@nifrajs/cli 5.0.0 → 5.1.0

package/src/rules/pages.ts

@@ -14,7 +14,7 @@
 import { existsSync, readFileSync } from "node:fs"
 import { join } from "node:path"
 import { discoverRoutes } from "@nifrajs/web/fs"
-import { shadowedPages } from "@nifrajs/web/route-manifest"
+import { BACKEND_ROUTE_EXPORTS, shadowedPages } from "@nifrajs/web/route-manifest"
 import type * as TSApi from "typescript"
 import { BACKEND_APP_FILE, CONFIG_FILE, FRAMEWORK_FILE } from "../app-files.ts"
 import { stripComments } from "../check-scan.ts"
@@ -159,10 +159,24 @@ export const statusLayoutRule: CheckRule = {
   },
 }
 
+/** The two framework configs' sources, `undefined` for one the app lacks. */
+export interface ApiPrefixSources {
+  readonly framework: string | undefined
+  readonly config: string | undefined
+}
+
+/** `apiPrefix` as the app runs it: nifra.config.ts's own, else backend/framework.ts's, which every
+ * command takes for an option nifra.config.ts leaves unset. */
+function effectiveApiPrefix({ framework, config }: ApiPrefixSources): StaticApiPrefix {
+  const own: StaticApiPrefix =
+    config === undefined ? { kind: "default" } : readStaticApiPrefix(config)
+  return own.kind !== "default" || framework === undefined ? own : readStaticApiPrefix(framework)
+}
+
 /**
- * NF-C035: `backend/app.ts` exports a backend and the framework config sets no `apiPrefix`, so the
- * backend is not served over HTTP - a browser call to `/api` reaches page routing. Loader-only is a
- * valid choice; the finding asks for it to be stated. An unreadable `apiPrefix` is NF-C027's to report.
+ * NF-C035: `backend/app.ts` exports a backend that is not served over HTTP, so a browser call to `/api`
+ * reaches page routing. The framework config sets no `apiPrefix`; loader-only is a valid choice, and
+ * the finding asks for it to be stated. An unreadable `apiPrefix` is NF-C027's.
  */
 export const implicitApiMountRule: CheckRule = {
   code: "NF-C035",
@@ -172,18 +186,16 @@ export const implicitApiMountRule: CheckRule = {
     // An API-only app serves its backend itself; there is no page routing to fall into.
     if (!existsSync(backendFile) || !hasWebConfig(ctx.root, ".")) return []
     if (!BACKEND_EXPORT.test(stripComments(readFileSync(backendFile, "utf8")))) return []
-    const configFile = CONFIG_FILES.find((file) => existsSync(join(ctx.root, file)))
-    if (
-      configFile !== undefined &&
-      readStaticApiPrefix(readFileSync(join(ctx.root, configFile), "utf8")).kind !== "default"
-    ) {
-      return []
-    }
-    const file = configFile ?? FRAMEWORK_FILE
+    const read = (file: string): string | undefined =>
+      existsSync(join(ctx.root, file)) ? readFileSync(join(ctx.root, file), "utf8") : undefined
+    const sources = { framework: read(FRAMEWORK_FILE), config: read(CONFIG_FILE) }
+    if (sources.framework === undefined && sources.config === undefined) return []
+    if (effectiveApiPrefix(sources).kind !== "default") return []
+    const file = sources.framework === undefined ? CONFIG_FILE : FRAMEWORK_FILE
     return [
       diagnostic({
         code: "NF-C035",
-        severity: "info",
+        severity: "warn",
         file,
         message: `${BACKEND_APP_FILE}'s backend is not served over HTTP, because ${file} sets no apiPrefix: a browser call to /api reaches page routing instead. Add \`export const apiPrefix = "/api"\` to ${file} to serve it there, as 4.x did by default, or \`export const apiPrefix = ""\` to keep it loader-only.`,
         fix: { recipe: "framework.api-prefix", command: "nifra fix --code NF-C035" },
@@ -193,32 +205,54 @@ export const implicitApiMountRule: CheckRule = {
   },
 }
 
