@starci/eslint-canon-fe 8.2.18 → 8.4.0

package/runtime/scripts/hfs/architecture/dead-exports-bindings.mjs

@@ -0,0 +1,149 @@
+// Import and namespace consumption analysis shared by dead-export edges.
+import path from 'node:path';
+
+/** Disk/staged test consumers have no production checker; bind their local names without resolving dependencies. */
+const namespaceChecker = (context, sourceFile, namespace) => {
+  if (context.namespaceCheckers.has(sourceFile)) return context.namespaceCheckers.get(sourceFile);
+  const { ts } = context;
+  let checker = context.checkerFor?.(sourceFile.fileName);
+  if (!checker?.getSymbolAtLocation(namespace.name)) {
+    const options = { noResolve: true, noLib: true, types: [], allowJs: true, target: ts.ScriptTarget.Latest };
+    const host = ts.createCompilerHost(options);
+    const filename = path.resolve(sourceFile.fileName);
+    host.getSourceFile = file => path.resolve(file) === filename ? sourceFile : undefined;
+    host.fileExists = file => path.resolve(file) === filename;
+    host.readFile = file => path.resolve(file) === filename ? sourceFile.text : undefined;
+    checker = ts.createProgram([filename], options, host).getTypeChecker();
+  }
+  context.namespaceCheckers.set(sourceFile, checker);
+  return checker;
+};
+
+const transparentExpression = (ts, node) => node && (ts.isParenthesizedExpression(node) || ts.isAsExpression(node)
+  || ts.isTypeAssertionExpression(node) || ts.isNonNullExpression(node) || ts.isSatisfiesExpression(node));
+
+const literalMember = (ts, node) => {
+  while (transparentExpression(ts, node)) node = node.expression;
+  return node && (ts.isStringLiteralLike(node) || ts.isNumericLiteral(node)) ? node.text : null;
+};
+
+const destructuredMember = (ts, name) => {
+  if (ts.isIdentifier(name)) return name.text;
+  if (ts.isComputedPropertyName(name)) return literalMember(ts, name.expression);
+  return literalMember(ts, name);
+};
+
+/** A destructuring alias consumes the property's name, while a rest/computed binding may consume every export. */
+const destructuredBindings = (ts, pattern) => {
+  const names = [];
+  const elements = ts.isObjectBindingPattern(pattern) ? pattern.elements : pattern.properties;
+  for (const element of elements) {
+    if (element.dotDotDotToken || ts.isSpreadAssignment(element)) return { all: true, pairs: [] };
+    const name = destructuredMember(ts, element.propertyName ?? element.name);
+    if (name === null) return { all: true, pairs: [] };
+    names.push(name);
+  }
+  return { all: false, pairs: names.map(imported => ({ imported, exported: null })) };
+};
+
+const namespaceReference = (ts, checker, symbol, node) => {
+  if (checker.getSymbolAtLocation(node) === symbol) return true;
+  const parent = node.parent;
+  if (ts.isShorthandPropertyAssignment(parent) && parent.name === node) return checker.getShorthandAssignmentValueSymbol(parent) === symbol;
+  return ts.isExportSpecifier(parent) && node === (parent.propertyName ?? parent.name)
+    && checker.getExportSpecifierLocalTargetSymbol(parent) === symbol;
+};
+
+const unwrappedNamespace = (ts, node) => {
+  while (transparentExpression(ts, node.parent)) node = node.parent;
+  return node;
+};
+
+const indexedNamespaceMember = (ts, node) => {
+  if (!ts.isTypeQueryNode(node.parent) || node.parent.exprName !== node) return null;
+  let query = node.parent;
+  while (ts.isParenthesizedTypeNode(query.parent)) query = query.parent;
+  const indexed = query.parent;
+  return ts.isIndexedAccessTypeNode(indexed) && indexed.objectType === query && ts.isLiteralTypeNode(indexed.indexType)
+    ? literalMember(ts, indexed.indexType.literal) : null;
+};
+
+/** The first member is the entry export even in a chain such as namespace.Enum.Member or namespace.Type.Inner. */
+const namespaceUse = (ts, reference) => {
+  const node = unwrappedNamespace(ts, reference);
+  const parent = node.parent;
+  let name = null;
+  if (ts.isPropertyAccessExpression(parent) && parent.expression === node) name = parent.name.text;
