@starci/hfs 4.2.12 → 4.2.14

package/runtime/scripts/hfs/architecture/hfs.mjs

@@ -43,7 +43,8 @@ export const HFS_RULE_IDS = [
 
 const NON_NPM_ENTRIES = new Set(['pnpm-lock.yaml', 'pnpm-workspace.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb']);
 const HUSKY_HOOKS_PATH = /^\.husky(?:\/_)?\/?$/u;
-const BACKEND_SRC_CHILDREN = new Set(['features', 'modules', 'tests']);
+/** The folders of a back end's src/ the slot manifest knows (features, modules, tests, assets): read from the be slot paths, never listed here. */
+const backendSrcChildrenOf = resolver => new Set(resolver.slots().filter(slot => slot.profiles.includes('be')).flatMap(slot => braceVariants(slot.path)).map(variant => /^src\/([a-z][a-z-]*)\//.exec(variant)?.[1]).filter(Boolean));
 const moduleTiersOf = resolver => new Set(resolver.slots().filter(slot => slot.profiles.includes('be')).flatMap(slot => braceVariants(slot.path)).map(variant => /^src\/modules\/([a-z][a-z-]*)\//.exec(variant)?.[1]).filter(Boolean)); // the folders of src/modules/ the slot manifest knows (domain, platform, integrations, events, queues, projections)
 // Owner test layout 2026-09-30: unit `<name>.spec.ts`, integration, e2e and contract by folder and suffix; int-spec and harness-spec stay banned.
 const UNSUPPORTED_TEST_SUFFIX = /\.(?:int|harness)-spec\.[cm]?[jt]sx?$/u;
@@ -274,9 +275,11 @@ function checkApplications(state) {
 function checkBackendSourceLayout(state) {
   if (!state.backend) return;
   const { tree, resolver, finding } = state;
+  const srcChildren = backendSrcChildrenOf(resolver);
+  const srcList = [...srcChildren].sort(byCodeUnit).map(name => name + '/').join(', ');
   for (const child of tree.children('src').sort(byCodeUnit)) {
-    if (!BACKEND_SRC_CHILDREN.has(child))
-      finding('HFS_SRC_LAYOUT_INVALID', `src/${child}`, `Backend src/ holds only features/, modules/ and tests/; ${child} must move to its owner.`);
+    if (!srcChildren.has(child))
+      finding('HFS_SRC_LAYOUT_INVALID', `src/${child}`, `Backend src/ holds only ${srcList}; ${child} must move to its owner.`);
   }
   for (const tier of tree.children('src/modules').sort(byCodeUnit)) {
     if (!moduleTiersOf(resolver).has(tier))

package/runtime/scripts/hfs/architecture/index.mjs

@@ -48,6 +48,7 @@ import { checkFeSlotAllows, FE_SLOT_ALLOWS_RULE_IDS } from './fe-slot-allows.mjs
 import { checkI18nKeys, I18N_KEYS_RULE_IDS } from './i18n-keys.mjs';
 import { checkDocLanguage, DOC_LANGUAGE_RULE_IDS } from './doc-language.mjs';
 import { checkBackendSupabase, checkFrontendSupabase, BACKEND_SUPABASE_RULE_IDS, FRONTEND_SUPABASE_RULE_IDS } from './supabase.mjs';
+import { checkServerActions, SERVER_ACTION_RULE_IDS } from './server-action.mjs';
 import { LINT_CODES, onLintSurface } from './surface.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 
@@ -98,6 +99,7 @@ const FRONTEND_MACHINE = {
   feSlotAllows: [checkFeSlotAllows, FE_SLOT_ALLOWS_RULE_IDS],
   i18nKeys: [checkI18nKeys, I18N_KEYS_RULE_IDS],
   supabaseFrontend: [checkFrontendSupabase, FRONTEND_SUPABASE_RULE_IDS],
+  serverActions: [checkServerActions, SERVER_ACTION_RULE_IDS],
 };
 
 /** Errors the machine reports when a program cannot be built or an edge cannot be proven: it cannot judge, so it refuses. */

package/runtime/scripts/hfs/architecture/owners.mjs

@@ -2,17 +2,23 @@ import path from 'node:path';
 import { canonical, isInside } from './config.mjs';
 import { relativePath, workspaceExportSources } from './typescript.mjs';
 import { sourceLocation } from '../../lib/ts-ast.mjs';
-import { isServerActionModule } from './server-action.mjs';
+import { globExpression } from '../../lib/glob.mjs';
+import { posixPath } from '../../lib/path-key.mjs';
 
 function absolute(root, relative) {
   return canonical(path.resolve(root, ...relative.split('/')));
 }
 
