@starci/eslint-canon-be 1.2.2 → 1.7.0

package/lib/slots.mjs

@@ -0,0 +1,60 @@
+/**
+ * The adapter between the HFS slot manifest (`knowledge/hfs/slots.yaml`) and the lint rules that need a
+ * number or a list the manifest owns: which platform capabilities may be `@Global()`, how long a source
+ * file may be, how many names a public `index.ts` may export.
+ *
+ * The manifest states these in `ruleParams.be` (the same block `ruleParams(manifest, "be")` of
+ * `scripts/lib/hfs-slots.mjs` returns) and in the `budget.indexExports` of a `be.*` slot. This file reads only those
+ * keys, and there is no other source: a manifest that does not state them, or that cannot be read, stops the lint
+ * run with an error naming the file, because the slot check owns the finding and a rule must not guess a number.
+ *
+ *   - `ruleParams.be.globalModules`  directories `src/modules/platform/<capability>/` allowed to declare `@Global()`;
+ *                                    the rule compares the capability `platform/<capability>`
+ *   - `ruleParams.be.fileLines`      `{ soft, hardGrowth }`: `soft` is the line budget; with `hardGrowth: true` a file
+ *                                    over it may not be born or grow (`file-size-growth`)
+ *   - the `budget.indexExports` of the first `be.*` slot that states one, the public-surface width
+ *
+ * The manifest is found through `STARCI_HFS_SLOTS`, else at `<runtime>/knowledge/hfs/slots.yaml` above this package.
+ */
+import { existsSync, readFileSync } from "node:fs"
+import { dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const RUNTIME_ROOT = join(HERE, "..", "..", "..", "..")
+
+const manifestFile = () => process.env.STARCI_HFS_SLOTS || join(RUNTIME_ROOT, "knowledge", "hfs", "slots.yaml")
+
+const toCapability = (dir) => String(dir).replace(/^src\/modules\//, "").replace(/\/+$/, "")
+
+/**
+ * Reads the rule parameters out of a parsed manifest.
+ *
+ * @param {object} manifest - The parsed `slots.yaml`.
+ * @returns {{ globalModules: readonly string[], fileLines: { soft: number, hardGrowth: number }, indexExports: number }} The parameters; `fileLines.hardGrowth` is the line count above which a file may not grow.
+ */
+export const paramsFromManifest = (manifest) => {
+    const be = manifest?.ruleParams?.be
+    if (!Array.isArray(be?.globalModules) || !be.globalModules.every((name) => typeof name === "string")) throw new Error("slots.yaml states no ruleParams.be.globalModules")
+    if (!Number.isInteger(be.fileLines?.soft) || typeof be.fileLines?.hardGrowth !== "boolean") throw new Error("slots.yaml states no ruleParams.be.fileLines {soft, hardGrowth}")
+    const indexSlot = Array.isArray(manifest.slots)
+        ? manifest.slots.find((slot) => String(slot?.id ?? "").startsWith("be.") && Number.isInteger(slot?.budget?.indexExports))
+        : undefined
+    if (indexSlot === undefined) throw new Error("slots.yaml states no budget.indexExports on a be.* slot")
+    const { soft, hardGrowth } = be.fileLines
+    return {
+        globalModules: be.globalModules.map(toCapability),
+        fileLines: { soft, hardGrowth: hardGrowth ? soft : Number.POSITIVE_INFINITY },
+        indexExports: indexSlot.budget.indexExports,
+    }
+}
+
+const load = async () => {
+    const file = manifestFile()
+    if (!existsSync(file)) throw new Error(`HFS slot manifest not found at ${file}`)
+    const { parseYaml } = await import(new URL("../../../../engine/yaml.mjs", import.meta.url))
+    return paramsFromManifest(parseYaml(readFileSync(file, "utf8")))
+}
+
+/** The parameters, resolved once per process. */
+export const hfsParams = await load()

