@starci/hfs 4.0.7 → 4.0.9

package/runtime/scripts/hfs/architecture/next-data-contract.mjs

@@ -0,0 +1,96 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { canonical, exactKeys, isInside, slash } from './config.mjs';
+
+const CONTRACT_SCHEMA = 'starci/next-data-lifecycle@1';
+const SOURCE = /\.[cm]?[jt]sx?$/i;
+const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
+const BINDING = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/;
+const TOP_KEYS = new Set(['schema', 'swr', 'hooks']);
+const SWR_KEYS = new Set(['package', 'major']);
+const HOOK_KEYS = new Set(['id', 'path', 'export', 'kind', 'resultBinding', 'identities']);
+const IDENTITY_KEYS = new Set(['id', 'binding', 'gatesRequest', 'resource']);
+function relativeSource(repository, value, label) {
+  repository = path.resolve(repository);
+  if (typeof value !== 'string' || !value.trim() || path.isAbsolute(value)) throw Error(`${label} must be a non-empty repository-relative source path.`);
+  const relative = slash(value.trim()).replace(/^\.\//, '');
+  if (relative.split('/').includes('..') || !SOURCE.test(relative) || /\.d\.[cm]?[jt]s$/i.test(relative)) {
+    throw Error(`${label} must be a production TypeScript or JavaScript source path.`);
+  }
+  const absolute = path.resolve(repository, ...relative.split('/'));
+  if (!isInside(repository, absolute)) throw Error(`${label} must stay inside the repository.`);
+  for (let current = absolute; current !== repository; current = path.dirname(current)) {
+    const stat = fs.lstatSync(current);
+    if (stat.isSymbolicLink()) throw Error(`${label} must not cross a symbolic-link or junction ancestor.`);
+  }
+  const stat = fs.lstatSync(absolute);
+  if (!stat.isFile() || !isInside(canonical(repository), canonical(absolute))) throw Error(`${label} must be a regular source file inside the repository.`);
+  return relative;
+}
+
+export function parseContract(config) {
+  // The contract is declared in the app's one package.json (the app root; config.root is the fe side folder).
+  const manifest = JSON.parse(fs.readFileSync(path.join(config.packageRoot ?? config.root, 'package.json'), 'utf8'));
+  const next = manifest?.starci?.codePatterns?.next;
+  const value = next?.dataLifecycle;
+  if (value === undefined) return null;
+  if (next.schema !== 'starci/next-code-pattern-contract@1') throw Error('package.json#starci.codePatterns.next must use starci/next-code-pattern-contract@1.');
+  exactKeys(value, TOP_KEYS, 'package.json#starci.codePatterns.next.dataLifecycle');
+  if (value.schema !== CONTRACT_SCHEMA) throw Error(`dataLifecycle.schema must be ${CONTRACT_SCHEMA}.`);
+  exactKeys(value.swr, SWR_KEYS, 'dataLifecycle.swr');
+  if (value.swr.package !== 'swr' || !Number.isInteger(value.swr.major) || value.swr.major < 1) {
+    throw Error('dataLifecycle.swr must bind package swr and one positive integer major version.');
+  }
+  if (!Array.isArray(value.hooks) || value.hooks.length === 0) throw Error('dataLifecycle.hooks must contain at least one declared lifecycle call.');
+  const ids = new Set();
+  const hooks = value.hooks.map((hook, index) => {
+    const label = `dataLifecycle.hooks[${index}]`;
+    exactKeys(hook, HOOK_KEYS, label);
+    if (typeof hook.id !== 'string' || !hook.id.trim() || ids.has(hook.id.trim())) throw Error(`${label}.id must be unique and non-empty.`);
+    ids.add(hook.id.trim());
+    const source = relativeSource(config.root, hook.path, `${label}.path`);
+    if (typeof hook.export !== 'string' || !/^use[A-Z0-9_$][\w$]*$/.test(hook.export)) throw Error(`${label}.export must name one exported use* hook.`);
+    if (!['query', 'mutation'].includes(hook.kind)) throw Error(`${label}.kind must be query or mutation.`);
+    if (hook.resultBinding !== undefined && (typeof hook.resultBinding !== 'string' || !IDENTIFIER.test(hook.resultBinding))) {
+      throw Error(`${label}.resultBinding must be one local identifier.`);
+    }
+    if (!Array.isArray(hook.identities)) throw Error(`${label}.identities must be an array.`);
+    const identityIds = new Set(), bindings = new Set();
+    const identities = hook.identities.map((identity, identityIndex) => {
+      const identityLabel = `${label}.identities[${identityIndex}]`;
+      exactKeys(identity, IDENTITY_KEYS, identityLabel);
+      if (typeof identity.id !== 'string' || !identity.id.trim() || identityIds.has(identity.id.trim())) throw Error(`${identityLabel}.id must be unique and non-empty.`);
+      if (typeof identity.binding !== 'string' || !BINDING.test(identity.binding) || bindings.has(identity.binding)) throw Error(`${identityLabel}.binding must be a unique identifier or property path.`);
+      if (typeof identity.gatesRequest !== 'boolean' || typeof identity.resource !== 'boolean') throw Error(`${identityLabel} must explicitly declare gatesRequest and resource booleans.`);
+      identityIds.add(identity.id.trim());
+      bindings.add(identity.binding);
+      return { id: identity.id.trim(), binding: identity.binding, gatesRequest: identity.gatesRequest, resource: identity.resource };
+    });
+    if (hook.kind === 'mutation' && !identities.some(identity => identity.resource)) throw Error(`${label} mutation must declare at least one resource identity.`);
+    return { id: hook.id.trim(), path: source, export: hook.export, kind: hook.kind,
+      ...(hook.resultBinding === undefined ? {} : { resultBinding: hook.resultBinding }), identities };
+  });
+  return { schema: value.schema, swr: { package: 'swr', major: value.swr.major }, hooks };
+}
+
+export function installedSWR(repository) {
+  const require = createRequire(path.join(repository, 'package.json'));
+  let manifest;
+  try { manifest = require.resolve('swr/package.json'); } catch {
+    let entry;
+    try { entry = require.resolve('swr'); } catch { throw Error('Installed swr package is unavailable.'); }
+    let current = path.dirname(entry);
+    while (isInside(repository, current) && current !== repository) {
+      const candidate = path.join(current, 'package.json');
+      if (fs.existsSync(candidate)) { manifest = candidate; break; }
+      current = path.dirname(current);
+    }
+  }
+  if (!manifest) throw Error('Installed swr package.json is unavailable.');
+  const actualManifest = canonical(manifest);
+  const parsed = JSON.parse(fs.readFileSync(actualManifest, 'utf8'));
+  const major = Number.parseInt(String(parsed.version ?? '').split('.')[0], 10);
+  if (parsed.name !== 'swr' || !Number.isInteger(major)) throw Error('Installed swr package identity or version is invalid.');
+  return { name: parsed.name, version: parsed.version, major, root: canonical(path.dirname(actualManifest)) };
+}

