@starci/hfs 4.0.10 → 4.1.0

package/runtime/scripts/hfs/architecture/index.mjs

@@ -49,6 +49,7 @@ import { checkI18nKeys, I18N_KEYS_RULE_IDS } from './i18n-keys.mjs';
 import { checkDocLanguage, DOC_LANGUAGE_RULE_IDS } from './doc-language.mjs';
 import { checkBackendSupabase, checkFrontendSupabase, BACKEND_SUPABASE_RULE_IDS, FRONTEND_SUPABASE_RULE_IDS } from './supabase.mjs';
 import { LINT_CODES, onLintSurface } from './surface.mjs';
+import { byCodeUnit } from '../../lib/list.mjs';
 
 export { REGISTRATION_RULE_IDS, SWR_DATA_RULE_IDS };
 
@@ -162,7 +163,7 @@ const machineIds = () => [
 export const HFS_MACHINE_RULE_IDS = Object.freeze((() => {
   const ordinary = new Set([...COMMON_RULE_IDS, ...BACKEND_RULE_IDS, ...FRONTEND_RULE_IDS, ...OWNER_RULE_IDS, ...GRAMMAR_RULE_IDS, ...REGISTRATION_RULE_IDS,
     ...SWR_DATA_RULE_IDS, SOURCE_LAYOUT_RULE_ID, SOURCE_NAME_RULE_ID, PUBLIC_CONTRACT_RULE_ID, READONLY_BOUNDARY_RULE_ID]);
-  return [...new Set(machineIds().filter((id) => !ordinary.has(id)))].sort();
+  return [...new Set(machineIds().filter((id) => !ordinary.has(id)))].sort(byCodeUnit);
 })());
 
 /** Every code the machine can emit, derived from the rule id lists of its checks (`starci app check` ships exactly these why entries). */
@@ -171,12 +172,151 @@ export const ARCHITECTURE_RULE_IDS = Object.freeze([...new Set([
   ...DEAD_EXPORT_RULE_IDS, ...DOC_LANGUAGE_RULE_IDS, ...REQUIRED_FILE_RULE_IDS, ...CLONE_RULE_IDS, ...OWNER_RULE_IDS, ...GRAMMAR_RULE_IDS,
   ...REGISTRATION_RULE_IDS, ...SWR_DATA_RULE_IDS, ...SYMBOL_RULE_IDS, SOURCE_LAYOUT_RULE_ID, SOURCE_NAME_RULE_ID, PUBLIC_CONTRACT_RULE_ID,
   READONLY_BOUNDARY_RULE_ID, ...ERROR_RULE_IDS, ...CONFIG_UNREAD_RULE_IDS, ...Object.values(BACKEND_MACHINE).flatMap(([, ids]) => ids), ...Object.values(FRONTEND_MACHINE).flatMap(([, ids]) => ids),
-])].sort());
+])].sort(byCodeUnit));
 
 function stable(items) {
   return items.sort((a, b) => `${a.path ?? ''}:${a.line ?? 0}:${a.column ?? 0}:${a.ruleId}`.localeCompare(`${b.path ?? ''}:${b.line ?? 0}:${b.column ?? 0}:${b.ruleId}`));
 }
 
+const ownerPublicApiOf = (owners, missingEntries) => {
+  if (!owners.length) return { status: 'unavailable', reason: 'no slot owner instance with an entry file exists in the repository' };
+  if (missingEntries.length) return { status: 'unavailable', reason: 'one or more declared owner entries are outside the checked production TypeScript or JavaScript program',
+    missingEntries: missingEntries.map(owner => owner.entry).sort(byCodeUnit) };
+  return { status: 'checked', declarations: owners.length };
+};
+
+const grammarContractOf = config => {
+  if (!config.kinds.includes('frontend')) return { status: 'not-applicable' };
+  if (config.frontend.grammar) return { status: 'checked', package: config.frontend.grammar.package };
+  return { status: 'unavailable', reason: 'no app has a src/app/globals.css to judge against the Grammar style entry' };