package/log-safety.mjs

@@ -0,0 +1,148 @@
+/**
+ * The rule that keeps a secret or a person out of a log line.
+ *
+ * `no-secret-in-log` (R71 `BE_LOG_SECRET`) reads the arguments of a logger call and refuses a value whose name
+ * says it is a credential (`password`, `secret`, `apiKey`, `accessToken`, `authorization`, `cookie`, `otp`) or
+ * a personal identifier (`email`, `phone`, `fullName`, `idCard`, `birthDate`). A log line outlives the request,
+ * is copied to a vendor, and is read by people who never had the credential or the consent. Log an id, a count,
+ * or a masked form instead.
+ *
+ * The check is on names, because a parser sees names. A name that says it is a measurement of a credential
+ * (`tokenCount`, `tokenType`, `secretName`) is not the credential, so those endings are exempt.
+ */
+import { wordsOf } from "./lib/ast.mjs"
+import { isDeclarationFile, isTestLane } from "./lib/path.mjs"
+
+const LOG_METHODS = new Set(["log", "error", "warn", "info", "debug", "verbose", "fatal", "trace"])
+
+/** A receiver is a logger when its last name says so. */
+const isLoggerReceiver = (node) => {
+  const name = node.type === "Identifier"
+    ? node.name
+    : node.type === "MemberExpression" && !node.computed && node.property.type === "Identifier"
+      ? node.property.name
+      : null
+  return name !== null && /^(?:logger|log|winstonService|loggingService|appLogger)$/i.test(name)
+}
+
+const SECRET_WORDS = new Set(["password", "passwd", "secret", "secrets", "apikey", "authorization", "bearer", "otp", "cookie", "cookies", "credential", "credentials", "jwt", "passphrase"])
+const SECRET_PAIRS = [["api", "key"], ["private", "key"], ["access", "key"], ["secret", "key"], ["signing", "key"], ["client", "secret"]]
+const PII_WORDS = new Set(["email", "emails", "phone", "phonenumber", "fullname", "idcard", "cccd", "birthdate", "dob"])
+/** A name that measures or classifies a credential is not the credential. */
+const MEASURE_WORDS = new Set(["count", "counts", "id", "ids", "type", "types", "name", "names", "ttl", "expiry", "expires", "expiresat", "limit", "usage", "used", "budget", "max", "min", "input", "output", "total", "length", "kind", "hash", "hashed", "masked", "present", "provided", "configured", "exists", "has", "is", "reason", "status", "prefix", "suffix", "version", "rotated", "at", "summary", "source", "from", "fixture", "seed"])
+
+/** Whether a name spells a credential, given its words. */
+const isSecretName = (words) => {
+  if (words.some((word) => MEASURE_WORDS.has(word))) return false
+  if (words.some((word) => SECRET_WORDS.has(word))) return true
+  if (words.includes("token") || words.includes("tokens")) return true
+  return SECRET_PAIRS.some(([a, b]) => words.some((word, index) => word === a && words[index + 1] === b))
+}
+
+const isPiiName = (words) => !words.some((word) => MEASURE_WORDS.has(word)) && words.some((word) => PII_WORDS.has(word))
+
+/** A call that hides its argument: the value shown is a mask, a hash, a flag or a count. */
+const isHidingCall = (node) =>
+  node.type === "CallExpression"
+  && node.callee.type === "Identifier"
+  && /^(?:mask|redact|hash|fingerprint|last4|truncate|Boolean|Number|String)$|^(?:mask|redact|hash|fingerprint)/i.test(node.callee.name)
+
+/** The names an argument reads: identifiers, member properties and object keys, not nested function bodies. */
+const namesIn = (node, found = []) => {
+  if (!node || typeof node.type !== "string") return found
+  switch (node.type) {
+    case "Identifier":
+      found.push({ name: node.name, node })
+      return found
+    case "MemberExpression":
