zitejs 0.10.0-start.0 → 0.10.0-start.10

package/dist/cjs/check/start/describeRules.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describedProblems = describedProblems;
+// The host, TanStack and Cloudflare answer these before the app does.
+const RESERVED_PATHS = [
+    /^\/_zite/,
+    /^\/__zite/,
+    /^\/_serverFn(\/|$)/,
+    /^\/cdn-cgi(\/|$)/,
+    /^\/auth(\/|$)/,
+    /^\/api\/auth(\/|$)/,
+    /^\/manifest\.webmanifest$/,
+];
+const OWNER_INPUTS = ["userId", "ownerId"];
+/** `access-missing: no signedIn…`, or a route's `GET: access-missing: …`, as a named problem. */
+const describeProblem = (problem, subject, file) => {
+    const match = /^(?:(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|ANY): )?([a-z][a-z-]*): (.*)$/s.exec(problem);
+    const [, method, rule, message] = match ?? [undefined, undefined, "describe", problem];
+    return {
+        rule: rule ?? "describe",
+        severity: "error",
+        ...(file && { file }),
+        message: `${subject}${method ? ` ${method}` : ""}: ${message ?? problem}`,
+    };
+};
+const inputProperties = (input) => {
+    const properties = input?.properties;
+    return properties && typeof properties === "object" ? Object.keys(properties) : [];
+};
+function describedProblems(description, { internal }) {
+    const problems = [];
+    for (const fn of description.functions) {
+        const subject = `function ${fn.name ?? fn.id}`;
+        problems.push(...fn.problems.map((p) => describeProblem(p, subject, fn.file)));
+        if (internal && fn.access.kind === "anyone") {
+            problems.push({
+                rule: "public-in-internal",
+                severity: "error",
+                ...(fn.file && { file: fn.file }),
+                message: `${subject} is a publicFn, and this internal app signs everyone in; make it a signedInFn`,
+            });
+        }
+        const owner = fn.access.kind === "signedIn" && inputProperties(fn.input).find((p) => OWNER_INPUTS.includes(p));
+        if (owner) {
+            problems.push({
+                rule: "owner-from-input",
+                severity: "warning",
+                ...(fn.file && { file: fn.file }),
+                message: `${subject} takes ${owner} as input, which any caller can set; use context.user.id`,
+            });
+        }
+    }
+    for (const route of description.routes) {
+        const subject = `route ${route.path}`;
+        problems.push(...route.problems.map((p) => describeProblem(p, subject, route.file)));
+        const publicMethods = Object.entries(route.methods).filter(([, access]) => access.kind === "anyone");
+        if (internal && publicMethods.length > 0) {
+            problems.push({
+                rule: "public-in-internal",
+                severity: "error",
+                ...(route.file && { file: route.file }),
+                message: `${subject} lets anyone call ${publicMethods.map(([m]) => m).join(", ")}, and this internal app signs everyone in; use signedIn`,
+            });
+        }
+        if (!route.description) {
+            problems.push({
+                rule: "description-missing",
+                severity: "warning",
+                ...(route.file && { file: route.file }),
+                message: `${subject} has no description; add staticData: { description } for the editor`,
+            });
+        }
+    }
+    for (const workflow of description.workflows ?? []) {
+        problems.push(...workflow.problems.map((p) => describeProblem(p, `workflow ${workflow.id}`, workflow.file)));
+    }
+    const paths = new Map([...description.routes, ...(description.pages ?? [])].map((r) => [r.path, r.file]));
+    for (const [path, file] of paths) {
+        if (RESERVED_PATHS.some((reserved) => reserved.test(path))) {
+            problems.push({
+                rule: "reserved-path",
+                severity: "error",
+                ...(file && { file }),
+                message: `${path} is the platform's; give the route another path`,
+            });
+        }
+    }
+    return problems;
+}

package/dist/cjs/check/start/problem.d.ts

@@ -0,0 +1,11 @@
+export type Severity = "error" | "warning";
+/** One finding of `zitejs check`, named by its rule. Errors fail the check; warnings only report. */
+export type Problem = {
+    rule: string;
+    severity: Severity;
+    /** App-relative. */
+    file?: string;
+    line?: number;
+    message: string;
+};
+export declare const formatProblem: ({ rule, severity, file, line, message }: Problem) => string;

