@starci/hfs 4.0.9 → 4.1.0

package/runtime/scripts/hfs/architecture/tiers.mjs

@@ -1,4 +1,5 @@
 import { isServerActionModule } from './server-action.mjs';
+import { byCodeUnit } from '../../lib/list.mjs';
 
 /**
  * HFS checks 1 and 2 (knowledge/hfs/slots.yaml `tiers`):
@@ -21,40 +22,61 @@ const REASON_TEXT = {
 };
 
 /** Strongly connected components (Tarjan, iterative) of `adjacency` (Map<node, Set<node>>); components of one node are dropped. */
+function startTraversal(state, adjacency, node) {
+  const at = state.counter;
+  state.counter += 1;
+  state.index.set(node, at);
+  state.low.set(node, at);
+  state.stack.push(node);
+  state.onStack.add(node);
+  state.work.push({ node, iterator: adjacency.get(node)[Symbol.iterator]() });
+}
+
+function visitTarget(state, adjacency, frame, target) {
+  if (!adjacency.has(target)) return;
+  if (!state.index.has(target)) {
+    startTraversal(state, adjacency, target);
+    return;
+  }
+  if (state.onStack.has(target)) state.low.set(frame.node, Math.min(state.low.get(frame.node), state.index.get(target)));
+}
+
+function closeComponent(state, frame) {
+  const component = [];
+  let member;
+  do {
+    member = state.stack.pop();
+    state.onStack.delete(member);
+    component.push(member);
+  } while (member !== frame.node);
+  if (component.length > 1) state.result.push(component);
+}
+
+function finishFrame(state, frame) {
+  state.work.pop();
+  if (state.work.length) {
+    const parent = state.work.at(-1).node;
+    state.low.set(parent, Math.min(state.low.get(parent), state.low.get(frame.node)));
+  }
+  if (state.low.get(frame.node) === state.index.get(frame.node)) closeComponent(state, frame);
+}
+
 export function stronglyConnected(adjacency) {
-  let counter = 0;
-  const index = new Map();
-  const low = new Map();
-  const onStack = new Set();
-  const stack = [];
-  const result = [];
+  const state = { counter: 0, index: new Map(), low: new Map(), onStack: new Set(), stack: [], result: [], work: [] };
   for (const start of adjacency.keys()) {
-    if (index.has(start)) continue;
-    const work = [{ node: start, iterator: adjacency.get(start)[Symbol.iterator]() }];
-    index.set(start, counter); low.set(start, counter); counter += 1; stack.push(start); onStack.add(start);
-    while (work.length) {
-      const frame = work.at(-1);
+    if (state.index.has(start)) continue;
+    startTraversal(state, adjacency, start);
+    while (state.work.length) {
+      const frame = state.work.at(-1);
       const next = frame.iterator.next();
-      if (!next.done) {
-        const target = next.value;
-        if (!adjacency.has(target)) continue;
-        if (!index.has(target)) {
-          index.set(target, counter); low.set(target, counter); counter += 1; stack.push(target); onStack.add(target);
-          work.push({ node: target, iterator: adjacency.get(target)[Symbol.iterator]() });
-        } else if (onStack.has(target)) low.set(frame.node, Math.min(low.get(frame.node), index.get(target)));
+      if (next.done) {
+        finishFrame(state, frame);
         continue;
       }
-      work.pop();
-      if (work.length) { const parent = work.at(-1).node; low.set(parent, Math.min(low.get(parent), low.get(frame.node))); }
-      if (low.get(frame.node) === index.get(frame.node)) {
-        const component = [];
-        let member;
-        do { member = stack.pop(); onStack.delete(member); component.push(member); } while (member !== frame.node);
-        if (component.length > 1) result.push(component);
-      }
+      visitTarget(state, adjacency, frame, next.value);
     }
   }
-  return result;
+  return state.result;
 }
 
 /** A shortest cycle through `origin` inside `members`, as a node path that starts and ends at origin. */
@@ -95,47 +117,57 @@ const blockCallsServerAction = (graph, edge) => {
   return from.slot === 'fe.components' && from.kind === 'blocks' && from.role === 'entry';
 };
 
