@bleedingdev/modern-js-code-tools 3.9.3-ultramodern.1 → 3.9.3-ultramodern.10

package/dist/cjs/microvertical-api-baseline.cjs

@@ -28,8 +28,10 @@ var __webpack_require__ = {};
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
+    camelCaseStem: ()=>camelCaseStem,
     configuredMicroVerticalApiStem: ()=>configuredMicroVerticalApiStem,
-    microVerticalApiBaselineViolation: ()=>microVerticalApiBaselineViolation
+    microVerticalApiBaselineViolation: ()=>microVerticalApiBaselineViolation,
+    pascalCaseStem: ()=>pascalCaseStem
 });
 const types_namespaceObject = require("@babel/types");
 const external_microvertical_api_owner_cjs_namespaceObject = require("./microvertical-api-owner.cjs");
@@ -503,11 +505,15 @@ const microVerticalApiBaselineViolation = (stem, filePath, expectation)=>{
         throw error;
     }
 };
+exports.camelCaseStem = __webpack_exports__.camelCaseStem;
 exports.configuredMicroVerticalApiStem = __webpack_exports__.configuredMicroVerticalApiStem;
 exports.microVerticalApiBaselineViolation = __webpack_exports__.microVerticalApiBaselineViolation;
+exports.pascalCaseStem = __webpack_exports__.pascalCaseStem;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "camelCaseStem",
     "configuredMicroVerticalApiStem",
-    "microVerticalApiBaselineViolation"
+    "microVerticalApiBaselineViolation",
+    "pascalCaseStem"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {
     value: true

package/dist/cjs/microvertical-api-boundary.cjs

@@ -64,6 +64,14 @@ const ignored = new Set([
     'node_modules',
     'repos'
 ]);
+const MAX_CLOSURE_DEPTH = 128;
+const MAX_CLOSURE_MODULES = 2048;
+const MAX_API_HOPS = 128;
+const MAX_API_VISITS = 2048;
+const identitySources = [
+    'effect',
+    'effect/Function'
+];
 const normalize = (file)=>file.split(external_node_path_default().sep).join('/').replace(/^\.\//u, '');
 const errorMessage = (error)=>error instanceof Error ? error.message : String(error);
 const apiApp = (app)=>'vertical' === app.kind && 'ui-only' !== app.surfaceProfile && 'horizontal-remote' !== app.deliveryUnitKind;
@@ -129,7 +137,7 @@ function configuredApps(root, supplied) {
         };
         for (const field of Object.keys(allowedFields)){
             const value = app[field];
-            if (void 0 !== value && !allowedFields[field].includes(value)) throw new Error(`${key}: invalid ${field}`);
+            if ((void 0 !== value || 'kind' === field) && ('string' != typeof value || !allowedFields[field].includes(value))) throw new Error(`${key}: invalid ${field}`);
         }
         if (void 0 !== app.api) {
             if (!app.api || 'object' != typeof app.api || Array.isArray(app.api)) throw new Error(`${key}: api must be an object`);
@@ -171,6 +179,9 @@ function check(options, topology) {
     };
     try {
         const apps = configuredApps(root, options.configuredApps);
+        const workspace = external_node_fs_default().realpathSync(root);
+        const realRelative = (file)=>normalize(external_node_path_default().relative(workspace, external_node_fs_default().realpathSync(absolute(file))));
+        const inside = (directory, real)=>real.startsWith(`${directory}${external_node_path_default().sep}`);
         const byPath = new Map(apps.map((app)=>[
                 normalize(app.path),
                 app
@@ -211,12 +222,19 @@ function check(options, topology) {
         const resolveRelative = (fromFile, specifier)=>{
             if (!/^\.\.?\//u.test(specifier)) return;
             const base = external_node_path_default().posix.join(external_node_path_default().posix.dirname(fromFile), specifier).replace(/\.(?:[cm]?[jt]sx?)$/u, '');
-            return [
+            const candidate = [
                 `${base}.ts`,
                 `${base}.tsx`,
                 `${base}/index.ts`,
                 `${base}/index.tsx`
-            ].find((candidate)=>exists(candidate));
+            ].find((file)=>exists(file));
+            return void 0 === candidate ? void 0 : realRelative(candidate);
+        };
+        const graphBinding = (graph, module, expression, seen = new Set())=>{
+            if (seen.has(expression) || seen.size >= 128) return;
+            seen.add(expression);
+            const binding = types_namespaceObject.isIdentifier(expression) || types_namespaceObject.isMemberExpression(expression) ? graph.resolveReference(module, expression) : void 0;
+            return binding?.kind === 'declaration' && (types_namespaceObject.isIdentifier(binding.expression) || types_namespaceObject.isMemberExpression(binding.expression)) ? graphBinding(graph, binding.module, binding.expression, seen) : binding;
         };
         const clientExportFile = (appPath, exported)=>{
             if ('string' != typeof exported || !exported.startsWith('./') || exported.split(/[\\/]/u).includes('..') || !/\.[cm]?[jt]sx?$/u.test(exported)) return;
@@ -233,29 +251,209 @@ function check(options, topology) {
             return normalize(external_node_path_default().relative(root, candidate));