package/runtime/scripts/{checks → hfs}/architecture/next-data.mjs

@@ -1,142 +1,19 @@
-import fs from 'node:fs';
 import path from 'node:path';
-import { createRequire } from 'node:module';
-import { canonical, exactKeys, isInside, slash } from './config.mjs';
-import { relativePath, sourceLocation, unwrapExpression } from './typescript.mjs';
+import { canonical, isInside } from './config.mjs';
+import { parseContract, installedSWR } from './next-data-contract.mjs';
+import { relativePath, unwrapExpression } from './typescript.mjs';
+import { anyDescendant, normalizedSymbol, normalizedSymbolValue, selectedNode, valueSymbol as sharedValueSymbol } from './ast-walks.mjs';
+import { sourceLocation } from '../../lib/ts-ast.mjs';
 
 export const SWR_KEY_RULE_ID = 'FE_SWR_KEY_IDENTITY';
 export const SWR_MUTATION_RULE_ID = 'FE_SWR_MUTATION_RESOURCE_IDENTITY';
 export const SWR_DATA_RULE_IDS = [SWR_KEY_RULE_ID, SWR_MUTATION_RULE_ID];
 
-const CONTRACT_SCHEMA = 'starci/next-data-lifecycle@1';
-const SOURCE = /\.[cm]?[jt]sx?$/i;
-const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
-const BINDING = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/;
-const TOP_KEYS = new Set(['schema', 'swr', 'hooks']);
-const SWR_KEYS = new Set(['package', 'major']);
-const HOOK_KEYS = new Set(['id', 'path', 'export', 'kind', 'resultBinding', 'identities']);
-const IDENTITY_KEYS = new Set(['id', 'binding', 'gatesRequest', 'resource']);
 const SWR_SPECIFIERS = new Set(['swr', 'swr/immutable', 'swr/mutation']);
 
