@starci/eslint-canon-fe 8.3.0 → 8.4.0

package/runtime/scripts/hfs/architecture/source-names.mjs

@@ -1,13 +1,14 @@
 import path from 'node:path';
 import { isInside } from './config.mjs';
 import { relativePath, unwrapExpression } from './typescript.mjs';
-import { commonJsRequireReasons, decoratorCallee, moduleExportsOf, nodeDecorators, normalizedSymbol, normalizedSymbolValue, programSourcesOf, returnedExpressions, selectedNode, valueSymbol, violation } from './ast-walks.mjs';
+import { commonJsRequireReasons, constructedDecoratorKind, decoratorCallee, moduleExportsOf, mutableDecoratorKind, nodeDecorators, normalizedSymbol, normalizedSymbolValue, programSourcesOf, returnedExpressions, selectedNode, valueSymbol, violation } from './ast-walks.mjs';
 import { createBackendSourceShapeChecker } from './source-names-shape.mjs';
+import { byCodeUnit } from '../../lib/list.mjs';
 
 const SOURCE_LAYOUT_RULE_ID = 'BE_FEATURE_LAYOUT_INVALID';
 const SOURCE_NAME_RULE_ID = 'BE_SOURCE_FORM';
 const FRAMEWORK_EXPORTS = new Map([
-  ['@nestjs/graphql', new Set(['Args', 'ArgsType', 'InputType', 'Mutation', 'ObjectType', 'Query', 'registerEnumType'])],
+  ['@nestjs/graphql', new Set(['Args', 'ArgsType', 'InputType', 'Mutation', 'ObjectType', 'Query', 'Subscription', 'registerEnumType'])],
   ['typeorm', new Set(['Entity', 'EntitySchema', 'MigrationInterface', 'ViewEntity'])],
 ]);
 const APPLICATION_ROLES = new Set(['command', 'contracts', 'handler', 'query']);
@@ -237,6 +238,11 @@ function graphqlField({ config, context, sourceFile, node, decorator, kind, nami
   }
   const methodName = node.name && (context.ts.isIdentifier(node.name) || context.ts.isStringLiteralLike(node.name)) ? node.name.text : null;
   const name = selected.status === 'literal' ? selected.value : methodName;
+  if (selected.status === 'literal') {
+    if (!methodName) namingReasons.push(`${relativePath(config.root, sourceFile.fileName)} cannot prove the @${kind} method name`);
+    else if (selected.value !== methodName) violations.push(violation(config, sourceFile, selected.node, SOURCE_NAME_RULE_ID,
+      `GraphQL @${kind} field name ${selected.value} must equal its method name ${methodName}.`));
+  }
   if (!name) namingReasons.push(`${relativePath(config.root, sourceFile.fileName)} cannot prove the @${kind} field name`);
   else if (!camelCase(name)) violations.push(violation(config, sourceFile, selected.node ?? node.name ?? node, SOURCE_NAME_RULE_ID,
     `GraphQL field name ${name} must be camelCase.`));
@@ -316,7 +322,46 @@ const checkBackendSourceShapeImpl = createBackendSourceShapeChecker({
   TRACE_NEW,
 });
 
+function inspectSubscriptionSource({ config, context, sourceFile, checker, framework, configuredRoot, namingReasons, violations }) {
+  const visit = node => {
+    for (const decorator of nodeDecorators(context.ts, node)) {
+      const kind = decoratorKind(context.ts, checker, decorator, framework.bySymbol);
+      if (kind === 'Subscription') graphqlField({ config, context, sourceFile, node, decorator, kind, namingReasons, violations });
+      else if (!kind && !configuredRoot) {
+        const dynamic = mutableDecoratorKind(context.ts, checker, decorator, framework.bySymbol)
+          ?? constructedDecoratorKind(context.ts, checker, decorator, framework.bySymbol, TRACE_NEW);
+        if (['Subscription', 'multiple framework', 'unproven framework'].includes(dynamic)) {
+          namingReasons.push(`${relativePath(config.root, sourceFile.fileName)} uses a mutable or constructed ${dynamic} decorator identity`);
+        }
+      }
+    }
+    context.ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+}
+
 export function checkBackendSourceShape(config, context) {
-  return checkBackendSourceShapeImpl(config, context);
+  const result = checkBackendSourceShapeImpl(config, context);
+  const roots = absoluteRoots(config.root, [...config.backend.features, ...config.backend.modules]);
+  const localFiles = new Set(context.files.map(file => canonical(file.fileName)));
+  const frameworkByChecker = new Map();
+  const namingReasons = [];
+  // The shared shape walk dispatches Query and Mutation; subscriptions use the same naming relation here.
+  for (const sourceFile of context.files) {
+    const fileName = canonical(sourceFile.fileName);
+    const configuredRoot = locatedRoot(roots, fileName);
+    const owner = config.hfs?.ownerOf?.(relativePath(config.root, fileName));
+    const slot = owner ? config.hfs.slot(owner.slot) : null;
+    if (!configuredRoot && !(slot?.tier === 'feature' && slot.profiles?.includes('be'))) continue;
+    const checker = context.checkerFor(fileName);
+    if (!frameworkByChecker.has(checker)) frameworkByChecker.set(checker, frameworkTargets(config, context, checker, localFiles));
+    const framework = frameworkByChecker.get(checker);
+    inspectSubscriptionSource({ config, context, sourceFile, checker, framework, configuredRoot, namingReasons, violations: result.violations });
+  }
+  if (namingReasons.length) result.coverage.naming = {
+    status: 'unavailable', reason: 'one or more backend source naming relations are not statically proved',
+    details: [...new Set([...(result.coverage.naming.details ?? []), ...namingReasons])].sort(byCodeUnit),
+  };
+  return result;
 }
 export { SOURCE_LAYOUT_RULE_ID, SOURCE_NAME_RULE_ID };

