@starci/eslint-canon-fe 8.2.13 → 8.2.15

package/runtime/scripts/hfs/architecture/supabase.mjs

@@ -1,35 +1,27 @@
-import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
-import { isServerActionModule } from './server-action.mjs';
-import { callName, chainParts, contextTypesClient, isDatabaseType, isSupabaseCall, moduleNameOf, reportAt, signatureFromSupabase, supabaseClientType, SUPABASE_MODULES, unwrap } from './supabase-ast.mjs';
+import { callName, chainParts, contextTypesClient, isDatabaseType, isSupabaseCall, moduleNameOf, reportAt, supabaseClientType, SUPABASE_MODULES } from './supabase-ast.mjs';
 import { checkBackendJwt } from './supabase-be.mjs';
-import { checkFrontendQueryResults, FE_DB_SLOTS, sameSymbol, symbolOf } from './supabase-results.mjs';
 
 /**
- * L10-L16, the slot-driven Supabase machine. Supabase is one data transport with one owner on each side:
- * `fe.modules.db` / `fe.package.db` in a front end and `be.integrations.supabase` in a back end. The checks below
- * recognise provider calls and types by their imported package declarations, not by local variable or type names.
+ * L10-L16, the slot-driven Supabase machine. On the back end Supabase is one data transport with one owner,
+ * `be.integrations.supabase`. On the front end Supabase is auth only (owner ruling 2026-10-13): `fe.modules.auth` is the one
+ * importer of `@supabase/*` and calls only the auth API; data, storage, rpc and realtime go through the back end (modules/api).
+ * The checks below recognise provider calls and types by their imported package declarations, not by local variable or type names.
  */
-export const FRONTEND_SUPABASE_RULE_IDS = Object.freeze([
-  'FE_SUPABASE_CLIENT_OWNER',
-  'FE_DB_RESULT_TYPED',
-  'FE_DB_ERROR_HANDLED',
-  'FE_SERVICE_ROLE_FORBIDDEN',
-  'FE_AUTH_SESSION_TRUST',
-  'FE_DB_WRITE_SHAPE',
-  'FE_ROUTE_HANDLER_FORBIDDEN',
-]);
+export const FRONTEND_SUPABASE_RULE_IDS = Object.freeze(['FE_SUPABASE_CLIENT_OWNER', 'FE_SERVICE_ROLE_FORBIDDEN']);
 export const BACKEND_SUPABASE_RULE_IDS = Object.freeze(['BE_SUPABASE_CLIENT_OWNER', 'BE_SUPABASE_JWT_VERIFIED']);
 
 const FE_CLIENT_OWNER = 'FE_SUPABASE_CLIENT_OWNER';
 const BE_CLIENT_OWNER = 'BE_SUPABASE_CLIENT_OWNER';
 const FE_SERVICE_ROLE = 'FE_SERVICE_ROLE_FORBIDDEN';
-const FE_SESSION_TRUST = 'FE_AUTH_SESSION_TRUST';
-const FE_WRITE_SHAPE = 'FE_DB_WRITE_SHAPE';
-const FE_ROUTE_HANDLER = 'FE_ROUTE_HANDLER_FORBIDDEN';
 const BE_SUPABASE_SLOT = 'be.integrations.supabase';
+const FE_AUTH_SLOT = 'fe.modules.auth';
+/** The front-end provider slot: enabled exactly when a connection declares provider supabase. */
+const FE_SUPABASE_PROVIDER_SLOT = 'fe.route.callback';
 const FE_CONFIG_SLOT = 'fe.modules.config';
 const SUPABASE_CALLS = new Set(['from', 'rpc']);
+/** The members of a Supabase client that read or write data, files or channels: never called from the front end. */
+const FE_DATA_MEMBERS = new Set(['from', 'rpc', 'schema', 'storage', 'functions', 'realtime', 'channel', 'getChannels', 'removeChannel', 'removeAllChannels']);
 const supabaseSlotEnabled = (input, slotId) => {
   const slot = input.graph.resolver.slot(slotId);
   return Boolean(slot && input.graph.resolver.slotEnabled(slot));
@@ -145,209 +137,43 @@ function checkFrontendSecretNames(input) {
   return { violations, coverage: { status: 'checked', envReads: state.reads } };
 }
 