+      // only the last name says what the value IS: `credential.fromEmail` is an address, `payload.token` is a token
+      if (!node.computed && node.property.type === "Identifier") found.push({ name: node.property.name, node: node.property })
+      else namesIn(node.property, found)
+      return found
+    case "Property":
+      if (isHidingCall(node.value)) return found
+      if (!node.computed && node.key.type === "Identifier") found.push({ name: node.key.name, node: node.key })
+      namesIn(node.value, found)
+      return found
+    case "ObjectExpression":
+      node.properties.forEach((property) => namesIn(property, found))
+      return found
+    case "ArrayExpression":
+      node.elements.forEach((element) => namesIn(element, found))
+      return found
+    case "TemplateLiteral":
+      node.expressions.forEach((expression) => namesIn(expression, found))
+      return found
+    case "BinaryExpression":
+    case "LogicalExpression":
+      namesIn(node.left, found)
+      namesIn(node.right, found)
+      return found
+    case "ConditionalExpression":
+      namesIn(node.consequent, found)
+      namesIn(node.alternate, found)
+      return found
+    case "SpreadElement":
+      return namesIn(node.argument, found)
+    case "TSAsExpression":
+    case "TSNonNullExpression":
+      return namesIn(node.expression, found)
+    case "CallExpression":
+      // `mask(token)` and `redact(token)` are the sanctioned way to show a credential; any other call reads its arguments
+      if (isHidingCall(node)) return found
+      node.arguments.forEach((argument) => namesIn(argument, found))
+      return found
+    default:
+      return found
+  }
+}
+
+/** A logger call names no credential and no personal identifier. */
+export const noSecretInLog = {
+  meta: {
+    type: "problem",
+    docs: { description: "Arguments of a logger call carry no credential and no personal identifier by name." },
+    schema: [],
+    messages: {
+      secret:
+        "`{{name}}` reads as a credential and is passed to a logger. Log lines outlive the request and are copied to vendors. Log whether it was present, its length, or a masked form (`mask(...)`), never the value.",
+      pii:
+        "`{{name}}` reads as a personal identifier and is passed to a logger. Log the owning id instead, or a masked form (`mask(...)`), never the raw value.",
+    },
+  },
+  create(context) {
+    const filename = context.filename || context.getFilename()
+    if (isTestLane(filename) || isDeclarationFile(filename)) return {}
+    return {
+      CallExpression(node) {
+        const { callee } = node
+        if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier") return
+        if (!LOG_METHODS.has(callee.property.name) || !isLoggerReceiver(callee.object)) return
+        const reported = new Set()
+        for (const argument of node.arguments) {
+          for (const { name, node: at } of namesIn(argument)) {
+            const words = wordsOf(name)
+            if (reported.has(name)) continue
+            if (isSecretName(words)) {
+              reported.add(name)
+              context.report({ node: at, messageId: "secret", data: { name } })
+            } else if (isPiiName(words)) {
+              reported.add(name)
+              context.report({ node: at, messageId: "pii", data: { name } })
+            }
+          }
+        }
+      },
+    }
+  },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+  "no-secret-in-log": noSecretInLog,
+}
+
+/** Starts at error: no baseline exists, and the repositories' fix lanes clear the debt. */
+export const recommended = {
+  "starci-be/no-secret-in-log": "error",
+}