package/runtime/scripts/hfs/architecture/supabase-ast.mjs

@@ -1,8 +1,10 @@
 // supabase-ast.mjs - shared TypeScript-symbol and expression helpers for the front-end and back-end Supabase
 // architecture checks. Recognition follows imported declarations and inferred types, never local spelling alone.
 import { unwrapExpression } from '../../lib/ts-analysis.mjs';
+import { accessName as memberName, hasAnyFlag } from '../../lib/ts-ast.mjs';
+export { accessName as memberName } from '../../lib/ts-ast.mjs';
 
-export const SUPABASE_MODULES = new Set(['@supabase/ssr', '@supabase/supabase-js']);
+export const SUPABASE_MODULES = Object.freeze({ has: name => typeof name === 'string' && name.startsWith('@supabase/') });
 
 export const moduleNameOf = (ts, node) => {
   if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) return node.moduleSpecifier.text;
@@ -17,7 +19,7 @@ export const importedFrom = (kit, checker, node, modules, names = null) => {
   return Boolean(binding && modules.has(binding.module) && (names === null || names.has(binding.name)));
 };
 
-const declarationFromSupabase = (declaration) => /(?:^|\/)node_modules\/@supabase\/(?:ssr|supabase-js|auth-js|postgrest-js|storage-js)(?:\/|$)/u
+const declarationFromSupabase = (declaration) => /(?:^|\/)node_modules\/@supabase\/[^/]+(?:\/|$)/u
   .test(String(declaration?.getSourceFile?.().fileName ?? '').replaceAll('\\', '/'));
 
 const typeFromSupabase = (checker, node) => {
@@ -50,23 +52,19 @@ const isSupabaseValue = (kit, checker, node) => {
   return typeFromSupabase(checker, current);
 };
 
-export const callName = (ts, call) => ts.isCallExpression(call) && ts.isPropertyAccessExpression(call.expression) ? call.expression.name.text : null;
+export const callName = (ts, call) => ts.isCallExpression(call) ? memberName(ts, call.expression) : null;
 
 export const chainParts = (ts, expression) => {
   const names = [];
   let current = unwrap(ts, expression);
   while (current) {
     if (ts.isCallExpression(current)) {
-      if (ts.isPropertyAccessExpression(current.expression)) {
-        names.unshift(current.expression.name.text);
-        current = unwrap(ts, current.expression.expression);
-        continue;
-      }
       current = unwrap(ts, current.expression);
       continue;
     }
-    if (ts.isPropertyAccessExpression(current)) {
-      names.unshift(current.name.text);
+    if (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+      const name = memberName(ts, current);
+      if (name) names.unshift(name);
       current = unwrap(ts, current.expression);
       continue;
     }
@@ -76,7 +74,47 @@ export const chainParts = (ts, expression) => {
 };
 
 export const isSupabaseCall = (kit, checker, node) => kit.ts.isCallExpression(node)
-  && (signatureFromSupabase(checker, node) || isSupabaseValue(kit, checker, kit.ts.isPropertyAccessExpression(node.expression) ? node.expression.expression : node.expression));
+  && (signatureFromSupabase(checker, node) || isSupabaseValue(kit, checker,
+    kit.ts.isPropertyAccessExpression(node.expression) || kit.ts.isElementAccessExpression(node.expression) ? node.expression.expression : node.expression));
+
+const authStorageValue = (kit, checker, expression, seen = new Set()) => {
+  const current = unwrap(kit.ts, expression);
+  if (!current || seen.has(current)) return false;
+  seen.add(current);
+  if (['auth', 'storage'].includes(memberName(kit.ts, current)) && isSupabaseValue(kit, checker, current.expression)) return true;
+  if (checker.getTypeAtLocation(current).symbol?.declarations?.some(declaration =>
+    /\/node_modules\/@supabase\/(?:storage-js|auth-js)\//u.test(String(declaration.getSourceFile().fileName).replaceAll('\\', '/')))) return true;
+  if (!kit.ts.isIdentifier(current)) return false;
+  return kit.declarationsOf(checker, current).some(declaration =>
+    (kit.ts.isVariableDeclaration(declaration) || kit.ts.isPropertyDeclaration(declaration)) && declaration.initializer
+    && authStorageValue(kit, checker, declaration.initializer, seen));
+};
+
+const chainAccesses = (ts, node) => {
+  const accesses = [];
+  let current = unwrap(ts, node);
+  while (current) {
+    if (ts.isCallExpression(current)) current = unwrap(ts, current.expression);
+    else if (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+      accesses.unshift(current);
+      current = unwrap(ts, current.expression);
+    } else break;
+  }
+  return accesses;
+};
+
+/** The first forbidden SDK access in a call chain, anchored once even when more methods follow it. */
+export const supabaseDataAccess = (kit, checker, node, members, { storageAllowed = false } = {}) => {
+  for (const access of chainAccesses(kit.ts, node)) {
+    const name = memberName(kit.ts, access);
+    if (storageAllowed && (name === 'storage' || name === 'auth')) return null;
+    if (members.has(name) && isSupabaseValue(kit, checker, access.expression)) {
+      if (storageAllowed && authStorageValue(kit, checker, access.expression)) return null;
+      return { name, node: access };
+    }
+  }
+  return null;
+};
 
