@nifrajs/cli 5.0.0 → 5.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/cli",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "The nifra CLI - zero-config dev/build/start for a nifra app (`nifra dev`, `nifra build`, `nifra start`).",
   "keywords": [
     "bun",
@@ -69,16 +69,16 @@
     "access": "public"
   },
   "dependencies": {
-    "@nifrajs/client": "5.0.0",
-    "@nifrajs/core": "5.0.0",
-    "@nifrajs/agent-review": "5.0.0",
-    "@nifrajs/i18n": "5.0.0",
-    "@nifrajs/mcp": "5.0.0",
-    "@nifrajs/mcp-db": "5.0.0",
-    "@nifrajs/runner": "5.0.0",
-    "@nifrajs/schema": "5.0.0",
-    "@nifrajs/testing": "5.0.0",
-    "@nifrajs/web": "5.0.0"
+    "@nifrajs/client": "5.1.0",
+    "@nifrajs/core": "5.1.0",
+    "@nifrajs/agent-review": "5.1.0",
+    "@nifrajs/i18n": "5.1.0",
+    "@nifrajs/mcp": "5.1.0",
+    "@nifrajs/mcp-db": "5.1.0",
+    "@nifrajs/runner": "5.1.0",
+    "@nifrajs/schema": "5.1.0",
+    "@nifrajs/testing": "5.1.0",
+    "@nifrajs/web": "5.1.0"
   },
   "repository": {
     "type": "git",

package/src/assure-hydration.ts

@@ -13,6 +13,7 @@ import { collectDoctorResult } from "./doctor.ts"
 import { loadApp, resolvePlugins } from "./load.ts"
 import {
   CHILD_OUTPUT_MAX_BYTES,
+  escalatingStop,
   forwardTerminalSignals,
   joinHeadTail,
   OWN_PROCESS_GROUP,
@@ -647,10 +648,11 @@ export async function runHydrationAssurance(
       detached: OWN_PROCESS_GROUP,
     },
   )
+  const stopper = escalatingStop((name) => signalProcessGroup(proc, name))
   let stopped: string | undefined
   const stop = (reason: string): void => {
     stopped ??= reason
-    signalProcessGroup(proc, "SIGTERM")
+    stopper.stop()
   }
   const onAbort = (): void => stop("cancelled")
   control.signal?.addEventListener("abort", onAbort, { once: true })
@@ -684,6 +686,7 @@ export async function runHydrationAssurance(
     return failed(joinHeadTail(stderr).trim() || "no result")
   } finally {
     clearTimeout(timer)
+    stopper.dispose()
     control.signal?.removeEventListener("abort", onAbort)
     releaseSignals()
   }

package/src/assure.ts

@@ -3,9 +3,10 @@
 import { existsSync } from "node:fs"
 import { join, resolve } from "node:path"
 import { pathToFileURL } from "node:url"
-import type { AssuranceConfig, AssuranceReport } from "@nifrajs/core/assurance"
+import type { AssuranceConfig, AssuranceReport, AssuredRoute } from "@nifrajs/core/assurance"
 import { CONFIG_FILE, FRAMEWORK_FILE } from "./app-files.ts"
 import type { Diagnostic } from "./diagnostics.ts"
+import type { ProjectVerification } from "./verification.ts"
 
 export interface AssureSink {
   record(bundle: AssureBundle): Promise<void>
@@ -14,6 +15,7 @@ export interface AssureSink {
 export interface GateResult {
   readonly gate:
     | "check"
+    | "assurance"
     | "doctor"
     | "render"
     | "hydration"
@@ -91,6 +93,45 @@ export async function loadAssuranceConfig(
   return loaded.default
 }
 
