@nifrajs/ts-plugin 3.3.0 → 4.0.0

package/README.md

@@ -4,6 +4,8 @@ A TypeScript language-service plugin for [nifra](https://github.com/nifrajs/nifr
 
 The routing rules are nifra's own - it discovers routes with `@nifrajs/web` and matches them with `@nifrajs/core`'s pattern matcher - so a path resolves to exactly the file it would serve at runtime, dynamic segments included (`/users/42` → `routes/users/[id].tsx`).
 
+It also shows the frontend/backend zone rules as you type: a value import that the build would refuse - backend code in a page, frontend code in `backend/`, anything but shared code in `shared/`, a Node built-in or a server package (`pg`, a mailer, a server SDK) in browser code - is an error on the import itself. `import type` is always allowed. The rules come from `@nifrajs/web/zones`, the same classifier the builds and `nifra check` use; the build stays authoritative and reports the full import chain.
+
 ## Install
 
 ```sh

package/dist/index.cjs

@@ -39,13 +39,13 @@ var __export = (target, all) => {
 // src/index.ts
 var exports_src = {};
 __export(exports_src, {
-  findRoutesDir: () => findRoutesDir,
+  default: () => src_default,
   findRoutePathLiteral: () => findRoutePathLiteral,
-  default: () => src_default
+  findRoutesDir: () => findRoutesDir
 });
 module.exports = __toCommonJS(exports_src);
-var import_node_fs = require("node:fs");
-var import_node_path = require("node:path");
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = require("node:path");
 var import_fs = require("@nifrajs/web/fs");
 
 // src/resolve.ts
@@ -70,13 +70,128 @@ function resolveRouteFile(path, routes) {
   return;
 }
 
+// src/zones.ts
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+var import_zones = require("@nifrajs/web/zones");
+var ZONE_DIAGNOSTIC_CODE = 990028;
+var BROWSER_CODE = new Set(["route-frontend", "frontend", "shared"]);
+var allTypes = (elements) => elements.length > 0 && elements.every((element) => element.isTypeOnly);
+function valueImports(tsm, source) {
+  const edges = [];
+  const add = (node) => {
+    if (node !== undefined && tsm.isStringLiteralLike(node)) {
+      edges.push({ specifier: node.text, literal: node });
+    }
+  };
+  const visit = (node) => {
+    if (tsm.isImportDeclaration(node)) {
+      const clause = node.importClause;
+      const bindings = clause?.namedBindings;
+      const typeOnly = clause !== undefined && (clause.isTypeOnly || clause.name === undefined && bindings !== undefined && tsm.isNamedImports(bindings) && allTypes(bindings.elements));
+      if (!typeOnly)
+        add(node.moduleSpecifier);
+      return;
+    }
+    if (tsm.isExportDeclaration(node)) {
+      const clause = node.exportClause;
+      const typeOnly = node.isTypeOnly || clause !== undefined && tsm.isNamedExports(clause) && allTypes(clause.elements);
+      if (!typeOnly)
+        add(node.moduleSpecifier);
+      return;
+    }
+    if (tsm.isImportEqualsDeclaration(node) && !node.isTypeOnly && tsm.isExternalModuleReference(node.moduleReference)) {
+      add(node.moduleReference.expression);
+      return;
+    }
+    if (tsm.isCallExpression(node) && node.expression.kind === tsm.SyntaxKind.ImportKeyword) {
+      add(node.arguments[0]);
+    }
+    tsm.forEachChild(node, visit);
+  };
+  visit(source);
+  return edges;
+}
+function resolveImport(tsm, source, edge, options) {
+  const specifier = edge.specifier.replace(/[?#].*$/, "");
+  const mode = tsm.getModeForUsageLocation(source, edge.literal, options);
+  const resolved = tsm.resolveModuleName(specifier, source.fileName, options, tsm.sys, undefined, undefined, mode).resolvedModule?.resolvedFileName;
+  if (resolved !== undefined)
+    return resolved;
+  if (!specifier.startsWith("./") && !specifier.startsWith("../"))
+    return;
+  const file = import_node_path.resolve(import_node_path.dirname(source.fileName), specifier);
+  return import_node_fs.existsSync(file) ? file : undefined;
+}
+var real = (file) => {
+  try {
+    return import_node_fs.realpathSync.native(file);
+  } catch {
+    return file;
+  }
+};
+function libraryAsImported(target, specifier) {
+  if (target.zone !== "library")
+    return target;
+  const named = import_zones.specifierPackage(specifier);
+  if (named === undefined || named === target.packageName)
+    return target;
