@starci/eslint-canon-be 1.0.0

package/data-access.mjs

@@ -0,0 +1,173 @@
+/**
+ * The rules that hold `data-access.md`.
+ *
+ * Three rules, all reading a constructor parameter or a decorator, all exact - there is no
+ * heuristic here and no judgement to get wrong, which is why all three can be switched on without
+ * a burn-down in a codebase that already follows them.
+ *
+ * The two rules canon does NOT try to enforce are worth naming so nobody adds them badly. Whether a
+ * helper was handed the caller's transactional manager (DATA-4) needs the call graph, and whether a
+ * relation should have been asked for at the call site (DATA-5) needs to know what the answer is
+ * for. Both are read by a person; a rule that guessed would fire on correct code.
+ */
+
+/** Forward-slash form of a filename, so Windows paths compare like every other path. */
+const normalizePath = (filename) => String(filename || "").replace(/\\/g, "/")
+
+/** A parameter property (`private readonly x: T`) wraps the parameter it declares. */
+const unwrapParam = (param) => (param.type === "TSParameterProperty" ? param.parameter : param)
+
+/** The type name a parameter is annotated with, or null. */
+const paramTypeName = (param) => {
+  const annotation = param.typeAnnotation && param.typeAnnotation.typeAnnotation
+  if (!annotation || annotation.type !== "TSTypeReference" || annotation.typeName.type !== "Identifier") return null
+  return annotation.typeName.name
+}
+
+/** Decorator names on a parameter, including ones carried by the parameter property wrapping it. */
+const paramDecorators = (original) => {
+  const carriers = [original]
+  if (original.type === "TSParameterProperty") carriers.push(original.parameter)
+  const names = []
+  for (const carrier of carriers) {
+    for (const decorator of carrier.decorators || []) {
+      const expression = decorator.expression
+      if (expression.type === "CallExpression" && expression.callee.type === "Identifier") {
+        names.push(expression.callee.name)
+      } else if (expression.type === "Identifier") {
+        names.push(expression.name)
+      }
+    }
+  }
+  return names
+}
+
+/** Every parameter of a constructor definition. */
+const constructorParams = (node) =>
+  node.kind === "constructor" && node.value && node.value.params ? node.value.params : []
+
+/** Repository types that bind a handle to one entity. */
+const REPOSITORY_TYPES = /^(?:Repository|TreeRepository|MongoRepository)$/
+
+/** The house decorator family that names a datasource. */
+const NAMES_DATASOURCE = /^Inject\w*EntityManager$/
+
+// -- DATA-1 ----------------------------------------------------------------------------------------
+
+/** An injected manager names the datasource it belongs to. */
+export const mustInjectEntityManager = {
+  meta: {
+    type: "problem",
+    docs: { description: "An injected `EntityManager` names its datasource through a decorator." },
+    schema: [],
+    messages: {
+      undecorated:
+        "`EntityManager` is injected without an `@Inject*EntityManager()` decorator. The type alone does not say WHICH datasource this is, and this application has more than one - so this reads correctly while pointing at the wrong database. Name the connection at the injection site.",
+    },
+  },
+  create(context) {
+    return {
+      MethodDefinition(node) {
+        for (const original of constructorParams(node)) {
+          const param = unwrapParam(original)
+          if (paramTypeName(param) !== "EntityManager") continue
+          if (paramDecorators(original).some((name) => NAMES_DATASOURCE.test(name))) continue
+          context.report({ node: param, messageId: "undecorated" })
+        }
+      },
+    }
+  },
+}
+
+// -- DATA-2 ----------------------------------------------------------------------------------------
+
+/** Persistence never arrives as a repository. */
+export const noInjectedRepository = {
+  meta: {
+    type: "problem",
+    docs: { description: "Persistence goes through `EntityManager`, never an injected repository." },
+    schema: [],
+    messages: {
+      repo:
+        "Inject `EntityManager` instead of a repository. A repository is bound to ONE entity, so it cannot carry a transaction into a second table - and a use case that grows a second write then has to be rewritten rather than extended.",
+    },