+};
+
+function invalidConfigurationResult(repositoryRoot, error) {
+  const hfs = checkHfsWithoutConfig(repositoryRoot);
+  return { schema: 'starci/architecture-check@1', ok: false, repository: String(repositoryRoot ?? ''), kinds: [], files: 0,
+    compiler: null, violations: stable(hfs.violations), coverage: { hfs: hfs.coverage },
+    errors: [{ ruleId: /^(HFS_[A-Z_]+):/.exec(String(error.message))?.[1] ?? 'ARCH_CONFIG_INVALID', message: String(error.message ?? error).replace(/^HFS_[A-Z_]+:\s*/, '') }], limitations: LIMITATIONS };
+}
+
+function compilerFailureResult(config, hfs, error) {
+  const message = String(error.message ?? error);
+  const match = /^(ARCH_[A-Z_]+):\s*/.exec(message);
+  return { schema: 'starci/architecture-check@1', ok: false, repository: config.root, kinds: config.kinds, files: 0,
+    compiler: null, violations: hfs.violations, coverage: { hfs: hfs.coverage },
+    errors: [{ ruleId: match?.[1] ?? 'ARCH_COMPILER_FAILURE', message: message.replace(/^(ARCH_[A-Z_]+):\s*/, '') }], limitations: LIMITATIONS };
+}
+
+function runBackendChecks(config, context, paths, injectedTypeScript, violations) {
+  violations.push(...checkBackend(config, context));
+  // A slice may omit every app root. Registration ownership needs the complete
+  // composition graph even when the caller asks for findings in only one path.
+  const registrationContext = paths.length && config.backend.moduleRegistration
+    ? buildTypeScriptContext(config, injectedTypeScript) : context;
+  const registration = checkModuleRegistration(config, registrationContext);
+  violations.push(...registration.violations);
+  const sourceShape = checkBackendSourceShape(config, context);
+  violations.push(...sourceShape.violations);
+  const contracts = checkBackendContracts(config, context);
+  violations.push(...contracts.violations);
+  return { moduleRegistration: registration.coverage, backendSourceShape: sourceShape.coverage, backendContractTypeForm: contracts.coverage };
+}
+
+function runFrontendChecks(config, context, violations) {
+  let frontendChecked = true;
+  try {
+    violations.push(...checkFrontend(config, context));
+  } catch (error) {
+    const message = String(error.message ?? error);
+    const match = /^(ARCH_[A-Z_]+):\s*/.exec(message);
+    if (!match) throw error;
+    context.errors.push({ ruleId: match[1], message: message.slice(match[0].length) });
+    frontendChecked = false;
+  }
+  const dataLifecycle = checkFrontendDataLifecycle(config, context);
+  violations.push(...dataLifecycle.violations);
+  return { frontendChecked, frontendDataLifecycle: dataLifecycle.coverage };
+}
+
+function runHfsMachine(config, context, paths, injectedTypeScript, base, fast, violations) {
+  // HFS machine: the slot-driven graph checks read the whole program, also when the caller asked for one path.