+  return { zone: "library", packageName: named };
+}
+function edgeProblem(classifier, display, fileName, from, specifier, target) {
+  const browser = BROWSER_CODE.has(from);
+  if (browser && /^(?:node|bun):/.test(specifier)) {
+    return `"${specifier}" may not reach the browser: Node and Bun built-ins run on the server only; use them in a route's backend half or under backend/`;
+  }
+  if (browser && specifier === import_zones.BACKEND_ONLY_MARKER) {
+    return `"${import_zones.BACKEND_ONLY_MARKER}" marks a module backend-only, but ${display(fileName)} reaches the browser. Move it under backend/ or into a route's backend half`;
+  }
+  if (target === undefined)
+    return;
+  const to = classifier.classify(target);
+  if (to.zone === "error")
+    return `${display(fileName)} imports ${display(target)}: ${to.reason}`;
+  if (to.zone === "library") {
+    const reason = browser ? import_zones.browserDenial(libraryAsImported(to, specifier), specifier) : undefined;
+    return reason === undefined ? undefined : `"${specifier}" may not reach the browser: ${reason}`;
+  }
+  return import_zones.importAllowed(from, to.zone) ? undefined : import_zones.importRuleMessage(display(fileName), from, display(target), to.zone);
+}
+function zoneDiagnostics(tsm, source, appRoot, options) {
+  const classifier = import_zones.createZoneClassifier({ appRoot });
+  const from = classifier.classify(source.fileName);
+  if (from.zone === "error" || from.zone === "library" || from.zone === "generated")
+    return [];
+  const display = (file) => {
+    const rel = import_node_path.relative(classifier.appRoot, real(file)).replaceAll("\\", "/");
+    return rel.startsWith("../") || import_node_path.isAbsolute(rel) ? file : rel;
+  };
+  const diagnostics = [];
+  for (const edge of valueImports(tsm, source)) {
+    const target = resolveImport(tsm, source, edge, options);
+    const message = edgeProblem(classifier, display, source.fileName, from.zone, edge.specifier, target);
+    if (message === undefined)
+      continue;
+    diagnostics.push({
+      file: source,
+      start: edge.literal.getStart(source),
+      length: edge.literal.getWidth(source),
+      messageText: message,
+      category: tsm.DiagnosticCategory.Error,
+      code: ZONE_DIAGNOSTIC_CODE,
+      source: "nifra"
+    });
+  }
+  return diagnostics;
+}
+
 // src/index.ts
-function findRoutesDir(fromFile, exists = import_node_fs.existsSync) {
-  let dir = import_node_path.dirname(fromFile);
+function findRoutesDir(fromFile, exists = import_node_fs2.existsSync) {
+  let dir = import_node_path2.dirname(fromFile);
   for (let i = 0;i < 64; i++) {
-    if (exists(import_node_path.join(dir, "routes")))
-      return import_node_path.join(dir, "routes");
-    const parent = import_node_path.dirname(dir);
+    if (exists(import_node_path2.join(dir, "routes")))
+      return import_node_path2.join(dir, "routes");
+    const parent = import_node_path2.dirname(dir);
     if (parent === dir)
       return;
     dir = parent;
@@ -89,13 +204,13 @@ function normalizeProgramPath(fileName) {
   return process.platform === "win32" ? withoutDevicePrefix.toLowerCase() : withoutDevicePrefix;
 }
 function canonicalProgramPaths(tsm, fileName) {
-  const absolute = import_node_path.resolve(fileName);
+  const absolute = import_node_path2.resolve(fileName);
   const paths = new Set([normalizeProgramPath(absolute)]);
   const tsmRealpath = tsm.sys.realpath;
   const resolvers = [
     ...typeof tsmRealpath === "function" ? [tsmRealpath] : [],
-    import_node_fs.realpathSync.native,
-    import_node_fs.realpathSync
+    import_node_fs2.realpathSync.native,
+    import_node_fs2.realpathSync
   ];
   for (const resolver of resolvers) {
     try {
@@ -110,20 +225,20 @@ function typeScriptProgramPath(tsm, program, fileName) {
     return;
   const getCanonicalFileName = tsm.sys.useCaseSensitiveFileNames ? (value) => value : (value) => value.toLowerCase();
   try {
-    return toPath(import_node_path.resolve(fileName), program.getCurrentDirectory(), getCanonicalFileName);
+    return toPath(import_node_path2.resolve(fileName), program.getCurrentDirectory(), getCanonicalFileName);
   } catch {
     return;
   }
 }
 function filesystemIdentity(fileName) {
   try {
-    const info = import_node_fs.statSync(import_node_path.resolve(fileName), { bigint: true });