 export const isDatabaseType = (ts, node) => {
   if (!node) return false;
@@ -106,3 +144,165 @@ export const contextTypesClient = (kit, checker, call) => {
 export const reportAt = (violations, kit, ruleId, file, node, message, extra = {}) => {
   violations.push({ ruleId, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
 };
+
+const declarationsOf = (ts, checker, node) => {
+  const target = ts.isPropertyAccessExpression(node) ? node.name : node;
+  // A shorthand property (`issuer,`) names the variable it reads, not the property it creates.
+  let symbol = ts.isShorthandPropertyAssignment(target.parent ?? {}) && target.parent.name === target
+    ? checker.getShorthandAssignmentValueSymbol(target.parent)
+    : checker.getSymbolAtLocation(target);
+  if (symbol && hasAnyFlag(symbol.flags, ts.SymbolFlags.Alias)) symbol = checker.getAliasedSymbol(symbol);
+  return symbol?.declarations ?? [];
+};
+
+const configType = (checker, node) => {
+  const type = checker.getTypeAtLocation(node);
+  return [type.symbol, type.aliasSymbol].some(symbol => symbol?.declarations?.some(declaration =>
+    /(?:\.config|\.options|\.env)\.ts$|\/modules\/config\/|\/node_modules\/@nestjs\/config\//u.test(String(declaration.getSourceFile().fileName).replaceAll('\\', '/'))
+    || /(?:Config|Options|Env)$/u.test(symbol.name)));
+};
+
+/** Trace issuer construction through configuration values and local URL/string transformations. */
+const issuerFromConfig = (ts, checker, expression, seen = new Set()) => {
+  const node = unwrap(ts, expression);
+  if (!node || seen.has(node)) return false;
+  const next = new Set(seen).add(node);
+  if (ts.isIdentifier(node)) {
+    return declarationsOf(ts, checker, node).some(declaration => {
+      if (ts.isVariableDeclaration(declaration) && declaration.initializer) return issuerFromConfig(ts, checker, declaration.initializer, next);
+      if (ts.isParameter(declaration) || ts.isPropertyDeclaration(declaration)) return configType(checker, node);
+      return /(?:\.config|\.env)\.ts$|\/modules\/config\//u.test(String(declaration.getSourceFile().fileName).replaceAll('\\', '/'));
+    });
+  }
+  if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
+    return issuerFromConfig(ts, checker, node.expression, next) || declarationsOf(ts, checker, node).some(declaration =>
+      (ts.isParameter(declaration) || ts.isPropertyDeclaration(declaration)) && !declaration.initializer && configType(checker, node));
+  }
+  if (ts.isTemplateExpression(node)) return node.templateSpans.some(span => issuerFromConfig(ts, checker, span.expression, next));
+  if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+    return issuerFromConfig(ts, checker, node.left, next) || issuerFromConfig(ts, checker, node.right, next);
+  }
+  if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
+    return issuerFromConfig(ts, checker, node.expression, next) || node.arguments?.some(argument => issuerFromConfig(ts, checker, argument, next));
+  }
+  return false;
+};
+
+const objectValue = (ts, checker, expression) => {
+  const node = unwrap(ts, expression);
+  if (!node) return null;
+  if (ts.isObjectLiteralExpression(node)) return node;
+  if (!ts.isIdentifier(node)) return null;
+  return declarationsOf(ts, checker, node).find(declaration => ts.isVariableDeclaration(declaration)
+    && declaration.initializer && ts.isObjectLiteralExpression(unwrap(ts, declaration.initializer)))?.initializer ?? null;
+};
+
+const literalString = (ts, checker, expression) => {
+  const node = unwrap(ts, expression);
+  if (!node) return null;
+  if (ts.isStringLiteralLike(node)) return node.text;
+  const type = checker.getTypeAtLocation(node);
+  return type.isStringLiteral?.() ? type.value : null;
+};
+
+/** A role read must belong to the payload produced by this verification, including destructuring aliases. */
+const verifiedPayload = (ts, checker, expression, call, seen = new Set()) => {
+  const node = unwrap(ts, expression);
+  if (!node || seen.has(node)) return false;
+  const next = new Set(seen).add(node);
+  if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && memberName(ts, node) === 'payload') {
+    const value = unwrap(ts, node.expression);
+    if (value === call) return true;
+    if (ts.isIdentifier(value)) return declarationsOf(ts, checker, value).some(declaration =>
+      ts.isVariableDeclaration(declaration) && unwrap(ts, declaration.initializer) === call);
+  }
+  if (!ts.isIdentifier(node)) return false;
+  return declarationsOf(ts, checker, node).some(declaration => {
+    if (ts.isVariableDeclaration(declaration)) return declaration.initializer && verifiedPayload(ts, checker, declaration.initializer, call, next);
