perf(schema): hoist Schema compilers and add lint rule

Schema.is, Schema.decode*, Schema.encode*, Schema.validate*, and Schema.parse* each compile a parser/guard from a schema. Calling them inside a function body rebuilds that function on every invocation. Adds executor/no-inline-schema-compile (oxlint plugin rule) that flags these calls when they appear inside a function body, with two severities: HIGH when the schema argument is itself an inline Schema.X(...) literal (both AST and compile rebuilt), MEDIUM when only the compiler is re-called. Fixes the 44 existing violations across 22 files by hoisting the compiled function (and where applicable, its schema literal) to module scope. Notable consolidations: - oauth-service.ts: 8 sites (5 decode + 3 encode of OAuthProviderState) collapse into two hoisted helpers - jwks-cache.ts, mcp-auth.ts: per-call guard compilation removed from JWT verify error path - React Add*Source / EditOpenApiSource components: shared decodeErrorMessage / isOpenApiSourceBindingValue hoisted migrate-connections.ts has one targeted oxlint-disable for a higher-order helper whose schema is a function parameter; the compile is hoisted into the outer closure but the rule (correctly) flags any Schema compiler call inside a function body.

Rhys Sullivan committed 6 months ago

Commit 25515e31 parent bfb87a025 files · +224 −99Browse files

Unified · Split

25 files

.oxlintrc.jsonc +1 −0
apps/cloud/src/jwks-cache.ts +4 −1
apps/cloud/src/mcp-auth.ts +2 −1
apps/cloud/src/mcp-miniflare.e2e.node.test.ts +3 −1
apps/cloud/src/services/sources-api.node.test.ts +4 −3
apps/local/src/server/migrate-connections.ts +5 −4
apps/local/src/server/migrate-mcp-bindings.test.ts +4 −2
apps/local/src/server/migrate-openapi-bindings.test.ts +14 −9
packages/core/api/src/oauth-popup.test.ts +6 −6
packages/core/api/src/observability.ts +3 −1
packages/core/config/src/config.test.ts +5 −3
packages/core/sdk/src/executor.ts +5 −5
packages/core/sdk/src/oauth-service.ts +15 −17
packages/core/storage-core/src/factory.ts +3 −3
packages/plugins/google-discovery/src/react/AddGoogleDiscoverySource.tsx +5 −7
packages/plugins/graphql/src/react/AddGraphqlSource.tsx +5 −7
packages/plugins/graphql/src/sdk/store.ts +8 −2
packages/plugins/mcp/src/react/AddMcpSource.tsx +5 −7
packages/plugins/openapi/src/react/AddOpenApiSource.tsx +5 −7
packages/plugins/openapi/src/react/EditOpenApiSource.tsx +8 −9
packages/plugins/openapi/src/sdk/non-json-body.test.ts +3 −2
packages/plugins/openapi/src/sdk/store.ts +3 −1
packages/plugins/workos-vault/src/sdk/client.ts +2 −1
scripts/oxlint-plugin-executor.js +2 −0
scripts/oxlint-plugin-executor/rules/no-inline-schema-compile.js +104 −0

.oxlintrc.jsonc+1−0

@@ -11,6 +11,7 @@ · 10 unmodified lines
11	"executor/no-effect-escape-hatch": "error",	11	"executor/no-effect-escape-hatch": "error",
12	"executor/no-effect-internal-tags": "error",	12	"executor/no-effect-internal-tags": "error",
13	"executor/no-error-constructor": "error",	13	"executor/no-error-constructor": "error",
		14	"executor/no-inline-schema-compile": "error",
14	"executor/no-instanceof-error": "error",	15	"executor/no-instanceof-error": "error",
15	"executor/no-instanceof-tagged-error": "error",	16	"executor/no-instanceof-tagged-error": "error",
16	"executor/no-json-parse": "error",	17	"executor/no-json-parse": "error",

apps/cloud/src/jwks-cache.ts+4−1

 });
 const decodeJsonWebKeySetPayload = Schema.decodeUnknownPromise(JsonWebKeySetPayload);
+const ErrorWithCode = Schema.Struct({ code: Schema.String });
+const isErrorWithCode = Schema.is(ErrorWithCode);
 const isJwksNoMatchingKey = (cause: unknown): boolean =>
-  Schema.is(Schema.Struct({ code: Schema.String }))(cause) && cause.code === JWKSNoMatchingKey.code;
+  isErrorWithCode(cause) && cause.code === JWKSNoMatchingKey.code;
 interface CacheEntry {
   jwks: JSONWebKeySet;