-const isClientModule = (ts, sourceFile) => sourceFile.statements.some((statement, index) => index < 4 && ts.isExpressionStatement(statement)
-  && ts.isStringLiteralLike(statement.expression) && statement.expression.text === 'use client');
-
-const isDirectiveStatement = (ts, statement) => ts.isExpressionStatement(statement) && ts.isStringLiteralLike(statement.expression);
-
-const hasExportModifier = (ts, node) => node.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.ExportKeyword);
-
-const exportedValuesOf = (ts, statement) => {
-  if (ts.isFunctionDeclaration(statement)) {
-    return hasExportModifier(ts, statement) && statement.name && statement.body
-      ? [{ name: statement.name.text, implementation: statement.body, functionNode: statement }] : [];
-  }
-  if (!ts.isVariableStatement(statement) || !hasExportModifier(ts, statement)) return [];
-  return statement.declarationList.declarations
-    .filter(declaration => ts.isIdentifier(declaration.name) && declaration.initializer)
-    .map(declaration => {
-      const functionNode = (ts.isArrowFunction(declaration.initializer) || ts.isFunctionExpression(declaration.initializer))
-        && ts.isBlock(declaration.initializer.body) ? declaration.initializer : null;
-      return { name: declaration.name.text, implementation: declaration.initializer, functionNode };
-    });
-};
-
-const exportedValues = (ts, sourceFile) => sourceFile.statements.flatMap(statement => exportedValuesOf(ts, statement));
-
-const exportedActions = (ts, sourceFile) => exportedValues(ts, sourceFile).map(value => value.functionNode).filter(Boolean);
-const exportedImplementations = (ts, sourceFile, name) => exportedValues(ts, sourceFile)
-  .filter(value => value.name === name).map(value => value.implementation);
-
-const contains = (kit, root, predicate) => {
-  let found = false;
-  kit.walk(root, node => {
-    if (predicate(node)) found = true;
-    return !found;
-  });
-  return found;
-};
-
-const principalCall = (kit, checker, graph, node) => kit.ts.isCallExpression(node) && (() => {
-  const expression = node.expression;
-  const name = kit.ts.isPropertyAccessExpression(expression) ? expression.name : expression;
-  if (!kit.ts.isIdentifier(name) || name.text !== 'getPrincipal') return false;
-  return kit.declarationsOf(checker, name).some(declaration => {
-    const rel = kit.graphPath(declaration);
-    return rel !== null && FE_DB_SLOTS.has(graph.files.get(rel)?.slot);
-  });
-})();
-
-const firstPrincipal = (kit, checker, graph, statement) => {
-  let call = null;
-  kit.walk(statement, node => {
-    if (kit.ts.isAwaitExpression(node) && principalCall(kit, checker, graph, unwrap(kit.ts, node.expression))) call = unwrap(kit.ts, node.expression);
-    return call === null;
-  });
-  if (!call || !kit.ts.isVariableStatement(statement)) return { call, symbol: null };
-  for (const declaration of statement.declarationList.declarations) {
-    if (kit.ts.isIdentifier(declaration.name) && declaration.initializer && contains(kit, declaration.initializer, node => node === call)) {
-      return { call, symbol: symbolOf(kit, checker, declaration.name) };
-    }
-  }
-  return { call, symbol: null };
-};
-
-const typedRefusal = (kit, node) => contains(kit, node, child => (kit.ts.isStringLiteralLike(child) && child.text === 'refused')
-  || (kit.ts.isIdentifier(child) && /^refused(?:Outcome)?$/iu.test(child.text)));
-
-const parseUse = (ts, identifier) => {
-  let current = identifier;
-  while (current.parent && (ts.isParenthesizedExpression(current.parent) || ts.isAsExpression(current.parent))) current = current.parent;
-  const call = current.parent;
-  return ts.isCallExpression(call) && call.arguments.includes(current) && ts.isPropertyAccessExpression(call.expression)
-    && ['parse', 'safeParse'].includes(call.expression.name.text);
-};
-
-const parameterBindings = (ts, name) => {
-  if (ts.isIdentifier(name)) return [name];
-  if (ts.isObjectBindingPattern(name) || ts.isArrayBindingPattern(name)) return name.elements.flatMap(element => ts.isBindingElement(element) ? parameterBindings(ts, element.name) : []);
-  return [];
-};
-
-function inspectServerSessionCalls(kit, file, checker, violations) {
+function inspectFrontendNode(scope, node) {
+  const { kit, checker, file, violations, counters } = scope;
   const { ts } = kit;
-  if (isClientModule(ts, file.sourceFile)) return;
-  kit.walk(file.sourceFile, node => {
-    if (ts.isCallExpression(node) && callName(ts, node) === 'getSession' && signatureFromSupabase(checker, node)) {
-      reportAt(violations, kit, FE_SESSION_TRUST, file, node, 'auth.getSession() trusts cookie-backed session data in server code; call getPrincipal() (getClaims), and getUser() for sensitive mutations.');
-    }
-    return true;
-  });
-}
-
-function inspectPrincipalProvider(kit, file, checker, violations) {
-  const { ts } = kit;
-  if (!FE_DB_SLOTS.has(file.slot)) return;
-  for (const implementation of exportedImplementations(ts, file.sourceFile, 'getPrincipal')) {
-    const readsClaims = contains(kit, implementation, node => ts.isCallExpression(node) && callName(ts, node) === 'getClaims'
-      && signatureFromSupabase(checker, node));
-    if (!readsClaims) reportAt(violations, kit, FE_SESSION_TRUST, file, implementation,
-      'getPrincipal() must establish the server principal through Supabase auth.getClaims().');
+  const moduleName = moduleNameOf(ts, node);
+  if (moduleName?.startsWith('@supabase/')) {
+    counters.imports += 1;
+    if (file.slot !== FE_AUTH_SLOT) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `${moduleName} is imported by ${file.rel}, whose slot is ${file.slot ?? 'unowned'}; on the front end Supabase is auth only and ${FE_AUTH_SLOT} (modules/auth) is its one importer.`, { module: moduleName, slot: file.slot ?? null });
+    return;
   }
+  if (!ts.isCallExpression(node) || !isSupabaseCall(kit, checker, node)) return;
+  counters.calls += 1;
+  const member = callName(ts, node);
+  const parts = chainParts(ts, node);
+  let data = null;
+  if (FE_DATA_MEMBERS.has(member)) data = parts.find(name => FE_DATA_MEMBERS.has(name)) ?? member;
+  if (data) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase .${data} call is made from the front end; Supabase on the front end is auth only - read and write data, files and realtime through the back end (a modules/api GraphQL operation, an SWR hook, hooks/socketio).`, { member: data, slot: file.slot ?? null });
+  else if (file.slot !== FE_AUTH_SLOT && parts.includes('auth')) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase auth call is made from ${file.slot ?? 'an unowned path'}; the auth client is called only inside ${FE_AUTH_SLOT}, which exports the session and the access token.`, { slot: file.slot ?? null });
 }
 