-export function checkTiers(graph) {
-  const { resolver, profile } = graph;
-  const violations = [];
-  const tierRule = profile === 'be' ? 'BE_TIER_DIRECTION' : 'FE_TIER_DIRECTION';
-  let edgesChecked = 0;
-  let unclassified = 0;
-  const counts = { tierDirection: 0, layerOrder: 0, crossApp: 0 };
-  for (const edge of graph.edges) {
-    const verdict = resolver.importAllowed(edge.from, edge.to);
-    if (verdict.reason === 'unowned' || verdict.reason?.startsWith('slot')) { unclassified += 1; continue; }
-    edgesChecked += 1;
-    const actionTarget = serverActionTarget(graph, edge);
-    if ((verdict.allowed || verdict.reason === 'notPublicEntry') && actionTarget && graph.unit(edge.from) !== graph.unit(edge.to) && !blockCallsServerAction(graph, edge)) {
-      counts.tierDirection += 1;
-      violations.push({
-        ruleId: tierRule,
-        path: edge.from, line: edge.line, column: edge.column,
-        specifier: edge.specifier, resolvedPath: edge.to, typeOnly: !edge.runtime,
-        fromTier: resolver.tierOf(edge.from), toTier: resolver.tierOf(edge.to),
-        message: `${edge.from} -> ${edge.to}: a db Server Action is called directly only by a connected block entry; hooks and other tiers use their declared data path${edge.runtime ? '' : ' (type-only imports count)'}.`,
-      });
-      continue;
-    }
-    if (verdict.allowed || (verdict.reason === 'tierDirection' && blockCallsServerAction(graph, edge)) || !REASON_TEXT[verdict.reason]) continue;
-    counts[verdict.reason] += 1;
-    const featureToFeature = profile === 'be' && verdict.reason === 'tierDirection' && verdict.fromTier === 'feature' && verdict.toTier === 'feature';
-    const fromKind = featureToFeature ? triggerOf(resolver, edge.from) : null;
-    const toKind = featureToFeature ? triggerOf(resolver, edge.to) : null;
-    const crossKind = fromKind !== null && toKind !== null && fromKind !== toKind;
-    violations.push({
-      ruleId: verdict.reason === 'crossApp' ? 'FE_APP_ISOLATION' : crossKind ? 'BE_KIND_ISOLATION' : featureToFeature ? 'BE_FEATURE_IMPORTS_FEATURE' : tierRule,
-      path: edge.from, line: edge.line, column: edge.column,
-      specifier: edge.specifier, resolvedPath: edge.to, typeOnly: !edge.runtime,
-      fromTier: verdict.fromTier ?? null, toTier: verdict.toTier ?? null,
-      message: crossKind
-        ? `${edge.from} -> ${edge.to}: a ${fromKind} feature imports a ${toKind} feature; no kind imports another, every cross-kind call is an event published with eventBus.publish(event, tx) from a domain service${edge.runtime ? '' : ' (type-only imports count)'}.`
-        : `${edge.from} -> ${edge.to}: ${REASON_TEXT[verdict.reason](verdict)}${edge.runtime ? '' : ' (type-only imports count)'}.`,
-    });
+function reportDirectServerAction(graph, edge, verdict, actionTarget, tierRule, counts, violations) {
+  if (!(verdict.allowed || verdict.reason === 'notPublicEntry') || !actionTarget
+    || graph.unit(edge.from) === graph.unit(edge.to) || blockCallsServerAction(graph, edge)) return false;
+  counts.tierDirection += 1;
+  violations.push({
+    ruleId: tierRule,
+    path: edge.from, line: edge.line, column: edge.column,
+    specifier: edge.specifier, resolvedPath: edge.to, typeOnly: !edge.runtime,
+    fromTier: graph.resolver.tierOf(edge.from), toTier: graph.resolver.tierOf(edge.to),
+    message: `${edge.from} -> ${edge.to}: a db Server Action is called directly only by a connected block entry; hooks and other tiers use their declared data path${edge.runtime ? '' : ' (type-only imports count)'}.`,
+  });
+  return true;
+}
+
+function reportReasonedTierViolation(graph, edge, verdict, tierRule, counts, violations) {
+  if (verdict.allowed || (verdict.reason === 'tierDirection' && blockCallsServerAction(graph, edge)) || !REASON_TEXT[verdict.reason]) return;
+  counts[verdict.reason] += 1;
+  const featureToFeature = graph.profile === 'be' && verdict.reason === 'tierDirection' && verdict.fromTier === 'feature' && verdict.toTier === 'feature';
+  const fromKind = featureToFeature ? triggerOf(graph.resolver, edge.from) : null;
+  const toKind = featureToFeature ? triggerOf(graph.resolver, edge.to) : null;
+  const crossKind = fromKind !== null && toKind !== null && fromKind !== toKind;
+  let ruleId = tierRule;
+  if (featureToFeature) ruleId = 'BE_FEATURE_IMPORTS_FEATURE';
+  if (crossKind) ruleId = 'BE_KIND_ISOLATION';
+  if (verdict.reason === 'crossApp') ruleId = 'FE_APP_ISOLATION';
+  const typeOnly = edge.runtime ? '' : ' (type-only imports count)';
+  const message = crossKind
+    ? `${edge.from} -> ${edge.to}: a ${fromKind} feature imports a ${toKind} feature; no kind imports another, every cross-kind call is an event published with eventBus.publish(event, tx) from a domain service${typeOnly}.`
+    : `${edge.from} -> ${edge.to}: ${REASON_TEXT[verdict.reason](verdict)}${typeOnly}.`;
+  violations.push({
+    ruleId,
+    path: edge.from, line: edge.line, column: edge.column,
+    specifier: edge.specifier, resolvedPath: edge.to, typeOnly: !edge.runtime,
+    fromTier: verdict.fromTier ?? null, toTier: verdict.toTier ?? null,
+    message,
+  });
+}
+
+function inspectTierEdge(graph, edge, tierRule, counts, violations, coverage) {
+  const verdict = graph.resolver.importAllowed(edge.from, edge.to);
+  if (verdict.reason === 'unowned' || verdict.reason?.startsWith('slot')) {
+    coverage.unclassifiedEdges += 1;
+    return;
   }
+  coverage.edgesChecked += 1;
+  const actionTarget = serverActionTarget(graph, edge);
+  if (reportDirectServerAction(graph, edge, verdict, actionTarget, tierRule, counts, violations)) return;
+  reportReasonedTierViolation(graph, edge, verdict, tierRule, counts, violations);
+}
 