package/module-layering.mjs

@@ -1,14 +1,17 @@
 /**
  * The rules that hold `module-layering.mjs`'s law file, `module-layering.md`.
  *
- * Five rules, all reading import specifiers, export specifiers, decorators or a filename against
+ * Four rules, all reading import specifiers, export specifiers, decorators or a filename against
  * the path of the file being linted. They are cheap and exact -- none of them touches disk -- which
  * is the whole reason they can be `error`:
- *   - `must-deep-module-import` / `no-self-module-alias` hold LAYERING-1 and LAYERING-2.
- *   - `no-folder-reexport` holds LAYERING-5 / Law 7 (no file re-exports a folder).
- *   - `no-self-global-module` holds the decidable slice of LAYERING-4 / Law 6 (a capability may not
- *     declare itself `@Global()`; see that rule's own doc comment for what is deliberately still
- *     left undecided).
+ *   - `must-deep-module-import` / `no-self-module-alias` hold LAYERING-1 and LAYERING-2. Under HFS the
+ *     first is the cross-owner public-entry rule: an aliased import names the owner and stops there
+ *     (`@modules/domain/plan`, `@features/plan`), so it lands on the owner's `index.ts`. A path into a
+ *     file of another owner, or an alias root or tier with no owner, is refused.
+ *   - `no-folder-reexport` holds LAYERING-5 / Law 7 and the width of an HFS `index.ts`: no folder
+ *     re-export, no `export *`, no `*_STORE` token, no whole `types/` folder, and at most the manifest's
+ *     `indexExports` names.
+ *   - `@Global()` is not decided here: `global-module-allowlist` (module-shape.mjs) reads the allowlist.
  *   - `no-relative-capability-escape` holds Law 8 (a relative import may not walk out of its own
  *     capability -- crossing a boundary always goes through the declared public alias).
  *
@@ -28,14 +31,14 @@
  */
 
 import { normalizePath } from "./lib/path.mjs"
+import { hfsParams } from "./lib/slots.mjs"
 
 /**
  * Category folders that hold capabilities rather than being one.
  *
- * Under these the capability name is the second segment. `lib` remains recognized while older
- * sources transition to the HFS tiers; the architecture check rejects it as a new tier.
+ * Under these the capability name is the second segment. They are the three HFS tiers; `lib` is not one.
  */
-const META_ROOTS = new Set(["domain", "platform", "integrations", "lib"])
+const META_ROOTS = new Set(["domain", "platform", "integrations"])
 
 /** The aliases a capability is reachable through. */
 const ALIASES = [
@@ -61,18 +64,32 @@ const ALIASES = [
 
 // -- LAYERING-1 ------------------------------------------------------------------------------------
 
-/** An import names a capability's explicit public entry or a file, never a root or tier. */
+/**
+ * An aliased import lands on an owner's public entry: the alias and the owner, nothing deeper.
+ *
+ * HFS gives every owner (a feature, a domain or platform capability, an integration) one `index.ts` that
+ * lists what it offers. An import from another owner therefore names the owner and stops
+ * (`@modules/domain/plan`, `@features/plan`); `@modules/domain/plan/plan.service` reaches past that entry
+ * into a file the owner did not offer, and `@modules/domain` or `@modules` names no owner at all. The
+ * rule's published name is older than the standard - it once required the opposite, a path INTO a file -
+ * and is kept because the name is what a build log and a manifest cite; the behavior is HFS's.
+ *
+ * Reaching into one's own owner through its alias is `no-self-module-alias`'s finding, not this one's.
+ */
 export const mustDeepModuleImport = {
   meta: {
     type: "problem",
-    docs: { description: "Import a capability public entry or a file, never an alias root or tier." },
+    docs: { description: "Import another owner through its public entry: the alias and the owner, never a path into it." },
     schema: [],
     messages: {
       barrel:
-        "`{{specifier}}` stops before a capability public entry or file. Import an explicit capability index.ts API or the declaring file.",
+        "`{{specifier}}` stops before an owner. Import an owner's public entry, for example `@modules/domain/plan` or `@features/plan`.",
+      deep:
+        "`{{specifier}}` reaches into a file of another owner. Import the owner's public entry (its `index.ts`) and export what you need from there.",
     },
   },
   create(context) {
+    const self = selfAliases(context.filename || context.getFilename())
     const check = (node, specifier) => {
       if (typeof specifier !== "string") return
       const alias = ALIASES.find((candidate) => specifier.startsWith(candidate.prefix))
@@ -84,12 +101,17 @@ export const mustDeepModuleImport = {
         return
       }
       const parts = rest.split("/")
-      const barrelDepth = alias.metaAware && META_ROOTS.has(parts[0])
-        ? 2
-        : 1
-      if (parts.length < barrelDepth || (!alias.publicEntry && parts.length === barrelDepth)) {
+      const ownerDepth = alias.metaAware && META_ROOTS.has(parts[0]) ? 2 : 1
+      if (parts.length < ownerDepth || (!alias.publicEntry && parts.length === ownerDepth)) {
         context.report({ node, messageId: "barrel", data: { specifier } })
+        return
       }
+      if (!alias.publicEntry || parts.length === ownerDepth) return
+      const entryFile = parts.length === ownerDepth + 1 && parts[ownerDepth] === "index"
+      if (entryFile) return
+      // reaching into one's own owner through its alias is no-self-module-alias's finding
+      if (self && self.prefix === alias.prefix && self.keys.some((key) => rest === key || rest.startsWith(`${key}/`))) return
+      context.report({ node, messageId: "deep", data: { specifier } })
     }
     return {
       ImportDeclaration(node) {
@@ -210,44 +232,59 @@ const isBareFolderSpecifier = (specifier) =>
   specifier === "." || specifier === "./" || specifier === ".." || specifier === "../" || specifier.endsWith("/")
 