         };
         const composedModules = (file, appPath)=>{
-            const order = [];
-            const seen = new Set();
+            const owner = external_node_fs_default().realpathSync(absolute(appPath));
+            if (!inside(owner, external_node_fs_default().realpathSync(absolute(file)))) throw new Error(`consumer module closure escapes its owner: ${file}`);
+            const entry = realRelative(file);
+            const discovered = new Set([
+                entry
+            ]);
             const queue = [
-                file
+                {
+                    file: entry,
+                    depth: 0
+                }
             ];
-            const owner = external_node_fs_default().realpathSync(absolute(appPath));
-            while(queue.length > 0 && order.length < 128){
-                const current = queue.shift();
-                if (seen.has(current)) continue;
-                seen.add(current);
-                order.push(current);
+            let graph;
+            for (const { file: current, depth } of queue){
                 const ast = parseFile(current);
                 if (!ast) continue;
-                for (const statement of ast.program.body){
-                    const source = (types_namespaceObject.isImportDeclaration(statement) || types_namespaceObject.isExportNamedDeclaration(statement) || types_namespaceObject.isExportAllDeclaration(statement)) && statement.source ? statement.source.value : void 0;
-                    const resolved = void 0 === source ? void 0 : resolveRelative(current, source);
-                    if (void 0 !== resolved && !seen.has(resolved)) {
-                        const real = external_node_fs_default().realpathSync(absolute(resolved));
-                        if (real.startsWith(`${owner}${external_node_path_default().sep}`)) queue.push(resolved);
+                const sources = [];
+                let callsRequire = false;
+                for (const statement of ast.program.body)if (types_namespaceObject.isImportDeclaration(statement) && 'type' !== statement.importKind && 'typeof' !== statement.importKind || (types_namespaceObject.isExportNamedDeclaration(statement) || types_namespaceObject.isExportAllDeclaration(statement)) && 'type' !== statement.exportKind && statement.source) sources.push(statement.source.value);
+                types_namespaceObject.traverseFast(ast, (node)=>{
+                    if (types_namespaceObject.isImportExpression(node)) {
+                        if (!types_namespaceObject.isStringLiteral(node.source)) throw new Error(`consumer module closure has nonliteral runtime dependency: ${current}`);
+                        sources.push(node.source.value);
+                    }
+                    if ((types_namespaceObject.isCallExpression(node) || types_namespaceObject.isOptionalCallExpression(node)) && types_namespaceObject.isIdentifier((0, external_source_analysis_cjs_namespaceObject.unwrapExpression)(node.callee, true), {
+                        name: 'require'
+                    })) callsRequire = true;
+                });
+                if (callsRequire) {
+                    graph ??= (0, external_module_graph_cjs_namespaceObject.createModuleGraph)();
+                    const module = graph.module(absolute(current));
+                    types_namespaceObject.traverseFast(module.file, (node)=>{
+                        if (!types_namespaceObject.isCallExpression(node) && !types_namespaceObject.isOptionalCallExpression(node)) return;
+                        const callee = (0, external_source_analysis_cjs_namespaceObject.unwrapExpression)(node.callee, true);
+                        if (!types_namespaceObject.isIdentifier(callee, {
+                            name: 'require'
+                        }) || !graph.isUnboundReference(module, callee)) return;
+                        const [argument] = node.arguments;
+                        if (1 !== node.arguments.length || !types_namespaceObject.isStringLiteral(argument)) throw new Error(`consumer module closure has nonliteral runtime dependency: ${current}`);
+                        sources.push(argument.value);
+                    });
+                }
+                for (const source of sources){
+                    if (!/^\.\.?\//u.test(source)) continue;
+                    const resolved = resolveRelative(current, source);
+                    if (void 0 === resolved) throw new Error(`consumer module closure has unresolved relative dependency: ${current} -> ${source}`);
+                    if (!inside(owner, external_node_path_default().join(workspace, resolved))) throw new Error(`consumer module closure escapes its owner: ${current} -> ${source}`);
+                    if (!discovered.has(resolved)) {
+                        if (depth + 1 >= MAX_CLOSURE_DEPTH) throw new Error(`consumer module closure exceeds ${MAX_CLOSURE_DEPTH} import-depth analysis budget`);