+  else if (ts.isQualifiedName(parent) && parent.left === node) name = parent.right.text;
+  else if (ts.isElementAccessExpression(parent) && parent.expression === node) name = literalMember(ts, parent.argumentExpression);
+  else if (ts.isVariableDeclaration(parent) && parent.initializer === node && ts.isObjectBindingPattern(parent.name)) return destructuredBindings(ts, parent.name);
+  else if (ts.isBinaryExpression(parent) && parent.right === node && parent.operatorToken.kind === ts.SyntaxKind.EqualsToken
+    && ts.isObjectLiteralExpression(parent.left)) return destructuredBindings(ts, parent.left);
+  else name = indexedNamespaceMember(ts, node);
+  return name === null ? { all: true, pairs: [] } : { all: false, pairs: [{ imported: name, exported: null }] };
+};
+
+const namespaceBindings = (context, declaration, namespace) => {
+  if (context.namespaceUses.has(namespace)) return context.namespaceUses.get(namespace);
+  const { ts } = context;
+  const sourceFile = declaration.getSourceFile();
+  const checker = namespaceChecker(context, sourceFile, namespace);
+  const symbol = checker.getSymbolAtLocation(namespace.name);
+  const result = { all: false, pairs: [] };
+  const visit = node => {
+    if (ts.isJSDocSeeTag(node) || ts.isJSDocLink(node) || ts.isJSDocLinkCode(node) || ts.isJSDocLinkPlain(node)) return;
+    if (ts.isIdentifier(node) && node !== namespace.name && namespaceReference(ts, checker, symbol, node)) {
+      const used = namespaceUse(ts, node);
+      result.all ||= used.all;
+      result.pairs.push(...used.pairs);
+    }
+    if (!result.all) {
+      ts.forEachChild(node, visit);
+      for (const doc of node.jsDoc ?? []) visit(doc);
+    }
+  };
+  // An unavailable binding must never turn an unknown consumer into a false unused-export finding.
+  if (symbol) visit(sourceFile);
+  else result.all = true;
+  context.namespaceUses.set(namespace, result);
+  return result;
+};
+
+const importBindings = (context, declaration) => {
+  const { ts } = context;
+  const clause = declaration.importClause;
+  if (!clause) return { all: false, pairs: [] }; // side-effect import: uses nothing
+  const pairs = [];
+  if (clause.name) pairs.push({ imported: 'default', exported: null });
+  const named = clause.namedBindings;
+  if (named && named.kind === ts.SyntaxKind.NamespaceImport) {
+    const namespace = namespaceBindings(context, declaration, named);
+    return { all: namespace.all, pairs: [...pairs, ...namespace.pairs] };
+  }
+  if (named) for (const element of named.elements) pairs.push({ imported: (element.propertyName ?? element.name).text, exported: null });
+  return { all: false, pairs };
+};
+
+const exportBindings = (ts, declaration) => {
+  const clause = declaration.exportClause;
+  if (!clause || clause.kind === ts.SyntaxKind.NamespaceExport) return { all: true, pairs: [] };
+  return { all: false, pairs: clause.elements.map(element => ({ imported: (element.propertyName ?? element.name).text, exported: element.name.text })) };
+};
+
+const importTypeBindings = (ts, declaration) => {
+  let qualifier = declaration.qualifier;
+  if (!qualifier) return { all: true, pairs: [] };
+  while (qualifier.kind === ts.SyntaxKind.QualifiedName) qualifier = qualifier.left;
+  return { all: false, pairs: [{ imported: qualifier.text, exported: null }] };
+};
+
+/** Names an import/export declaration takes from its target: {all} or {pairs: [{imported, exported}]}. */
+export function bindingsOf(context, declaration) {
+  const { ts } = context;
+  if (!declaration) return { all: true, pairs: [] };
+  if (declaration.kind === ts.SyntaxKind.ImportDeclaration) return importBindings(context, declaration);
+  if (declaration.kind === ts.SyntaxKind.ExportDeclaration) return exportBindings(ts, declaration);
+  if (declaration.kind === ts.SyntaxKind.ImportTypeNode) return importTypeBindings(ts, declaration);
+  // ImportEqualsDeclaration, dynamic import(), require(): the whole module is taken.
+  return { all: true, pairs: [] };
+}