-function relativeSource(repository, value, label) {
-  repository = path.resolve(repository);
-  if (typeof value !== 'string' || !value.trim() || path.isAbsolute(value)) throw Error(`${label} must be a non-empty repository-relative source path.`);
-  const relative = slash(value.trim()).replace(/^\.\//, '');
-  if (relative.split('/').includes('..') || !SOURCE.test(relative) || /\.d\.[cm]?[jt]s$/i.test(relative)) {
-    throw Error(`${label} must be a production TypeScript or JavaScript source path.`);
-  }
-  const absolute = path.resolve(repository, ...relative.split('/'));
-  if (!isInside(repository, absolute)) throw Error(`${label} must stay inside the repository.`);
-  for (let current = absolute; current !== repository; current = path.dirname(current)) {
-    const stat = fs.lstatSync(current);
-    if (stat.isSymbolicLink()) throw Error(`${label} must not cross a symbolic-link or junction ancestor.`);
-  }
-  const stat = fs.lstatSync(absolute);
-  if (!stat.isFile() || !isInside(canonical(repository), canonical(absolute))) throw Error(`${label} must be a regular source file inside the repository.`);
-  return relative;
-}
-
-function parseContract(config) {
-  // The contract is declared in the app's one package.json (the app root; config.root is the fe side folder).
-  const manifest = JSON.parse(fs.readFileSync(path.join(config.packageRoot ?? config.root, 'package.json'), 'utf8'));
-  const next = manifest?.starci?.codePatterns?.next;
-  const value = next?.dataLifecycle;
-  if (value === undefined) return null;
-  if (next.schema !== 'starci/next-code-pattern-contract@1') throw Error('package.json#starci.codePatterns.next must use starci/next-code-pattern-contract@1.');
-  exactKeys(value, TOP_KEYS, 'package.json#starci.codePatterns.next.dataLifecycle');
-  if (value.schema !== CONTRACT_SCHEMA) throw Error(`dataLifecycle.schema must be ${CONTRACT_SCHEMA}.`);
-  exactKeys(value.swr, SWR_KEYS, 'dataLifecycle.swr');
-  if (value.swr.package !== 'swr' || !Number.isInteger(value.swr.major) || value.swr.major < 1) {
-    throw Error('dataLifecycle.swr must bind package swr and one positive integer major version.');
-  }
-  if (!Array.isArray(value.hooks) || value.hooks.length === 0) throw Error('dataLifecycle.hooks must contain at least one declared lifecycle call.');
-  const ids = new Set();
-  const hooks = value.hooks.map((hook, index) => {
-    const label = `dataLifecycle.hooks[${index}]`;
-    exactKeys(hook, HOOK_KEYS, label);
-    if (typeof hook.id !== 'string' || !hook.id.trim() || ids.has(hook.id.trim())) throw Error(`${label}.id must be unique and non-empty.`);
-    ids.add(hook.id.trim());
-    const source = relativeSource(config.root, hook.path, `${label}.path`);
-    if (typeof hook.export !== 'string' || !/^use[A-Z0-9_$][\w$]*$/.test(hook.export)) throw Error(`${label}.export must name one exported use* hook.`);
-    if (!['query', 'mutation'].includes(hook.kind)) throw Error(`${label}.kind must be query or mutation.`);
-    if (hook.resultBinding !== undefined && (typeof hook.resultBinding !== 'string' || !IDENTIFIER.test(hook.resultBinding))) {
-      throw Error(`${label}.resultBinding must be one local identifier.`);
-    }
-    if (!Array.isArray(hook.identities)) throw Error(`${label}.identities must be an array.`);
-    const identityIds = new Set(), bindings = new Set();
-    const identities = hook.identities.map((identity, identityIndex) => {
-      const identityLabel = `${label}.identities[${identityIndex}]`;
-      exactKeys(identity, IDENTITY_KEYS, identityLabel);
-      if (typeof identity.id !== 'string' || !identity.id.trim() || identityIds.has(identity.id.trim())) throw Error(`${identityLabel}.id must be unique and non-empty.`);
-      if (typeof identity.binding !== 'string' || !BINDING.test(identity.binding) || bindings.has(identity.binding)) throw Error(`${identityLabel}.binding must be a unique identifier or property path.`);
-      if (typeof identity.gatesRequest !== 'boolean' || typeof identity.resource !== 'boolean') throw Error(`${identityLabel} must explicitly declare gatesRequest and resource booleans.`);
-      identityIds.add(identity.id.trim());
-      bindings.add(identity.binding);
-      return { id: identity.id.trim(), binding: identity.binding, gatesRequest: identity.gatesRequest, resource: identity.resource };
-    });
-    if (hook.kind === 'mutation' && !identities.some(identity => identity.resource)) throw Error(`${label} mutation must declare at least one resource identity.`);
-    return { id: hook.id.trim(), path: source, export: hook.export, kind: hook.kind,
-      ...(hook.resultBinding === undefined ? {} : { resultBinding: hook.resultBinding }), identities };
-  });
-  return { schema: value.schema, swr: { package: 'swr', major: value.swr.major }, hooks };
-}
-
-function installedSWR(repository) {
-  const require = createRequire(path.join(repository, 'package.json'));
-  let manifest;
-  try { manifest = require.resolve('swr/package.json'); } catch {
-    let entry;
-    try { entry = require.resolve('swr'); } catch { throw Error('Installed swr package is unavailable.'); }
-    let current = path.dirname(entry);
-    while (isInside(repository, current) && current !== repository) {
-      const candidate = path.join(current, 'package.json');
-      if (fs.existsSync(candidate)) { manifest = candidate; break; }
-      current = path.dirname(current);
-    }
-  }
-  if (!manifest) throw Error('Installed swr package.json is unavailable.');
-  const actualManifest = canonical(manifest);
-  const parsed = JSON.parse(fs.readFileSync(actualManifest, 'utf8'));
-  const major = Number.parseInt(String(parsed.version ?? '').split('.')[0], 10);
-  if (parsed.name !== 'swr' || !Number.isInteger(major)) throw Error('Installed swr package identity or version is invalid.');
-  return { name: parsed.name, version: parsed.version, major, root: canonical(path.dirname(actualManifest)) };
-}
-
-function normalizedSymbol(ts, checker, value) {
-  let symbol = value ?? null;
-  const seen = new Set();
-  while (symbol && (symbol.flags & ts.SymbolFlags.Alias) && !seen.has(symbol)) {
-    seen.add(symbol);
-    const target = checker.getAliasedSymbol(symbol);
-    if (!target || target === symbol) break;
-    symbol = target;
-  }
-  return symbol;
-}
-
-function selectedNode(ts, expression) {
-  expression = unwrapExpression(ts, expression);
-  if (ts.isIdentifier(expression)) return expression;
-  if (ts.isPropertyAccessExpression(expression)) return expression.name;
-  if (ts.isElementAccessExpression(expression) && ts.isStringLiteralLike(expression.argumentExpression)) return expression.argumentExpression;
-  return null;
-}
-
-function symbolAt(ts, checker, node) {
-  return normalizedSymbol(ts, checker, checker.getSymbolAtLocation(node));
-}
-
-function valueSymbol(ts, checker, expression, seen = new Set()) {
-  const selected = selectedNode(ts, expression);
-  const symbol = selected ? symbolAt(ts, checker, selected) : null;
-  if (!symbol || seen.has(symbol)) return symbol;
-  const declarations = symbol.getDeclarations?.() ?? [];
-  if (declarations.length === 1 && ts.isVariableDeclaration(declarations[0]) && declarations[0].initializer
-    && (ts.getCombinedNodeFlags(declarations[0].parent) & ts.NodeFlags.Const)) {
-    return valueSymbol(ts, checker, declarations[0].initializer, new Set(seen).add(symbol));
-  }
-  return symbol;
-}
+/* null when the expression selects no name at all (the shared default traces the unselected node itself). */
+const valueSymbol = (ts, checker, expression, seen = new Set()) =>
+  sharedValueSymbol(ts, checker, expression, seen, { unselected: 'null' });
 