+  },
+  create(context) {
+    return {
+      MethodDefinition(node) {
+        for (const original of constructorParams(node)) {
+          const param = unwrapParam(original)
+          const byDecorator = paramDecorators(original).includes("InjectRepository")
+          const byType = REPOSITORY_TYPES.test(paramTypeName(param) || "")
+          if (byDecorator || byType) context.report({ node: param, messageId: "repo" })
+        }
+      },
+    }
+  },
+}
+
+// -- DATA-3 ----------------------------------------------------------------------------------------
+
+/** An entity names its table, so a class rename cannot become a dropped table. */
+export const requireEntityTableName = {
+  meta: {
+    type: "problem",
+    docs: { description: "`@Entity()` names its table explicitly." },
+    schema: [],
+    messages: {
+      inferred:
+        "`@Entity()` here lets the ORM infer the table name from the class name, so renaming the class renames the table - which `synchronize` performs as a DROP and CREATE rather than a migration. A class rename is a refactor; a dropped table is an outage. Name the table.",
+    },
+  },
+  create(context) {
+    /** Both `@Entity("t")` and `@Entity({ name: "t" })` name the table. */
+    const isTableName = (argument) =>
+      (argument.type === "Literal" && typeof argument.value === "string") || argument.type === "TemplateLiteral"
+    return {
+      Decorator(node) {
+        const expression = node.expression
+        if (expression.type !== "CallExpression") return
+        if (expression.callee.type !== "Identifier" || expression.callee.name !== "Entity") return
+        // The options form is not a stylistic variant to discourage: it is the ONLY form that can
+        // also carry a schema qualifier, so rejecting it would push an author to delete the schema
+        // to satisfy the rule - a worse outcome than the inferred name this exists to prevent.
+        const named = expression.arguments.some(
+          (argument) =>
+            isTableName(argument)
+            || (argument.type === "ObjectExpression"
+              && argument.properties.some(
+                (property) =>
+                  property.type === "Property"
+                  && !property.computed
+                  && (property.key.name === "name" || property.key.value === "name")
+                  && isTableName(property.value),
+              )),
+        )
+        if (!named) context.report({ node, messageId: "inferred" })
+      },
+    }
+  },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+  "must-inject-entity-manager": mustInjectEntityManager,
+  "no-injected-repository": noInjectedRepository,
+  "require-entity-table-name": requireEntityTableName,
+}
+
+/**
+ * The level this law asks for, as the plugin's own opinion.
+ *
+ * All three measured at zero debt in the reference repository, so all three ship at `error`. A
+ * repository adopting them into an existing tree measures first and lands anything above zero at
+ * `warn` with the count beside it.
+ */
+export const recommended = {
+  "starci-be/must-inject-entity-manager": "error",
+  "starci-be/no-injected-repository": "error",
+  "starci-be/require-entity-table-name": "error",
+}
+
+/** Path helper shared with the other backend law modules. */
+export { normalizePath }

package/e2e-flow.mjs

@@ -0,0 +1,213 @@
+/**
+ * The rules that hold `e2e-flow.md`.
+ *
+ * FIVE OF THE TWELVE RULES HAVE A MACHINE-CHECKABLE HALF HERE. That is the honest number rather
+ * than a gap somebody should close. A rule earns its place by being exact: it must fire on a syntactic shape, not on a
+ * judgement, or it becomes something authors learn to disable and the law is worse off than when
+ * nothing enforced it.
+ *
+ * What was measured and left alone, so the next reader does not "finish the job":
+ *
+ *   - E2E-1 (one file, one flow, named for the sentence). A filename cannot be checked against a
+ *     business sentence. `course-purchase.e2e-spec.ts` and `resolver-group.e2e-spec.ts` are the same
+ *     shape to a parser and opposite things to a reader.
+ *   - E2E-2 (named steps, not one long case). Counting `it` blocks would refuse a flow that is
+ *     genuinely one step, and a rule whose first false positive is legitimate teaches authors that
+ *     the rule is wrong rather than that they are.