+    const info = import_node_fs2.statSync(import_node_path2.resolve(fileName), { bigint: true });
     if (info.ino === 0n)
       return;
     return `bigint:${info.dev}:${info.ino}`;
   } catch {
     try {
-      const info = import_node_fs.statSync(import_node_path.resolve(fileName));
+      const info = import_node_fs2.statSync(import_node_path2.resolve(fileName));
       if (info.ino === 0)
         return;
       return `number:${info.dev}:${info.ino}`;
@@ -167,7 +282,7 @@ function hostSourceFile(tsm, host, program, fileName) {
 function diskSourceFile(tsm, program, fileName) {
   let text;
   try {
-    text = import_node_fs.readFileSync(fileName, "utf8");
+    text = import_node_fs2.readFileSync(fileName, "utf8");
   } catch {
     return;
   }
@@ -213,8 +328,8 @@ function routeDefinitionAt(tsm, ls, host, fileName, position) {
   }
   if (file === undefined)
     return;
-  const target = import_node_path.isAbsolute(file) ? file : import_node_path.join(routesDir, file);
-  if (!import_node_fs.existsSync(target))
+  const target = import_node_path2.isAbsolute(file) ? file : import_node_path2.join(routesDir, file);
+  if (!import_node_fs2.existsSync(target))
     return;
   return {
     definitions: [
@@ -251,6 +366,19 @@ function init(modules) {
         const source = programSourceFile(tsm, ls.getProgram(), fileName);
         return source === undefined ? undefined : ls.getDefinitionAndBoundSpan(source.fileName, position);
       })();
+      proxy.getSemanticDiagnostics = (fileName) => {
+        const source = programSourceFile(tsm, ls.getProgram(), fileName);
+        const own = ls.getSemanticDiagnostics(source?.fileName ?? fileName);
+        const routesDir = source === undefined ? undefined : findRoutesDir(source.fileName);
+        if (source === undefined || routesDir === undefined)
+          return own;
+        try {
+          const options = ls.getProgram()?.getCompilerOptions() ?? {};
+          return [...own, ...zoneDiagnostics(tsm, source, import_node_path2.dirname(routesDir), options)];
+        } catch {
+          return own;
+        }
+      };
       return proxy;
     }
   };

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,KAAK,EAAE,MAAM,YAAY,CAAA;AAGrC,sGAAsG;AACtG,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAoB,GAC1C,MAAM,GAAG,SAAS,CASpB;AAgMD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EAAE,EACd,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAA;CAAE,GAAG,SAAS,CAMjD;AA4CD,iBAAS,IAAI,CAAC,OAAO,EAAE;IAAE,UAAU,EAAE,OAAO,EAAE,CAAA;CAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CA6CxE;AAED,eAAe,IAAI,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,KAAK,EAAE,MAAM,YAAY,CAAA;AAIrC,sGAAsG;AACtG,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAoB,GAC1C,MAAM,GAAG,SAAS,CASpB;AAgMD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EAAE,EACd,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAA;CAAE,GAAG,SAAS,CAMjD;AA4CD,iBAAS,IAAI,CAAC,OAAO,EAAE;IAAE,UAAU,EAAE,OAAO,EAAE,CAAA;CAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAyDxE;AAED,eAAe,IAAI,CAAA"}

package/dist/zones.d.ts

@@ -0,0 +1,9 @@
+import type * as ts from "typescript";
+/** The code every zone diagnostic carries; TypeScript requires a number, and none of its own is this. */
+export declare const ZONE_DIAGNOSTIC_CODE = 990028;
+/**
+ * The zone diagnostics for one file of the app rooted at `appRoot`. A fresh classifier per call keeps a
+ * moved file or an edited package declaration from going stale; it costs a few `stat`s per import.
+ */
+export declare function zoneDiagnostics(tsm: typeof ts, source: ts.SourceFile, appRoot: string, options: ts.CompilerOptions): ts.Diagnostic[];
+//# sourceMappingURL=zones.d.ts.map

package/dist/zones.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zones.d.ts","sourceRoot":"","sources":["../src/zones.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,KAAK,EAAE,MAAM,YAAY,CAAA;AAErC,yGAAyG;AACzG,eAAO,MAAM,oBAAoB,SAAS,CAAA;AAmI1C;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EAAE,EACd,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,EAAE,CAAC,eAAe,GAC1B,EAAE,CAAC,UAAU,EAAE,CA+BjB"}

package/dist/zones.js

@@ -0,0 +1,146 @@
+/**
+ * Zone diagnostics: the frontend/backend import rules of `@nifrajs/web/zones`, in the editor.
