@starci/eslint-canon-fe 8.3.0 → 8.4.0

package/runtime/knowledge/patterns/fe/folder.yaml

@@ -306,6 +306,7 @@ rules:
       envelope, the generated wire types (from be/contracts/, through the root codegen) and the axios calls live in
       modules/api; the session lives in modules/auth; mutation feedback in modules/toast; environment reading in
       modules/config; every href builder in modules/routes; locale routing in modules/i18n; colour values in modules/brand.
+      Only hooks/swr imports the API transport operations; feature owners and other hooks consume those SWR hooks.
       A helper name defined twice across hook files is a finding.
     rationale: |
       A rule that says what a hooks folder is also says where everything else goes, so nobody copies a helper sixteen

package/runtime/knowledge/sonar-gate.yaml

@@ -82,7 +82,7 @@ overall:
     rule: typescript:S3776
     via: overall.issues
 # Lite is the same quality policy, coverage included: a lite back end keeps full's unit run and its 100 per file on the measured
-# logic files (owner ruling 2026-10-12, R212 case-1). Readers select this block from hfs.json edition; the gate keeps its own
+# logic files (owner ruling 2026-10-12, R212 case-1 (owner:lite-production-swarm), with the Work boundary amended by ruling:R212/case-4). Readers select this block from hfs.json edition; the gate keeps its own
 # name so a lite project's server gate stays a separate object, and every threshold below equals full's.
 lite:
   gate:

package/runtime/modules/models/runtimes.yaml

@@ -351,7 +351,7 @@ allocation:
   # process keeps the lock regardless of age.
   housekeeping:
     tmpMaxAgeMs: 172800000
-    tmpPrefixes: [policy-, rights-, l4-, starci, starci-w2, evidence, sup-k, work-v3, scoped-lint, si-, w1-, nivo-, orca-spec,
+    tmpPrefixes: [coverage-generated-wire-, work-validate-lite-, example-refs-lite-, example-lite-, coverage-inventory-, policy-, rights-, l4-, starci, starci-w2, evidence, sup-k, work-v3, scoped-lint, si-, w1-, nivo-, orca-spec,
       owner-bias-cli-, admission-runtime-, agent-launch-, starci-provider-budget-, starci-provider-schema-,
       codex-, deps-, direction-part-, draw-layer-, footprint-, grammar-pin-, guard-, literal-argv-, module-yaml-,
       doc-language-, guidance-, hk-, hfs-, install-link-, kernel-check-, kguard-, sup-orca, land-, op-manifest-, path-key-, pathspec-, push-scan-spec-, rename-over-, sbl-, serve-ask-, sup-chat, sup-repo, sup-src, sup-wd,

package/runtime/packages/hfs/templates/app/package-scripts/package.json

@@ -10,6 +10,7 @@
     "test:e2e": "npm run typecheck:tests && cd be && jest --selectProjects e2e",
     "test:contract": "npm run typecheck:tests && cd be && jest --selectProjects contract",
     "test:stack": "starci app stack",
+{{supabaseScripts}}
     "contract:emit": "starci app emit"
   }
 }

package/runtime/scripts/api/git/lib.mjs

@@ -75,3 +75,6 @@ export const gitExecutable = (options = null) => {
   if (!options) cachedGit = found;
   return found;
 };
+
+/** The output ceiling of the whole-diff and `cat-file --batch` calls `test affected` batches (a release diff is tens of megabytes). */
+export const BATCH_MAX_BUFFER = 1024 * 1024 * 1024;

package/runtime/scripts/api/git/merge-base.mjs

@@ -0,0 +1,9 @@
+// merge-base.mjs — `git merge-base <a> <b>`: the best common ancestor of two commits. Whether one commit is in another
+// is is-ancestor.mjs.
+import { gitRunner } from './lib.mjs';
+
+/** The best common ancestor of commits `a` and `b` (a sha), or null when they share none or a ref does not resolve. */
+export const mergeBase = (cwd, a, b, { git = null } = {}) => {
+  const r = gitRunner(git)(['merge-base', a, b], { cwd });
+  return r.ok && r.stdout ? r.stdout : null;
+};