package/runtime/scripts/hfs/architecture/dead-exports.mjs

@@ -17,15 +17,16 @@
  * and contributes no name here.
  *
  * A name is used when a production file outside the owner imports it from the entry (type-only imports count). A
- * namespace import, `import x = require`, a dynamic import()/require(), an `export *` or `export * as` of the entry make
- * every name used. A file outside the owner that re-exports the name (`export { n as m } from`) uses it when `m` is itself
+ * namespace import uses its statically accessed members; a computed read or an escape of the namespace uses every name.
+ * `import x = require`, a dynamic import()/require(), an `export *` or `export * as` of the entry make every name used.
+ * A file outside the owner that re-exports the name (`export { n as m } from`) uses it when `m` is itself
  * used by the importers of that file; a re-exporting file nobody imports is a framework entry (a route file) and uses it.
  * Specs and tests are not in the graph, so an export used only by a spec is dead, on purpose, with these exceptions (unit test
  * standard): the unit spec of every unit role (ruleParams.be.unitRoles: `<name>.service.spec.ts`, `<name>.cli.spec.ts`) and of every logic role
  * (ruleParams.be.logicRoles: `<name>.policy.spec.ts`, `<name>.client.spec.ts`, ...), a
  * unit spec of a webhook, gateway or subscription door (`.webhook.spec.ts`, `.gateway.spec.ts`, `.subscription.spec.ts`: a door has no service of its own), a
  * `*.builder.ts` under src/tests/fixtures/builders, and a file of the test world (slots be.tests.world and be.tests.world.kit, which
- * open and migrate the real databases of the e2e run) read from disk count as consumers, because a spec can only provide an
+ * open and migrate the real databases of the e2e run) read from disk or staged in the git index count as consumers, because a spec can only provide an
  * Inject*() token or a param type the entry exports, and the world wires the same capabilities the apps do. An integration
  * spec (slot be.tests.integration, `src/tests/integration/<capability>/*.integration-spec.ts`) counts as a consumer of exactly one
  * owner: the integration (slot be.integrations, `src/modules/integrations/<provider>/`) whose provider folder is its capability
@@ -38,6 +39,8 @@ import { canonical } from './config.mjs';
 import path from 'node:path';
 import { treeOf } from './required-files.mjs';
 import { globExpression } from '../../lib/glob.mjs';
+import { stagedConsumerSources } from './staged-consumers.mjs';
+import { bindingsOf } from './dead-exports-bindings.mjs';
 
 export const DEAD_EXPORT_RULE_IDS = ['HFS_UNUSED_EXPORT', 'HFS_UNUSED_FILE'];
 
@@ -69,40 +72,6 @@ function extraEntries(graph, entry) {
   return names.flatMap(name => (name.includes('*') ? matches(name) : [`${found.root}/${name}`].filter(rel => graph.files.has(rel))));
 }
 
-const importBindings = (ts, declaration) => {
-  const clause = declaration.importClause;
-  if (!clause) return { all: false, pairs: [] }; // side-effect import: uses nothing
-  const pairs = [];
-  if (clause.name) pairs.push({ imported: 'default', exported: null });
-  const named = clause.namedBindings;
-  if (named && named.kind === ts.SyntaxKind.NamespaceImport) return { all: true, pairs: [] };
-  if (named) for (const element of named.elements) pairs.push({ imported: (element.propertyName ?? element.name).text, exported: null });
-  return { all: false, pairs };
-};
-
-const exportBindings = (ts, declaration) => {
-  const clause = declaration.exportClause;
-  if (!clause || clause.kind === ts.SyntaxKind.NamespaceExport) return { all: true, pairs: [] };
-  return { all: false, pairs: clause.elements.map(element => ({ imported: (element.propertyName ?? element.name).text, exported: element.name.text })) };
-};
-
-const importTypeBindings = (ts, declaration) => {
-  let qualifier = declaration.qualifier;
-  if (!qualifier) return { all: true, pairs: [] };
-  while (qualifier.kind === ts.SyntaxKind.QualifiedName) qualifier = qualifier.left;
-  return { all: false, pairs: [{ imported: qualifier.text, exported: null }] };
-};
-
-/** Names an import/export declaration takes from its target: {all} or {pairs: [{imported, exported}]}. */
-function bindingsOf(ts, declaration) {
-  if (!declaration) return { all: true, pairs: [] };
-  if (declaration.kind === ts.SyntaxKind.ImportDeclaration) return importBindings(ts, declaration);
-  if (declaration.kind === ts.SyntaxKind.ExportDeclaration) return exportBindings(ts, declaration);
-  if (declaration.kind === ts.SyntaxKind.ImportTypeNode) return importTypeBindings(ts, declaration);
-  // ImportEqualsDeclaration, dynamic import(), require(): the whole module is taken.
-  return { all: true, pairs: [] };
-}
-
 const addExportName = (found, sourceFile, name, node) => {
   if (found.has(name)) return;
   found.set(name, sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1);
@@ -241,10 +210,12 @@ function inIntegrationOf(graph, to, provider) {
 }
 
 /** The pseudo edges of one test consumer file: its import/export declarations that resolve to graph files it may reach. */
-function consumerFileEdges({ ts, options, graph, config }, rel, provider) {
+function consumerFileEdges({ ts, options, graph, config }, rel, provider, indexedText) {
   const abs = path.join(config.root, ...rel.split('/'));
-  let text;
-  try { text = fs.readFileSync(abs, 'utf8'); } catch { return []; }
+  let text = indexedText;
+  if (text === undefined) {
+    try { text = fs.readFileSync(abs, 'utf8'); } catch { return []; }
+  }
   const sourceFile = ts.createSourceFile(abs, text, ts.ScriptTarget.Latest, true);
   const edges = [];
   for (const statement of sourceFile.statements) {
@@ -257,17 +228,19 @@ function consumerFileEdges({ ts, options, graph, config }, rel, provider) {
 }
 
