@starci/eslint-canon-be 1.7.0 → 1.8.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.8.0 - 2026-09-30
+
+- Breaking (hotfix ahead of 2.0.0, owner rule "no repositories"): `sql-only-in-repository` is removed. `sql-text-only` (R36) takes its place: raw SQL text is written only in a `<name>.sql.ts` (the capability's `persistence/<name>.sql.ts`, or a test builder's `src/tests/fixtures/builders/<area>.sql.ts`); everywhere else `.query(...)` takes an imported text constant, never a string literal or template; `createQueryBuilder` is refused everywhere. Migrations keep their inline SQL.
+- New: `no-repository-file` (R36): a `*.repository.ts` file is a finding. Move its SQL text into `<name>.sql.ts` and run it from the capability service on the shared EntityManager.
+
+## 1.7.1 - 2026-09-30
+
+- Fixed: eslint no longer fails to start in a product repository with `HFS slot manifest not found at <repo>/knowledge/hfs/slots.yaml`. `lib/slots.mjs` used to look for the manifest at a path above the package (the product repository, or a linked runtime copy that no longer exists). The package now depends on `@starci/hfs` and resolves the manifest and the YAML reader as `@starci/hfs/runtime/knowledge/hfs/slots.yaml` and `@starci/hfs/runtime/engine/yaml.mjs`, so what the canon reads travels with the installed packages. `STARCI_HFS_SLOTS` still overrides the manifest file.
+
 ## 1.7.0 - 2026-09-30
 
 - New: `named-entity-manager-only` (R83 `BE_UNNAMED_DATA_ACCESS`, in `data-access`): a bare `@InjectEntityManager()` with no connection argument, any `.getRepository(...)` call (on a DataSource, an EntityManager or a transaction manager) and an injected `DataSource` (a constructor parameter typed `DataSource`, `@InjectDataSource()`, `@InjectConnection()`) are refused. A `DataSource` is allowed only under `platform/database/` or `platform/databases/` (also `platform/db`, `platform/datasource`, `platform/typeorm`) and `apps/migrate/`; spec files are skipped. The message says to inject the shared EntityManager with the named injector and call it directly.

package/README.md

@@ -1,6 +1,6 @@
 # @starci/eslint-canon-be
 
-**78 ESLint rules, from 26 laws, that hold a NestJS-shaped back end to one way of being written.**
+**ESLint rules, grouped by law (the count is `Object.keys(rules)`; knowledge/hfs/rules.yaml names the HFS rule each one enforces), that hold a NestJS-shaped back end to one way of being written.**
 
 Not a style pack. These rules enforce *architecture*: which layer may import which, whether a
 failure carries its own identity, where a query is allowed to be built, what an end-to-end test is
@@ -54,7 +54,7 @@ A sample, not the list:
 | Area | What the rules hold |
 |---|---|
 | **Errors** | A `catch` rethrows, logs through the logger port or returns an outcome carrying its cause; an error lives in its capability's `errors/`, extends `DomainError`, and no bare `Error` or framework exception escapes (`catch-must-account`, `error-home`) |
-| **Schema authority** | Migrations only: no `synchronize`, no `migrationsRun`, no runtime DDL, no entity glob; raw SQL only in a persistence repository; no ORM entity in a contract (`no-runtime-schema`, `sql-only-in-repository`, `no-entity-in-contract`) |
+| **Schema authority** | Migrations only: no `synchronize`, no `migrationsRun`, no runtime DDL, no entity glob; raw SQL text only in a `<name>.sql.ts`, no `*.repository.ts` file; no ORM entity in a contract (`no-runtime-schema`, `sql-text-only`, `no-repository-file`, `no-entity-in-contract`) |
 | **Config and secrets** | `process.env` only in `platform/config`; no literal default for a secret, password, token, key or URL; secrets compare with `timingSafeEqual` (`no-direct-env-read`, `no-secret-default`, `secret-compare-timing-safe`) |
 | **Default deny** | Typed bodies and arguments, no `GraphQLJSON` tunnel, no `switch (operation)`, and `@Public` carries a reason (`no-untyped-body`, `public-needs-reason`) |
 | **Module shape** | `@Global()` only on the manifest allowlist; typed `ConfigurableModuleBuilder`; static `register`; one module per file; no `new` of a provider; no module-level `let` |
@@ -103,43 +103,7 @@ ESLint 9+ (flat config), Node 20.9+.
 
