@starci/eslint-canon-be 1.2.1 → 1.7.0

package/index.mjs

@@ -1,107 +1,137 @@
-/**
- * The back-end plugin: every law's rules, gathered once.
- *
- * A consuming repository imports THIS and nothing below it. Registering rules one by one in the
- * target's own plugin file is how the two lists drift: a law gains a rule here, nobody adds it there,
- * and the rule ships as a document. That is not hypothetical for this axis - the back end kept a
- * hand-written plugin whose names had already diverged from canon's, so `no-nest-logger` and
- * `no-framework-logger` were one law wearing two names and no build could say which had fired.
- *
- * The target's `eslint.config.mjs` stays the authority on what is switched on, at what level and
- * over which globs. That is a different question from what EXISTS, and this file answers only the
- * second.
- *
- * WHAT THIS FILE REFUSES TO DO. It does not rename anything. A rule's published name is part of the
- * law that declares it, because that name is what appears in a build log, in a disable comment and in
- * every conversation about the failure. Aliasing one here to match a target's older spelling would
- * leave two names for one rule and no way to tell which a message came from.
- */
-import { recommended as authorizationRecommended, rules as authorizationRules } from "./authorization.mjs"
-import { recommended as cdcRecommended, rules as cdcRules } from "./cdc.mjs"
-import { recommended as commentsRecommended, rules as commentsRules } from "./comments.mjs"
-import { recommended as cqrsRecommended, rules as cqrsRules } from "./cqrs.mjs"
-import { recommended as dataAccessRecommended, rules as dataAccessRules } from "./data-access.mjs"
-import { recommended as e2eFlowRecommended, rules as e2eFlowRules } from "./e2e-flow.mjs"
-import { recommended as eventDeliveryRecommended, rules as eventDeliveryRules } from "./event-delivery.mjs"
-import { recommended as exceptionIdentityRecommended, rules as exceptionIdentityRules } from "./exception-identity.mjs"
-import { recommended as exceptionsRecommended, rules as exceptionsRules } from "./exceptions.mjs"
-import { recommended as moduleLayeringRecommended, rules as moduleLayeringRules } from "./module-layering.mjs"
-import { recommended as namingRecommended, rules as namingRules } from "./naming.mjs"
-import { recommended as observabilityRecommended, rules as observabilityRules } from "./observability.mjs"
-import { recommended as testingRecommended, rules as testingRules } from "./testing.mjs"
-import { recommended as transportRecommended, rules as transportRules } from "./transport.mjs"
-import { recommended as typeSafetyRecommended, rules as typeSafetyRules } from "./type-safety.mjs"
-
-/** Each law's contribution, kept separate so a duplicate name is detectable rather than silent. */
-const CONTRIBUTIONS = [
-    { law: "authorization", rules: authorizationRules, recommended: authorizationRecommended },
-    { law: "cdc", rules: cdcRules, recommended: cdcRecommended },
-    { law: "comments", rules: commentsRules, recommended: commentsRecommended },
-    { law: "cqrs", rules: cqrsRules, recommended: cqrsRecommended },
-    { law: "data-access", rules: dataAccessRules, recommended: dataAccessRecommended },
-    { law: "e2e-flow", rules: e2eFlowRules, recommended: e2eFlowRecommended },
-    { law: "event-delivery", rules: eventDeliveryRules, recommended: eventDeliveryRecommended },
-    { law: "exception-identity", rules: exceptionIdentityRules, recommended: exceptionIdentityRecommended },
-    { law: "exceptions", rules: exceptionsRules, recommended: exceptionsRecommended },
-    { law: "module-layering", rules: moduleLayeringRules, recommended: moduleLayeringRecommended },
-    { law: "naming", rules: namingRules, recommended: namingRecommended },
-    { law: "observability", rules: observabilityRules, recommended: observabilityRecommended },
-    { law: "testing", rules: testingRules, recommended: testingRecommended },
-    { law: "transport", rules: transportRules, recommended: transportRecommended },
-    { law: "type-safety", rules: typeSafetyRules, recommended: typeSafetyRecommended },
-]
-
-/** Every gathered law. */
-export const lawOwners = CONTRIBUTIONS.map((entry) => entry.law)
-
-/**
- * Every (law, rule name) pair as DECLARED, before any collapsing.