-/** The extra public entries the slot manifest declares for the owner (slot field `entries`, on the slot that holds its entry file), as absolute paths. */
+/**
+ * The extra public entries the slot manifest declares for the owner (slot field `entries`, on the slot that holds its entry file):
+ * exact files as absolute paths, and the entries holding a `*` (one file per operation, `graphql/queries/query-*.ts`) as patterns.
+ */
 function slotEntries(config, owner) {
   const found = config.hfs?.classifyPath?.(owner.entry);
   const names = found?.slot ? config.hfs.slot(found.slot)?.entries ?? [] : [];
-  return names.map(name => absolute(config.root, `${found.root}/${name}`));
+  const exact = names.filter(name => !name.includes('*')).map(name => absolute(config.root, `${found.root}/${name}`));
+  const patterns = names.filter(name => name.includes('*')).map(name => globExpression(`${posixPath(absolute(config.root, found.root))}/${name}`));
+  return { exact, patterns };
 }
 
 /** The owner's public entries: its declared entry, the `entries` its slot declares, plus every source file its package.json `exports` maps when the owner is a workspace package. */
@@ -21,9 +27,10 @@ function ownerDeclarations(config, context) {
     const root = absolute(config.root, owner.root);
     const entry = absolute(config.root, owner.entry);
     const workspace = context.workspaces?.find(item => item.root === root);
-    const declared = slotEntries(config, owner);
+    const { exact: declared, patterns } = slotEntries(config, owner);
     const entries = new Set([entry, ...declared, ...(workspace ? workspaceExportSources(context.ts, workspace) : [])]);
-    return { ...owner, root, entry, entries, declared };
+    const isEntry = file => entries.has(file) || patterns.some(pattern => pattern.test(posixPath(file)));
+    return { ...owner, root, entry, entries, isEntry, declared };
   }).sort((a, b) => b.root.length - a.root.length);
 }
 
@@ -35,7 +42,7 @@ function reexportSteps(context, current) {
   return (context.edges.get(current.file) ?? []).filter(candidate => candidate.reexport).map(candidate => ({ file: candidate.to, chain: [...current.chain, candidate.to] }));
 }
 
-function privateOwnerChain(context, owners, actionEntries, edge) {
+function privateOwnerChain(context, owners, edge) {
   const sourceOwner = ownerOf(owners, edge.from);
   const queue = [{ file: edge.to, chain: [edge.from, edge.to] }];
   const visited = new Set();
@@ -44,7 +51,7 @@ function privateOwnerChain(context, owners, actionEntries, edge) {
     if (visited.has(current.file)) continue;
     visited.add(current.file);
     const owner = ownerOf(owners, current.file);
-    if (owner && sourceOwner?.id !== owner.id) return owner.entries.has(current.file) || actionEntries.has(current.file) ? null : { owner, chain: current.chain };
+    if (owner && sourceOwner?.id !== owner.id) return owner.isEntry(current.file) ? null : { owner, chain: current.chain };
     queue.push(...reexportSteps(context, current));
   }
   return null;
@@ -61,7 +68,7 @@ function arrangesSchema(config, from, to) {
     && resolver.classifyPath(relativePath(config.root, to)).slot === 'be.persistence';
 }
 
-function publicEntryViolations(config, context, owners, sourceFiles, actionEntries) {
+function publicEntryViolations(config, context, owners, sourceFiles) {
   const violations = [];
   for (const owner of owners) {
     const sourceFile = sourceFiles.get(owner.entry);
@@ -73,7 +80,6 @@ function publicEntryViolations(config, context, owners, sourceFiles, actionEntri
     const publicFiles = new Set([
       sourceFile,
       ...owner.declared.map(file => sourceFiles.get(file)).filter(Boolean),
-      ...[...actionEntries].filter(file => isInside(owner.root, file)).map(file => sourceFiles.get(file)).filter(Boolean),
     ]);
     for (const entryFile of publicFiles) {
       for (const statement of entryFile.statements) if (context.ts.isExportDeclaration(statement) && !statement.exportClause) {
@@ -90,12 +96,12 @@ function publicEntryViolations(config, context, owners, sourceFiles, actionEntri
   return violations;
 }
 
-function ownerImportViolations(config, context, owners, actionEntries) {
+function ownerImportViolations(config, context, owners) {
   const violations = [];
   for (const sourceFile of context.files) {
     const from = canonical(sourceFile.fileName);
     for (const edge of context.edges.get(from) ?? []) {
-      const bypass = privateOwnerChain(context, owners, actionEntries, edge);
+      const bypass = privateOwnerChain(context, owners, edge);
       if (!bypass) continue;
       if (arrangesSchema(config, from, bypass.chain.at(-1))) continue;
       violations.push({
@@ -119,11 +125,8 @@ export function checkOwners(config, context) {
   if (!config.owners?.length) return [];
   const owners = ownerDeclarations(config, context);
   const sourceFiles = new Map(context.files.map(file => [canonical(file.fileName), file]));
-  const actionEntries = new Set(config.kinds.includes('frontend')
-    ? [...sourceFiles].filter(([, file]) => isServerActionModule(context.ts, file)).map(([name]) => name)
-    : []);
   return [
-    ...publicEntryViolations(config, context, owners, sourceFiles, actionEntries),
-    ...ownerImportViolations(config, context, owners, actionEntries),
+    ...publicEntryViolations(config, context, owners, sourceFiles),
+    ...ownerImportViolations(config, context, owners),
   ];
 }

package/runtime/scripts/hfs/architecture/route-files-thin.mjs

@@ -24,6 +24,9 @@ const HOOK_ROUTES = new Set([...MOUNTING_ROUTES, 'page']);
 const HOOK_NAME = /^use[A-Z0-9]/u;
 const HOOKS_SLOT = 'fe.hooks';
 