+const appendLine = (source: string, line: string): string =>
+  source === "" ? line : `${source}${source.endsWith("\n") ? "" : "\n"}${line}`
+
 /** Append `export const apiPrefix = "/api"` to a framework config that sets none, creating it if needed. */
 export function withDefaultApiPrefix(source: string | undefined): string | undefined {
   if (source !== undefined && readStaticApiPrefix(source).kind !== "default") return undefined
-  const line = 'export const apiPrefix = "/api"\n'
-  if (source === undefined || source === "") return line
-  return `${source}${source.endsWith("\n") ? "" : "\n"}${line}`
+  return appendLine(source ?? "", 'export const apiPrefix = "/api"\n')
+}
+
+/**
+ * The edit that serves the backend at `/api`: the mount in backend/framework.ts, where the server
+ * entry reads it, or in nifra.config.ts when it is the only config. A file that needs no edit comes
+ * back `undefined`; an `apiPrefix` either file sets is never replaced.
+ */
+export function apiPrefixFix(sources: ApiPrefixSources): ApiPrefixSources {
+  if (effectiveApiPrefix(sources).kind !== "default")
+    return { framework: undefined, config: undefined }
+  return sources.framework === undefined
+    ? { framework: undefined, config: withDefaultApiPrefix(sources.config) }
+    : { framework: withDefaultApiPrefix(sources.framework), config: undefined }
 }
 
 const LOADER_EXPORT =
   /\bexport\s+(?:async\s+)?(?:const|let|var|function\*?)\s+loader\b|\bexport\s*\{[^}]*\bloader\b[^}]*\}/
 const SCRIPT_LAYOUT = /\.[cm]?[jt]sx?$/
 
-const hasModifier = (ts: typeof TSApi, node: TSApi.Node, kind: TSApi.SyntaxKind): boolean =>
-  ts.canHaveModifiers(node) && (ts.getModifiers(node) ?? []).some((m) => m.kind === kind)
+// Read from the node, not `ts.getModifiers`: TypeScript 7's API has no getModifiers or canHaveModifiers.
+const hasModifier = (
+  node: TSApi.VariableStatement | TSApi.FunctionDeclaration | TSApi.ClassDeclaration,
+  kind: TSApi.SyntaxKind,
+): boolean => node.modifiers?.some((m) => m.kind === kind) === true
 
-/** The function an exported `meta` names: a declaration, or a const initialized with one. */
-function exportedMetaFunction(
+/** The function an exported `name` names: a declaration, or a const initialized with one. */
+function exportedFunction(
   ts: typeof TSApi,
   tree: TSApi.SourceFile,
+  name: string,
 ): TSApi.FunctionDeclaration | TSApi.ArrowFunction | TSApi.FunctionExpression | undefined {
   for (const statement of tree.statements) {
-    if (!hasModifier(ts, statement, ts.SyntaxKind.ExportKeyword)) continue
-    if (ts.isFunctionDeclaration(statement) && statement.name?.text === "meta") return statement
+    if (ts.isFunctionDeclaration(statement)) {
+      if (statement.name?.text === name && hasModifier(statement, ts.SyntaxKind.ExportKeyword))
+        return statement
+      continue
+    }
     if (!ts.isVariableStatement(statement)) continue
+    if (!hasModifier(statement, ts.SyntaxKind.ExportKeyword)) continue
     for (const declaration of statement.declarationList.declarations) {
-      if (!ts.isIdentifier(declaration.name) || declaration.name.text !== "meta") continue
+      if (!ts.isIdentifier(declaration.name) || declaration.name.text !== name) continue
       let init = declaration.initializer
       while (
         init !== undefined &&
@@ -237,7 +271,7 @@ function exportedMetaFunction(
 
 /** Where an exported function `meta` reads its args' `data`: a destructured `data`, or `args.data`. */
 export function metaDataReads(ts: typeof TSApi, tree: TSApi.SourceFile): number[] {
-  const meta = exportedMetaFunction(ts, tree)
+  const meta = exportedFunction(ts, tree, "meta")
   const param = meta?.parameters[0]
   if (param === undefined) return []
   const lineOf = (node: TSApi.Node) =>
@@ -326,9 +360,217 @@ export const layoutMetaDataRule: CheckRule = {
   },
 }
 