- *
- * This exists because `ruleOwners` and `rules` below are both built with `Object.fromEntries`, which
- * silently keeps the last writer when two laws declare one name. A test that walks either of them
- * therefore cannot see a collision: the duplicate is already gone by the time it looks, so every
- * name appears exactly once BY CONSTRUCTION and the check passes forever while being blind.
- *
- * That is exactly what happened - three back-end rules were declared by two laws each, one copy was
- * discarded on import, and the guard reported green the whole time. A gate that cannot fail is
- * indistinguishable from no gate, so the raw declarations are published here and the guard walks
- * these instead.
- */
-export const ruleDeclarations = CONTRIBUTIONS.flatMap((entry) =>
-  Object.keys(entry.rules).map((name) => ({ law: entry.law, name })),
-)
-
-/**
- * Which law declares each rule.
- *
- * Exported because a failing rule is a question about a LAW, and the shortest path from a build log
- * to the document that explains it is this map. It answers "who owns this name" for a name that
- * SHIPPED; proving no two laws claim one name is `ruleDeclarations`' job, not this map's.
- */
-export const ruleOwners = Object.fromEntries(
-    CONTRIBUTIONS.flatMap((entry) => Object.keys(entry.rules).map((name) => [name, entry.law])),
-)
-
-/** Every rule this canon publishes, keyed by its published name. */
-export const rules = Object.fromEntries(
-    CONTRIBUTIONS.flatMap((entry) => Object.entries(entry.rules)),
-)
-
-/**
- * The levels this canon asks for, as the plugin's own opinion.
- *
- * Unlike the front end, this axis allows `warn`, and the allowance is the burn-down playbook rather
- * than a softer standard: a rule measured with debt arrives at `warn` with a ledger entry naming the
- * offenders, and flips to `error` the day that entry closes. Switching a rule on over existing
- * offenders is what teaches an author to scroll past it, and a reader who has learned to scroll past
- * one rule reads none of them.
- */
-export const recommended = Object.fromEntries(
-    CONTRIBUTIONS.flatMap((entry) => Object.entries(entry.recommended)),
-)
-
-/** The plugin object, shaped the way a flat config expects it. */
-export default {
-    meta: { name: "eslint-plugin-starci-be" },
-    rules,
-}
+/**
+ * The back-end plugin: every law's rules, gathered once.
+ *
+ * A consuming repository imports THIS and nothing below it. Registering rules one by one in the
+ * target's own plugin file is how the two lists drift: a law gains a rule here, nobody adds it there,
+ * and the rule ships as a document. That is not hypothetical for this axis - the back end kept a
+ * hand-written plugin whose names had already diverged from canon's, so `no-nest-logger` and
+ * `no-framework-logger` were one law wearing two names and no build could say which had fired.
+ *
+ * The target's `eslint.config.mjs` stays the authority on what is switched on, at what level and
+ * over which globs. That is a different question from what EXISTS, and this file answers only the
+ * second.
+ *
+ * WHAT THIS FILE REFUSES TO DO. It does not rename anything. A rule's published name is part of the
+ * law that declares it, because that name is what appears in a build log, in a disable comment and in
+ * every conversation about the failure. Aliasing one here to match a target's older spelling would
+ * leave two names for one rule and no way to tell which a message came from.