-  // Owner cycles: nodes are owner units, edges the imports between two distinct units.
+function ownerAdjacency(graph, resolver) {
   const adjacency = new Map();
   const witness = new Map();
   for (const edge of graph.edges) {
@@ -148,25 +180,44 @@ export function checkTiers(graph) {
     adjacency.get(a).add(b);
     if (!witness.has(`${a}\0${b}`)) witness.set(`${a}\0${b}`, edge);
   }
+  return { adjacency, witness };
+}
+
+function addOwnerCycleViolations(graph, adjacency, witness, violations) {
   const components = stronglyConnected(adjacency);
   for (const component of components) {
     const members = new Set(component);
-    const origin = [...component].sort()[0];
+    const origin = [...component].sort(byCodeUnit)[0];
     const cycle = cycleThrough(adjacency, members, origin);
     const hops = cycle.slice(0, -1).map((unit, i) => witness.get(`${unit}\0${cycle[i + 1]}`));
     const label = unit => unit.slice(unit.indexOf(':') + 1) || unit;
     const first = hops[0];
+    const connectedOwners = component.length > cycle.length - 1 ? ` (strongly connected with ${component.length} owners)` : '';
     violations.push({
       ruleId: 'ARCH_OWNER_CYCLE',
       path: first.from, line: first.line, column: first.column,
       cycle: cycle.map(label),
       cycleImports: hops.map(hop => ({ path: hop.from, line: hop.line, specifier: hop.specifier, typeOnly: !hop.runtime })),
       componentSize: component.length,
-      message: `Owner cycle: ${cycle.map(label).join(' -> ')}${component.length > cycle.length - 1 ? ` (strongly connected with ${component.length} owners)` : ''}; type-only imports count.`,
+      message: `Owner cycle: ${cycle.map(label).join(' -> ')}${connectedOwners}; type-only imports count.`,
     });
   }
+  return components.length;
+}
+
+export function checkTiers(graph) {
+  const { resolver, profile } = graph;
+  const violations = [];
+  const tierRule = profile === 'be' ? 'BE_TIER_DIRECTION' : 'FE_TIER_DIRECTION';
+  const coverage = { edgesChecked: 0, unclassifiedEdges: 0 };
+  const counts = { tierDirection: 0, layerOrder: 0, crossApp: 0 };
+  for (const edge of graph.edges) inspectTierEdge(graph, edge, tierRule, counts, violations, coverage);
+
+  // Owner cycles: nodes are owner units, edges the imports between two distinct units.
+  const { adjacency, witness } = ownerAdjacency(graph, resolver);
+  const cycles = addOwnerCycleViolations(graph, adjacency, witness, violations);
   return {
     violations,
-    coverage: { status: 'checked', edgesChecked, unclassifiedEdges: unclassified, ownerUnits: adjacency.size, cycles: components.length, ...counts },
+    coverage: { status: 'checked', ...coverage, ownerUnits: adjacency.size, cycles, ...counts },
   };
 }