 /**
- * Pseudo edges (read from disk, outside the production program) to graph files: from the unit role specs, the fixture builders and
+ * Pseudo edges (read from disk and staged index sources, outside the production program) to graph files: from the unit role specs, the fixture builders and
  * the test world files to anything, and from an integration spec only to the integration of its own provider folder.
  */
 function testConsumerEdges({ context, graph, config }) {
   const resolution = { ts: context.ts, options: context.projects?.[0]?.options ?? {}, graph, config };
-  const consumers = [...treeOf(config.root).files]
-    .map(file => ({ file, any: testConsumer(graph, file) }))
-    .map(({ file, any }) => ({ file, provider: any ? null : integrationSpecProvider(graph, file), any }))
+  // Live lint keeps tracked disk consumers; staged snapshots add the consumers present in the same commit.
+  const staged = stagedConsumerSources(config.root, file => testConsumer(graph, file) || integrationSpecProvider(graph, file) !== null);
+  const consumers = [...[...treeOf(config.root).files].map(file => ({ file })), ...staged]
+    .map(source => ({ ...source, any: testConsumer(graph, source.file) }))
+    .map(({ file, text, any }) => ({ file, text, provider: any ? null : integrationSpecProvider(graph, file), any }))
     .filter(({ any, provider }) => any || provider !== null)
     .sort((a, b) => a.file.localeCompare(b.file));
-  return consumers.flatMap(({ file: rel, provider }) => consumerFileEdges(resolution, rel, provider));
+  return consumers.flatMap(({ file: rel, text, provider }) => consumerFileEdges(resolution, rel, provider, text));
 }
 
 const edgeIndex = edges => {
@@ -307,7 +280,7 @@ const consumedNames = (context, file, ownerKey, depth, visiting) => {
   const result = { all: false, names: new Set() };
   for (const edge of context.edgesTo.get(file) ?? []) {
     if (ownerKey && unitOfFile(context.graph, edge.from) === ownerKey) continue;
-    const bindings = bindingsOf(context.ts, edge.edge.declaration);
+    const bindings = bindingsOf(context, edge.edge.declaration);
     if (bindings.all) { result.all = true; continue; }
     for (const pair of bindings.pairs) consumeReexportedName(context, result, edge, pair, depth, visiting);
   }
@@ -316,10 +289,10 @@ const consumedNames = (context, file, ownerKey, depth, visiting) => {
 
 /** Adds to `used` the entry exports reached by a consumer outside the owner that imports a file the entry re-exports by name. */
 const addReexportedUses = (context, key, publicEntry, used) => {
-  const { ts, graph } = context;
+  const { graph } = context;
   for (const edge of graph.edges) {
     if (edge.from !== publicEntry || !edge.reexport || graph.unit(edge.to) !== key) continue;
-    const reexport = bindingsOf(ts, edge.edge.declaration);
+    const reexport = bindingsOf(context, edge.edge.declaration);
     const inner = consumedNames(context, edge.to, key, 0, new Set([publicEntry, edge.to]));
     if (reexport.all) continue;
     for (const pair of reexport.pairs) if (inner.all || inner.names.has(pair.imported)) used.names.add(pair.exported);
@@ -337,7 +310,7 @@ const unusedExportViolation = (publicEntry, name, line, owner) => ({
 const addSiblingEntryUses = (context, publicEntry, declared, used) => {
   for (const edge of context.edgesTo.get(publicEntry) ?? []) {
     if (edge.reexport || edge.from === publicEntry || !declared.has(edge.from)) continue;
-    const bindings = bindingsOf(context.ts, edge.edge.declaration);
+    const bindings = bindingsOf(context, edge.edge.declaration);
     if (bindings.all) used.all = true;
     for (const pair of bindings.pairs) used.names.add(pair.imported);
   }
@@ -377,7 +350,7 @@ const ownerExportFindings = (context, config) => {
 
 export function checkDeadExports({ context, graph, config }) {
   const edgesTo = edgeIndex([...graph.edges, ...testConsumerEdges({ context, graph, config })]);
-  const analysis = { ...context, graph, edgesTo };
+  const analysis = { ...context, graph, edgesTo, namespaceCheckers: new WeakMap(), namespaceUses: new WeakMap() };
   const exports = ownerExportFindings(analysis, config);
   const files = deadFiles(graph, config);
   const dead = exports.violations.length;

package/runtime/scripts/hfs/architecture/default-deny.mjs

@@ -2,22 +2,23 @@ import { machineKit } from './machine-ast.mjs';
 