package/runtime/scripts/api/git/recorded-lines.mjs

@@ -1,19 +1,65 @@
 // recorded-lines.mjs - the line count a file had at a git revision (git show <ref>:<file>): the recorded size a
 // size-growth rule compares the working file with.
 import path from 'node:path';
+import { existsSync } from 'node:fs';
 import { runGit } from './lib.mjs';
+import { mergeBase } from './merge-base.mjs';
+import { withoutGitLocalEnv } from '../../lib/git.mjs';
 import { lineCount } from '../../lib/line-count.mjs';
+import { readEnv } from '../../lib/env.mjs';
+import { folded } from '../../lib/event-contract.mjs';
+
+const ok = (result) => !result.error && result.status === 0;
+const pathKey = (value) => process.platform === 'win32' ? value.toLowerCase() : value;
+
+/** A commit hook exports an index; HEAD applies only to a staged file whose lint text is that index's text. */
+function lintingIndex(dir, name, source) {
+  const indexFile = readEnv('GIT_INDEX_FILE');
+  if (!indexFile || typeof source !== 'string') return false;
+  const options = { dir, env: withoutGitLocalEnv(process.env), maxBuffer: 64 * 1024 * 1024 };
+  const index = runGit(['rev-parse', '--path-format=absolute', '--git-path', 'index'], options);
+  const root = runGit(['rev-parse', '--show-toplevel'], options);
+  if (!ok(index) || !ok(root)) return false;
+  // The hook's relative index path is relative to the repository root even after xargs changes to be/ or fe/.
+  const hookIndex = path.resolve(root.stdout.trim(), indexFile);
+  if (pathKey(path.dirname(hookIndex)) !== pathKey(path.dirname(path.resolve(index.stdout.trim())))) return false;
+  const stagedOptions = { ...options, env: { ...options.env, GIT_INDEX_FILE: hookIndex } };
+  const changed = runGit(['diff', '--cached', '--relative', '--name-only', '-z', '--', `./${name}`], stagedOptions);
+  if (!ok(changed) || !changed.stdout.split('\0').includes(name)) return false;
+  const staged = runGit(['show', `:./${name}`], stagedOptions);
+  return ok(staged) && folded(staged.stdout) === folded(source);
+}
+
+function recordedRef(dir, name, source) {
+  if (lintingIndex(dir, name, source)) return 'HEAD';
+  const base = readEnv('STARCI_BASE_REF');
+  for (const ref of base ? [base] : ['origin/main', 'main']) {
+    const sha = mergeBase(dir, 'HEAD', ref);
+    if (sha) return sha;
+  }
+  return null;
+}
 
 /**
- * The line count of a file at a git revision, or null when the file did not exist there or git is absent.
+ * The line count at the branch's merge base, null for a confirmed new file, or `unavailable` for unreadable history.
+ * Only lint text matching a changed file in a commit hook's index is compared with HEAD. Explicit revision strings
+ * remain supported for callers that request a particular revision rather than the lint baseline.
  *
  * @param {string} filename - Absolute path of the file.
- * @param {string} ref - The revision, `HEAD` by default (the parent of the commit being made).
- * @returns {number | null} The recorded line count.
+ * @param {object | string} options - `{ source }` from ESLint, or an explicit revision.
+ * @returns {number | null | 'unavailable'} The recorded line count or the reason it cannot be compared.
  */
-export const recordedLines = (filename, ref = 'HEAD') => {
-  const r = runGit(['show', `${ref}:./${path.basename(filename)}`], { dir: path.dirname(filename), maxBuffer: 64 * 1024 * 1024 });
-  // no repository, no such revision, or a new file: all mean there is no recorded size to compare with
-  if (r.error || r.status !== 0) return null;
-  return lineCount(r.stdout);
+export const recordedLines = (filename, options = {}) => {
+  const absolute = path.resolve(filename);
+  let dir = path.dirname(absolute);
+  while (!existsSync(dir) && path.dirname(dir) !== dir) dir = path.dirname(dir);
+  const name = path.relative(dir, absolute).split(path.sep).join('/');
+  const ref = typeof options === 'string' ? options : recordedRef(dir, name, options.source);
+  if (!ref) return 'unavailable';
+  const gitOptions = { dir, maxBuffer: 64 * 1024 * 1024 };
+  const files = runGit(['ls-tree', '--name-only', '-z', ref, '--', `./${name}`], gitOptions);
+  if (!ok(files)) return 'unavailable';
+  if (!files.stdout.split('\0').includes(name)) return null;
+  const recorded = runGit(['show', `${ref}:./${name}`], gitOptions);
+  return ok(recorded) ? lineCount(recorded.stdout) : 'unavailable';
 };