+ *   - E2E-5, E2E-6 and E2E-9 turn on WHAT is asserted or WHO is acting, which is meaning.
+ *   - E2E-8 (one place stands the world up) is a fact about a repository's fixtures, not about a
+ *     file, so it belongs to a gate that can see the tree rather than to a rule that sees one file.
+ *   - E2E-10 (a flow logs nothing) is already held: `no-console` and `no-framework-logger` in the
+ *     observability law cover every call site, and a second rule saying the same thing in this lane
+ *     would double every report.
+ *
+ * The rules below enforce only exact syntax: transport bypass, absence of any persisted-state read,
+ * direct provider imports, sleeps and branches. They do not pretend to judge business meaning.
+ */
+
+/** Files this law governs. A flow is a named lane, not every file that happens to touch a database. */
+const isE2eSpec = (filename) => /\.e2e-spec\.ts$/.test(String(filename || "").replace(/\\/g, "/"))
+
+/** Names a repository sleeps by. Awaiting any of them is waiting for a duration instead of a state. */
+const SLEEPERS = new Set(["sleep", "delay", "wait", "pause", "setTimeout"])
+
+/** E2E enters through production transport and never invokes an internal actor directly. */
+export const e2eUsesProductionTransport = {
+  meta: {
+    type: "problem",
+    docs: { description: "Operational E2E keeps the production transport boundary in the proof." },
+    schema: [],
+    messages: {
+      busImport: "`{{name}}` is an internal dispatcher. Enter through GraphQL, HTTP, socket, broker or scheduler.",
+      direct: "Direct `.{{method}}()` skips production routing and delivery semantics.",
+      actor: "Calling `{{name}}` directly bypasses the broker/CQRS boundary that owns it.",
+    },
+  },
+  create(context) {
+    if (!isE2eSpec(context.filename || context.getFilename())) return {}
+    const buses = new Set(["CommandBus", "QueryBus", "EventBus"])
+    return {
+      ImportDeclaration(node) {
+        if (node.source.value !== "@nestjs/cqrs") return
+        for (const specifier of node.specifiers) {
+          if (specifier.type !== "ImportSpecifier") continue
+          const imported = specifier.imported.name || specifier.imported.value
+          if (buses.has(imported)) context.report({ node: specifier, messageId: "busImport", data: { name: imported } })
+        }
+      },
+      CallExpression(node) {
+        const callee = node.callee
+        if (callee.type !== "MemberExpression" || callee.computed) return
+        const method = callee.property.name
+        if (method === "execute" || method === "process") {
+          context.report({ node: callee.property, messageId: "direct", data: { method } })
+          return
+        }
+        let receiver = callee.object
+        while (receiver && ["TSAsExpression", "TSTypeAssertion", "ChainExpression"].includes(receiver.type)) receiver = receiver.expression
+        if (receiver && receiver.type === "Identifier" && /(?:Worker|Handler)$/.test(receiver.name)) {
+          context.report({ node: callee.property, messageId: "actor", data: { name: receiver.name } })
+        }
+      },
+    }
+  },
+}
+
+/** E2E reads the consequence from persistent state rather than only its response envelope. */
+export const e2eAssertsPersistedState = {
+  meta: {
+    type: "problem",
+    docs: { description: "E2E reads a persisted business consequence." },
+    schema: [],
+    messages: { state: "This E2E never reads persisted state back; an envelope alone is not a business consequence." },
+  },
+  create(context) {
+    if (!isE2eSpec(context.filename || context.getFilename())) return {}
+    let readsState = false
+    const readers = /^(?:entityManager|dataSource|EntityManager|DataSource|getRepository|queryRunner)$/
+    return {
+      Identifier(node) { if (readers.test(node.name)) readsState = true },
+      "Program:exit"(node) { if (!readsState) context.report({ node, messageId: "state" }) },
+    }
+  },
+}
+
+/** Model quality belongs in harness; E2E scripts only the provider boundary. */
+export const noModelCallInE2e = {
+  meta: {
+    type: "problem",
+    docs: { description: "E2E never reaches a paid or nondeterministic model provider." },
+    schema: [],
+    messages: { provider: "`{{source}}` reaches a model provider from E2E. Script the external result and keep internal policy real." },
+  },
+  create(context) {
+    if (!isE2eSpec(context.filename || context.getFilename())) return {}
+    const providers = /^(?:@anthropic-ai\/|openai$|openai\/|ollama$|@google\/generative-ai|@mistralai\/|cohere-ai)/
+    return {
+      ImportDeclaration(node) {
+        const source = node.source.value
