fensu-cli 0.9.2__tar.gz → 0.9.4__tar.gz

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/Cargo.lock

@@ -392,7 +392,7 @@ checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
 [[package]]
 name = "fensu-cli"
-version = "0.9.2"
+version = "0.9.4"
 dependencies = [
  "cap-fs-ext",
  "cap-std",

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fensu-cli
-Version: 0.9.2
+Version: 0.9.4
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: Apache Software License

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fensu-cli"
-version = "0.9.2" # x-release-please-version
+version = "0.9.4" # x-release-please-version
 edition.workspace = true
 license.workspace = true
 publish = false

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-cli/src/catalogue/main/mod.rs

@@ -3,3 +3,4 @@
 pub(crate) mod rule_catalogue;
 pub(crate) mod rule_metadata;
 pub(crate) mod rule_output;
+pub(crate) mod validate_config_selectors;

fensu_cli-0.9.4/crates/fensu-cli/src/catalogue/main/validate_config_selectors.rs

@@ -0,0 +1,37 @@
+//! Validate configured selectors against the activated rule catalogue.
+
+use crate::catalogue::models::RuleMetadata;
+use crate::models::Config;
+
+pub(crate) fn validate_config_selectors(
+    config: &Config,
+    catalogue: &[&RuleMetadata],
+) -> Result<(), String> {
+    for (name, selectors) in [
+        ("select", &config.select),
+        ("warn", &config.warn),
+        ("ignore", &config.ignore),
+    ] {
+        validate_selector_group(name, selectors, catalogue)?;
+    }
+    for entry in &config.rule_ignores {
+        validate_selector_group("rule_ignores.rules", &entry.rules, catalogue)?;
+    }
+    Ok(())
+}
+
+fn validate_selector_group(
+    name: &str,
+    selectors: &[String],
+    catalogue: &[&RuleMetadata],
+) -> Result<(), String> {
+    for selector in selectors {
+        if catalogue.iter().any(|rule| rule.code.starts_with(selector)) {
+            continue;
+        }
+        return Err(format!(
+            "Config key {name} contains selector {selector}, but it matches no rules in the configured catalogue. Activate the required rule pack, or correct or remove the selector."
+        ));
+    }
+    Ok(())
+}

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-cli/src/check/_helpers/evaluation.rs

@@ -1,10 +1,11 @@
-use std::collections::{BTreeMap, HashMap, HashSet};
+use std::collections::{HashMap, HashSet};
 use std::path::Path;
 
 use fensu_facts::extension::models::ProgramHandle;
 use fensu_native::rules::main::evaluate_core_rules::evaluate_core_rules;
 use fensu_native::rules::main::plan_core_rule_queries::plan_core_rule_queries;
-use fensu_native::rules::models::NativeRuleContext;
+use fensu_native::rules::main::plan_execution_owners::plan_execution_owners;
+use fensu_native::rules::models::{NativeExecutionRule, NativeExecutionTarget, NativeRuleContext};
 use rayon::iter::{IndexedParallelIterator, IntoParallelRefIterator, ParallelIterator};
 
 use crate::catalogue::main::rule_metadata::rule_metadata;
@@ -20,9 +21,7 @@ use crate::check::_helpers::rule_policy::{
     validate_unique_implementations,
 };
 use crate::check::models::EvaluationRequest;
-use crate::constants::{
-    OWNER_FILE, OWNER_PACKAGE, ROLE_HELPERS, ROLE_MAIN, SCOPE_TEST, SUFFIX_INIT,
-};
+use crate::constants::SCOPE_TEST;
 use crate::models::{Config, Fault, ScopedSource, ThresholdUse};
 use crate::reporting::main::report::report;
 use crate::reporting::models::ReportRequest;
@@ -50,7 +49,7 @@ pub(crate) fn evaluate_and_render(request: EvaluationRequest<'_>) -> Result<(Str
         .iter()
         .map(|rule| rule.code.as_str())
         .collect::<HashSet<_>>();
-    let codes_by_source = owner_plan(sources, &all_rules);
+    let codes_by_source = owner_plan(sources, &all_rules)?;
     let project = project_plane(root, config, sources)?;
     let program_by_path = sources
         .iter()
@@ -241,120 +240,32 @@ fn package_name(source: &ScopedSource) -> String {
         .unwrap_or_else(|| source.root_text.clone())
 }
 
