)` argument, not a call",
+    "github": "an `auth.start_oauth(github)` argument, not a call",
+    # type names
+    "str": "string interpolation: `\"{x}\"`",
+    "int": "float_to_int(x)",
+    "float": "int_to_float(x)",
+    "bool": "a comparison: `x != 0`, `s != \"\"`",
+    "bytes": "no conversion to `bytes` is built",
+    "time": "a `time` field value; no conversion to `time` is built",
+    "dur": "no conversion to `dur` is built",
+    "uuid": "let the database assign the id (`id uuid pk`)",
+    "json": "no conversion to `json` is built",
+    "nil": "the value `nil`, not a call",
 }
 
 
+def _unclassified_names() -> set[str]:
+    """Known names with no bare-call rule: must stay empty (asserted below
+    and by test_bare_call_parity)."""
+    classified = (set(STD_BUILT_FNS) | set(_FN_NOT_BUILT) | set(_METHOD_ONLY)
+                  | set(_WHERE_PREDICATE_FIX) | _ERROR_CODES | {"err"}
+                  | set(_NOT_CALLABLE) | set(ELEMENT_NAMES))
+    return (set(BUILTINS) | set(_PRIM_NAMES) | CONTEXTUAL_WORDS) - classified
+
+
+assert not _unclassified_names(), _unclassified_names()
+
+
 def _lit_text(v):
     """The literal text of a plain string literal, or None when `v` is not one
     (a bare word, an expression, or an *interpolated* string -- whose runtime
@@ -324,6 +461,17 @@ class Checker:
         # (module-level fn bodies)
         self._module_names: set[str] = set()
         self._emitted = True
+        # which emitted code is being walked: "view" (a view's state,
+        # derives, render tree and handlers) or "route" (a service route,
+        # a page.server handler, a _server.vl provider). `err(...)` builds
+        # only in a route.
+        self._ctx = "route"
+        # payload-carrying union variants this module declares, and the
+        # calls whose position makes them legal (a `where()` predicate
+        # value, the error constructor inside `err(...)`)
+        self._variants: set[str] = set()
+        self._views: set[str] = set()
+        self._exempt_calls: set[int] = set()
         # names of `fn`-typed record fields in this module: `x.on_pick(id)`
         # calls one, which E-METHOD-UNKNOWN must not report
         self._fn_fields: set[str] = set()
@@ -2973,10 +3121,15 @@ class Checker:
             if nm:
                 top.add(nm)
                 self._module_names.add(nm)
+                if isinstance(it, A.ViewDecl):
+                    self._views.add(nm)
             if isinstance(it, A.Use):
                 for n in it.names:
                     top.add(n)
-                    self._module_names.add(n)
+                    # `use std.time { now }` names the std function, not an
+                    # author's own: its call is still judged below
+                    if not it.path.startswith("std."):
+                        self._module_names.add(n)
                 base = it.path.replace("./", "").replace("../", "")
                 base = base.split("/")[-1].split(".")[-1]
                 if base:
@@ -2987,6 +3140,7 @@ class Checker:
             elif isinstance(it, A.TypeDecl) and it.kind == "union":
                 for v in it.variants:
                     top.add(v.name)
+                    self._variants.add(v.name)
             elif isinstance(it, (A.TypeDecl, A.ModelDecl)):
                 pass
 