+/** The client providers (fe.components.providers) wrap the mounted owner like a package shell; they are not a second owner. */
+const PROVIDERS_SLOT = 'fe.components.providers';
+const isFeatureOwner = target => target?.tier === 'feature' && target.slot !== PROVIDERS_SLOT;
 const isFunction = (ts, node) => ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node);
 const jsxOf = (ts, node) => ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node);
 
@@ -68,7 +71,7 @@ function reportRoute(violations, kit, file, stem, node, message, extra = {}) {
 function inspectMountingTag(tag, { graph, kit, ts, file, stem, checker, violations, state }) {
   if (ts.isIdentifier(tag) && /^[a-z]/u.test(tag.text)) {
     reportRoute(violations, kit, file, stem, tag, `<${tag.text}> is drawing in a ${stem} route file; a route file mounts one feature and draws nothing. Move the markup into the feature.`);
-  } else if (kit.declarationsOf(checker, ts.isPropertyAccessExpression(tag) ? tag.name : tag).some(declaration => graph.files.get(kit.graphPath(declaration) ?? '')?.tier === 'feature')) {
+  } else if (kit.declarationsOf(checker, ts.isPropertyAccessExpression(tag) ? tag.name : tag).some(declaration => isFeatureOwner(graph.files.get(kit.graphPath(declaration) ?? '')))) {
     state.owners += 1;
   }
 }

package/runtime/scripts/hfs/architecture/server-action.mjs

@@ -1,24 +1,79 @@
-/** The value of a directive-prologue statement, or null once the prologue has ended. */
-function directiveValue(ts, sourceFile, statement) {
-  const expressionStatement = ts?.isExpressionStatement
-    ? ts.isExpressionStatement(statement)
-    : Boolean(statement?.expression);
-  if (!expressionStatement) return null;
-  const expression = statement.expression;
-  if (ts?.isStringLiteral) return ts.isStringLiteral(expression) ? expression.text : null;
-  const raw = expression?.getText?.(sourceFile);
-  const quote = raw?.[0];
-  return typeof expression?.text === 'string' && (quote === "'" || quote === '"') && raw.at(-1) === quote
-    ? expression.text
-    : null;
+import { sourceLocation } from '../../lib/ts-ast.mjs';
+
+/**
+ * The front end serves no API (owner ruling 2026-10-13, both editions, every app): it calls the back end through Apollo GraphQL and
+ * axios in modules/api and never runs server code of its own.
+ *
+ *   - FE_SERVER_ACTION_FORBIDDEN: a `"use server"` directive anywhere in a front-end source file, in the file's directive prologue
+ *     (a Server Action module) or in the prologue of any function body (an inline Server Action), apps and packages alike;
+ *   - FE_ROUTE_HANDLER_FORBIDDEN: a route handler (`route.ts`, `route.js` and their module variants) under `apps/<app>/src/app/` other than the
+ *     liveness probe `health/live/route.ts` and the file the slot `fe.route.callback` owns (the Supabase auth code exchange).
+ *
+ * The check is provider-independent: it runs for every front-end repository.
+ */
+export const SERVER_ACTION_RULE_IDS = Object.freeze(['FE_SERVER_ACTION_FORBIDDEN', 'FE_ROUTE_HANDLER_FORBIDDEN']);
+
+const SERVER_ACTION = 'FE_SERVER_ACTION_FORBIDDEN';
+const ROUTE_HANDLER = 'FE_ROUTE_HANDLER_FORBIDDEN';
+const CALLBACK_SLOT = 'fe.route.callback';
+const ROUTE_FILE = /^apps\/([^/]+)\/src\/app\/(?:.+\/)?route\.[cm]?[jt]s$/u;
+
+/** The statement nodes of a directive prologue: the leading string-literal expression statements. */
+function prologue(ts, statements) {
+  const directives = [];
+  for (const statement of statements ?? []) {
+    if (!ts.isExpressionStatement(statement) || !ts.isStringLiteral(statement.expression)) break;
+    directives.push(statement);
+  }
+  return directives;
+}
+
+const useServerIn = (ts, statements) => prologue(ts, statements).find(statement => statement.expression.text === 'use server') ?? null;
+
+/** Every `"use server"` directive of one source file: the file-level one and each function-level one. */
+function serverDirectives(ts, sourceFile) {
+  const found = [];
+  const fileLevel = useServerIn(ts, sourceFile.statements);
+  if (fileLevel) found.push({ node: fileLevel, level: 'file' });
+  const visit = node => {
+    // a function with a block body: declaration, expression, arrow, method, constructor or accessor
+    if (ts.isFunctionLike(node) && node.body && ts.isBlock(node.body)) {
+      const inline = useServerIn(ts, node.body.statements);
+      if (inline) found.push({ node: inline, level: 'function' });
+    }
+    ts.forEachChild(node, visit);
+  };
+  ts.forEachChild(sourceFile, visit);
+  return found;
+}
+
+function serverActionViolations(ts, file) {
+  return serverDirectives(ts, file.sourceFile).map(({ node, level }) => ({
+    ruleId: SERVER_ACTION, path: file.rel, ...sourceLocation(file.sourceFile, node), level,
+    message: `${file.rel} declares a ${level}-level "use server" directive: the front end runs no Server Action. Call the back end through a modules/api GraphQL operation (or a rest call) from an SWR hook, and move the server work into a be feature.`,
+  }));
+}
+
+function routeHandlerViolation(file) {
+  const match = ROUTE_FILE.exec(file.rel);
+  if (!match) return null;
+  if (file.rel === `apps/${match[1]}/src/app/health/live/route.ts` || file.slot === CALLBACK_SLOT) return null;
+  return {
+    ruleId: ROUTE_HANDLER, path: file.rel, line: 1, column: 1,
+    message: `${file.rel} is a front-end route handler outside health/live/route.ts and the ${CALLBACK_SLOT} slot: the front end serves no API. Webhooks, cron, public APIs and third-party callbacks belong to be features; the browser reaches the back end through modules/api.`,
+  };
 }
 