 /**
  * R41 `default-deny-app-guard` (BE_DEFAULT_DENY). Every api app root provides its `APP_GUARD` entries in the order
- * throttler -> CSRF origin guard -> AuthGuard, each exactly once, so no request reaches a handler before it was
- * rate-limited, origin-checked and authenticated. A guard is classified by structure, never by name or folder alone
+ * throttler -> CSRF origin guard -> CredentialGuard -> AuthGuard, each exactly once, so no request reaches a handler before it was
+ * rate-limited, origin-checked, credential-authenticated and admitted. A guard is classified by structure, never by name or folder alone
  * (BE-CONVENTION 1.7 names the roles, not a library):
  *   - throttler: a class of @nestjs/throttler or one that extends it, or a guard that reads through a Reflector the
  *     per-door metadata (the `@RateLimit(tier)` decorator) that a SetMetadata call of its own capability writes;
  *   - CSRF origin guard: a guard declared in platform/http-security that reads the request origin or referer header;
+ *   - CredentialGuard: the `CredentialGuard` class declared in domain/identity;
  *   - AuthGuard: the `AuthGuard` class declared in domain/identity.
  * Other guards are permitted between them; a missing, repeated or reordered one of the three is a finding.
  */
 export const DEFAULT_DENY_RULE_IDS = ['BE_DEFAULT_DENY'];
 
 const RULE = 'BE_DEFAULT_DENY';
-const ORDER = ['throttler', 'csrf', 'auth'];
+const ORDER = ['throttler', 'csrf', 'credential', 'auth'];
 const ORIGIN_HEADERS = new Set(['origin', 'referer', 'referrer']);
 const METADATA_READERS = new Set(['get', 'getAll', 'getAllAndMerge', 'getAllAndOverride']);
-const LABEL = { throttler: 'the throttler guard', csrf: 'the CSRF origin guard of platform/http-security', auth: 'AuthGuard of domain/identity' };
+const LABEL = { throttler: 'the throttler guard', csrf: 'the CSRF origin guard of platform/http-security', credential: 'CredentialGuard of domain/identity', auth: 'AuthGuard of domain/identity' };
 
 const keySymbol = (kit, checker, node) => (node ? kit.aliased(checker, kit.symbolAt(checker, node)) ?? null : null);
 
@@ -98,6 +99,7 @@ const classifyDeclaration = (kit, graph, keyCache, declaration) => {
     if (readsDoorMetadata(kit, graph, keyCache, declaration, owner)) return 'throttler';
   }
   if (owner?.tier === 'domain' && owner.name === 'identity' && ts.isClassDeclaration(declaration) && declaration.name?.text === 'AuthGuard') return 'auth';
+  if (owner?.tier === 'domain' && owner.name === 'identity' && ts.isClassDeclaration(declaration) && declaration.name?.text === 'CredentialGuard') return 'credential';
   return null;
 };
 
@@ -117,7 +119,7 @@ const roleMessages = (app, roles, anchor) => {
   const out = [];
   for (const role of ORDER) {
     const entries = roles.filter(item => item.role === role);
-    if (entries.length === 0) out.push({ node: anchor, message: `App ${app.name} does not provide ${LABEL[role]} as an APP_GUARD; an api app is denied by default: throttler, then CSRF origin guard, then AuthGuard.` });
+    if (entries.length === 0) out.push({ node: anchor, message: `App ${app.name} does not provide ${LABEL[role]} as an APP_GUARD; an api app is denied by default: throttler, then CSRF origin guard, then CredentialGuard, then AuthGuard.` });
     else if (entries.length > 1) out.push({ node: entries[1].guard.node, message: `App ${app.name} provides ${LABEL[role]} more than once as an APP_GUARD.` });
   }
   return out;
@@ -128,7 +130,7 @@ const orderMessages = (app, roles) => {
   if (!indexes.every(index => index >= 0)) return [];
   const out = [];
   for (let i = 1; i < indexes.length; i += 1) {
-    if (indexes[i] < indexes[i - 1]) out.push({ node: roles[indexes[i]].guard.node, message: `App ${app.name} provides ${LABEL[ORDER[i]]} before ${LABEL[ORDER[i - 1]]}; the APP_GUARD order is throttler, CSRF origin guard, AuthGuard.` });
+    if (indexes[i] < indexes[i - 1]) out.push({ node: roles[indexes[i]].guard.node, message: `App ${app.name} provides ${LABEL[ORDER[i]]} before ${LABEL[ORDER[i - 1]]}; the APP_GUARD order is throttler, CSRF origin guard, CredentialGuard, AuthGuard.` });
   }
   return out;
 };