+ *
+ * Assist only. The browser builds, the dev servers and `nifra check` enforce the same rules with the
+ * full import chain; this reports the direct edge as it is typed, so a backend import in a page is
+ * red before anything is built. Files in no zone (tests, scripts, config) are never reported: no
+ * build loads them.
+ */
+import { existsSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { BACKEND_ONLY_MARKER, browserDenial, createZoneClassifier, importAllowed, importRuleMessage, specifierPackage, } from "@nifrajs/web/zones";
+/** The code every zone diagnostic carries; TypeScript requires a number, and none of its own is this. */
+export const ZONE_DIAGNOSTIC_CODE = 990028;
+/** Zones whose own code runs in a browser. */
+const BROWSER_CODE = new Set(["route-frontend", "frontend", "shared"]);
+const allTypes = (elements) => elements.length > 0 && elements.every((element) => element.isTypeOnly);
+/** Every value import in a file: static, re-export and literal dynamic `import()`. Type-only ones are
+ * erased before bundling, so they may cross zones. */
+function valueImports(tsm, source) {
+    const edges = [];
+    const add = (node) => {
+        if (node !== undefined && tsm.isStringLiteralLike(node)) {
+            edges.push({ specifier: node.text, literal: node });
+        }
+    };
+    const visit = (node) => {
+        if (tsm.isImportDeclaration(node)) {
+            const clause = node.importClause;
+            const bindings = clause?.namedBindings;
+            const typeOnly = clause !== undefined &&
+                (clause.isTypeOnly ||
+                    (clause.name === undefined &&
+                        bindings !== undefined &&
+                        tsm.isNamedImports(bindings) &&
+                        allTypes(bindings.elements)));
+            if (!typeOnly)
+                add(node.moduleSpecifier);
+            return;
+        }
+        if (tsm.isExportDeclaration(node)) {
+            const clause = node.exportClause;
+            const typeOnly = node.isTypeOnly ||
+                (clause !== undefined && tsm.isNamedExports(clause) && allTypes(clause.elements));
+            if (!typeOnly)
+                add(node.moduleSpecifier);
+            return;
+        }
+        if (tsm.isImportEqualsDeclaration(node) &&
+            !node.isTypeOnly &&
+            tsm.isExternalModuleReference(node.moduleReference)) {
+            add(node.moduleReference.expression);
+            return;
+        }
+        if (tsm.isCallExpression(node) && node.expression.kind === tsm.SyntaxKind.ImportKeyword) {
+            add(node.arguments[0]);
+        }
+        tsm.forEachChild(node, visit);
+    };
+    visit(source);
+    return edges;
+}
+/** Where an import lands: TypeScript's resolution (tsconfig `paths` included), else a relative path
+ * that exists on disk (an `.svelte` or `.vue` file TypeScript only knows through a shim). */
+function resolveImport(tsm, source, edge, options) {
+    const specifier = edge.specifier.replace(/[?#].*$/, "");
+    const mode = tsm.getModeForUsageLocation(source, edge.literal, options);
+    const resolved = tsm.resolveModuleName(specifier, source.fileName, options, tsm.sys, undefined, undefined, mode).resolvedModule?.resolvedFileName;
+    if (resolved !== undefined)
+        return resolved;
+    if (!specifier.startsWith("./") && !specifier.startsWith("../"))
+        return undefined;
+    const file = resolve(dirname(source.fileName), specifier);
+    return existsSync(file) ? file : undefined;
+}
+const real = (file) => {
+    try {
+        return realpathSync.native(file);
+    }
+    catch {
+        return file;
+    }
+};
+/** A third-party target as the specifier names it: TypeScript resolves `pg` to `@types/pg`, and the
+ * server-package list knows `pg`. */
+function libraryAsImported(target, specifier) {
+    if (target.zone !== "library")
+        return target;
+    const named = specifierPackage(specifier);
+    if (named === undefined || named === target.packageName)
+        return target;
+    return { zone: "library", packageName: named };
+}
+/** Why one import breaks the zone rules, or `undefined` when it does not. */
+function edgeProblem(classifier, display, fileName, from, specifier, target) {
+    const browser = BROWSER_CODE.has(from);