+const GATE_EXPORT = /\bexport\s+const\s+gate\s*(?::\s*boolean\s*)?=\s*true\b/
+const MIDDLEWARE_EXPORT =
+  /\bexport\s+(?:async\s+)?(?:const|let|var|function\*?)\s+middleware\b|\bexport\s*\{[^}]*\bmiddleware\b[^}]*\}/
+
+/** Lines where an exported `loader` refuses access: `redirect()`, `statusPage(401|403)`, `new Response()`. */
+export function loaderRefusals(ts: typeof TSApi, tree: TSApi.SourceFile): number[] {
+  const loader = exportedFunction(ts, tree, "loader")
+  if (loader?.body === undefined) return []
+  const lines: number[] = []
+  const lineOf = (node: TSApi.Node): number =>
+    tree.getLineAndCharacterOfPosition(node.getStart(tree)).line + 1
+  const visit = (node: TSApi.Node): void => {
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)) {
+      const status = node.arguments[0]
+      if (
+        node.expression.text === "redirect" ||
+        (node.expression.text === "statusPage" &&
+          status !== undefined &&
+          ts.isNumericLiteral(status) &&
+          (status.text === "401" || status.text === "403"))
+      )
+        lines.push(lineOf(node))
+    } else if (
+      ts.isNewExpression(node) &&
+      ts.isIdentifier(node.expression) &&
+      node.expression.text === "Response"
+    ) {
+      lines.push(lineOf(node))
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(loader.body)
+  return lines
+}
+
+/**
+ * NF-C042: a layout loader that refuses access - a redirect, a 401 or 403, a `Response` - in a layout
+ * that is not a gate and exports no middleware. A client navigation that keeps the layout skips that
+ * loader, and an action below it runs without it, so the check reads as a guard and is not one. A
+ * refusal inside a helper the loader calls is not seen; the development warning covers that.
+ */
+export const ungatedLayoutRefusalRule: CheckRule = {
+  code: "NF-C042",
+  title: "Layout loader refuses access without a gate",
+  async scan(ctx) {
+    const routesDir = join(ctx.root, "routes")
+    if (!existsSync(routesDir)) return []
+    let manifest: ReturnType<typeof discoverRoutes>
+    try {
+      manifest = discoverRoutes(routesDir)
+    } catch {
+      return []
+    }
+    const layouts = Object.values(manifest.layouts)
+      .filter((layout) => SCRIPT_LAYOUT.test(layout.file))
+      .sort((a, b) => codeUnitOrder(a.file, b.file))
+    if (layouts.length === 0) return []
+    const sources = layouts.map((layout) =>
+      [layout.file, ...(layout.backend === undefined ? [] : [layout.backend])].map((file) => ({
+        file,
+        text: readFileSync(join(routesDir, file), "utf8"),
+      })),
+    )
+    if (!sources.flat().some((half) => LOADER_EXPORT.test(stripComments(half.text)))) return []
+    const loaded = await loadRuleTypeScript(ctx)
+    const ts = loaded.compiler
+    if (ts === undefined) return []
+    const findings: Diagnostic[] = []
+    for (const halves of sources) {
+      const code = halves.map((half) => stripComments(half.text))
+      if (code.some((text) => GATE_EXPORT.test(text) || MIDDLEWARE_EXPORT.test(text))) continue
+      for (const half of halves) {
+        if (!LOADER_EXPORT.test(stripComments(half.text))) continue
+        const tree = ts.createSourceFile(
+          half.file,
+          half.text,
+          ts.ScriptTarget.Latest,
+          true,
+          scriptKindOf(ts, half.file),
+        )
+        const [line] = loaderRefusals(ts, tree)
+        if (line === undefined) continue
+        findings.push(
+          diagnostic({
+            code: "NF-C042",
+            severity: "warn",
+            file: `routes/${half.file}`,
+            line,
+            message: `routes/${half.file}'s loader refuses access, but the layout is not a gate. A client navigation that keeps the layout skips this loader, and an action below it runs without it, so it does not protect the pages under it. Export \`gate = true\` from this file, or move the check into its \`middleware\`.`,
+            evidence: [
+              "gate = true: the loader runs on every request and before every action, ahead of the page loader",
+              "middleware: runs before every page and action below the directory",
+            ],
+            verify: "nifra check",
+          }),
+        )
+      }
+    }
+    return findings
