fix: convert the five measured comment-mask ledger rows onto the shared mask

examples/app-showcase/test/inert-wirings.test.ts

@@ -2,6 +2,15 @@
 
 import { readdirSync, readFileSync } from 'node:fs';
 import { describe, it, expect } from 'vitest';
+// The repo's ONE answer to "is this span a comment, or code?". The naive block
+// regex this replaces had no idea what a string literal is: it opened a phantom
+// comment at a block-comment opener sitting INSIDE a string and ran to the next
+// terminator far below, deleting live code on 5 of this app's 91 sources.
+// `stripComments` (not `maskComments`) is the projection this file wants -- the
+// one guard below reports bare file paths, never a line or an offset. The
+// `.mjs` specifier is deliberate; `scripts/js-comment-mask.d.mts` beside it is a
+// hand-written declaration, so this import needs no `allowJs`.
+import { stripComments } from '../../../scripts/js-comment-mask.mjs';
 import stack from '../objectstack.config.js';
 import { PLATFORM_CAPABILITY_NAMES } from '@objectstack/spec/security';
 import { FILE_REFERENCE_TYPES, valueSchemaFor } from '@objectstack/spec/data';
@@ -44,15 +53,10 @@ function sourceFiles(dir: string = SRC_ROOT): string[] {
  * Source text with comments removed, so a source-scan guard judges CODE.
  * Documentation must stay free to name a retired key (this file's own comments
  * do, and so do the ones explaining the rename) without tripping the guard that
- * bans authoring it. Block comments go first; then whole-line `//` comments —
- * never a trailing `//`, which would eat the `//` in a URL inside a string.
+ * bans authoring it.
  */
 function codeOf(file: string): string {
- return readFileSync(file, 'utf8')
- .replace(/\/\*[\s\S]*?\*\//g, '')
- .split('\n')
- .filter((line: string) => !line.trimStart().startsWith('//'))
- .join('\n');
+ return stripComments(readFileSync(file, 'utf8'));
 }
 
 /** Every `functions` entry, whichever spelling it was authored in. */

packages/cli/src/utils/console-route-ledger.conformance.test.ts

@@ -24,6 +24,19 @@ import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { describe, it, expect } from 'vitest';
+// The repo's ONE answer to "is this span a comment, or code?" — its header
+// carries the two private-stripper families that drifted apart and the
+// parser-differential sweep that measured which way each fails. The private
+// scanner this replaces was string-aware but REGEX-BLIND: the doubled slash
+// closing `/^https?:\/\//i` read as a line-comment opener and took the rest of
+// the line with it, which is the same defect #12398 found live in two sibling
+// guards. `stripComments` (not `maskComments`) is the projection this file
+// wants: it deletes comment characters but keeps every newline, so the
+// `file:line` every finding here reports still points at the real line, and
+// nothing in this file reports an offset. The `.mjs` specifier is deliberate;
+// `scripts/js-comment-mask.d.mts` beside it is a hand-written declaration, so
+// this import needs no `allowJs`.
+import { stripComments } from '../../../../scripts/js-comment-mask.mjs';
 import { CONSOLE_ROUTE_LEDGER } from './console-route-ledger.js';
 
 /**
@@ -59,49 +72,6 @@ const NON_ROUTE_MEMBERS = new Set(['use', 'notFound', 'onError', 'fire', 'fetch'
 // Scanning machinery
 // ---------------------------------------------------------------------------
 
-/**
- * Strip comments before scanning, PRESERVING newlines inside block comments so
- * every finding's `file:line` points at the real line — `console.ts` opens with
- * a 35-line header, and reporting a mount 35 lines short makes an accurate
- * finding read as a wrong one.
- */
-export function stripComments(source: string): string {
- let out = '';
- let i = 0;
- while (i < source.length) {
- const c = source[i];
- const next = source[i + 1];
- if (c === '/' && next === '/') {
- while (i < source.length && source[i] !== '\n') i++;
- continue;
- }
- if (c === '/' && next === '*') {
- i += 2;
- while (i < source.length && !(source[i] === '*' && source[i + 1] === '/')) {
- if (source[i] === '\n') out += '\n';
- i++;
- }
- i += 2;
- continue;
- }
- if (c === '\'' || c === '"' || c === '`') {
- const quote = c;
- out += c;
- i++;
- while (i < source.length) {
- if (source[i] === '\\') { out += source.slice(i, i + 2); i += 2; continue; }
- out += source[i];
- if (source[i] === quote) { i++; break; }
- i++;
- }
- continue;
- }
- out += c;
- i++;
- }
- return out;
-}
-
 /** Module-scope `const NAME = '<literal>';` bindings, exported or not. */
 export function constantBindings(code: string): Map<string, string> {
  const out = new Map<string, string>();
@@ -380,13 +350,29 @@ describe('cli console route ledger hygiene', () => {
 });
 