package/runtime/scripts/hfs/architecture/backend-app-files.mjs

@@ -1,20 +1,13 @@
 import path from 'node:path';
 import { allowsFile } from '../allows.mjs';
 import { relativePath, unwrapExpression } from './typescript.mjs';
-import { sourceLocation } from '../../lib/ts-ast.mjs';
+import { accessName, sourceLocation } from '../../lib/ts-ast.mjs';
 
 const PROCESS_MODULES = new Set(['process', 'node:process']);
 const PROCESS_GLOBAL = new Set(['process']);
 const GLOBAL_HOLDERS = new Set(['globalThis', 'global']);
 const REFLECT_GLOBAL = new Set(['Reflect']);
 
-/** A static property name, including `object['env']` and `object[`env`]`. */
-export function accessName(ts, node) {
-  if (ts.isPropertyAccessExpression(node)) return node.name.text;
-  if (ts.isElementAccessExpression(node) && ts.isStringLiteralLike(node.argumentExpression)) return node.argumentExpression.text;
-  return null;
-}
-
 function bindingName(ts, element) {
   const name = element.propertyName ?? element.name;
   if (ts.isIdentifier(name) || ts.isStringLiteralLike(name)) return name.text;

package/runtime/scripts/hfs/architecture/backend.mjs

@@ -3,7 +3,7 @@ import { isInside } from './config.mjs';
 import { allowsFile, slotAdmitsFile } from '../allows.mjs';
 import { reachableViolation, relativePath } from './typescript.mjs';
 import { checkApplicationEnvironment } from './backend-app-files.mjs';
-import { sourceLocation } from '../../lib/ts-ast.mjs';
+import { accessName, sourceLocation } from '../../lib/ts-ast.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 
 const FORBIDDEN_APP_ROLE = /(?:^|\.)(?:service|provider|providers|resolver|controller|handler|repository|entity|use-case|command|query|listener|consumer|processor)\.[cm]?[jt]sx?$/i;
@@ -177,15 +177,10 @@ function requiredSpecifier(ts, call) {
     : null;
 }
 
-const requiredMemberSelection = (ts, node) => {
-  if (ts.isPropertyAccessExpression(node)) return node.name.text;
-  return ts.isStringLiteralLike(node.argumentExpression) ? node.argumentExpression.text : null;
-};
-
 function requiredMemberEvidence(ts, node, found) {
   if (!(ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) || !ts.isCallExpression(node.expression)) return;
   const specifier = requiredSpecifier(ts, node.expression);
-  const selected = requiredMemberSelection(ts, node);
+  const selected = accessName(ts, node);
   const member = ts.isPropertyAccessExpression(node) ? node.name : node.argumentExpression;
   if (specifier && TRANSPORT_PACKAGES.test(specifier)) {
     found.push({ node: member, specifier, detail: `${selected ?? 'computed member'} from ${specifier}` });

package/runtime/scripts/hfs/architecture/client-reaches-server.mjs

@@ -4,7 +4,7 @@ import { sourceLocation } from '../../lib/ts-ast.mjs';
 /**
  * R55 `client-reaches-server` (FE_CLIENT_REACHES_SERVER), the repository half of the eslint rule `client-no-server-import`,
  * which sees one hop from a file that carries the directive. The machine walks the resolved import graph from every module
- * whose first statement is the `"use client"` directive, over runtime edges only (a type-only import vanishes at build), and
+ * whose directive prologue contains `"use client"`, over runtime edges only (a type-only import vanishes at build), and
  * reports any reachable module (the entry itself included) that imports a server-only surface:
  *
  *   - `server-only`, `next/headers`, `next/server`, `next-intl/server`;
@@ -22,8 +22,11 @@ const NODE_BUILTINS = new Set(builtinModules.map(name => name.replace(/^node:/u,
 