 function declarationsInside(symbol, root) {
   const declarations = symbol?.getDeclarations?.() ?? [];
@@ -163,7 +40,7 @@ function officialTargets(config, context, installed, reasons) {
         reasons.push(`${relativePath(config.root, source.fileName)} cannot resolve ${statement.moduleSpecifier.text} through the target TypeScript program`);
         continue;
       }
-      const exports = new Map(checker.getExportsOfModule(moduleSymbol).map(symbol => [symbol.getName(), normalizedSymbol(context.ts, checker, symbol)]));
+      const exports = new Map(checker.getExportsOfModule(moduleSymbol).map(symbol => [symbol.getName(), normalizedSymbolValue(context.ts, checker, symbol)]));
       for (const [name, kind] of selected) {
         const target = exports.get(name);
         if (!target) continue;
@@ -229,7 +106,7 @@ function configMutateSymbols(config, context, targets) {
         for (const element of node.name.elements) {
           const property = element.propertyName && context.ts.isIdentifier(element.propertyName) ? element.propertyName.text
             : context.ts.isIdentifier(element.name) ? element.name.text : null;
-          if (property === 'mutate' && context.ts.isIdentifier(element.name)) symbols.add(symbolAt(context.ts, checker, element.name));
+          if (property === 'mutate' && context.ts.isIdentifier(element.name)) symbols.add(normalizedSymbol(context.ts, checker, element.name));
         }
       }
       context.ts.forEachChild(node, visit);
@@ -274,7 +151,7 @@ function exportedHook(config, context, entry, reasons) {
   const checker = context.checkerFor(source.fileName);
   const moduleSymbol = checker.getSymbolAtLocation(source);
   const exported = moduleSymbol ? checker.getExportsOfModule(moduleSymbol).find(symbol => symbol.getName() === entry.export) : null;
-  const symbol = normalizedSymbol(context.ts, checker, exported);
+  const symbol = normalizedSymbolValue(context.ts, checker, exported);
   const declarations = (symbol?.getDeclarations?.() ?? []).filter(declaration => canonical(declaration.getSourceFile().fileName) === canonical(source.fileName));
   const functions = declarations.map(declaration => functionNode(context.ts, declaration)).filter(Boolean);
   if (functions.length !== 1) {
@@ -288,7 +165,7 @@ function bindingSymbols(ts, checker, fn) {
   const found = new Map();
   const addName = name => {
     if (ts.isIdentifier(name)) {
-      const symbol = symbolAt(ts, checker, name);
+      const symbol = normalizedSymbol(ts, checker, name);
       if (symbol) {
         if (!found.has(name.text)) found.set(name.text, new Set());
         found.get(name.text).add(symbol);
@@ -326,7 +203,7 @@ function resolvedIdentities(ts, checker, fn, entry, reasons) {
 