+    if (!ts.isBindingElement(declaration) || (declaration.propertyName ?? declaration.name).getText() !== 'payload') return false;
+    return unwrap(ts, declaration.parent.parent.initializer) === call;
+  });
+};
+
+const rejects = (ts, statement) => {
+  if (ts.isBlock(statement)) {
+    const exit = statement.statements.find(item => ts.isThrowStatement(item) || ts.isReturnStatement(item));
+    return Boolean(exit && rejects(ts, exit));
+  }
+  if (ts.isThrowStatement(statement)) return true;
+  if (!ts.isReturnStatement(statement)) return false;
+  const value = statement.expression && unwrap(ts, statement.expression);
+  return !value || value.kind === ts.SyntaxKind.NullKeyword || value.kind === ts.SyntaxKind.FalseKeyword
+    || (ts.isCallExpression(value) && /^(?:refused|err|fail|failure)$/u.test(value.expression.getText()));
+};
+
+const roleCondition = (ts, checker, condition, call, equality = false) => {
+  const node = unwrap(ts, condition);
+  if (!node || !ts.isBinaryExpression(node)) return false;
+  const combined = equality ? ts.SyntaxKind.AmpersandAmpersandToken : ts.SyntaxKind.BarBarToken;
+  if (node.operatorToken.kind === combined) return roleCondition(ts, checker, node.left, call, equality) || roleCondition(ts, checker, node.right, call, equality);
+  const operators = equality ? [ts.SyntaxKind.EqualsEqualsEqualsToken, ts.SyntaxKind.EqualsEqualsToken]
+    : [ts.SyntaxKind.ExclamationEqualsEqualsToken, ts.SyntaxKind.ExclamationEqualsToken];
+  if (!operators.includes(node.operatorToken.kind)) return false;
+  const role = expression => (ts.isPropertyAccessExpression(expression) || ts.isElementAccessExpression(expression))
+    && memberName(ts, expression) === 'role' && verifiedPayload(ts, checker, expression.expression, call);
+  return (role(node.left) && literalString(ts, checker, node.right) === 'authenticated')
+    || (role(node.right) && literalString(ts, checker, node.left) === 'authenticated');
+};
+
+const returnsPrincipal = (ts, statement) => {
+  let accepted = false;
+  const visit = node => {
+    if (ts.isFunctionLike(node)) return;
+    if (ts.isReturnStatement(node) && !rejects(ts, node)) accepted = true;
+    ts.forEachChild(node, visit);
+  };
+  visit(statement);
+  return accepted;
+};
+
+const statementsAfterVerify = (ts, call) => {
+  let statement = call;
+  while (statement.parent && !ts.isBlock(statement.parent)) statement = statement.parent;
+  const block = statement.parent;
+  if (!block || !ts.isBlock(block)) return [];
+  return block.statements.slice(block.statements.indexOf(statement) + 1);
+};
+
+const rejectsRoleGuard = (ts, checker, statement, call) => {
+  if (!ts.isIfStatement(statement)) return false;
+  if (roleCondition(ts, checker, statement.expression, call) && rejects(ts, statement.thenStatement)) return true;
+  return Boolean(statement.elseStatement && roleCondition(ts, checker, statement.expression, call, true) && rejects(ts, statement.elseStatement));
+};
+
+const rejectsOtherRoles = (ts, checker, call) => {
+  for (const item of statementsAfterVerify(ts, call)) {
+    if (ts.isReturnStatement(item) || ts.isThrowStatement(item)) return false;
+    if (rejectsRoleGuard(ts, checker, item, call)) return true;
+    if (returnsPrincipal(ts, item)) return false;
+  }
+  return false;
+};
+
+/** R260 is shared by the architecture machine and the published typed ESLint rule. */
+export const jwtPolicyProblems = (ts, checker, call) => {
+  const problems = [];
+  const options = objectValue(ts, checker, call.arguments[2]);
+  const property = name => options?.properties.findLast(entry =>
+    (ts.isPropertyAssignment(entry) || ts.isShorthandPropertyAssignment(entry))
+    && (ts.isIdentifier(entry.name) || ts.isStringLiteralLike(entry.name)) && entry.name.text === name);
+  const value = name => {
+    const entry = property(name);
+    return entry && unwrap(ts, ts.isPropertyAssignment(entry) ? entry.initializer : entry.name);
+  };
+  const algorithms = value('algorithms');
+  const secure = new Set(['ES256', 'RS256', 'EdDSA']);
+  if (!algorithms || !ts.isArrayLiteralExpression(algorithms) || !algorithms.elements.length
+    || algorithms.elements.some(item => !ts.isStringLiteralLike(item) || !secure.has(item.text))
+    || options?.properties.some(entry => ts.isSpreadAssignment(entry))) {
+    problems.push('BE_JWT_ALG_PINNED: algorithms must be a non-empty literal subset of ES256, RS256 and EdDSA.');
+  }
+  if (!issuerFromConfig(ts, checker, value('issuer'))) problems.push('BE_JWT_ALG_PINNED: issuer must derive from typed configuration.');
+  if (!rejectsOtherRoles(ts, checker, call)) problems.push('BE_JWT_ALG_PINNED: the verified principal must reject every role other than authenticated before returning it.');
+  return problems;
+};