 const isServerSpecifier = specifier => SERVER_MODULES.has(specifier) || specifier.startsWith('node:') || NODE_BUILTINS.has(specifier.split('/')[0]);
 const isClientEntry = (ts, file) => {
-  const first = file.sourceFile.statements[0];
-  return Boolean(first) && ts.isExpressionStatement(first) && ts.isStringLiteral(first.expression) && first.expression.text === 'use client';
+  for (const statement of file.sourceFile.statements) {
+    if (!ts.isExpressionStatement(statement) || !ts.isStringLiteral(statement.expression)) return false;
+    if (statement.expression.text === 'use client') return true;
+  }
+  return false;
 };
 
 const reachesBundle = (ts, declaration) => {

package/runtime/scripts/hfs/architecture/dead-exports-bindings.mjs

@@ -0,0 +1,149 @@
+// Import and namespace consumption analysis shared by dead-export edges.
+import path from 'node:path';
+
+/** Disk/staged test consumers have no production checker; bind their local names without resolving dependencies. */
+const namespaceChecker = (context, sourceFile, namespace) => {
+  if (context.namespaceCheckers.has(sourceFile)) return context.namespaceCheckers.get(sourceFile);
+  const { ts } = context;
+  let checker = context.checkerFor?.(sourceFile.fileName);
+  if (!checker?.getSymbolAtLocation(namespace.name)) {
+    const options = { noResolve: true, noLib: true, types: [], allowJs: true, target: ts.ScriptTarget.Latest };
+    const host = ts.createCompilerHost(options);
+    const filename = path.resolve(sourceFile.fileName);
+    host.getSourceFile = file => path.resolve(file) === filename ? sourceFile : undefined;
+    host.fileExists = file => path.resolve(file) === filename;
+    host.readFile = file => path.resolve(file) === filename ? sourceFile.text : undefined;
+    checker = ts.createProgram([filename], options, host).getTypeChecker();
+  }
+  context.namespaceCheckers.set(sourceFile, checker);
+  return checker;
+};
+
+const transparentExpression = (ts, node) => node && (ts.isParenthesizedExpression(node) || ts.isAsExpression(node)
+  || ts.isTypeAssertionExpression(node) || ts.isNonNullExpression(node) || ts.isSatisfiesExpression(node));
+
+const literalMember = (ts, node) => {
+  while (transparentExpression(ts, node)) node = node.expression;
+  return node && (ts.isStringLiteralLike(node) || ts.isNumericLiteral(node)) ? node.text : null;
+};
+
+const destructuredMember = (ts, name) => {
+  if (ts.isIdentifier(name)) return name.text;
+  if (ts.isComputedPropertyName(name)) return literalMember(ts, name.expression);
+  return literalMember(ts, name);
+};
+
+/** A destructuring alias consumes the property's name, while a rest/computed binding may consume every export. */
+const destructuredBindings = (ts, pattern) => {
+  const names = [];
+  const elements = ts.isObjectBindingPattern(pattern) ? pattern.elements : pattern.properties;
+  for (const element of elements) {
+    if (element.dotDotDotToken || ts.isSpreadAssignment(element)) return { all: true, pairs: [] };
+    const name = destructuredMember(ts, element.propertyName ?? element.name);
+    if (name === null) return { all: true, pairs: [] };
+    names.push(name);
+  }
+  return { all: false, pairs: names.map(imported => ({ imported, exported: null })) };
+};
+
+const namespaceReference = (ts, checker, symbol, node) => {
+  if (checker.getSymbolAtLocation(node) === symbol) return true;
+  const parent = node.parent;
+  if (ts.isShorthandPropertyAssignment(parent) && parent.name === node) return checker.getShorthandAssignmentValueSymbol(parent) === symbol;
+  return ts.isExportSpecifier(parent) && node === (parent.propertyName ?? parent.name)
+    && checker.getExportSpecifierLocalTargetSymbol(parent) === symbol;
+};
+
+const unwrappedNamespace = (ts, node) => {
+  while (transparentExpression(ts, node.parent)) node = node.parent;
+  return node;
+};
+
+const indexedNamespaceMember = (ts, node) => {
+  if (!ts.isTypeQueryNode(node.parent) || node.parent.exprName !== node) return null;
+  let query = node.parent;
+  while (ts.isParenthesizedTypeNode(query.parent)) query = query.parent;
+  const indexed = query.parent;
+  return ts.isIndexedAccessTypeNode(indexed) && indexed.objectType === query && ts.isLiteralTypeNode(indexed.indexType)
+    ? literalMember(ts, indexed.indexType.literal) : null;
+};
+