package/dist/cjs/check/start/problem.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatProblem = void 0;
+const formatProblem = ({ rule, severity, file, line, message }) => `${severity} ${rule}${file ? ` ${file}${line ? `:${line}` : ""}` : ""}: ${message}`;
+exports.formatProblem = formatProblem;

package/dist/cjs/check/start/sourceRules.d.ts

@@ -0,0 +1,3 @@
+import type { Problem } from "./problem.js";
+/** Every source hint for one Start app, given its files by app-relative path. */
+export declare function sourceProblems(sources: Record<string, string>): Problem[];

package/dist/cjs/check/start/sourceRules.js

@@ -0,0 +1,441 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sourceProblems = sourceProblems;
+// Source hints for a Start app: line-level findings read from the code, never
+// access decisions, which come from describe. A file that doesn't parse is
+// skipped; tsc reports it.
+const parser_1 = require("@babel/parser");
+const isNode = (value) => typeof value === "object" && value !== null && typeof value.type === "string";
+const SKIP_KEYS = new Set(["loc", "start", "end", "extra", "leadingComments", "trailingComments", "innerComments", "range"]);
+const walk = (node, visit, ancestors = []) => {
+    visit(node, ancestors);
+    ancestors.push(node);
+    for (const key of Object.keys(node)) {
+        if (SKIP_KEYS.has(key))
+            continue;
+        const value = node[key];
+        if (Array.isArray(value)) {
+            for (const child of value)
+                if (isNode(child))
+                    walk(child, visit, ancestors);
+        }
+        else if (isNode(value)) {
+            walk(value, visit, ancestors);
+        }
+    }
+    ancestors.pop();
+};
+const FUNCTION_TYPES = new Set([
+    "FunctionDeclaration",
+    "FunctionExpression",
+    "ArrowFunctionExpression",
+    "ObjectMethod",
+    "ClassMethod",
+    "ClassPrivateMethod",
+]);
+const LOOP_TYPES = new Set(["ForStatement", "ForInStatement", "ForOfStatement", "WhileStatement", "DoWhileStatement"]);
+const atModuleScope = (ancestors) => !ancestors.some((a) => FUNCTION_TYPES.has(a.type));
+const lineOf = (node) => node.loc?.start.line;
+const nameOf = (node) => {
+    if (!isNode(node))
+        return undefined;
+    if (node.type === "Identifier")
+        return node.name;
+    if (node.type === "StringLiteral")
+        return node.value;
+    return undefined;
+};
+const propertyNamed = (object, name) => object.properties.find((p) => (p.type === "ObjectProperty" || p.type === "ObjectMethod") && !p.computed && nameOf(p.key) === name);
+const unwrap = (node) => node.type === "TSNonNullExpression" || node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression"
+    ? unwrap(node.expression)
+    : node;
+/** `a.b(…).c(…)`: the calls from the outside in, the member names, and the root identifier. */
+const chainOf = (start) => {
+    const calls = [];
+    const members = [];
+    let current = start;
+    while (current) {
+        current = unwrap(current);
+        if (current.type === "CallExpression") {
+            calls.push(current);
+            current = current.callee;
+        }
+        else if (current.type === "MemberExpression" && !current.computed) {
+            const member = nameOf(current.property);
+            if (member === undefined)
+                return { calls, members };
+            members.push(member);
+            current = current.object;
+        }
+        else if (current.type === "Identifier") {
+            return { root: current.name, calls, members };
+        }
+        else {
+            return { calls, members };
+        }
+    }
+    return { calls, members };
+};
+const isHandlerCall = (node) => node.type === "CallExpression" && isNode(node.callee) && node.callee.type === "MemberExpression" && nameOf(node.callee.property) === "handler";
+const BUILDER_MEMBERS = new Set(["handler", "validator", "inputValidator", "middleware"]);
+/** The call that hands the factory its options: `signedInFn({ … })`, not `.validator(…)`. */
+const optionsCall = (calls) => calls.find((call) => {
+    const callee = call.callee;
+    return !(callee.type === "MemberExpression" && BUILDER_MEMBERS.has(nameOf(callee.property) ?? ""));
+});
+const hasMethodOption = (calls) => {
+    const call = optionsCall(calls);
+    const options = call && call.arguments[0];
+    return !!options && options.type === "ObjectExpression" && !!propertyNamed(options, "method");
+};
+const isTopLevelDeclarator = (ancestors) => {
+    const [declarator, declaration, outer, program] = ancestors.slice(-4).reverse();
+    if (declarator?.type !== "VariableDeclarator" || declaration?.type !== "VariableDeclaration")
+        return false;
+    return outer?.type === "Program" || (outer?.type === "ExportNamedDeclaration" && program?.type === "Program");
+};
+const parseFile = (path, code) => {
+    try {
+        const ast = (0, parser_1.parse)(code, {
+            sourceType: "module",
+            plugins: path.endsWith("x") ? ["typescript", "jsx"] : ["typescript"],
+            errorRecovery: true,
+        });
+        const imports = new Map();