-function inspectActionDirective(kit, file, action, violations) {
-  const { ts } = kit;
-  const first = action.body.statements[0];
-  const functionLevel = first?.expression?.text === 'use server' && isDirectiveStatement(ts, first);
-  if (!isServerActionModule(ts, file.sourceFile) && !functionLevel) {
-    reportAt(violations, kit, FE_WRITE_SHAPE, file, action, 'An exported write function must be a Server Action through a file-level or function-level `use server` directive.');
-  }
-}
-
-function inspectActionPrincipal(input, kit, file, checker, action, authenticatesAnonymous, violations) {
-  const { ts } = kit;
-  // Function directives are the prologue, not work: the principal is the first non-directive statement.
-  const work = action.body.statements.slice(action.body.statements.findIndex(statement => !isDirectiveStatement(ts, statement)) >>> 0);
-  const first = work[0];
-  const principal = first ? firstPrincipal(kit, checker, input.graph, first) : { call: null, symbol: null };
-  if (!principal.call || !principal.symbol) {
-    reportAt(violations, kit, FE_SESSION_TRUST, file, first ?? action, 'A write Server Action must begin with `const principal = await getPrincipal()` from the db owner.');
-  } else if (!authenticatesAnonymous) {
-    const refuses = work.slice(1).some(statement => ts.isIfStatement(statement)
-      && contains(kit, statement.expression, node => ts.isIdentifier(node) && sameSymbol(kit, checker, node, principal.symbol))
-      && typedRefusal(kit, statement.thenStatement));
-    if (!refuses) reportAt(violations, kit, FE_SESSION_TRUST, file, action, 'A write Server Action must refuse an anonymous principal with a typed `refused` Outcome before doing work.');
-  }
-}
-
-function inspectActionInputs(kit, file, action, checker, violations) {
-  const { ts } = kit;
-  for (const parameter of action.parameters.flatMap(item => parameterBindings(ts, item.name))) {
-    const symbol = symbolOf(kit, checker, parameter);
-    const references = [];
-    kit.walk(action.body, node => {
-      if (ts.isIdentifier(node) && sameSymbol(kit, checker, node, symbol)) references.push(node);
-      return true;
-    });
-    references.sort((a, b) => a.getStart() - b.getStart());
-    const firstUse = references[0];
-    if (firstUse && !parseUse(ts, firstUse)) reportAt(violations, kit, FE_WRITE_SHAPE, file, firstUse,
-      `Server Action input ${parameter.text} is used before schema.parse(...) or schema.safeParse(...).`, { parameter: parameter.text });
-  }
-}
-
-function inspectSensitiveAction(kit, file, checker, action, violations) {
-  const { ts } = kit;
-  const sensitive = /(?:^|\/)(?:billing|payment|payout|refund|charge|subscription|password|credential|role|permission|membership)[/.-]/iu.test(file.rel);
-  if (sensitive && !contains(kit, action.body, node => ts.isCallExpression(node) && callName(ts, node) === 'getUser' && signatureFromSupabase(checker, node))) {
-    reportAt(violations, kit, FE_SESSION_TRUST, file, action, 'A money, account-security or role-changing Server Action must call auth.getUser() before the mutation.');
-  }
-}
-
-function inspectWriteAction(input, kit, file, checker, action, authenticatesAnonymous, violations) {
-  inspectActionDirective(kit, file, action, violations);
-  inspectActionPrincipal(input, kit, file, checker, action, authenticatesAnonymous, violations);
-  inspectActionInputs(kit, file, action, checker, violations);
-  inspectSensitiveAction(kit, file, checker, action, violations);
-}
-
-function inspectWriteModule(input, kit, file, checker, state) {
-  const { ts } = kit;
-  if (!FE_DB_SLOTS.has(file.slot) || !path.posix.basename(file.rel).startsWith('write-')) return;
-  const classified = input.graph.resolver.classifyPath(file.rel);
-  const belowSlot = classified.root && file.rel.startsWith(`${classified.root}/`) ? file.rel.slice(classified.root.length + 1) : '';
-  const authenticatesAnonymous = (input.graph.resolver.slot(file.slot)?.anonymousActions ?? []).includes(belowSlot);
-  const declared = exportedActions(ts, file.sourceFile);
-  if (!declared.length) reportAt(state.violations, kit, FE_WRITE_SHAPE, file, file.sourceFile, `${file.rel} is a write module but exports no Server Action function.`);
-  for (const action of declared) {
-    state.actions += 1;
-    inspectWriteAction(input, kit, file, checker, action, authenticatesAnonymous, state.violations);
-  }
-}
-
-function inspectRouteHandler(input, kit, file, state) {
-  if (!file.rel.endsWith('/route.ts')) return;
-  state.routes += 1;
-  const classified = input.graph.resolver.classifyPath(file.rel);
-  const app = classified.bindings?.app;
-  const live = app !== undefined && file.rel === `apps/${app}/src/app/health/live/route.ts`;
-  if (!live && file.slot !== 'fe.route.callback') reportAt(state.violations, kit, FE_ROUTE_HANDLER, file, file.sourceFile,
-    `${file.rel} is a front-end route handler outside health/live and the fe.route.callback slot; webhooks, cron, public APIs and third-party callbacks belong to be features.`);
-}
-
-function checkFrontendAuthAndRoutes(input) {
+function checkFrontendClientOwner(input) {
   const kit = machineKit(input);
-  const state = { violations: [], actions: 0, routes: 0 };
+  const violations = [];
+  const counters = { imports: 0, calls: 0 };
   for (const file of input.graph.files.values()) {
-    const checker = kit.checkerOf(file.sourceFile);
-    inspectServerSessionCalls(kit, file, checker, state.violations);
-    inspectPrincipalProvider(kit, file, checker, state.violations);
-    inspectWriteModule(input, kit, file, checker, state);
-    inspectRouteHandler(input, kit, file, state);
+    const scope = { kit, checker: kit.checkerOf(file.sourceFile), file, violations, counters };
+    kit.walk(file.sourceFile, node => inspectFrontendNode(scope, node));
   }
-  return { violations: state.violations, coverage: { status: 'checked', actions: state.actions, routes: state.routes } };
+  return { violations, coverage: { status: 'checked', ...counters, ownerSlots: [FE_AUTH_SLOT] } };
 }
 