+/** The first member is the entry export even in a chain such as namespace.Enum.Member or namespace.Type.Inner. */
+const namespaceUse = (ts, reference) => {
+  const node = unwrappedNamespace(ts, reference);
+  const parent = node.parent;
+  let name = null;
+  if (ts.isPropertyAccessExpression(parent) && parent.expression === node) name = parent.name.text;
+  else if (ts.isQualifiedName(parent) && parent.left === node) name = parent.right.text;
+  else if (ts.isElementAccessExpression(parent) && parent.expression === node) name = literalMember(ts, parent.argumentExpression);
+  else if (ts.isVariableDeclaration(parent) && parent.initializer === node && ts.isObjectBindingPattern(parent.name)) return destructuredBindings(ts, parent.name);
+  else if (ts.isBinaryExpression(parent) && parent.right === node && parent.operatorToken.kind === ts.SyntaxKind.EqualsToken
+    && ts.isObjectLiteralExpression(parent.left)) return destructuredBindings(ts, parent.left);
+  else name = indexedNamespaceMember(ts, node);
+  return name === null ? { all: true, pairs: [] } : { all: false, pairs: [{ imported: name, exported: null }] };
+};
+
+const namespaceBindings = (context, declaration, namespace) => {
+  if (context.namespaceUses.has(namespace)) return context.namespaceUses.get(namespace);
+  const { ts } = context;
+  const sourceFile = declaration.getSourceFile();
+  const checker = namespaceChecker(context, sourceFile, namespace);
+  const symbol = checker.getSymbolAtLocation(namespace.name);
+  const result = { all: false, pairs: [] };
+  const visit = node => {
+    if (ts.isJSDocSeeTag(node) || ts.isJSDocLink(node) || ts.isJSDocLinkCode(node) || ts.isJSDocLinkPlain(node)) return;
+    if (ts.isIdentifier(node) && node !== namespace.name && namespaceReference(ts, checker, symbol, node)) {
+      const used = namespaceUse(ts, node);
+      result.all ||= used.all;
+      result.pairs.push(...used.pairs);
+    }
+    if (!result.all) {
+      ts.forEachChild(node, visit);
+      for (const doc of node.jsDoc ?? []) visit(doc);
+    }
+  };
+  // An unavailable binding must never turn an unknown consumer into a false unused-export finding.
+  if (symbol) visit(sourceFile);
+  else result.all = true;
+  context.namespaceUses.set(namespace, result);
+  return result;
+};
+
+const importBindings = (context, declaration) => {
+  const { ts } = context;
+  const clause = declaration.importClause;
+  if (!clause) return { all: false, pairs: [] }; // side-effect import: uses nothing
+  const pairs = [];
+  if (clause.name) pairs.push({ imported: 'default', exported: null });
+  const named = clause.namedBindings;
+  if (named && named.kind === ts.SyntaxKind.NamespaceImport) {
+    const namespace = namespaceBindings(context, declaration, named);
+    return { all: namespace.all, pairs: [...pairs, ...namespace.pairs] };
+  }
+  if (named) for (const element of named.elements) pairs.push({ imported: (element.propertyName ?? element.name).text, exported: null });
+  return { all: false, pairs };
+};
+
+const exportBindings = (ts, declaration) => {
+  const clause = declaration.exportClause;
+  if (!clause || clause.kind === ts.SyntaxKind.NamespaceExport) return { all: true, pairs: [] };
+  return { all: false, pairs: clause.elements.map(element => ({ imported: (element.propertyName ?? element.name).text, exported: element.name.text })) };
+};
+
+const importTypeBindings = (ts, declaration) => {
+  let qualifier = declaration.qualifier;
+  if (!qualifier) return { all: true, pairs: [] };
+  while (qualifier.kind === ts.SyntaxKind.QualifiedName) qualifier = qualifier.left;
+  return { all: false, pairs: [{ imported: qualifier.text, exported: null }] };
+};
+
+/** Names an import/export declaration takes from its target: {all} or {pairs: [{imported, exported}]}. */
+export function bindingsOf(context, declaration) {
+  const { ts } = context;
+  if (!declaration) return { all: true, pairs: [] };
+  if (declaration.kind === ts.SyntaxKind.ImportDeclaration) return importBindings(context, declaration);
+  if (declaration.kind === ts.SyntaxKind.ExportDeclaration) return exportBindings(ts, declaration);
+  if (declaration.kind === ts.SyntaxKind.ImportTypeNode) return importTypeBindings(ts, declaration);
+  // ImportEqualsDeclaration, dynamic import(), require(): the whole module is taken.
+  return { all: true, pairs: [] };
+}