 ## HFS rules and their why codes
 
-Each rule below reports through the code-pattern gate with a catalogued Vietnamese reason (`modules/kernel/failure-codes.yaml`,
-mapped by `scripts/checks/lint-why.mjs`). The catalog id is the rule number in `knowledge/hfs/rules.yaml`.
-
-| Rule | Catalog | Why code |
-|---|---|---|
-| `catch-must-account` | R40 | `BE_LOGGER_REQUIRED` |
-| `error-home` | R38 | `BE_ERROR_HOME` |
-| `no-runtime-schema` | R34 | `BE_SCHEMA_AUTHORITY` |
-| `sql-only-in-repository` | R36 | `BE_SQL_OUTSIDE_REPOSITORY` |
-| `no-entity-in-contract` | R37 | `BE_ENTITY_IN_CONTRACT` |
-| `no-untyped-body`, `public-needs-reason`, `secret-compare-timing-safe` | R41 | `BE_DEFAULT_DENY` |
-| `no-direct-env-read` | R43 | `BE_CONFIG_OWNER` |
-| `no-secret-default` | R44 | `BE_SECRET_DEFAULT` |
-| `global-module-allowlist`, `typed-module-definition`, `static-module-register`, `no-new-injectable`, `no-module-let`, `one-module-per-file` | R45 | `BE_MODULE_SHAPE` |
-| `no-inline-suppression` | R18 | `HFS_INLINE_SUPPRESSION` |
-| `file-size-growth` | R20 | `HFS_SIZE_GROWTH` |
-| `spec-no-source-read`, `spec-typed-doubles` | R48 | `BE_SPEC_QUALITY` |
-| `must-deep-module-import`, `no-folder-reexport` | R30 | `BE_PUBLIC_SURFACE` |
-| `dto-needs-validator` | R42 | `BE_INPUT_BOUNDED` |
-| `no-interpolated-sql` | R68 | `BE_SQL_INTERPOLATED` |
-| `query-needs-limit` | R69 | `BE_QUERY_UNBOUNDED` |
-| `no-query-in-loop` | R77 | `BE_QUERY_IN_LOOP` |
-| `http-needs-timeout` | R70 | `BE_HTTP_TIMEOUT` |
-| `no-secret-in-log` | R71 | `BE_LOG_SECRET` |
-| `no-never-cast`, `no-non-null-assertion` | R72 | `BE_TYPE_ESCAPE` |
-| `async-needs-await` | R73 | `BE_ASYNC_NO_AWAIT` |
-| `migration-down-reversible` | R74 | `BE_MIGRATION_REVERSIBLE` |
-| `explicit-handler-return-type` | R75 | `BE_RETURN_TYPE` |
-| `json-parse-needs-guard` | R76 | `BE_JSON_PARSE_UNGUARDED` |
-| `user-copy-through-catalog` | R78 | `BE_USER_COPY_LITERAL` |
-| `no-ambient-clock` | R79 | `BE_AMBIENT_CLOCK` |
-| `inbox-dedupe-required` | R80 | `BE_INBOX_DEDUPE_MISSING` |
-| `no-hand-rolled-retry` | R81 | `BE_HAND_ROLLED_RETRY` |
-| `no-external-call-in-transaction` | R82 | `BE_TRANSACTION_EXTERNAL_CALL` |
-| `named-entity-manager-only`, `no-injected-repository` | R83 | `BE_UNNAMED_DATA_ACCESS` |
-
-There is no soft size-limit lint rule: a warning under a zero-warning gate is an exception in disguise. Listing files over the soft budget (`ruleParams.be.fileLines.soft`) is a report item of the hfs check or the architecture machine, as migration backlog, and never blocks.
-
-The tier direction matrix and the feature-imports-feature ban (R26, R28) are owned by the architecture machine
-(`@starci/hfs`), not by a lint rule: they need the whole import graph.
+Every rule of this plugin is an enforcer of one HFS rule. The relation (rule id -> HFS rule -> catalogued Vietnamese why code)
+lives in exactly one place, `knowledge/hfs/rules.yaml` (`enforcers`), and `scripts/checks/check-hfs-rules.mjs` refuses a
+rule of this plugin that no catalog entry names. There is no second table here.
+