-pub(crate) fn owner_plan(sources: &[ScopedSource], rules: &[&RuleMetadata]) -> Vec<Vec<String>> {
-    let mut planned = vec![Vec::new(); sources.len()];
-    for rule in rules {
-        let applicable = sources
-            .iter()
-            .enumerate()
-            .filter(|(_, source)| family_applies(&rule.family, &source.scope))
-            .collect::<Vec<_>>();
-        if rule.execution_owner == OWNER_FILE {
-            for (index, _) in applicable {
-                planned[index].push(rule.code.clone());
-            }
-            continue;
-        }
-        let mut groups = BTreeMap::<String, Vec<usize>>::new();
-        for (index, source) in applicable {
-            if let Some(identity) = owner_identity(source, &rule.execution_owner) {
-                groups.entry(identity).or_default().push(index);
-            }
-        }
-        for indexes in groups.values() {
-            if let Some(index) = indexes
-                .iter()
-                .min_by_key(|index| anchor_key(&sources[**index], &rule.execution_owner))
-            {
-                planned[*index].push(rule.code.clone());
-            }
-        }
-    }
-    planned
-}
-
-pub(crate) fn family_applies(family: &str, scope: &str) -> bool {
-    if scope == SCOPE_TEST {
-        matches!(family, "annotations" | "tests")
-    } else {
-        !matches!(family, "tests" | "custom")
-    }
-}
-
-pub(crate) fn owner_identity(source: &ScopedSource, owner: &str) -> Option<String> {
-    let domain = source
-        .relative_parts
-        .first()
-        .filter(|part| !part.ends_with(".py"));
-    let subdomain = source
-        .relative_parts
-        .get(1)
-        .filter(|part| !part.ends_with(".py") && !is_role_directory(part));
-    match owner {
-        "project" => Some("project".to_owned()),
-        "scope" => Some(format!("{}\0{}", source.scope, source.root_text)),
-        "package" => source
-            .path
-            .parent()
-            .map(|path| path.to_string_lossy().into_owned()),
-        "domain" => domain.map(|value| format!("{}\0{}\0{value}", source.scope, source.root_text)),
-        "subdomain" => subdomain.map(|value| {
-            format!(
-                "{}\0{}\0{}\0{value}",
-                source.scope,
-                source.root_text,
-                domain.map(String::as_str).unwrap_or_default()
-            )
-        }),
-        "leaf" => domain.map(|value| {
-            format!(
-                "{}\0{}\0{value}\0{}",
-                source.scope,
-                source.root_text,
-                subdomain.map(String::as_str).unwrap_or_default()
+pub(crate) fn owner_plan(
+    sources: &[ScopedSource],
+    rules: &[&RuleMetadata],
+) -> Result<Vec<Vec<String>>, String> {
+    let targets: Vec<NativeExecutionTarget> = sources
+        .iter()
+        .map(|source| NativeExecutionTarget {
+            repository_path: source.repository_path.clone(),
+            scope: source.scope.clone(),
+            root: source.root_text.clone(),
+            relative_parts: source.relative_parts.clone(),
+            direct: true,
+        })
+        .collect();
+    let native_rules: Vec<NativeExecutionRule> = rules
+        .iter()
+        .map(|rule| {
+            NativeExecutionRule::new(
+                rule.code.clone(),
+                rule.family.clone(),
+                rule.execution_owner.clone(),
             )
-        }),
-        _ => None,
-    }
-}
-
-pub(crate) fn anchor_key(source: &ScopedSource, owner: &str) -> (bool, usize, String) {
-    let init = source
-        .relative_parts
-        .last()
-        .is_some_and(|part| part == SUFFIX_INIT);
-    let expected_depth = match owner {
-        "scope" => Some(1),
-        "domain" => Some(2),
-        "subdomain" => Some(3),
-        "leaf" => Some(
-            if source
-                .relative_parts
-                .get(1)
-                .is_some_and(|part| !part.ends_with(".py") && !is_role_directory(part))
-            {
-                3
-            } else {
-                2
-            },
-        ),
-        _ => None,
-    };
-    let owner_init = if owner == OWNER_PACKAGE {
-        init
-    } else {
-        init && expected_depth == Some(source.relative_parts.len())
-    };
-    (
-        !owner_init,
-        source.relative_parts.len(),
-        source.repository_path.clone(),
-    )
-}
-
-fn is_role_directory(part: &str) -> bool {
-    matches!(
-        part,
-        ROLE_MAIN | ROLE_HELPERS | "classes" | "models" | "types" | "constants" | "exceptions"
-    )
+        })
+        .collect();
+    Ok(plan_execution_owners(&targets, &native_rules)?
+        .into_iter()
+        .map(|plan| plan.codes)
+        .collect())
 }