 export function checkFrontendSupabase(input) {
-  if (!supabaseSlotEnabled(input, 'fe.modules.db')) return { violations: [], coverage: { status: 'not-applicable', reason: 'the Supabase front-end database slot is not enabled' } };
-  const owner = checkClientOwnership(input, { slots: FE_DB_SLOTS, ruleId: FE_CLIENT_OWNER });
-  const results = checkFrontendQueryResults(input);
+  if (!supabaseSlotEnabled(input, FE_SUPABASE_PROVIDER_SLOT)) return { violations: [], coverage: { status: 'not-applicable', reason: 'no connection declares provider supabase' } };
+  const owner = checkFrontendClientOwner(input);
   const secrets = checkFrontendSecretNames(input);
-  const auth = checkFrontendAuthAndRoutes(input);
   return {
-    violations: [...owner.violations, ...results.violations, ...secrets.violations, ...auth.violations],
-    coverage: { status: 'checked', owner: owner.coverage, results: results.coverage, secrets: secrets.coverage, auth: auth.coverage },
+    violations: [...owner.violations, ...secrets.violations],
+    coverage: { status: 'checked', owner: owner.coverage, secrets: secrets.coverage },
   };
 }
 

package/runtime/scripts/hfs/architecture/tiers.mjs

@@ -1,4 +1,3 @@
-import { isServerActionModule } from './server-action.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 
 /**
@@ -102,37 +101,8 @@ const triggerOf = (resolver, file) => {
   return owner ? (resolver.slot(owner.slot)?.trigger ?? null) : null;
 };
 
-/** The db Server Action an edge targets, or null. */
-const serverActionTarget = (graph, edge) => {
-  if (graph.profile !== 'fe') return null;
-  const to = graph.resolver.classifyPath(edge.to);
-  return to.slot === 'fe.modules.db' && /^write-[^/]+\.ts$/u.test(edge.to.split('/').at(-1))
-    && isServerActionModule(null, graph.files.get(edge.to).sourceFile) ? to : null;
-};
-
-/** A connected block may call a db writer directly when that writer is a file-level Next Server Action. */
-const blockCallsServerAction = (graph, edge) => {
-  if (!serverActionTarget(graph, edge)) return false;
-  const from = graph.resolver.classifyPath(edge.from);
-  return from.slot === 'fe.components' && from.kind === 'blocks' && from.role === 'entry';
-};
-
-function reportDirectServerAction(graph, edge, verdict, actionTarget, tierRule, counts, violations) {
-  if (!(verdict.allowed || verdict.reason === 'notPublicEntry') || !actionTarget
-    || graph.unit(edge.from) === graph.unit(edge.to) || blockCallsServerAction(graph, edge)) return false;
-  counts.tierDirection += 1;
-  violations.push({
-    ruleId: tierRule,
-    path: edge.from, line: edge.line, column: edge.column,
-    specifier: edge.specifier, resolvedPath: edge.to, typeOnly: !edge.runtime,
-    fromTier: graph.resolver.tierOf(edge.from), toTier: graph.resolver.tierOf(edge.to),
-    message: `${edge.from} -> ${edge.to}: a db Server Action is called directly only by a connected block entry; hooks and other tiers use their declared data path${edge.runtime ? '' : ' (type-only imports count)'}.`,
-  });
-  return true;
-}
-
 function reportReasonedTierViolation(graph, edge, verdict, tierRule, counts, violations) {
-  if (verdict.allowed || (verdict.reason === 'tierDirection' && blockCallsServerAction(graph, edge)) || !REASON_TEXT[verdict.reason]) return;
+  if (verdict.allowed || !REASON_TEXT[verdict.reason]) return;
   counts[verdict.reason] += 1;
   const featureToFeature = graph.profile === 'be' && verdict.reason === 'tierDirection' && verdict.fromTier === 'feature' && verdict.toTier === 'feature';
   const fromKind = featureToFeature ? triggerOf(graph.resolver, edge.from) : null;
@@ -162,8 +132,6 @@ function inspectTierEdge(graph, edge, tierRule, counts, violations, coverage) {
     return;
   }
   coverage.edgesChecked += 1;
-  const actionTarget = serverActionTarget(graph, edge);
-  if (reportDirectServerAction(graph, edge, verdict, actionTarget, tierRule, counts, violations)) return;
   reportReasonedTierViolation(graph, edge, verdict, tierRule, counts, violations);
 }
 