-/** True when a TypeScript source file declares `"use server"` in its directive prologue. */
-export function isServerActionModule(ts, sourceFile) {
-  for (const statement of sourceFile?.statements ?? []) {
-    const value = directiveValue(ts, sourceFile, statement);
-    if (value === null) return false;
-    if (value === 'use server') return true;
+/** The FE machine check of both bans over every source file of the front-end program. */
+export function checkServerActions({ graph, context }) {
+  const ts = context.ts;
+  const violations = [];
+  let routes = 0;
+  for (const file of graph.files.values()) {
+    violations.push(...serverActionViolations(ts, file));
+    const route = routeHandlerViolation(file);
+    if (ROUTE_FILE.test(file.rel)) routes += 1;
+    if (route) violations.push(route);
   }
-  return false;
+  return { violations, coverage: { status: 'checked', files: graph.files.size, routes } };
 }

package/runtime/scripts/hfs/architecture/supabase-ast.mjs

@@ -34,7 +34,7 @@ const typeFromSupabase = (checker, node) => {
   return false;
 };
 
-export const signatureFromSupabase = (checker, call) => {
+const signatureFromSupabase = (checker, call) => {
   try { return declarationFromSupabase(checker.getResolvedSignature(call)?.declaration); } catch { return false; }
 };
 
@@ -45,7 +45,7 @@ export const unwrap = (ts, node) => {
   return current;
 };
 
-export const isSupabaseValue = (kit, checker, node) => {
+const isSupabaseValue = (kit, checker, node) => {
   const current = unwrap(kit.ts, node);
   if (!current) return false;
   if (importedFrom(kit, checker, current, SUPABASE_MODULES)) return true;

package/runtime/scripts/hfs/architecture/supabase.mjs

@@ -1,35 +1,27 @@
-import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
-import { isServerActionModule } from './server-action.mjs';
-import { callName, chainParts, contextTypesClient, isDatabaseType, isSupabaseCall, moduleNameOf, reportAt, signatureFromSupabase, supabaseClientType, SUPABASE_MODULES, unwrap } from './supabase-ast.mjs';
+import { callName, chainParts, contextTypesClient, isDatabaseType, isSupabaseCall, moduleNameOf, reportAt, supabaseClientType, SUPABASE_MODULES } from './supabase-ast.mjs';
 import { checkBackendJwt } from './supabase-be.mjs';
-import { checkFrontendQueryResults, FE_DB_SLOTS, sameSymbol, symbolOf } from './supabase-results.mjs';
 
 /**
- * L10-L16, the slot-driven Supabase machine. Supabase is one data transport with one owner on each side:
- * `fe.modules.db` / `fe.package.db` in a front end and `be.integrations.supabase` in a back end. The checks below
- * recognise provider calls and types by their imported package declarations, not by local variable or type names.
+ * L10-L16, the slot-driven Supabase machine. On the back end Supabase is one data transport with one owner,
+ * `be.integrations.supabase`. On the front end Supabase is auth only (owner ruling 2026-10-13): `fe.modules.auth` is the one
+ * importer of `@supabase/*` and calls only the auth API; data, storage, rpc and realtime go through the back end (modules/api).
+ * The checks below recognise provider calls and types by their imported package declarations, not by local variable or type names.
  */
-export const FRONTEND_SUPABASE_RULE_IDS = Object.freeze([
-  'FE_SUPABASE_CLIENT_OWNER',
-  'FE_DB_RESULT_TYPED',
-  'FE_DB_ERROR_HANDLED',
-  'FE_SERVICE_ROLE_FORBIDDEN',
-  'FE_AUTH_SESSION_TRUST',
-  'FE_DB_WRITE_SHAPE',
-  'FE_ROUTE_HANDLER_FORBIDDEN',
-]);
+export const FRONTEND_SUPABASE_RULE_IDS = Object.freeze(['FE_SUPABASE_CLIENT_OWNER', 'FE_SERVICE_ROLE_FORBIDDEN']);
 export const BACKEND_SUPABASE_RULE_IDS = Object.freeze(['BE_SUPABASE_CLIENT_OWNER', 'BE_SUPABASE_JWT_VERIFIED']);
 