+ */
+import { recommended as asyncDisciplineRecommended, rules as asyncDisciplineRules } from "./async-discipline.mjs"
+import { recommended as authorizationRecommended, rules as authorizationRules } from "./authorization.mjs"
+import { recommended as cdcRecommended, rules as cdcRules } from "./cdc.mjs"
+import { recommended as commentsRecommended, rules as commentsRules } from "./comments.mjs"
+import { recommended as configOwnerRecommended, rules as configOwnerRules } from "./config-owner.mjs"
+import { recommended as cqrsRecommended, rules as cqrsRules } from "./cqrs.mjs"
+import { recommended as dataAccessRecommended, rules as dataAccessRules } from "./data-access.mjs"
+import { recommended as defaultDenyRecommended, rules as defaultDenyRules } from "./default-deny.mjs"
+import { recommended as e2eFlowRecommended, rules as e2eFlowRules } from "./e2e-flow.mjs"
+import { recommended as errorHandlingRecommended, rules as errorHandlingRules } from "./error-handling.mjs"
+import { recommended as eventDeliveryRecommended, rules as eventDeliveryRules } from "./event-delivery.mjs"
+import { recommended as idempotencyRecommended, rules as idempotencyRules } from "./idempotency.mjs"
+import { recommended as inputBoundsRecommended, rules as inputBoundsRules } from "./input-bounds.mjs"
+import { recommended as logSafetyRecommended, rules as logSafetyRules } from "./log-safety.mjs"
+import { recommended as moduleLayeringRecommended, rules as moduleLayeringRules } from "./module-layering.mjs"
+import { recommended as moduleShapeRecommended, rules as moduleShapeRules } from "./module-shape.mjs"
+import { recommended as namingRecommended, rules as namingRules } from "./naming.mjs"
+import { recommended as observabilityRecommended, rules as observabilityRules } from "./observability.mjs"
+import { recommended as querySafetyRecommended, rules as querySafetyRules } from "./query-safety.mjs"
+import { recommended as resilienceRecommended, rules as resilienceRules } from "./resilience.mjs"
+import { recommended as schemaAuthorityRecommended, rules as schemaAuthorityRules } from "./schema-authority.mjs"
+import { recommended as sizeBudgetRecommended, rules as sizeBudgetRules } from "./size-budget.mjs"
+import { recommended as specQualityRecommended, rules as specQualityRules } from "./spec-quality.mjs"
+import { recommended as suppressionRecommended, rules as suppressionRules } from "./suppression.mjs"
+import { recommended as temporalRecommended, rules as temporalRules } from "./temporal.mjs"
+import { recommended as testingRecommended, rules as testingRules } from "./testing.mjs"
+import { recommended as transportRecommended, rules as transportRules } from "./transport.mjs"
+import { recommended as typeSafetyRecommended, rules as typeSafetyRules } from "./type-safety.mjs"
+import { recommended as userCopyRecommended, rules as userCopyRules } from "./user-copy.mjs"
+
+/** Each law's contribution, kept separate so a duplicate name is detectable rather than silent. */
+const CONTRIBUTIONS = [
+    { law: "async-discipline", rules: asyncDisciplineRules, recommended: asyncDisciplineRecommended },
+    { law: "authorization", rules: authorizationRules, recommended: authorizationRecommended },
+    { law: "cdc", rules: cdcRules, recommended: cdcRecommended },
+    { law: "comments", rules: commentsRules, recommended: commentsRecommended },
+    { law: "config-owner", rules: configOwnerRules, recommended: configOwnerRecommended },
+    { law: "cqrs", rules: cqrsRules, recommended: cqrsRecommended },
+    { law: "data-access", rules: dataAccessRules, recommended: dataAccessRecommended },
+    { law: "default-deny", rules: defaultDenyRules, recommended: defaultDenyRecommended },
+    { law: "e2e-flow", rules: e2eFlowRules, recommended: e2eFlowRecommended },
+    { law: "error-handling", rules: errorHandlingRules, recommended: errorHandlingRecommended },
+    { law: "event-delivery", rules: eventDeliveryRules, recommended: eventDeliveryRecommended },
+    { law: "idempotency", rules: idempotencyRules, recommended: idempotencyRecommended },
+    { law: "input-bounds", rules: inputBoundsRules, recommended: inputBoundsRecommended },
+    { law: "log-safety", rules: logSafetyRules, recommended: logSafetyRecommended },
+    { law: "module-layering", rules: moduleLayeringRules, recommended: moduleLayeringRecommended },
+    { law: "module-shape", rules: moduleShapeRules, recommended: moduleShapeRecommended },
+    { law: "naming", rules: namingRules, recommended: namingRecommended },
+    { law: "observability", rules: observabilityRules, recommended: observabilityRecommended },
+    { law: "query-safety", rules: querySafetyRules, recommended: querySafetyRecommended },
+    { law: "resilience", rules: resilienceRules, recommended: resilienceRecommended },
+    { law: "schema-authority", rules: schemaAuthorityRules, recommended: schemaAuthorityRecommended },
+    { law: "size-budget", rules: sizeBudgetRules, recommended: sizeBudgetRecommended },
+    { law: "spec-quality", rules: specQualityRules, recommended: specQualityRecommended },
+    { law: "suppression", rules: suppressionRules, recommended: suppressionRecommended },
+    { law: "temporal", rules: temporalRules, recommended: temporalRecommended },
+    { law: "testing", rules: testingRules, recommended: testingRecommended },
+    { law: "transport", rules: transportRules, recommended: transportRecommended },
+    { law: "type-safety", rules: typeSafetyRules, recommended: typeSafetyRecommended },
+    { law: "user-copy", rules: userCopyRules, recommended: userCopyRecommended },
+]
+
+/** Every gathered law. */
+export const lawOwners = CONTRIBUTIONS.map((entry) => entry.law)
+
+/**
+ * Every (law, rule name) pair as DECLARED, before any collapsing.