package/runtime/scripts/hfs/architecture/transport-owner.mjs

@@ -33,74 +33,80 @@ const PACKAGE_API_SLOT = 'fe.package.api';
 const CLIENT_SLOTS = new Set([APP_CLIENT_SLOT, 'fe.package.api.client']);
 const NO_CLIENT = "the repository has no transport client. Create the one client (packages/<family>-api/src/client.ts, or the only app's modules/api/client.ts) and call it.";
 
-export function checkTransportOwner(input) {
-  const { graph } = input;
-  const kit = machineKit(input);
-  const { ts, resolver } = kit;
-  const violations = [];
-  const report = (file, node, message, extra = {}) => violations.push({ ruleId: RULE, path: file.rel, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
-  const nextApps = resolver.repo.apps.filter(item => item.kind === 'next');
-  let readers = 0;
+/** True when `node` names the global fetch: no import, and no declaration outside a lib declaration file. */
+function isGlobalObjectFetch(ts, node) {
+  return ts.isPropertyAccessExpression(node) && node.name.text === 'fetch' && ts.isIdentifier(node.expression) && GLOBAL_OBJECTS.has(node.expression.text);
+}
 
-  /** True when `node` names the global fetch: no import, and no declaration outside a lib declaration file. */
-  const isGlobalFetch = (checker, node) => {
-    if (ts.isIdentifier(node)) {
-      if (node.text !== 'fetch' || kit.importBinding(checker, node)) return false;
-      const parent = node.parent;
-      if (ts.isPropertyAccessExpression(parent) && parent.name === node) return false;
-      // A type position (`typeof fetch`, `typeof globalThis.fetch`) names the type of fetch and sends nothing.
-      if (ts.isTypeQueryNode(parent) || ts.isQualifiedName(parent)) return false;
-      if ((ts.isPropertyAssignment(parent) || ts.isPropertyDeclaration(parent) || ts.isMethodDeclaration(parent) || ts.isBindingElement(parent) || ts.isParameter(parent) || ts.isVariableDeclaration(parent)) && parent.name === node) return false;
-      if (ts.isImportSpecifier(parent) || ts.isExportSpecifier(parent) || ts.isPropertySignature(parent)) return false;
-      const declarations = kit.declarationsOf(checker, node);
-      return declarations.every(declaration => declaration.getSourceFile().isDeclarationFile);
-    }
-    return ts.isPropertyAccessExpression(node) && node.name.text === 'fetch' && ts.isIdentifier(node.expression) && GLOBAL_OBJECTS.has(node.expression.text);
-  };
+function isDeclarationName(ts, parent, node) {
+  return (ts.isPropertyAssignment(parent) || ts.isPropertyDeclaration(parent) || ts.isMethodDeclaration(parent) || ts.isBindingElement(parent) || ts.isParameter(parent) || ts.isVariableDeclaration(parent)) && parent.name === node;
+}
 
-  const files = [...graph.files.values()].filter(file => file.slot && file.tier !== 'e2e');
-  const clients = files.filter(file => CLIENT_SLOTS.has(file.slot));
-  const outcomes = files.filter(file => resolver.slot(file.slot)?.outcomeHome === true);
-  const clientRels = new Set(clients.map(file => file.rel));
-  const list = items => items.map(item => item.rel).join(', ');
-  const owned = clients.length ? `the repository has one transport (${list(clients)}). Call the client and take its Outcome.` : NO_CLIENT;
+function isTypeOrImportPosition(ts, parent) {
+  return ts.isTypeQueryNode(parent) || ts.isQualifiedName(parent) || ts.isImportSpecifier(parent) || ts.isExportSpecifier(parent) || ts.isPropertySignature(parent);
+}
 