 /**
- * LAYERING-5 / module-layering.md Law 7: no file re-exports a folder.
+ * LAYERING-5 / module-layering.md Law 7, and the shape of an HFS `index.ts` public surface.
  *
- * Two certain signs, neither needing a disk lookup:
- *  - a bare-dot or trailing-slash specifier names a directory by construction -- no file path ever
- *    looks like that, aliased or relative, so there is nothing to guess;
- *  - an export-star in an `index.*` public entry hides the capability's API rather than listing
- *    its exports explicitly, even when other named exports appear beside it.
+ * The public entry of an owner is a short, explicit list. Certain signs, none needing a disk lookup:
+ *  - a bare-dot or trailing-slash specifier names a directory by construction, in any file;
+ *  - in an `index.*` file: `export *` hides the surface instead of listing it; a specifier ending in
+ *    `/types` or `/types/index` exports a whole types folder; an exported name ending in `_STORE` hands out
+ *    a storage token; and more than `maxExports` (the `indexExports` budget of the slot manifest) names is not
+ *    a public surface but the inside of the owner.
  *
- * What this deliberately does NOT flag: a single bridging re-export naming a real file
- * (`export { AiInvokeService } from '@modules/ai/ai-invoke.service'`), which LAYERING-1's own
- * common-business-situations list keeps legitimate, and a relative barrel that names a real
- * multi-segment path with no file extension (`export * from './services'`) -- telling that apart
- * from a real file with an implicit extension needs the filesystem, which no rule in this canon
- * touches; see the module doc comment for why that gap is left to LAYERING-1's alias-only reach
- * plus this filename check rather than guessed at.
+ * What this accepts, because HFS wants it: `export { PlanModule } from "./plan.module"`,
+ * `export type { PlanSummary } from "./plan.contracts"`, and `export { entities, migrations } from
+ * "./persistence"` - explicit names from named files. Whether a specifier such as `./persistence` is a
+ * file or a folder needs the file system, which no rule in this canon touches.
  */
 export const noFolderReexport = {
   meta: {
     type: "problem",
     docs: {
       description:
-        "LAYERING-5 / HFS: no file re-exports a folder, and public index files list named exports.",
+        "LAYERING-5 / HFS: no file re-exports a folder, and an index file lists a bounded set of named exports.",
     },
-    schema: [],
+    schema: [
+      {
+        type: "object",
+        properties: { maxExports: { type: "integer", minimum: 1 } },
+        additionalProperties: false,
+      },
+    ],
     messages: {
       bareSpecifier:
-        "`{{specifier}}` names a directory, not a file. LAYERING-5: a capability's public surface is the files call sites actually import -- re-exporting a whole folder makes that surface a list nobody reads instead. Export the specific file.",
+        "`{{specifier}}` names a directory, not a file. LAYERING-5: a capability's public surface is the files call sites actually import - re-exporting a whole folder makes that surface a list nobody reads instead. Export the specific file.",
       indexBarrel:
         "`{{name}}` is a public entry and must list explicit named exports. Replace export-star with the symbols this capability exposes.",
+      typesFolder:
+        "`{{specifier}}` exports a whole types folder from a public entry. List the contract types other owners need, by name.",
+      storeToken:
+        "`{{name}}` is a storage token. A public entry offers behavior and contracts, not the token that opens the owner's store.",
+      tooWide:
+        "This public entry exports {{count}} names, above the budget of {{max}}. An entry that wide is the inside of the owner: split the owner, or export fewer, narrower contracts.",
     },
   },
   create(context) {
     const filename = normalizePath(context.filename || context.getFilename())
+    const isIndex = INDEX_FILE_RE.test(filename)
+    const max = context.options[0]?.maxExports ?? hfsParams.indexExports
+    let count = 0
 
