@bleedingdev/modern-js-code-tools 3.9.3-ultramodern.1 → 3.9.3-ultramodern.11

package/dist/cjs/strict-effect-runtime.cjs

@@ -51,6 +51,19 @@ const nodeRuntime = '@modern-js/bff-effect/effect';
 const assembly = '@modern-js/bff-effect/assembly';
 const failure = 'Generated API entries must export defineEffectBff(...) or the native Effect BFF assembly helper with an explicitly composed handler Layer and an unshadowed executable root; entries must implement handlers through HttpApiBuilder.group.';
 const MAX_API_SOURCE_MODULES = 256;
+const httpRouteMethods = new Set([
+    '*',
+    'GET',
+    'POST',
+    'PUT',
+    'PATCH',
+    'DELETE',
+    'HEAD',
+    'OPTIONS',
+    'TRACE',
+    'CONNECT',
+    'QUERY'
+]);
 function createEffectApiImportResolver(filename) {
     const directory = external_node_fs_default().realpathSync(external_node_path_default().dirname(filename));
     const owner = external_node_fs_default().realpathSync(external_node_path_default().resolve(directory, '..'));
@@ -98,9 +111,12 @@ function strictEffectRuntimeTopologyViolation(source, resolveImport) {
                 })) {
                     let target = nodePath.isAssignmentExpression() ? nodePath.node.left : nodePath.node.argument;
                     while(types_namespaceObject.isMemberExpression(target))target = target.object;
-                    if (types_namespaceObject.isIdentifier(target)) {
-                        const binding = nodePath.scope.getBinding(target.name);
-                        if (binding) mutated.add(binding);
+                    let binding = types_namespaceObject.isIdentifier(target) ? nodePath.scope.getBinding(target.name) : void 0;
+                    while(binding && !mutated.has(binding)){
+                        mutated.add(binding);
+                        const declarator = binding.path.node;
+                        const alias = 'const' === binding.kind && types_namespaceObject.isVariableDeclarator(declarator) && declarator.init ? (0, external_source_analysis_cjs_namespaceObject.unwrapExpression)(declarator.init, true) : void 0;
+                        binding = types_namespaceObject.isIdentifier(alias) ? binding.path.scope.getBinding(alias.name) : void 0;
                     }
                 }
                 if (nodePath.isTSModuleDeclaration() && types_namespaceObject.isIdentifier(nodePath.node.id)) {
@@ -275,11 +291,48 @@ function strictEffectRuntimeTopologyViolation(source, resolveImport) {
                 if (method(node.callee, 'Layer', 'mergeAll', layerSources)) return node.arguments.length > 0 && node.arguments.every((argument)=>handlers(argument, api));
                 return method(node.callee, 'HttpApiBuilder', 'group') && 3 === node.arguments.length && apiIdentity(node.arguments[0]) === api && handled(node.arguments[2]);
             });
-        const transport = (node)=>guarded(node, (node)=>{
+        const effectSources = [
+            edge,
+            'effect',
+            'effect/Effect'
+        ];
+        const routeHandler = (node)=>{
+            node = unwrap(node);
+            if (!types_namespaceObject.isCallExpression(node) || !method(node.callee, 'HttpRouter', 'add') || 3 !== node.arguments.length) return;
+            const [verb, route, handler] = node.arguments;
+            return types_namespaceObject.isStringLiteral(verb) && httpRouteMethods.has(verb.value) && types_namespaceObject.isStringLiteral(route) && (route.value.startsWith('/') || '*' === route.value) && (types_namespaceObject.isArrowFunctionExpression(handler) || types_namespaceObject.isFunctionExpression(handler)) ? handler : void 0;
+        };
+        const effectReference = (node)=>guarded(node, (node)=>{
                 const init = initialized(node);
-                if (init) return transport(init);
+                if (init) return types_namespaceObject.isIdentifier(unwrap(init)) && effectReference(init);
+                const value = imported(node);
+                return !!value && !value.namespace;
+            });
+        const capturedRouteFactory = (node)=>guarded(node, (node)=>{
+                const init = initialized(node) ?? externalValue(node);
+                if (init) return capturedRouteFactory(init);
+                if (!types_namespaceObject.isArrowFunctionExpression(node) || node.async || 1 !== node.params.length || !types_namespaceObject.isIdentifier(node.params[0]) || types_namespaceObject.isBlockStatement(node.body)) return false;
+                const handler = routeHandler(node.body);
+                const parameter = binding(node.params[0]);
+                return !!handler && !!parameter && parameter.referencePaths.some((reference)=>!!reference.findParent((path)=>path.node === handler));
+            });
+        const capturedTransport = (node)=>guarded(node, (node)=>{
+                const init = initialized(node);
+                if (init) return capturedTransport(init);
+                if (!types_namespaceObject.isCallExpression(node)) return false;
+                if (method(node.callee, 'Effect', 'map', effectSources)) return 2 === node.arguments.length && effectReference(node.arguments[0]) && capturedRouteFactory(node.arguments[1]);
+                if (!types_namespaceObject.isMemberExpression(node.callee) || node.callee.computed || !types_namespaceObject.isIdentifier(node.callee.property, {