package/runtime/scripts/hfs/architecture/transport-owner.mjs

@@ -2,36 +2,44 @@ import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
 
 /**
- * R50 `transport-owner` (FE_TRANSPORT_OWNER), the machine half of the eslint rules `fetch-only-in-api-client` and
- * `client-fetch-has-signal`. ESLint judges one file at a time by the spelling of a call; the machine judges the repository by
- * what the checker resolves. A repository has exactly ONE transport client and ONE Outcome union, both named by slot (never
- * by a path spelled here): the api package's (`fe.package.api.client`, `fe.package.api.outcome`) when the repository shares
- * it, or the only app's (`fe.transport.client`, `fe.transport.outcome`) when the repository declares exactly one app. The
- * Outcome homes are the slots the manifest marks `outcomeHome` (the lite edition adds `fe.modules.db.outcome`), not a list kept here.
+ * R50 `transport-owner` (FE_TRANSPORT_OWNER), the machine half of the eslint transport rules. ESLint judges one file at a time by
+ * the spelling of a call; the machine judges the repository by what the checker resolves. The browser calls the back end through
+ * Apollo GraphQL and axios (owner ruling 2026-10-13, both editions). A repository has exactly ONE transport client folder (the auth
+ * and no-auth Apollo clients with their link chain) and ONE GraphQLResponse union, both named by slot (never by a path spelled here):
+ * the api package's (`fe.package.api.client`, `fe.package.api.outcome`) when several apps call the back end, or the app's own
+ * (`fe.transport.client`, `fe.transport.outcome`) when exactly one app does. An app calls the back end when it holds a file of the
+ * api owner (modules/api, its client and union) or imports the api package; an app that holds neither (a marketing landing) shares
+ * no transport and is not counted. The union homes are the slots the manifest marks `outcomeHome`, not a list kept here.
  *
- *   - two or more clients, or two or more Outcome unions, in the repository (two apps each keeping one, or a package one plus
- *     an app one) are findings on every copy;
- *   - an app client or app Outcome union in a repository that declares more than one app is a finding (it belongs to the package);
- *   - the client calls the global `fetch` (a client that never calls it has its transport somewhere else);
- *   - no other file references the global `fetch`: a call, `globalThis.fetch`, `window.fetch`, or a reference passed as a value
- *     (`useSWR(key, fetch)`, `const send = fetch`), all of which a spelling-based rule misses; with no client at all every such
- *     reference is a finding that says the repository has no client;
- *   - no file imports an HTTP library, by static import, `import()` or `require()`;
- *   - every server reader (`modules/api/<domain>/read-*.ts`) imports the client (or the api package that holds it), so a reader
- *     is a caller of the one transport and not a second one.
+ *   - two or more client folders, or two or more unions, in the repository (two apps each keeping one, or a package one plus an
+ *     app one) are findings on every copy;
+ *   - an app client or app union in a repository where more than one app calls the back end is a finding (it belongs to the package);
+ *   - no file outside the client folder references the global `fetch`: a call, `globalThis.fetch`, `window.fetch`, or a
+ *     reference passed as a value (`useSWR(key, fetch)`, `const send = fetch`), all of which a spelling-based rule misses; with no
+ *     client at all every such reference is a finding that says the repository has no client;
+ *   - axios is imported only by the api owner (modules/api, the api package) for its rest calls; every other HTTP library is a
+ *     second transport wherever it is imported, by static import, `import()` or `require()`;
+ *   - an `ApolloClient` is constructed only inside the client folder;
+ *   - every GraphQL operation (`graphql/queries/query-*.ts`, `graphql/mutations/mutation-*.ts`) imports the client (or the api
+ *     package that holds it), so an operation is a caller of the one transport and not a second one.
  */
 export const TRANSPORT_OWNER_RULE_IDS = ['FE_TRANSPORT_OWNER'];
 
 const RULE = 'FE_TRANSPORT_OWNER';
-/** Packages that send HTTP requests: a second transport when a file imports one. */
+/** Packages that send HTTP requests: a second transport when a file imports one (axios only outside the api owner). */
 const HTTP_LIBRARIES = new Set(['axios', 'ky', 'ky-universal', 'got', 'node-fetch', 'undici', 'cross-fetch', 'isomorphic-fetch', 'superagent', 'ofetch', 'whatwg-fetch']);
+const REST_LIBRARY = 'axios';
 const GLOBAL_OBJECTS = new Set(['globalThis', 'window', 'self', 'global']);
-const API_SLOT = 'fe.modules.api';
 const APP_CLIENT_SLOT = 'fe.transport.client';
 const APP_OUTCOME_SLOT = 'fe.transport.outcome';
 const PACKAGE_API_SLOT = 'fe.package.api';
 const CLIENT_SLOTS = new Set([APP_CLIENT_SLOT, 'fe.package.api.client']);
-const NO_CLIENT = "the repository has no transport client. Create the one client (packages/<family>-api/src/client.ts, or the only app's modules/api/client.ts) and call it.";
+/** The api owner: the slots whose files may import axios (the rest calls and the client's own links). */
+const API_OWNER_SLOTS = new Set(['fe.modules.api', PACKAGE_API_SLOT, ...CLIENT_SLOTS]);
+/** The slots that hold the GraphQL operations of an app or of the api package. */
+const OPERATION_SLOTS = new Set(['fe.modules.api', PACKAGE_API_SLOT]);
+const OPERATION_FILE = /^(?:query|mutation)-[^/]+\.ts$/u;
+const NO_CLIENT = "the repository has no transport client. Create the one Apollo client folder (packages/<family>-api/src/graphql/clients/, or the only app's modules/api/graphql/clients/) and call the back end through it.";
 