+  },
+}
+
+/** The names a module exports at runtime, each with its line: declarations and `export { ... }` lists.
+ * `export *` names nothing it can read, and type-only exports carry no value. */
+function runtimeExports(
+  ts: typeof TSApi,
+  tree: TSApi.SourceFile,
+): Array<{ readonly name: string; readonly line: number }> {
+  const found: Array<{ name: string; line: number }> = []
+  const add = (name: string, node: TSApi.Node): void => {
+    found.push({ name, line: tree.getLineAndCharacterOfPosition(node.getStart(tree)).line + 1 })
+  }
+  for (const statement of tree.statements) {
+    if (ts.isExportDeclaration(statement)) {
+      if (statement.isTypeOnly || statement.exportClause === undefined) continue
+      if (!ts.isNamedExports(statement.exportClause)) continue
+      for (const element of statement.exportClause.elements) {
+        if (!element.isTypeOnly) add(element.name.text, element)
+      }
+      continue
+    }
+    if (
+      !(
+        ts.isVariableStatement(statement) ||
+        ts.isFunctionDeclaration(statement) ||
+        ts.isClassDeclaration(statement)
+      ) ||
+      !hasModifier(statement, ts.SyntaxKind.ExportKeyword) ||
+      hasModifier(statement, ts.SyntaxKind.DeclareKeyword)
+    )
+      continue
+    if (ts.isVariableStatement(statement)) {
+      for (const declaration of statement.declarationList.declarations) {
+        if (ts.isIdentifier(declaration.name)) add(declaration.name.text, declaration)
+      }
+    } else if (statement.name !== undefined) {
+      add(statement.name.text, statement)
+    }
+  }
+  return found
+}
+
+/**
+ * NF-C041: a route's frontend file (`x.tsx`, a layout, a status or error page) exports a name only
+ * the server reads, such as `loader` or `action`. The frontend file ships to the browser whole, so
+ * `nifra build` and the server refuse it; this reports it before either runs.
+ */
+export const frontendServerExportRule: CheckRule = {
+  code: "NF-C041",
+  title: "Server-only export in a route frontend file",
+  async scan(ctx) {
+    const routesDir = join(ctx.root, "routes")
+    if (!existsSync(routesDir)) return []
+    let manifest: ReturnType<typeof discoverRoutes>
+    try {
+      manifest = discoverRoutes(routesDir)
+    } catch {
+      return []
+    }
+    const files = new Set<string>()
+    for (const entry of [
+      ...manifest.routes,
+      ...Object.values(manifest.layouts),
+      ...Object.values(manifest.errors ?? {}),
+      ...(manifest.notFound === undefined ? [] : [manifest.notFound]),
+      ...Object.values(manifest.notFounds ?? {}),
+      ...Object.values(manifest.statusPages ?? {}),
+      ...Object.values(manifest.loadings ?? {}),
+    ]) {
+      if (SCRIPT_LAYOUT.test(entry.file)) files.add(entry.file)
+    }
+    if (files.size === 0) return []
+    const loaded = await loadRuleTypeScript(ctx)
+    const ts = loaded.compiler
+    if (ts === undefined) return []
+    const findings: Diagnostic[] = []
+    for (const file of [...files].sort(codeUnitOrder)) {
+      const text = readFileSync(join(routesDir, file), "utf8")
+      const tree = ts.createSourceFile(
+        file,
+        text,
+        ts.ScriptTarget.Latest,
+        true,
+        scriptKindOf(ts, file),
+      )
+      for (const { name, line } of runtimeExports(ts, tree)) {
+        if (!BACKEND_ROUTE_EXPORTS.has(name)) continue
+        const backend = `routes/${file.replace(SCRIPT_LAYOUT, ".backend.ts")}`
+        findings.push(
+          diagnostic({
+            code: "NF-C041",
+            severity: "error",
+            file: `routes/${file}`,
+            line,
+            message: `routes/${file} exports "${name}", which runs on the server only, and a route's frontend file ships to the browser whole, so nifra build and the server refuse it. Move it to ${backend}.`,
+            evidence: [`export: ${name}`, `backend half: ${backend}`],
+            fix: { recipe: "route.split", command: "nifra fix --code NF-C041" },
+            verify: "nifra check",
+          }),
+        )
+      }
+    }
+    return findings
+  },
+}
+
 export const pageRules = Object.freeze([
   shadowedPageRule,
   statusLayoutRule,
   implicitApiMountRule,
   layoutMetaDataRule,
+  frontendServerExportRule,
+  ungatedLayoutRefusalRule,
 ])