+                    name: 'pipe'
+                }) || 1 !== node.arguments.length || !effectReference(node.callee.object)) return false;
+                const map = unwrap(node.arguments[0]);
+                return types_namespaceObject.isCallExpression(map) && method(map.callee, 'Effect', 'map', effectSources) && 1 === map.arguments.length && capturedRouteFactory(map.arguments[0]);
+            });
+        const transport = (node, provided = false)=>guarded(node, (node)=>{
+                const init = initialized(node) ?? externalValue(node);
+                if (init) return transport(init, provided);
                 if (!types_namespaceObject.isCallExpression(node)) return method(node, 'Layer', 'empty', layerSources);
-                return pipe(node, transport) || method(node.callee, 'HttpRouter', 'cors') || method(node.callee, 'Layer', 'mergeAll', layerSources) && node.arguments.length > 0 && node.arguments.every(transport);
+                const providedHere = provided || node.arguments.some((argument)=>types_namespaceObject.isCallExpression(argument) && method(argument.callee, 'Layer', 'provide', layerSources) && 1 === argument.arguments.length);
+                return pipe(node, (value)=>transport(value, providedHere)) || void 0 !== routeHandler(node) || provided && method(node.callee, 'Layer', 'unwrap', layerSources) && 1 === node.arguments.length && capturedTransport(node.arguments[0]) || method(node.callee, 'HttpRouter', 'cors') || method(node.callee, 'Layer', 'mergeAll', layerSources) && node.arguments.length > 0 && node.arguments.every((argument)=>transport(argument, provided));
             });
         const directLayer = (node, api)=>guarded(node, (node)=>{
                 const init = initialized(node);

package/dist/esm/microvertical-api-baseline.js

@@ -470,4 +470,4 @@ const microVerticalApiBaselineViolation = (stem, filePath, expectation)=>{
         throw error;
     }
 };
-export { configuredMicroVerticalApiStem, microVerticalApiBaselineViolation };
+export { camelCaseStem, configuredMicroVerticalApiStem, microVerticalApiBaselineViolation, pascalCaseStem };

package/dist/esm/microvertical-api-boundary.js

@@ -1,10 +1,10 @@
 import node_fs from "node:fs";
 import node_path from "node:path";
 import { parse } from "@babel/parser";
-import { configuredMicroVerticalApiStem, microVerticalApiBaselineViolation } from "./microvertical-api-baseline.js";
+import { camelCaseStem, configuredMicroVerticalApiStem, microVerticalApiBaselineViolation, pascalCaseStem } from "./microvertical-api-baseline.js";
 import { baselinePackage, resolveBaselinePackageDirectory } from "./microvertical-api-owner.js";
 import { createModuleGraph } from "./module-graph.js";
-import { SourceSyntaxError, consumerParserPlugins } from "./source-analysis.js";
+import { SourceSyntaxError, consumerParserPlugins, unwrapExpression } from "./source-analysis.js";
 import { createEffectApiImportResolver, strictEffectRuntimeTopologyViolation } from "./strict-effect-runtime.js";
 import * as __rspack_external__babel_types_6e8337dd from "@babel/types";
 const ignored = new Set([
@@ -17,6 +17,14 @@ const ignored = new Set([
     'node_modules',
     'repos'
 ]);
+const MAX_CLOSURE_DEPTH = 128;
+const MAX_CLOSURE_MODULES = 2048;
+const MAX_API_HOPS = 128;
+const MAX_API_VISITS = 2048;
+const identitySources = [
+    'effect',
+    'effect/Function'
+];
 const normalize = (file)=>file.split(node_path.sep).join('/').replace(/^\.\//u, '');
 const errorMessage = (error)=>error instanceof Error ? error.message : String(error);
 const apiApp = (app)=>'vertical' === app.kind && 'ui-only' !== app.surfaceProfile && 'horizontal-remote' !== app.deliveryUnitKind;
@@ -82,7 +90,7 @@ function configuredApps(root, supplied) {
         };
         for (const field of Object.keys(allowedFields)){
             const value = app[field];
-            if (void 0 !== value && !allowedFields[field].includes(value)) throw new Error(`${key}: invalid ${field}`);
+            if ((void 0 !== value || 'kind' === field) && ('string' != typeof value || !allowedFields[field].includes(value))) throw new Error(`${key}: invalid ${field}`);
         }
         if (void 0 !== app.api) {
             if (!app.api || 'object' != typeof app.api || Array.isArray(app.api)) throw new Error(`${key}: api must be an object`);
@@ -124,6 +132,9 @@ function check(options, topology) {
     };
     try {
         const apps = configuredApps(root, options.configuredApps);
+        const workspace = node_fs.realpathSync(root);
+        const realRelative = (file)=>normalize(node_path.relative(workspace, node_fs.realpathSync(absolute(file))));
+        const inside = (directory, real)=>real.startsWith(`${directory}${node_path.sep}`);
         const byPath = new Map(apps.map((app)=>[
                 normalize(app.path),
                 app
@@ -164,12 +175,19 @@ function check(options, topology) {
         const resolveRelative = (fromFile, specifier)=>{
             if (!/^\.\.?\//u.test(specifier)) return;
             const base = node_path.posix.join(node_path.posix.dirname(fromFile), specifier).replace(/\.(?:[cm]?[jt]sx?)$/u, '');
-            return [
+            const candidate = [
                 `${base}.ts`,
                 `${base}.tsx`,
                 `${base}/index.ts`,