apps/cloud/src/mcp-auth.ts+2−1

@@ -15,9 +15,10 @@ export class McpJwtVerificationError extends Data.TaggedError("McpJwtVerificatio · 14 unmodified lines
15	}> {}	15	}> {}
16		16
17	const JoseErrorCode = Schema.Struct({ code: Schema.String });	17	const JoseErrorCode = Schema.Struct({ code: Schema.String });
		18	const isJoseErrorCodeShape = Schema.is(JoseErrorCode);
18		19
19	const getJoseErrorCode = (cause: unknown): string \| null =>	20	const getJoseErrorCode = (cause: unknown): string \| null =>
20	Schema.is(JoseErrorCode)(cause) ? cause.code : null;	21	isJoseErrorCodeShape(cause) ? cause.code : null;
21		22
22	const isJoseErrorCode = (code: string): boolean => code.startsWith("ERR_J");	23	const isJoseErrorCode = (code: string): boolean => code.startsWith("ERR_J");
23		24

apps/cloud/src/mcp-miniflare.e2e.node.test.ts+3−1

   }),
 );
+const decodeOtlpPayload = Schema.decodeUnknownOption(OtlpPayloadFromJson);
 const unwrapAttrValue = (v?: OtlpAttributeValue): unknown => {
   if (!v) return undefined;
   if (v.stringValue !== undefined) return v.stringValue;
           body += chunk;
         });
         req.on("end", () => {
-          const maybePayload = Schema.decodeUnknownOption(OtlpPayloadFromJson)(body);
+          const maybePayload = decodeOtlpPayload(body);
           if (Option.isSome(maybePayload)) {
             const payload = maybePayload.value;
             for (const rs of payload.resourceSpans ?? []) {

apps/cloud/src/services/sources-api.node.test.ts+4−3

   variables: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
 });
+const GraphqlRequestFromJson = Schema.fromJsonString(GraphqlRequestSchema);
+const decodeGraphqlRequest = Schema.decodeUnknownPromise(GraphqlRequestFromJson);
 const startGraphqlServer = () => {
   const requests: Array<{ readonly query: string; readonly variables: unknown }> = [];
   const server = http.createServer(async (req, res) => {
       return;
     }
-    const parsed = await Schema.decodeUnknownPromise(Schema.fromJsonString(GraphqlRequestSchema))(
+    const parsed = await decodeGraphqlRequest(await readBody(req));
-      await readBody(req),
-    );
     const query = parsed.query ?? "";
     requests.push({ query, variables: parsed.variables ?? null });

apps/local/src/server/migrate-connections.ts+5−4

@@ -30,10 +30,11 @@ const isString = (v: unknown): v is string => typeof v === "string"; · 29 unmodified lines
30	const JsonObject = Schema.Record(Schema.String, Schema.Unknown);	30	const JsonObject = Schema.Record(Schema.String, Schema.Unknown);
31	const JsonObjectFromString = Schema.fromJsonString(JsonObject);	31	const JsonObjectFromString = Schema.fromJsonString(JsonObject);
32		32
33	const decodeUnknownOptionAs =	33	const decodeUnknownOptionAs = <A>(schema: Schema.Decoder<A>) => {
34	<A>(schema: Schema.Decoder<A>) =>	34	// oxlint-disable-next-line executor/no-inline-schema-compile -- schema bound by parameter; compiler hoisted into closure
35	(input: unknown): Option.Option<A> =>	35	const decode = Schema.decodeUnknownOption(schema);
36	Schema.decodeUnknownOption(schema)(input);	36	return (input: unknown): Option.Option<A> => decode(input);
		37	};
37		38
38	const decodeJsonObjectString = Schema.decodeUnknownOption(JsonObjectFromString);	39	const decodeJsonObjectString = Schema.decodeUnknownOption(JsonObjectFromString);
39		40