package/runtime/scripts/hfs/architecture/dead-exports.mjs

@@ -17,8 +17,9 @@
  * and contributes no name here.
  *
  * A name is used when a production file outside the owner imports it from the entry (type-only imports count). A
- * namespace import, `import x = require`, a dynamic import()/require(), an `export *` or `export * as` of the entry make
- * every name used. A file outside the owner that re-exports the name (`export { n as m } from`) uses it when `m` is itself
+ * namespace import uses its statically accessed members; a computed read or an escape of the namespace uses every name.
+ * `import x = require`, a dynamic import()/require(), an `export *` or `export * as` of the entry make every name used.
+ * A file outside the owner that re-exports the name (`export { n as m } from`) uses it when `m` is itself
  * used by the importers of that file; a re-exporting file nobody imports is a framework entry (a route file) and uses it.
  * Specs and tests are not in the graph, so an export used only by a spec is dead, on purpose, with these exceptions (unit test
  * standard): the unit spec of every unit role (ruleParams.be.unitRoles: `<name>.service.spec.ts`, `<name>.cli.spec.ts`) and of every logic role
@@ -39,6 +40,7 @@ import path from 'node:path';
 import { treeOf } from './required-files.mjs';
 import { globExpression } from '../../lib/glob.mjs';
 import { stagedConsumerSources } from './staged-consumers.mjs';
+import { bindingsOf } from './dead-exports-bindings.mjs';
 
 export const DEAD_EXPORT_RULE_IDS = ['HFS_UNUSED_EXPORT', 'HFS_UNUSED_FILE'];
 
@@ -70,40 +72,6 @@ function extraEntries(graph, entry) {
   return names.flatMap(name => (name.includes('*') ? matches(name) : [`${found.root}/${name}`].filter(rel => graph.files.has(rel))));
 }
 
-const importBindings = (ts, declaration) => {
-  const clause = declaration.importClause;
-  if (!clause) return { all: false, pairs: [] }; // side-effect import: uses nothing
-  const pairs = [];
-  if (clause.name) pairs.push({ imported: 'default', exported: null });
-  const named = clause.namedBindings;
-  if (named && named.kind === ts.SyntaxKind.NamespaceImport) return { all: true, pairs: [] };
-  if (named) for (const element of named.elements) pairs.push({ imported: (element.propertyName ?? element.name).text, exported: null });
-  return { all: false, pairs };
-};
-
-const exportBindings = (ts, declaration) => {
-  const clause = declaration.exportClause;
-  if (!clause || clause.kind === ts.SyntaxKind.NamespaceExport) return { all: true, pairs: [] };
-  return { all: false, pairs: clause.elements.map(element => ({ imported: (element.propertyName ?? element.name).text, exported: element.name.text })) };
-};
-
-const importTypeBindings = (ts, declaration) => {
-  let qualifier = declaration.qualifier;
-  if (!qualifier) return { all: true, pairs: [] };
-  while (qualifier.kind === ts.SyntaxKind.QualifiedName) qualifier = qualifier.left;
-  return { all: false, pairs: [{ imported: qualifier.text, exported: null }] };
-};
-
-/** Names an import/export declaration takes from its target: {all} or {pairs: [{imported, exported}]}. */
-function bindingsOf(ts, declaration) {
-  if (!declaration) return { all: true, pairs: [] };
-  if (declaration.kind === ts.SyntaxKind.ImportDeclaration) return importBindings(ts, declaration);
-  if (declaration.kind === ts.SyntaxKind.ExportDeclaration) return exportBindings(ts, declaration);
-  if (declaration.kind === ts.SyntaxKind.ImportTypeNode) return importTypeBindings(ts, declaration);
-  // ImportEqualsDeclaration, dynamic import(), require(): the whole module is taken.
-  return { all: true, pairs: [] };
-}
-
 const addExportName = (found, sourceFile, name, node) => {
   if (found.has(name)) return;
   found.set(name, sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1);
@@ -312,7 +280,7 @@ const consumedNames = (context, file, ownerKey, depth, visiting) => {
   const result = { all: false, names: new Set() };
   for (const edge of context.edgesTo.get(file) ?? []) {
     if (ownerKey && unitOfFile(context.graph, edge.from) === ownerKey) continue;
-    const bindings = bindingsOf(context.ts, edge.edge.declaration);
+    const bindings = bindingsOf(context, edge.edge.declaration);
     if (bindings.all) { result.all = true; continue; }
     for (const pair of bindings.pairs) consumeReexportedName(context, result, edge, pair, depth, visiting);
   }
@@ -321,10 +289,10 @@ const consumedNames = (context, file, ownerKey, depth, visiting) => {
 