+        for (const statement of ast.program.body) {
+            if (statement.type !== "ImportDeclaration")
+                continue;
+            const source = statement.source.value;
+            for (const specifier of statement.specifiers) {
+                const local = nameOf(specifier.local);
+                if (!local)
+                    continue;
+                const imported = specifier.type === "ImportSpecifier" ? (nameOf(specifier.imported) ?? local) : "default";
+                imports.set(local, { source, imported });
+            }
+        }
+        return { path, program: ast.program, imports };
+    }
+    catch {
+        return undefined;
+    }
+};
+const FACTORIES = ["signedInFn", "publicFn", "createServerFn"];
+/**
+ * The names a server function can start from, app-wide: zitejs's factories,
+ * TanStack's raw one, and the app's own factories built from them
+ * (`export const managerFn = signedInFn.middleware([role("manager")])`).
+ */
+const factoryNames = (files) => {
+    const names = new Set(FACTORIES);
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const file of files) {
+            const isFactory = (local) => names.has(file.imports.get(local)?.imported ?? local);
+            for (const statement of file.program.body) {
+                if (statement.type === "ExportNamedDeclaration" && statement.source) {
+                    for (const specifier of statement.specifiers) {
+                        const exported = nameOf(specifier.exported);
+                        if (exported && names.has(nameOf(specifier.local) ?? "") && !names.has(exported)) {
+                            names.add(exported);
+                            changed = true;
+                        }
+                    }
+                }
+                const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
+                if (declaration?.type !== "VariableDeclaration")
+                    continue;
+                for (const declarator of declaration.declarations) {
+                    const name = nameOf(declarator.id);
+                    const init = declarator.init;
+                    if (!name || !init || names.has(name) || isHandlerCall(unwrap(init)))
+                        continue;
+                    const { root } = chainOf(init);
+                    if (root && isFactory(root)) {
+                        names.add(name);
+                        changed = true;
+                    }
+                }
+            }
+        }
+    }
+    return names;
+};
+const callsCreateWorkflow = (program) => {
+    let found = false;
+    walk(program, (node) => {
+        if (node.type === "CallExpression" && nameOf(node.callee) === "createWorkflow")
+            found = true;
+    });
+    return found;
+};
+const isServerReachable = (path, callsWorkflow) => /\.(functions|server)\.tsx?$/.test(path) || path.startsWith("src/routes/api/") || path === "src/start.ts" || callsWorkflow;
+/** The names an import brings in as values; types are erased, so they never reach the runtime. */
+const valueImports = (statement) => {
+    if (statement.importKind === "type")
+        return [];
+    const specifiers = statement.specifiers.filter((s) => s.importKind !== "type");
+    if (statement.specifiers.length === 0)
+        return "all";
+    if (specifiers.some((s) => s.type !== "ImportSpecifier"))
+        return "all";
+    return specifiers.map((s) => nameOf(s.imported) ?? "");
+};
+const MUTATING_METHODS = new Set(["set", "add", "push", "unshift", "splice", "delete", "clear"]);
+const isContainer = (init) => !!init &&
+    ((init.type === "NewExpression" && ["Map", "Set"].includes(nameOf(init.callee) ?? "")) ||
+        init.type === "ArrayExpression" ||
+        init.type === "ObjectExpression");
+const callsAny = (node, matches) => {
+    let found = false;
+    walk(node, (n) => {
+        if (n.type === "CallExpression" && isNode(n.callee) && matches(n.callee))
+            found = true;
+    });
+    return found;
+};
+const ROOT_LAYOUTS = new Set(["src/routes/__root.tsx", "src/routes/_app.tsx", "src/routes/_app/route.tsx"]);
+// The Start runtime reads a ZiteError thrown from any copy of zitejs, classic's included.
+const CLASSIC_ALLOWED = { "zitejs/backend": new Set(["ZiteError"]) };
+const CLASSIC_IMPORTS = {
+    "zitejs/backend": "server code is a signedInFn/publicFn server function from zitejs/start",
+    "zitejs/api": "pages call server functions directly, from a loader or an event handler",
+    "react-router-dom": "routing is file routes, with Link and useNavigate from @tanstack/react-router",
+    "react-router": "routing is file routes, with Link and useNavigate from @tanstack/react-router",
+};
+const importsModule = (source, module) => source === module || source.startsWith(`${module}/`);
+const containsTypeofWindow = (node) => {
+    let found = false;
+    walk(node, (n) => {
+        if (n.type === "UnaryExpression" && n.operator === "typeof" && nameOf(n.argument) === "window")
+            found = true;
+    });
+    return found;
+};
+const GUARD_TYPES = new Set(["IfStatement", "ConditionalExpression", "LogicalExpression"]);