apps/local/src/server/migrate-mcp-bindings.test.ts+4−2

   }),
 );
+const decodeConfigJson = Schema.decodeUnknownSync(ConfigJson);
 const tempDirs: Array<string> = [];
 const makeDbPath = () => {
     expect(row.auth_secret_id).toBe("tok-secret");
     expect(row.auth_secret_prefix).toBe("Bearer ");
     // The auth key should be stripped from config json after migration.
-    const config = Schema.decodeUnknownSync(ConfigJson)(row.config);
+    const config = decodeConfigJson(row.config);
     expect(config.auth).toBeUndefined();
     expect(config.transport).toBe("remote");
     expect(config.endpoint).toBe("https://example.com/mcp");
     };
     expect(row.auth_kind).toBe("none");
     expect(row.auth_secret_id).toBeNull();
-    const config = Schema.decodeUnknownSync(ConfigJson)(row.config);
+    const config = decodeConfigJson(row.config);
     expect(config.transport).toBe("stdio");
     expect(config.command).toBe("/usr/bin/server");
     after.close();

apps/local/src/server/migrate-openapi-bindings.test.ts+14−9

   n: Schema.Number,
 });
+const decodeBindingRows = Schema.decodeUnknownSync(Schema.Array(BindingRow));
+const decodeQueryParamRows = Schema.decodeUnknownSync(Schema.Array(QueryParamRow));
+const decodeFetchHeaderRows = Schema.decodeUnknownSync(Schema.Array(FetchHeaderRow));
+const decodeFetchQueryParamRows = Schema.decodeUnknownSync(Schema.Array(FetchQueryParamRow));
+const decodeTableInfoRows = Schema.decodeUnknownSync(Schema.Array(TableInfoRow));
+const decodeCountRow = Schema.decodeUnknownSync(CountRow);
 describe("0007_normalize_plugin_secret_refs (openapi)", () => {
   let dir: string;
   let dbPath: string;
     closeDatabase(drizzleSqlite);
     const after = openDatabase(dbPath, { readonly: true });
-    const rows = Schema.decodeUnknownSync(Schema.Array(BindingRow))(
+    const rows = decodeBindingRows(
       after
         .prepare(
           "SELECT id, kind, secret_id, connection_id, text_value FROM openapi_source_binding ORDER BY id",
       text_value: "literal",
     });
     // value json column dropped.
-    const cols = Schema.decodeUnknownSync(Schema.Array(TableInfoRow))(
+    const cols = decodeTableInfoRows(
       after.prepare("PRAGMA table_info('openapi_source_binding')").all(),
     );
     expect(cols.some((c) => c.name === "value")).toBe(false);
     const after = openDatabase(dbPath, { readonly: true });
-    const qpRows = Schema.decodeUnknownSync(Schema.Array(QueryParamRow))(
+    const qpRows = decodeQueryParamRows(
       after
         .prepare(
           "SELECT name, kind, text_value, secret_id FROM openapi_source_query_param WHERE source_id = ? ORDER BY name",
       text_value: "true",
     });
-    const fetchHeaders = Schema.decodeUnknownSync(Schema.Array(FetchHeaderRow))(
+    const fetchHeaders = decodeFetchHeaderRows(
       after
         .prepare(
           "SELECT name, kind, secret_id, secret_prefix FROM openapi_source_spec_fetch_header WHERE source_id = ?",
       secret_prefix: "Bearer ",
     });
-    const fetchQp = Schema.decodeUnknownSync(Schema.Array(FetchQueryParamRow))(
+    const fetchQp = decodeFetchQueryParamRows(
       after
         .prepare(
           "SELECT name, secret_id FROM openapi_source_spec_fetch_query_param WHERE source_id = ?",
     expect(fetchQp[0]).toMatchObject({ name: "token", secret_id: "fetch-qp" });
     // Old json columns dropped.
-    const cols = Schema.decodeUnknownSync(Schema.Array(TableInfoRow))(
+    const cols = decodeTableInfoRows(after.prepare("PRAGMA table_info('openapi_source')").all());
-      after.prepare("PRAGMA table_info('openapi_source')").all(),
-    );
     expect(cols.some((c) => c.name === "query_params")).toBe(false);
     expect(cols.some((c) => c.name === "invocation_config")).toBe(false);
   });
     closeDatabase(drizzleSqlite);
     const after = openDatabase(dbPath, { readonly: true });
-    const qpCount = Schema.decodeUnknownSync(CountRow)(
+    const qpCount = decodeCountRow(
       after
         .prepare("SELECT count(*) as n FROM openapi_source_query_param WHERE source_id = ?")
         .get("bare"),