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-cli/src/check/_helpers/rule_policy.rs

@@ -3,6 +3,7 @@ use std::collections::{HashMap, HashSet};
 
 use crate::catalogue::main::rule_catalogue::configured_rule_catalogue;
 use crate::catalogue::main::rule_metadata::rule_metadata;
+use crate::catalogue::main::validate_config_selectors::validate_config_selectors;
 use crate::catalogue::models::RuleMetadata;
 use crate::check::_helpers::policy::{path_matches, role};
 use crate::models::{Config, ScopedSource, ThresholdUse};
@@ -47,6 +48,8 @@ pub(crate) fn selected_rules(
 }
 
 pub(crate) fn validate_config_tiers(config: &Config) -> Result<(), String> {
+    let catalogue = configured_rule_catalogue(&config.rule_packs)?;
+    validate_config_selectors(config, &catalogue)?;
     let blocking = selected_rules(config, &config.select, &[])?;
     let warnings = selected_rules(config, &config.warn, &[])?;
     let warning_codes = warnings

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-cli/src/constants.rs

@@ -3,8 +3,6 @@ pub(crate) const COLOR_AUTO: &str = "auto";
 pub(crate) const COLOR_NEVER: &str = "never";
 pub(crate) const GLOB_ALL: &str = "**";
 pub(crate) const OPTION_COLOR: &str = "--color";
-pub(crate) const OWNER_FILE: &str = "file";
-pub(crate) const OWNER_PACKAGE: &str = "package";
 pub(crate) const ROLE_HELPERS: &str = "_helpers";
 pub(crate) const ROLE_MAIN: &str = "main";
 pub(crate) const ROLE_RULES: &str = "rules";

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-cli/src/skills/_helpers/context/selection.rs

@@ -4,6 +4,7 @@ use std::path::Path;
 use serde_json::json;
 
 use crate::catalogue::main::rule_catalogue::configured_rule_catalogue;
+use crate::catalogue::main::validate_config_selectors::validate_config_selectors;
 use crate::catalogue::models::RuleMetadata;
 use crate::configuration::constants::{
     CONTRACT_BEHAVIORS, DEFAULT_THRESHOLDS, RULE_CONFIGURATION_INPUTS,
@@ -47,7 +48,9 @@ pub(crate) fn selection(config: &Config, project_root: &Path) -> Result<RuleSele
     {
         return hosted_selection(project_root);
     }
-    let catalogue = configured_rule_catalogue(&config.rule_packs)?
+    let configured_catalogue = configured_rule_catalogue(&config.rule_packs)?;
+    validate_config_selectors(config, &configured_catalogue)?;
+    let catalogue = configured_catalogue
         .into_iter()
         .cloned()
         .collect::<Vec<_>>();

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-cli/tests/command/test_check_policy.rs

@@ -81,6 +81,47 @@ fn given_native_dagster_alias_when_checking_then_executes_core_kernel_under_pack
     }
 }
 