+const guardedByTypeofWindow = (ancestors) => ancestors.some((a) => GUARD_TYPES.has(a.type) && containsTypeofWindow((a.test ?? a.left)));
+const isRelativePath = (node) => (node?.type === "StringLiteral" && node.value.startsWith("/")) ||
+    (node?.type === "TemplateLiteral" && (node.quasis[0]?.value?.cooked ?? "").startsWith("/"));
+/** Every source hint for one Start app, given its files by app-relative path. */
+function sourceProblems(sources) {
+    const files = Object.entries(sources)
+        .filter(([path]) => /\.[cm]?[jt]sx?$/.test(path) && !path.endsWith("routeTree.gen.ts") && !path.endsWith(".d.ts"))
+        .flatMap(([path, code]) => parseFile(path, code) ?? []);
+    const factories = factoryNames(files);
+    const problems = [];
+    const report = (rule, severity, file, node, message) => problems.push({ rule, severity, file, ...(node && lineOf(node) && { line: lineOf(node) }), message });
+    const serverFnFiles = new Map();
+    if (!sources["src/router.tsx"]?.includes("createZiteRouter(")) {
+        problems.push({
+            rule: "router-file",
+            severity: "error",
+            file: "src/router.tsx",
+            message: "export getRouter from src/router.tsx, built with createZiteRouter from zitejs/start, which gives pages the signed-in user",
+        });
+    }
+    for (const file of files) {
+        const { path, program } = file;
+        const factoryRoot = (root) => !!root && factories.has(file.imports.get(root)?.imported ?? root);
+        const callsWorkflow = callsCreateWorkflow(program);
+        const serverReachable = isServerReachable(path, callsWorkflow);
+        const localServerFns = new Set();
+        const moduleContainers = new Map();
+        for (const statement of program.body) {
+            const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
+            if (declaration?.type !== "VariableDeclaration")
+                continue;
+            for (const declarator of declaration.declarations) {
+                const name = nameOf(declarator.id);
+                const init = declarator.init ? unwrap(declarator.init) : undefined;
+                if (!name || !init)
+                    continue;
+                if (isHandlerCall(init) && factoryRoot(chainOf(init).root))
+                    localServerFns.add(name);
+                if (serverReachable && declaration.kind === "const" && isContainer(init))
+                    moduleContainers.set(name, false);
+            }
+        }
+        for (const directive of program.directives ?? []) {
+            if (directive.value.value === "use server") {
+                report("use-server", "error", path, directive, "'use server' is Next.js; server code is a signedInFn/publicFn server function");
+            }
+        }
+        for (const statement of program.body) {
+            if (statement.type === "ImportDeclaration") {
+                const source = statement.source.value;
+                const values = valueImports(statement);
+                for (const [module, instead] of Object.entries(CLASSIC_IMPORTS)) {
+                    const allowed = source === module ? CLASSIC_ALLOWED[module] : undefined;
+                    const refused = values === "all" ? true : values.some((name) => !allowed?.has(name));
+                    if (importsModule(source, module) && refused) {
+                        report("classic-construct", "error", path, statement, `${module} is classic's; in a Start app, ${instead}`);
+                    }
+                }
+                if (source === "cloudflare:workers") {
+                    report("cloudflare-env", "error", path, statement, "read the app's environment from process.env, not cloudflare:workers");
+                }
+                const typeOnly = values !== "all" && values.length === 0;
+                if (callsWorkflow && !typeOnly && (/\.functions(\.[jt]sx?)?$/.test(source) || importsModule(source, "@tanstack/react-start/server"))) {
+                    report("workflow-imports", "error", path, statement, `a workflow runs without a page request, so it can't use ${source}; move what it needs into a *.server.ts helper`);
+                }
+            }
+            const exported = statement.type === "ExportNamedDeclaration" ? statement.declaration : undefined;
+            const exportedNames = exported?.type === "FunctionDeclaration"
+                ? [nameOf(exported.id)]
+                : exported?.type === "VariableDeclaration"
+                    ? exported.declarations.map((d) => nameOf(d.id))
+                    : [];
+            if (exportedNames.includes("getServerSideProps")) {
+                report("next-construct", "error", path, statement, "getServerSideProps is Next.js; a route's loader fetches its data");
+            }
+            if (serverReachable && statement.type === "VariableDeclaration" && statement.kind === "let") {
+                report("module-state", "warning", path, statement, "a module-level let in server code is shared by every request and every user; keep per-request state inside the handler");
+            }
+        }
+        walk(program, (node, ancestors) => {