 function accessPath(ts, checker, node) {
   node = unwrapExpression(ts, node);
-  if (ts.isIdentifier(node)) return { symbol: symbolAt(ts, checker, node), parts: [node.text] };
+  if (ts.isIdentifier(node)) return { symbol: normalizedSymbol(ts, checker, node), parts: [node.text] };
   if (ts.isPropertyAccessExpression(node)) {
     const base = accessPath(ts, checker, node.expression);
     return base ? { symbol: base.symbol, parts: [...base.parts, node.name.text] } : null;
@@ -342,7 +219,7 @@ function expandedAccessPath(ts, checker, node, seen = new Set(), depth = 0) {
   if (!node || depth > 10) return null;
   node = unwrapExpression(ts, node);
   if (ts.isIdentifier(node)) {
-    const symbol = symbolAt(ts, checker, node);
+    const symbol = normalizedSymbol(ts, checker, node);
     if (!symbol || seen.has(symbol)) return symbol ? { symbol, parts: [node.text] } : null;
     const initializer = constInitializer(ts, symbol);
     return initializer ? expandedAccessPath(ts, checker, initializer, new Set(seen).add(symbol), depth + 1)
@@ -365,19 +242,8 @@ function matchesIdentityAccess(ts, checker, node, identity) {
   return matches(accessPath(ts, checker, node)) || matches(expandedAccessPath(ts, checker, node));
 }
 
-function expressionReferences(ts, checker, expression, identity) {
-  let found = false;
-  const visit = node => {
-    if (found) return;
-    if (matchesIdentityAccess(ts, checker, node, identity)) {
-      found = true;
-      return;
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(expression);
-  return found;
-}
+const expressionReferences = (ts, checker, expression, identity) =>
+  anyDescendant(ts, expression, (node) => matchesIdentityAccess(ts, checker, node, identity));
 
