@starci/hfs 4.0.8 → 4.0.10

package/runtime/scripts/hfs/architecture/schema-owner.mjs

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { machineKit, pascal } from './machine-ast.mjs';
 import { treeOf } from './required-files.mjs';
 import { DATABASE_DIR } from './connection-map.mjs';
+import { collectRegistrations, isPerConnection, persistenceOfFactory } from './context-map.mjs';
 
 /**
  * R35 `schema-owner` (BE_SCHEMA_OWNER, BE-CONVENTION 1.4.6). Schema lives with the capability that owns the table:
@@ -11,7 +12,7 @@ import { DATABASE_DIR } from './connection-map.mjs';
  *     folder named `entities` or `migrations` outside be.persistence is refused too;
  *   - `persistence/connection.ts` declares `<c>Entities` / `<c>Migrations`, the arrays the apps register; a capability has no
  *     `CONNECTION` alias (C0 lead decision 2026-09-30): its connection is the one those arrays are REGISTERED on, in the
- *     `entities` / `migrations` of a connection literal of `DatabaseModule.register` and of the migrate app. The arrays are
+ *     `entities` / `migrations` of a connection literal of `DatabaseModule.register` and of the cli app. The arrays are
  *     registered under exactly one connection across all apps, that connection is declared in hfs.json, and every
  *     `Inject<Conn>EntityManager()` used inside the capability is that same connection;
  *   - the capability's `index.ts` exports `<c>Entities` when it has entities and `<c>Migrations` when it has migrations
@@ -36,13 +37,7 @@ export function checkSchemaOwner(input) {
   const report = (file, node, message, extra = {}) => violations.push({ ruleId: RULE, path: file.rel, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
   const plain = (rel, message, extra = {}) => violations.push({ ruleId: RULE, path: rel, line: 1, column: 1, message, ...extra });
 
-  /** {root, capability, folder, below} of a be.persistence file: `folder` is the directory below persistence/ ('' at its root). */
-  const persistenceOf = rel => {
-    const classified = resolver.classifyPath(rel);
-    if (classified.slot !== PERSISTENCE_SLOT) return null;
-    const below = rel.slice(classified.root.length + 1).split('/');
-    return { root: classified.root, capability: path.posix.basename(path.posix.dirname(classified.root)), folder: below.length > 1 ? below[0] : '', below };
-  };
+  const persistenceOf = persistenceOfFactory(resolver);
 
   let entities = 0;
   let migrations = 0;
@@ -80,7 +75,10 @@ export function checkSchemaOwner(input) {
       const isMigration = heritage(statement).some(expression => kit.isImportOf(checker, expression, 'MigrationInterface', 'typeorm'));
       if (isEntity) {
         entities += 1;
-        if (persistence?.folder !== 'entities') report(file, statement.name, `Entity ${statement.name.text} is declared outside persistence/entities/ of a domain or platform capability; an entity lives with the capability that owns its table, in src/modules/{domain,platform}/<capability>/persistence/entities/<table>.entity.ts.`, { class: statement.name.text });
+        // The table of a projection belongs to the projection that alone writes it: `<name>.projection-entity.ts` of slot be.projections.
+        const ownProjectionTable = resolver.classifyPath(file.rel).slot === 'be.projections' && file.rel.endsWith('.projection-entity.ts');
+        if (ownProjectionTable) note({ root: path.posix.join(path.posix.dirname(file.rel), 'persistence'), capability: path.posix.basename(path.posix.dirname(file.rel)) }, 'entities');
+        else if (persistence?.folder !== 'entities') report(file, statement.name, `Entity ${statement.name.text} is declared outside persistence/entities/ of a domain or platform capability; an entity lives with the capability that owns its table, in src/modules/{domain,platform}/<capability>/persistence/entities/<table>.entity.ts.`, { class: statement.name.text });
         else note(persistence, 'entities');
       }
       if (!isMigration) continue;
@@ -100,124 +98,28 @@ export function checkSchemaOwner(input) {
     }
   }
 