+  const hfsContext = paths.length ? buildTypeScriptContext(config, injectedTypeScript) : context;
+  const hfsChecks = { tiers: null, reachability: null, deadExports: null, requiredFiles: null, clones: null, symbols: null, docLanguage: null };
+  if (!hfsContext.program) return hfsChecks;
+  const graph = buildHfsGraph(config, hfsContext);
+  const input = { config, context: hfsContext, graph, base };
+  const runs = { tiers: () => checkTiers(graph), reachability: () => checkReachability(input), deadExports: () => checkDeadExports(input),
+    requiredFiles: () => checkRequiredFiles(input), clones: () => checkClones(input), symbols: () => checkSymbols(input), docLanguage: () => checkDocLanguage(input) };
+  if (graph.profile === 'be') for (const [name, [check]] of Object.entries(BACKEND_MACHINE)) runs[name] = () => check(input);
+  if (graph.profile === 'fe') for (const [name, [check]] of Object.entries(FRONTEND_MACHINE)) runs[name] = () => check(input);
+  if (fast) { delete runs.deadExports; delete runs.clones; delete runs.symbols; }
+  for (const [name, run] of Object.entries(runs)) {
+    const result = run();
+    violations.push(...result.violations.map(violation => ({ ...violation, check: name })));
+    hfsChecks[name] = result.coverage;
+  }
+  return hfsChecks;
+}
+
+function hfsRuleIds(hfs) {
+  return hfs.coverage.status === 'checked' ? HFS_RULE_IDS : [];
+}
+
+function hfsCheckRuleIds(hfsChecks) {
+  return [
+    ...(hfsChecks.tiers ? TIER_RULE_IDS : []),
+    ...(hfsChecks.reachability?.status === 'checked' ? REACHABILITY_RULE_IDS : []),
+    ...(hfsChecks.deadExports?.status === 'checked' ? DEAD_EXPORT_RULE_IDS : []),
+    ...(hfsChecks.requiredFiles?.status === 'checked' ? REQUIRED_FILE_RULE_IDS : []),
+    ...(hfsChecks.clones?.status === 'checked' ? CLONE_RULE_IDS : []),
+    ...(hfsChecks.symbols?.status === 'checked' ? SYMBOL_RULE_IDS : []),
+    ...(hfsChecks.docLanguage?.status === 'checked' ? DOC_LANGUAGE_RULE_IDS : []),
+  ];
+}
+
+function derivedCoverageRuleIds(coverage) {
+  return [
+    ...(coverage.ownerPublicApi.status === 'checked' ? OWNER_RULE_IDS : []),
+    ...(coverage.grammarContract.status === 'checked' ? GRAMMAR_RULE_IDS : []),
+    ...(coverage.moduleRegistration.status === 'checked' ? REGISTRATION_RULE_IDS : []),
+    ...(coverage.backendSourceShape.layout?.status === 'checked' ? [SOURCE_LAYOUT_RULE_ID] : []),
+    ...(coverage.backendSourceShape.naming?.status === 'checked' ? [SOURCE_NAME_RULE_ID] : []),
+    ...(coverage.backendContractTypeForm.publicContracts?.status === 'checked' ? [PUBLIC_CONTRACT_RULE_ID] : []),
+    ...(coverage.backendContractTypeForm.readonlyBoundaries?.status === 'checked' ? [READONLY_BOUNDARY_RULE_ID] : []),
+  ];
+}
+
+function checkedRuleIdsFor(config, hfs, hfsChecks, frontendChecked, coverage) {
+  const machineRuleIds = Object.entries({ ...BACKEND_MACHINE, ...FRONTEND_MACHINE })
+    .flatMap(([name, [, ids]]) => (hfsChecks[name]?.status === 'checked' ? ids : []));
+  const checked = [...new Set([
+    ...COMMON_RULE_IDS,
+    ...hfsRuleIds(hfs),
+    ...(config.kinds.includes('backend') ? BACKEND_RULE_IDS : []),
+    ...hfsCheckRuleIds(hfsChecks),
+    ...CONFIG_UNREAD_RULE_IDS,
+    ...machineRuleIds,
+    ...(frontendChecked ? FRONTEND_RULE_IDS : []),
+    ...derivedCoverageRuleIds(coverage),
+    ...(config.kinds.includes('frontend') && ['checked', 'not-applicable'].includes(coverage.frontendDataLifecycle.status) ? SWR_DATA_RULE_IDS : []),
+  ])];
+  return checked.filter(id => !(id.startsWith('FE_') && !config.kinds.includes('frontend')) && !(id.startsWith('BE_') && !config.kinds.includes('backend')))
+    .sort(byCodeUnit);
+}
+
+/** The errors and the violations a surface reports: findings under the requested paths, on the requested surface, in stable order. */
+function scopeFindings({ config, context, violations, paths, surface }) {
+  const inScope = item => !paths.length || (item.path && paths.some(prefix => sameOrUnder(item.path, prefix.replace(/\/$/, ''))));
+  // Two findings travel as context errors (package boundary edges); they are obligations of the lint surface like any other finding.