                 `${base}/index.tsx`
-            ].find((candidate)=>exists(candidate));
+            ].find((file)=>exists(file));
+            return void 0 === candidate ? void 0 : realRelative(candidate);
+        };
+        const graphBinding = (graph, module, expression, seen = new Set())=>{
+            if (seen.has(expression) || seen.size >= 128) return;
+            seen.add(expression);
+            const binding = __rspack_external__babel_types_6e8337dd.isIdentifier(expression) || __rspack_external__babel_types_6e8337dd.isMemberExpression(expression) ? graph.resolveReference(module, expression) : void 0;
+            return binding?.kind === 'declaration' && (__rspack_external__babel_types_6e8337dd.isIdentifier(binding.expression) || __rspack_external__babel_types_6e8337dd.isMemberExpression(binding.expression)) ? graphBinding(graph, binding.module, binding.expression, seen) : binding;
         };
         const clientExportFile = (appPath, exported)=>{
             if ('string' != typeof exported || !exported.startsWith('./') || exported.split(/[\\/]/u).includes('..') || !/\.[cm]?[jt]sx?$/u.test(exported)) return;
@@ -186,29 +204,209 @@ function check(options, topology) {
             return normalize(node_path.relative(root, candidate));
         };
         const composedModules = (file, appPath)=>{
-            const order = [];
-            const seen = new Set();
+            const owner = node_fs.realpathSync(absolute(appPath));
+            if (!inside(owner, node_fs.realpathSync(absolute(file)))) throw new Error(`consumer module closure escapes its owner: ${file}`);
+            const entry = realRelative(file);
+            const discovered = new Set([
+                entry
+            ]);
             const queue = [
-                file
+                {
+                    file: entry,
+                    depth: 0
+                }
             ];
-            const owner = node_fs.realpathSync(absolute(appPath));
-            while(queue.length > 0 && order.length < 128){
-                const current = queue.shift();
-                if (seen.has(current)) continue;
-                seen.add(current);
-                order.push(current);
+            let graph;
+            for (const { file: current, depth } of queue){
                 const ast = parseFile(current);
                 if (!ast) continue;
-                for (const statement of ast.program.body){
-                    const source = (__rspack_external__babel_types_6e8337dd.isImportDeclaration(statement) || __rspack_external__babel_types_6e8337dd.isExportNamedDeclaration(statement) || __rspack_external__babel_types_6e8337dd.isExportAllDeclaration(statement)) && statement.source ? statement.source.value : void 0;
-                    const resolved = void 0 === source ? void 0 : resolveRelative(current, source);
-                    if (void 0 !== resolved && !seen.has(resolved)) {
-                        const real = node_fs.realpathSync(absolute(resolved));
-                        if (real.startsWith(`${owner}${node_path.sep}`)) queue.push(resolved);
+                const sources = [];
+                let callsRequire = false;
+                for (const statement of ast.program.body)if (__rspack_external__babel_types_6e8337dd.isImportDeclaration(statement) && 'type' !== statement.importKind && 'typeof' !== statement.importKind || (__rspack_external__babel_types_6e8337dd.isExportNamedDeclaration(statement) || __rspack_external__babel_types_6e8337dd.isExportAllDeclaration(statement)) && 'type' !== statement.exportKind && statement.source) sources.push(statement.source.value);
+                __rspack_external__babel_types_6e8337dd.traverseFast(ast, (node)=>{
+                    if (__rspack_external__babel_types_6e8337dd.isImportExpression(node)) {
+                        if (!__rspack_external__babel_types_6e8337dd.isStringLiteral(node.source)) throw new Error(`consumer module closure has nonliteral runtime dependency: ${current}`);
+                        sources.push(node.source.value);
+                    }
+                    if ((__rspack_external__babel_types_6e8337dd.isCallExpression(node) || __rspack_external__babel_types_6e8337dd.isOptionalCallExpression(node)) && __rspack_external__babel_types_6e8337dd.isIdentifier(unwrapExpression(node.callee, true), {
+                        name: 'require'
+                    })) callsRequire = true;
+                });
+                if (callsRequire) {
+                    graph ??= createModuleGraph();
+                    const module = graph.module(absolute(current));
+                    __rspack_external__babel_types_6e8337dd.traverseFast(module.file, (node)=>{
+                        if (!__rspack_external__babel_types_6e8337dd.isCallExpression(node) && !__rspack_external__babel_types_6e8337dd.isOptionalCallExpression(node)) return;
+                        const callee = unwrapExpression(node.callee, true);
+                        if (!__rspack_external__babel_types_6e8337dd.isIdentifier(callee, {
+                            name: 'require'
+                        }) || !graph.isUnboundReference(module, callee)) return;
+                        const [argument] = node.arguments;