-  // The connection of a capability is where its arrays are registered (no CONNECTION alias in persistence/connection.ts).
-  const unparen = node => { let current = node; while (current && (ts.isParenthesizedExpression(current) || ts.isAsExpression(current) || ts.isSatisfiesExpression?.(current) || ts.isNonNullExpression(current))) current = current.expression; return current; };
-  const returned = declaration => {
-    const fn = ts.isVariableDeclaration(declaration) && declaration.initializer ? unparen(declaration.initializer) : declaration;
-    if (!(ts.isArrowFunction(fn) || ts.isFunctionDeclaration(fn) || ts.isFunctionExpression(fn) || ts.isMethodDeclaration(fn)) || !fn.body) return null;
-    if (!ts.isBlock(fn.body)) return fn.body;
-    const statements = fn.body.statements.filter(ts.isReturnStatement);
-    return statements.length === 1 ? statements[0].expression ?? null : null;
-  };
-  const propertySources = new Map(); // property name -> [{declaration, initializer, checker}] over the program
-  const assignmentsOf = name => {
-    if (propertySources.has(name)) return propertySources.get(name);
-    const list = [];
-    for (const file of graph.files.values()) {
-      if (!file.sourceFile.text.includes(name)) continue;
-      const checker = kit.checkerOf(file.sourceFile);
-      kit.walk(file.sourceFile, node => {
-        if (ts.isPropertyAssignment(node) && kit.propertyNameText(node.name) === name && ts.isObjectLiteralExpression(node.parent)) {
-          // the property of the type the literal is checked against, so a typed const and a typed return meet the same declaration
-          const contextual = checker.getContextualType(node.parent)?.getProperty(name);
-          const symbol = contextual ?? checker.getSymbolAtLocation(node.name);
-          list.push({ declaration: symbol?.declarations?.[0] ?? null, initializer: node.initializer, checker });
-        }
-        return true;
-      });
-    }
-    propertySources.set(name, list);
-    return list;
-  };
-  const nameOfLiteral = (checker, literal, depth) => {
-    const own = kit.propertyOf(literal, 'name');
-    if (own) return kit.stringValue(checker, kit.valueOfProperty(own));
-    for (const property of literal.properties) {
-      if (!ts.isSpreadAssignment(property)) continue;
-      const value = nameOfExpression(checker, property.expression, depth + 1);
-      if (value) return value;
-    }
-    return null;
-  };
-  const nameOfExpression = (checker, expression, depth) => {
-    const node = unparen(expression);
-    if (!node || depth > 5) return null;
-    if (ts.isObjectLiteralExpression(node)) return nameOfLiteral(checker, node, depth);
-    if (ts.isCallExpression(node)) {
-      for (const declaration of kit.declarationsOf(checker, node.expression)) {
-        const body = returned(declaration);
-        const value = body ? nameOfExpression(kit.checkerOf(declaration.getSourceFile()), body, depth + 1) : null;
-        if (value) return value;
-      }
-      return null;
-    }
-    if (ts.isIdentifier(node)) {
-      const declaration = kit.declarationsOf(checker, node)[0];
-      return declaration && ts.isVariableDeclaration(declaration) && declaration.initializer ? nameOfExpression(kit.checkerOf(declaration.getSourceFile()), declaration.initializer, depth + 1) : null;
-    }
-    if (ts.isPropertyAccessExpression(node)) {
-      const target = kit.declarationsOf(checker, node.name)[0];
-      if (!target) return null;
-      const names = new Set(assignmentsOf(node.name.text).filter(item => item.declaration === target).map(item => nameOfExpression(item.checker, item.initializer, depth + 1)).filter(Boolean));
-      return names.size === 1 ? [...names][0] : null;
-    }
-    return null;
-  };
-  /** The capability arrays (`<c>Entities` / `<c>Migrations` of persistence/connection.ts) an expression lists. */
-  const arraysIn = (checker, expression, out, depth) => {
-    const node = unparen(expression);
-    if (!node || depth > 6) return;
-    if (ts.isArrayLiteralExpression(node)) { for (const element of node.elements) arraysIn(checker, ts.isSpreadElement(element) ? element.expression : element, out, depth + 1); return; }
-    if (!ts.isIdentifier(node) && !ts.isPropertyAccessExpression(node)) return;
-    const declaration = kit.declarationsOf(checker, ts.isPropertyAccessExpression(node) ? node.name : node)[0];
-    if (!declaration || !ts.isVariableDeclaration(declaration) || !ts.isIdentifier(declaration.name)) return;
-    const rel = kit.graphPath(declaration);
-    const owner = rel ? persistenceOf(rel) : null;
-    if (owner && owner.below.length === 1 && owner.below[0] === 'connection.ts' && [`${camel(owner.capability)}Entities`, `${camel(owner.capability)}Migrations`].includes(declaration.name.text)) {
-      out.push({ key: path.posix.dirname(owner.root), name: owner.capability });
-    } else if (declaration.initializer) arraysIn(kit.checkerOf(declaration.getSourceFile()), declaration.initializer, out, depth + 1);
-  };
-  const registered = new Map(); // capability root -> {name, connections: Map(connection -> first site)}
-  let registrations = 0;
-  for (const file of graph.files.values()) {
-    const checker = kit.checkerOf(file.sourceFile);
-    kit.walk(file.sourceFile, node => {
-      if (!ts.isObjectLiteralExpression(node)) return true;