 function constInitializer(ts, symbol) {
   const declarations = symbol?.getDeclarations?.() ?? [];
@@ -409,7 +275,7 @@ function identityContribution(ts, checker, expression, identity, seen = new Set(
   expression = unwrapExpression(ts, expression);
   if (matchesIdentityAccess(ts, checker, expression, identity)) return 'yes';
   if (ts.isIdentifier(expression)) {
-    const symbol = symbolAt(ts, checker, expression);
+    const symbol = normalizedSymbol(ts, checker, expression);
     if (!symbol || seen.has(symbol)) return 'no';
     const initializer = constInitializer(ts, symbol);
     return initializer ? identityContribution(ts, checker, initializer, identity, new Set(seen).add(symbol), depth + 1) : 'no';
@@ -471,8 +337,8 @@ function rootKeyExpression(ts, checker, expression, identities, seen = new Set()
     const returned = returnedExpression(ts, expression);
     return returned ? rootKeyExpression(ts, checker, returned, identities, seen, depth + 1) : null;
   }
-  if (ts.isIdentifier(expression) && !identities.some(identity => identity.symbol === symbolAt(ts, checker, expression))) {
-    const symbol = symbolAt(ts, checker, expression);
+  if (ts.isIdentifier(expression) && !identities.some(identity => identity.symbol === normalizedSymbol(ts, checker, expression))) {
+    const symbol = normalizedSymbol(ts, checker, expression);
     if (symbol && !seen.has(symbol)) {
       const declarations = symbol.getDeclarations?.() ?? [];
       if (declarations.length === 1 && ts.isVariableDeclaration(declarations[0]) && declarations[0].initializer
@@ -510,8 +376,8 @@ function staticKeyExpression(ts, checker, expression, identities, seen = new Set
     return false;
   }
   if (ts.isIdentifier(expression)) {
-    if (expression.text === 'undefined' || identities.some(identity => identity.symbol === symbolAt(ts, checker, expression))) return true;
-    const symbol = symbolAt(ts, checker, expression);
+    if (expression.text === 'undefined' || identities.some(identity => identity.symbol === normalizedSymbol(ts, checker, expression))) return true;
+    const symbol = normalizedSymbol(ts, checker, expression);
     if (!symbol || seen.has(symbol)) return false;
     const declarations = symbol.getDeclarations?.() ?? [];
     if (declarations.length !== 1 || !ts.isVariableDeclaration(declarations[0]) || !declarations[0].initializer
@@ -543,22 +409,29 @@ function nullish(ts, checker, expression) {
   return !symbol || (symbol.getDeclarations?.() ?? []).every(declaration => declaration.getSourceFile().isDeclarationFile);
 }
 
-function trueMeansAvailable(ts, checker, condition, identity) {
+/** True when taking `branch` of `condition` proves the declared identity is available. */
+function branchMeansAvailable(ts, checker, condition, identity, branch) {
   condition = unwrapExpression(ts, condition);
   if (expressionReferences(ts, checker, condition, identity) && (ts.isIdentifier(condition)
-    || ts.isPropertyAccessExpression(condition) || ts.isElementAccessExpression(condition))) return true;
+    || ts.isPropertyAccessExpression(condition) || ts.isElementAccessExpression(condition))) return branch;
   if (ts.isPrefixUnaryExpression(condition) && condition.operator === ts.SyntaxKind.ExclamationToken) {
-    const nested = trueMeansAvailable(ts, checker, condition.operand, identity);
-    return nested === null ? null : !nested;
+    return branchMeansAvailable(ts, checker, condition.operand, identity, !branch);
   }
   if (ts.isBinaryExpression(condition)) {
+    const operator = condition.operatorToken.kind;
+    if (operator === ts.SyntaxKind.AmpersandAmpersandToken || operator === ts.SyntaxKind.BarBarToken) {
+      // `a && b` is true only when both sides are true; `a || b` is false only when both sides are false.
+      const decisive = operator === ts.SyntaxKind.AmpersandAmpersandToken ? branch : !branch;
+      return decisive && [condition.left, condition.right]
+        .some(side => branchMeansAvailable(ts, checker, side, identity, branch));
+    }
     const leftIdentity = expressionReferences(ts, checker, condition.left, identity) && nullish(ts, checker, condition.right);
     const rightIdentity = expressionReferences(ts, checker, condition.right, identity) && nullish(ts, checker, condition.left);
-    if (!leftIdentity && !rightIdentity) return null;
-    if ([ts.SyntaxKind.ExclamationEqualsToken, ts.SyntaxKind.ExclamationEqualsEqualsToken].includes(condition.operatorToken.kind)) return true;
-    if ([ts.SyntaxKind.EqualsEqualsToken, ts.SyntaxKind.EqualsEqualsEqualsToken].includes(condition.operatorToken.kind)) return false;
+    if (!leftIdentity && !rightIdentity) return false;
+    if ([ts.SyntaxKind.ExclamationEqualsToken, ts.SyntaxKind.ExclamationEqualsEqualsToken].includes(operator)) return branch;
+    if ([ts.SyntaxKind.EqualsEqualsToken, ts.SyntaxKind.EqualsEqualsEqualsToken].includes(operator)) return !branch;
   }
-  return null;
+  return false;
 }
 