packages/core/api/src/oauth-popup.test.ts+6−6

   refreshTokenSecretId: string | null;
 };
+const DomainErrorShape = Schema.Struct({
+  _tag: Schema.Literal("DomainError"),
+  message: Schema.String,
+});
+const isDomainError = Schema.is(DomainErrorShape);
 // ---------------------------------------------------------------------------
 // popupDocument
 // ---------------------------------------------------------------------------
     class DomainError extends Data.TaggedError("DomainError")<{
       readonly message: string;
     }> {}
-    const isDomainError = Schema.is(
-      Schema.Struct({
-        _tag: Schema.Literal("DomainError"),
-        message: Schema.String,
-      }),
-    );
     const html = await Effect.runPromise(
       runOAuthCallback<GoogleAuth, DomainError, never>({
         complete: () => Effect.fail(new DomainError({ message: "Code expired" })),

packages/core/api/src/observability.ts+3−1

  * widened `YieldableError` channel on `ExecutionEngineService` is
  * narrowed to `InternalError` before leaving the handler body.
  */
+const isInternalError = Schema.is(InternalError);
 export const captureEngineError = <A, R>(
   eff: Effect.Effect<A, Cause.YieldableError, R>,
 ): Effect.Effect<A, InternalError, R> =>
   eff.pipe(
     Effect.catch((err) =>
-      Schema.is(InternalError)(err)
+      isInternalError(err)
         ? Effect.fail(err)
         : resolveCapture.pipe(
             Effect.flatMap((c) => c.captureException(Cause.fail(err))),

packages/core/config/src/config.test.ts+5−3

   removeSecretFromConfig,
 } from "./write";
+const decodeExecutorFileConfig = Schema.decodeUnknownSync(ExecutorFileConfig);
 const withTmpDir = <A, E>(fn: (dir: string) => Effect.Effect<A, E, FileSystem.FileSystem>) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
 describe("ExecutorFileConfig schema", () => {
   it("decodes a minimal config", () => {
     const raw = { sources: [] };
-    const result = Schema.decodeUnknownSync(ExecutorFileConfig)(raw);
+    const result = decodeExecutorFileConfig(raw);
     expect(result.sources).toEqual([]);
   });
       },
     };
-    const result = Schema.decodeUnknownSync(ExecutorFileConfig)(raw);
+    const result = decodeExecutorFileConfig(raw);
     expect(result.sources).toHaveLength(4);
     expect(result.name).toBe("test");
     expect(result.secrets!["my-token"]!.name).toBe("My Token");
     const raw = {
       sources: [{ kind: "invalid", endpoint: "http://example.com" }],
     };
-    expect(() => Schema.decodeUnknownSync(ExecutorFileConfig)(raw)).toThrow();
+    expect(() => decodeExecutorFileConfig(raw)).toThrow();
   });
 });

packages/core/sdk/src/executor.ts+5−5

   runtime: true,
 });
+const decodeJsonFromString = Schema.decodeUnknownOption(Schema.UnknownFromJsonString);
 const decodeJsonColumn = (value: unknown): unknown => {
   if (value === null || value === undefined) return undefined;
   if (typeof value !== "string") return value;
-  return Schema.decodeUnknownOption(Schema.UnknownFromJsonString)(value).pipe(
+  return decodeJsonFromString(value).pipe(Option.getOrElse(() => value));
-    Option.getOrElse(() => value),
-  );
 };
+const decodeProviderState = Schema.decodeUnknownOption(ConnectionProviderState);
 const rowToTool = (row: ToolRow, annotations?: ToolAnnotations): Tool => ({
   id: row.id,
   sourceId: row.source_id,
     // behavior under the new SDK orchestration stays identical.
     const CONNECTION_REFRESH_SKEW_MS = 60_000;
-    const decodeProviderState = Schema.decodeUnknownOption(ConnectionProviderState);
     const rowToConnection = (row: ConnectionRow): ConnectionRef =>
       new ConnectionRef({
         id: ConnectionId.make(row.id),