+    if (browser && /^(?:node|bun):/.test(specifier)) {
+        return `"${specifier}" may not reach the browser: Node and Bun built-ins run on the server only; use them in a route's backend half or under backend/`;
+    }
+    if (browser && specifier === BACKEND_ONLY_MARKER) {
+        return `"${BACKEND_ONLY_MARKER}" marks a module backend-only, but ${display(fileName)} reaches the browser. Move it under backend/ or into a route's backend half`;
+    }
+    if (target === undefined)
+        return undefined;
+    const to = classifier.classify(target);
+    if (to.zone === "error")
+        return `${display(fileName)} imports ${display(target)}: ${to.reason}`;
+    if (to.zone === "library") {
+        const reason = browser ? browserDenial(libraryAsImported(to, specifier), specifier) : undefined;
+        return reason === undefined ? undefined : `"${specifier}" may not reach the browser: ${reason}`;
+    }
+    return importAllowed(from, to.zone)
+        ? undefined
+        : importRuleMessage(display(fileName), from, display(target), to.zone);
+}
+/**
+ * The zone diagnostics for one file of the app rooted at `appRoot`. A fresh classifier per call keeps a
+ * moved file or an edited package declaration from going stale; it costs a few `stat`s per import.
+ */
+export function zoneDiagnostics(tsm, source, appRoot, options) {
+    const classifier = createZoneClassifier({ appRoot });
+    const from = classifier.classify(source.fileName);
+    if (from.zone === "error" || from.zone === "library" || from.zone === "generated")
+        return [];
+    const display = (file) => {
+        const rel = relative(classifier.appRoot, real(file)).replaceAll("\\", "/");
+        return rel.startsWith("../") || isAbsolute(rel) ? file : rel;
+    };
+    const diagnostics = [];
+    for (const edge of valueImports(tsm, source)) {
+        const target = resolveImport(tsm, source, edge, options);
+        const message = edgeProblem(classifier, display, source.fileName, from.zone, edge.specifier, target);
+        if (message === undefined)
+            continue;
+        diagnostics.push({
+            file: source,
+            start: edge.literal.getStart(source),
+            length: edge.literal.getWidth(source),
+            messageText: message,
+            category: tsm.DiagnosticCategory.Error,
+            code: ZONE_DIAGNOSTIC_CODE,
+            source: "nifra",
+        });
+    }
+    return diagnostics;
+}
+//# sourceMappingURL=zones.js.map

package/dist/zones.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zones.js","sourceRoot":"","sources":["../src/zones.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClE,OAAO,EACL,mBAAmB,EACnB,aAAa,EAEb,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,GAGjB,MAAM,oBAAoB,CAAA;AAG3B,yGAAyG;AACzG,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAE1C,8CAA8C;AAC9C,MAAM,YAAY,GAAsB,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;AAOzF,MAAM,QAAQ,GAAG,CAAC,QAA+D,EAAW,EAAE,CAC5F,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;AAExE;sDACsD;AACtD,SAAS,YAAY,CAAC,GAAc,EAAE,MAAqB;IACzD,MAAM,KAAK,GAAiB,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,CAAC,IAA+B,EAAQ,EAAE;QACpD,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,CAAC;IACH,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,EAAE,aAAa,CAAA;YACtC,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS;gBACpB,CAAC,MAAM,CAAC,UAAU;oBAChB,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;wBACxB,QAAQ,KAAK,SAAS;wBACtB,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC;wBAC5B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;YACnC,IAAI,CAAC,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YACxC,OAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAA;YAChC,MAAM,QAAQ,GACZ,IAAI,CAAC,UAAU;gBACf,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YACnF,IAAI,CAAC,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YACxC,OAAM;QACR,CAAC;QACD,IACE,GAAG,CAAC,yBAAyB,CAAC,IAAI,CAAC;YACnC,CAAC,IAAI,CAAC,UAAU;YAChB,GAAG,CAAC,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,EACnD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAA;YACpC,OAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YACxF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QACxB,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAA;IACD,KAAK,CAAC,MAAM,CAAC,CAAA;IACb,OAAO,KAAK,CAAA;AACd,CAAC;AAED;6FAC6F;AAC7F,SAAS,aAAa,CACpB,GAAc,EACd,MAAqB,EACrB,IAAgB,EAChB,OAA2B;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,CACpC,SAAS,EACT,MAAM,CAAC,QAAQ,EACf,OAAO,EACP,GAAG,CAAC,GAAG,EACP,SAAS,EACT,SAAS,EACT,IAAI,CACL,CAAC,cAAc,EAAE,gBAAgB,CAAA;IAClC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IAC3C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAA;IACzD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5C,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;qCACqC;AACrC,SAAS,iBAAiB,CAAC,MAAsB,EAAE,SAAiB;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IAC5C,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,CAAC,WAAW;QAAE,OAAO,MAAM,CAAA;IACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AAChD,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAClB,UAA0B,EAC1B,OAAiC,EACjC,QAAgB,EAChB,IAAU,EACV,SAAiB,EACjB,MAA0B;IAE1B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,SAAS,kIAAkI,CAAA;IACxJ,CAAC;IACD,IAAI,OAAO,IAAI,SAAS,KAAK,mBAAmB,EAAE,CAAC;QACjD,OAAO,IAAI,mBAAmB,sCAAsC,OAAO,CAAC,QAAQ,CAAC,6EAA6E,CAAA;IACpK,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAA;IAC/F,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/F,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,gCAAgC,MAAM,EAAE,CAAA;IACjG,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAc,EACd,MAAqB,EACrB,OAAe,EACf,OAA2B;IAE3B,MAAM,UAAU,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACjD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,CAAA;IAC5F,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1E,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;IAC9D,CAAC,CAAA;IACD,MAAM,WAAW,GAAoB,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,WAAW,CACzB,UAAU,EACV,OAAO,EACP,MAAM,CAAC,QAAQ,EACf,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,EACd,MAAM,CACP,CAAA;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,SAAQ;QACnC,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,GAAG,CAAC,kBAAkB,CAAC,KAAK;YACtC,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,OAAO;SAChB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nifrajs/ts-plugin",
-  "version": "3.3.0",
-  "description": "TypeScript language-service plugin for nifra - go-to-definition from a route-path string literal to the routes/ file that serves it.",
+  "version": "4.0.0",
+  "description": "TypeScript language-service plugin for nifra - go-to-definition from a route-path string literal to the routes/ file that serves it, and the frontend/backend zone rules as editor errors.",
   "keywords": [
     "bun",
     "typescript",
@@ -13,6 +13,9 @@
     "editor"
   ],
   "type": "module",
+  "nifra": {
+    "environment": "library"
+  },
   "main": "./dist/index.cjs",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -44,8 +47,8 @@
     "build": "bun run build.ts"
   },
   "dependencies": {
-    "@nifrajs/core": "3.3.0",
-    "@nifrajs/web": "3.3.0"
+    "@nifrajs/core": "4.0.0",
+    "@nifrajs/web": "4.0.0"
   },
   "peerDependencies": {
     "typescript": ">=5.5.0"

package/src/index.ts

@@ -1,7 +1,8 @@
 /**
- * `@nifrajs/ts-plugin` - a TypeScript language-service plugin. It adds ONE thing to the editor:
- * go-to-definition on a route-path string literal jumps to the `routes/` file that serves it, so
- * `navigate({ to: "/orders" })`, `<Link to="/orders">`, or `href="/orders"` are click-through.
+ * `@nifrajs/ts-plugin` - a TypeScript language-service plugin. It adds two things to the editor:
+ * - go-to-definition on a route-path string literal jumps to the `routes/` file that serves it, so
+ *   `navigate({ to: "/orders" })`, `<Link to="/orders">`, or `href="/orders"` are click-through;
+ * - the frontend/backend zone rules as errors on the import that breaks them (see ./zones.ts).
  *
  * Wire it up in a project's tsconfig:
  * ```json
@@ -10,13 +11,14 @@
  *
  * The routing rules are nifra's own: it discovers routes with `@nifrajs/web`'s `discoverRoutes` and
  * matches with `@nifrajs/core`'s pattern matcher (see ./resolve.ts), so a path resolves to exactly the
- * file it would serve at runtime. The plugin only wires that into `getDefinitionAndBoundSpan`.
+ * file it would serve at runtime; the zone rules are `@nifrajs/web/zones`, the builds' own classifier.