package/runtime/scripts/hfs/architecture/supabase-be.mjs

@@ -3,7 +3,7 @@
 import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
 import { importedFrom, reportAt, unwrap } from './supabase-ast.mjs';
-import { accessName } from './backend-app-files.mjs';
+import { accessName } from '../../lib/ts-ast.mjs';
 
 const BE_SUPABASE_SLOT = 'be.integrations.supabase';
 const BE_JWT_VERIFIED = 'BE_SUPABASE_JWT_VERIFIED';

package/runtime/scripts/hfs/architecture/supabase.mjs

@@ -1,15 +1,15 @@
 import { machineKit } from './machine-ast.mjs';
-import { callName, chainParts, contextTypesClient, isDatabaseType, isSupabaseCall, moduleNameOf, reportAt, supabaseClientType, SUPABASE_MODULES } from './supabase-ast.mjs';
+import { callName, chainParts, contextTypesClient, isDatabaseType, isSupabaseCall, jwtPolicyProblems, moduleNameOf, reportAt, supabaseClientType, supabaseDataAccess, SUPABASE_MODULES } from './supabase-ast.mjs';
 import { checkBackendJwt } from './supabase-be.mjs';
 
 /**
- * L10-L16, the slot-driven Supabase machine. On the back end Supabase is one data transport with one owner,
+ * L10-L16, the slot-driven Supabase machine. On the back end Supabase provides Auth/Storage with one owner,
  * `be.integrations.supabase`. On the front end Supabase is auth only (owner ruling 2026-10-13): `fe.modules.auth` is the one
  * importer of `@supabase/*` and calls only the auth API; data, storage, rpc and realtime go through the back end (modules/api).
  * The checks below recognise provider calls and types by their imported package declarations, not by local variable or type names.
  */
 export const FRONTEND_SUPABASE_RULE_IDS = Object.freeze(['FE_SUPABASE_CLIENT_OWNER', 'FE_SERVICE_ROLE_FORBIDDEN']);
-export const BACKEND_SUPABASE_RULE_IDS = Object.freeze(['BE_SUPABASE_CLIENT_OWNER', 'BE_SUPABASE_JWT_VERIFIED']);
+export const BACKEND_SUPABASE_RULE_IDS = Object.freeze(['BE_SUPABASE_CLIENT_OWNER', 'BE_SUPABASE_JWT_VERIFIED', 'BE_JWT_ALG_PINNED']);
 
 const FE_CLIENT_OWNER = 'FE_SUPABASE_CLIENT_OWNER';
 const BE_CLIENT_OWNER = 'BE_SUPABASE_CLIENT_OWNER';
@@ -19,7 +19,7 @@ const FE_AUTH_SLOT = 'fe.modules.auth';
 /** The front-end provider slot: enabled exactly when a connection declares provider supabase. */
 const FE_SUPABASE_PROVIDER_SLOT = 'fe.route.callback';
 const FE_CONFIG_SLOT = 'fe.modules.config';
-const SUPABASE_CALLS = new Set(['from', 'rpc']);
+const BE_DATA_MEMBERS = new Set(['from', 'rpc', 'schema', 'functions', 'channel', 'realtime', 'getChannels', 'removeChannel', 'removeAllChannels']);
 /** The members of a Supabase client that read or write data, files or channels: never called from the front end. */
 const FE_DATA_MEMBERS = new Set(['from', 'rpc', 'schema', 'storage', 'functions', 'realtime', 'channel', 'getChannels', 'removeChannel', 'removeAllChannels']);
 const supabaseSlotEnabled = (input, slotId) => {
@@ -55,12 +55,21 @@ function inspectClientFactoryCall(scope, node) {
 }
 
 function inspectProviderCall(scope, node) {
-  const { kit, checker, file, slots, ruleId, violations, counters } = scope;
+  const { kit, checker, file, slots, ruleId, violations, counters, reportedData } = scope;
   const { ts } = kit;
+  const data = supabaseDataAccess(kit, checker, node, BE_DATA_MEMBERS, { storageAllowed: true });
+  if (data) {
+    if (!reportedData.has(data.node.pos)) {
+      reportedData.add(data.node.pos);
+      reportAt(violations, kit, ruleId, file, data.node, `A Supabase .${data.name} data call is made from ${file.slot ?? 'an unowned path'}; the back-end SDK is Auth/Storage only, including inside ${BE_SUPABASE_SLOT}. Data uses EntityManager as app_be.`, { member: data.name, slot: file.slot ?? null });
+    }
+    if (ts.isCallExpression(node)) counters.calls += 1;
+    return;
+  }
   if (!isSupabaseCall(kit, checker, node)) return;
   const properties = chainParts(ts, node);
   const method = callName(ts, node);
-  if (!SUPABASE_CALLS.has(method) && !properties.includes('auth') && !properties.includes('storage')) return;
+  if (!properties.includes('auth') && !properties.includes('storage')) return;
   counters.calls += 1;
   if (!slots.has(file.slot)) reportAt(violations, kit, ruleId, file, node, `A Supabase ${method ?? 'client'} call is made from ${file.slot ?? 'an unowned path'}; database, auth and storage calls belong only to ${[...slots].join(' or ')}.`, { method, slot: file.slot ?? null });
 }
@@ -68,8 +77,9 @@ function inspectProviderCall(scope, node) {
 function inspectOwnershipNode(scope, node) {
   inspectSupabaseImport(scope, node);
   inspectClientTypeReference(scope, node);
-  if (!scope.kit.ts.isCallExpression(node)) return;
-  inspectClientFactoryCall(scope, node);
+  const { ts } = scope.kit;
+  if (!ts.isCallExpression(node) && !ts.isPropertyAccessExpression(node) && !ts.isElementAccessExpression(node)) return;
+  if (ts.isCallExpression(node)) inspectClientFactoryCall(scope, node);
   inspectProviderCall(scope, node);
 }
 