+/** Why declared response/error schemas go unenforced, phrased for the server that has to change. */
+export interface ResponseContractGaps {
+  readonly typedOnly: readonly string[]
+  readonly warnOnly: readonly string[]
+  readonly typedOnlyReason: string | undefined
+  readonly warnOnlyReason: string | undefined
+}
+
+const sample = (routes: readonly string[]): string =>
+  routes.length <= 3
+    ? routes.join(", ")
+    : `${routes.slice(0, 3).join(", ")} and ${routes.length - 3} more`
+
+export function responseContractGaps(routes: readonly AssuredRoute[]): ResponseContractGaps {
+  const key = (route: AssuredRoute): string => `${route.method} ${route.path}`
+  const typedOnly = routes.filter((route) => route.responseContract === "unchecked").map(key)
+  const warnOnly = routes.filter((route) => route.responseContract === "warn").map(key)
+  const covered = routes.filter(
+    (route) => route.responseContract === "enforce" || route.responseContract === "warn",
+  ).length
+  // A plugin that covers some routes is installed - just not where these were registered, which is
+  // the case "install responseContract" advice used to send people in circles over.
+  const typedOnlyReason =
+    typedOnly.length === 0
+      ? undefined
+      : covered > 0
+        ? `${typedOnly.length} declared route(s) are typed-only (${sample(typedOnly)}) although responseContract() covers ${covered} other(s): it covers routes registered after it on the same server, and routes merge()d into that server after it. Install responseContract("enforce") on the server that registers these, before them.`
+        : `${typedOnly.length} declared route(s) are typed-only (${sample(typedOnly)}); install responseContract("enforce") on the server that registers them, before them - a parent's also covers servers merge()d into it afterwards.`
+  const warnOnlyReason =
+    warnOnly.length === 0
+      ? undefined
+      : `${warnOnly.length} declared route(s) are warn-only and still send the original payload (${sample(warnOnly)}); switch responseContract("warn") to "enforce".`
+  return { typedOnly, warnOnly, typedOnlyReason, warnOnlyReason }
+}
+
+/** The policy line that turns an unenforced contract into a route-assurance failure. */
+export const RESPONSE_CONTRACT_BASELINE_HINT =
+  'to fail route assurance on these, add baseline: [{ name: "response-contract", match: { hasResponse: true }, require: ["nifra.response-contract"] }] to the policy'
+
 export function formatAssuranceReport(report: AssuranceReport): string {
   if (report.ok) {
     const contracted = report.routes.filter((route) => route.responseContract !== undefined)
@@ -247,20 +288,57 @@ export async function collectAssureBundle(
     }
   }
 
+  // One verification serves both gates that read the app, so the config is evaluated once.
+  let verification: Promise<ProjectVerification> | undefined
+  const verify = (): Promise<ProjectVerification> =>
+    (verification ??= import("./verification.ts").then(({ collectProjectVerification }) =>
+      collectProjectVerification(cwd, {
+        ...(options.config !== undefined ? { config: options.config } : {}),
+        preloaded:
+          assuranceConfig !== undefined
+            ? { config: assuranceConfig }
+            : { error: assuranceConfigError },
+      }),
+    ))
+
   await addGate("check", async () => {
-    const { collectProjectVerification } = await import("./verification.ts")
-    const verification = await collectProjectVerification(cwd, {
-      ...(options.config !== undefined ? { config: options.config } : {}),
-      preloaded:
-        assuranceConfig !== undefined
-          ? { config: assuranceConfig }
-          : { error: assuranceConfigError },
-    })
-    const result = await verification.check()
+    const result = await (await verify()).check()
     const diagnostics = (result.structuredDiagnostics ?? []).map((item) => item)
     return { diagnostics }
   })
 
+  // Route assurance is the gate the bundle exists to carry: a failing policy fails it, and a declared
+  // response the runtime does not enforce is a warning, so `--strict` refuses to call it green.
+  await addGate("assurance", async () => {
+    const report = assuranceConfig === undefined ? undefined : (await verify()).routeAssurance
+    if (report === undefined)
+      return {
+        diagnostics: [],
+        skipReason: existsSync(resolve(cwd, options.config ?? DEFAULT_ASSURANCE_CONFIG))
+          ? "route assurance could not be evaluated (reported by the check gate)"
+          : "no route assurance config",
+      }
+    const diagnostics = report.findings.map((finding) =>
+      diagnosticFromMessage("NF-A001", finding.message, "error"),
+    )
+    const gaps = responseContractGaps(report.routes)
+    for (const [reason, routes] of [
+      [gaps.typedOnlyReason, gaps.typedOnly],
+      [gaps.warnOnlyReason, gaps.warnOnly],
+    ] as const) {
+      if (reason === undefined) continue
+      diagnostics.push(
+        Object.freeze({
+          code: "NF-A001",
+          severity: "warn" as const,
+          message: `${reason} (${RESPONSE_CONTRACT_BASELINE_HINT})`,
+          evidence: Object.freeze(routes.slice(0, 20)),
+        }),
+      )
+    }
+    return { diagnostics }
+  })
+
   await addGate("doctor", async () => {
     const { collectDoctorResult } = await import("./doctor.ts")
     const result = await collectDoctorResult(cwd)