 describe('scan machinery, pinned in both directions', () => {
- it('the comment stripper drops prose paths, keeps code paths, and preserves line numbers', () => {
+ it('the shared stripper drops prose paths, keeps code paths, and preserves line numbers', () => {
+ // Not a re-pin of `js-comment-mask.mjs` -- that module pins its own
+ // behaviour. This pins the PROPERTY this census rests on: comment
+ // characters go, every newline stays, so `lineOf()` below still counts
+ // the real line.
  const stripped = stripComments("// app.get('/ghost', h)\n/* a\nb */\napp.get(`/real`, h);\n");
  expect(stripped).not.toContain('ghost');
  expect(stripped).toContain('/real');
  expect(censusOf(['f.ts'], () => "/* a\nb\nc */\napp.get('/x', h);\n").routes[0].line).toBe(4);
  });
 
+ it('a doubled slash inside a REGEX LITERAL does not swallow the rest of its line', () => {
+ // The defect the private scanner this file used to carry was measured
+ // committing on 7 of this package's 110 sources: string-aware but
+ // regex-blind, it read the `//` that CLOSES `/^https?:\/\//i` as a
+ // line-comment opener and deleted to end of line. A mount sharing that
+ // line went with it, and the census reported clean over text it never
+ // read. Live in `commands/dev.ts`, `commands/serve.ts` and
+ // `commands/start.ts` at conversion time.
+ const stripped = stripComments("const ok = /^https?:\\/\\//i.test(u); app.get('/real', h);\n");
+ expect(stripped).toContain('/real');
+ });
+
  it('resolves the spellings this package uses, and refuses the rest', () => {
  const b = constantBindings("export const CONSOLE_PATH = '/_console';\n");
  expect(b.get('CONSOLE_PATH')).toBe('/_console');

packages/drivers/driver-sql/src/live-dialect-matrix.isolation.test.ts

@@ -43,6 +43,14 @@ import { readFileSync, readdirSync } from 'node:fs';
 import { SqlDriver } from '../src/index.js';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+// The repo's ONE answer to "is this span a comment, or code?". The naive block
+// regex this replaces had no idea what a string literal is: in
+// `logger-receiver-detach.test.ts` a fixture STRING quotes a docblock and the
+// sweep ate the string. `stripComments` (not `maskComments`) is the projection
+// this file wants -- the guard below reports bare file names, never a line or
+// an offset. The `.mjs` specifier is deliberate; `scripts/js-comment-mask.d.mts`
+// beside it is a hand-written declaration, so this import needs no `allowJs`.
+import { stripComments } from '../../../../scripts/js-comment-mask.mjs';
 import {
  LIVE_SCHEMA_PREFIX,
  MYSQL_CELL,
@@ -127,11 +135,9 @@ describe('live-dialect matrix — per-file schema isolation (#9350)', () => {
 });
 
 describe('live-dialect matrix — the cell is the only route to a live server (#9350)', () => {
- /** Source with line and block comments removed, so prose about the env var is not a hit. */
+ /** Source with comments removed, so prose about the env var is not a hit. */
  const codeOf = (file: string): string =>
- readFileSync(join(SRC_DIR, file), 'utf8')
- .replace(/\/\*[\s\S]*?\*\//g, '')
- .replace(/^[ \t]*\/\/.*$/gm, '');
+ stripComments(readFileSync(join(SRC_DIR, file), 'utf8'));
 
  /**
  * The needle is ASSEMBLED rather than written as a literal.