packages/core/sdk/src/oauth-service.ts+15−17

 const decodeSessionPayload = Schema.decodeUnknownSync(OAuthSessionPayload);
 const encodeSessionPayload = Schema.encodeSync(OAuthSessionPayload);
+const UnknownFromJsonString = Schema.fromJsonString(Schema.Unknown);
+const decodeUnknownJsonOption = Schema.decodeUnknownOption(UnknownFromJsonString);
+const decodeProviderStateSync = Schema.decodeUnknownSync(OAuthProviderStateSchema);
+const encodeProviderStateSync = Schema.encodeSync(OAuthProviderStateSchema);
 const coerceJson = (value: unknown): unknown => {
   if (typeof value !== "string") return value;
-  return Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown))(value).pipe(
+  return decodeUnknownJsonOption(value).pipe(Option.getOrElse(() => value));
-    Option.getOrElse(() => value),
-  );
 };
 const stringArray = (value: unknown): readonly string[] =>
   if (record && !("kind" in record) && "flow" in record && "tokenUrl" in record) {
     const flow = record.flow;
     if (flow === "authorizationCode") {
-      return Schema.decodeUnknownSync(OAuthProviderStateSchema)({
+      return decodeProviderStateSync({
         kind: "authorization-code",
         tokenEndpoint: record.tokenUrl,
         issuerUrl: originOrNull(record.authorizationEndpoint),
       });
     }
     if (flow === "clientCredentials") {
-      return Schema.decodeUnknownSync(OAuthProviderStateSchema)({
+      return decodeProviderStateSync({
         kind: "client-credentials",
         tokenEndpoint: record.tokenUrl,
         clientIdSecretId: record.clientIdSecretId,
   if (record && !("kind" in record) && "clientIdSecretId" in record && "scopes" in record) {
     const scopes = stringArray(record.scopes);
-    return Schema.decodeUnknownSync(OAuthProviderStateSchema)({
+    return decodeProviderStateSync({
       kind: "authorization-code",
       tokenEndpoint: "https://oauth2.googleapis.com/token",
       issuerUrl: "https://accounts.google.com",
     const authorizationServerMetadata = isRecord(record.authorizationServerMetadata)
       ? record.authorizationServerMetadata
       : null;
-    return Schema.decodeUnknownSync(OAuthProviderStateSchema)({
+    return decodeProviderStateSync({
       kind: "dynamic-dcr",
       tokenEndpoint:
         typeof record.tokenEndpoint === "string"
     });
   }
-  return Schema.decodeUnknownSync(OAuthProviderStateSchema)(raw);
+  return decodeProviderStateSync(raw);
 };
 // ---------------------------------------------------------------------------
             refreshToken: null,
             expiresAt,
             oauthScope: tokens.scope ?? null,
-            providerState: Schema.encodeSync(OAuthProviderStateSchema)(providerState) as Record<
+            providerState: encodeProviderStateSync(providerState) as Record<string, unknown>,
-              string,
-              unknown
-            >,
           }),
         )
         .pipe(
               : null,
             expiresAt: connectionExpiresAt,
             oauthScope: exchangeResult.tokens.scope ?? null,
-            providerState: Schema.encodeSync(OAuthProviderStateSchema)(providerState) as Record<
+            providerState: encodeProviderStateSync(providerState) as Record<string, unknown>,
-              string,
-              unknown
-            >,
           }),
         )
         .pipe(
           refreshToken: tokens.refresh_token,
           expiresAt,
           oauthScope: tokens.scope ?? input.oauthScope,
-          providerState: Schema.encodeSync(OAuthProviderStateSchema)({
+          providerState: encodeProviderStateSync({
             ...state,
             tokenEndpoint,
             scope: tokens.scope ?? state.scope,

packages/core/storage-core/src/factory.ts+3−3

   return value;
 };
+const decodeJsonFromString = Schema.decodeUnknownOption(Schema.UnknownFromJsonString);
 // ---------------------------------------------------------------------------
 // Factory
 // ---------------------------------------------------------------------------
   };
   const decodeJsonFallback = (value: string): unknown =>
-    Schema.decodeUnknownOption(Schema.UnknownFromJsonString)(value).pipe(
+    decodeJsonFromString(value).pipe(Option.getOrElse((): unknown => value));
-      Option.getOrElse((): unknown => value),
-    );
   const decodeValue = (attr: DBFieldAttribute | undefined, value: unknown): unknown => {
     if (value === undefined || value === null) return value;

packages/plugins/google-discovery/src/react/AddGoogleDiscoverySource.tsx+5−7

 import { googleDiscoveryPresets, type GoogleDiscoveryPreset } from "../sdk/presets";
 const ErrorMessage = Schema.Struct({ message: Schema.String });
+const decodeErrorMessage = Schema.decodeUnknownOption(ErrorMessage);
 const errorMessageFromExit = (exit: Exit.Exit<unknown, unknown>, fallback: string): string =>
-  Option.match(
+  Option.match(Option.flatMap(Exit.findErrorOption(exit), decodeErrorMessage), {
-    Option.flatMap(Exit.findErrorOption(exit), Schema.decodeUnknownOption(ErrorMessage)),
+    onNone: () => fallback,
-    {
+    onSome: ({ message }) => message,
-      onNone: () => fallback,
+  });
-      onSome: ({ message }) => message,
-    },
-  );
 type GoogleAuthKind = "none" | "oauth2";