+        if (typeof source === "string" && providers.test(source)) context.report({ node, messageId: "provider", data: { source } })
+      },
+    }
+  },
+}
+
+// -- E2E-3 ----------------------------------------------------------------------------------------
+
+/** A flow polls until the state settles; it never waits for a duration. */
+export const noSleepInFlow = {
+  meta: {
+    type: "problem",
+    docs: { description: "A flow polls for the state it needs, with a deadline. It never sleeps." },
+    schema: [],
+    messages: {
+      sleep:
+        "`{{name}}` waits for a DURATION, and a duration is a guess about somebody else's machine. It is too long on the machine that passes - every run pays it - and too short on the one that matters, where it fails as a flake nobody can reproduce. Poll for the state you are actually waiting for, with a deadline, so the test says what it wanted rather than how long it was willing to sit there.",
+      timer:
+        "A promise around `setTimeout` is a sleep with the name taken off. The objection is the same: nothing here says which state the flow is waiting for, so the failure message when it expires names a timeout instead of the thing that never happened. Poll the state, with a deadline.",
+    },
+  },
+  create(context) {
+    if (!isE2eSpec(context.filename || context.getFilename())) return {}
+    return {
+      CallExpression(node) {
+        const callee = node.callee
+        if (!callee || callee.type !== "Identifier" || !SLEEPERS.has(callee.name)) return
+        // A `setTimeout` wrapped in `new Promise` is reported once, as `timer`, by the branch below.
+        // Reporting it here as well would put two findings on one sleep and teach nobody anything.
+        for (let current = node.parent; current; current = current.parent) {
+          if (current.type === "NewExpression" && current.callee && current.callee.name === "Promise") return
+        }
+        context.report({ node, messageId: "sleep", data: { name: callee.name } })
+      },
+      NewExpression(node) {
+        if (!node.callee || node.callee.name !== "Promise") return
+        const source = context.sourceCode || context.getSourceCode()
+        if (/setTimeout/.test(source.getText(node))) context.report({ node, messageId: "timer" })
+      },
+    }
+  },
+}
+
+// -- E2E-7 ----------------------------------------------------------------------------------------
+
+/** A step asserts one outcome. A branch means the test is prepared for either, which is no assertion. */
+export const noBranchInFlowStep = {
+  meta: {
+    type: "problem",
+    docs: { description: "A flow step takes no branch: it asserts the one outcome the business promises." },
+    schema: [],
+    messages: {
+      branch:
+        "A branch inside a step means this test passes down either path, so a green run stops being evidence that the business worked - it only proves the code reached the end. The flow knows which outcome it is asserting: state it. If two outcomes are both legitimate, they are two steps, or two flows.",
+    },
+  },
+  create(context) {
+    if (!isE2eSpec(context.filename || context.getFilename())) return {}
+    const source = context.sourceCode || context.getSourceCode()
+
+    /** True when this node sits inside the callback of an `it(...)`. */
+    const insideStep = (node) => {
+      for (let current = node.parent; current; current = current.parent) {
+        if (current.type !== "CallExpression") continue
+        const callee = current.callee
+        const name = callee && (callee.name || (callee.object && callee.object.name))
+        if (name === "it" || name === "test") return true
+      }
+      return false
+    }
+
+    const report = (node) => {
+      if (insideStep(node)) context.report({ node, messageId: "branch" })
+    }
+
+    return {
+      IfStatement: report,
+      ConditionalExpression: report,
+      SwitchStatement: report,
+      LogicalExpression(node) {
+        // `a && b` used as a STATEMENT is a hidden if; the same operator inside an assertion is not
+        if (node.parent && node.parent.type === "ExpressionStatement") report(node)
+        // touching the source keeps the helper honest if the shape ever changes
+        void source
+      },
+    }
+  },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+  "e2e-uses-production-transport": e2eUsesProductionTransport,
+  "e2e-asserts-persisted-state": e2eAssertsPersistedState,
+  "no-model-call-in-e2e": noModelCallInE2e,
+  "no-sleep-in-flow": noSleepInFlow,
+  "no-branch-in-flow-step": noBranchInFlowStep,
+}
+
+/**
+ * The level this law asks for, as the plugin's own opinion.