@@ -79,7 +89,7 @@ function checkClientOwnership(input, { slots, ruleId }) {
   const counters = { imports: 0, clients: 0, calls: 0 };
   for (const file of input.graph.files.values()) {
     const checker = kit.checkerOf(file.sourceFile);
-    const scope = { kit, checker, file, slots, ruleId, violations, counters };
+    const scope = { kit, checker, file, slots, ruleId, violations, counters, reportedData: new Set() };
     kit.walk(file.sourceFile, node => inspectOwnershipNode(scope, node));
   }
   return { violations, coverage: { status: 'checked', ...counters, ownerSlots: [...slots] } };
@@ -138,7 +148,7 @@ function checkFrontendSecretNames(input) {
 }
 
 function inspectFrontendNode(scope, node) {
-  const { kit, checker, file, violations, counters } = scope;
+  const { kit, checker, file, violations, counters, reportedData } = scope;
   const { ts } = kit;
   const moduleName = moduleNameOf(ts, node);
   if (moduleName?.startsWith('@supabase/')) {
@@ -146,14 +156,19 @@ function inspectFrontendNode(scope, node) {
     if (file.slot !== FE_AUTH_SLOT) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `${moduleName} is imported by ${file.rel}, whose slot is ${file.slot ?? 'unowned'}; on the front end Supabase is auth only and ${FE_AUTH_SLOT} (modules/auth) is its one importer.`, { module: moduleName, slot: file.slot ?? null });
     return;
   }
-  if (!ts.isCallExpression(node) || !isSupabaseCall(kit, checker, node)) return;
+  if (!ts.isCallExpression(node) && !ts.isPropertyAccessExpression(node) && !ts.isElementAccessExpression(node)) return;
+  const data = supabaseDataAccess(kit, checker, node, FE_DATA_MEMBERS);
+  if (data) {
+    if (!reportedData.has(data.node.pos)) {
+      reportedData.add(data.node.pos);
+      reportAt(violations, kit, FE_CLIENT_OWNER, file, data.node, `A Supabase .${data.name} call is made from the front end; Supabase on the front end is auth only - read and write data, files and realtime through the back end (a modules/api GraphQL operation, an SWR hook, hooks/socketio).`, { member: data.name, slot: file.slot ?? null });
+    }
+    return;
+  }
+  if (!isSupabaseCall(kit, checker, node)) return;
   counters.calls += 1;
-  const member = callName(ts, node);
   const parts = chainParts(ts, node);
-  let data = null;
-  if (FE_DATA_MEMBERS.has(member)) data = parts.find(name => FE_DATA_MEMBERS.has(name)) ?? member;
-  if (data) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase .${data} call is made from the front end; Supabase on the front end is auth only - read and write data, files and realtime through the back end (a modules/api GraphQL operation, an SWR hook, hooks/socketio).`, { member: data, slot: file.slot ?? null });
-  else if (file.slot !== FE_AUTH_SLOT && parts.includes('auth')) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase auth call is made from ${file.slot ?? 'an unowned path'}; the auth client is called only inside ${FE_AUTH_SLOT}, which exports the session and the access token.`, { slot: file.slot ?? null });
+  if (file.slot !== FE_AUTH_SLOT && parts.includes('auth')) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase auth call is made from ${file.slot ?? 'an unowned path'}; the auth client is called only inside ${FE_AUTH_SLOT}, which exports the session and the access token.`, { slot: file.slot ?? null });
 }
 
 function checkFrontendClientOwner(input) {
@@ -161,15 +176,18 @@ function checkFrontendClientOwner(input) {
   const violations = [];
   const counters = { imports: 0, calls: 0 };
   for (const file of input.graph.files.values()) {
-    const scope = { kit, checker: kit.checkerOf(file.sourceFile), file, violations, counters };
+    const scope = { kit, checker: kit.checkerOf(file.sourceFile), file, violations, counters, reportedData: new Set() };
     kit.walk(file.sourceFile, node => inspectFrontendNode(scope, node));
   }
   return { violations, coverage: { status: 'checked', ...counters, ownerSlots: [FE_AUTH_SLOT] } };
 }
 
 export function checkFrontendSupabase(input) {
-  if (!supabaseSlotEnabled(input, FE_SUPABASE_PROVIDER_SLOT)) return { violations: [], coverage: { status: 'not-applicable', reason: 'no connection declares provider supabase' } };
   const owner = checkFrontendClientOwner(input);
+  if (!supabaseSlotEnabled(input, FE_SUPABASE_PROVIDER_SLOT)) return {
+    violations: owner.violations,
+    coverage: { status: owner.coverage.imports || owner.coverage.calls || owner.violations.length ? 'checked' : 'not-applicable', owner: owner.coverage, reason: 'no connection declares provider supabase; SDK ownership is still checked' },
+  };
   const secrets = checkFrontendSecretNames(input);
   return {
     violations: [...owner.violations, ...secrets.violations],
@@ -178,11 +196,31 @@ export function checkFrontendSupabase(input) {
 }
 