packages/plugins/graphql/src/react/AddGraphqlSource.tsx+5−7

 import type { HeaderValue } from "../sdk/types";
 const ErrorMessage = Schema.Struct({ message: Schema.String });
+const decodeErrorMessage = Schema.decodeUnknownOption(ErrorMessage);
 const errorMessageFromExit = (exit: Exit.Exit<unknown, unknown>, fallback: string): string =>
-  Option.match(
+  Option.match(Option.flatMap(Exit.findErrorOption(exit), decodeErrorMessage), {
-    Option.flatMap(Exit.findErrorOption(exit), Schema.decodeUnknownOption(ErrorMessage)),
+    onNone: () => fallback,
-    {
+    onSome: ({ message }) => message,
-      onNone: () => fallback,
+  });
-      onSome: ({ message }) => message,
-    },
-  );
 type AuthMode = "none" | "oauth2";

packages/plugins/graphql/src/sdk/store.ts+8−2

   readonly binding: OperationBinding;
 }
+const OperationBindingFromJsonString = Schema.fromJsonString(OperationBinding);
+const decodeOperationBindingFromJsonString = Schema.decodeUnknownSync(
+  OperationBindingFromJsonString,
+);
+const decodeOperationBinding = Schema.decodeUnknownSync(OperationBinding);
 const decodeBinding = (value: unknown): OperationBinding => {
   if (typeof value === "string") {
-    return Schema.decodeUnknownSync(Schema.fromJsonString(OperationBinding))(value);
+    return decodeOperationBindingFromJsonString(value);
   }
-  return Schema.decodeUnknownSync(OperationBinding)(value);
+  return decodeOperationBinding(value);
 };
 const encodeBinding = Schema.encodeSync(OperationBinding);

packages/plugins/mcp/src/react/AddMcpSource.tsx+5−7

 import { mcpPresets, type McpPreset } from "../sdk/presets";
 const ErrorMessage = Schema.Struct({ message: Schema.String });
+const decodeErrorMessage = Schema.decodeUnknownOption(ErrorMessage);
 const errorMessageFromExit = (exit: Exit.Exit<unknown, unknown>, fallback: string): string =>
-  Option.match(
+  Option.match(Option.flatMap(Exit.findErrorOption(exit), decodeErrorMessage), {
-    Option.flatMap(Exit.findErrorOption(exit), Schema.decodeUnknownOption(ErrorMessage)),
+    onNone: () => fallback,
-    {
+    onSome: ({ message }) => message,
-      onNone: () => fallback,
+  });
-      onSome: ({ message }) => message,
-    },
-  );
 // ---------------------------------------------------------------------------
 // Preset lookup

packages/plugins/openapi/src/react/AddOpenApiSource.tsx+5−7

 export const OPENAPI_OAUTH_CALLBACK_PATH = "/api/oauth/callback";
 const ErrorMessage = Schema.Struct({ message: Schema.String });
+const decodeErrorMessage = Schema.decodeUnknownOption(ErrorMessage);
 const errorMessageFromExit = (exit: Exit.Exit<unknown, unknown>, fallback: string): string =>
-  Option.match(
+  Option.match(Option.flatMap(Exit.findErrorOption(exit), decodeErrorMessage), {
-    Option.flatMap(Exit.findErrorOption(exit), Schema.decodeUnknownOption(ErrorMessage)),
+    onNone: () => fallback,
-    {
+    onSome: ({ message }) => message,
-      onNone: () => fallback,
+  });
-      onSome: ({ message }) => message,
-    },
-  );
 const substituteUrlVariables = (url: string, values: Record<string, string>): string => {
   let out = url;