+ *
+ * Both are exact and both fire on a syntactic shape rather than on a judgement, so neither carries
+ * the false-positive risk that would justify adopting it at `warn`.
+ */
+export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-be/${name}`, "error"]))

package/event-delivery.mjs

@@ -0,0 +1,40 @@
+const normalizePath = (filename) => String(filename || "").replace(/\\/g, "/")
+
+/** The NATS bridge rejects self-echo and claims redelivery before local fan-out. */
+export const natsBridgeDeliveryContract = {
+  meta: {
+    type: "problem",
+    docs: { description: "The central NATS bridge preserves cross-instance delivery invariants." },
+    schema: [],
+    messages: {
+      origin: "Drop envelopes whose producer id matches this instance before local emit.",
+      digest: "Claim/check the envelope digest before local emit so redelivery is idempotent.",
+    },
+  },
+  create(context) {
+    if (!normalizePath(context.filename || context.getFilename()).endsWith(
+      "/event/nats/nats-bridge.service.ts",
+    )) return {}
+    return {
+      "Program:exit"(node) {
+        const source = context.sourceCode || context.getSourceCode()
+        const text = source.getText()
+        const originIndex = text.search(/parsed\.id\s*===\s*this\.instanceService\.getId\(\)/)
+        const digestIndex = text.indexOf("parsed.digest")
+        const emitIndex = text.indexOf("this.eventEmitter.emit")
+        if (originIndex < 0 || emitIndex < 0 || originIndex > emitIndex) {
+          context.report({ node, messageId: "origin" })
+        }
+        if (digestIndex < 0 || emitIndex < 0 || digestIndex > emitIndex) {
+          context.report({ node, messageId: "digest" })
+        }
+      },
+    }
+  },
+}
+
+export const rules = { "nats-bridge-delivery-contract": natsBridgeDeliveryContract }
+
+export const recommended = {
+  "starci-be/nats-bridge-delivery-contract": "error",
+}

package/exception-identity.mjs

@@ -0,0 +1,200 @@
+/**
+ * The rules that hold `exception-identity.md`.
+ *
+ * THREE RULES OVER ONE DECLARATION, AND THE FIRST IS WHAT MAKES THE OTHER GATES REAL. The
+ * metadata-object rule, the base-class rule and the folder rule in `exceptions.mjs` all key on a name
+ * ending in `Exception`, and the throw-site rule recognises only `Error` and the framework names. A
+ * failure declared as `SomethingError` therefore sits inside the errors folder, extends the house
+ * base, and is reported by none of them; the gate says nothing and that reads as agreement.
+ *
+ * The second rule is the one a client feels. The code is what Apollo stamps onto every GraphQL error
+ * (`formatError` in the monolithic server module says so in as many words: code matching, not status,
+ * is the front end's primary signal), so a code that drifts from its class is a wire contract nobody
+ * can predict from the name - and a code copied from the exception above it makes two unrelated
+ * failures arrive identical, which is the exact defect `EXCEPTION-1` refuses framework exceptions for.