  */
 import { existsSync, readFileSync, realpathSync, statSync } from "node:fs"
 import { dirname, isAbsolute, join, resolve } from "node:path"
 import { discoverRoutes } from "@nifrajs/web/fs"
 import type * as ts from "typescript"
 import { resolveRouteFile } from "./resolve.ts"
+import { zoneDiagnostics } from "./zones.ts"
 
 /** Walk up from a source file to the nearest directory that has a `routes/` folder - the app root. */
 export function findRoutesDir(
@@ -324,6 +326,18 @@ function init(modules: { typescript: typeof ts }): ts.server.PluginModule {
             ? undefined
             : ls.getDefinitionAndBoundSpan(source.fileName, position)
         })()
+      proxy.getSemanticDiagnostics = (fileName) => {
+        const source = programSourceFile(tsm, ls.getProgram(), fileName)
+        const own = ls.getSemanticDiagnostics(source?.fileName ?? fileName)
+        const routesDir = source === undefined ? undefined : findRoutesDir(source.fileName)
+        if (source === undefined || routesDir === undefined) return own
+        try {
+          const options = ls.getProgram()?.getCompilerOptions() ?? {}
+          return [...own, ...zoneDiagnostics(tsm, source, dirname(routesDir), options)]
+        } catch {
+          return own // the build enforces the rules; an editor assist must never break diagnostics
+        }
+      }
       return proxy
     },
   }

package/src/zones.ts

@@ -0,0 +1,196 @@
+/**
+ * Zone diagnostics: the frontend/backend import rules of `@nifrajs/web/zones`, in the editor.
+ *
+ * Assist only. The browser builds, the dev servers and `nifra check` enforce the same rules with the
+ * full import chain; this reports the direct edge as it is typed, so a backend import in a page is
+ * red before anything is built. Files in no zone (tests, scripts, config) are never reported: no
+ * build loads them.
+ */
+import { existsSync, realpathSync } from "node:fs"
+import { dirname, isAbsolute, relative, resolve } from "node:path"
+import {
+  BACKEND_ONLY_MARKER,
+  browserDenial,
+  type Classification,
+  createZoneClassifier,
+  importAllowed,
+  importRuleMessage,
+  specifierPackage,
+  type Zone,
+  type ZoneClassifier,
+} from "@nifrajs/web/zones"
+import type * as ts from "typescript"
+
+/** The code every zone diagnostic carries; TypeScript requires a number, and none of its own is this. */
+export const ZONE_DIAGNOSTIC_CODE = 990028
+
+/** Zones whose own code runs in a browser. */
+const BROWSER_CODE: ReadonlySet<Zone> = new Set(["route-frontend", "frontend", "shared"])
+
+interface ImportEdge {
+  readonly specifier: string
+  readonly literal: ts.StringLiteralLike
+}
+
+const allTypes = (elements: ts.NodeArray<ts.ImportSpecifier | ts.ExportSpecifier>): boolean =>
+  elements.length > 0 && elements.every((element) => element.isTypeOnly)
+
+/** Every value import in a file: static, re-export and literal dynamic `import()`. Type-only ones are
+ * erased before bundling, so they may cross zones. */
+function valueImports(tsm: typeof ts, source: ts.SourceFile): ImportEdge[] {
+  const edges: ImportEdge[] = []
+  const add = (node: ts.Expression | undefined): void => {
+    if (node !== undefined && tsm.isStringLiteralLike(node)) {
+      edges.push({ specifier: node.text, literal: node })
+    }
+  }
+  const visit = (node: ts.Node): void => {
+    if (tsm.isImportDeclaration(node)) {
+      const clause = node.importClause
+      const bindings = clause?.namedBindings
+      const typeOnly =
+        clause !== undefined &&
+        (clause.isTypeOnly ||
+          (clause.name === undefined &&
+            bindings !== undefined &&
+            tsm.isNamedImports(bindings) &&
+            allTypes(bindings.elements)))
+      if (!typeOnly) add(node.moduleSpecifier)
+      return
+    }
+    if (tsm.isExportDeclaration(node)) {
+      const clause = node.exportClause
+      const typeOnly =
+        node.isTypeOnly ||
+        (clause !== undefined && tsm.isNamedExports(clause) && allTypes(clause.elements))
+      if (!typeOnly) add(node.moduleSpecifier)
+      return
+    }
+    if (
+      tsm.isImportEqualsDeclaration(node) &&
+      !node.isTypeOnly &&
+      tsm.isExternalModuleReference(node.moduleReference)
+    ) {
+      add(node.moduleReference.expression)
+      return
+    }
+    if (tsm.isCallExpression(node) && node.expression.kind === tsm.SyntaxKind.ImportKeyword) {