packages/plugins/plugin-auth/src/rate-limit-storage-isolation.test.ts

@@ -42,6 +42,16 @@
 import { describe, it, expect } from 'vitest';
 import { readFileSync, existsSync, readdirSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
+// The repo's ONE answer to "is this span a comment, or code?". The private
+// scanner this replaces tracked the three string forms but was REGEX-BLIND, so
+// the doubled slash closing a literal like `/^https?:\/\//i` read as a
+// line-comment opener and took the rest of the line -- `auth-manager.ts` in this
+// very package was losing that line. `stripComments` (not `maskComments`) is the
+// projection this file wants: every finding reports a package-relative FILE PATH
+// and a specifier, never a line or an offset into the original. The `.mjs`
+// specifier is deliberate; `scripts/js-comment-mask.d.mts` beside it is a
+// hand-written declaration, so this import needs no `allowJs`.
+import { stripComments } from '../../../../scripts/js-comment-mask.mjs';
 
 /**
  * Seeded from `__dirname`, not from a `findUp` walk of `process.cwd()`, and not
@@ -109,51 +119,6 @@ const SRC = HERE;
 const RUNTIME_SRC = resolve(REPO, 'packages/runtime/src');
 const SERVICE_SMS_SRC = resolve(REPO, 'packages/services/service-sms/src');
 
-/**
- * Strip comments before scanning. The distinction this file turns on — a
- * `import type` versus a value `import` of the same specifier — is invisible to
- * a raw-text regex the moment a doc comment quotes an import line, and this
- * module's own header quotes several. Handles `//`, block comments and the
- * three string forms so a `'http://…'` literal is not mistaken for a comment.
- */
-function stripComments(src: string): string {
- let out = '';
- let i = 0;
- while (i < src.length) {
- const c = src[i]!;
- const next = src[i + 1];
- if (c === '/' && next === '/') {
- while (i < src.length && src[i] !== '\n') i++;
- continue;
- }
- if (c === '/' && next === '*') {
- i += 2;
- while (i < src.length && !(src[i] === '*' && src[i + 1] === '/')) i++;
- i += 2;
- continue;
- }
- if (c === "'" || c === '"' || c === '`') {
- out += c;
- i++;
- while (i < src.length && src[i] !== c) {
- if (src[i] === '\\') {
- out += src[i]! + (src[i + 1] ?? '');
- i += 2;
- continue;
- }
- out += src[i];
- i++;
- }
- out += c;
- i++;
- continue;
- }
- out += c;
- i++;
- }
- return out;
-}
-
 interface Ref {
  spec: string;
  /** `import type … from` / `export type … from` — erased at build, costs nothing at runtime. */

packages/runtime/src/error-envelope.conformance.test.ts

@@ -27,6 +27,16 @@
 
 import { describe, it, expect, vi } from 'vitest';
 import { readFileSync } from 'node:fs';
+// The repo's ONE answer to "is this span a comment, or code?". The naive pair
+// this replaces had an UNANCHORED trailing arm, so a doubled slash anywhere on a
+// line opened a phantom comment and the rest of the line went -- measured
+// eating route paths inside template literals in `dispatcher-plugin.ts` and an
+// https URL that `domains/mcp.ts` builds. `stripComments` (not `maskComments`)
+// is the projection these guards want: they report match counts and matched
+// text, never a line or an offset. The `.mjs` specifier is deliberate;
+// `scripts/js-comment-mask.d.mts` beside it is a hand-written declaration, so
+// this import needs no `allowJs`.
+import { stripComments } from '../../../scripts/js-comment-mask.mjs';
 import {
  ApiErrorSchema,
  BaseResponseSchema,
@@ -455,9 +465,7 @@ describe('#3842 — no dispatcher module may reintroduce the drift', () => {
  // Comments stripped first: these modules' own prose quotes the old shape,
  // and a doc comment is not a code path.
  const read = (file: string) =>
- readFileSync(new URL(file, import.meta.url), 'utf8')
- .replace(/\/\*[\s\S]*?\*\//g, '')
- .replace(/\/\/[^\n]*/g, '');
+ stripComments(readFileSync(new URL(file, import.meta.url), 'utf8'));
 
  /** Every module that can put a body on this wire surface. */
  const MODULES = [