-      const arrays = [];
-      for (const key of ['entities', 'migrations']) {
-        const property = kit.propertyOf(node, key);
-        if (property) arraysIn(checker, kit.valueOfProperty(property), arrays, 0);
-      }
-      if (!arrays.length) return true;
-      registrations += 1;
-      const connection = nameOfLiteral(checker, node, 0);
-      if (connection === null) return true;
-      for (const { key, name } of new Map(arrays.map(item => [item.key, item])).values()) {
-        if (!registered.has(key)) registered.set(key, { name, connections: new Map() });
-        const sites = registered.get(key).connections;
-        if (!sites.has(connection)) sites.set(connection, { file, node });
-      }
-      return true;
-    });
-  }
-  for (const { name, connections: sites } of registered.values()) {
+  const { registered, registrations } = collectRegistrations({ kit, graph, persistenceOf });
+  for (const [key, { name, connections: sites }] of registered) {
     for (const [connection, site] of sites) {
       if (!connections.has(connection)) report(site.file, site.node, `The ${name} capability is registered on connection "${connection}", which hfs.json does not declare (declared: ${[...connections].sort().join(', ') || 'none'}); the tables of a capability live on one declared connection.`, { connection, capability: name });
     }
-    if (sites.size > 1) {
+    if (sites.size > 1 && !isPerConnection(resolver, key, name)) {
       const all = [...sites.keys()].sort().join(' and ');
       for (const [connection, site] of [...sites].slice(1)) report(site.file, site.node, `The ${name} capability's entities and migrations are registered on connections ${all}; a capability's tables live on exactly one connection, so register its arrays under one connection across every app.`, { connection, capability: name });
     }
   }
   for (const [key, kinds] of found) {
-    if (!registered.get(key)?.connections.size) plain(`${key}/persistence/connection.ts`, `The ${kinds.name} capability has entities or migrations but no app registers them; add ${camel(kinds.name)}Entities and ${camel(kinds.name)}Migrations to a connection of DatabaseModule.register and of the migrate app.`, { capability: kinds.name });
+    if (!registered.get(key)?.connections.size) plain(`${key}/persistence/connection.ts`, `The ${kinds.name} capability has entities or migrations but no app registers them; add ${camel(kinds.name)}Entities and ${camel(kinds.name)}Migrations to a connection of DatabaseModule.register and of the cli app.`, { capability: kinds.name });
     const connectionFile = graph.files.get(`${key}/persistence/connection.ts`);
     const declared = new Set((connectionFile?.sourceFile.statements.filter(ts.isVariableStatement).flatMap(statement => statement.declarationList.declarations) ?? []).map(item => item.name.text));
     for (const [kind, has] of [['Entities', kinds.entities], ['Migrations', kinds.migrations]]) {
       if (has && !declared.has(`${camel(kinds.name)}${kind}`)) plain(`${key}/persistence/connection.ts`, `${key}/persistence/connection.ts must export ${camel(kinds.name)}${kind}, the ${kind.toLowerCase()} of the ${kinds.name} capability, the one file that lists them for the apps.`, { capability: kinds.name });
     }
     const only = registered.get(key)?.connections;
-    if (!only || only.size !== 1) continue;
+    if (!only || only.size < 1) continue;
+    // A per-connection platform capability (event-bus, jobs) lives on every connection that uses it; any other on exactly one (reported above).
+    const perConnection = only.size > 1 && isPerConnection(resolver, key, kinds.name);
+    if (only.size > 1 && !perConnection) continue;
     const home = [...only.keys()][0];
     for (const file of graph.files.values()) {
       if (!file.rel.startsWith(`${key}/`)) continue;
@@ -227,7 +129,8 @@ export function checkSchemaOwner(input) {
         const declaration = kit.declarationsOf(checker, node.expression)[0];
         const rel = declaration ? kit.graphPath(declaration) : null;
         const used = rel ? [...connections].find(name => rel === `${DATABASE_DIR}/${name}.decorators.ts`) : null;
-        if (used && used !== home) report(file, node, `${file.rel} injects the entity manager of connection ${used}, but the ${kinds.name} capability's tables are registered on ${home}; a capability reads only its own database, so use Inject${pascal(home)}EntityManager or move the tables.`, { connection: used, expected: home, capability: kinds.name });
+        if (used && perConnection && !only.has(used)) report(file, node, `${file.rel} injects the entity manager of connection ${used}, but the ${kinds.name} capability's tables are registered on ${[...only.keys()].sort().join(' and ')}; register the capability on ${used} too or inject one of its connections.`, { connection: used, expected: [...only.keys()].sort().join(','), capability: kinds.name });
+        else if (used && !perConnection && used !== home) report(file, node, `${file.rel} injects the entity manager of connection ${used}, but the ${kinds.name} capability's tables are registered on ${home}; a capability reads only its own database, so use Inject${pascal(home)}EntityManager or move the tables.`, { connection: used, expected: home, capability: kinds.name });
         return true;
       });
     }