+      add(node.arguments[0])
+    }
+    tsm.forEachChild(node, visit)
+  }
+  visit(source)
+  return edges
+}
+
+/** Where an import lands: TypeScript's resolution (tsconfig `paths` included), else a relative path
+ * that exists on disk (an `.svelte` or `.vue` file TypeScript only knows through a shim). */
+function resolveImport(
+  tsm: typeof ts,
+  source: ts.SourceFile,
+  edge: ImportEdge,
+  options: ts.CompilerOptions,
+): string | undefined {
+  const specifier = edge.specifier.replace(/[?#].*$/, "")
+  const mode = tsm.getModeForUsageLocation(source, edge.literal, options)
+  const resolved = tsm.resolveModuleName(
+    specifier,
+    source.fileName,
+    options,
+    tsm.sys,
+    undefined,
+    undefined,
+    mode,
+  ).resolvedModule?.resolvedFileName
+  if (resolved !== undefined) return resolved
+  if (!specifier.startsWith("./") && !specifier.startsWith("../")) return undefined
+  const file = resolve(dirname(source.fileName), specifier)
+  return existsSync(file) ? file : undefined
+}
+
+const real = (file: string): string => {
+  try {
+    return realpathSync.native(file)
+  } catch {
+    return file
+  }
+}
+
+/** A third-party target as the specifier names it: TypeScript resolves `pg` to `@types/pg`, and the
+ * server-package list knows `pg`. */
+function libraryAsImported(target: Classification, specifier: string): Classification {
+  if (target.zone !== "library") return target
+  const named = specifierPackage(specifier)
+  if (named === undefined || named === target.packageName) return target
+  return { zone: "library", packageName: named }
+}
+
+/** Why one import breaks the zone rules, or `undefined` when it does not. */
+function edgeProblem(
+  classifier: ZoneClassifier,
+  display: (file: string) => string,
+  fileName: string,
+  from: Zone,
+  specifier: string,
+  target: string | undefined,
+): string | undefined {
+  const browser = BROWSER_CODE.has(from)
+  if (browser && /^(?:node|bun):/.test(specifier)) {
+    return `"${specifier}" may not reach the browser: Node and Bun built-ins run on the server only; use them in a route's backend half or under backend/`
+  }
+  if (browser && specifier === BACKEND_ONLY_MARKER) {
+    return `"${BACKEND_ONLY_MARKER}" marks a module backend-only, but ${display(fileName)} reaches the browser. Move it under backend/ or into a route's backend half`
+  }
+  if (target === undefined) return undefined
+  const to = classifier.classify(target)
+  if (to.zone === "error") return `${display(fileName)} imports ${display(target)}: ${to.reason}`
+  if (to.zone === "library") {
+    const reason = browser ? browserDenial(libraryAsImported(to, specifier), specifier) : undefined
+    return reason === undefined ? undefined : `"${specifier}" may not reach the browser: ${reason}`
+  }
+  return importAllowed(from, to.zone)
+    ? undefined
+    : importRuleMessage(display(fileName), from, display(target), to.zone)
+}
+
+/**
+ * The zone diagnostics for one file of the app rooted at `appRoot`. A fresh classifier per call keeps a
+ * moved file or an edited package declaration from going stale; it costs a few `stat`s per import.
+ */
+export function zoneDiagnostics(
+  tsm: typeof ts,
+  source: ts.SourceFile,
+  appRoot: string,
+  options: ts.CompilerOptions,
+): ts.Diagnostic[] {
+  const classifier = createZoneClassifier({ appRoot })
+  const from = classifier.classify(source.fileName)
+  if (from.zone === "error" || from.zone === "library" || from.zone === "generated") return []
+  const display = (file: string): string => {
+    const rel = relative(classifier.appRoot, real(file)).replaceAll("\\", "/")
+    return rel.startsWith("../") || isAbsolute(rel) ? file : rel
+  }
+  const diagnostics: ts.Diagnostic[] = []
+  for (const edge of valueImports(tsm, source)) {
+    const target = resolveImport(tsm, source, edge, options)
+    const message = edgeProblem(
+      classifier,
+      display,
+      source.fileName,
+      from.zone,
+      edge.specifier,
+      target,
+    )
+    if (message === undefined) continue
+    diagnostics.push({
+      file: source,
+      start: edge.literal.getStart(source),
+      length: edge.literal.getWidth(source),
+      messageText: message,
+      category: tsm.DiagnosticCategory.Error,
+      code: ZONE_DIAGNOSTIC_CODE,
+      source: "nifra",
+    })
+  }
+  return diagnostics
+}