+#[test]
+fn given_native_dagster_rule_when_checking_then_executes_pack_kernel() {
+    let test_cases = [NativeRulePackTestCase {
+        description: "selected native Dagster rule reports an invalid asset main module",
+        config: "roots = [\"src/pkg\"]\ntests = []\ntooling = []\nrule_packs = [\"dagster\"]\nselect = [\"FPDG004\"]\n",
+        expected_exit_code: 1,
+        expected_output: "FPDG004  Dagster main.py must contain only imports and one main()",
+    }];
+
+    for test_case in &test_cases {
+        let repository = tempfile::tempdir().expect("temporary repository");
+        write(repository.path().join("fensu.toml"), test_case.config);
+        write(
+            repository
+                .path()
+                .join("src/pkg/defs/assets/example/assets.py"),
+            "assets: tuple[object, ...] = ()\n",
+        );
+        write(
+            repository.path().join("src/pkg/defs/assets/example/main.py"),
+            "def helper() -> int:\n    return 1\n\ndef main() -> dg.MaterializeResult:\n    return dg.MaterializeResult()\n",
+        );
+
+        let output = run_check(repository.path());
+        let stdout = String::from_utf8_lossy(&output.stdout);
+
+        assert_eq!(
+            output.status.code(),
+            Some(test_case.expected_exit_code),
+            "{}: {}",
+            test_case.description,
+            String::from_utf8_lossy(&output.stderr)
+        );
+        assert!(
+            stdout.contains(test_case.expected_output),
+            "{}: {stdout}",
+            test_case.description
+        );
+    }
+}
+
 #[test]
 fn given_core_and_alias_in_one_tier_when_checking_then_rejects_duplicate_implementation() {
     let test_cases = [NativeRulePackTestCase {

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-cli/tests/command/test_check_validation.rs

@@ -24,6 +24,30 @@ fn given_invalid_native_policy_when_checking_then_configuration_fails_closed() {
             expected_exit_code: 2,
             expected_error: "Config key ignore contains invalid selector wrong.",
         },
+        InvalidCheckConfigTestCase {
+            description: "unmatched blocking selector is rejected",
+            config: "roots = [\"src/pkg\"]\ntests = []\ntooling = []\nselect = [\"FFX\"]\n",
+            expected_exit_code: 2,
+            expected_error: "Config key select contains selector FFX, but it matches no rules in the configured catalogue.",
+        },
+        InvalidCheckConfigTestCase {
+            description: "unmatched warning selector is rejected",
+            config: "roots = [\"src/pkg\"]\ntests = []\ntooling = []\nselect = []\nwarn = [\"FFX\"]\n",
+            expected_exit_code: 2,
+            expected_error: "Config key warn contains selector FFX, but it matches no rules in the configured catalogue.",
+        },
+        InvalidCheckConfigTestCase {
+            description: "unmatched Dagster alias ignore is rejected",
+            config: "roots = [\"src/pkg\"]\ntests = []\ntooling = []\nrule_packs = [\"dagster\"]\nselect = [\"FPDG\"]\nignore = [\"FPDGL101\"]\n",
+            expected_exit_code: 2,
+            expected_error: "Config key ignore contains selector FPDGL101, but it matches no rules in the configured catalogue.",
+        },
+        InvalidCheckConfigTestCase {
+            description: "unmatched path-scoped ignore selector is rejected",
+            config: "roots = [\"src/pkg\"]\ntests = []\ntooling = []\nselect = [\"FFA001\"]\n\n[[rule_ignores]]\nrules = [\"FFX\"]\npaths = [\"src/pkg/**\"]\nreason = \"Generated source.\"\n",
+            expected_exit_code: 2,
+            expected_error: "Config key rule_ignores.rules contains selector FFX, but it matches no rules in the configured catalogue.",
+        },
         InvalidCheckConfigTestCase {
             description: "blocking and warning tiers cannot overlap",
             config: "roots = [\"src/pkg\"]\ntests = []\ntooling = []\nselect = [\"FFA001\"]\nwarn = [\"FFA001\"]\n",