package/runtime/scripts/hfs/architecture/frontend-block-render.mjs

@@ -0,0 +1,104 @@
+import path from 'node:path';
+import { normalizedSymbolValue } from './ast-walks.mjs';
+import { unwrapExpression } from './typescript.mjs';
+
+/** Feature composition may inject block renders into a pure view without making the view a world owner. */
+export class BlockRenderAnalysis {
+  constructor(renderer) {
+    this.renderer = renderer;
+    this.world = renderer.world;
+  }
+
+  featureComposition(expression, expectedFile) {
+    const file = expression?.getSourceFile().fileName;
+    return Boolean(file && !expectedFile && this.world.insideAny(this.world.roots.features, file)
+      && path.basename(file) === 'index.tsx');
+  }
+
+  renderProp(expression, checker, expectedFile) {
+    return this.featureComposition(expression, expectedFile) && this.renderValue(expression, checker);
+  }
+
+  blockTarget(expression, checker) {
+    const functions = this.world.expressionFunctions(expression, checker);
+    return functions.length > 0 && functions.every(fn => {
+      const file = fn.getSourceFile().fileName;
+      return this.world.sourceSet.has(path.resolve(file)) && path.basename(file) === 'index.tsx'
+        && this.world.tierOf(this.world.roots.components, file)?.tier === 'blocks'
+        && this.renderer.functionHasRender(fn, checker);
+    });
+  }
+
+  callbacksRender(functions, checker, seen) {
+    return functions.length > 0 && functions.every(fn => {
+      const values = this.renderer.helpers.returnedExpressions(this.world.ts, fn);
+      return !this.world.functionUsesWorld(fn, checker) && values.length > 0
+        && values.every(value => this.renderValue(value, checker, seen));
+    });
+  }
+
+  renderValue(input, checker, seen = new Set()) {
+    const ts = this.world.ts;
+    const value = unwrapExpression(ts, input);
+    if (!value) return false;
+    if (value.kind === ts.SyntaxKind.NullKeyword || value.kind === ts.SyntaxKind.FalseKeyword) return true;
+    if (ts.isConditionalExpression(value)) return this.renderValue(value.whenTrue, checker, seen)
+      && this.renderValue(value.whenFalse, checker, seen);
+    if (ts.isBinaryExpression(value) && value.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken)
+      return this.renderValue(value.right, checker, seen);
+    if (ts.isArrayLiteralExpression(value)) return value.elements.every(item => this.renderValue(item, checker, seen));
+    if (ts.isJsxFragment(value)) return this.fragmentBlocks(value, checker, seen);
+    if (ts.isJsxElement(value) || ts.isJsxSelfClosingElement(value)) return this.jsxBlock(value, checker, seen);
+    if (ts.isCallExpression(value)) return this.createdBlock(value, checker, seen) || this.mappedBlocks(value, checker, seen);
+    if (ts.isArrowFunction(value) || ts.isFunctionExpression(value)) return this.callbacksRender([value], checker, seen);
+    return this.referencedBlocks(value, checker, seen);
+  }
+
+  fragmentBlocks(value, checker, seen) {
+    const ts = this.world.ts;
+    return value.children.every(child => {
+      if (ts.isJsxText(child)) return !child.text.trim();
+      return this.renderValue(ts.isJsxExpression(child) ? child.expression : child, checker, seen);
+    });
+  }
+
+  jsxBlock(value, checker, seen) {
+    const ts = this.world.ts;
+    const opening = ts.isJsxElement(value) ? value.openingElement : value;
+    if (!this.blockTarget(opening.tagName, checker)) return false;
+    const boundary = { hasBoundary: true };
+    return this.renderer.jsxChildrenBoundary(value, opening, checker, seen, null, false, boundary)
+      && this.renderer.jsxAttributesBoundary(opening, checker, seen, null, boundary);
+  }
+
+  mappedBlocks(value, checker, seen) {
+    const ts = this.world.ts;
+    const callee = unwrapExpression(ts, value.expression);
+    if (!ts.isPropertyAccessExpression(callee) && !ts.isElementAccessExpression(callee)) return false;
+    let name = ts.isPropertyAccessExpression(callee) ? callee.name.text : null;
+    if (name === null && ts.isStringLiteralLike(callee.argumentExpression)) name = callee.argumentExpression.text;
+    return name === 'map' && value.arguments.length > 0
+      && this.callbacksRender(this.world.expressionFunctions(value.arguments[0], checker), checker, seen);
+  }
+
+  createdBlock(value, checker, seen) {
+    const ts = this.world.ts;
+    if (!this.renderer.isCreateElement(value, checker) || !value.arguments[0]
+      || !this.blockTarget(value.arguments[0], checker)) return false;
+    const boundary = { hasBoundary: true };
+    const props = value.arguments[1] ? unwrapExpression(ts, value.arguments[1]) : null;
+    return this.renderer.createElementPropsBoundary(props, checker, seen, null, boundary, false)
+      && value.arguments.slice(2).every(child => this.renderer.renderBoundary(child, checker, seen));
+  }
+
+  referencedBlocks(value, checker, seen) {
+    const ts = this.world.ts;
+    const symbol = normalizedSymbolValue(ts, checker, this.renderer.helpers.selectedSymbol(ts, checker, value));
+    if (!symbol || seen.has(symbol)) return false;
+    const nextSeen = new Set(seen).add(symbol);
+    const values = (symbol.getDeclarations?.() ?? []).flatMap(declaration => ts.isVariableDeclaration(declaration)
+      && declaration.initializer ? [declaration.initializer] : []);
+    if (values.length) return values.every(item => this.renderValue(item, checker, nextSeen));
+    return this.callbacksRender(this.world.expressionFunctions(value, checker), checker, nextSeen);
+  }
+}