     const checkSpecifier = (node, specifier) => {
       if (typeof specifier !== "string") return
       if (isBareFolderSpecifier(specifier)) {
         context.report({ node, messageId: "bareSpecifier", data: { specifier } })
+      } else if (isIndex && /(?:^|\/)types(?:\/index)?$/.test(specifier)) {
+        context.report({ node, messageId: "typesFolder", data: { specifier } })
       }
     }
 
@@ -257,10 +294,23 @@ export const noFolderReexport = {
       },
       ExportNamedDeclaration(node) {
         if (node.source) checkSpecifier(node.source, node.source.value)
+        if (!isIndex) return
+        const declared = []
+        if (node.declaration) {
+          if (node.declaration.id) declared.push(node.declaration.id)
+          for (const declarator of node.declaration.declarations ?? []) if (declarator.id.type === "Identifier") declared.push(declarator.id)
+        }
+        for (const specifier of node.specifiers) declared.push(specifier.exported)
+        count += declared.length
+        for (const identifier of declared) {
+          const name = identifier.name ?? identifier.value
+          if (typeof name === "string" && /_STORE$/.test(name)) context.report({ node: identifier, messageId: "storeToken", data: { name } })
+        }
       },
       ExportAllDeclaration(node) {
         if (node.source) checkSpecifier(node.source, node.source.value)
-        if (INDEX_FILE_RE.test(filename) && !isBareFolderSpecifier(node.source?.value)) {
+        if (isIndex) count += 1
+        if (isIndex && !isBareFolderSpecifier(node.source?.value)) {
           context.report({
             node,
             messageId: "indexBarrel",
@@ -268,70 +318,8 @@ export const noFolderReexport = {
           })
         }
       },
-    }
-  },
-}
-
-// -- LAYERING-4 / Law 6 (partial) ----------------------------------------------------------------
-
-/** Files that build their own throwaway test graph rather than wiring a production capability. */
-const TEST_FILE_RE = /\.(spec|test)\.(ts|tsx|js|jsx|mjs|cjs)$/
-
-/**
- * LAYERING-4 / module-layering.md Law 6, the one slice of it decidable without whole-application
- * knowledge: a capability declaring `@Global()` on itself.
- *
- * The rest of Law 6 -- which capabilities exist at all, and what starts before what -- has no rule
- * here, and the omission is deliberate, not an oversight. Both need knowledge a single file does
- * not have: "which capabilities exist" is a fact about the whole application graph, and "what
- * starts first" is recorded today as an English comment (`apps/core/src/main.ts`'s side-effect
- * import), which a rule can only pattern-match on wording and would be guessing at meaning, not
- * reading syntax.
- *
- * `isGlobal` passed as a plain, caller-supplied OPTION (`.register({ isGlobal: false })`,
- * `.setExtras({ isGlobal: false }, (definition, extras) => ({ ...definition, global: extras.isGlobal
- * }))`) is deliberately OUT of scope too, and measuring the reference repository is why: it passes
- * that literal option at every level of nesting, including a capability's own top module wiring its
- * own nested children (`CoreModule.register({ isGlobal: true })` inside `features/api/api.module.ts`,
- * which is nesting, not the sideways declaration Law 6 refuses). Telling "a nested child" from "a