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-cli/tests/skills/commands.inc

@@ -7,10 +7,40 @@ use crate::helpers::{
     CONFIG,
 };
 use crate::test_types::{
-    ExceptionSymbolTestCase, FreshnessTestCase, PublicationRaceTestCase,
-    RepositoryGuidanceTestCase, SkillsCommandTestCase,
+    ExceptionSymbolTestCase, FreshnessTestCase, InvalidSkillsConfigTestCase,
+    PublicationRaceTestCase, RepositoryGuidanceTestCase, SkillsCommandTestCase,
 };
 
+#[test]
+fn given_unmatched_selector_when_generating_skills_then_configuration_fails_closed() {
+    let test_cases = [InvalidSkillsConfigTestCase {
+        description: "skills reject selectors absent from the configured catalogue",
+        expected_exit_code: 2,
+        expected_error: "Config key ignore contains selector FFX, but it matches no rules in the configured catalogue.",
+    }];
+    for test_case in test_cases {
+        let repository = project();
+        let configured = CONFIG.replace("select = [\"FF\"]", "select = [\"FF\"]\nignore = [\"FFX\"]");
+        write(repository.path().join("fensu.toml"), configured);
+
+        let result = native(repository.path(), &["--target", "agents"]);
+
+        assert_eq!(
+            result.status.code(),
+            Some(test_case.expected_exit_code),
+            "{}: {}",
+            test_case.description,
+            text(&result.stderr)
+        );
+        assert!(
+            text(&result.stderr).contains(test_case.expected_error),
+            "{}: {}",
+            test_case.description,
+            text(&result.stderr)
+        );
+    }
+}
+
 #[test]
 fn given_canonical_role_policy_when_generating_skill_then_guidance_is_owned_and_complete() {
     let test_cases = [RepositoryGuidanceTestCase {
@@ -711,7 +741,7 @@ def always(module: ast.Module, ctx: RuleContext) -> list[Fault]:
         let incompatible = repository.path().join("incompatible-host");
         write(
             &incompatible,
-            b"#!/bin/sh\nprintf '{\"protocol\":1,\"package_version\":\"0\",\"catalogue\":[],\"blocking\":[],\"warnings\":[],\"ignored\":[]}\\n'\n",
+            b"#!/bin/sh\ncat >/dev/null\nprintf '{\"protocol\":1,\"package_version\":\"0\",\"catalogue\":[],\"blocking\":[],\"warnings\":[],\"ignored\":[]}\\n'\n",
         );
         fs::set_permissions(&incompatible, fs::Permissions::from_mode(0o755))
             .expect("incompatible host mode");

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-cli/tests/skills/test_types.rs

@@ -5,6 +5,12 @@ pub(crate) struct SkillsCommandTestCase {
     pub(crate) expected_exit_code: i32,
 }
 
+pub(crate) struct InvalidSkillsConfigTestCase {
+    pub(crate) description: &'static str,
+    pub(crate) expected_exit_code: i32,
+    pub(crate) expected_error: &'static str,
+}
+
 pub(crate) struct FreshnessTestCase {
     pub(crate) description: &'static str,
     pub(crate) expected_state: &'static str,

fensu_cli-0.9.4/crates/fensu-native/src/extension/_helpers/evaluation/execution_planning.rs