package/runtime/scripts/hfs/architecture/server-action.mjs

@@ -0,0 +1,24 @@
+/** The value of a directive-prologue statement, or null once the prologue has ended. */
+function directiveValue(ts, sourceFile, statement) {
+  const expressionStatement = ts?.isExpressionStatement
+    ? ts.isExpressionStatement(statement)
+    : Boolean(statement?.expression);
+  if (!expressionStatement) return null;
+  const expression = statement.expression;
+  if (ts?.isStringLiteral) return ts.isStringLiteral(expression) ? expression.text : null;
+  const raw = expression?.getText?.(sourceFile);
+  const quote = raw?.[0];
+  return typeof expression?.text === 'string' && (quote === "'" || quote === '"') && raw.at(-1) === quote
+    ? expression.text
+    : null;
+}
+
+/** True when a TypeScript source file declares `"use server"` in its directive prologue. */
+export function isServerActionModule(ts, sourceFile) {
+  for (const statement of sourceFile?.statements ?? []) {
+    const value = directiveValue(ts, sourceFile, statement);
+    if (value === null) return false;
+    if (value === 'use server') return true;
+  }
+  return false;
+}

package/runtime/scripts/hfs/architecture/side-boundary.mjs

@@ -0,0 +1,16 @@
+// side-boundary.mjs - what counts as an import that leaves a side of an app (ARCH_INTERNAL_IMPORT_OUTSIDE).
+// A side (be/ or fe/) imports nothing of the app outside itself: the root holds no source and the other side is another program; a
+// declared read of the OTHER side (be/contracts/) is codegen input, never an import. A declared read of a tree the APP ROOT owns
+// (supabase/types/, sides.<side>.reads of the slot manifest) is the one thing both sides do import: the generated database types.
+import path from 'node:path';
+import { isInside, slash } from './config.mjs';
+
+const OTHER_SIDE = /^(be|fe)\//;
+
+/** True when `target` (an absolute path) lies in a tree of the app root that the side declares it reads (`reads` of the side declaration). */
+const readsAppTree = (config, target) => (config.hfs?.repo?.reads ?? [])
+  .some((read) => !OTHER_SIDE.test(read) && isInside(path.join(config.packageRoot, read), target));
+
+/** Whether an import of `target` leaves the side the machine judges (config.root) for the app (config.packageRoot), declared app-root reads excepted. */
+export const crossesSide = (config, target) => config.packageRoot !== undefined && config.packageRoot !== config.root
+  && isInside(config.packageRoot, target) && !isInside(config.root, target) && !slash(target).includes('/node_modules/') && !readsAppTree(config, target);

package/runtime/scripts/hfs/architecture/source-names.mjs

@@ -1,6 +1,8 @@
 import path from 'node:path';
 import { isInside } from './config.mjs';
-import { isUnshadowedCommonJsRequire, relativePath, sourceLocation, UNPROVEN_FRAMEWORK, unwrapExpression } from './typescript.mjs';
+import { relativePath, UNPROVEN_FRAMEWORK, unwrapExpression } from './typescript.mjs';
+import { commonJsRequireReasons, constructedDecoratorKind, decoratorCallee, moduleExportsOf, mutableDecoratorKind, nodeDecorators, normalizedSymbol, normalizedSymbolValue, programSourcesOf, returnedExpressions, selectedNode, tracedFrameworkKinds, valueSymbol, violation } from './ast-walks.mjs';
+import { sourceLocation } from '../../lib/ts-ast.mjs';
 
 const SOURCE_LAYOUT_RULE_ID = 'BE_FEATURE_LAYOUT_INVALID';
 const SOURCE_NAME_RULE_ID = 'BE_SOURCE_FORM';
@@ -9,16 +11,16 @@ const FRAMEWORK_EXPORTS = new Map([
   ['typeorm', new Set(['Entity', 'EntitySchema', 'MigrationInterface', 'ViewEntity'])],
 ]);
 const APPLICATION_ROLES = new Set(['command', 'contracts', 'handler', 'query']);
-const TRANSPORT_ROLES = new Set(['args', 'cli', 'consumer', 'controller', 'gateway', 'input', 'job', 'request', 'resolver', 'response', 'type']);
+const TRANSPORT_ROLES = new Set(['args', 'cli', 'consumer', 'controller', 'gateway', 'input', 'processor', 'request', 'resolver', 'response', 'type']);
 const APPLICATION_LAYER_ROLES = new Set([...APPLICATION_ROLES, 'mapper']);
 const TRANSPORT_LAYER_ROLES = new Set([...TRANSPORT_ROLES, 'enum', 'filter', 'guard', 'interceptor', 'mapper']);
 // Class-bearing roles of the CLOSED suffix list of BE-CONVENTION 1.15 (class name = PascalCase of file + role). A role that is
-// not in that list (adapter, exception, processor, provider, repository, strategy, use-case) is never an allowed role here.
+// not in that list (adapter, exception, provider, repository, strategy, use-case) is never an allowed role here.
 const CLASS_ROLE_SUFFIX = new Map([
   ['args', 'Args'], ['cli', 'Cli'], ['client', 'Client'], ['command', 'Command'], ['consumer', 'Consumer'],
   ['controller', 'Controller'], ['entity', 'Entity'], ['error', 'Error'], ['filter', 'Filter'], ['gateway', 'Gateway'],
-  ['guard', 'Guard'], ['handler', 'Handler'], ['input', 'Input'], ['interceptor', 'Interceptor'], ['job', 'Job'],
-  ['mapper', 'Mapper'], ['module', 'Module'], ['module-definition', 'Module'], ['policy', 'Policy'], ['query', 'Query'],
+  ['guard', 'Guard'], ['handler', 'Handler'], ['input', 'Input'], ['interceptor', 'Interceptor'], ['processor', 'Processor'], ['event', 'Event'], ['queue', 'Queue'],
+  ['projection', 'Projection'], ['projection-entity', 'ProjectionEntity'], ['step', 'Step'], ['mapper', 'Mapper'], ['module', 'Module'], ['module-definition', 'Module'], ['policy', 'Policy'], ['query', 'Query'],
   ['request', 'Request'], ['resolver', 'Resolver'], ['response', 'Response'], ['service', 'Service'], ['type', 'Type'],
 ]);
 // Transport object contracts (interfaces and object aliases) named by their file role: <Action>Input in *.input.ts,
@@ -41,162 +43,40 @@ function canonical(file) {
   return path.resolve(file);
 }
 
-function normalizedSymbolValue(ts, checker, value) {
-  let symbol = value ?? null;
-  const seen = new Set();
-  while (symbol && (symbol.flags & ts.SymbolFlags.Alias) && !seen.has(symbol)) {
-    seen.add(symbol);
-    const target = checker.getAliasedSymbol(symbol);
-    if (!target || target === symbol) break;
-    symbol = target;
-  }
-  return symbol;
-}
-
-function normalizedSymbol(ts, checker, node) {
-  return normalizedSymbolValue(ts, checker, checker?.getSymbolAtLocation(node) ?? null);
-}
 