+                        if (discovered.size >= MAX_CLOSURE_MODULES) throw new Error(`consumer module closure exceeds ${MAX_CLOSURE_MODULES}-module analysis budget`);
+                        discovered.add(resolved);
+                        queue.push({
+                            file: resolved,
+                            depth: depth + 1
+                        });
+                    }
+                }
+            }
+            return queue.map((item)=>item.file);
+        };
+        const foreignClientConstructions = (client, appPath, contract, stem, rpc)=>{
+            const graph = (0, external_module_graph_cjs_namespaceObject.createModuleGraph)();
+            const contractModule = graph.module(absolute(contract));
+            const factory = rpc ? 'makeEffectRpcClient' : 'makeEffectHttpApiClient';
+            const ownExport = graph.resolve(contractModule, rpc ? `${(0, external_microvertical_api_baseline_cjs_namespaceObject.pascalCaseStem)(stem)}RpcGroup` : `${(0, external_microvertical_api_baseline_cjs_namespaceObject.camelCaseStem)(stem)}Api`, 'export');
+            const isIdentity = (value)=>'external' === value.kind && identitySources.includes(value.specifier) && 'identity' === value.name && 0 === value.members.length;
+            const identityPipe = (module, node)=>{
+                if (!types_namespaceObject.isCallExpression(node) || !types_namespaceObject.isMemberExpression(node.callee) || node.callee.computed || !types_namespaceObject.isIdentifier(node.callee.property, {
+                    name: 'pipe'
+                }) || 1 !== node.arguments.length) return false;
+                const values = graph.evaluate(module, node.arguments[0]);
+                return values.length > 0 && values.every(isIdentity);
+            };
+            const withoutIdentity = (module, value)=>{
+                let node = (0, external_source_analysis_cjs_namespaceObject.unwrapExpression)(value, true);
+                for(let pipes = 0; identityPipe(module, node); pipes += 1){
+                    if (pipes >= MAX_API_HOPS) return value;
+                    node = (0, external_source_analysis_cjs_namespaceObject.unwrapExpression)(node.callee.object, true);
+                }
+                return node;
+            };
+            const normalizedApi = (initial)=>{
+                let binding = initial;
+                const seen = new Set();
+                for(let hops = 0; hops < MAX_API_HOPS; hops += 1){
+                    const expression = withoutIdentity(binding.module, binding.expression);
+                    if (seen.has(expression)) break;
+                    seen.add(expression);
+                    if (!types_namespaceObject.isIdentifier(expression) && !types_namespaceObject.isMemberExpression(expression)) return {
+                        ...binding,
+                        expression: expression
+                    };
+                    const next = graphBinding(graph, binding.module, expression);
+                    if (next?.kind !== 'declaration') break;
+                    binding = next;
+                }
+            };
+            const apiBinding = (module, value)=>{
+                const binding = graphBinding(graph, module, withoutIdentity(module, value));
+                return binding?.kind === 'declaration' ? normalizedApi(binding) : void 0;
+            };
+            const ownedApis = new Map();
+            const own = (binding)=>{
+                const identities = ownedApis.get(binding.module.path) ?? new Set();
+                identities.add(binding.expression);
+                ownedApis.set(binding.module.path, identities);
+            };
+            const proven = new Set();
+            const active = new Set();
+            let visits = 0;
+            const builtApi = (module, expression)=>{
+                const initial = withoutIdentity(module, expression);
+                if (active.has(initial) || active.size >= MAX_API_HOPS) return false;
+                active.add(initial);
+                try {
+                    const children = [];
+                    for(let node = initial;;){
+                        if (++visits > MAX_API_VISITS) return false;
+                        if (types_namespaceObject.isIdentifier(node) || types_namespaceObject.isMemberExpression(node)) {
+                            const receiver = apiBinding(module, node);
+                            if (!receiver || !builtApi(receiver.module, receiver.expression)) return false;
+                            break;
+                        }
+                        if (!types_namespaceObject.isCallExpression(node)) return false;
+                        const callee = graph.evaluate(module, node.callee);
+                        if (callee.length > 0 && callee.every((value)=>'external' === value.kind && httpApiSources.includes(value.specifier) && 'HttpApi' === value.name && 1 === value.members.length && 'make' === value.members[0])) {
+                            if (1 !== node.arguments.length || !types_namespaceObject.isStringLiteral(node.arguments[0])) return false;