+  const asViolation = item => LINT_CODES.has(item.ruleId);
+  const allErrors = context.errors.filter(item => item.ruleId.startsWith('ARCH_TSCONFIG_') || !item.path || inScope(item));
+  const obligations = surface === 'all' ? violations : [...violations, ...context.errors.filter(asViolation).filter(inScope)];
+  // The lint surface is what an editor can show on a line of a TypeScript file; `starci app check` keeps every other finding of the machine.
+  const onSurface = item => surface === 'all' || onLintSurface(config.root, item) === (surface === 'lint');
+  const errors = stable(surface === 'all' ? allErrors : allErrors.filter(item => !asViolation(item)));
+  const scopedViolations = stable(obligations.filter(inScope).filter(onSurface));
+  return { errors, scopedViolations };
+}
+
 /**
  * Check a target repository. injectedTypeScript exists only for hermetic rule fixtures. `fast` leaves out the checks
  * that read the whole repository to answer (clones, dead exports, repository-wide symbols); the pre-push check of the changed owners uses it.
@@ -187,24 +327,17 @@ export function checkArchitecture({ repositoryRoot, injectedTypeScript, paths =
   try {
     config = loadArchitectureConfig(repositoryRoot, { hfs: openedHfs });
   } catch (error) {
-    const hfs = checkHfsWithoutConfig(repositoryRoot);
-    return { schema: 'starci/architecture-check@1', ok: false, repository: String(repositoryRoot ?? ''), kinds: [], files: 0,
-      compiler: null, violations: stable(hfs.violations), coverage: { hfs: hfs.coverage },
-      errors: [{ ruleId: /^(HFS_[A-Z_]+):/.exec(String(error.message))?.[1] ?? 'ARCH_CONFIG_INVALID', message: String(error.message ?? error).replace(/^HFS_[A-Z_]+:\s*/, '') }], limitations: LIMITATIONS };
+    return invalidConfigurationResult(repositoryRoot, error);
   }
   const hfs = checkHfs(config);
   let context;
   try {
     context = buildTypeScriptContext(config, injectedTypeScript, paths);
   } catch (error) {
-    const message = String(error.message ?? error);
-    const match = /^(ARCH_[A-Z_]+):\s*/.exec(message);
-    return { schema: 'starci/architecture-check@1', ok: false, repository: config.root, kinds: config.kinds, files: 0,
-      compiler: null, violations: hfs.violations, coverage: { hfs: hfs.coverage },
-      errors: [{ ruleId: match?.[1] ?? 'ARCH_COMPILER_FAILURE', message: message.replace(/^(ARCH_[A-Z_]+):\s*/, '') }], limitations: LIMITATIONS };
+    return compilerFailureResult(config, hfs, error);
   }
   const violations = [...hfs.violations];
-  const configUnread = checkConfigUnread({ config, context });
+  const configUnread = checkConfigUnread({ context });
   violations.push(...configUnread.violations);
   let moduleRegistration = { status: 'not-applicable' };
   let backendSourceShape = { status: 'not-applicable' };
@@ -212,68 +345,25 @@ export function checkArchitecture({ repositoryRoot, injectedTypeScript, paths =
   let frontendDataLifecycle = { status: 'not-applicable' };
   if (context.program) violations.push(...checkOwners(config, context));
   if (context.program && config.kinds.includes('backend')) {
-    violations.push(...checkBackend(config, context));
-    // A slice may omit every app root. Registration ownership needs the complete
-    // composition graph even when the caller asks for findings in only one path.