+ *
+ * This exists because `ruleOwners` and `rules` below are both built with `Object.fromEntries`, which
+ * silently keeps the last writer when two laws declare one name. A test that walks either of them
+ * therefore cannot see a collision: the duplicate is already gone by the time it looks, so every
+ * name appears exactly once BY CONSTRUCTION and the check passes forever while being blind.
+ *
+ * That is exactly what happened - three back-end rules were declared by two laws each, one copy was
+ * discarded on import, and the guard reported green the whole time. A gate that cannot fail is
+ * indistinguishable from no gate, so the raw declarations are published here and the guard walks
+ * these instead.
+ */
+export const ruleDeclarations = CONTRIBUTIONS.flatMap((entry) =>
+  Object.keys(entry.rules).map((name) => ({ law: entry.law, name })),
+)
+
+/**
+ * Which law declares each rule.
+ *
+ * Exported because a failing rule is a question about a LAW, and the shortest path from a build log
+ * to the document that explains it is this map. It answers "who owns this name" for a name that
+ * SHIPPED; proving no two laws claim one name is `ruleDeclarations`' job, not this map's.
+ */
+export const ruleOwners = Object.fromEntries(
+    CONTRIBUTIONS.flatMap((entry) => Object.keys(entry.rules).map((name) => [name, entry.law])),
+)
+
+/** Every rule this canon publishes, keyed by its published name. */
+export const rules = Object.fromEntries(
+    CONTRIBUTIONS.flatMap((entry) => Object.entries(entry.rules)),
+)
+
+/**
+ * The levels this canon asks for, as the plugin's own opinion.
+ *
+ * Unlike the front end, this axis allows `warn`, and the allowance is the burn-down playbook rather
+ * than a softer standard: a rule measured with debt arrives at `warn` with a ledger entry naming the
+ * offenders, and flips to `error` the day that entry closes. Switching a rule on over existing
+ * offenders is what teaches an author to scroll past it, and a reader who has learned to scroll past
+ * one rule reads none of them.
+ */
+export const recommended = Object.fromEntries(
+    CONTRIBUTIONS.flatMap((entry) => Object.entries(entry.recommended)),
+)
+
+/** The plugin object, shaped the way a flat config expects it. */
+export default {
+    meta: { name: "eslint-plugin-starci-be" },
+    rules,
+}
+
+export { starciBeConfig, linterOptions } from "./lib/config.mjs"

package/input-bounds.mjs

@@ -0,0 +1,84 @@
+/**
+ * The rules that keep input bounded (R42 `BE_INPUT_BOUNDED`).
+ *
+ * `dto-needs-validator` refuses an input class whose property carries no `class-validator` decorator. A property with
+ * no validator accepts any value the wire delivers: a string of any length, a number of any size, an array of any
+ * count. The transport layer states what it accepts; the use case never re-checks shape.
+ *
+ * An input class is one decorated `@InputType` or `@ArgsType`, or declared in a file named `*.dto.ts`, `*.input.ts`,
+ * `*.args.ts` or `*.request.ts`. A class decorated `@ObjectType` is a response and is left alone. A decorator counts as
+ * a validator only when it is imported from `class-validator`, so a `@Field` or a `@Type` does not satisfy the rule.