packages/plugins/openapi/src/react/EditOpenApiSource.tsx+8−9

 } from "../sdk/types";
 const ErrorMessage = Schema.Struct({ message: Schema.String });
+const decodeErrorMessage = Schema.decodeUnknownOption(ErrorMessage);
+const isOpenApiSourceBindingValue = Schema.is(OpenApiSourceBindingValue);
 const errorMessageFromExit = (exit: Exit.Exit<unknown, unknown>, fallback: string): string =>
-  Option.match(
+  Option.match(Option.flatMap(Exit.findErrorOption(exit), decodeErrorMessage), {
-    Option.flatMap(Exit.findErrorOption(exit), Schema.decodeUnknownOption(ErrorMessage)),
+    onNone: () => fallback,
-    {
+    onSome: ({ message }) => message,
-      onNone: () => fallback,
+  });
-      onSome: ({ message }) => message,
-    },
-  );
 type SlotDef =
   | {
 const isSecretBindingValue = (
   value: unknown,
 ): value is Extract<OpenApiSourceBindingValueType, { readonly kind: "secret" }> =>
-  Schema.is(OpenApiSourceBindingValue)(value) && value.kind === "secret";
+  isOpenApiSourceBindingValue(value) && value.kind === "secret";
 const isConnectionBindingValue = (
   value: unknown,
 ): value is Extract<OpenApiSourceBindingValueType, { readonly kind: "connection" }> =>
-  Schema.is(OpenApiSourceBindingValue)(value) && value.kind === "connection";
+  isOpenApiSourceBindingValue(value) && value.kind === "connection";
 export default function EditOpenApiSource(props: {
   readonly sourceId: string;

packages/plugins/openapi/src/sdk/non-json-body.test.ts+3−2

     name: Schema.String,
   }),
 );
+const decodeJsonNameBody = Schema.decodeUnknownSync(JsonNameBody);
 const memoryProvider: SecretProvider = (() => {
   const store = new Map<string, string>();
       expect(captured.contentType).toBe("text/xml");
       const body = captured.body.toString("utf8");
       expect(body).not.toBe("[object Object]");
-      expect(Schema.decodeUnknownSync(JsonNameBody)(body)).toEqual({ name: "Acme" });
+      expect(decodeJsonNameBody(body)).toEqual({ name: "Acme" });
     }),
   );
       );
       expect(captured.contentType).toBe("application/json");
-      expect(Schema.decodeUnknownSync(JsonNameBody)(captured.body.toString("utf8"))).toEqual({
+      expect(decodeJsonNameBody(captured.body.toString("utf8"))).toEqual({
         name: "Acme",
       });
     }),

packages/plugins/openapi/src/sdk/store.ts+3−1

@@ -287,8 +287,10 @@ const SourceNameStorageRow = Schema.Struct({ · 286 unmodified lines
287	});	287	});
288	const decodeSourceNameStorageRow = Schema.decodeUnknownSync(SourceNameStorageRow);	288	const decodeSourceNameStorageRow = Schema.decodeUnknownSync(SourceNameStorageRow);
289		289
		290	const decodeStorageString = Schema.decodeUnknownSync(Schema.String);
		291
290	const decodeStorageDate = (value: unknown): Date =>	292	const decodeStorageDate = (value: unknown): Date =>
291	value instanceof Date ? value : new Date(Schema.decodeUnknownSync(Schema.String)(value));	293	value instanceof Date ? value : new Date(decodeStorageString(value));
292		294
293	interface ChildRow {	295	interface ChildRow {
294	readonly id: string;	296	readonly id: string;

packages/plugins/workos-vault/src/sdk/client.ts+2−1

 const CauseWithStatusSchema = Schema.Struct({
   status: Schema.Number,
 });
+const decodeCauseWithStatusOption = Schema.decodeUnknownOption(CauseWithStatusSchema);
 const statusFromWorkOSCause = (cause: unknown): number | undefined => {
   if (cause instanceof GenericServerException || cause instanceof NotFoundException) {
     return cause.status;
   }
-  return Option.match(Schema.decodeUnknownOption(CauseWithStatusSchema)(cause), {
+  return Option.match(decodeCauseWithStatusOption(cause), {
     onNone: () => undefined,
     onSome: (decoded) => decoded.status,
   });

scripts/oxlint-plugin-executor.js+2−0

 import noEffectInternalTags from "./oxlint-plugin-executor/rules/no-effect-internal-tags.js";
 import noErrorConstructor from "./oxlint-plugin-executor/rules/no-error-constructor.js";
 import noInlineObjectTypeAssertion from "./oxlint-plugin-executor/rules/no-inline-object-type-assertion.js";
+import noInlineSchemaCompile from "./oxlint-plugin-executor/rules/no-inline-schema-compile.js";
 import noInstanceofError from "./oxlint-plugin-executor/rules/no-instanceof-error.js";
 import noInstanceofTaggedError from "./oxlint-plugin-executor/rules/no-instanceof-tagged-error.js";
 import noJsonParse from "./oxlint-plugin-executor/rules/no-json-parse.js";
     "no-error-constructor": noErrorConstructor,
     "no-ts-nocheck": noTsNocheck,
     "no-inline-object-type-assertion": noInlineObjectTypeAssertion,
+    "no-inline-schema-compile": noInlineSchemaCompile,
     "no-instanceof-error": noInstanceofError,
     "no-instanceof-tagged-error": noInstanceofTaggedError,
     "no-json-parse": noJsonParse,