+                            break;
+                        }
+                        if (!types_namespaceObject.isMemberExpression(node.callee) || node.callee.computed || !types_namespaceObject.isIdentifier(node.callee.property)) return false;
+                        const method = node.callee.property.name;
+                        const count = node.arguments.length;
+                        const [first] = node.arguments;
+                        if ('addHttpApi' === method && 1 === count) children.push(first);
+                        else if (!('add' === method && count > 0 || 'annotate' === method && 2 === count || [
+                            'annotateMerge',
+                            'middleware'
+                        ].includes(method) && 1 === count || 'prefix' === method && 1 === count && types_namespaceObject.isStringLiteral(first) && first.value.startsWith('/'))) return false;
+                        node = withoutIdentity(module, node.callee.object);
                     }
+                    return children.every((child)=>{
+                        const binding = apiBinding(module, child);
+                        return void 0 !== binding && collectApi(binding);
+                    });
+                } finally{
+                    active.delete(initial);
                 }
+            };
+            const collectApi = (binding)=>{
+                if (proven.has(binding.expression)) return true;
+                if (!builtApi(binding.module, binding.expression)) return false;
+                proven.add(binding.expression);
+                if (binding.module.boundary === contractModule.boundary) own(binding);
+                return true;
+            };
+            if (!rpc && ownExport?.kind === 'declaration') {
+                const root = normalizedApi(ownExport);
+                if (root && collectApi(root)) own(root);
+                else ownedApis.clear();
+            }
+            const immutablePipeAliases = (module, target)=>{
+                if (0 === module.mutations.length) return true;
+                let valid = true;
+                types_namespaceObject.traverseFast(module.file, (node)=>{
+                    if (!types_namespaceObject.isVariableDeclarator(node) || !types_namespaceObject.isIdentifier(node.id) || !node.init) return;
+                    let initializer = (0, external_source_analysis_cjs_namespaceObject.unwrapExpression)(node.init, true);
+                    let identityOnly = true;
+                    let piped = false;
+                    while(types_namespaceObject.isCallExpression(initializer) && types_namespaceObject.isMemberExpression(initializer.callee) && !initializer.callee.computed && types_namespaceObject.isIdentifier(initializer.callee.property, {
+                        name: 'pipe'
+                    })){
+                        piped = true;
+                        identityOnly &&= identityPipe(module, initializer);
+                        initializer = (0, external_source_analysis_cjs_namespaceObject.unwrapExpression)(initializer.callee.object, true);
+                    }
+                    if (!piped) return;
+                    const receiver = apiBinding(module, initializer);
+                    if (receiver?.module.path !== target.module.path || receiver.expression !== target.expression) return;
+                    if (!identityOnly || graph.resolveReference(module, node.id)?.kind !== 'declaration') valid = false;
+                });
+                return valid;
+            };
+            const ownedBy = (module, argument)=>{
+                if (!argument) return false;
+                if (rpc) {
+                    const binding = graphBinding(graph, module, argument);
+                    return binding?.kind === 'declaration' && ownExport?.kind === 'declaration' && binding.module.path === ownExport.module.path && binding.expression === ownExport.expression;
+                }
+                const binding = apiBinding(module, argument);
+                return void 0 !== binding && !!ownedApis.get(binding.module.path)?.has(binding.expression) && immutablePipeAliases(module, binding);
+            };
+            const violations = new Set();
+            for (const source of composedModules(client, appPath)){
+                const module = graph.module(absolute(source));
+                types_namespaceObject.traverseFast(module.file, (node)=>{
+                    if (!types_namespaceObject.isCallExpression(node) && !types_namespaceObject.isOptionalCallExpression(node)) return;
+                    const native = graph.evaluate(module, node.callee).some((value)=>'external' === value.kind && value.specifier === effect && value.name === factory);
+                    if (native && !ownedBy(module, node.arguments[0])) violations.add(`${source}: must construct the client from its own API contract`);
+                });
             }
-            return order;
+            return [