 export function checkBackendSupabase(input) {
-  if (!supabaseSlotEnabled(input, BE_SUPABASE_SLOT)) return { violations: [], coverage: { status: 'not-applicable', reason: 'the Supabase back-end integration slot is not enabled' } };
   const owner = checkClientOwnership(input, { slots: new Set([BE_SUPABASE_SLOT]), ruleId: BE_CLIENT_OWNER });
+  if (!supabaseSlotEnabled(input, BE_SUPABASE_SLOT)) return {
+    violations: owner.violations,
+    coverage: { status: owner.coverage.imports || owner.coverage.calls || owner.violations.length ? 'checked' : 'not-applicable', owner: owner.coverage, reason: 'the Supabase integration slot is disabled; SDK ownership is still checked' },
+  };
   const jwt = checkBackendJwt(input);
+  const policy = checkJwtPolicy(input);
   return {
-    violations: [...owner.violations, ...jwt.violations],
-    coverage: { status: 'checked', owner: owner.coverage, jwt: jwt.coverage },
+    violations: [...owner.violations, ...jwt.violations, ...policy.violations],
+    coverage: { status: 'checked', owner: owner.coverage, jwt: jwt.coverage, jwtPolicy: policy.coverage },
   };
 }
+
+export function checkJwtPolicy(input) {
+  const kit = machineKit(input);
+  const violations = [];
+  let verifyCalls = 0;
+  for (const file of input.graph.files.values()) {
+    const checker = kit.checkerOf(file.sourceFile);
+    kit.walk(file.sourceFile, node => {
+      if (!kit.ts.isCallExpression(node) || !kit.isImportOf(checker, node.expression, 'jwtVerify', 'jose')) return;
+      verifyCalls += 1;
+      const problems = jwtPolicyProblems(kit.ts, checker, node);
+      if (problems.length) reportAt(violations, kit, 'BE_JWT_ALG_PINNED', file, node, problems.join(' '));
+    });
+  }
+  return { violations, coverage: { status: 'checked', verifyCalls } };
+}

package/runtime/scripts/hfs/architecture/surface.mjs

@@ -64,7 +64,8 @@ export const LINT_ENFORCERS = Object.freeze([
   enforcer('public-contract-form', BE, ['BE_PUBLIC_CONTRACT_FORM'], 'A public signature is typed by a named contract, never inline or untyped.'),
   enforcer('frontend-source-layout', FE, ['FE_SOURCE_LAYOUT_INVALID'], 'A front-end source file sits in a tier folder.'),
   enforcer('component-purity', FE, ['FE_COMPONENT_WORLD_OWNERSHIP', 'FE_WORLD_OWNER_RENDER_BOUNDARY', 'FE_CONNECTED_BLOCK_RENDER_PAIR', 'FE_PURE_REACHES_DATA', 'FE_PURE_WORLD_HOOK', 'FE_PURE_WORLD_IMPORT'], 'A pure component reaches no data or world state; its connected entry owns them.'),
-  enforcer('grammar-entry', FE, ['ARCH_GRAMMAR_CONTRACT_INVALID', 'ARCH_GRAMMAR_EXPORT_BYPASS'], 'Vendor grammar is reached only through its owner entry.'),
+  // Package-manifest contract findings stay with app check; only source import bypasses belong to lint.
+  enforcer('grammar-entry', FE, ['ARCH_GRAMMAR_EXPORT_BYPASS'], 'Vendor grammar is reached only through its owner entry.'),
   enforcer('i18n-keys', FE, ['FE_I18N_KEYS'], 'Translation keys read by source and keys held by catalogs agree both ways.'),
   // The per-path judgements of the slot manifest (scripts/hfs/path-findings.mjs), on a tracked TypeScript file.
   enforcer('slot-undeclared', BOTH, ['HFS_SLOT_UNDECLARED', 'HFS_SLOT_AMBIGUOUS', 'HFS_SLOT_NOT_ENABLED'], 'A TypeScript file is owned by exactly one slot of the repository.', { origin: 'repo' }),

package/runtime/scripts/hfs/architecture/tiers.mjs

@@ -7,12 +7,12 @@ import { byCodeUnit } from '../../lib/list.mjs';
  *      is the one direction with its own code (BE_FEATURE_IMPORTS_FEATURE, R28), never BE_TIER_DIRECTION, and a feature of one trigger
  *      kind (slot field `trigger`: api, webhooks, realtime, saga, reactors, jobs, cli) importing a feature of another is
  *      BE_KIND_ISOLATION, whose fix is the event bus,
- *      an app never imports another app (FE_APP_ISOLATION), and a component layer imports only the layers after it;
+ *      an app never imports another app (BE_SERVICE_ISOLATION / FE_APP_ISOLATION), and a component layer imports only the layers after it;
  *   2. owner cycles: a strongly connected component of the owner graph, type-only imports included (ARCH_OWNER_CYCLE),
  *      reported with the cycle path and the import that closes each hop.
  * Importing inside one owner is always allowed; the public-entry rule stays with owners.mjs (ARCH_OWNER_EXPORT_BYPASS).
  */
-export const TIER_RULE_IDS = ['BE_TIER_DIRECTION', 'BE_FEATURE_IMPORTS_FEATURE', 'BE_KIND_ISOLATION', 'FE_TIER_DIRECTION', 'FE_APP_ISOLATION', 'ARCH_OWNER_CYCLE'];
+export const TIER_RULE_IDS = ['BE_TIER_DIRECTION', 'BE_FEATURE_IMPORTS_FEATURE', 'BE_KIND_ISOLATION', 'BE_SERVICE_ISOLATION', 'FE_TIER_DIRECTION', 'FE_APP_ISOLATION', 'ARCH_OWNER_CYCLE'];
 