 function violation(config, call, ruleId, message, extra = {}) {
@@ -580,7 +453,7 @@ function isUnshadowedCommonJsRequire(ts, checker, expression, seen = new Set(),
 
 function symbolOfRequireAlias(ts, checker, expression) {
   const symbol = checker.getSymbolAtLocation(expression);
-  return normalizedSymbol(ts, checker, symbol);
+  return normalizedSymbolValue(ts, checker, symbol);
 }
 
 function swrReferences(config, context) {
@@ -621,7 +494,7 @@ function containerSymbolsFromKey(ts, checker, expression, found = new Set(), see
   if (!expression || depth > 12) return found;
   expression = unwrapExpression(ts, expression);
   if (ts.isIdentifier(expression)) {
-    const symbol = symbolAt(ts, checker, expression);
+    const symbol = normalizedSymbol(ts, checker, expression);
     if (!symbol || seen.has(symbol)) return found;
     const initializer = constInitializer(ts, symbol);
     if (!initializer) return found;
@@ -641,7 +514,7 @@ function keyContainerRisks(ts, checker, key, owner) {
     .filter(ts.isVariableDeclaration).map(declaration => declaration.name)));
   const risks = [];
   const visit = node => {
-    if (ts.isIdentifier(node) && symbols.has(symbolAt(ts, checker, node)) && !declarationNames.has(node)
+    if (ts.isIdentifier(node) && symbols.has(normalizedSymbol(ts, checker, node)) && !declarationNames.has(node)
       && !(node.pos >= key.pos && node.end <= key.end)) risks.push(node);
     ts.forEachChild(node, visit);
   };
@@ -687,8 +560,7 @@ function inspectKey(config, context, entry, call, identities, violations, reason
     }
     if (identity.gatesRequest) {
       const gated = active.every(leaf => leaf.decisions.some(decision => {
-        const available = trueMeansAvailable(context.ts, call.checker, decision.condition, identity);
-        return available !== null && decision.branch === available;
+        return branchMeansAvailable(context.ts, call.checker, decision.condition, identity, decision.branch);
       }));
       if (!gated) violations.push(violation(config, call, SWR_KEY_RULE_ID,
         `${entry.id} must produce an explicit null key when ${identity.id} (${identity.binding}) is unavailable.`,

package/runtime/scripts/{checks → hfs}/architecture/owners.mjs

@@ -1,19 +1,29 @@
 import path from 'node:path';
 import { canonical, isInside } from './config.mjs';
-import { relativePath, sourceLocation, workspaceExportSources } from './typescript.mjs';
+import { relativePath, workspaceExportSources } from './typescript.mjs';
+import { sourceLocation } from '../../lib/ts-ast.mjs';
+import { isServerActionModule } from './server-action.mjs';
 
 function absolute(root, relative) {
   return canonical(path.resolve(root, ...relative.split('/')));
 }
 
-/** The owner's public entries: its declared entry, plus every source file its package.json `exports` maps when the owner is a workspace package. */
+/** The extra public entries the slot manifest declares for the owner (slot field `entries`, on the slot that holds its entry file), as absolute paths. */
+function slotEntries(config, owner) {
+  const found = config.hfs?.classifyPath?.(owner.entry);
+  const names = found?.slot ? config.hfs.slot(found.slot)?.entries ?? [] : [];
+  return names.map(name => absolute(config.root, `${found.root}/${name}`));
+}
+
+/** The owner's public entries: its declared entry, the `entries` its slot declares, plus every source file its package.json `exports` maps when the owner is a workspace package. */
 function ownerDeclarations(config, context) {
   return config.owners.map(owner => {
     const root = absolute(config.root, owner.root);
     const entry = absolute(config.root, owner.entry);
     const workspace = context.workspaces?.find(item => item.root === root);
-    const entries = new Set([entry, ...(workspace ? workspaceExportSources(context.ts, workspace) : [])]);
-    return { ...owner, root, entry, entries };
+    const declared = slotEntries(config, owner);
+    const entries = new Set([entry, ...declared, ...(workspace ? workspaceExportSources(context.ts, workspace) : [])]);
+    return { ...owner, root, entry, entries, declared };
   }).sort((a, b) => b.root.length - a.root.length);
 }
 
@@ -21,7 +31,7 @@ function ownerOf(owners, file) {
   return owners.find(owner => isInside(owner.root, file)) ?? null;
 }
 