+                ...violations
+            ];
         };
         const moduleShape = (file, imports, calls, patterns = [], defaultExport, composedAppPath)=>{
             if (!exists(file)) return;
@@ -294,6 +492,14 @@ function check(options, topology) {
                 })), `${file}: must default-export ${defaultExport}`);
         };
         const effect = '@modern-js/bff-effect/effect-client';
+        const httpApiSources = [
+            effect,
+            'effect/http-api'
+        ];
+        const clientFactories = new Set([
+            'makeEffectHttpApiClient',
+            'makeEffectRpcClient'
+        ]);
         const appDirectories = [
             ...new Set([
                 ...directories('apps'),
@@ -471,6 +677,7 @@ function check(options, topology) {
                 ], [
                     rpc ? 'makeEffectRpcClient' : 'makeEffectHttpApiClient'
                 ], [], void 0, appPath);
+                if (exists(contract)) diagnostics.push(...foreignClientConstructions(client, appPath, contract, stem, rpc));
             }
             moduleShape(`${appPath}/api/effect-api.ts`, [], [], [
                 [
@@ -514,8 +721,8 @@ function check(options, topology) {
             ]);
         });
         const sourceRules = options.sourceRules ?? [];
-        const graph = (0, external_module_graph_cjs_namespaceObject.createModuleGraph)();
         for (const file of sourceRules.length ? sourceFiles : [])if (/\.[cm]?[jt]sx?$/u.test(file)) guarded(file, ()=>{
+            const graph = (0, external_module_graph_cjs_namespaceObject.createModuleGraph)();
             let module;
             try {
                 module = graph.module(absolute(file));
@@ -534,20 +741,178 @@ function check(options, topology) {
                 for (const message of messages)diagnostics.push(`${file}: ${message}`);
             }
         });
-        const shell = 'apps/shell-super-app';
-        const verticals = apps.filter((app)=>app.path.startsWith('verticals/') && apiApp(app));
-        if (exists(shell) && verticals.length) {
-            const file = `${shell}/src/api/vertical-clients.ts`;
-            assert(exists(file), `${file}: must aggregate vertical API clients`);
-            if (exists(file)) guarded(file, ()=>{
-                const ast = parseFile(file);
-                for (const app of verticals){
-                    const specifier = `${app.package}/api/${app.api?.protocol === 'rpc' ? 'rpc-client' : 'client'}`;
-                    assert(ast?.program.body.some((item)=>types_namespaceObject.isExportNamedDeclaration(item) && item.source?.value === specifier), `${file}: must re-export ${specifier}`);
+        const checkShellExports = (shellPath)=>{
+            const packageFile = `${shellPath}/package.json`;
+            const manifest = JSON.parse(read(packageFile));
+            noPath(`${shellPath}/src/api/vertical-clients.ts`, 'Shell client registries are forbidden; import each owner client directly');
+            assert(!Object.hasOwn(manifest.exports ?? {}, './api/clients'), `${packageFile}: Shell ./api/clients exports are forbidden`);
+            const owner = external_node_fs_default().realpathSync(absolute(shellPath));
+            const invalidExport = ()=>assert(false, `${packageFile}: invalid Shell public source export`);
+            const targets = (exported)=>'string' == typeof exported ? [
+                    exported
+                ] : exported && 'object' == typeof exported ? Object.values(exported).flatMap(targets) : [];
+            const filesUnder = (directory, seen = new Set())=>{
+                const real = external_node_fs_default().realpathSync(absolute(directory));
+                if (real !== owner && !inside(owner, real)) {
+                    invalidExport();
+                    return [];
                 }
-            });
+                if (seen.has(real)) return [];
+                seen.add(real);
+                return external_node_fs_default().readdirSync(absolute(directory), {
+                    withFileTypes: true
+                }).flatMap((entry)=>{
+                    if (ignored.has(entry.name)) return [];
+                    const file = `${directory}/${entry.name}`;
+                    const stat = external_node_fs_default().statSync(absolute(file));
+                    return stat.isDirectory() ? filesUnder(file, seen) : stat.isFile() ? [
+                        file
+                    ] : [];
+                });
+            };
+            const exportedFiles = (target)=>{
+                if (!target.includes('*')) return [
+                    `${shellPath}/${target.slice(2)}`
+                ];
+                const prefix = target.slice(0, target.indexOf('*'));
+                const pattern = new RegExp(`^${target.split('*').map((part)=>part.replaceAll(/[.*+?^${}()|[\]\\]/gu, '\\$&')).join('.*')}$`, 'u');
+                return filesUnder(`${shellPath}/${prefix.slice(2, prefix.lastIndexOf('/'))}`).filter((file)=>pattern.test(`./${external_node_path_default().posix.relative(shellPath, file)}`));