-function selectedNode(ts, expression) {
-  expression = unwrapExpression(ts, expression);
-  if (ts.isIdentifier(expression)) return expression;
-  if (ts.isPropertyAccessExpression(expression)) return expression.name;
-  if (ts.isElementAccessExpression(expression) && ts.isStringLiteralLike(expression.argumentExpression)) return expression.argumentExpression;
-  return null;
-}
-
-function valueSymbol(ts, checker, node, seen = new Set()) {
-  const selected = selectedNode(ts, node) ?? node;
-  const symbol = normalizedSymbol(ts, checker, selected);
-  if (!symbol || seen.has(symbol)) return symbol;
-  seen.add(symbol);
-  const declarations = symbol.getDeclarations?.() ?? [];
-  if (declarations.length === 1 && ts.isVariableDeclaration(declarations[0]) && declarations[0].initializer
-    && (ts.getCombinedNodeFlags(declarations[0].parent) & ts.NodeFlags.Const)) {
-    return valueSymbol(ts, checker, declarations[0].initializer, seen);
-  }
-  return symbol;
-}
 
 function frameworkTargets(config, context, checker, localFiles) {
-  const bySymbol = new Map();
   const reasons = [];
-  const program = context.programs.find(candidate => candidate.getTypeChecker() === checker);
-  if (!program) return { bySymbol, reasons: ['a TypeScript program checker could not be associated with its source'] };
-  for (const sourceFile of program.getSourceFiles()) {
-    if (!localFiles.has(canonical(sourceFile.fileName))) continue;
+  const bySymbol = new Map();
+  const files = programSourcesOf(context, checker, localFiles);
+  if (!files) return { bySymbol, reasons: ['a TypeScript program checker could not be associated with its source'] };
+  for (const sourceFile of files) {
     for (const statement of sourceFile.statements) {
-      const specifierNode = (context.ts.isImportDeclaration(statement) || context.ts.isExportDeclaration(statement))
-        && statement.moduleSpecifier && context.ts.isStringLiteralLike(statement.moduleSpecifier) ? statement.moduleSpecifier : null;
-      const specifier = specifierNode?.text;
-      if (!specifier || !FRAMEWORK_EXPORTS.has(specifier)) continue;
-      const moduleSymbol = checker.getSymbolAtLocation(specifierNode);
-      if (!moduleSymbol) {
-        reasons.push(`${relativePath(config.root, sourceFile.fileName)} cannot resolve ${specifier}`);
-        continue;
-      }
-      const selected = FRAMEWORK_EXPORTS.get(specifier);
-      for (const exported of checker.getExportsOfModule(moduleSymbol)) if (selected.has(exported.getName())) {
-        const target = normalizedSymbolValue(context.ts, checker, exported);
-        if (target) bySymbol.set(target, exported.getName());
-      }
+      const bound = moduleExportsOf(context.ts, checker, statement);
+      if (!bound || !FRAMEWORK_EXPORTS.has(bound.specifier)) continue;
+      if (!bound.symbol) { reasons.push(`${relativePath(config.root, sourceFile.fileName)} cannot resolve ${bound.specifier}`); continue; }
+      const selected = FRAMEWORK_EXPORTS.get(bound.specifier);
+      for (const [name, target] of bound.exports) if (selected.has(name) && target) bySymbol.set(target, name);
     }
-    const visit = node => {
-      if (context.ts.isCallExpression(node) && isUnshadowedCommonJsRequire(context.ts, checker, node.expression)
-        && node.arguments.length === 1 && context.ts.isStringLiteralLike(node.arguments[0]) && FRAMEWORK_EXPORTS.has(node.arguments[0].text)) {
-        reasons.push(`${relativePath(config.root, sourceFile.fileName)} uses a CommonJS ${node.arguments[0].text} binding whose source role cannot be proved`);
-      }
-      context.ts.forEachChild(node, visit);
-    };
-    visit(sourceFile);
+    commonJsRequireReasons(context.ts, checker, sourceFile, (specifier) => FRAMEWORK_EXPORTS.has(specifier),
+      reasons, relativePath(config.root, sourceFile.fileName), 'binding whose source role cannot be proved');
   }
   return { bySymbol, reasons };
 }
 
-function calledExpression(ts, decorator) {
-  return ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
-}
-
 function decoratorKind(ts, checker, decorator, targets) {
-  const selected = selectedNode(ts, calledExpression(ts, decorator));
+  const selected = selectedNode(ts, decoratorCallee(ts, decorator));
   return selected ? targets.get(valueSymbol(ts, checker, selected)) ?? null : null;
 }
 