package/src/capabilities-tool.ts

@@ -18,7 +18,13 @@ import {
 } from "@nifrajs/core/capabilities"
 import { expandOptionalParams } from "@nifrajs/core/pattern"
 import { type ReflectedMount, type ReflectedRoute, reflectRoutes } from "@nifrajs/core/reflection"
-import { scanStaticRouteText, scanStaticSocketText, stripComments, walkSource } from "./check.ts"
+import {
+  scanSkippedRouteText,
+  scanStaticRouteText,
+  scanStaticSocketText,
+  stripComments,
+  walkSource,
+} from "./check.ts"
 
 // Import and re-export clauses are spelled out (a default binding, then `* as ns` or a `{ … }` list)
 // rather than scanned lazily, which is quadratic on a long semicolon-free module.
@@ -340,6 +346,7 @@ export async function collectCapabilityProjectReport(
   const policy = defineCapabilityPolicy(policyInput)
   const sources = await readSources(cwd)
   const automatic = new Map<string, Set<string>>()
+  const skipped = new Map<string, string>()
   for (const [file, content] of sources) {
     for (const route of [
       ...scanStaticRouteText(file, content, undefined, sources),
@@ -352,6 +359,12 @@ export async function collectCapabilityProjectReport(
         automatic.set(routeKey(route.method, path), modules)
       }
     }
+    for (const route of scanSkippedRouteText(file, content, sources)) {
+      for (const path of staticRouteForms(route.path)) {
+        if (!skipped.has(routeKey(route.method, path)))
+          skipped.set(routeKey(route.method, path), `${file}:${route.line}`)
+      }
+    }
   }
 
   const evidenceRoutes = []
@@ -380,12 +393,25 @@ export async function collectCapabilityProjectReport(
       policy,
       sources,
     )
-    evidenceRoutes.push({
-      method: route.method,
-      path: route.path,
-      covered: modules.size > 0 && walked.covered,
-      evidence: walked.evidence,
-    })
+    const site = modules.size === 0 ? skipped.get(routeKey(route.method, route.path)) : undefined
+    const uncoveredReason =
+      modules.size > 0
+        ? undefined
+        : site === undefined
+          ? "no source file registers it with a path the static scan can read; map it with capabilities.provenance.routeModules"
+          : `${site} appears to register it on a server the static scan cannot identify (built by a helper that is neither \`server()\` nor imported from a module that calls it); call server() there, or map the route with capabilities.provenance.routeModules`
+    const covered = modules.size > 0 && walked.covered
+    evidenceRoutes.push(
+      uncoveredReason === undefined
+        ? { method: route.method, path: route.path, covered, evidence: walked.evidence }
+        : {
+            method: route.method,
+            path: route.path,
+            covered,
+            evidence: walked.evidence,
+            uncoveredReason,
+          },
+    )
     violations.push(...walked.violations)
     truncations.push(...walked.truncations)
   }

package/src/check-diagnostics.ts

@@ -368,6 +368,8 @@ export interface CheckTypecheckResult {
   readonly note?: string
   readonly output?: string
   readonly missingTypeScript?: boolean
+  /** TypeScript sources found with no tsconfig.json to typecheck them. */
+  readonly sourcesWithoutTsconfig?: number
   readonly outsideProgram?: readonly string[]
 }
 

package/src/check-scan.ts

@@ -352,15 +352,59 @@ export function parseSimpleFetchCall(snippet: string): SimpleFetchCall | undefin
   return { path, method, start: match.index, end: close + 1 }
 }
 
-function isPotentialBackendSource(code: string): boolean {
+const SERVER_CONSTRUCTION = /(?<![.\w])server\s*\(|new\s+Hono(?:<[^>]+>)?\s*\(/
+
+function isPotentialBackendSource(
+  code: string,
+  file?: string,
+  project?: ReadonlyMap<string, string>,
+): boolean {
   return (
     code.includes("@nifrajs/core") ||
-    /(?<![.\w])server\s*\(/.test(code) ||
+    SERVER_CONSTRUCTION.test(code) ||
     /(?:from\s*|import\s*)["']hono["']/.test(code) ||
-    /new\s+Hono(?:<[^>]+>)?\s*\(/.test(code)
+    (file !== undefined && project !== undefined && callsLocalServerFactory(code, file, project))
   )
 }
 