+                        if (1 !== node.arguments.length || !__rspack_external__babel_types_6e8337dd.isStringLiteral(argument)) throw new Error(`consumer module closure has nonliteral runtime dependency: ${current}`);
+                        sources.push(argument.value);
+                    });
+                }
+                for (const source of sources){
+                    if (!/^\.\.?\//u.test(source)) continue;
+                    const resolved = resolveRelative(current, source);
+                    if (void 0 === resolved) throw new Error(`consumer module closure has unresolved relative dependency: ${current} -> ${source}`);
+                    if (!inside(owner, node_path.join(workspace, resolved))) throw new Error(`consumer module closure escapes its owner: ${current} -> ${source}`);
+                    if (!discovered.has(resolved)) {
+                        if (depth + 1 >= MAX_CLOSURE_DEPTH) throw new Error(`consumer module closure exceeds ${MAX_CLOSURE_DEPTH} import-depth analysis budget`);
+                        if (discovered.size >= MAX_CLOSURE_MODULES) throw new Error(`consumer module closure exceeds ${MAX_CLOSURE_MODULES}-module analysis budget`);
+                        discovered.add(resolved);
+                        queue.push({
+                            file: resolved,
+                            depth: depth + 1
+                        });
                     }
                 }
             }
-            return order;
+            return queue.map((item)=>item.file);
+        };
+        const foreignClientConstructions = (client, appPath, contract, stem, rpc)=>{
+            const graph = createModuleGraph();
+            const contractModule = graph.module(absolute(contract));
+            const factory = rpc ? 'makeEffectRpcClient' : 'makeEffectHttpApiClient';
+            const ownExport = graph.resolve(contractModule, rpc ? `${pascalCaseStem(stem)}RpcGroup` : `${camelCaseStem(stem)}Api`, 'export');
+            const isIdentity = (value)=>'external' === value.kind && identitySources.includes(value.specifier) && 'identity' === value.name && 0 === value.members.length;
+            const identityPipe = (module, node)=>{
+                if (!__rspack_external__babel_types_6e8337dd.isCallExpression(node) || !__rspack_external__babel_types_6e8337dd.isMemberExpression(node.callee) || node.callee.computed || !__rspack_external__babel_types_6e8337dd.isIdentifier(node.callee.property, {
+                    name: 'pipe'
+                }) || 1 !== node.arguments.length) return false;
+                const values = graph.evaluate(module, node.arguments[0]);
+                return values.length > 0 && values.every(isIdentity);
+            };
+            const withoutIdentity = (module, value)=>{
+                let node = unwrapExpression(value, true);
+                for(let pipes = 0; identityPipe(module, node); pipes += 1){
+                    if (pipes >= MAX_API_HOPS) return value;
+                    node = unwrapExpression(node.callee.object, true);
+                }
+                return node;
+            };
+            const normalizedApi = (initial)=>{
+                let binding = initial;
+                const seen = new Set();
+                for(let hops = 0; hops < MAX_API_HOPS; hops += 1){
+                    const expression = withoutIdentity(binding.module, binding.expression);
+                    if (seen.has(expression)) break;
+                    seen.add(expression);
+                    if (!__rspack_external__babel_types_6e8337dd.isIdentifier(expression) && !__rspack_external__babel_types_6e8337dd.isMemberExpression(expression)) return {
+                        ...binding,
+                        expression: expression
+                    };
+                    const next = graphBinding(graph, binding.module, expression);
+                    if (next?.kind !== 'declaration') break;
+                    binding = next;
+                }
+            };
+            const apiBinding = (module, value)=>{
+                const binding = graphBinding(graph, module, withoutIdentity(module, value));
+                return binding?.kind === 'declaration' ? normalizedApi(binding) : void 0;
+            };
+            const ownedApis = new Map();
+            const own = (binding)=>{
+                const identities = ownedApis.get(binding.module.path) ?? new Set();
+                identities.add(binding.expression);
+                ownedApis.set(binding.module.path, identities);
+            };
+            const proven = new Set();
+            const active = new Set();
+            let visits = 0;
+            const builtApi = (module, expression)=>{
+                const initial = withoutIdentity(module, expression);
+                if (active.has(initial) || active.size >= MAX_API_HOPS) return false;
+                active.add(initial);
+                try {
+                    const children = [];
+                    for(let node = initial;;){
+                        if (++visits > MAX_API_VISITS) return false;
+                        if (__rspack_external__babel_types_6e8337dd.isIdentifier(node) || __rspack_external__babel_types_6e8337dd.isMemberExpression(node)) {
+                            const receiver = apiBinding(module, node);
+                            if (!receiver || !builtApi(receiver.module, receiver.expression)) return false;