@@ -0,0 +1,113 @@
+//! Native file selection and deterministic execution-owner planning.
+
+use std::collections::HashSet;
+
+use globset::{GlobBuilder, GlobSet, GlobSetBuilder};
+use pyo3::exceptions::PyValueError;
+use pyo3::{pyfunction, PyResult};
+
+use crate::extension::constants::RECURSIVE_GLOB;
+use crate::rules::main::plan_execution_owners::plan_execution_owners;
+use crate::rules::models::{NativeExecutionRule, NativeExecutionTarget};
+
+type TargetTuple = (String, String, String, Vec<String>, bool);
+type RuleTuple = (String, String, String);
+type PlannedTargetTuple = (Vec<String>, Vec<(String, String)>);
+
+#[pyfunction]
+pub(crate) fn select_native_execution_files(
+    paths: Vec<String>,
+    includes: Vec<String>,
+    excludes: Vec<String>,
+) -> PyResult<(Option<Vec<usize>>, usize)> {
+    if includes.is_empty() && excludes.is_empty() {
+        return Ok((None, 0));
+    }
+    let include_set = build_patterns(&includes)?;
+    let exclude_set = build_patterns(&excludes)?;
+    for pattern in &includes {
+        let matcher = build_patterns(std::slice::from_ref(pattern))?;
+        if !paths.iter().any(|path| matcher.is_match(path)) {
+            return Err(PyValueError::new_err(format!(
+                "Evaluation include pattern matched no discovered Python files: {pattern}."
+            )));
+        }
+    }
+    let selected: Vec<usize> = paths
+        .iter()
+        .enumerate()
+        .filter_map(|(index, path)| {
+            let included = includes.is_empty() || include_set.is_match(path);
+            (included && !exclude_set.is_match(path)).then_some(index)
+        })
+        .collect();
+    if selected.is_empty() && !paths.is_empty() {
+        return Err(PyValueError::new_err(
+            "Evaluation configuration selects zero Python files; exclusions removed all targets.",
+        ));
+    }
+    let excluded = paths.len().saturating_sub(selected.len());
+    Ok((Some(selected), excluded))
+}
+
+#[pyfunction]
+pub(crate) fn plan_native_execution_owners(
+    targets: Vec<TargetTuple>,
+    rules: Vec<RuleTuple>,
+) -> PyResult<Vec<PlannedTargetTuple>> {
+    let native_targets: Vec<NativeExecutionTarget> = targets
+        .into_iter()
+        .map(
+            |(repository_path, scope, root, relative_parts, direct)| NativeExecutionTarget {
+                repository_path,
+                scope,
+                root,
+                relative_parts,
+                direct,
+            },
+        )
+        .collect();
+    let native_rules: Vec<NativeExecutionRule> = rules
+        .into_iter()
+        .map(|(code, family, owner)| NativeExecutionRule::new(code, family, owner))
+        .collect();
+    let plans =
+        plan_execution_owners(&native_targets, &native_rules).map_err(PyValueError::new_err)?;
+    Ok(plans
+        .into_iter()
+        .map(|plan| (plan.codes, plan.identities))
+        .collect())
+}
+
+#[pyfunction]
+pub(crate) fn partition_native_execution_targets(
+    ordered_paths: Vec<String>,
+    work_paths: Vec<String>,
+) -> Vec<usize> {
+    let work: HashSet<String> = work_paths.into_iter().collect();
+    ordered_paths
+        .iter()
+        .enumerate()
+        .filter_map(|(index, path)| work.contains(path).then_some(index))
+        .collect()
+}
+
+fn build_patterns(patterns: &[String]) -> PyResult<GlobSet> {
+    let mut builder = GlobSetBuilder::new();
+    for pattern in patterns {
+        let pattern = if pattern.contains('/') || pattern == RECURSIVE_GLOB {
+            pattern.clone()
+        } else {
+            format!("{{{pattern},**/{pattern}}}")
+        };
+        let glob = GlobBuilder::new(&pattern)
+            .literal_separator(true)
+            .backslash_escape(false)
+            .build()
+            .map_err(|error| PyValueError::new_err(error.to_string()))?;
+        builder.add(glob);
+    }
+    builder
+        .build()
+        .map_err(|error| PyValueError::new_err(error.to_string()))
+}

fensu_cli-0.9.4/crates/fensu-native/src/extension/constants.rs

@@ -0,0 +1,3 @@
+//! Native execution planning decision values.
+
+pub(crate) const RECURSIVE_GLOB: &str = "**";

{fensu_cli-0.9.2 → fensu_cli-0.9.4}/crates/fensu-native/src/rules/_helpers/dagster/assets.rs