+ */
+import { decoratorName } from "./lib/ast.mjs"
+import { isDeclarationFile, isTestLane, normalizePath } from "./lib/path.mjs"
+
+const INPUT_FILE = /\.(?:dto|input|args|request)\.ts$/
+
+const decoratorsOf = (node) => node.decorators ?? []
+
+/** Names imported from `class-validator`, by local name. */
+const validatorImports = (program) => {
+  const names = new Set()
+  for (const statement of program.body) {
+    if (statement.type !== "ImportDeclaration" || statement.source.value !== "class-validator") continue
+    for (const specifier of statement.specifiers) names.add(specifier.local.name)
+  }
+  return names
+}
+
+/** Every property of an input class has a validator. */
+export const dtoNeedsValidator = {
+  meta: {
+    type: "problem",
+    docs: { description: "A property of an input class carries a `class-validator` decorator." },
+    schema: [],
+    messages: {
+      missing:
+        "`{{name}}` has no `class-validator` decorator, so the wire may deliver any value here: a string of any length, a number of any size, an array of any count. Add the validators the field needs (`@IsString() @MaxLength(n)`, `@IsInt() @Min(0) @Max(n)`, `@IsArray() @ArrayMaxSize(n)`, `@IsOptional()` for a nullable field).",
+    },
+  },
+  create(context) {
+    const filename = normalizePath(context.filename || context.getFilename())
+    if (isTestLane(filename) || isDeclarationFile(filename)) return {}
+    const sourceCode = context.sourceCode || context.getSourceCode()
+    let validators = null
+    return {
+      Program(node) {
+        validators = validatorImports(node)
+      },
+      ClassDeclaration(node) {
+        checkClass(node)
+      },
+      ClassExpression(node) {
+        checkClass(node)
+      },
+    }
+    function checkClass(node) {
+      const decorators = decoratorsOf(node).map(decoratorName)
+      const target = node.parent?.type === "ExportNamedDeclaration" || node.parent?.type === "ExportDefaultDeclaration" ? node.parent : node
+      const classDecorators = [...decorators, ...decoratorsOf(target).map(decoratorName)]
+      if (classDecorators.includes("ObjectType")) return
+      const isInput = classDecorators.includes("InputType") || classDecorators.includes("ArgsType") || INPUT_FILE.test(filename)
+      if (!isInput) return
+      for (const member of node.body.body) {
+        if (member.type !== "PropertyDefinition" || member.static || member.computed) continue
+        if (member.key.type !== "Identifier") continue
+        const validated = decoratorsOf(member).some((decorator) => {
+          const name = decoratorName(decorator)
+          return name !== null && validators.has(name)
+        })
+        if (!validated) context.report({ node: member.key, messageId: "missing", data: { name: sourceCode.getText(member.key) } })
+      }
+    }
+  },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+  "dto-needs-validator": dtoNeedsValidator,
+}
+
+/** Starts at error: no baseline exists, and the repositories' fix lanes clear the debt. */
+export const recommended = {
+  "starci-be/dto-needs-validator": "error",
+}

package/lib/ast.mjs

@@ -0,0 +1,81 @@
+/**
+ * Small AST helpers the HFS laws share, so each rule states its question instead of its traversal.
+ *
+ * Nothing here touches disk or the type checker: a rule reads one file's syntax and its path.
+ */
+
+const SKIP_KEYS = new Set(["parent", "loc", "range", "tokens", "comments"])
+
+const isNode = (value) => value !== null && typeof value === "object" && typeof value.type === "string"
+
+const FUNCTION_TYPES = new Set(["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"])
+
+/**
+ * Visits `node` and every descendant, depth first.
+ *
+ * @param {object} node - The subtree root.
+ * @param {(child: object) => void} visit - Called with each node.
+ * @param {{ intoFunctions?: boolean }} [options] - `intoFunctions: false` stops at nested function boundaries.
+ * @returns {void}
+ */
+export const walk = (node, visit, { intoFunctions = true } = {}) => {
+    if (!isNode(node)) return
+    visit(node)
+    for (const [key, value] of Object.entries(node)) {
+        if (SKIP_KEYS.has(key)) continue
+        if (Array.isArray(value)) {
+            for (const child of value) {
+                if (!isNode(child)) continue
+                if (!intoFunctions && FUNCTION_TYPES.has(child.type)) continue
+                walk(child, visit, { intoFunctions })
+            }
+        } else if (isNode(value)) {
+            if (!intoFunctions && FUNCTION_TYPES.has(value.type)) continue
+            walk(value, visit, { intoFunctions })
+        }
+    }
+}
+
+/** True when any node of the subtree satisfies `predicate`. */
+export const some = (node, predicate, options) => {
+    let found = false
+    walk(node, (child) => {
+        if (!found && predicate(child)) found = true
+    }, options)
+    return found
+}
+
+/** The name a property key, identifier or string literal spells, else null. */
+export const keyName = (node) => {
+    if (!node) return null
+    if (node.type === "Identifier") return node.name
+    if (node.type === "Literal" && typeof node.value === "string") return node.value
+    if (node.type === "PrivateIdentifier") return node.name
+    return null
+}
+
+/** The name of a decorator (`@Foo` or `@Foo(...)`), else null. */
+export const decoratorName = (decorator) => {
+    const expression = decorator?.expression
+    if (!expression) return null
+    if (expression.type === "Identifier") return expression.name
+    if (expression.type === "CallExpression" && expression.callee.type === "Identifier") return expression.callee.name
+    return null
+}
+
+/** True for a string literal or a template without substitutions, giving its text via `staticText`. */
+export const staticText = (node) => {
+    if (!node) return null
+    if (node.type === "Literal" && typeof node.value === "string") return node.value
+    if (node.type === "TemplateLiteral" && node.expressions.length === 0) return node.quasis.map((q) => q.value.cooked ?? "").join("")
+    return null
+}
+
+/** Splits `webhookSecret`, `WEBHOOK_SECRET` and `webhook-secret` into lower-case words. */
+export const wordsOf = (name) =>
+    String(name)
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2")
+        .split(/[^A-Za-z0-9]+/)
+        .filter(Boolean)
+        .map((word) => word.toLowerCase())

package/lib/config.mjs

@@ -0,0 +1,49 @@
+/**
+ * The one flat-config block that attaches the back-end canon to a repository.