+/**
+ * A module that builds its server through a local helper - `newServer().get(...)` with `newServer`
+ * imported from a project file that calls `server()` - names neither `@nifrajs/core` nor `server(`
+ * itself. One import hop is followed: the imported module must construct a server, so a helper module
+ * that merely mentions `@nifrajs/core` (a schema re-export) does not turn every importer into a
+ * backend and its `client.get("/x")` calls into routes.
+ */
+function callsLocalServerFactory(
+  code: string,
+  file: string,
+  project: ReadonlyMap<string, string>,
+): boolean {
+  for (const [local, binding] of namedImports(code)) {
+    if (!new RegExp(`(?<![.\\w$])${local.replaceAll("$", "\\$")}\\s*\\(`).test(code)) continue
+    const target = projectModule(project, file, binding.specifier)
+    if (target !== undefined && SERVER_CONSTRUCTION.test(stripComments(project.get(target) ?? "")))
+      return true
+  }
+  return false
+}
+
+/**
+ * Literal route registrations in a file the backend-source gate turned away, so a route the scan
+ * could not cover can say where it probably lives. Nothing here is treated as a route.
+ */
+export function scanSkippedRouteText(
+  file: string,
+  content: string,
+  project?: ReadonlyMap<string, string>,
+): StaticRouteFinding[] {
+  const code = stripComments(content)
+  if (isPotentialBackendSource(code, file, project)) return []
+  return [
+    ...scanRoutePattern(file, content, code, ROUTE_REGISTRATION_DQ),
+    ...scanRoutePattern(file, content, code, ROUTE_REGISTRATION_SQ),
+  ]
+}
+
 function scanRoutePattern(
   file: string,
   content: string,
@@ -727,7 +771,7 @@ export function scanStaticRouteText(
   project?: ReadonlyMap<string, string>,
 ): StaticRouteFinding[] {
   const code = stripComments(content)
-  if (!isPotentialBackendSource(code)) return []
+  if (!isPotentialBackendSource(code, file, project)) return []
   return [
     ...scanRoutePattern(file, content, code, ROUTE_REGISTRATION_DQ, facts),
     ...scanRoutePattern(file, content, code, ROUTE_REGISTRATION_SQ, facts),
@@ -849,7 +893,7 @@ function scanRouteArguments(
   const routes: StaticRouteFinding[] = []
   const unresolved: UnresolvedRoutePathFinding[] = []
   const code = stripComments(content)
-  if (!isPotentialBackendSource(code)) return { routes, unresolved }
+  if (!isPotentialBackendSource(code, file, project)) return { routes, unresolved }
   const lines = content.split("\n")
   const constants = moduleConstants(code, content)
   const imports = namedImports(code)
@@ -922,7 +966,7 @@ export function scanStaticSocketText(
   project?: ReadonlyMap<string, string>,
 ): StaticRouteFinding[] {
   const code = stripComments(content)
-  if (!isPotentialBackendSource(code)) return []
+  if (!isPotentialBackendSource(code, file, project)) return []
   return [
     ...scanRoutePattern(file, content, code, ROUTE_REGISTRATION_DQ, facts, SOCKET_VERB),
     ...scanRoutePattern(file, content, code, ROUTE_REGISTRATION_SQ, facts, SOCKET_VERB),
@@ -2939,7 +2983,8 @@ function staticImportEdges(
   for (let m = re.exec(code); m !== null; m = re.exec(code)) {
     if (positions[m.index] === " ") continue
     if (m[1] === undefined) continue
-    if (facts !== undefined && file !== undefined) {
+    // Only a `type` modifier can erase a clause the pattern matched, so other clauses skip the parse.
+    if (facts !== undefined && file !== undefined && /\btype\b/.test(m[0])) {
       const source = facts.parse(file, content)
       if (source !== undefined && facts.isValueImportAt(source, m.index, m[1]) === false) continue
     }
@@ -3020,12 +3065,14 @@ function importEdges(
   return edges.sort((a, b) => a.index - b.index)
 }
 