-  // Exactly one client and one Outcome union per repository.
-  for (const [items, noun] of [[clients, 'transport client'], [outcomes, 'Outcome union']]) {
-    for (const file of items) {
-      if (items.length > 1) report(file, file.sourceFile, `The repository has ${items.length} ${noun}s (${list(items)}); it has exactly one: the api package's (packages/<family>-api/src/) when the apps share it, or the only app's. Keep one and delete the others.`);
-      else if ((file.slot === APP_CLIENT_SLOT || file.slot === APP_OUTCOME_SLOT) && nextApps.length > 1) {
-        report(file, file.sourceFile, `${file.rel} is an app's ${noun} in a repository of ${nextApps.length} apps; a repository with several apps keeps its one ${noun} in the api package (packages/<family>-api/src/).`);
-      }
+function isGlobalFetch(ts, kit, checker, node) {
+  if (!ts.isIdentifier(node)) return isGlobalObjectFetch(ts, node);
+  if (node.text !== 'fetch') return false;
+  if (kit.importBinding(checker, node)) return false;
+  const parent = node.parent;
+  if (ts.isPropertyAccessExpression(parent) && parent.name === node) return false;
+  // A type position (`typeof fetch`, `typeof globalThis.fetch`) names the type of fetch and sends nothing.
+  if (isTypeOrImportPosition(ts, parent)) return false;
+  if (isDeclarationName(ts, parent, node)) return false;
+  const declarations = kit.declarationsOf(checker, node);
+  return declarations.every(declaration => declaration.getSourceFile().isDeclarationFile);
+}
+
+function reportMultiplicity(items, noun, nextApps, report, list) {
+  for (const file of items) {
+    if (items.length > 1) {
+      report(file, file.sourceFile, `The repository has ${items.length} ${noun}s (${list(items)}); it has exactly one: the api package's (packages/<family>-api/src/) when the apps share it, or the only app's. Keep one and delete the others.`);
+    } else if ((file.slot === APP_CLIENT_SLOT || file.slot === APP_OUTCOME_SLOT) && nextApps.length > 1) {
+      report(file, file.sourceFile, `${file.rel} is an app's ${noun} in a repository of ${nextApps.length} apps; a repository with several apps keeps its one ${noun} in the api package (packages/<family>-api/src/).`);
     }
   }
+}
 