+                            break;
+                        }
+                        if (!__rspack_external__babel_types_6e8337dd.isCallExpression(node)) return false;
+                        const callee = graph.evaluate(module, node.callee);
+                        if (callee.length > 0 && callee.every((value)=>'external' === value.kind && httpApiSources.includes(value.specifier) && 'HttpApi' === value.name && 1 === value.members.length && 'make' === value.members[0])) {
+                            if (1 !== node.arguments.length || !__rspack_external__babel_types_6e8337dd.isStringLiteral(node.arguments[0])) return false;
+                            break;
+                        }
+                        if (!__rspack_external__babel_types_6e8337dd.isMemberExpression(node.callee) || node.callee.computed || !__rspack_external__babel_types_6e8337dd.isIdentifier(node.callee.property)) return false;
+                        const method = node.callee.property.name;
+                        const count = node.arguments.length;
+                        const [first] = node.arguments;
+                        if ('addHttpApi' === method && 1 === count) children.push(first);
+                        else if (!('add' === method && count > 0 || 'annotate' === method && 2 === count || [
+                            'annotateMerge',
+                            'middleware'
+                        ].includes(method) && 1 === count || 'prefix' === method && 1 === count && __rspack_external__babel_types_6e8337dd.isStringLiteral(first) && first.value.startsWith('/'))) return false;
+                        node = withoutIdentity(module, node.callee.object);
+                    }
+                    return children.every((child)=>{
+                        const binding = apiBinding(module, child);
+                        return void 0 !== binding && collectApi(binding);
+                    });
+                } finally{
+                    active.delete(initial);
+                }
+            };
+            const collectApi = (binding)=>{
+                if (proven.has(binding.expression)) return true;
+                if (!builtApi(binding.module, binding.expression)) return false;
+                proven.add(binding.expression);
+                if (binding.module.boundary === contractModule.boundary) own(binding);
+                return true;
+            };
+            if (!rpc && ownExport?.kind === 'declaration') {
+                const root = normalizedApi(ownExport);
+                if (root && collectApi(root)) own(root);
+                else ownedApis.clear();
+            }
+            const immutablePipeAliases = (module, target)=>{
+                if (0 === module.mutations.length) return true;
+                let valid = true;
+                __rspack_external__babel_types_6e8337dd.traverseFast(module.file, (node)=>{
+                    if (!__rspack_external__babel_types_6e8337dd.isVariableDeclarator(node) || !__rspack_external__babel_types_6e8337dd.isIdentifier(node.id) || !node.init) return;
+                    let initializer = unwrapExpression(node.init, true);
+                    let identityOnly = true;
+                    let piped = false;
+                    while(__rspack_external__babel_types_6e8337dd.isCallExpression(initializer) && __rspack_external__babel_types_6e8337dd.isMemberExpression(initializer.callee) && !initializer.callee.computed && __rspack_external__babel_types_6e8337dd.isIdentifier(initializer.callee.property, {
+                        name: 'pipe'
+                    })){
+                        piped = true;
+                        identityOnly &&= identityPipe(module, initializer);
+                        initializer = unwrapExpression(initializer.callee.object, true);
+                    }
+                    if (!piped) return;
+                    const receiver = apiBinding(module, initializer);
+                    if (receiver?.module.path !== target.module.path || receiver.expression !== target.expression) return;
+                    if (!identityOnly || graph.resolveReference(module, node.id)?.kind !== 'declaration') valid = false;
+                });
+                return valid;
+            };
+            const ownedBy = (module, argument)=>{
+                if (!argument) return false;
+                if (rpc) {
+                    const binding = graphBinding(graph, module, argument);
+                    return binding?.kind === 'declaration' && ownExport?.kind === 'declaration' && binding.module.path === ownExport.module.path && binding.expression === ownExport.expression;
+                }
+                const binding = apiBinding(module, argument);
+                return void 0 !== binding && !!ownedApis.get(binding.module.path)?.has(binding.expression) && immutablePipeAliases(module, binding);
+            };
+            const violations = new Set();
+            for (const source of composedModules(client, appPath)){
+                const module = graph.module(absolute(source));
+                __rspack_external__babel_types_6e8337dd.traverseFast(module.file, (node)=>{
+                    if (!__rspack_external__babel_types_6e8337dd.isCallExpression(node) && !__rspack_external__babel_types_6e8337dd.isOptionalCallExpression(node)) return;