+            };
+            const ownClientPrefix = `${manifest.name}/api/`;
+            const foreignSpecifier = (specifier)=>/\/api\/(?:rpc-)?client$/u.test(specifier) && !specifier.startsWith(ownClientPrefix);
+            for (const target of targets(manifest.exports))if (/\.[cm]?[jt]sx?$/u.test(target)) {
+                if (!target.startsWith('./') || target.split(/[\\/]/u).includes('..')) {
+                    invalidExport();
+                    continue;
+                }
+                for (const candidate of exportedFiles(target)){
+                    const file = clientExportFile(shellPath, `./${external_node_path_default().posix.relative(shellPath, candidate)}`);
+                    if (!file) {
+                        invalidExport();
+                        continue;
+                    }
+                    assert(!exposesForeignClient(file, owner, foreignSpecifier), `${file}: Shell public exports must not expose another owner's API client`);
+                }
+            }
+        };
+        const exposesForeignClient = (entry, owner, foreignSpecifier)=>{
+            const graph = (0, external_module_graph_cjs_namespaceObject.createModuleGraph)();
+            const seenValues = new Set();
+            const seenExports = new Map();
+            const workspacePath = (module)=>normalize(external_node_path_default().relative(workspace, module.path));
+            const resolveSource = (from, specifier)=>resolveRelative(from, specifier) ?? ownerClients.get(specifier);
+            const returnExpressions = (node)=>{
+                if (types_namespaceObject.isReturnStatement(node)) return node.argument ? [
+                    node.argument
+                ] : [];
+                if (types_namespaceObject.isFunction(node)) return [];
+                return (types_namespaceObject.VISITOR_KEYS[node.type] ?? []).flatMap((key)=>{
+                    const value = Reflect.get(node, key);
+                    return (Array.isArray(value) ? value : [
+                        value
+                    ]).flatMap((child)=>types_namespaceObject.isNode(child) ? returnExpressions(child) : []);
+                });
+            };
+            const nestedValues = (node)=>{
+                if (types_namespaceObject.isObjectExpression(node)) return node.properties.flatMap((property)=>types_namespaceObject.isObjectProperty(property) ? [
+                        property.value
+                    ] : types_namespaceObject.isObjectMethod(property) ? returnExpressions(property.body) : types_namespaceObject.isSpreadElement(property) ? [
+                        property.argument
+                    ] : []);
+                if (types_namespaceObject.isArrayExpression(node)) return node.elements.filter((element)=>null !== element);
+                if (types_namespaceObject.isFunction(node)) return types_namespaceObject.isBlockStatement(node.body) ? returnExpressions(node.body) : [
+                    node.body
+                ];
+                return [];
+            };
+            const foreignValue = (value, from)=>{
+                if ('external' === value.kind) {
+                    const source = resolveSource(workspacePath(from), value.specifier);
+                    if (!source) return foreignSpecifier(value.specifier);
+                    return '*' === value.name ? inspect(source) : exportedValue(source, value.name);
+                }
+                if ('unresolved' === value.kind && types_namespaceObject.isImportDeclaration(value.node) && value.node.specifiers.some((specifier)=>types_namespaceObject.isImportNamespaceSpecifier(specifier))) {
+                    const specifier = value.node.source.value;
+                    const source = resolveSource(workspacePath(value.module), specifier);
+                    return source ? inspect(source) : foreignSpecifier(specifier);
+                }
+                if ('node' !== value.kind || seenValues.has(value.node)) return false;
+                seenValues.add(value.node);
+                const { node, module } = value;
+                if ((types_namespaceObject.isCallExpression(node) || types_namespaceObject.isOptionalCallExpression(node)) && graph.evaluate(module, node.callee).some((callee)=>'external' === callee.kind && callee.specifier === effect && clientFactories.has(callee.name))) {
+                    const [argument] = node.arguments;
+                    const binding = argument ? graphBinding(graph, module, argument) : void 0;
+                    if (module.boundary !== owner || binding?.kind !== 'declaration' || binding.module.boundary !== owner) return true;
+                }
+                return nestedValues(node).some((expression)=>graph.evaluate(module, expression).some((nested)=>foreignValue(nested, module)));
+            };
+            const exportName = (node)=>types_namespaceObject.isIdentifier(node) ? node.name : node.value;