-/** The runtime imports of a module with the line each sits on, in source order. Pure. */
+/** The runtime imports of a module with the line each sits on, in source order. With `facts`, an
+ * import the compiler erases (`import { type X }`) is none. Pure. */
 export function importSites(
   content: string,
   file?: string,
+  facts?: SourceFacts,
 ): Array<{ readonly specifier: string; readonly line: number }> {
-  return importEdges(content, undefined, file).map(({ specifier, index }) => ({
+  return importEdges(content, facts, file).map(({ specifier, index }) => ({
     specifier,
     line: lineAt(content, index),
   }))

package/src/check.ts

@@ -19,7 +19,7 @@
 import { existsSync, mkdtempSync, readFileSync, realpathSync, rmdirSync, rmSync } from "node:fs"
 import { tmpdir } from "node:os"
 import { dirname, isAbsolute, join, relative, resolve } from "node:path"
-import { specifierPackage } from "@nifrajs/web/zones"
+import { declaredSide, specifierPackage } from "@nifrajs/web/zones"
 import { BACKEND_APP_FILE } from "./app-files.ts"
 import {
   type CheckAssuranceContext,
@@ -33,6 +33,7 @@ import {
 import { appDirs, clientModuleRoot } from "./client-module.ts"
 import { checkContractsLock, DEFAULT_CONTRACTS_LOCK } from "./contracts.ts"
 import { type Diagnostic, normalizeSeverity, toSarifLog } from "./diagnostics.ts"
+import { installedManifest } from "./internal/installed-package.ts"
 import { createApiOnlyProbe, createNifraProjectProbe } from "./internal/nifra-project.ts"
 import { createSpecifierResolver } from "./internal/project-specifiers.ts"
 import { createSourceFacts } from "./internal/source-facts.ts"
@@ -95,6 +96,10 @@ interface TypecheckResult {
   /** tsconfig.json exists but no `typescript` install was found walking up from cwd. The contract
    * gate could not run - the caller surfaces this as a FAILING diagnostic, never a silent skip. */
   readonly missingTypeScript?: boolean
+  /** No tsconfig.json at the project root. Fails the check only when TypeScript sources exist. */
+  readonly missingTsconfig?: boolean
+  /** TypeScript sources the scan found with no tsconfig.json to typecheck them. */
+  readonly sourcesWithoutTsconfig?: number
   /** Every file in the compiler's program, absolute. Absent when the compiler listed none. */
   readonly programFiles?: readonly string[]
   /** Zoned TypeScript files outside the program, project-relative: the typecheck never read them. */
@@ -123,7 +128,7 @@ function resolveTscBin(cwd: string): string | undefined {
 async function typecheck(cwd: string, signal?: AbortSignal): Promise<TypecheckResult> {
   const tsconfig = join(cwd, "tsconfig.json")
   if (!(await Bun.file(tsconfig).exists()))
-    return { ran: false, ok: true, note: "no tsconfig.json" }
+    return { ran: false, ok: true, missingTsconfig: true, note: "no tsconfig.json" }
   // Routes import their generated `./+types` modules; bring them up to date before tsc reads them.
   const { refreshRouteTypes } = await import("./route-types.ts")
   refreshRouteTypes(cwd, () => {})
@@ -309,6 +314,16 @@ async function collectContractFacts(cwd: string): Promise<ContractCheckFacts> {
   }
 }
 
+/** A project whose TypeScript no tsconfig.json covers has no typecheck to pass: the gate fails. */
+function withoutTsconfig(
+  result: TypecheckResult,
+  sourceFiles: ReadonlyArray<{ readonly file: string }>,
+): TypecheckResult {
+  if (result.missingTsconfig !== true) return result
+  const sources = sourceFiles.filter(({ file }) => !/\.d\.[cm]?ts$/.test(file)).length
+  return sources === 0 ? result : { ...result, ok: false, sourcesWithoutTsconfig: sources }
+}
+
 /** Record the zoned files the compiler's program left out, minus the typecheck rule's `ignore` globs. */
 function withProgramCoverage(
   cwd: string,
@@ -376,11 +391,10 @@ async function buildProjectScan(
 
   // tsc compiles TypeScript sources only; the JavaScript and component files the scan reads are no
   // program's to cover.
-  const typecheckResult = withProgramCoverage(
-    cwd,
-    typecheckRun,
-    sourceFiles.filter(({ file }) => /\.[cm]?tsx?$/.test(file)),
-    checkConfig,
+  const typeScriptSources = sourceFiles.filter(({ file }) => /\.[cm]?tsx?$/.test(file))
+  const typecheckResult = withoutTsconfig(
+    withProgramCoverage(cwd, typecheckRun, typeScriptSources, checkConfig),
+    typeScriptSources,
   )
 