+ *
+ * The third keeps the payload's type named after the failure it belongs to, so the shape a throw site
+ * must satisfy is reachable from the exception's own name.
+ */
+
+/** The house base every exception extends. */
+const EXCEPTION_BASE = "AbstractException"
+
+/** Anything named like an exception. */
+const EXCEPTION_NAME = /Exception$/
+
+/** A class declaration that extends the house base - the only shape these rules govern. */
+const isHouseException = (node) =>
+  Boolean(node.id) && Boolean(node.superClass) && node.superClass.type === "Identifier" && node.superClass.name === EXCEPTION_BASE
+
+/** The constructor of a class body, when it declares one. */
+const constructorOf = (node) =>
+  node.body.body.find((member) => member.type === "MethodDefinition" && member.kind === "constructor")
+
+/** The `super(...)` call inside a constructor, which is where the message and the code are passed. */
+const superCallOf = (ctor) => {
+  const found = []
+  const visit = (statements) => {
+    for (const statement of statements ?? []) {
+      if (
+        statement.type === "ExpressionStatement" &&
+        statement.expression.type === "CallExpression" &&
+        statement.expression.callee.type === "Super"
+      ) {
+        found.push(statement.expression)
+      }
+    }
+  }
+  visit(ctor.value.body?.body)
+  return found[0]
+}
+
+/** Letters only, upper case: `COURSE_NOT_FOUND_EXCEPTION` and `CourseNotFoundException` compare equal. */
+const letters = (text) => String(text).replace(/_/g, "").toUpperCase()
+
+// -- IDENTITY-1 ------------------------------------------------------------------------------------
+
+/** The class name ends in `Exception`, because that suffix is what every other exception rule sees. */
+export const exceptionNameEndsInException = {
+  meta: {
+    type: "problem",
+    docs: { description: "A class extending `AbstractException` is named `*Exception`." },
+    schema: [],
+    messages: {
+      suffix:
+        "`{{name}}` extends `AbstractException` but is not named `*Exception`. Every rule guarding exceptions matches on that suffix - the throw-site rule, the metadata-object rule, the base-class rule and the folder rule all skip this class, so it is a failure NOTHING checks while the gate stays green. Rename it `{{suggestion}}`.",
+    },
+  },
+  create(context) {
+    return {
+      ClassDeclaration(node) {
+        if (!isHouseException(node) || EXCEPTION_NAME.test(node.id.name)) return
+        context.report({
+          node: node.id,
+          messageId: "suffix",
+          data: {
+            name: node.id.name,
+            suggestion: `${node.id.name.replace(/Error$/, "")}Exception`,
+          },
+        })
+      },
+    }
+  },
+}
+
+// -- IDENTITY-2 ------------------------------------------------------------------------------------
+
+/** The code is the class name, so nothing has to be looked up and nothing can be quietly reused. */
+export const exceptionCodeMatchesClassName = {
+  meta: {
+    type: "problem",
+    docs: { description: "The code passed to `super()` spells the class name." },
+    schema: [],
+    messages: {
+      mismatch:
+        "`{{name}}` reports the code `{{code}}`. The code is what a client matches on, so it is derived from the class name and nothing else: `{{expected}}`. A code that says something different cannot be predicted from the name, cannot be found by searching for the class, and - when it was copied from the exception above it - makes two unrelated failures arrive at the client identical.",
+      notLiteral:
+        "`{{name}}` builds its code instead of stating one. A code assembled at runtime cannot be found by searching for it, which is the one thing every consumer of it does - the client matching on it, the alert grouping by it, the reader asking where this failure comes from. Pass the literal `{{expected}}`.",
+    },
+  },
+  create(context) {
+    return {
+      ClassDeclaration(node) {
+        if (!isHouseException(node)) return
+        const ctor = constructorOf(node)
+        if (!ctor) return
+        const call = superCallOf(ctor)
+        if (!call || call.arguments.length < 2) return
+        const code = call.arguments[1]
+        const expected = `${node.id.name
+          .replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2")
+          .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+          .toUpperCase()}`
+        if (code.type !== "Literal" || typeof code.value !== "string") {
+          context.report({ node: code, messageId: "notLiteral", data: { name: node.id.name, expected } })
+          return
+        }
+        // Underscore placement is not the ruling - `GRAPHQL_DATA` and `GRAPH_QL_DATA` name the same
+        // class, and an acronym has no single correct split. The letters are the ruling.