+function globalFetchUse(ts, kit, checker, node) {
+  if (ts.isPropertyAccessExpression(node) && isGlobalFetch(ts, kit, checker, node)) return 'property';
+  if (ts.isIdentifier(node) && isGlobalFetch(ts, kit, checker, node)) return 'identifier';
+  return null;
+}
+
+function moduleSpecifierOf(ts, node) {
+  if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) return node.moduleSpecifier;
+  if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || (ts.isIdentifier(node.expression) && node.expression.text === 'require'))) return node.arguments[0];
+  return null;
+}
+
+function inspectTransportNode({ ts, kit, checker, file, node, isClient, clientCalls, clients, owned, report }) {
+  const fetchUse = globalFetchUse(ts, kit, checker, node);
+  if (fetchUse !== null) {
+    if (isClient) clientCalls.value += 1;
+    else if (fetchUse === 'property') report(file, node, `${node.getText(file.sourceFile)} reaches the global fetch outside the transport client; ${owned}`);
+    else report(file, node, `fetch is used outside the transport client (called, aliased or passed as a value); ${owned}`);
+    return false;
+  }
+  const specifier = moduleSpecifierOf(ts, node);
+  if (specifier && ts.isStringLiteralLike(specifier) && HTTP_LIBRARIES.has(specifier.text.split('/')[0])) {
+    report(file, node, `${specifier.text} is a second HTTP transport; the repository's one transport is built on fetch (${clients.length ? clients.map(item => item.rel).join(', ') : 'no client exists yet'}). Use the client.`, { library: specifier.text });
+  }
+  return true;
+}
+
+function inspectTransportFiles({ files, graph, kit, ts, clientRels, clients, owned, report }) {
   const appsWithFiles = new Set();
+  let readers = 0;
   for (const file of files) {
-    const bindings = resolver.classifyPath(file.rel).bindings;
+    const bindings = kit.resolver.classifyPath(file.rel).bindings;
     if (bindings?.app) appsWithFiles.add(bindings.app);
     const checker = kit.checkerOf(file.sourceFile);
     const isClient = clientRels.has(file.rel);
-    let clientCalls = 0;
-    kit.walk(file.sourceFile, node => {
-      if (ts.isPropertyAccessExpression(node) && isGlobalFetch(checker, node)) {
-        if (isClient) clientCalls += 1;
-        else report(file, node, `${node.getText(file.sourceFile)} reaches the global fetch outside the transport client; ${owned}`);
-        return false;
-      }
-      if (ts.isIdentifier(node) && isGlobalFetch(checker, node)) {
-        if (isClient) clientCalls += 1;
-        else report(file, node, `fetch is used outside the transport client (called, aliased or passed as a value); ${owned}`);
-        return false;
-      }
-      const specifier = ts.isImportDeclaration(node) || ts.isExportDeclaration(node) ? node.moduleSpecifier
-        : ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || (ts.isIdentifier(node.expression) && node.expression.text === 'require')) ? node.arguments[0] : null;
-      if (specifier && ts.isStringLiteralLike(specifier) && HTTP_LIBRARIES.has(specifier.text.split('/')[0])) {
-        report(file, node, `${specifier.text} is a second HTTP transport; the repository's one transport is built on fetch (${clients.length ? list(clients) : 'no client exists yet'}). Use the client.`, { library: specifier.text });
-      }
-      return true;
-    });
-    if (isClient && clientCalls === 0) report(file, file.sourceFile, `${file.rel} never calls the global fetch; the client is the one module that owns fetch, with its timeout and abort signal.`);
+    const clientCalls = { value: 0 };
+    kit.walk(file.sourceFile, node => inspectTransportNode({ ts, kit, checker, file, node, isClient, clientCalls, clients, owned, report }));
+    if (isClient && clientCalls.value === 0) report(file, file.sourceFile, `${file.rel} never calls the global fetch; the client is the one module that owns fetch, with its timeout and abort signal.`);
     if (file.slot === API_SLOT && bindings?.app && path.posix.basename(file.rel).startsWith('read-')) {
       readers += 1;
       const reachesClient = graph.edges.some(edge => edge.from === file.rel && edge.runtime
@@ -108,5 +114,26 @@ export function checkTransportOwner(input) {
       if (!reachesClient) report(file, file.sourceFile, `${file.rel} is a server reader that does not import the transport client; a reader fetches through the repository's one client, never through its own transport.`);
     }
   }
+  return { appsWithFiles, readers };
+}
+
+export function checkTransportOwner(input) {
+  const { graph } = input;
+  const kit = machineKit(input);
+  const { ts, resolver } = kit;
+  const violations = [];
+  const report = (file, node, message, extra = {}) => violations.push({ ruleId: RULE, path: file.rel, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
+  const nextApps = resolver.repo.apps.filter(item => item.kind === 'next');
+  const files = [...graph.files.values()].filter(file => file.slot && file.tier !== 'e2e');
+  const clients = files.filter(file => CLIENT_SLOTS.has(file.slot));
+  const outcomes = files.filter(file => resolver.slot(file.slot)?.outcomeHome === true);
+  const clientRels = new Set(clients.map(file => file.rel));
+  const list = items => items.map(item => item.rel).join(', ');
+  const owned = clients.length ? `the repository has one transport (${list(clients)}). Call the client and take its Outcome.` : NO_CLIENT;
+
+  // Exactly one client and one Outcome union per repository.
+  for (const [items, noun] of [[clients, 'transport client'], [outcomes, 'Outcome union']]) reportMultiplicity(items, noun, nextApps, report, list);
+
+  const { appsWithFiles, readers } = inspectTransportFiles({ files, graph, kit, ts, clientRels, clients, owned, report });
   return { violations, coverage: { status: 'checked', apps: appsWithFiles.size, readers, clients: clients.length, outcomes: outcomes.length } };
 }