+ *
+ * A consuming `eslint.config.mjs` used to hand-copy three things: the list of rules it switches off, the
+ * helper that lifts `warn` to `error`, and the source globs. Copies drift - two repositories held
+ * byte-identical files, a third had grown its own variant - and a rule that a copy switched off with the words
+ * "replaced by checks" was enforced by nothing when the replacing check ran in no gate. This factory owns the
+ * levels, so a repository states only its source globs.
+ *
+ * NO RULE IS OFF. HFS has no retired-rule list: a rule the standard no longer holds is deleted from the
+ * plugin, and a rule that stays is on. The factory refuses a recommendation that carries an `off`, so a rule
+ * cannot be published switched off and still look adopted.
+ */
+
+/** A disable directive is a weakening of lint, and one that suppresses nothing is dead weight. */
+export const linterOptions = Object.freeze({ noInlineConfig: true, reportUnusedDisableDirectives: "error" })
+
+/** The zero-warning gate reads a warning as a failure, so the canon's `warn` level is stated as `error`. */
+const asError = (setting) =>
+    setting === "warn" ? "error" : Array.isArray(setting) && setting[0] === "warn" ? ["error", ...setting.slice(1)] : setting
+
+const levelOf = (setting) => (Array.isArray(setting) ? setting[0] : setting)
+
+/**
+ * @param {object} input - Attachment options.
+ * @param {string[]} input.sources - The globs of the repository's production and spec source.
+ * @param {object} input.plugin - The plugin object, imported from this canon.
+ * @param {Record<string, unknown>} input.recommended - The recommendation, imported from this canon.
+ * @returns {object} One flat-config block.
+ */
+export const starciBeConfig = ({ sources, plugin, recommended }) => {
+    if (!Array.isArray(sources) || sources.length === 0) {
+        throw new Error("starciBeConfig needs the repository's source globs - a block that matches no file governs nothing")
+    }
+    const rules = recommended?.rules ?? recommended
+    if (!rules || Object.keys(rules).length === 0) {
+        throw new Error("starciBeConfig received an empty recommendation - a config with no rules is not adoption")
+    }
+    const off = Object.entries(rules)
+        .filter(([, setting]) => levelOf(setting) === "off")
+        .map(([name]) => name)
+    if (off.length > 0) {
+        throw new Error(`starciBeConfig refuses a recommendation with rules switched off: ${off.join(", ")}`)
+    }
+    const configured = Object.fromEntries(
+        Object.entries(rules).map(([name, setting]) => [name, asError(setting)]),
+    )
+    return { files: sources, linterOptions: { ...linterOptions }, plugins: { "starci-be": plugin }, rules: configured }
+}

package/lib/path.mjs

@@ -0,0 +1,17 @@
+/** Forward-slash form of a filename, so Windows paths compare like every other path. */
+export const normalizePath = (filename) => String(filename || "").replace(/\\/g, "/")
+
+/** A spec file: the unit lane, where a fixture may build a deliberately wrong value. */
+export const isSpecFile = (filename) => /\.(?:spec|test)\.[cm]?[jt]sx?$|-spec\.[cm]?[jt]sx?$/.test(normalizePath(filename))
+
+/** Any file of the test lanes: a spec, or anything under `src/tests/`. */
+export const isTestLane = (filename) => {
+    const file = normalizePath(filename)
+    return isSpecFile(file) || file.includes("/src/tests/")
+}
+
+/** A migration: the one place schema-changing SQL is allowed to be written. */
+export const isMigrationFile = (filename) => /\/persistence\/migrations\/[^/]+\.[cm]?[jt]s$/.test(normalizePath(filename))
+
+/** A declaration file carries types only and no runtime behaviour to police. */
+export const isDeclarationFile = (filename) => /\.d\.[cm]?ts$/.test(normalizePath(filename))

package/lib/slots.mjs

@@ -0,0 +1,60 @@
+/**
+ * The adapter between the HFS slot manifest (`knowledge/hfs/slots.yaml`) and the lint rules that need a
+ * number or a list the manifest owns: which platform capabilities may be `@Global()`, how long a source
+ * file may be, how many names a public `index.ts` may export.