@@ -3006,7 +3160,9 @@ class Checker:
                         scope.bind(s.name, "derive")
                     elif isinstance(s, A.LoadDecl):
                         scope.bind(s.name, "load result")
+                self._ctx = "view"
                 self._scoped(it.body, [top, scope], fallible=True)
+                self._ctx = "route"
             elif isinstance(it, A.ServiceDecl):
                 for r in it.routes:
                     scope = _Scope((p.name for p in r.params), "route parameter")
@@ -3121,23 +3277,100 @@ class Checker:
     def _check_builtin_call(self, call, scopes: list[set]) -> None:
         """A bare call to an allowlisted name the build cannot lower compiles
         to an undefined JS function (action-48). Skipped when the name is the
-        author's own: a local binding or a module declaration or import."""
+        author's own: a local binding or a module declaration or a
+        non-`std` import."""
         callee = call.callee
-        if not isinstance(callee, A.Name):
+        if not isinstance(callee, A.Name) or id(call) in self._exempt_calls:
             return
         nm = callee.id
-        if nm in self._module_names or any(nm in s for s in scopes[1:]):
+        if nm in STD_BUILT_FNS:
+            return
+        # `session` / `request` are bound in a view's or handler's scope, but
+        # they are the ambient objects, never the author's own function
+        ambient = nm in _AMBIENT_RECEIVERS
+        throws = "compiles to a call the built page or route cannot make, and throws when it runs"
+        if (nm in self._views and self._emitted
+                and not any(nm in s for s in scopes[1:])):
+            # a view is rendered by a line of its own (an element); as a
+            # value, `Row(1)` calls the emitted render function with no
+            # context and throws
+            self._d("E-NOT-A-FUNCTION", Severity.ERROR,
+                    "'%s' is a view, not a function -- as a value `%s(...)` %s"
+                    % (nm, nm, throws), call,
+                    "render it as its own line in the view body: `%s(...)`" % nm)
+            return
+        if not ambient and (nm in self._module_names
+                            or any(nm in s for s in scopes[1:])):
             return
         if nm in _METHOD_ONLY:
             self._d("E-METHOD-AS-FN", Severity.ERROR,
                     "'%s' is a method, not a function -- `%s(...)` compiles to "
                     "an undefined function and throws when the page runs"
                     % (nm, nm), call, "call it on the value: `%s`" % _METHOD_ONLY[nm])
-        elif nm in _FN_NOT_BUILT and self._emitted:
+        elif not self._emitted:
+            # a module-level `fn` body: the build refuses module functions
+            # (E-VIEW-MODULE-FN), so nothing here is emitted
+            return
+        elif nm in _FN_NOT_BUILT:
             self._d("E-FN-NOT-BUILT", Severity.ERROR,
-                    "'%s' is in the spec but this build has no working `%s` -- "
-                    "the call compiles and throws when it runs" % (nm, nm),
+                    "'%s' is a std name this build of Volaro has no function "
+                    "for -- the call compiles to an undefined function and "
+                    "throws when it runs" % nm,
                     call, "use %s" % _FN_NOT_BUILT[nm])
+        elif nm == "err":
+            if self._ctx == "view":
+                self._d("E-ERR-CONTEXT", Severity.ERROR,
+                        "`err(...)` fails a route; a view has no route to fail "
+                        "-- in a view it %s" % throws, call,
+                        "use " + _ERR_ROUTE_FIX)
+        elif nm in _ERROR_CODES or nm in self._variants:
+            what = ("the error code '%s'" % nm if nm in _ERROR_CODES
+                    and nm not in self._variants
+                    else "the union variant '%s'" % nm)
+            self._d("E-ERR-CONTEXT", Severity.ERROR,
+                    "%s is built only as the argument of `err(...)` in a route "
+                    "body -- here `%s(...)` %s" % (what, nm, throws), call,
+                    "use " + _ERR_ROUTE_FIX + ("" if nm in _ERROR_CODES else
+                    "; for data, a record type with the same fields"))
+        elif nm in _WHERE_PREDICATE_FIX:
+            self._d("E-WHERE-PREDICATE", Severity.ERROR,
+                    "'%s' is a `where()` predicate (spec section 13.1), built "
+                    "only as a `.where(field: %s(...))` value -- here it %s"
+                    % (nm, nm, throws), call,
+                    "compare the values with %s, or move it into "
+                    "`.where(field: %s(x))`" % (_WHERE_PREDICATE_FIX[nm], nm))
+        elif nm in _NOT_CALLABLE:
+            self._d("E-NOT-A-FUNCTION", Severity.ERROR,
+                    "'%s' is not a function -- `%s(...)` %s" % (nm, nm, throws),
+                    call, "use %s" % _NOT_CALLABLE[nm])
+        elif nm in ELEMENT_NAMES:
+            self._d("E-NOT-A-FUNCTION", Severity.ERROR,
+                    "'%s' is an element, not a function -- as a value "
+                    "`%s(...)` %s" % (nm, nm, throws), call,
+                    "write the element as its own line in the view body: `%s ...`"
+                    % nm)
+
+    def _mark_positional_calls(self, call) -> None:
+        """Exempt the calls whose position gives them meaning: a predicate as
+        a `.where(field: ...)` value (either branch of an `if` value too), and
+        the error constructor that is the argument of `err(...)`."""
+        callee = call.callee
+        if isinstance(callee, A.Member) and callee.name == "where":
+            stack = [v for _, v in call.named]
+            while stack:
+                v = stack.pop()
+                if isinstance(v, A.IfExpr):
+                    stack += [v.then, v.orelse]
+                elif (isinstance(v, A.Call) and isinstance(v.callee, A.Name)
+                      and v.callee.id in _WHERE_PREDICATE_FIX):
+                    self._exempt_calls.add(id(v))
+        elif isinstance(callee, A.Name) and callee.id == "err":
+            # in a view the `err(...)` itself is the one error reported
+            for a in call.args:
+                if (isinstance(a, A.Call) and isinstance(a.callee, A.Name)
+                        and (a.callee.id in _ERROR_CODES
+                             or a.callee.id in self._variants)):
+                    self._exempt_calls.add(id(a))
 
     @staticmethod
     def _value_receiver(obj, scopes: list[set]) -> bool:
@@ -3331,6 +3564,7 @@ class Checker:
             self._expr(ex.obj, scopes, fallible)
             self._expr(ex.index, scopes, fallible)
         elif isinstance(ex, A.Call):
+            self._mark_positional_calls(ex)
             self._check_builtin_call(ex, scopes)
             self._check_value_method(ex, scopes)
             callee = ex.callee