package/runtime/scripts/hfs/architecture/frontend-world-render.mjs

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { normalizedSymbolValue } from './ast-walks.mjs';
 import { relativePath, unwrapExpression } from './typescript.mjs';
+import { BlockRenderAnalysis } from './frontend-block-render.mjs';
 function importDeclarationFor(ts, node) {
   for (let current = node; current; current = current.parent) if (ts.isImportDeclaration(current)) return current;
   return null;
@@ -41,12 +42,14 @@ export class WorldRenderAnalysis {
   constructor(world, helpers) {
     this.world = world;
     this.helpers = helpers;
+    this.blocks = new BlockRenderAnalysis(this);
   }
 
   expressionHasRender(expression, checker, seen = new Set()) {
     expression = unwrapExpression(this.world.ts, expression);
     if (!expression) return false;
     if (this.world.ts.isJsxElement(expression) || this.world.ts.isJsxSelfClosingElement(expression) || this.world.ts.isJsxFragment(expression)) return true;
+    if (this.world.ts.isArrayLiteralExpression(expression)) return expression.elements.some(item => this.expressionHasRender(item, checker, seen));
     if (this.world.ts.isCallExpression(expression) && isReactCreateElement(this.world.ts, checker, expression)) return true;
     if (this.world.ts.isConditionalExpression(expression)) return this.conditionalExpressionHasRender(expression, checker, seen);
     const logicalRender = this.logicalExpressionHasRender(expression, checker, seen);
@@ -148,6 +151,22 @@ export class WorldRenderAnalysis {
       || this.world.expressionFunctions(expression, checker).some(fn => this.functionHasRender(fn, checker));
   }
 
+  isCreateElement(expression, checker) {
+    return isReactCreateElement(this.world.ts, checker, expression);
+  }
+
+  propValueBoundary(input, checker, seen, expectedFile, pureTarget) {
+    const ts = this.world.ts;
+    const value = unwrapExpression(ts, input);
+    if (pureTarget && this.blocks.renderProp(value, checker, expectedFile)) return true;
+    if (pureTarget && this.blocks.featureComposition(value, expectedFile) && ts.isObjectLiteralExpression(value)) {
+      return value.properties.every(property => !ts.isPropertyAssignment(property)
+        || this.propValueBoundary(property.initializer, checker, seen, expectedFile, pureTarget));
+    }
+    return !this.expressionSuppliesRender(value, checker) || this.pureRenderTarget(value, checker, expectedFile)
+      || this.renderBoundary(value, checker, seen, true, expectedFile);
+  }
+
   routedLayoutChild(opening, child, checker) {
     const ts = this.world.ts;
     if (!ts.isJsxExpression(child) || !child.expression) return false;
@@ -216,7 +235,7 @@ export class WorldRenderAnalysis {
     if (!pureTarget && !wrapper) return false;
     const boundary = { hasBoundary: pureTarget };
     const props = expression.arguments[1] ? unwrapExpression(ts, expression.arguments[1]) : null;
-    if (!this.createElementPropsBoundary(props, checker, seen, expectedFile, boundary)) return false;
+    if (!this.createElementPropsBoundary(props, checker, seen, expectedFile, boundary, pureTarget)) return false;
     const children = expression.arguments.slice(2);
     if (children.length) {
       if (!children.every(child => this.renderBoundary(child, checker, seen, false, expectedFile))) return false;
@@ -225,19 +244,19 @@ export class WorldRenderAnalysis {
     return boundary.hasBoundary;
   }
 