 /** True when `node` names the global fetch: no import, and no declaration outside a lib declaration file. */
 function isGlobalObjectFetch(ts, node) {
@@ -59,12 +67,14 @@ function isGlobalFetch(ts, kit, checker, node) {
   return declarations.every(declaration => declaration.getSourceFile().isDeclarationFile);
 }
 
-function reportMultiplicity(items, noun, nextApps, report, list) {
-  for (const file of items) {
+/** Findings on every copy when there are several, and on an app's own copy in a repository where several apps call the back end. */
+function reportMultiplicity(items, noun, callingApps, report) {
+  const list = items.map(item => item.root).join(', ');
+  for (const item of items) {
     if (items.length > 1) {
-      report(file, file.sourceFile, `The repository has ${items.length} ${noun}s (${list(items)}); it has exactly one: the api package's (packages/<family>-api/src/) when the apps share it, or the only app's. Keep one and delete the others.`);
-    } else if ((file.slot === APP_CLIENT_SLOT || file.slot === APP_OUTCOME_SLOT) && nextApps.length > 1) {
-      report(file, file.sourceFile, `${file.rel} is an app's ${noun} in a repository of ${nextApps.length} apps; a repository with several apps keeps its one ${noun} in the api package (packages/<family>-api/src/).`);
+      report(item, item.sourceFile, `The repository has ${items.length} ${noun}s (${list}); it has exactly one: the api package's (packages/<family>-api/src/graphql/) when the apps share it, or the only app's. Keep one and delete the others.`);
+    } else if ((item.slot === APP_CLIENT_SLOT || item.slot === APP_OUTCOME_SLOT) && callingApps.length > 1) {
+      report(item, item.sourceFile, `${item.root} is an app's ${noun} in a repository of ${callingApps.length} apps that call the back end (${callingApps.join(', ')}); a repository where several apps call the back end keeps its one ${noun} in the api package (packages/<family>-api/src/graphql/).`);
     }
   }
 }
@@ -81,40 +91,80 @@ function moduleSpecifierOf(ts, node) {
   return null;
 }
 
-function inspectTransportNode({ ts, kit, checker, file, node, isClient, clientCalls, clients, owned, report }) {
+function isApolloClientConstruction(ts, kit, checker, node) {
+  if (!ts.isNewExpression(node)) return false;
+  const binding = kit.importBinding(checker, node.expression);
+  return Boolean(binding && binding.name === 'ApolloClient' && binding.module.startsWith('@apollo/client'));
+}
+
+function inspectLibraryImport({ ts, file, node, transport, report }) {
+  const specifier = moduleSpecifierOf(ts, node);
+  if (!specifier || !ts.isStringLiteralLike(specifier)) return;
+  const library = specifier.text.split('/')[0];
+  if (!HTTP_LIBRARIES.has(library) || (library === REST_LIBRARY && API_OWNER_SLOTS.has(file.slot))) return;
+  const where = library === REST_LIBRARY
+    ? 'axios belongs to the api owner only (modules/api/rest, the api package): call its rest functions'
+    : `the transport is Apollo GraphQL (${transport}) with axios for the rest calls of modules/api/rest`;
+  report(file, node, `${specifier.text} is a second HTTP transport in ${file.rel}; ${where}.`, { library: specifier.text });
+}
+
+function inspectTransportNode(scope, node) {
+  const { ts, kit, checker, file, isClient, owned, report } = scope;
   const fetchUse = globalFetchUse(ts, kit, checker, node);
   if (fetchUse !== null) {
-    if (isClient) clientCalls.value += 1;
-    else if (fetchUse === 'property') report(file, node, `${node.getText(file.sourceFile)} reaches the global fetch outside the transport client; ${owned}`);
+    if (isClient) return false;
+    if (fetchUse === 'property') report(file, node, `${node.getText(file.sourceFile)} reaches the global fetch outside the transport client; ${owned}`);
     else report(file, node, `fetch is used outside the transport client (called, aliased or passed as a value); ${owned}`);
     return false;
   }
-  const specifier = moduleSpecifierOf(ts, node);
-  if (specifier && ts.isStringLiteralLike(specifier) && HTTP_LIBRARIES.has(specifier.text.split('/')[0])) {
-    report(file, node, `${specifier.text} is a second HTTP transport; the repository's one transport is built on fetch (${clients.length ? clients.map(item => item.rel).join(', ') : 'no client exists yet'}). Use the client.`, { library: specifier.text });
-  }
+  if (!isClient && isApolloClientConstruction(ts, kit, checker, node)) report(file, node, `${file.rel} constructs an ApolloClient outside the transport client folder; ${owned}`);
+  inspectLibraryImport({ ...scope, node });
   return true;
 }
 