+            const names = (source, visited = new Set())=>{
+                if (visited.has(source)) return [];
+                visited.add(source);
+                return graph.module(absolute(source)).file.program.body.flatMap((statement)=>{
+                    if (types_namespaceObject.isExportDefaultDeclaration(statement)) return [
+                        'default'
+                    ];
+                    if (!types_namespaceObject.isExportNamedDeclaration(statement) && !types_namespaceObject.isExportAllDeclaration(statement) || 'type' === statement.exportKind) return [];
+                    if (types_namespaceObject.isExportAllDeclaration(statement)) {
+                        const target = resolveSource(source, statement.source.value);
+                        return target ? names(target, visited).filter((name)=>'default' !== name) : [];
+                    }
+                    return statement.declaration ? Object.keys(types_namespaceObject.getOuterBindingIdentifiers(statement.declaration)) : statement.specifiers.flatMap((specifier)=>types_namespaceObject.isExportSpecifier(specifier) && 'type' === specifier.exportKind ? [] : [
+                            exportName(specifier.exported)
+                        ]);
+                });
+            };
+            const exportedValue = (source, name)=>{
+                const visited = seenExports.get(source) ?? new Set();
+                if (visited.has(name)) return false;
+                visited.add(name);
+                seenExports.set(source, visited);
+                const module = graph.module(absolute(source));
+                const evaluates = (from, node)=>graph.evaluate(from, node).some((value)=>foreignValue(value, from));
+                const binding = graph.resolve(module, name, 'export');
+                if (binding?.kind === 'external') return foreignValue({
+                    ...binding,
+                    members: []
+                }, module);
+                if (binding?.kind === 'declaration') return evaluates(binding.module, binding.expression);
+                for (const statement of module.file.program.body){
+                    if (types_namespaceObject.isExportDefaultDeclaration(statement) && 'default' === name) return evaluates(module, statement.declaration);
+                    if (!types_namespaceObject.isExportNamedDeclaration(statement) || 'type' === statement.exportKind) continue;
+                    if (types_namespaceObject.isFunctionDeclaration(statement.declaration) && statement.declaration.id?.name === name) return evaluates(module, statement.declaration);
+                    const specifier = statement.specifiers.find((item)=>exportName(item.exported) === name);
+                    if (!specifier) continue;
+                    if (types_namespaceObject.isExportSpecifier(specifier) && 'type' === specifier.exportKind) return false;
+                    if (!statement.source) return types_namespaceObject.isExportSpecifier(specifier) ? evaluates(module, specifier.local) : false;
+                    const target = resolveSource(source, statement.source.value);
+                    if (!target) return foreignSpecifier(statement.source.value);
+                    if (types_namespaceObject.isExportNamespaceSpecifier(specifier)) return inspect(target);
+                    if (types_namespaceObject.isExportSpecifier(specifier)) return exportedValue(target, exportName(specifier.local));
+                }
+                return module.file.program.body.some((statement)=>{
+                    if (!types_namespaceObject.isExportAllDeclaration(statement) || 'type' === statement.exportKind) return false;
+                    const target = resolveSource(source, statement.source.value);
+                    return !!target && names(target).includes(name) && exportedValue(target, name);
+                });
+            };
+            const inspect = (source)=>[
+                    ...new Set(names(source))
+                ].some((name)=>exportedValue(source, name));
+            return inspect(entry);
+        };
+        const ownerClients = new Map();
+        for (const app of apps)if (exists(`${app.path}/package.json`)) {
+            const manifest = JSON.parse(read(`${app.path}/package.json`));
+            for (const key of [
+                './api/client',
+                './api/rpc-client'
+            ]){
+                const file = clientExportFile(app.path, manifest.exports?.[key]);
+                if (file) ownerClients.set(`${manifest.name}${key.slice(1)}`, file);
+            }
         }
-        if (exists(`${shell}/package.json`)) guarded(`${shell}/package.json`, ()=>assert(JSON.parse(read(`${shell}/package.json`)).exports?.['./api/clients'] === './src/api/vertical-clients.ts', `${shell}/package.json: must export ./api/clients`));
+        for (const shell of apps.filter((app)=>'shell' === app.kind))guarded(shell.path, ()=>checkShellExports(normalize(shell.path)));