+                    const native = graph.evaluate(module, node.callee).some((value)=>'external' === value.kind && value.specifier === effect && value.name === factory);
+                    if (native && !ownedBy(module, node.arguments[0])) violations.add(`${source}: must construct the client from its own API contract`);
+                });
+            }
+            return [
+                ...violations
+            ];
         };
         const moduleShape = (file, imports, calls, patterns = [], defaultExport, composedAppPath)=>{
             if (!exists(file)) return;
@@ -247,6 +445,14 @@ function check(options, topology) {
                 })), `${file}: must default-export ${defaultExport}`);
         };
         const effect = '@modern-js/bff-effect/effect-client';
+        const httpApiSources = [
+            effect,
+            'effect/http-api'
+        ];
+        const clientFactories = new Set([
+            'makeEffectHttpApiClient',
+            'makeEffectRpcClient'
+        ]);
         const appDirectories = [
             ...new Set([
                 ...directories('apps'),
@@ -424,6 +630,7 @@ function check(options, topology) {
                 ], [
                     rpc ? 'makeEffectRpcClient' : 'makeEffectHttpApiClient'
                 ], [], void 0, appPath);
+                if (exists(contract)) diagnostics.push(...foreignClientConstructions(client, appPath, contract, stem, rpc));
             }
             moduleShape(`${appPath}/api/effect-api.ts`, [], [], [
                 [
@@ -467,8 +674,8 @@ function check(options, topology) {
             ]);
         });
         const sourceRules = options.sourceRules ?? [];
-        const graph = createModuleGraph();
         for (const file of sourceRules.length ? sourceFiles : [])if (/\.[cm]?[jt]sx?$/u.test(file)) guarded(file, ()=>{
+            const graph = createModuleGraph();
             let module;
             try {
                 module = graph.module(absolute(file));
@@ -487,20 +694,178 @@ function check(options, topology) {
                 for (const message of messages)diagnostics.push(`${file}: ${message}`);
             }
         });
-        const shell = 'apps/shell-super-app';
-        const verticals = apps.filter((app)=>app.path.startsWith('verticals/') && apiApp(app));
-        if (exists(shell) && verticals.length) {
-            const file = `${shell}/src/api/vertical-clients.ts`;
-            assert(exists(file), `${file}: must aggregate vertical API clients`);
-            if (exists(file)) guarded(file, ()=>{
-                const ast = parseFile(file);
-                for (const app of verticals){
-                    const specifier = `${app.package}/api/${app.api?.protocol === 'rpc' ? 'rpc-client' : 'client'}`;
-                    assert(ast?.program.body.some((item)=>__rspack_external__babel_types_6e8337dd.isExportNamedDeclaration(item) && item.source?.value === specifier), `${file}: must re-export ${specifier}`);
+        const checkShellExports = (shellPath)=>{
+            const packageFile = `${shellPath}/package.json`;
+            const manifest = JSON.parse(read(packageFile));
+            noPath(`${shellPath}/src/api/vertical-clients.ts`, 'Shell client registries are forbidden; import each owner client directly');
+            assert(!Object.hasOwn(manifest.exports ?? {}, './api/clients'), `${packageFile}: Shell ./api/clients exports are forbidden`);
+            const owner = node_fs.realpathSync(absolute(shellPath));
+            const invalidExport = ()=>assert(false, `${packageFile}: invalid Shell public source export`);
+            const targets = (exported)=>'string' == typeof exported ? [
+                    exported
+                ] : exported && 'object' == typeof exported ? Object.values(exported).flatMap(targets) : [];
+            const filesUnder = (directory, seen = new Set())=>{
+                const real = node_fs.realpathSync(absolute(directory));
+                if (real !== owner && !inside(owner, real)) {
+                    invalidExport();
+                    return [];
+                }
+                if (seen.has(real)) return [];
+                seen.add(real);
+                return node_fs.readdirSync(absolute(directory), {
+                    withFileTypes: true
+                }).flatMap((entry)=>{
+                    if (ignored.has(entry.name)) return [];
+                    const file = `${directory}/${entry.name}`;
+                    const stat = node_fs.statSync(absolute(file));
+                    return stat.isDirectory() ? filesUnder(file, seen) : stat.isFile() ? [
+                        file
+                    ] : [];
+                });
+            };
+            const exportedFiles = (target)=>{
+                if (!target.includes('*')) return [
+                    `${shellPath}/${target.slice(2)}`
+                ];
+                const prefix = target.slice(0, target.indexOf('*'));
+                const pattern = new RegExp(`^${target.split('*').map((part)=>part.replaceAll(/[.*+?^${}()|[\]\\]/gu, '\\$&')).join('.*')}$`, 'u');
+                return filesUnder(`${shellPath}/${prefix.slice(2, prefix.lastIndexOf('/'))}`).filter((file)=>pattern.test(`./${node_path.posix.relative(shellPath, file)}`));