 const FE_CLIENT_OWNER = 'FE_SUPABASE_CLIENT_OWNER';
 const BE_CLIENT_OWNER = 'BE_SUPABASE_CLIENT_OWNER';
 const FE_SERVICE_ROLE = 'FE_SERVICE_ROLE_FORBIDDEN';
-const FE_SESSION_TRUST = 'FE_AUTH_SESSION_TRUST';
-const FE_WRITE_SHAPE = 'FE_DB_WRITE_SHAPE';
-const FE_ROUTE_HANDLER = 'FE_ROUTE_HANDLER_FORBIDDEN';
 const BE_SUPABASE_SLOT = 'be.integrations.supabase';
+const FE_AUTH_SLOT = 'fe.modules.auth';
+/** The front-end provider slot: enabled exactly when a connection declares provider supabase. */
+const FE_SUPABASE_PROVIDER_SLOT = 'fe.route.callback';
 const FE_CONFIG_SLOT = 'fe.modules.config';
 const SUPABASE_CALLS = new Set(['from', 'rpc']);
+/** The members of a Supabase client that read or write data, files or channels: never called from the front end. */
+const FE_DATA_MEMBERS = new Set(['from', 'rpc', 'schema', 'storage', 'functions', 'realtime', 'channel', 'getChannels', 'removeChannel', 'removeAllChannels']);
 const supabaseSlotEnabled = (input, slotId) => {
   const slot = input.graph.resolver.slot(slotId);
   return Boolean(slot && input.graph.resolver.slotEnabled(slot));
@@ -145,209 +137,43 @@ function checkFrontendSecretNames(input) {
   return { violations, coverage: { status: 'checked', envReads: state.reads } };
 }
 