package/src/rules/security.ts

@@ -74,8 +74,9 @@ function unexpectedMessage(
 const parentOf = (dir: string): string => dir.slice(0, Math.max(dir.lastIndexOf("/"), 0))
 
 /**
- * Whether NF-S002 may treat `file` as browser code, which compares values the client already holds,
- * so a finding there is advisory. It must be browser code by path (a route's frontend half,
+ * Whether NF-S001 and NF-S002 may treat `file` as browser code, where a finding is advisory: a
+ * browser compares values the client already holds, and a gate there that fails open grants nothing
+ * the server does not check again. It must be browser code by path (a route's frontend half,
  * `frontend/`) and sit inside a nifra web app: a `routes/` folder in an API-only project or a package
  * without a web dependency runs on the server. `shared/` also runs on the server, and a file that
  * cannot be classified is treated as server - fail closed.
@@ -557,29 +558,46 @@ const GATE_NAMES = [
   /^(?:require|assert|authori[sz]e|authenticate)/i,
   /^can[A-Z]/,
   /.Guard$/,
-  /^(?:ensure|verify|check|validate)(?:Auth|LoggedIn|Login|Session|Token|Jwt|JWT|Signature|Webhook|Hmac|HMAC|Password|Credential|Permission|Access|Role|Admin|Owner|Scope|Csrf|CSRF|ApiKey|Origin|Tenant|User|Member)/,
+  /^(?:ensure|verify|check|validate)(?:Auth\w*|LoggedIn|Login|Session|Token|Jwt|JWT|Signatures?|Webhook|Hmac|HMAC|Password|Credentials?|Permissions?|Access|Roles?|Admin(?:istrator)?|Owner(?:ship)?|Scopes?|Csrf|CSRF|ApiKey|Origin|Tenant|User|Member(?:ship)?)(?![a-z])/,
 ]
 
+/** An authenticator returns who is calling, so its "nobody" result (`null`, `undefined`) is a denial. */
+const AUTHENTICATOR = /^authenticate/i
+
+/** Result-object fields whose `false` is the denial (`{ ok: false, error }`). */
+const DECISION_FIELDS = new Set([
+  "ok",
+  "allowed",
+  "authorized",
+  "authenticated",
+  "valid",
+  "success",
+  "granted",
+])
+
 /** Helpers whose whole job is to fail (`fail(…)`, `deny(…)`, `reject(…)`, …). */
 const FAILING_HELPERS = new Set(["fail", "deny", "reject", "forbid", "unauthorized", "abort"])
 
 /**
- * Whether a gate's catch block fails closed: it throws, returns `false`, a `new Response(…)` or a
- * `deny…(…)` call, or hands the failure to a {@link FAILING_HELPERS} helper. The last form is why
+ * Whether a gate's catch block fails closed: it throws, returns `false`, a result object whose decision
+ * field is `false`, a `new Response(…)` or a `deny…(…)` call (an authenticator also `null` or
+ * nothing), or hands the failure to a {@link FAILING_HELPERS} helper. The last form is why
  * conformance/invariant asserts that funnel every error through a `never`-returning `fail()` are not
  * fail-open - the scanner reads no types, so it trusts the helper by name, the same trade the SQL and
  * gate-name heuristics already make. Read from the syntax, so a "throw" in a comment or a string counts
  * for nothing, and a nested function's statements are not the catch's own.
  */
-function failsClosed(ts: typeof TSApi, block: TSApi.Block): boolean {
+function failsClosed(ts: typeof TSApi, block: TSApi.Block, gate: string): boolean {
+  const authenticator = AUTHENTICATOR.test(gate)
   let closed = false
   const visit = (node: TSApi.Node): void => {
     if (closed || ts.isFunctionLike(node)) return
     if (
       ts.isThrowStatement(node) ||
       (ts.isReturnStatement(node) &&
-        node.expression !== undefined &&
-        isDenial(ts, node.expression)) ||
+        (node.expression === undefined
+          ? authenticator
+          : isDenial(ts, node.expression, authenticator))) ||
       (ts.isCallExpression(node) &&
         ts.isIdentifier(node.expression) &&
         FAILING_HELPERS.has(node.expression.text))
@@ -593,7 +611,7 @@ function failsClosed(ts: typeof TSApi, block: TSApi.Block): boolean {
   return closed
 }
 