+        if (letters(code.value) === letters(node.id.name)) return
+        context.report({
+          node: code,
+          messageId: "mismatch",
+          data: { name: node.id.name, code: code.value, expected },
+        })
+      },
+    }
+  },
+}
+
+// -- IDENTITY-3 ------------------------------------------------------------------------------------
+
+/** The metadata type carries the exception's name, so the payload shape is reachable from it. */
+export const exceptionMetadataTypeNamedForClass = {
+  meta: {
+    type: "problem",
+    docs: { description: "The constructor's metadata parameter is typed `<Class>Metadata`." },
+    schema: [],
+    messages: {
+      untyped:
+        "`{{name}}`'s metadata parameter states no type. The parameter is the whole contract a throw site has to satisfy, and an untyped one accepts every object - including the one missing the id the failure exists to carry. Type it `{{expected}}`.",
+      named:
+        "`{{name}}` types its metadata as `{{actual}}`. Name the type after the exception - `{{expected}}` - so the payload is reachable from the failure's own name, and so the day this failure gains its first field there is already a place to put it that no call site has to learn.",
+    },
+  },
+  create(context) {
+    return {
+      ClassDeclaration(node) {
+        if (!isHouseException(node)) return
+        const ctor = constructorOf(node)
+        if (!ctor) return
+        // `{ ... }: Metadata = {}` parses as an assignment pattern wrapping the destructuring, and
+        // reading only the outer node skipped exactly the declarations that had given up on a named
+        // type - the ones this rule exists for.
+        const declared = ctor.value.params[0]
+        const param = declared?.type === "AssignmentPattern" ? declared.left : declared
+        if (!param || param.type !== "ObjectPattern") return
+        const expected = `${node.id.name}Metadata`
+        const annotation = param.typeAnnotation?.typeAnnotation
+        if (!annotation) {
+          context.report({ node: param, messageId: "untyped", data: { name: node.id.name, expected } })
+          return
+        }
+        if (annotation.type !== "TSTypeReference" || annotation.typeName.type !== "Identifier") return
+        if (annotation.typeName.name === expected) return
+        context.report({
+          node: annotation,
+          messageId: "named",
+          data: { name: node.id.name, actual: annotation.typeName.name, expected },
+        })
+      },
+    }
+  },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+  "exception-name-ends-in-exception": exceptionNameEndsInException,
+  "exception-code-matches-class-name": exceptionCodeMatchesClassName,
+  "exception-metadata-type-named-for-class": exceptionMetadataTypeNamedForClass,
+}
+
+/**
+ * The levels this law asks for.
+ *
+ * All three measured with debt when they landed and all three are at zero now, which is the only
+ * state that earns `error`: a rule switched on over existing offenders trains its readers to scroll
+ * past it, and a reader who has learned to scroll past one rule reads none of them. Each arrived at
+ * `warn` with a ledger entry naming its offenders and flipped as that entry closed - metadata types
+ * first, because renaming one costs no caller anything, then the codes and the class names, which
+ * are wire-visible and were measured against every client before being moved.
+ *
+ * What that measurement found is worth keeping: across three front ends, five exception codes are
+ * matched in total, and none of them belonged to a drifted declaration. The assumption that a code
+ * change means a coordinated release was expensive to believe and cheap to check.
+ */
+export const recommended = {
+  "starci-be/exception-name-ends-in-exception": "error", // debt paid 2026-08-14
+  "starci-be/exception-code-matches-class-name": "error", // debt paid 2026-08-14
+  "starci-be/exception-metadata-type-named-for-class": "error", // debt paid 2026-08-14
+}