-const isClientModule = (ts, sourceFile) => sourceFile.statements.some((statement, index) => index < 4 && ts.isExpressionStatement(statement)
-  && ts.isStringLiteralLike(statement.expression) && statement.expression.text === 'use client');
-
-const isDirectiveStatement = (ts, statement) => ts.isExpressionStatement(statement) && ts.isStringLiteralLike(statement.expression);
-
-const hasExportModifier = (ts, node) => node.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.ExportKeyword);
-
-const exportedValuesOf = (ts, statement) => {
-  if (ts.isFunctionDeclaration(statement)) {
-    return hasExportModifier(ts, statement) && statement.name && statement.body
-      ? [{ name: statement.name.text, implementation: statement.body, functionNode: statement }] : [];
-  }
-  if (!ts.isVariableStatement(statement) || !hasExportModifier(ts, statement)) return [];
-  return statement.declarationList.declarations
-    .filter(declaration => ts.isIdentifier(declaration.name) && declaration.initializer)
-    .map(declaration => {
-      const functionNode = (ts.isArrowFunction(declaration.initializer) || ts.isFunctionExpression(declaration.initializer))
-        && ts.isBlock(declaration.initializer.body) ? declaration.initializer : null;
-      return { name: declaration.name.text, implementation: declaration.initializer, functionNode };
-    });
-};
-
-const exportedValues = (ts, sourceFile) => sourceFile.statements.flatMap(statement => exportedValuesOf(ts, statement));
-
-const exportedActions = (ts, sourceFile) => exportedValues(ts, sourceFile).map(value => value.functionNode).filter(Boolean);
-const exportedImplementations = (ts, sourceFile, name) => exportedValues(ts, sourceFile)
-  .filter(value => value.name === name).map(value => value.implementation);
-
-const contains = (kit, root, predicate) => {
-  let found = false;
-  kit.walk(root, node => {
-    if (predicate(node)) found = true;
-    return !found;
-  });
-  return found;
-};
-
-const principalCall = (kit, checker, graph, node) => kit.ts.isCallExpression(node) && (() => {
-  const expression = node.expression;
-  const name = kit.ts.isPropertyAccessExpression(expression) ? expression.name : expression;
-  if (!kit.ts.isIdentifier(name) || name.text !== 'getPrincipal') return false;
-  return kit.declarationsOf(checker, name).some(declaration => {
-    const rel = kit.graphPath(declaration);
-    return rel !== null && FE_DB_SLOTS.has(graph.files.get(rel)?.slot);
-  });
-})();
-
-const firstPrincipal = (kit, checker, graph, statement) => {
-  let call = null;
-  kit.walk(statement, node => {
-    if (kit.ts.isAwaitExpression(node) && principalCall(kit, checker, graph, unwrap(kit.ts, node.expression))) call = unwrap(kit.ts, node.expression);
-    return call === null;
-  });
-  if (!call || !kit.ts.isVariableStatement(statement)) return { call, symbol: null };
-  for (const declaration of statement.declarationList.declarations) {
-    if (kit.ts.isIdentifier(declaration.name) && declaration.initializer && contains(kit, declaration.initializer, node => node === call)) {
-      return { call, symbol: symbolOf(kit, checker, declaration.name) };
-    }
-  }
-  return { call, symbol: null };
-};
-
-const typedRefusal = (kit, node) => contains(kit, node, child => (kit.ts.isStringLiteralLike(child) && child.text === 'refused')
-  || (kit.ts.isIdentifier(child) && /^refused(?:Outcome)?$/iu.test(child.text)));
-
-const parseUse = (ts, identifier) => {
-  let current = identifier;
-  while (current.parent && (ts.isParenthesizedExpression(current.parent) || ts.isAsExpression(current.parent))) current = current.parent;
-  const call = current.parent;
-  return ts.isCallExpression(call) && call.arguments.includes(current) && ts.isPropertyAccessExpression(call.expression)
-    && ['parse', 'safeParse'].includes(call.expression.name.text);
-};
-
-const parameterBindings = (ts, name) => {
-  if (ts.isIdentifier(name)) return [name];
-  if (ts.isObjectBindingPattern(name) || ts.isArrayBindingPattern(name)) return name.elements.flatMap(element => ts.isBindingElement(element) ? parameterBindings(ts, element.name) : []);
-  return [];
-};
-
-function inspectServerSessionCalls(kit, file, checker, violations) {
+function inspectFrontendNode(scope, node) {
+  const { kit, checker, file, violations, counters } = scope;
   const { ts } = kit;
-  if (isClientModule(ts, file.sourceFile)) return;
-  kit.walk(file.sourceFile, node => {
-    if (ts.isCallExpression(node) && callName(ts, node) === 'getSession' && signatureFromSupabase(checker, node)) {
-      reportAt(violations, kit, FE_SESSION_TRUST, file, node, 'auth.getSession() trusts cookie-backed session data in server code; call getPrincipal() (getClaims), and getUser() for sensitive mutations.');
-    }
-    return true;
-  });
-}
-
-function inspectPrincipalProvider(kit, file, checker, violations) {
-  const { ts } = kit;
-  if (!FE_DB_SLOTS.has(file.slot)) return;
-  for (const implementation of exportedImplementations(ts, file.sourceFile, 'getPrincipal')) {
-    const readsClaims = contains(kit, implementation, node => ts.isCallExpression(node) && callName(ts, node) === 'getClaims'
-      && signatureFromSupabase(checker, node));
-    if (!readsClaims) reportAt(violations, kit, FE_SESSION_TRUST, file, implementation,
-      'getPrincipal() must establish the server principal through Supabase auth.getClaims().');
+  const moduleName = moduleNameOf(ts, node);
+  if (moduleName?.startsWith('@supabase/')) {
+    counters.imports += 1;
+    if (file.slot !== FE_AUTH_SLOT) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `${moduleName} is imported by ${file.rel}, whose slot is ${file.slot ?? 'unowned'}; on the front end Supabase is auth only and ${FE_AUTH_SLOT} (modules/auth) is its one importer.`, { module: moduleName, slot: file.slot ?? null });
+    return;
   }
+  if (!ts.isCallExpression(node) || !isSupabaseCall(kit, checker, node)) return;
+  counters.calls += 1;
+  const member = callName(ts, node);
+  const parts = chainParts(ts, node);
+  let data = null;
+  if (FE_DATA_MEMBERS.has(member)) data = parts.find(name => FE_DATA_MEMBERS.has(name)) ?? member;
+  if (data) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase .${data} call is made from the front end; Supabase on the front end is auth only - read and write data, files and realtime through the back end (a modules/api GraphQL operation, an SWR hook, hooks/socketio).`, { member: data, slot: file.slot ?? null });
+  else if (file.slot !== FE_AUTH_SLOT && parts.includes('auth')) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase auth call is made from ${file.slot ?? 'an unowned path'}; the auth client is called only inside ${FE_AUTH_SLOT}, which exports the session and the access token.`, { slot: file.slot ?? null });
 }
 