-  createElementPropsBoundary(props, checker, seen, expectedFile, boundary) {
+  createElementPropsBoundary(props, checker, seen, expectedFile, boundary, pureTarget) {
     const ts = this.world.ts;
     if (!props || props.kind === ts.SyntaxKind.NullKeyword) return true;
     if (!ts.isObjectLiteralExpression(props) || props.properties.some(property => ts.isSpreadAssignment(property))) return false;
-    return props.properties.every(property => this.propsPropertyBoundary(property, checker, seen, expectedFile, boundary));
+    return props.properties.every(property => this.propsPropertyBoundary(property, checker, seen, expectedFile, boundary, pureTarget));
   }
 
-  propsPropertyBoundary(property, checker, seen, expectedFile, boundary) {
+  propsPropertyBoundary(property, checker, seen, expectedFile, boundary, pureTarget) {
     const ts = this.world.ts;
     if (!ts.isPropertyAssignment(property)) return true;
     const value = unwrapExpression(ts, property.initializer);
+    if (!this.propValueBoundary(value, checker, seen, expectedFile, pureTarget)) return false;
     if (!this.expressionSuppliesRender(value, checker)) return true;
-    if (!this.pureRenderTarget(value, checker, expectedFile) && !this.renderBoundary(value, checker, seen, true, expectedFile)) return false;
     const name = property.name && (ts.isIdentifier(property.name) || ts.isStringLiteralLike(property.name)) ? property.name.text : null;
     if (['children', 'component', 'content', 'render', 'view'].includes(name)) boundary.hasBoundary = true;
     return true;
@@ -270,7 +289,7 @@ export class WorldRenderAnalysis {
     if (!pureTarget && !wrapper) return false;
     const boundary = { hasBoundary: pureTarget };
     if (!this.jsxChildrenBoundary(expression, opening, checker, seen, expectedFile, pureTarget, boundary)) return false;
-    if (!this.jsxAttributesBoundary(opening, checker, seen, expectedFile, boundary)) return false;
+    if (!this.jsxAttributesBoundary(opening, checker, seen, expectedFile, boundary, pureTarget)) return false;
     return boundary.hasBoundary;
   }
 
@@ -286,13 +305,13 @@ export class WorldRenderAnalysis {
     return true;
   }
 
-  jsxAttributesBoundary(opening, checker, seen, expectedFile, boundary) {
+  jsxAttributesBoundary(opening, checker, seen, expectedFile, boundary, pureTarget = false) {
     const ts = this.world.ts;
     return opening.attributes.properties.every(attribute => !ts.isJsxAttribute(attribute) || !attribute.initializer
-      || this.jsxAttributeBoundary(attribute, checker, seen, expectedFile, boundary));
+      || this.jsxAttributeBoundary(attribute, checker, seen, expectedFile, boundary, pureTarget));
   }
 
-  jsxAttributeBoundary(attribute, checker, seen, expectedFile, boundary) {
+  jsxAttributeBoundary(attribute, checker, seen, expectedFile, boundary, pureTarget) {
     const ts = this.world.ts;
     const name = attribute.name.text;
     if (['fallback', 'errorElement'].includes(name)) {
@@ -300,10 +319,10 @@ export class WorldRenderAnalysis {
       if (ts.isJsxExpression(attribute.initializer)
         && !this.renderBoundary(attribute.initializer.expression, checker, seen, true, expectedFile)) return false;
     }
+    if (ts.isJsxExpression(attribute.initializer) && attribute.initializer.expression
+      && !this.propValueBoundary(attribute.initializer.expression, checker, seen, expectedFile, pureTarget)) return false;
     if (ts.isJsxExpression(attribute.initializer) && attribute.initializer.expression
       && this.expressionSuppliesRender(attribute.initializer.expression, checker)) {
-      if (!this.pureRenderTarget(attribute.initializer.expression, checker, expectedFile)
-        && !this.renderBoundary(attribute.initializer.expression, checker, seen, true, expectedFile)) return false;
       if (['component', 'content', 'render', 'view'].includes(name)) boundary.hasBoundary = true;
     }
     return true;

package/runtime/scripts/hfs/architecture/frontend-world.mjs

@@ -74,7 +74,7 @@ class WorldAnalysis {
     let found = false;
     const visit = node => {
       if (!found && this.ts.isCallExpression(node) && this.ts.isIdentifier(node.expression) && node.expression.text === 'fetch'
-        && !checker.getSymbolAtLocation(node.expression)) found = true;
+        && (checker.getSymbolAtLocation(node.expression)?.getDeclarations() ?? []).every(declaration => declaration.getSourceFile().isDeclarationFile)) found = true;
       if (!found) this.ts.forEachChild(node, visit);
     };
     visit(sourceFile);