-function inspectTransportFiles({ files, graph, kit, ts, clientRels, clients, owned, report }) {
+/** True when the operation imports the client folder, or (from an app) the api package that holds it. */
+function reachesClient(graph, file, clientRels) {
+  return graph.edges.some(edge => {
+    if (edge.from !== file.rel || !edge.runtime) return false;
+    if (clientRels.has(edge.to)) return true;
+    return file.slot !== PACKAGE_API_SLOT && (graph.files.get(edge.to)?.slot ?? '').startsWith(PACKAGE_API_SLOT);
+  });
+}
+
+function inspectTransportFiles({ files, graph, kit, ts, clientRels, transport, owned, report }) {
   const appsWithFiles = new Set();
-  let readers = 0;
+  let operations = 0;
   for (const file of files) {
-    const bindings = kit.resolver.classifyPath(file.rel).bindings;
-    if (bindings?.app) appsWithFiles.add(bindings.app);
-    const checker = kit.checkerOf(file.sourceFile);
-    const isClient = clientRels.has(file.rel);
-    const clientCalls = { value: 0 };
-    kit.walk(file.sourceFile, node => inspectTransportNode({ ts, kit, checker, file, node, isClient, clientCalls, clients, owned, report }));
-    if (isClient && clientCalls.value === 0) report(file, file.sourceFile, `${file.rel} never calls the global fetch; the client is the one module that owns fetch, with its timeout and abort signal.`);
-    if (file.slot === API_SLOT && bindings?.app && path.posix.basename(file.rel).startsWith('read-')) {
-      readers += 1;
-      const reachesClient = graph.edges.some(edge => edge.from === file.rel && edge.runtime
-        && (clientRels.has(edge.to) || graph.files.get(edge.to)?.slot === PACKAGE_API_SLOT));
-      if (!reachesClient) report(file, file.sourceFile, `${file.rel} is a server reader that does not import the transport client; a reader fetches through the repository's one client, never through its own transport.`);
+    if (file.bindings?.app) appsWithFiles.add(file.bindings.app);
+    const scope = { ts, kit, checker: kit.checkerOf(file.sourceFile), file, isClient: clientRels.has(file.rel), transport, owned, report };
+    kit.walk(file.sourceFile, node => inspectTransportNode(scope, node));
+    if (OPERATION_SLOTS.has(file.slot) && OPERATION_FILE.test(path.posix.basename(file.rel))) {
+      operations += 1;
+      if (!reachesClient(graph, file, clientRels)) report(file, file.sourceFile, `${file.rel} is a GraphQL operation that does not import the transport client; an operation runs through the repository's one Apollo client, never through its own transport.`);
     }
   }
-  return { appsWithFiles, readers };
+  return { appsWithFiles, operations };
+}
+
+/**
+ * The declared Next apps that call the back end: those holding a file of an api owner slot (modules/api, the app client, the app
+ * union) or importing a file of the api package. An app with neither shares no transport.
+ */
+function transportApps(nextApps, files, graph) {
+  const byRel = new Map(files.map(file => [file.rel, file]));
+  const calling = new Set(files.filter(file => API_OWNER_SLOTS.has(file.slot) && file.slot !== PACKAGE_API_SLOT).map(file => file.bindings?.app));
+  for (const edge of graph.edges) {
+    const app = byRel.get(edge.from)?.bindings?.app;
+    if (app && (byRel.get(edge.to)?.slot ?? '').startsWith(PACKAGE_API_SLOT)) calling.add(app);
+  }
+  return nextApps.map(item => item.name).filter(name => calling.has(name));
+}
+
+/** One instance per client folder (its slot root), carried by the folder's first file. */
+function clientInstances(clients) {
+  const byRoot = new Map();
+  for (const file of [...clients].sort((a, b) => a.rel.localeCompare(b.rel))) if (!byRoot.has(file.root)) byRoot.set(file.root, file);
+  return [...byRoot.values()];
 }
 
 export function checkTransportOwner(input) {
@@ -124,16 +174,22 @@ export function checkTransportOwner(input) {
   const violations = [];
   const report = (file, node, message, extra = {}) => violations.push({ ruleId: RULE, path: file.rel, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
   const nextApps = resolver.repo.apps.filter(item => item.kind === 'next');
-  const files = [...graph.files.values()].filter(file => file.slot && file.tier !== 'e2e');
+  const files = [...graph.files.values()].filter(file => file.slot && file.tier !== 'e2e').map(file => {
+    const classified = resolver.classifyPath(file.rel);
+    return { ...file, root: classified.root ?? file.rel, bindings: classified.bindings };
+  });
   const clients = files.filter(file => CLIENT_SLOTS.has(file.slot));
-  const outcomes = files.filter(file => resolver.slot(file.slot)?.outcomeHome === true);
+  const instances = clientInstances(clients);
+  const outcomes = files.filter(file => resolver.slot(file.slot)?.outcomeHome === true).map(file => ({ ...file, root: file.rel }));
   const clientRels = new Set(clients.map(file => file.rel));
-  const list = items => items.map(item => item.rel).join(', ');
-  const owned = clients.length ? `the repository has one transport (${list(clients)}). Call the client and take its Outcome.` : NO_CLIENT;
+  const transport = instances.length ? instances.map(item => item.root).join(', ') : 'no client exists yet';
+  const owned = instances.length ? `the repository has one transport (${transport}). Call the back end through a modules/api operation and take its GraphQLResponse.` : NO_CLIENT;
 