@@ -133,22 +133,54 @@ pub(super) fn assets_delegate_to_main(
         faults.push(path_fault(code, None));
     }
     for callback in callbacks {
-        let body = function_source(program, callback.line);
-        let direct = body
-            .lines()
-            .skip(1)
-            .filter(|line| !line.trim().is_empty())
-            .collect::<Vec<_>>();
-        let valid = direct.len() == 1
-            && (direct[0].trim_start().starts_with("return main(")
-                || direct[0].trim_start().starts_with("yield from main("));
-        if !valid {
+        if !direct_main_delegation(program, callback.line) {
             faults.push(fault(code, callback.line, callback.column));
         }
     }
     faults
 }
 
+fn direct_main_delegation(program: &ProgramHandle, line: u32) -> bool {
+    let source = function_source(program, line);
+    let mut signature_complete = false;
+    let mut delimiter_balance: i32 = 0;
+    let mut body_indentation: Option<usize> = None;
+    let mut direct_statements: Vec<&str> = Vec::new();
+    for text in source.lines() {
+        if !signature_complete {
+            delimiter_balance += text.chars().fold(0, |balance, character| {
+                balance
+                    + match character {
+                        '(' | '[' | '{' => 1,
+                        ')' | ']' | '}' => -1,
+                        _ => 0,
+                    }
+            });
+            signature_complete = delimiter_balance == 0 && text.trim_end().ends_with(':');
+            continue;
+        }
+        if text.trim().is_empty() {
+            continue;
+        }
+        let indentation = text.len().saturating_sub(text.trim_start().len());
+        let body_indentation = *body_indentation.get_or_insert(indentation);
+        if indentation == body_indentation && delimiter_balance == 0 {
+            direct_statements.push(text.trim_start());
+        }
+        delimiter_balance += text.chars().fold(0, |balance, character| {
+            balance
+                + match character {
+                    '(' | '[' | '{' => 1,
+                    ')' | ']' | '}' => -1,
+                    _ => 0,
+                }
+        });
+    }
+    direct_statements.len() == 1
+        && (direct_statements[0].starts_with("return main(")
+            || direct_statements[0].starts_with("yield from main("))
+}
+
 fn approved_main_return(signature: &str) -> bool {
     signature.contains("MaterializeResult")
         || signature.contains("Iterator[")
@@ -263,6 +295,20 @@ fn nearest_asset_owner(
     }
 }
 
+fn ancestor_asset_owners(owner: &str) -> Vec<String> {
+    let parts: Vec<&str> = owner.split('.').collect();
+    (4..parts.len())
+        .map(|depth| parts[..depth].join("."))
+        .collect()
+}
+
+fn owner_supports_target(owner: &str, target: &str) -> bool {
+    target.starts_with(&format!("{owner}._helpers."))
+        || ["constants", "exceptions", "models", "types"]
+            .iter()
+            .any(|role| target == format!("{owner}.{role}"))
+}
+
 pub(super) fn import_boundaries(
     program: &ProgramHandle,
     code: &str,
@@ -275,6 +321,7 @@ pub(super) fn import_boundaries(
     let Some(owner) = nearest_asset_owner(context, project) else {
         return Vec::new();
     };
+    let ancestor_owners = ancestor_asset_owners(&owner);
     let package = &context.package_name;
     let mut faults: Vec<NativeFaultRow> = Vec::new();
     for row in &program.reference_rows().imports {
@@ -290,10 +337,10 @@ pub(super) fn import_boundaries(
                 && !private
                 && import_public(row);
             let owned = target == format!("{owner}.main")
-                || target.starts_with(&format!("{owner}._helpers."))
-                || ["constants", "exceptions", "models", "types"]
+                || owner_supports_target(&owner, &target)
+                || ancestor_owners
                     .iter()
-                    .any(|role| target == format!("{owner}.{role}"));
+                    .any(|ancestor| owner_supports_target(ancestor, &target));
             let dependency = row.from_import && target.ends_with(".assets");
             if !shared && !owned && !dependency {
                 faults.push(fault(code, row.line, row.column));