   // TypeScript 7's unstable API materializes source files through one project session. Build the
@@ -390,7 +404,24 @@ async function buildProjectScan(
   const loadedTypeScript = await loadProjectTypeScript(cwd, opts.loadTypeScript, source)
   try {
     const sqlCompiler = loadedTypeScript.compiler
-    const sourceFacts = sqlCompiler === undefined ? undefined : createSourceFacts(sqlCompiler)
+    // Resolved modules stay project-relative, as the scanned files are: the zone of a path is read
+    // from its folders, and a checkout under a folder named `backend/` must not make it all backend.
+    // The resolver answers with real paths, so the project root is read as one too.
+    const realCwd = (() => {
+      try {
+        return realpathSync(cwd)
+      } catch {
+        return cwd
+      }
+    })()
+    const resolveSpecifier = createSpecifierResolver()
+    const sourceFacts =
+      sqlCompiler === undefined
+        ? undefined
+        : createSourceFacts(sqlCompiler, {
+            keepsTypeOnlyImports: (file) =>
+              resolveSpecifier.keepsTypeOnlyImports(isAbsolute(file) ? file : join(realCwd, file)),
+          })
     const sqlImports = sqlCompiler === undefined ? undefined : createProjectSqlImports(cwd)
     const project = new Map(
       sourceFiles.map(({ file, content }) => [file.replaceAll("\\", "/"), content]),
@@ -403,17 +434,6 @@ async function buildProjectScan(
         interpolatedSql.push(...scanSqlSites(file, content, sqlCompiler, sqlImports))
     }
 
-    // Resolved modules stay project-relative, as the scanned files are: the zone of a path is read
-    // from its folders, and a checkout under a folder named `backend/` must not make it all backend.
-    // The resolver answers with real paths, so the project root is read as one too.
-    const realCwd = (() => {
-      try {
-        return realpathSync(cwd)
-      } catch {
-        return cwd
-      }
-    })()
-    const resolveSpecifier = createSpecifierResolver()
     const projectPath = (path: string): string => {
       const rel = relative(realCwd, path).replaceAll("\\", "/")
       return rel.startsWith("../") || isAbsolute(rel) ? path : rel
@@ -439,7 +459,7 @@ async function buildProjectScan(
     // An app's `clientModule` is browser code wherever it lives: the generated client entry imports it.
     const browserRoots = new Set<string>()
     for (const app of appDirs(source.files)) {
-      const entry = clientModuleRoot(cwd, app, resolveSpecifier)
+      const entry = clientModuleRoot(cwd, app, resolveSpecifier, sqlCompiler)
       if (entry === undefined) continue
       const rel = projectPath(entry.file)
       if (isBrowserSource(rel) || browserRoots.has(rel)) continue
@@ -448,28 +468,24 @@ async function buildProjectScan(
       browserRoots.add(rel)
       browserModules.push({ rel, content })
     }
-    // Node's lookup: the nearest `node_modules/<name>` at or above the importing file.
+    // The side the package gives the entry the import names: package-wide, or per entry.
     const backendPackage = (fromFile: string, specifier: string): boolean => {
       const name = specifierPackage(specifier)
       if (name === undefined) return false
-      let dir = dirname(isAbsolute(fromFile) ? fromFile : join(realCwd, fromFile))
-      for (;;) {
-        const manifest = join(dir, "node_modules", name, "package.json")
-        if (existsSync(manifest)) {
-          try {
-            const nifra: unknown = JSON.parse(readFileSync(manifest, "utf8"))?.nifra
-            return (
-              typeof nifra === "object" &&
-              nifra !== null &&
-              Reflect.get(nifra, "environment") === "backend"
-            )
-          } catch {
-            return false
-          }
-        }
-        const parent = dirname(dir)
-        if (parent === dir) return false
-        dir = parent
+      const manifest = installedManifest(
+        isAbsolute(fromFile) ? fromFile : join(realCwd, fromFile),
+        name,
+      )
+      if (manifest === undefined) return false
+      try {
+        const nifra: unknown = JSON.parse(readFileSync(manifest, "utf8"))?.nifra
+        return (
+          typeof nifra === "object" &&
+          nifra !== null &&
+          declaredSide(Reflect.get(nifra, "environment"), specifier) === "backend"
+        )
+      } catch {
+        return false
       }
     }
     const serverOnlyChains = createServerOnlyChains({