-function inspectActionDirective(kit, file, action, violations) {
-  const { ts } = kit;
-  const first = action.body.statements[0];
-  const functionLevel = first?.expression?.text === 'use server' && isDirectiveStatement(ts, first);
-  if (!isServerActionModule(ts, file.sourceFile) && !functionLevel) {
-    reportAt(violations, kit, FE_WRITE_SHAPE, file, action, 'An exported write function must be a Server Action through a file-level or function-level `use server` directive.');
-  }
-}
-
-function inspectActionPrincipal(input, kit, file, checker, action, authenticatesAnonymous, violations) {
-  const { ts } = kit;
-  // Function directives are the prologue, not work: the principal is the first non-directive statement.
-  const work = action.body.statements.slice(action.body.statements.findIndex(statement => !isDirectiveStatement(ts, statement)) >>> 0);
-  const first = work[0];
-  const principal = first ? firstPrincipal(kit, checker, input.graph, first) : { call: null, symbol: null };
-  if (!principal.call || !principal.symbol) {
-    reportAt(violations, kit, FE_SESSION_TRUST, file, first ?? action, 'A write Server Action must begin with `const principal = await getPrincipal()` from the db owner.');
-  } else if (!authenticatesAnonymous) {
-    const refuses = work.slice(1).some(statement => ts.isIfStatement(statement)
-      && contains(kit, statement.expression, node => ts.isIdentifier(node) && sameSymbol(kit, checker, node, principal.symbol))
-      && typedRefusal(kit, statement.thenStatement));
-    if (!refuses) reportAt(violations, kit, FE_SESSION_TRUST, file, action, 'A write Server Action must refuse an anonymous principal with a typed `refused` Outcome before doing work.');
-  }
-}
-
-function inspectActionInputs(kit, file, action, checker, violations) {
-  const { ts } = kit;
-  for (const parameter of action.parameters.flatMap(item => parameterBindings(ts, item.name))) {
-    const symbol = symbolOf(kit, checker, parameter);
-    const references = [];
-    kit.walk(action.body, node => {
-      if (ts.isIdentifier(node) && sameSymbol(kit, checker, node, symbol)) references.push(node);
-      return true;
-    });
-    references.sort((a, b) => a.getStart() - b.getStart());
-    const firstUse = references[0];
-    if (firstUse && !parseUse(ts, firstUse)) reportAt(violations, kit, FE_WRITE_SHAPE, file, firstUse,
-      `Server Action input ${parameter.text} is used before schema.parse(...) or schema.safeParse(...).`, { parameter: parameter.text });
-  }
-}
-
-function inspectSensitiveAction(kit, file, checker, action, violations) {
-  const { ts } = kit;
-  const sensitive = /(?:^|\/)(?:billing|payment|payout|refund|charge|subscription|password|credential|role|permission|membership)[/.-]/iu.test(file.rel);
-  if (sensitive && !contains(kit, action.body, node => ts.isCallExpression(node) && callName(ts, node) === 'getUser' && signatureFromSupabase(checker, node))) {
-    reportAt(violations, kit, FE_SESSION_TRUST, file, action, 'A money, account-security or role-changing Server Action must call auth.getUser() before the mutation.');
-  }
-}
-
-function inspectWriteAction(input, kit, file, checker, action, authenticatesAnonymous, violations) {
-  inspectActionDirective(kit, file, action, violations);
-  inspectActionPrincipal(input, kit, file, checker, action, authenticatesAnonymous, violations);
-  inspectActionInputs(kit, file, action, checker, violations);
-  inspectSensitiveAction(kit, file, checker, action, violations);
-}
-
-function inspectWriteModule(input, kit, file, checker, state) {
-  const { ts } = kit;
-  if (!FE_DB_SLOTS.has(file.slot) || !path.posix.basename(file.rel).startsWith('write-')) return;
-  const classified = input.graph.resolver.classifyPath(file.rel);
-  const belowSlot = classified.root && file.rel.startsWith(`${classified.root}/`) ? file.rel.slice(classified.root.length + 1) : '';
-  const authenticatesAnonymous = (input.graph.resolver.slot(file.slot)?.anonymousActions ?? []).includes(belowSlot);
-  const declared = exportedActions(ts, file.sourceFile);
-  if (!declared.length) reportAt(state.violations, kit, FE_WRITE_SHAPE, file, file.sourceFile, `${file.rel} is a write module but exports no Server Action function.`);
-  for (const action of declared) {
-    state.actions += 1;
-    inspectWriteAction(input, kit, file, checker, action, authenticatesAnonymous, state.violations);
-  }
-}
-
-function inspectRouteHandler(input, kit, file, state) {
-  if (!file.rel.endsWith('/route.ts')) return;
-  state.routes += 1;
-  const classified = input.graph.resolver.classifyPath(file.rel);
-  const app = classified.bindings?.app;
-  const live = app !== undefined && file.rel === `apps/${app}/src/app/health/live/route.ts`;
-  if (!live && file.slot !== 'fe.route.callback') reportAt(state.violations, kit, FE_ROUTE_HANDLER, file, file.sourceFile,
-    `${file.rel} is a front-end route handler outside health/live and the fe.route.callback slot; webhooks, cron, public APIs and third-party callbacks belong to be features.`);
-}
-
-function checkFrontendAuthAndRoutes(input) {
+function checkFrontendClientOwner(input) {
   const kit = machineKit(input);
-  const state = { violations: [], actions: 0, routes: 0 };
+  const violations = [];
+  const counters = { imports: 0, calls: 0 };
   for (const file of input.graph.files.values()) {
-    const checker = kit.checkerOf(file.sourceFile);
-    inspectServerSessionCalls(kit, file, checker, state.violations);
-    inspectPrincipalProvider(kit, file, checker, state.violations);
-    inspectWriteModule(input, kit, file, checker, state);
-    inspectRouteHandler(input, kit, file, state);
+    const scope = { kit, checker: kit.checkerOf(file.sourceFile), file, violations, counters };
+    kit.walk(file.sourceFile, node => inspectFrontendNode(scope, node));
   }
-  return { violations: state.violations, coverage: { status: 'checked', actions: state.actions, routes: state.routes } };
+  return { violations, coverage: { status: 'checked', ...counters, ownerSlots: [FE_AUTH_SLOT] } };
 }
 