-function isDenial(ts: typeof TSApi, expression: TSApi.Expression): boolean {
+function isDenial(ts: typeof TSApi, expression: TSApi.Expression, authenticator: boolean): boolean {
   let value = expression
   while (
     ts.isParenthesizedExpression(value) ||
@@ -603,6 +621,22 @@ function isDenial(ts: typeof TSApi, expression: TSApi.Expression): boolean {
   )
     value = value.expression
   if (value.kind === ts.SyntaxKind.FalseKeyword) return true
+  if (
+    authenticator &&
+    (value.kind === ts.SyntaxKind.NullKeyword ||
+      ts.isVoidExpression(value) ||
+      (ts.isIdentifier(value) && value.text === "undefined"))
+  )
+    return true
+  if (ts.isObjectLiteralExpression(value)) {
+    return value.properties.some(
+      (property) =>
+        ts.isPropertyAssignment(property) &&
+        (ts.isIdentifier(property.name) || ts.isStringLiteral(property.name)) &&
+        DECISION_FIELDS.has(property.name.text) &&
+        property.initializer.kind === ts.SyntaxKind.FalseKeyword,
+    )
+  }
   if (ts.isNewExpression(value))
     return ts.isIdentifier(value.expression) && value.expression.text === "Response"
   return (
@@ -621,23 +655,26 @@ export const failOpenGateRule: CheckRule = {
     const ts = loaded.compiler
     if (ts === undefined) return didNotRun("NF-S001", "Fail-open gate scan")
     const findings: Diagnostic[] = []
+    const webDirs = createWebAppProbe(ctx.root)
     for (const file of ctx.project.source.files) {
       const parsed = parsedFile(ts, ctx.project.source, file)
       if (parsed === undefined) continue
       const { tree, lines } = parsed
+      let browser: boolean | undefined
       const visit = (node: TSApi.Node): void => {
         if (ts.isCatchClause(node)) {
           let parent: TSApi.Node | undefined = node.parent
           while (parent !== undefined && !ts.isFunctionLike(parent)) parent = parent.parent
           const name = parent === undefined ? undefined : functionName(ts, parent)
           if (name !== undefined && GATE_NAMES.some((gate) => gate.test(name))) {
-            if (!failsClosed(ts, node.block)) {
+            if (!failsClosed(ts, node.block, name)) {
               const line = tree.getLineAndCharacterOfPosition(node.getStart(tree)).line + 1
               const reviewed = expectedReason(lines, line, "NF-S001") !== undefined
+              browser ??= provenBrowserFile(ctx.root, file, webDirs)
               findings.push(
                 diagnostic({
                   code: "NF-S001",
-                  severity: reviewed ? "info" : "error",
+                  severity: reviewed ? "info" : browser ? "warn" : "error",
                   file,
                   line,
                   message: reviewed
@@ -651,6 +688,7 @@ export const failOpenGateRule: CheckRule = {
                   evidence: [
                     name,
                     "catch block has no denial or rethrow",
+                    ...(browser ? ["browser code: the server's own gate decides"] : []),
                     ...expectationEvidence(lines, line, "NF-S001"),
                   ],
                   verify: "nifra check --lints-only",