+            const parent = ancestors.at(-1);
+            if (node.type === "CallExpression" && isHandlerCall(node)) {
+                const { root, calls } = chainOf(node);
+                if (factoryRoot(root)) {
+                    const declarator = parent?.type === "VariableDeclarator" ? parent : undefined;
+                    const name = nameOf(declarator?.id);
+                    if (!declarator || !isTopLevelDeclarator(ancestors)) {
+                        report("server-fn-not-top-level", "error", path, node, "assign each server function to its own top-level const: one in an object, a function or a helper's return value isn't compiled");
+                    }
+                    else if (name) {
+                        serverFnFiles.set(name, [...(serverFnFiles.get(name) ?? []), path]);
+                    }
+                    if (!hasMethodOption(calls)) {
+                        report("method-missing", "error", path, node, `call ${root} with { method: 'GET' | 'POST', description } before .handler()`);
+                    }
+                    if (file.imports.get(root)?.imported === "publicFn" || root === "publicFn") {
+                        const handler = node.arguments[0];
+                        if (handler && FUNCTION_TYPES.has(handler.type)) {
+                            walk(handler, (inner, innerAncestors) => {
+                                const returned = inner.type === "ReturnStatement"
+                                    ? inner.argument
+                                    : inner === handler && handler.type === "ArrowFunctionExpression" && handler.body.type !== "BlockStatement"
+                                        ? handler.body
+                                        : undefined;
+                                if (!returned || innerAncestors.slice(1).some((a) => FUNCTION_TYPES.has(a.type)))
+                                    return;
+                                const call = unwrap(returned.type === "AwaitExpression" ? returned.argument : returned);
+                                if (call.type !== "CallExpression")
+                                    return;
+                                const chain = chainOf(call);
+                                const method = chain.members[0];
+                                if (chain.root !== "zite" || (method !== "findAll" && method !== "findOne"))
+                                    return;
+                                const options = call.arguments[0];
+                                if (options?.type === "ObjectExpression" && propertyNamed(options, "fields"))
+                                    return;
+                                report("public-rows", "warning", path, inner, `anyone can call ${declarator ? nameOf(declarator.id) : "this function"}, and it returns whole records; pass fields to return only what the page shows`);
+                            });
+                        }
+                    }
+                }
+            }
+            if (moduleContainers.size > 0 && !atModuleScope(ancestors)) {
+                const target = node.type === "CallExpression" && isNode(node.callee) && node.callee.type === "MemberExpression" &&
+                    MUTATING_METHODS.has(nameOf(node.callee.property) ?? "")
+                    ? nameOf(node.callee.object)
+                    : node.type === "AssignmentExpression" && isNode(node.left) && node.left.type === "MemberExpression"
+                        ? nameOf(node.left.object)
+                        : undefined;
+                if (target && moduleContainers.get(target) === false) {
+                    moduleContainers.set(target, true);
+                    report("module-state", "warning", path, node, `${target} is module-level, so what a handler writes to it is shared by every request and every user; use the database or keep it inside the handler`);
+                }
+            }
+            if (node.type === "MemberExpression" && nameOf(node.property) === "inputValidator" && !node.computed) {
+                report("input-validator", "warning", path, node, "inputValidator is deprecated, renamed validator; call .validator(…)");
+            }
+            if (node.type === "CallExpression" && nameOf(node.callee) === "createEndpoint") {
+                report("classic-construct", "error", path, node, "createEndpoint is classic's; in a Start app, server code is a signedInFn/publicFn server function");
+            }
+            if (node.type === "CallExpression" && nameOf(node.callee) === "redirect") {
+                const options = node.arguments[0];
+                const href = options?.type === "ObjectExpression" ? propertyNamed(options, "href") : undefined;
+                const value = href && href.value;
+                const toLogin = !!value && (nameOf(value) === "loginHref" || callsAny(value, (callee) => nameOf(callee) === "loginHref"));
+                const reload = options && propertyNamed(options, "reloadDocument");
+                const reloads = !!reload && isNode(reload.value) && reload.value.type === "BooleanLiteral" && reload.value.value === true;