 export function checkFrontendSupabase(input) {
-  if (!supabaseSlotEnabled(input, 'fe.modules.db')) return { violations: [], coverage: { status: 'not-applicable', reason: 'the Supabase front-end database slot is not enabled' } };
-  const owner = checkClientOwnership(input, { slots: FE_DB_SLOTS, ruleId: FE_CLIENT_OWNER });
-  const results = checkFrontendQueryResults(input);
+  if (!supabaseSlotEnabled(input, FE_SUPABASE_PROVIDER_SLOT)) return { violations: [], coverage: { status: 'not-applicable', reason: 'no connection declares provider supabase' } };
+  const owner = checkFrontendClientOwner(input);
   const secrets = checkFrontendSecretNames(input);
-  const auth = checkFrontendAuthAndRoutes(input);
   return {
-    violations: [...owner.violations, ...results.violations, ...secrets.violations, ...auth.violations],
-    coverage: { status: 'checked', owner: owner.coverage, results: results.coverage, secrets: secrets.coverage, auth: auth.coverage },
+    violations: [...owner.violations, ...secrets.violations],
+    coverage: { status: 'checked', owner: owner.coverage, secrets: secrets.coverage },
   };
 }
 

package/runtime/scripts/hfs/architecture/tiers.mjs

@@ -1,4 +1,3 @@
-import { isServerActionModule } from './server-action.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 
 /**
@@ -102,37 +101,8 @@ const triggerOf = (resolver, file) => {
   return owner ? (resolver.slot(owner.slot)?.trigger ?? null) : null;
 };
 
-/** The db Server Action an edge targets, or null. */
-const serverActionTarget = (graph, edge) => {
-  if (graph.profile !== 'fe') return null;
-  const to = graph.resolver.classifyPath(edge.to);
-  return to.slot === 'fe.modules.db' && /^write-[^/]+\.ts$/u.test(edge.to.split('/').at(-1))
-    && isServerActionModule(null, graph.files.get(edge.to).sourceFile) ? to : null;
-};
-
-/** A connected block may call a db writer directly when that writer is a file-level Next Server Action. */
-const blockCallsServerAction = (graph, edge) => {
-  if (!serverActionTarget(graph, edge)) return false;
-  const from = graph.resolver.classifyPath(edge.from);
-  return from.slot === 'fe.components' && from.kind === 'blocks' && from.role === 'entry';
-};
-
-function reportDirectServerAction(graph, edge, verdict, actionTarget, tierRule, counts, violations) {
-  if (!(verdict.allowed || verdict.reason === 'notPublicEntry') || !actionTarget
-    || graph.unit(edge.from) === graph.unit(edge.to) || blockCallsServerAction(graph, edge)) return false;
-  counts.tierDirection += 1;
-  violations.push({
-    ruleId: tierRule,
-    path: edge.from, line: edge.line, column: edge.column,
-    specifier: edge.specifier, resolvedPath: edge.to, typeOnly: !edge.runtime,
-    fromTier: graph.resolver.tierOf(edge.from), toTier: graph.resolver.tierOf(edge.to),
-    message: `${edge.from} -> ${edge.to}: a db Server Action is called directly only by a connected block entry; hooks and other tiers use their declared data path${edge.runtime ? '' : ' (type-only imports count)'}.`,
-  });
-  return true;
-}
-
 function reportReasonedTierViolation(graph, edge, verdict, tierRule, counts, violations) {
-  if (verdict.allowed || (verdict.reason === 'tierDirection' && blockCallsServerAction(graph, edge)) || !REASON_TEXT[verdict.reason]) return;
+  if (verdict.allowed || !REASON_TEXT[verdict.reason]) return;
   counts[verdict.reason] += 1;
   const featureToFeature = graph.profile === 'be' && verdict.reason === 'tierDirection' && verdict.fromTier === 'feature' && verdict.toTier === 'feature';
   const fromKind = featureToFeature ? triggerOf(graph.resolver, edge.from) : null;
@@ -162,8 +132,6 @@ function inspectTierEdge(graph, edge, tierRule, counts, violations, coverage) {
     return;
   }
   coverage.edgesChecked += 1;
-  const actionTarget = serverActionTarget(graph, edge);
-  if (reportDirectServerAction(graph, edge, verdict, actionTarget, tierRule, counts, violations)) return;
   reportReasonedTierViolation(graph, edge, verdict, tierRule, counts, violations);
 }