-    const registrationContext = paths.length && config.backend.moduleRegistration
-      ? buildTypeScriptContext(config, injectedTypeScript) : context;
-    const registration = checkModuleRegistration(config, registrationContext);
-    violations.push(...registration.violations);
-    moduleRegistration = registration.coverage;
-    const sourceShape = checkBackendSourceShape(config, context);
-    violations.push(...sourceShape.violations);
-    backendSourceShape = sourceShape.coverage;
-    const contracts = checkBackendContracts(config, context);
-    violations.push(...contracts.violations);
-    backendContractTypeForm = contracts.coverage;
+    const backend = runBackendChecks(config, context, paths, injectedTypeScript, violations);
+    moduleRegistration = backend.moduleRegistration;
+    backendSourceShape = backend.backendSourceShape;
+    backendContractTypeForm = backend.backendContractTypeForm;
   }
   let frontendChecked = config.kinds.includes('frontend');
   if (context.program && config.kinds.includes('frontend')) {
     // A broken authored input (the framework-pinned root list in knowledge) is an error, never a
     // silently different contract: the frontend rules are then not reported as checked.
-    try {
-      violations.push(...checkFrontend(config, context));
-    } catch (error) {
-      const message = String(error.message ?? error);
-      const match = /^(ARCH_[A-Z_]+):\s*/.exec(message);
-      if (!match) throw error;
-      context.errors.push({ ruleId: match[1], message: message.slice(match[0].length) });
-      frontendChecked = false;
-    }
-    const dataLifecycle = checkFrontendDataLifecycle(config, context);
-    violations.push(...dataLifecycle.violations);
-    frontendDataLifecycle = dataLifecycle.coverage;
-  }
-  // HFS machine: the slot-driven graph checks read the whole program, also when the caller asked for one path.
-  const hfsContext = paths.length ? buildTypeScriptContext(config, injectedTypeScript) : context;
-  const hfsChecks = { tiers: null, reachability: null, deadExports: null, requiredFiles: null, clones: null, symbols: null, docLanguage: null };
-  if (hfsContext.program) {
-    const graph = buildHfsGraph(config, hfsContext);
-    const input = { config, context: hfsContext, graph, base };
-    const runs = { tiers: () => checkTiers(graph), reachability: () => checkReachability(input), deadExports: () => checkDeadExports(input),
-      requiredFiles: () => checkRequiredFiles(input), clones: () => checkClones(input), symbols: () => checkSymbols(input), docLanguage: () => checkDocLanguage(input) };
-    if (graph.profile === 'be') for (const [name, [check]] of Object.entries(BACKEND_MACHINE)) runs[name] = () => check(input);
-    if (graph.profile === 'fe') for (const [name, [check]] of Object.entries(FRONTEND_MACHINE)) runs[name] = () => check(input);
-    if (fast) { delete runs.deadExports; delete runs.clones; delete runs.symbols; }
-    for (const [name, run] of Object.entries(runs)) {
-      const result = run();
-      violations.push(...result.violations.map(violation => ({ ...violation, check: name })));
-      hfsChecks[name] = result.coverage;
-    }
+    const frontend = runFrontendChecks(config, context, violations);
+    frontendChecked = frontend.frontendChecked;
+    frontendDataLifecycle = frontend.frontendDataLifecycle;
   }
-  const inScope = item => !paths.length || (item.path && paths.some(prefix => sameOrUnder(item.path, prefix.replace(/\/$/, ''))));
-  // Two findings travel as context errors (package boundary edges); they are obligations of the lint surface like any other finding.
-  const asViolation = item => LINT_CODES.has(item.ruleId);
-  const allErrors = context.errors.filter(item => item.ruleId.startsWith('ARCH_TSCONFIG_') || !item.path || inScope(item));
-  const obligations = surface === 'all' ? violations : [...violations, ...context.errors.filter(asViolation).filter(inScope)];
-  // The lint surface is what an editor can show on a line of a TypeScript file; `starci app check` keeps every other finding of the machine.
