Validate eval/rsg_version against firmware lifecycle

[chrisdp]

Summary

Adds firmware-aware diagnostics for eval(...) calls and the manifest's rsg_version entry, driven by lifecycle metadata in a new src/RokuConstants.ts.

What this catches

Code	Manifest	minFirmwareVersion	Outcome
1147 evalIsDeprecatedAtRsgVersion	(any)	resolves to rsg_version ≥ 1.2	flag every eval(...) call as removed
1148 rsgVersionRequiresMinFirmware	rsg_version=1.3	< 15.0	flag manifest
1149 invalidRsgVersionFormat	rsg_version=banana	(any)	warning on the manifest line
1150 rsgVersionDeprecated	rsg_version=1.2	≥ 15.1	suggest upgrading to 1.3
1151 rsgVersionRemoved	rsg_version=1.0	≥ 9.0	error: device no longer honors the entry
1151 rsgVersionRemoved	rsg_version=1.1	≥ 14.5	error: silently treated as 1.2

Default-firmware behavior change

When the user hasn't configured minFirmwareVersion, brighterscript now assumes a default of 15.0.0 so these diagnostics are useful out of the box. Users targeting older firmware can opt out by setting minFirmwareVersion explicitly.

This also affects the existing optional-chaining FW check (BrsFileValidator.ts) — same default applied uniformly via the new Program.getEffectiveMinFirmwareVersion() helper.

Implementation

• src/RokuConstants.ts — single source of truth for RSG version lifecycle (introducedAt / becameDefaultAt / deprecatedAt / removedAt / replacement), DEFAULT_MIN_FIRMWARE_VERSION, OPTIONAL_CHAINING_MIN_FIRMWARE_VERSION, EVAL_REMOVED_AT_RSG_VERSION. Adding a new RSG version is one entry there; downstream validators pick it up.
• Manifest.ts — adds parseManifestEntries() (line-aware) alongside the existing parseManifest(). Public API unchanged.
• Program.ts — adds getEffectiveMinFirmwareVersion() (sanitizes garbage input → DEFAULT) and getRsgVersion() (data-driven default selection). Both getManifestEntries() and getManifestPath() are protected for now — no stable public API yet, will firm up when the manifest gets proper file-tracking support.
• ProgramValidator.ts — new manifest validator deriving diagnostics from RSG_VERSIONS. Removal takes precedence over deprecation; deprecation only fires when the user's effective firmware actually meets the deprecation threshold (so users on pre-deprecation firmware aren't nagged).
• BrsFileValidator.ts — adds validateEvalIsNotDeprecated next to the existing optional-chaining check; both route through getEffectiveMinFirmwareVersion().

Sources for lifecycle data

• Declare RSG 1.3 support by October 1, 2026 (Roku dev blog)
• Roku SceneGraph 1.1 apps sunset
• Roku Channel Manifest docs
• Roku OS 9 / 14.5 release notes for the eval and 1.1-substitution timelines

Known gaps / TODOs

These are documented inline so we can revisit as the manifest infrastructure matures:

• Manifest isn't a tracked file — diagnostics use a { srcPath, pkgPath } stub. Should be replaced by proper file tracking. Code actions for manifest diagnostics are deferred until then.
• getManifestEntries / getManifestPath accessed via bracket notation — protected for now to avoid committing to a public API.
• becameDefaultAt semantically broadened — for 1.0/1.1/1.2 it's "device silent fallback"; for 1.3 it's "Roku's cert-policy expected default" (since 1.3 isn't a runtime default but is required by Roku's static analysis tool). TODO comment in RokuConstants flags this for confirmation with Roku.

Test plan

• npm test — 2808 passing (+ ~40 new), 0 failing
• npm run lint — clean
• Per-version test coverage in ProgramValidator.spec.ts (every diagnostic in fire/don't-fire scenarios across firmware windows)
• eval validator tests in BrsFileValidator.spec.ts covering manifest-explicit / manifest-silent / dotted-method / case-insensitive
• parseManifestEntries line-aware parser tests
• Program.getRsgVersion / getEffectiveMinFirmwareVersion sanitization tests

🤖 Generated with Claude Code