+                if (toLogin && !reloads) {
+                    report("login-reload", "error", path, node, "the sign-in page isn't one of the app's routes; redirect to it with reloadDocument: true");
+                }
+            }
+            if (node.type === "NewExpression" &&
+                nameOf(node.callee) === "QueryClient" &&
+                atModuleScope(ancestors)) {
+                report("module-query-client", "error", path, node, "a module-level QueryClient caches one visitor's data for the next; createZiteRouter makes one per request as context.queryClient");
+            }
+            if (atModuleScope(ancestors)) {
+                const envRead = node.type === "MemberExpression" &&
+                    isNode(node.object) &&
+                    node.object.type === "MemberExpression" &&
+                    nameOf(node.object.object) === "process" &&
+                    nameOf(node.object.property) === "env" &&
+                    nameOf(node.property) !== "NODE_ENV";
+                if (envRead) {
+                    report("module-env", "error", path, node, "process.env is the request's, so read it inside a handler or loader, not when the module loads");
+                }
+                if (node.type === "CallExpression" && isNode(node.callee) && node.callee.type === "MemberExpression" &&
+                    nameOf(node.callee.object) === "Date" && nameOf(node.callee.property) === "now") {
+                    report("module-env", "error", path, node, "Date.now() when the module loads is the server's start time; call it where the value is used");
+                }
+                const isWindowReference = node.type === "Identifier" &&
+                    node.name === "window" &&
+                    !(parent?.type === "UnaryExpression" && parent.operator === "typeof") &&
+                    !(parent?.type === "MemberExpression" && parent.property === node && !parent.computed) &&
+                    !(parent?.type === "ObjectProperty" && parent.key === node) &&
+                    !parent?.type.startsWith("TS") &&
+                    !guardedByTypeofWindow(ancestors);
+                if (isWindowReference) {
+                    // Guards come in too many shapes to tell for sure, so only a warning.
+                    report("module-env", "warning", path, node, "window doesn't exist while the server renders; use it in an effect or event handler");
+                }
+            }
+            if (node.type === "AwaitExpression" &&
+                isNode(node.argument) &&
+                chainOf(node.argument).root === "zite") {
+                const fn = [...ancestors].reverse().findIndex((a) => FUNCTION_TYPES.has(a.type));
+                const inner = fn === -1 ? ancestors : ancestors.slice(ancestors.length - fn);
+                if (inner.some((a) => LOOP_TYPES.has(a.type))) {
+                    report("await-in-loop", "warning", path, node, "each await zite.* in a loop is a round trip; batch it with one findAll, bulkCreate or bulkUpdate");
+                }
+            }
+            if ((node.type === "ObjectProperty" || node.type === "ObjectMethod") &&
+                (nameOf(node.key) === "loader" || nameOf(node.key) === "beforeLoad")) {
+                const body = (node.type === "ObjectMethod" ? node : node.value);
+                const isLayout = ROOT_LAYOUTS.has(path) && nameOf(node.key) === "beforeLoad";
+                const ssr = parent?.type === "ObjectExpression" ? propertyNamed(parent, "ssr")?.value : undefined;
+                const browserOnly = isNode(ssr) && ssr.type === "BooleanLiteral" && ssr.value === false;
+                walk(body, (inner) => {
+                    if (inner.type !== "CallExpression")
+                        return;
+                    const callee = nameOf(inner.callee);
+                    if (!browserOnly && callee === "fetch" && isRelativePath(inner.arguments[0])) {
+                        report("relative-fetch", "error", path, inner, "a loader also runs on the server, where a relative URL has no host; call a server function instead");
+                    }
+                    const source = callee ? file.imports.get(callee)?.source : undefined;
+                    const serverFn = !!callee && (localServerFns.has(callee) || (!!source && /\.functions(\.[jt]sx?)?$/.test(source)));
+                    if (isLayout && serverFn) {
+                        report("layout-server-fn", "warning", path, inner, `${callee} would run on every navigation from the root layout; the signed-in user is already context.user`);
+                    }
+                });
+            }
+        });
+    }
+    for (const [name, paths] of serverFnFiles) {
+        const distinct = [...new Set(paths)];
+        if (distinct.length > 1) {
+            problems.push({
+                rule: "duplicate-server-fn",
+                severity: "error",
+                file: distinct[1],
+                message: `${name} is also a server function in ${distinct[0]}; a server function's name is its id, so each is unique in the app`,
+            });
+        }
+    }
+    return problems;
+}