-  const onSurface = item => surface === 'all' || onLintSurface(config.root, item) === (surface === 'lint');
-  const errors = stable(surface === 'all' ? allErrors : allErrors.filter(item => !asViolation(item)));
-  const scopedViolations = stable(obligations.filter(inScope).filter(onSurface));
+  const hfsChecks = runHfsMachine(config, context, paths, injectedTypeScript, base, fast, violations);
+  const { errors, scopedViolations } = scopeFindings({ config, context, violations, paths, surface });
   const sourceFiles = new Set(context.files.map(file => canonical(file.fileName)));
   const missingOwnerEntries = config.owners?.filter(owner => !sourceFiles.has(canonical(path.resolve(config.root, ...owner.entry.split('/'))))) ?? [];
   const coverage = {
-    sourceFiles: context.files.map(file => relativePath(config.root, canonical(file.fileName))).sort(),
+    sourceFiles: context.files.map(file => relativePath(config.root, canonical(file.fileName))).sort(byCodeUnit),
     hfs: hfs.coverage,
     configUnread: configUnread.coverage,
     backendContractTypeForm,
@@ -281,44 +371,10 @@ export function checkArchitecture({ repositoryRoot, injectedTypeScript, paths =
     frontendDataLifecycle,
     moduleRegistration,
     hfsMachine: hfsChecks,
-    ownerPublicApi: !config.owners.length
-      ? { status: 'unavailable', reason: 'no slot owner instance with an entry file exists in the repository' }
-      : missingOwnerEntries.length
-        ? { status: 'unavailable', reason: 'one or more declared owner entries are outside the checked production TypeScript or JavaScript program',
-          missingEntries: missingOwnerEntries.map(owner => owner.entry).sort() }
-      : { status: 'checked', declarations: config.owners.length },
-    grammarContract: !config.kinds.includes('frontend')
-      ? { status: 'not-applicable' }
-      : config.frontend.grammar
-        ? { status: 'checked', package: config.frontend.grammar.package }
-        : { status: 'unavailable', reason: 'no app has a src/app/globals.css to judge against the Grammar style entry' },
+    ownerPublicApi: ownerPublicApiOf(config.owners, missingOwnerEntries),
+    grammarContract: grammarContractOf(config),
   };
-  coverage.checkedRuleIds = [...new Set([
-    ...COMMON_RULE_IDS,
-    ...(hfs.coverage.status === 'checked' ? HFS_RULE_IDS : []),
-    ...(config.kinds.includes('backend') ? BACKEND_RULE_IDS : []),
-    ...(hfsChecks.tiers ? TIER_RULE_IDS : []),
-    ...(hfsChecks.reachability?.status === 'checked' ? REACHABILITY_RULE_IDS : []),
-    ...(hfsChecks.deadExports?.status === 'checked' ? DEAD_EXPORT_RULE_IDS : []),
-    ...(hfsChecks.requiredFiles?.status === 'checked' ? REQUIRED_FILE_RULE_IDS : []),
-    ...(hfsChecks.clones?.status === 'checked' ? CLONE_RULE_IDS : []),
-    ...(hfsChecks.symbols?.status === 'checked' ? SYMBOL_RULE_IDS : []),
-    ...(hfsChecks.docLanguage?.status === 'checked' ? DOC_LANGUAGE_RULE_IDS : []),
-    ...CONFIG_UNREAD_RULE_IDS,
-    ...Object.entries({ ...BACKEND_MACHINE, ...FRONTEND_MACHINE }).flatMap(([name, [, ids]]) => (hfsChecks[name]?.status === 'checked' ? ids : [])),
-    ...(frontendChecked ? FRONTEND_RULE_IDS : []),
-    ...(coverage.ownerPublicApi.status === 'checked' ? OWNER_RULE_IDS : []),
-    ...(coverage.grammarContract.status === 'checked' ? GRAMMAR_RULE_IDS : []),
-    ...(coverage.moduleRegistration.status === 'checked' ? REGISTRATION_RULE_IDS : []),
-    ...(coverage.backendSourceShape.layout?.status === 'checked' ? [SOURCE_LAYOUT_RULE_ID] : []),