- * foreign capability" needs the module graph -- the exact reason LAYERING-3 stays a documented code
- * rather than an enforced one, and the same reason applies here. `@Global()` carries none of that
- * ambiguity: it declares the module global unconditionally, for every caller, which is precisely
- * the fact Law 6 says only a composition root gets to state.
- */
-export const noSelfGlobalModule = {
-  meta: {
-    type: "problem",
-    docs: {
-      description:
-        "LAYERING-4 / module-layering.md Law 6: which capabilities are global is stated only at the composition root -- a capability's own file may not declare itself `@Global()`.",
-    },
-    schema: [],
-    messages: {
-      global:
-        "`@Global()` declares this module global from inside its own capability. LAYERING-4: whether a capability is global is a fact about the APPLICATION, decided per-application at the composition root (`AiModule.register({ isGlobal: true })` in `apps/*/src/app.module.ts`), not a fact a capability gets to state about itself. Remove the decorator and pass `isGlobal` through as a caller-supplied option instead.",
-    },
-  },
-  create(context) {
-    const filename = normalizePath(context.filename || context.getFilename())
-    if (TEST_FILE_RE.test(filename)) return {}
-    const self = selfAliases(filename)
-    if (!self || self.prefix === "@tests/") return {}
-
-    return {
-      Decorator(node) {
-        const expr = node.expression
-        const name =
-          expr.type === "CallExpression"
-            ? expr.callee.type === "Identifier"
-              ? expr.callee.name
-              : null
-            : expr.type === "Identifier"
-              ? expr.name
-              : null
-        if (name === "Global") {
-          context.report({ node, messageId: "global" })
-        }
+      "Program:exit"(node) {
+        if (isIndex && count > max) context.report({ node, messageId: "tooWide", data: { count, max } })
       },
     }
   },
@@ -403,24 +391,18 @@ export const rules = {
   "must-deep-module-import": mustDeepModuleImport,
   "no-self-module-alias": noSelfModuleAlias,
   "no-folder-reexport": noFolderReexport,
-  "no-self-global-module": noSelfGlobalModule,
   "no-relative-capability-escape": noRelativeCapabilityEscape,
 }
 
 /**
  * The level this law asks for, as the plugin's own opinion.
  *
- * All five measured at zero debt in the reference repository -- the three added alongside
- * `no-folder-reexport`, `no-self-global-module` and `no-relative-capability-escape` fired zero
- * times across the repository's ~4700 `src/**` TypeScript files, verified against a harness that
- * DOES fire on synthetic violations of each (so the zero is measured, not a broken rule going
- * quiet). A repository adopting any of these five into an existing tree will not be at zero: land
- * above zero at `warn` with the count, exactly as the burn-down procedure says.
+ * All four are `error`. HFS keeps no baseline: a repository adopts them after its migration lane has
+ * moved its imports onto owner entries, and `starciBeConfig` states them at `error` with none switched off.
  */
 export const recommended = {
   "starci-be/must-deep-module-import": "error",
   "starci-be/no-self-module-alias": "error",
   "starci-be/no-folder-reexport": "error",
-  "starci-be/no-self-global-module": "error",
   "starci-be/no-relative-capability-escape": "error",
 }