package/dist/cjs/cli.js

@@ -80,7 +80,7 @@ async function main() {
             console.error('  sync      Generate .zite/db.ts from database schema (single-app)');
             console.error('  dev       Run sync then watch for changes (like npx convex dev)');
             console.error('  generate  Regenerate every app and automation .zite/ (monorepo)');
-            console.error('  check   Run tsc --noEmit (and vite build where there is one) for every app and automation');
+            console.error('  check   Typecheck and build every app and automation; a Start app is also described and its source checked by rule (--json for a report)');
             console.error('  bundle  Bundle endpoints (src/api/*.ts, or an automation\'s src/index.ts) for cloudflare-lambda');
             console.error('  describe  Print what a built TanStack Start app declares: functions, routes, access');
             process.exit(1);

package/dist/cjs/integrations/rules.d.ts

@@ -38,11 +38,24 @@ declare const FIELDS_BY_TYPE: {
     jira: readonly string[];
     typeform: readonly string[];
     apollo: readonly string[];
+    clay: readonly string[];
     attio: readonly string[];
     granola: readonly string[];
+    clickup: readonly string[];
     dropbox: readonly string[];
+    zendesk: readonly string[];
+    smartsheet: readonly string[];
     amazonS3: readonly string[];
     snowflake: readonly string[];
+    databricks: readonly string[];
+    confluence: readonly string[];
+    pipedrive: readonly string[];
+    shopify: readonly string[];
+    sharepoint: readonly string[];
+    excel: readonly string[];
+    x: readonly string[];
+    zoomMeetings: readonly string[];
+    smartsuite: readonly string[];
 };
 /** A service type `integrations.get` serves: one used through its npm package with a token. */
 export type CredentialServiceType = keyof typeof FIELDS_BY_TYPE;