-    ...(coverage.backendSourceShape.naming?.status === 'checked' ? [SOURCE_NAME_RULE_ID] : []),
-    ...(coverage.backendContractTypeForm.publicContracts?.status === 'checked' ? [PUBLIC_CONTRACT_RULE_ID] : []),
-    ...(coverage.backendContractTypeForm.readonlyBoundaries?.status === 'checked' ? [READONLY_BOUNDARY_RULE_ID] : []),
-    ...(config.kinds.includes('frontend') && ['checked', 'not-applicable'].includes(coverage.frontendDataLifecycle.status) ? SWR_DATA_RULE_IDS : []),
-  ])]
-    // A back-end repository checked no FE_ rule and a front-end one no BE_ rule, whatever list a shared check (tiers, required files) carries.
-    .filter(id => !(id.startsWith('FE_') && !config.kinds.includes('frontend')) && !(id.startsWith('BE_') && !config.kinds.includes('backend')))
-    .sort();
+  coverage.checkedRuleIds = checkedRuleIdsFor(config, hfs, hfsChecks, frontendChecked, coverage);
   return {
     schema: 'starci/architecture-check@1',
     ok: errors.length === 0 && scopedViolations.length === 0,

package/runtime/scripts/hfs/architecture/injection-token-exported.mjs

@@ -15,6 +15,37 @@ export const INJECTION_TOKEN_EXPORTED_RULE_IDS = ['BE_RAW_INJECT'];
 
 const RULE = 'BE_RAW_INJECT';
 
+const exportedVariableHasName = (ts, kit, statement, name) => {
+  if (!ts.isVariableStatement(statement) || !kit.isExported(statement)) return false;
+  return statement.declarationList.declarations.some(declaration =>
+    (ts.isIdentifier(declaration.name) && declaration.name.text === name)
+    || (ts.isObjectBindingPattern(declaration.name) && declaration.name.elements.some(element => ts.isIdentifier(element.name) && element.name.text === name)));
+};
+
+const exportedDeclarationHasName = (ts, statement, name) => {
+  if (!ts.isExportDeclaration(statement)) return false;
+  const clause = statement.exportClause;
+  return clause !== undefined && ts.isNamedExports(clause) && clause.elements.some(element => element.name.text === name);
+};
+
+const exportsName = (ts, kit, file, name) => file?.sourceFile.statements.some(statement =>
+  exportedVariableHasName(ts, kit, statement, name) || exportedDeclarationHasName(ts, statement, name)) === true;
+
+const indexOf = (graph, file) => (file?.owner ? graph.files.get(`${file.owner.root}/index.ts`) : null);
+
+const injectionViolationFor = (graph, kit, ts, dependency) => {
+  const decoratorFile = graph.files.get(kit.graphPath(dependency.decoratorDeclaration));
+  if (dependency.kind === 'unresolved') {
+    return decoratorFile ? { ruleId: RULE, path: decoratorFile.rel, ...kit.at(decoratorFile.rel, decoratorFile.sourceFile, dependency.injectorCall), decorator: dependency.decorator,
+      message: `${dependency.decorator}() cannot be followed to its token (${dependency.reason}); name an exported \`unique symbol\` const so a unit spec can provide it.` } : null;
+  }
+  const tokenFile = dependency.declaration ? graph.files.get(kit.graphPath(dependency.declaration)) : null;
+  const homes = [decoratorFile, tokenFile && path.posix.basename(tokenFile.rel).endsWith('.decorators.ts') ? tokenFile : null, indexOf(graph, decoratorFile), indexOf(graph, tokenFile)];
+  if (!decoratorFile || homes.some(home => exportsName(ts, kit, home, dependency.name))) return null;
+  return { ruleId: RULE, path: decoratorFile.rel, ...kit.at(decoratorFile.rel, decoratorFile.sourceFile, dependency.injectorCall), decorator: dependency.decorator, token: dependency.name,