-function mutableDecoratorKind(ts, checker, decorator, targets) {
-  const selected = selectedNode(ts, calledExpression(ts, decorator));
-  const symbol = selected ? normalizedSymbol(ts, checker, selected) : null;
-  const declarations = symbol?.getDeclarations?.() ?? [];
-  if (declarations.length !== 1 || !ts.isVariableDeclaration(declarations[0]) || !declarations[0].initializer
-    || (ts.getCombinedNodeFlags(declarations[0].parent) & ts.NodeFlags.Const)) return null;
-  return targets.get(valueSymbol(ts, checker, declarations[0].initializer)) ?? null;
-}
-
-function returnedExpressions(ts, declaration) {
-  if ((ts.isArrowFunction(declaration) || ts.isFunctionExpression(declaration)) && !ts.isBlock(declaration.body)) return [declaration.body];
-  const body = ts.isFunctionDeclaration(declaration) || ts.isMethodDeclaration(declaration)
-    || ts.isArrowFunction(declaration) || ts.isFunctionExpression(declaration) ? declaration.body : null;
-  if (!body || !ts.isBlock(body)) return [];
-  const returned = [];
-  const visit = node => {
-    if (node !== body && (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node) || ts.isMethodDeclaration(node))) return;
-    if (ts.isReturnStatement(node) && node.expression) returned.push(node.expression);
-    else ts.forEachChild(node, visit);
-  };
-  visit(body);
-  return returned;
-}
-
-function tracedFrameworkKinds(ts, checker, expression, targets, seen = new Set(), depth = 0) {
-  if (!expression) return new Set();
-  if (depth > 10) return new Set([UNPROVEN_FRAMEWORK]);
-  expression = unwrapExpression(ts, expression);
-  const selected = selectedNode(ts, expression);
-  const symbol = selected ? normalizedSymbol(ts, checker, selected) : null;
-  const direct = symbol ? targets.get(symbol) : null;
-  if (direct) return new Set([direct]);
-  if (ts.isArrowFunction(expression) || ts.isFunctionExpression(expression)) {
-    const kinds = new Set();
-    for (const returned of returnedExpressions(ts, expression)) {
-      for (const kind of tracedFrameworkKinds(ts, checker, returned, targets, seen, depth + 1)) kinds.add(kind);
-    }
-    return kinds;
-  }
-  if (ts.isCallExpression(expression)) {
-    const kinds = tracedFrameworkKinds(ts, checker, expression.expression, targets, seen, depth + 1);
-    if (kinds.size) return kinds;
-  }
-  if (ts.isNewExpression(expression)) return tracedFrameworkKinds(ts, checker, expression.expression, targets, seen, depth + 1);
-  if (!symbol || seen.has(symbol)) return new Set();
-  const nextSeen = new Set(seen).add(symbol);
-  const kinds = new Set();
-  for (const declaration of symbol.getDeclarations?.() ?? []) {
-    if (ts.isVariableDeclaration(declaration) && declaration.initializer) {
-      for (const kind of tracedFrameworkKinds(ts, checker, declaration.initializer, targets, nextSeen, depth + 1)) kinds.add(kind);
-    }
-    for (const returned of returnedExpressions(ts, declaration)) {
-      for (const kind of tracedFrameworkKinds(ts, checker, returned, targets, nextSeen, depth + 1)) kinds.add(kind);
-    }
-  }
-  return kinds;
-}
-
-function constructedDecoratorKind(ts, checker, decorator, targets) {
-  const kinds = tracedFrameworkKinds(ts, checker, calledExpression(ts, decorator), targets);
-  if (kinds.has(UNPROVEN_FRAMEWORK)) return 'unproven framework';
-  return kinds.size === 1 ? [...kinds][0] : kinds.size ? 'multiple framework' : null;
-}
-
-function decorators(ts, node) {
-  return ts.canHaveDecorators(node) ? ts.getDecorators(node) ?? [] : node.decorators ?? [];
-}
+/* This module's trace descends `new X()` callees too; the framework map keys symbols directly. */
+const TRACE_NEW = { newExpression: true };
 
 function hasModifier(ts, node, kind) {
   return (ts.canHaveModifiers(node) ? ts.getModifiers(node) ?? [] : node.modifiers ?? []).some(modifier => modifier.kind === kind);
 }
 
-function violation(config, sourceFile, node, ruleId, message, extra = {}) {
-  return { ruleId, path: relativePath(config.root, sourceFile.fileName), ...sourceLocation(sourceFile, node), message, ...extra };
-}
+
 
 function sourceRole(ts, sourceFile) {
   const file = path.basename(sourceFile.fileName).replace(SOURCE_EXTENSION, '');
@@ -304,7 +184,7 @@ function companionInterfaceAllowed(ts, sourceFile, name) {
   if (!/^I[A-Z]/.test(name)) return false;
   const companion = name.slice(1);
   return sourceFile.statements.some(statement => ts.isClassDeclaration(statement) && statement.name?.text === companion
-    && decorators(ts, statement).length > 0);
+    && nodeDecorators(ts, statement).length > 0);
 }
 
 function camelCase(value) {
@@ -485,7 +365,7 @@ export function checkBackendSourceShape(config, context) {
 
     const classDeclarations = sourceFile.statements.filter(statement => ts.isClassDeclaration(statement));
     for (const declaration of classDeclarations) {
-      const declarationDecorators = decorators(ts, declaration);
+      const declarationDecorators = nodeDecorators(ts, declaration);
       const kinds = declarationDecorators.map(decorator => decoratorKind(ts, checker, decorator, framework.bySymbol)).filter(Boolean);
       const graphQlDto = kinds.some(kind => kind === 'ArgsType' || kind === 'InputType' || kind === 'ObjectType');
       if (graphQlDto && (!featureRoot || !inTransport || directories[transportIndex + 1] !== 'graphql')) {
@@ -551,11 +431,11 @@ export function checkBackendSourceShape(config, context) {
     }
 