 function tierDirectionText({ fromTier, toTier, mayImport, kindRestriction, fromKind, toKind }) {
   if (!kindRestriction) return `a ${fromTier} may import only ${mayImport.join(', ') || 'nothing'}; it imports a ${toTier}`;
@@ -118,7 +118,7 @@ function reportReasonedTierViolation(graph, edge, verdict, tierRule, counts, vio
   let ruleId = tierRule;
   if (featureToFeature) ruleId = 'BE_FEATURE_IMPORTS_FEATURE';
   if (crossKind) ruleId = 'BE_KIND_ISOLATION';
-  if (verdict.reason === 'crossApp') ruleId = 'FE_APP_ISOLATION';
+  if (verdict.reason === 'crossApp') ruleId = graph.profile === 'be' ? 'BE_SERVICE_ISOLATION' : 'FE_APP_ISOLATION';
   const typeOnly = edge.runtime ? '' : ' (type-only imports count)';
   const message = crossKind
     ? `${edge.from} -> ${edge.to}: a ${fromKind} feature imports a ${toKind} feature; no kind imports another, every cross-kind call is an event published with eventBus.publish(event, tx) from a domain service${typeOnly}.`

package/runtime/scripts/hfs/architecture/unit-spec-providers.mjs

@@ -5,6 +5,7 @@ import { constructorDependencies } from './constructor-deps.mjs';
 import { treeOf } from './required-files.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 import { importsOf } from '../../lib/ts-analysis.mjs';
+import { checkFunctionSubject, functionSubjectExports, keyOf as literalKey, valueObjectSubjects } from './function-spec-providers.mjs';
 
 /**
  * R48 `unit-spec-providers` (BE_SPEC_QUALITY), the unit test standard's rule 3: the unit spec of a service builds its
@@ -15,7 +16,10 @@ import { importsOf } from '../../lib/ts-analysis.mjs';
  * outside the production program, so it is read from disk). A parameter decorated with a custom `Inject<Thing>()` provides
  * the token that decorator's `injector<T>(TOKEN)` names; an undecorated parameter of a class type provides that class (see
  * constructor-deps.mjs). Providers are matched by the exported name of the imported binding (`import { CACHE as C }` is
- * CACHE), never by text. A provider is a class, or `{ provide: TOKEN, useValue: double }` and nothing else.
+ * CACHE), never by text. A provider is a class, or `{ provide: TOKEN, useValue: double }` and nothing else. A sibling
+ * containing only exported functions instead provides its complete real function object and exercises it through module.get;
+ * the constants, enums, re-exports and overload signatures beside those functions do not count. A value-object subject (an
+ * undecorated class whose constructor parameters carry no injection token) is built with `new`, Nest never constructs it.
  *
  * Findings: an extra provider, a missing provider, a service that is not the first provider, a dependency whose token cannot
  * be resolved, a spec with no createTestingModule providers array, and a provider that is neither a class nor
@@ -37,7 +41,6 @@ function testingModules(ts, sourceFile) {
   return calls;
 }
 
-const literalKey = (ts, property) => (ts.isPropertyAssignment(property) || ts.isShorthandPropertyAssignment(property)) && (ts.isIdentifier(property.name) || ts.isStringLiteralLike(property.name)) ? property.name.text : null;
 
 function providerList(ts, call, rel, report) {
   const options = call.arguments[0];
@@ -97,6 +100,8 @@ function checkDependencies(kit, rel, service, serviceFile, list, provided, repor
 function checkTestingModule({ ts, kit, rel, serviceRel, serviceFile, imports, call, report }) {
   const list = providerList(ts, call, rel, report);
   if (!list) return;
+  const names = functionSubjectExports(ts, serviceFile.sourceFile);
+  if (names) return checkFunctionSubject({ ts, rel, serviceRel, imports, call, list, names, report });
   const nameOf = identifier => imports.get(identifier.text)?.name ?? identifier.text;
   const { provided, readable } = readProviders(ts, list, rel, nameOf, report);
   if (!readable) return;
@@ -115,6 +120,7 @@ function checkServiceSpec({ config, graph, kit, ts, rel, violations }) {
   const serviceFile = graph.files.get(serviceRel);
   if (!serviceFile) { report(sourceFile, `${rel} has no ${path.posix.basename(serviceRel)} beside it; a service spec sits next to the service it tests.`); return true; }
   const modules = testingModules(ts, sourceFile);
+  if (!modules.length && valueObjectSubjects(ts, serviceFile.sourceFile)) return true;
   if (!modules.length) { report(sourceFile, `${rel} never calls Test.createTestingModule({ providers: [...] }); build the service from a testing module holding exactly its constructor dependencies.`); return true; }
   for (const call of modules) checkTestingModule({ ts, kit, rel, serviceRel, serviceFile, imports, call, report });
   return true;