 /** Adds to `used` the entry exports reached by a consumer outside the owner that imports a file the entry re-exports by name. */
 const addReexportedUses = (context, key, publicEntry, used) => {
-  const { ts, graph } = context;
+  const { graph } = context;
   for (const edge of graph.edges) {
     if (edge.from !== publicEntry || !edge.reexport || graph.unit(edge.to) !== key) continue;
-    const reexport = bindingsOf(ts, edge.edge.declaration);
+    const reexport = bindingsOf(context, edge.edge.declaration);
     const inner = consumedNames(context, edge.to, key, 0, new Set([publicEntry, edge.to]));
     if (reexport.all) continue;
     for (const pair of reexport.pairs) if (inner.all || inner.names.has(pair.imported)) used.names.add(pair.exported);
@@ -342,7 +310,7 @@ const unusedExportViolation = (publicEntry, name, line, owner) => ({
 const addSiblingEntryUses = (context, publicEntry, declared, used) => {
   for (const edge of context.edgesTo.get(publicEntry) ?? []) {
     if (edge.reexport || edge.from === publicEntry || !declared.has(edge.from)) continue;
-    const bindings = bindingsOf(context.ts, edge.edge.declaration);
+    const bindings = bindingsOf(context, edge.edge.declaration);
     if (bindings.all) used.all = true;
     for (const pair of bindings.pairs) used.names.add(pair.imported);
   }
@@ -382,7 +350,7 @@ const ownerExportFindings = (context, config) => {
 
 export function checkDeadExports({ context, graph, config }) {
   const edgesTo = edgeIndex([...graph.edges, ...testConsumerEdges({ context, graph, config })]);
-  const analysis = { ...context, graph, edgesTo };
+  const analysis = { ...context, graph, edgesTo, namespaceCheckers: new WeakMap(), namespaceUses: new WeakMap() };
   const exports = ownerExportFindings(analysis, config);
   const files = deadFiles(graph, config);
   const dead = exports.violations.length;

package/runtime/scripts/hfs/architecture/default-deny.mjs

@@ -2,22 +2,23 @@ import { machineKit } from './machine-ast.mjs';
 
 /**
  * R41 `default-deny-app-guard` (BE_DEFAULT_DENY). Every api app root provides its `APP_GUARD` entries in the order
- * throttler -> CSRF origin guard -> AuthGuard, each exactly once, so no request reaches a handler before it was
- * rate-limited, origin-checked and authenticated. A guard is classified by structure, never by name or folder alone
+ * throttler -> CSRF origin guard -> CredentialGuard -> AuthGuard, each exactly once, so no request reaches a handler before it was
+ * rate-limited, origin-checked, credential-authenticated and admitted. A guard is classified by structure, never by name or folder alone
  * (BE-CONVENTION 1.7 names the roles, not a library):
  *   - throttler: a class of @nestjs/throttler or one that extends it, or a guard that reads through a Reflector the
  *     per-door metadata (the `@RateLimit(tier)` decorator) that a SetMetadata call of its own capability writes;
  *   - CSRF origin guard: a guard declared in platform/http-security that reads the request origin or referer header;
+ *   - CredentialGuard: the `CredentialGuard` class declared in domain/identity;
  *   - AuthGuard: the `AuthGuard` class declared in domain/identity.
  * Other guards are permitted between them; a missing, repeated or reordered one of the three is a finding.
  */
 export const DEFAULT_DENY_RULE_IDS = ['BE_DEFAULT_DENY'];
 