+    message: `${dependency.decorator}() injects ${dependency.name}, which is not exported from ${path.posix.basename(decoratorFile.rel)} nor from the capability index.ts; export the token so a unit spec can provide it (\`{ provide: ${dependency.name}, useValue: double }\`).` };
+};
+
 export function checkInjectionTokenExported(input) {
   const { graph } = input;
   const kit = machineKit(input);
@@ -23,39 +54,13 @@ export function checkInjectionTokenExported(input) {
   const seen = new Set();
   let decorators = 0;
 
-  const exportsName = (file, name) => {
-    if (!file) return false;
-    for (const statement of file.sourceFile.statements) {
-      if (ts.isVariableStatement(statement) && kit.isExported(statement)) {
-        for (const declaration of statement.declarationList.declarations) {
-          if (ts.isIdentifier(declaration.name) && declaration.name.text === name) return true;
-          if (ts.isObjectBindingPattern(declaration.name) && declaration.name.elements.some(element => ts.isIdentifier(element.name) && element.name.text === name)) return true;
-        }
-      }
-      if (ts.isExportDeclaration(statement) && statement.exportClause && ts.isNamedExports(statement.exportClause)
-        && statement.exportClause.elements.some(element => element.name.text === name)) return true;
-    }
-    return false;
-  };
-  const indexOf = file => (file?.owner ? graph.files.get(`${file.owner.root}/index.ts`) : null);
-
   for (const { file, declaration } of serviceClasses(kit, graph)) {
     for (const dependency of constructorDependencies(kit, file, declaration)) {
       if (dependency.external || !dependency.decoratorDeclaration || !dependency.injectorCall || seen.has(dependency.injectorCall)) continue;
       seen.add(dependency.injectorCall);
       decorators += 1;
-      const decoratorFile = graph.files.get(kit.graphPath(dependency.decoratorDeclaration));
-      if (dependency.kind === 'unresolved') {
-        if (decoratorFile) violations.push({ ruleId: RULE, path: decoratorFile.rel, ...kit.at(decoratorFile.rel, decoratorFile.sourceFile, dependency.injectorCall), decorator: dependency.decorator,
-          message: `${dependency.decorator}() cannot be followed to its token (${dependency.reason}); name an exported \`unique symbol\` const so a unit spec can provide it.` });
-        continue;
-      }
-      const tokenFile = dependency.declaration ? graph.files.get(kit.graphPath(dependency.declaration)) : null;
-      const homes = [decoratorFile, tokenFile && path.posix.basename(tokenFile.rel).endsWith('.decorators.ts') ? tokenFile : null, indexOf(decoratorFile), indexOf(tokenFile)];
-      if (homes.some(home => exportsName(home, dependency.name))) continue;
-      if (!decoratorFile) continue;
-      violations.push({ ruleId: RULE, path: decoratorFile.rel, ...kit.at(decoratorFile.rel, decoratorFile.sourceFile, dependency.injectorCall), decorator: dependency.decorator, token: dependency.name,
-        message: `${dependency.decorator}() injects ${dependency.name}, which is not exported from ${path.posix.basename(decoratorFile.rel)} nor from the capability index.ts; export the token so a unit spec can provide it (\`{ provide: ${dependency.name}, useValue: double }\`).` });
+      const violation = injectionViolationFor(graph, kit, ts, dependency);
+      if (violation) violations.push(violation);
     }
   }
   return { violations, coverage: { status: 'checked', decorators, files: graph.files.size } };