         if (exists('topology/reference-topology.json')) guarded('topology/reference-topology.json', ()=>{
             for (const vertical of JSON.parse(read('topology/reference-topology.json')).verticals ?? []){
                 if (vertical.api?.runtime === 'effect') {

package/dist/cjs/module-graph.cjs

@@ -232,6 +232,7 @@ function parseModule(filePath, workspace) {
     const file = (0, external_source_analysis_cjs_namespaceObject.parseSource)(external_node_fs_default().readFileSync(filePath, 'utf8'), filePath);
     let scope;
     const references = new Map();
+    const declarations = new Map();
     const returns = new Map();
     const bareReturns = new Set();
     const functionScopes = new Map();
@@ -342,6 +343,11 @@ function parseModule(filePath, workspace) {
         ReferencedIdentifier (p) {
             references.set(p.node, p.scope.getBinding(p.node.name));
         },
+        BindingIdentifier (p) {
+            if (!types_namespaceObject.isIdentifier(p.node)) return;
+            const binding = p.scope.getBinding(p.node.name);
+            if (binding?.identifier === p.node) declarations.set(p.node, binding);
+        },
         Function (p) {
             functionScopes.set(p.node, p.scope);
         },
@@ -407,6 +413,7 @@ function parseModule(filePath, workspace) {
         scope,
         workspace,
         references,
+        declarations,
         returns,
         bareReturns,
         functionScopes,
@@ -1142,7 +1149,7 @@ function createModuleGraph() {
         }
     };
     const mutated = (module, binding)=>binding.constantViolations.length > 0 || factsOf(module).merged.has(binding.identifier.name) || (aliasesOf(binding, factsOf(module).writes)?.some((alias)=>factsOf(module).writes.has(alias.binding)) ?? true);
-    const resolveBinding = (module, name, scope, chain, seen)=>{
+    const resolveBinding = (module, name, scope, chain, seen, lexical)=>{
         const key = `${scope}:${module.path}#${name}`;
         if (seen.has(key) || seen.size >= MAX_LOOKUPS) return;
         seen.add(key);
@@ -1165,7 +1172,7 @@ function createModuleGraph() {
             return void 0 === next ? void 0 : resolveBinding(next, imported, 'export', hops, seen);
         };
         if ('local' === scope) {
-            const binding = factsOf(module).scope.getBinding(name);
+            const binding = lexical ?? factsOf(module).scope.getBinding(name);
             if (!binding || mutated(module, binding)) return;
             if ('module' === binding.kind) {
                 const imported = importOf(binding);
@@ -1194,6 +1201,39 @@ function createModuleGraph() {
             if (void 0 !== resolved) return resolved;
         }
     };
+    const resolveReference = (module, reference)=>{
+        const node = (0, external_source_analysis_cjs_namespaceObject.unwrapExpression)(reference, true);
+        const moduleFacts = factsOf(module);
+        const bindingAt = (identifier)=>moduleFacts.references.get(identifier) ?? moduleFacts.declarations.get(identifier);
+        if (types_namespaceObject.isIdentifier(node)) {
+            const binding = bindingAt(node);
+            return binding ? resolveBinding(module, node.name, 'local', [], new Set(), binding) : void 0;
+        }
+        if (!types_namespaceObject.isMemberExpression(node) || node.computed || !types_namespaceObject.isIdentifier(node.object) || !types_namespaceObject.isIdentifier(node.property)) return;
+        const binding = bindingAt(node.object);
+        if (!binding || 'module' !== binding.kind || mutated(module, binding)) return;
+        const imported = importOf(binding);
+        if (imported?.name !== '*') return;
+        const target = follow(module, imported.specifier);
+        const chain = [
+            {
+                path: module.path,
+                name: node.object.name
+            }
+        ];
+        if ('external' === target) return {
+            kind: 'external',
+            specifier: imported.specifier,
+            name: node.property.name,
+            chain
+        };
+        return void 0 === target ? void 0 : resolveBinding(target, node.property.name, 'export', chain, new Set());
+    };
+    const isUnboundReference = (module, reference)=>{
+        const node = (0, external_source_analysis_cjs_namespaceObject.unwrapExpression)(reference, true);
+        const { references } = factsOf(module);
+        return types_namespaceObject.isIdentifier(node) && references.has(node) && void 0 === references.get(node);
+    };
     const evaluation = (walking)=>{
         const active = new Set();
         let frames = 0;
@@ -1801,6 +1841,8 @@ function createModuleGraph() {
     return {
         module: (filePath)=>load(filePath),
         resolve: (module, name, scope)=>resolveBinding(module, name, scope, [], new Set()),
+        resolveReference,
+        isUnboundReference,
         evaluate: (module, expression)=>evaluation(false).values(module, expression, []),
         reachable: (module, expression)=>evaluation(true).reachable(module, expression)
     };