 const RULE = 'BE_DEFAULT_DENY';
-const ORDER = ['throttler', 'csrf', 'auth'];
+const ORDER = ['throttler', 'csrf', 'credential', 'auth'];
 const ORIGIN_HEADERS = new Set(['origin', 'referer', 'referrer']);
 const METADATA_READERS = new Set(['get', 'getAll', 'getAllAndMerge', 'getAllAndOverride']);
-const LABEL = { throttler: 'the throttler guard', csrf: 'the CSRF origin guard of platform/http-security', auth: 'AuthGuard of domain/identity' };
+const LABEL = { throttler: 'the throttler guard', csrf: 'the CSRF origin guard of platform/http-security', credential: 'CredentialGuard of domain/identity', auth: 'AuthGuard of domain/identity' };
 
 const keySymbol = (kit, checker, node) => (node ? kit.aliased(checker, kit.symbolAt(checker, node)) ?? null : null);
 
@@ -98,6 +99,7 @@ const classifyDeclaration = (kit, graph, keyCache, declaration) => {
     if (readsDoorMetadata(kit, graph, keyCache, declaration, owner)) return 'throttler';
   }
   if (owner?.tier === 'domain' && owner.name === 'identity' && ts.isClassDeclaration(declaration) && declaration.name?.text === 'AuthGuard') return 'auth';
+  if (owner?.tier === 'domain' && owner.name === 'identity' && ts.isClassDeclaration(declaration) && declaration.name?.text === 'CredentialGuard') return 'credential';
   return null;
 };
 
@@ -117,7 +119,7 @@ const roleMessages = (app, roles, anchor) => {
   const out = [];
   for (const role of ORDER) {
     const entries = roles.filter(item => item.role === role);
-    if (entries.length === 0) out.push({ node: anchor, message: `App ${app.name} does not provide ${LABEL[role]} as an APP_GUARD; an api app is denied by default: throttler, then CSRF origin guard, then AuthGuard.` });
+    if (entries.length === 0) out.push({ node: anchor, message: `App ${app.name} does not provide ${LABEL[role]} as an APP_GUARD; an api app is denied by default: throttler, then CSRF origin guard, then CredentialGuard, then AuthGuard.` });
     else if (entries.length > 1) out.push({ node: entries[1].guard.node, message: `App ${app.name} provides ${LABEL[role]} more than once as an APP_GUARD.` });
   }
   return out;
@@ -128,7 +130,7 @@ const orderMessages = (app, roles) => {
   if (!indexes.every(index => index >= 0)) return [];
   const out = [];
   for (let i = 1; i < indexes.length; i += 1) {
-    if (indexes[i] < indexes[i - 1]) out.push({ node: roles[indexes[i]].guard.node, message: `App ${app.name} provides ${LABEL[ORDER[i]]} before ${LABEL[ORDER[i - 1]]}; the APP_GUARD order is throttler, CSRF origin guard, AuthGuard.` });
+    if (indexes[i] < indexes[i - 1]) out.push({ node: roles[indexes[i]].guard.node, message: `App ${app.name} provides ${LABEL[ORDER[i]]} before ${LABEL[ORDER[i - 1]]}; the APP_GUARD order is throttler, CSRF origin guard, CredentialGuard, AuthGuard.` });
   }
   return out;
 };

package/runtime/scripts/hfs/architecture/frontend-world.mjs

@@ -74,7 +74,7 @@ class WorldAnalysis {
     let found = false;
     const visit = node => {
       if (!found && this.ts.isCallExpression(node) && this.ts.isIdentifier(node.expression) && node.expression.text === 'fetch'
-        && !checker.getSymbolAtLocation(node.expression)) found = true;
+        && (checker.getSymbolAtLocation(node.expression)?.getDeclarations() ?? []).every(declaration => declaration.getSourceFile().isDeclarationFile)) found = true;
       if (!found) this.ts.forEachChild(node, visit);
     };
     visit(sourceFile);