+            };
+            const ownClientPrefix = `${manifest.name}/api/`;
+            const foreignSpecifier = (specifier)=>/\/api\/(?:rpc-)?client$/u.test(specifier) && !specifier.startsWith(ownClientPrefix);
+            for (const target of targets(manifest.exports))if (/\.[cm]?[jt]sx?$/u.test(target)) {
+                if (!target.startsWith('./') || target.split(/[\\/]/u).includes('..')) {
+                    invalidExport();
+                    continue;
                 }
-            });
+                for (const candidate of exportedFiles(target)){
+                    const file = clientExportFile(shellPath, `./${node_path.posix.relative(shellPath, candidate)}`);
+                    if (!file) {
+                        invalidExport();
+                        continue;
+                    }
+                    assert(!exposesForeignClient(file, owner, foreignSpecifier), `${file}: Shell public exports must not expose another owner's API client`);
+                }
+            }
+        };
+        const exposesForeignClient = (entry, owner, foreignSpecifier)=>{
+            const graph = createModuleGraph();
+            const seenValues = new Set();
+            const seenExports = new Map();
+            const workspacePath = (module)=>normalize(node_path.relative(workspace, module.path));
+            const resolveSource = (from, specifier)=>resolveRelative(from, specifier) ?? ownerClients.get(specifier);
+            const returnExpressions = (node)=>{
+                if (__rspack_external__babel_types_6e8337dd.isReturnStatement(node)) return node.argument ? [
+                    node.argument
+                ] : [];
+                if (__rspack_external__babel_types_6e8337dd.isFunction(node)) return [];
+                return (__rspack_external__babel_types_6e8337dd.VISITOR_KEYS[node.type] ?? []).flatMap((key)=>{
+                    const value = Reflect.get(node, key);
+                    return (Array.isArray(value) ? value : [
+                        value
+                    ]).flatMap((child)=>__rspack_external__babel_types_6e8337dd.isNode(child) ? returnExpressions(child) : []);
+                });
+            };
+            const nestedValues = (node)=>{
+                if (__rspack_external__babel_types_6e8337dd.isObjectExpression(node)) return node.properties.flatMap((property)=>__rspack_external__babel_types_6e8337dd.isObjectProperty(property) ? [
+                        property.value
+                    ] : __rspack_external__babel_types_6e8337dd.isObjectMethod(property) ? returnExpressions(property.body) : __rspack_external__babel_types_6e8337dd.isSpreadElement(property) ? [
+                        property.argument
+                    ] : []);
+                if (__rspack_external__babel_types_6e8337dd.isArrayExpression(node)) return node.elements.filter((element)=>null !== element);
+                if (__rspack_external__babel_types_6e8337dd.isFunction(node)) return __rspack_external__babel_types_6e8337dd.isBlockStatement(node.body) ? returnExpressions(node.body) : [
+                    node.body
+                ];
+                return [];
+            };
+            const foreignValue = (value, from)=>{
+                if ('external' === value.kind) {
+                    const source = resolveSource(workspacePath(from), value.specifier);
+                    if (!source) return foreignSpecifier(value.specifier);
+                    return '*' === value.name ? inspect(source) : exportedValue(source, value.name);
+                }
+                if ('unresolved' === value.kind && __rspack_external__babel_types_6e8337dd.isImportDeclaration(value.node) && value.node.specifiers.some((specifier)=>__rspack_external__babel_types_6e8337dd.isImportNamespaceSpecifier(specifier))) {
+                    const specifier = value.node.source.value;
+                    const source = resolveSource(workspacePath(value.module), specifier);
+                    return source ? inspect(source) : foreignSpecifier(specifier);
+                }
+                if ('node' !== value.kind || seenValues.has(value.node)) return false;
+                seenValues.add(value.node);
+                const { node, module } = value;
+                if ((__rspack_external__babel_types_6e8337dd.isCallExpression(node) || __rspack_external__babel_types_6e8337dd.isOptionalCallExpression(node)) && graph.evaluate(module, node.callee).some((callee)=>'external' === callee.kind && callee.specifier === effect && clientFactories.has(callee.name))) {
+                    const [argument] = node.arguments;
+                    const binding = argument ? graphBinding(graph, module, argument) : void 0;
+                    if (module.boundary !== owner || binding?.kind !== 'declaration' || binding.module.boundary !== owner) return true;
+                }
+                return nestedValues(node).some((expression)=>graph.evaluate(module, expression).some((nested)=>foreignValue(nested, module)));
+            };
+            const exportName = (node)=>__rspack_external__babel_types_6e8337dd.isIdentifier(node) ? node.name : node.value;
+            const names = (source, visited = new Set())=>{
+                if (visited.has(source)) return [];
+                visited.add(source);