     const visit = node => {
-      for (const decorator of decorators(ts, node)) {
+      for (const decorator of nodeDecorators(ts, node)) {
         const kind = decoratorKind(ts, checker, decorator, framework.bySymbol);
         if (!kind) {
           const dynamic = mutableDecoratorKind(ts, checker, decorator, framework.bySymbol)
-            ?? constructedDecoratorKind(ts, checker, decorator, framework.bySymbol);
+            ?? constructedDecoratorKind(ts, checker, decorator, framework.bySymbol, TRACE_NEW);
           if (dynamic) {
             const detail = `${relative} uses a mutable or constructed ${dynamic} decorator identity`;
             if (['Entity', 'ViewEntity', 'ArgsType', 'InputType', 'ObjectType', 'multiple framework', 'unproven framework'].includes(dynamic)) layoutReasons.push(detail);
@@ -574,7 +454,7 @@ export function checkBackendSourceShape(config, context) {
       }
       const exportedFactoryCall = ts.isCallExpression(node) && ts.isVariableDeclaration(node.parent) && publicDeclarations.has(node.parent);
       if ((ts.isNewExpression(node) || exportedFactoryCall) && featureRoot) {
-        const constructed = tracedFrameworkKinds(ts, checker, node, framework.bySymbol);
+        const constructed = tracedFrameworkKinds(ts, checker, node, framework.bySymbol, TRACE_NEW);
         if (constructed.has('EntitySchema')) violations.push(violation(config, sourceFile, node.expression, SOURCE_LAYOUT_RULE_ID,
           'TypeORM EntitySchema cannot be owned by a feature; place schema under its declared persistence module.'));
         if (constructed.has(UNPROVEN_FRAMEWORK)) layoutReasons.push(`${relative} has a constructed provider identity beyond the bounded static trace`);

package/runtime/scripts/hfs/architecture/sql-owner.mjs

@@ -1,16 +1,19 @@
 import path from 'node:path';
 import { analyzeSql, HOLE } from './sql-tokens.mjs';
 import { machineKit } from './machine-ast.mjs';
+import { contextModelOf } from './context-map.mjs';
+import { supabaseTablesOf } from './supabase-tables.mjs';
 
 /**
  * R86 `sql-owner` (BE_SQL_TABLE_OWNER). Every `sql` tagged template (the tag declared in platform/database) of a
  * `<name>.sql.ts` file in a capability's `persistence/` is read with the tokenizer of sql-tokens.mjs and judged against the
- * entities of the whole program:
- *   - it writes (INSERT INTO, UPDATE, DELETE FROM, MERGE INTO, TRUNCATE) only tables the file's own capability declares
- *     with `@Entity("<table>")` in its persistence;
- *   - it reads (FROM, JOIN, USING) only tables of capabilities its owner may import (the tier matrix, through
- *     `resolver.importAllowed` to the table owner's public entry) or its own;
- *   - every table it names is declared by some entity;
+ * schema authority of the whole program:
+ *   - it writes (INSERT INTO, UPDATE, DELETE FROM, MERGE INTO, TRUNCATE) only tables the file's own capability declares;
+ *   - it reads (FROM, JOIN, USING) only tables of its own CONTEXT (the connection its capability's arrays are registered on): its own
+ *     capability's, or those of a same-context capability its owner may import (the tier matrix, through `resolver.importAllowed`
+ *     to the table owner's public entry); a table of another context is refused (cross-context data comes only by events);
+ *   - every table it names is declared by some entity under TypeORM authority, or by the generated
+ *     `Database['public']['Tables']` contract under Supabase authority;
  *   - a SELECT carries LIMIT, or constrains the primary key or a unique key of its first table with `=`, or selects only
  *     aggregates without GROUP BY.
  * Table positions that hold a `${...}` substitution (SqlIdent) are dynamic; they are counted in the coverage and judged by
@@ -28,7 +31,7 @@ const literalStrings = (ts, node) => {
   return null;
 };
 
-function entitiesOf(kit, graph) {
+export function entitiesOf(kit, graph) {
   const { ts } = kit;
   const tables = new Map();
   let unreadable = 0;
@@ -90,11 +93,29 @@ function entitiesOf(kit, graph) {
   return { tables, unreadable };
 }
 