-function privateOwnerChain(context, owners, edge) {
+function privateOwnerChain(context, owners, actionEntries, edge) {
   const sourceOwner = ownerOf(owners, edge.from);
   const queue = [{ file: edge.to, chain: [edge.from, edge.to] }];
   const visited = new Set();
@@ -30,7 +40,7 @@ function privateOwnerChain(context, owners, edge) {
     if (visited.has(current.file)) continue;
     visited.add(current.file);
     const owner = ownerOf(owners, current.file);
-    if (owner && sourceOwner?.id !== owner.id) return owner.entries.has(current.file) ? null : { owner, chain: current.chain };
+    if (owner && sourceOwner?.id !== owner.id) return owner.entries.has(current.file) || actionEntries.has(current.file) ? null : { owner, chain: current.chain };
     for (const candidate of context.edges.get(current.file) ?? []) if (candidate.reexport) {
       queue.push({ file: candidate.to, chain: [...current.chain, candidate.to] });
     }
@@ -55,6 +65,9 @@ export function checkOwners(config, context) {
   const owners = ownerDeclarations(config, context);
   const violations = [];
   const sourceFiles = new Map(context.files.map(file => [canonical(file.fileName), file]));
+  const actionEntries = new Set(config.kinds.includes('frontend')
+    ? [...sourceFiles].filter(([, file]) => isServerActionModule(context.ts, file)).map(([name]) => name)
+    : []);
   for (const owner of owners) {
     const sourceFile = sourceFiles.get(owner.entry);
     if (!sourceFile) {
@@ -62,20 +75,27 @@ export function checkOwners(config, context) {
         message: `Owner ${owner.id} public entry is outside the configured TypeScript programs, so its boundary cannot be checked.` });
       continue;
     }
-    for (const statement of sourceFile.statements) if (context.ts.isExportDeclaration(statement) && !statement.exportClause) {
-      violations.push({
-        ruleId: 'ARCH_OWNER_EXPORT_STAR',
-        path: relativePath(config.root, owner.entry),
-        ...sourceLocation(sourceFile, statement),
-        owner: owner.id,
-        message: `Owner ${owner.id} public entry must use explicit named exports rather than export *.`
-      });
+    const publicFiles = new Set([
+      sourceFile,
+      ...owner.declared.map(file => sourceFiles.get(file)).filter(Boolean),
+      ...[...actionEntries].filter(file => isInside(owner.root, file)).map(file => sourceFiles.get(file)).filter(Boolean),
+    ]);
+    for (const entryFile of publicFiles) {
+      for (const statement of entryFile.statements) if (context.ts.isExportDeclaration(statement) && !statement.exportClause) {
+        violations.push({
+          ruleId: 'ARCH_OWNER_EXPORT_STAR',
+          path: relativePath(config.root, canonical(entryFile.fileName)),
+          ...sourceLocation(entryFile, statement),
+          owner: owner.id,
+          message: `Owner ${owner.id} public entry must use explicit named exports rather than export *.`
+        });
+      }
     }
   }
   for (const sourceFile of context.files) {
     const from = canonical(sourceFile.fileName);
     for (const edge of context.edges.get(from) ?? []) {
-      const bypass = privateOwnerChain(context, owners, edge);
+      const bypass = privateOwnerChain(context, owners, actionEntries, edge);
       if (!bypass) continue;
       if (arrangesSchema(config, from, bypass.chain.at(-1))) continue;
       violations.push({

package/runtime/scripts/{checks → hfs}/architecture/register-once.mjs

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
+import { isTestWorldSlot } from '../test-world-slot.mjs';
 
 /**
  * R45 `register-once` (BE_MODULE_SHAPE), the module graph read from the app roots (owner rule of 2026-09-30, the
@@ -29,7 +30,7 @@ export function checkRegisterOnce(input) {
   const isAppRoot = file => Boolean(file.slot?.startsWith('be.app.')) && path.posix.basename(file.rel) === 'app.module.ts';
   // The test world (slot be.tests.world) is the test composition root: useTestWorld registers capability modules with
   // `isGlobal: true` the way an app root does. A spec (integration, contract, e2e) is not a composition root.
-  const isWorld = file => file.slot === 'be.tests.world';
+  const isWorld = file => isTestWorldSlot(file.slot);
   const appOf = file => config.apps.find(app => file.rel === `apps/${app.name}/src/app.module.ts`)?.name ?? null;
 
   // Every @Module class of the program.