+                return graph.module(absolute(source)).file.program.body.flatMap((statement)=>{
+                    if (__rspack_external__babel_types_6e8337dd.isExportDefaultDeclaration(statement)) return [
+                        'default'
+                    ];
+                    if (!__rspack_external__babel_types_6e8337dd.isExportNamedDeclaration(statement) && !__rspack_external__babel_types_6e8337dd.isExportAllDeclaration(statement) || 'type' === statement.exportKind) return [];
+                    if (__rspack_external__babel_types_6e8337dd.isExportAllDeclaration(statement)) {
+                        const target = resolveSource(source, statement.source.value);
+                        return target ? names(target, visited).filter((name)=>'default' !== name) : [];
+                    }
+                    return statement.declaration ? Object.keys(__rspack_external__babel_types_6e8337dd.getOuterBindingIdentifiers(statement.declaration)) : statement.specifiers.flatMap((specifier)=>__rspack_external__babel_types_6e8337dd.isExportSpecifier(specifier) && 'type' === specifier.exportKind ? [] : [
+                            exportName(specifier.exported)
+                        ]);
+                });
+            };
+            const exportedValue = (source, name)=>{
+                const visited = seenExports.get(source) ?? new Set();
+                if (visited.has(name)) return false;
+                visited.add(name);
+                seenExports.set(source, visited);
+                const module = graph.module(absolute(source));
+                const evaluates = (from, node)=>graph.evaluate(from, node).some((value)=>foreignValue(value, from));
+                const binding = graph.resolve(module, name, 'export');
+                if (binding?.kind === 'external') return foreignValue({
+                    ...binding,
+                    members: []
+                }, module);
+                if (binding?.kind === 'declaration') return evaluates(binding.module, binding.expression);
+                for (const statement of module.file.program.body){
+                    if (__rspack_external__babel_types_6e8337dd.isExportDefaultDeclaration(statement) && 'default' === name) return evaluates(module, statement.declaration);
+                    if (!__rspack_external__babel_types_6e8337dd.isExportNamedDeclaration(statement) || 'type' === statement.exportKind) continue;
+                    if (__rspack_external__babel_types_6e8337dd.isFunctionDeclaration(statement.declaration) && statement.declaration.id?.name === name) return evaluates(module, statement.declaration);
+                    const specifier = statement.specifiers.find((item)=>exportName(item.exported) === name);
+                    if (!specifier) continue;
+                    if (__rspack_external__babel_types_6e8337dd.isExportSpecifier(specifier) && 'type' === specifier.exportKind) return false;
+                    if (!statement.source) return __rspack_external__babel_types_6e8337dd.isExportSpecifier(specifier) ? evaluates(module, specifier.local) : false;
+                    const target = resolveSource(source, statement.source.value);
+                    if (!target) return foreignSpecifier(statement.source.value);
+                    if (__rspack_external__babel_types_6e8337dd.isExportNamespaceSpecifier(specifier)) return inspect(target);
+                    if (__rspack_external__babel_types_6e8337dd.isExportSpecifier(specifier)) return exportedValue(target, exportName(specifier.local));
+                }
+                return module.file.program.body.some((statement)=>{
+                    if (!__rspack_external__babel_types_6e8337dd.isExportAllDeclaration(statement) || 'type' === statement.exportKind) return false;
+                    const target = resolveSource(source, statement.source.value);
+                    return !!target && names(target).includes(name) && exportedValue(target, name);
+                });
+            };
+            const inspect = (source)=>[
+                    ...new Set(names(source))
+                ].some((name)=>exportedValue(source, name));
+            return inspect(entry);
+        };
+        const ownerClients = new Map();
+        for (const app of apps)if (exists(`${app.path}/package.json`)) {
+            const manifest = JSON.parse(read(`${app.path}/package.json`));
+            for (const key of [
+                './api/client',
+                './api/rpc-client'
+            ]){
+                const file = clientExportFile(app.path, manifest.exports?.[key]);
+                if (file) ownerClients.set(`${manifest.name}${key.slice(1)}`, file);
+            }
         }
-        if (exists(`${shell}/package.json`)) guarded(`${shell}/package.json`, ()=>assert(JSON.parse(read(`${shell}/package.json`)).exports?.['./api/clients'] === './src/api/vertical-clients.ts', `${shell}/package.json: must export ./api/clients`));
+        for (const shell of apps.filter((app)=>'shell' === app.kind))guarded(shell.path, ()=>checkShellExports(normalize(shell.path)));
         if (exists('topology/reference-topology.json')) guarded('topology/reference-topology.json', ()=>{
             for (const vertical of JSON.parse(read('topology/reference-topology.json')).verticals ?? []){
                 if (vertical.api?.runtime === 'effect') {