package/src/rules/zones.ts

@@ -17,6 +17,7 @@ import {
   importRuleMessage,
   privateEnvReads,
   privateEnvReason,
+  specifierPackage,
   type ZoneClassifier,
   ZoneConfigError,
 } from "@nifrajs/web/zones"
@@ -26,6 +27,7 @@ import { appDirs, clientModuleRoot } from "../client-module.ts"
 import { componentCheckReceipts } from "../component-check.ts"
 import { type Diagnostic, diagnostic } from "../diagnostics.ts"
 import { codeUnitOrder } from "../internal/code-unit-order.ts"
+import { installedManifest } from "../internal/installed-package.ts"
 import {
   createApiOnlyProbe,
   createKindProbe,
@@ -35,7 +37,9 @@ import {
   withApiKindHint,
 } from "../internal/nifra-project.ts"
 import { createSpecifierResolver } from "../internal/project-specifiers.ts"
+import { createSourceFacts } from "../internal/source-facts.ts"
 import type { CheckRule, RuleContext } from "./index.ts"
+import { loadRuleTypeScript } from "./typescript.ts"
 
 const ZONE_FOLDER = new Set(["routes", "frontend", "backend", "shared"])
 const FRONTEND = new Set(["route-frontend", "frontend"])
@@ -186,6 +190,15 @@ export const zoneImportRule: CheckRule = {
     // Outside any web app, a finding may only mean the project serves no pages: say how to declare it.
     const inWebApp = createWebAppProbe(ctx.root)
     const resolveSpecifier = createSpecifierResolver()
+    // Without a compiler nothing proves an import erased, so every import stays an edge.
+    const { compiler } = await loadRuleTypeScript(ctx)
+    const facts =
+      compiler === undefined
+        ? undefined
+        : createSourceFacts(compiler, {
+            keepsTypeOnlyImports: (file) =>
+              resolveSpecifier.keepsTypeOnlyImports(isAbsolute(file) ? file : join(ctx.root, file)),
+          })
     const queue: Importer[] = []
     const queued = new Set<string>()
     const follow = (importer: Importer): void => {
@@ -201,7 +214,7 @@ export const zoneImportRule: CheckRule = {
     // The browser entry imports the app's `clientModule`, so the build classifies it like any file it
     // loads, and loads what it imports.
     for (const app of appDirs(ctx.sources.files)) {
-      const entry = clientModuleRoot(ctx.root, app, resolveSpecifier)
+      const entry = clientModuleRoot(ctx.root, app, resolveSpecifier, compiler)
       if (entry === undefined) continue
       let classification: Classification
       try {
@@ -235,11 +248,21 @@ export const zoneImportRule: CheckRule = {
     for (const { file, app, zone: from } of queue) {
       const content = ctx.sources.read(file)
       if (content === undefined) continue
-      for (const { specifier, line } of importSites(content, file)) {
-        const target = resolveSpecifier(join(ctx.root, file), specifier)
-        if (target === undefined) continue
-        const to = classifierFor(app).classify(target)
-        const targetName = display(ctx.root, target)
+      for (const { specifier, line } of importSites(content, file, facts)) {
+        let target = resolveSpecifier(join(ctx.root, file), specifier)
+        let to: Classification
+        if (target === undefined) {
+          // An installed package is judged here only by the entry it names, when it gives each
+          // entry its own side; a package-wide side is NF-C004's in browser code.
+          const name = specifierPackage(specifier)
+          const manifest =
+            name === undefined ? undefined : installedManifest(join(ctx.root, file), name)
+          if (manifest === undefined) continue
+          to = classifierFor(app).classify(manifest, specifier)
+          if (to.entry === undefined) continue
+          target = manifest
+        } else to = classifierFor(app).classify(target, specifier)
+        const targetName = to.entry === undefined ? display(ctx.root, target) : specifier
         if (
           ["frontend", "route-frontend", "shared"].includes(from) &&
           (receipts.has(target) || receipts.has(targetName))
@@ -250,7 +273,7 @@ export const zoneImportRule: CheckRule = {
           if (to.package !== undefined) {
             if (reportedPackages.has(to.package)) continue
             reportedPackages.add(to.package)
-          } else {
+          } else if (to.entry === undefined) {
             // A file in no zone loads what it imports too: the build refuses each one it reaches.
             follow({ file: targetName, app, zone: "error" })
           }