+const capabilityTable = root => path.posix.basename(root).replaceAll('-', '_').toLowerCase();
+
+/** Supabase declarations, with an owner when the generated table name matches a capability's persistence folder. */
+function supabaseDeclarations(graph, appRoot, ts) {
+  const generated = supabaseTablesOf(appRoot, ts);
+  const tables = new Map([...generated].map(table => [table, { table, owner: null, rel: null, uniqueSets: [] }]));
+  for (const file of graph.files.values()) {
+    if (file.slot !== 'be.persistence' || !file.owner) continue;
+    const key = capabilityTable(file.owner.root);
+    const declaration = tables.get(key);
+    if (declaration && declaration.owner === null) tables.set(key, { ...declaration, owner: file.owner.root, rel: file.rel });
+  }
+  return tables;
+}
+
 export function checkSqlOwner(input) {
-  const { graph } = input;
+  const { config, graph } = input;
   const kit = machineKit(input);
   const { ts, resolver } = kit;
-  const { tables, unreadable } = entitiesOf(kit, graph);
+  const supabase = resolver.ruleParams().schemaAuthority === 'supabase';
+  const entityDeclarations = supabase ? { tables: new Map(), unreadable: 0 } : entitiesOf(kit, graph);
+  const tables = supabase ? supabaseDeclarations(graph, config.packageRoot, ts) : entityDeclarations.tables;
+  const model = contextModelOf(kit, graph);
   const violations = [];
   let templates = 0;
   let dynamic = 0;
@@ -119,17 +140,36 @@ export function checkSqlOwner(input) {
       };
       const result = analyzeSql(text, { uniqueSetsOf: table => tables.get(table.toLowerCase())?.uniqueSets ?? null });
       dynamic += result.dynamic;
+      const ownTable = capabilityTable(file.owner.root);
       for (const write of result.writes) {
-        const entity = tables.get(write.table.toLowerCase());
-        if (!entity) report(`SQL writes table ${write.table}, which no @Entity declares; declare the entity in the owning capability's persistence/entities.`, { table: write.table });
-        else if (entity.owner !== file.owner.root) report(`SQL in ${file.owner.root} writes table ${write.table}, owned by ${entity.owner}; a capability writes only the tables of its own entities, call the owner's public API instead.`, { table: write.table, tableOwner: entity.owner });
+        const declaration = tables.get(write.table.toLowerCase());
+        if (!declaration) {
+          report(supabase
+            ? `SQL writes table ${write.table}, which Database['public']['Tables'] does not declare; regenerate supabase/types/database.types.ts from the migrations.`
+            : `SQL writes table ${write.table}, which no @Entity declares; declare the entity in the owning capability's persistence/entities.`, { table: write.table });
+        } else if (supabase && write.table.toLowerCase() !== ownTable) {
+          report(`SQL in ${file.owner.root} writes table ${write.table}${declaration.owner ? `, owned by ${declaration.owner}` : ''}; under Supabase schema authority a capability writes only its own table (${ownTable}), named for that capability.`, { table: write.table, ...(declaration.owner ? { tableOwner: declaration.owner } : {}) });
+        } else if (!supabase && declaration.owner !== file.owner.root) {
+          report(`SQL in ${file.owner.root} writes table ${write.table}, owned by ${declaration.owner}; a capability writes only the tables of its own entities, call the owner's public API instead.`, { table: write.table, tableOwner: declaration.owner });
+        }
       }
       for (const read of result.reads) {
-        const entity = tables.get(read.table.toLowerCase());
-        if (!entity) { report(`SQL reads table ${read.table}, which no @Entity declares; declare the entity in the owning capability's persistence/entities.`, { table: read.table }); continue; }
-        if (entity.owner === file.owner.root) continue;
-        const verdict = resolver.importAllowed(file.rel, `${entity.owner}/index.ts`);
-        if (!verdict.allowed) report(`SQL in ${file.owner.root} reads table ${read.table}, owned by ${entity.owner}, which ${file.owner.root} may not import (${verdict.reason}); read it through the owner's public API.`, { table: read.table, tableOwner: entity.owner, reason: verdict.reason });
+        const declaration = tables.get(read.table.toLowerCase());
+        if (!declaration) {
+          report(supabase
+            ? `SQL reads table ${read.table}, which Database['public']['Tables'] does not declare; regenerate supabase/types/database.types.ts from the migrations.`
+            : `SQL reads table ${read.table}, which no @Entity declares; declare the entity in the owning capability's persistence/entities.`, { table: read.table });
+          continue;
+        }
+        if (!declaration.owner || declaration.owner === file.owner.root) continue;
+        const ownContext = model.contextOfCapability(file.owner.root);
+        const tableContext = model.contextOfCapability(declaration.owner);
+        if (ownContext && tableContext && ownContext !== tableContext) {
+          report(`SQL in ${file.owner.root} (context ${ownContext}) reads table ${read.table}, owned by ${declaration.owner} (context ${tableContext}); a context reads and writes only its own context's tables, so a cross-context JOIN or subquery is refused. Keep a local copy fed by the other context's events (a reactor), or read a projection.`, { table: read.table, tableOwner: declaration.owner, context: ownContext, tableContext });
+          continue;
+        }
+        const verdict = resolver.importAllowed(file.rel, `${declaration.owner}/index.ts`);
+        if (!verdict.allowed) report(`SQL in ${file.owner.root} reads table ${read.table}, owned by ${declaration.owner}, which ${file.owner.root} may not import (${verdict.reason}); read it through the owner's public API.`, { table: read.table, tableOwner: declaration.owner, reason: verdict.reason });
       }
       for (const select of result.selects) {
         if (select.bounded || (select.table && !tables.has(select.table.toLowerCase()))) continue;
@@ -138,5 +178,6 @@ export function checkSqlOwner(input) {
       return true;
     });
   }
-  return { violations, coverage: { status: 'checked', entities: tables.size, unreadableEntities: unreadable, templates, dynamicIdentifiers: dynamic, foreignTags } };
+  return { violations, coverage: { status: 'checked', entities: entityDeclarations.tables.size, unreadableEntities: entityDeclarations.unreadable,
+    ...(supabase ? { supabaseTables: tables.size } : {}), templates, dynamicIdentifiers: dynamic, foreignTags } };
 }