package/dist/cjs/integrations/rules.js

@@ -47,15 +47,43 @@ const FIELDS_BY_TYPE = {
     jira: extras("cloudId", "siteUrl"),
     typeform: extras(),
     apollo: extras(),
+    clay: extras(),
     attio: extras(),
     granola: extras(),
+    clickup: extras(),
     dropbox: extras(),
+    // Every path is https://{subdomain}.zendesk.com/api/v2/..., and a token is
+    // only valid on the account it was issued for, so the subdomain travels with
+    // it rather than being configured per app.
+    zendesk: extras("subdomain"),
+    // Smartsheet's US, EU, AU and Gov regions are separate, and a token is only
+    // valid on its own region's host, so the host travels with it.
+    smartsheet: extras("apiBaseUrl"),
     // The IAM key alone reaches nothing: every call needs the region and the
     // bucket, and S3-compatible providers need the endpoint too.
     amazonS3: extras("keyId", "region", "bucket", "endpoint", "pathPrefix"),
     // The SQL API lives on each account's own host, and the token is pinned to
     // one role; the warehouse is optional and falls back to the user's default.
     snowflake: extras("accountUrl", "role", "warehouse"),
+    // A statement is addressed by workspace host and SQL warehouse, and the token
+    // derives neither.
+    databricks: extras("host", "warehouseId"),
+    // Cloud Confluence is addressed through api.atlassian.com by cloud id, the
+    // same as Jira; the site URL is only for links a human will click.
+    confluence: extras("cloudId", "siteUrl"),
+    // OAuth returns a per-company api_domain alongside the token, so there is no
+    // one host to call.
+    pipedrive: extras("apiBaseUrl"),
+    // Shopify has no global API host: every call goes to the store's own domain
+    // under a pinned API version. The storefront pair is the shopper-facing API,
+    // which installs predating those scopes do not have.
+    shopify: extras("shopDomain", "apiBaseUrl", "storefrontApiUrl", "storefrontAccessToken"),
+    sharepoint: extras(),
+    excel: extras(),
+    x: extras(),
+    zoomMeetings: extras(),
+    // Every request names the workspace in an Account-Id header beside the key.
+    smartsuite: extras("workspaceId"),
 };
 /** Per service type: `accessToken`, then its extra labels sorted (Salesforce `instanceUrl`). */
 exports.CREDENTIAL_FIELDS = FIELDS_BY_TYPE;
@@ -68,6 +96,7 @@ exports.OPTIONAL_CREDENTIAL_FIELDS = {
     // Only S3-compatible providers set an endpoint, and a prefix is opt-in.
     amazonS3: ["endpoint", "pathPrefix"],
     snowflake: ["warehouse"],
+    shopify: ["storefrontApiUrl", "storefrontAccessToken"],
 };
 /**
  * Types the runtime never serves: those with a generated client (Airtable, email,

package/dist/cjs/integrations/rules.test.js

@@ -18,6 +18,7 @@ const index_js_1 = require("../index.js");
         ]);
         (0, vitest_1.expect)(index_js_1.CREDENTIAL_FIELDS.jira).toEqual(["accessToken", "cloudId", "siteUrl"]);
         (0, vitest_1.expect)(index_js_1.CREDENTIAL_FIELDS.granola).toEqual(["accessToken"]);
+        (0, vitest_1.expect)(index_js_1.CREDENTIAL_FIELDS.smartsheet).toEqual(["accessToken", "apiBaseUrl"]);
     });
     (0, vitest_1.it)("has no type the runtime never serves", () => {
         for (const type of index_js_1.NON_CREDENTIAL_SERVICE_TYPES) {