-  // Exactly one client and one Outcome union per repository.
-  for (const [items, noun] of [[clients, 'transport client'], [outcomes, 'Outcome union']]) reportMultiplicity(items, noun, nextApps, report, list);
+  // Exactly one client folder and one GraphQLResponse union per repository.
+  const calling = transportApps(nextApps, files, graph);
+  reportMultiplicity(instances, 'transport client', calling, report);
+  reportMultiplicity(outcomes, 'GraphQLResponse union', calling, report);
 
-  const { appsWithFiles, readers } = inspectTransportFiles({ files, graph, kit, ts, clientRels, clients, owned, report });
-  return { violations, coverage: { status: 'checked', apps: appsWithFiles.size, readers, clients: clients.length, outcomes: outcomes.length } };
+  const { appsWithFiles, operations } = inspectTransportFiles({ files, graph, kit, ts, clientRels, transport, owned, report });
+  return { violations, coverage: { status: 'checked', apps: appsWithFiles.size, operations, clients: instances.length, outcomes: outcomes.length } };
 }

package/runtime/scripts/hfs/architecture/type-context.mjs

@@ -156,7 +156,10 @@ function unresolvedReferenceFinding(reference, sourceFile, project, config, work
   const codeLike = !helpers.assetExtension.test(reference.specifier);
   const workspaceImport = [...workspaceNames].some(name => helpers.sameOrUnder(reference.specifier, name));
   const internal = reference.specifier.startsWith('.') || helpers.pathAliasMatches(reference.specifier, project.options.paths) || workspaceImport;
-  if (codeLike && internal) errors.push({
+  // A __generated__/ folder is the gitignored output of the app's codegen step (the GraphQL wire types, fe-stack codegen): it
+  // exists after `npm run codegen`, which lint, typecheck and build run first, and the compiler proves those imports there.
+  const generated = /(?:^|\/)__generated__(?:\/|$)/.test(reference.specifier);
+  if (codeLike && internal && !generated) errors.push({
     ruleId: 'ARCH_INTERNAL_IMPORT_UNRESOLVED',
     project: project.relative,
     path: helpers.relativePath(config.root, sourceFile.fileName),

package/runtime/scripts/hfs/edition-slots.mjs

@@ -1,5 +1,7 @@
 // edition.mjs - the one edition filter shared by the HFS slot resolver, declaration validation, rule catalog and
 // edition-specific rule parameters. Full is the default; lite changes data views, never the checks that consume them.
+// Lite is the full architecture deployed without self-hosted infrastructure (owner ruling 2026-10-12): its overlays swap
+// adapters and remove the infra and e2e world, and every slot keeps its own `tests`.
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { EDITIONS } from './manifest-shape.mjs';
 
@@ -15,7 +17,7 @@ export function slotInEdition(manifest, slot, edition) {
   return (slot.editions ?? manifest.editions ?? EDITIONS).includes(edition);
 }
 
-/** The slot as `edition` sees it: lite overlays its data, presence and tracking while forbidding every test world. */
+/** The slot as `edition` sees it: lite overlays its data, presence and tracking; `tests` stays the slot's own (lite keeps the unit specs). */
 export function effectiveSlot(slot, profile, edition) {
   if (edition !== 'lite') return slot;
   const { lite, litePresence, ...base } = slot;
@@ -23,7 +25,7 @@ export function effectiveSlot(slot, profile, edition) {
   let tracked = slot.tracked;
   if (presence === 'forbidden') tracked = 'external';
   else if (tracked === 'external') tracked = 'tracked';
-  return { ...base, ...lite, presence, tracked, tests: 'none' };
+  return { ...base, ...lite, presence, tracked };
 }
 
 /** The template group starci app sync renders `slot` from under `edition`: `liteManagedBy` (else `managedBy`) in lite, `managedBy` otherwise; undefined when unmanaged. */
@@ -59,10 +61,17 @@ export function enforcerJudgedInEdition(rules, kind, id, edition = 'full') {
   return owners.every((rule) => judgedInEdition(rule, edition) && rule.enforcers.filter((enforcer) => enforcer.kind === kind && enforcer.id === id).every((enforcer) => judgedInEdition(enforcer, edition)));
 }
 
-/** A frozen copy of one profile's parameters, with its lite overrides applied only in the lite edition. */
+/**
+ * A frozen copy of one profile's parameters, with its lite overrides applied only in the lite edition. A lite key whose base
+ * value and override are both maps merges one level deep (lite.infraOwners restates only the specifiers whose owner changes);
+ * any other value replaces the base.
+ */
 export function editionRuleParams(params, edition) {
   const { lite, ...base } = params;
-  const merged = edition === 'lite' && lite ? { ...base, ...lite } : base;
+  const merged = edition === 'lite' && lite ? { ...base } : base;
+  if (edition === 'lite' && lite) {
+    for (const [key, value] of Object.entries(lite)) merged[key] = isPlainObject(value) && isPlainObject(base[key]) ? { ...base[key], ...value } : value;
+  }
   const deepFreeze = (value) => { if (value && typeof value === 'object') { Object.values(value).forEach(deepFreeze); } return Object.freeze(value); };
   return deepFreeze(structuredClone(merged));
 }