+ *
+ * The manifest states these in `ruleParams.be` (the same block `ruleParams(manifest, "be")` of
+ * `scripts/lib/hfs-slots.mjs` returns) and in the `budget.indexExports` of a `be.*` slot. This file reads only those
+ * keys, and there is no other source: a manifest that does not state them, or that cannot be read, stops the lint
+ * run with an error naming the file, because the slot check owns the finding and a rule must not guess a number.
+ *
+ *   - `ruleParams.be.globalModules`  directories `src/modules/platform/<capability>/` allowed to declare `@Global()`;
+ *                                    the rule compares the capability `platform/<capability>`
+ *   - `ruleParams.be.fileLines`      `{ soft, hardGrowth }`: `soft` is the line budget; with `hardGrowth: true` a file
+ *                                    over it may not be born or grow (`file-size-growth`)
+ *   - the `budget.indexExports` of the first `be.*` slot that states one, the public-surface width
+ *
+ * The manifest is found through `STARCI_HFS_SLOTS`, else at `<runtime>/knowledge/hfs/slots.yaml` above this package.
+ */
+import { existsSync, readFileSync } from "node:fs"
+import { dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const RUNTIME_ROOT = join(HERE, "..", "..", "..", "..")
+
+const manifestFile = () => process.env.STARCI_HFS_SLOTS || join(RUNTIME_ROOT, "knowledge", "hfs", "slots.yaml")
+
+const toCapability = (dir) => String(dir).replace(/^src\/modules\//, "").replace(/\/+$/, "")
+
+/**
+ * Reads the rule parameters out of a parsed manifest.
+ *
+ * @param {object} manifest - The parsed `slots.yaml`.
+ * @returns {{ globalModules: readonly string[], fileLines: { soft: number, hardGrowth: number }, indexExports: number }} The parameters; `fileLines.hardGrowth` is the line count above which a file may not grow.
+ */
+export const paramsFromManifest = (manifest) => {
+    const be = manifest?.ruleParams?.be
+    if (!Array.isArray(be?.globalModules) || !be.globalModules.every((name) => typeof name === "string")) throw new Error("slots.yaml states no ruleParams.be.globalModules")
+    if (!Number.isInteger(be.fileLines?.soft) || typeof be.fileLines?.hardGrowth !== "boolean") throw new Error("slots.yaml states no ruleParams.be.fileLines {soft, hardGrowth}")
+    const indexSlot = Array.isArray(manifest.slots)
+        ? manifest.slots.find((slot) => String(slot?.id ?? "").startsWith("be.") && Number.isInteger(slot?.budget?.indexExports))
+        : undefined
+    if (indexSlot === undefined) throw new Error("slots.yaml states no budget.indexExports on a be.* slot")
+    const { soft, hardGrowth } = be.fileLines
+    return {
+        globalModules: be.globalModules.map(toCapability),
+        fileLines: { soft, hardGrowth: hardGrowth ? soft : Number.POSITIVE_INFINITY },
+        indexExports: indexSlot.budget.indexExports,
+    }
+}
+
+const load = async () => {
+    const file = manifestFile()
+    if (!existsSync(file)) throw new Error(`HFS slot manifest not found at ${file}`)
+    const { parseYaml } = await import(new URL("../../../../engine/yaml.mjs", import.meta.url))
+    return paramsFromManifest(parseYaml(readFileSync(file, "utf8")))
+}
+
+/** The parameters, resolved once per process. */
+export const hfsParams = await load()