scripts/oxlint-plugin-executor/rules/no-inline-schema-compile.js+104−0

@@ -0,0 +1,104 @@
	1	import { getPropertyName, isIdentifier, unwrapExpression } from "../utils.js";
	2
	3	// Schema methods that compile a parser/guard from a schema. Calling these
	4	// allocates a new function per invocation; the result should be hoisted to
	5	// module (or at least closure) scope.
	6	const COMPILER_METHODS = new Set([
	7	"is",
	8	"asserts",
	9	"decode",
	10	"decodeSync",
	11	"decodePromise",
	12	"decodeOption",
	13	"decodeEither",
	14	"decodeUnknown",
	15	"decodeUnknownSync",
	16	"decodeUnknownPromise",
	17	"decodeUnknownOption",
	18	"decodeUnknownEither",
	19	"encode",
	20	"encodeSync",
	21	"encodePromise",
	22	"encodeOption",
	23	"encodeEither",
	24	"encodeUnknown",
	25	"encodeUnknownSync",
	26	"encodeUnknownPromise",
	27	"encodeUnknownOption",
	28	"encodeUnknownEither",
	29	"validate",
	30	"validateSync",
	31	"validatePromise",
	32	"validateOption",
	33	"validateEither",
	34	"parse",
	35	"parseSync",
	36	"parsePromise",
	37	"parseOption",
	38	"parseEither",
	39	]);
	40
	41	const getSchemaCompilerMethod = (callee) => {
	42	const expression = unwrapExpression(callee);
	43	if (expression?.type !== "MemberExpression") return undefined;
	44	const object = unwrapExpression(expression.object);
	45	if (!isIdentifier(object, "Schema")) return undefined;
	46	const method = getPropertyName(expression.property);
	47	return method && COMPILER_METHODS.has(method) ? method : undefined;
	48	};
	49
	50	const isNestedSchemaCall = (node) => {
	51	const expression = unwrapExpression(node);
	52	if (expression?.type !== "CallExpression") return false;
	53	const callee = unwrapExpression(expression.callee);
	54	if (callee?.type !== "MemberExpression") return false;
	55	const object = unwrapExpression(callee.object);
	56	return isIdentifier(object, "Schema");
	57	};
	58
	59	const messageHigh = (method) =>
	60	`Hoist Schema.${method}(...) to module scope: both the inline schema literal and the compiled function are rebuilt on every call. Move the compiled function to a module-level const.`;
	61
	62	const messageMedium = (method) =>
	63	`Hoist Schema.${method}(...) to module scope: the compiled function is rebuilt on every call. Move it to a module-level const.`;
	64
	65	export default {
	66	meta: {
	67	type: "problem",
	68	docs: {
	69	description:
	70	"Disallow Schema compiler calls (Schema.is/decode/encode/validate/parse) inside function bodies; hoist them to module scope.",
	71	},
	72	},
	73	create(context) {
	74	let functionDepth = 0;
	75
	76	const enterFunction = () => {
	77	functionDepth++;
	78	};
	79	const exitFunction = () => {
	80	functionDepth--;
	81	};
	82
	83	return {
	84	FunctionDeclaration: enterFunction,
	85	"FunctionDeclaration:exit": exitFunction,
	86	FunctionExpression: enterFunction,
	87	"FunctionExpression:exit": exitFunction,
	88	ArrowFunctionExpression: enterFunction,
	89	"ArrowFunctionExpression:exit": exitFunction,
	90
	91	CallExpression(node) {
	92	if (functionDepth === 0) return;
	93	const method = getSchemaCompilerMethod(node.callee);
	94	if (!method) return;
	95	const firstArg = node.arguments[0];
	96	const high = firstArg && isNestedSchemaCall(firstArg);
	97	context.report({
	98	node: node.callee,
	99	message: high ? messageHigh(method) : messageMedium(method),
	100	});
	101	},
	102	};
	103	},
	104	};