package/index.mjs

@@ -18,7 +18,6 @@
  */
 import { recommended as asyncDisciplineRecommended, rules as asyncDisciplineRules } from "./async-discipline.mjs"
 import { recommended as authorizationRecommended, rules as authorizationRules } from "./authorization.mjs"
-import { recommended as cdcRecommended, rules as cdcRules } from "./cdc.mjs"
 import { recommended as commentsRecommended, rules as commentsRules } from "./comments.mjs"
 import { recommended as configOwnerRecommended, rules as configOwnerRules } from "./config-owner.mjs"
 import { recommended as cqrsRecommended, rules as cqrsRules } from "./cqrs.mjs"
@@ -26,7 +25,6 @@ import { recommended as dataAccessRecommended, rules as dataAccessRules } from "
 import { recommended as defaultDenyRecommended, rules as defaultDenyRules } from "./default-deny.mjs"
 import { recommended as e2eFlowRecommended, rules as e2eFlowRules } from "./e2e-flow.mjs"
 import { recommended as errorHandlingRecommended, rules as errorHandlingRules } from "./error-handling.mjs"
-import { recommended as eventDeliveryRecommended, rules as eventDeliveryRules } from "./event-delivery.mjs"
 import { recommended as idempotencyRecommended, rules as idempotencyRules } from "./idempotency.mjs"
 import { recommended as inputBoundsRecommended, rules as inputBoundsRules } from "./input-bounds.mjs"
 import { recommended as logSafetyRecommended, rules as logSafetyRules } from "./log-safety.mjs"
@@ -50,7 +48,6 @@ import { recommended as userCopyRecommended, rules as userCopyRules } from "./us
 const CONTRIBUTIONS = [
     { law: "async-discipline", rules: asyncDisciplineRules, recommended: asyncDisciplineRecommended },
     { law: "authorization", rules: authorizationRules, recommended: authorizationRecommended },
-    { law: "cdc", rules: cdcRules, recommended: cdcRecommended },
     { law: "comments", rules: commentsRules, recommended: commentsRecommended },
     { law: "config-owner", rules: configOwnerRules, recommended: configOwnerRecommended },
     { law: "cqrs", rules: cqrsRules, recommended: cqrsRecommended },
@@ -58,7 +55,6 @@ const CONTRIBUTIONS = [
     { law: "default-deny", rules: defaultDenyRules, recommended: defaultDenyRecommended },
     { law: "e2e-flow", rules: e2eFlowRules, recommended: e2eFlowRecommended },
     { law: "error-handling", rules: errorHandlingRules, recommended: errorHandlingRecommended },
-    { law: "event-delivery", rules: eventDeliveryRules, recommended: eventDeliveryRecommended },
     { law: "idempotency", rules: idempotencyRules, recommended: idempotencyRecommended },
     { law: "input-bounds", rules: inputBoundsRules, recommended: inputBoundsRecommended },
     { law: "log-safety", rules: logSafetyRules, recommended: logSafetyRecommended },

package/lib/slots.mjs

@@ -14,16 +14,39 @@
  *                                    over it may not be born or grow (`file-size-growth`)
  *   - the `budget.indexExports` of the first `be.*` slot that states one, the public-surface width
  *
- * The manifest is found through `STARCI_HFS_SLOTS`, else at `<runtime>/knowledge/hfs/slots.yaml` above this package.
+ * The manifest and the YAML reader come from the installed `@starci/hfs` package, which carries a runtime copy
+ * (`runtime/knowledge/hfs/slots.yaml`, `runtime/engine/yaml.mjs`) and is a dependency of this package. They are
+ * resolved as `@starci/hfs/runtime/...` with `import.meta.resolve`, never from the product repository's filesystem
+ * and never from a link path. `STARCI_HFS_SLOTS` overrides the manifest file (tests, experiments). Inside the runtime
+ * repository itself, where `@starci/hfs` is not installed, the sibling `packages/hfs` workspace stands in.
  */
 import { existsSync, readFileSync } from "node:fs"
 import { dirname, join } from "node:path"
-import { fileURLToPath } from "node:url"
+import { fileURLToPath, pathToFileURL } from "node:url"
 
 const HERE = dirname(fileURLToPath(import.meta.url))
-const RUNTIME_ROOT = join(HERE, "..", "..", "..", "..")
+const SIBLING_HFS = join(HERE, "..", "..", "..", "hfs")
 
-const manifestFile = () => process.env.STARCI_HFS_SLOTS || join(RUNTIME_ROOT, "knowledge", "hfs", "slots.yaml")
+const HFS_SLOTS = "@starci/hfs/runtime/knowledge/hfs/slots.yaml"
+const HFS_YAML = "@starci/hfs/runtime/engine/yaml.mjs"
+
+/**
+ * Resolves a file of the installed `@starci/hfs` package.
+ *
+ * @param {string} specifier - The `@starci/hfs/...` specifier.
+ * @returns {string} The `file:` URL of the file.
+ */
+const hfsFile = (specifier) => {
+    try {
+        return import.meta.resolve(specifier)
+    } catch (error) {
+        const sibling = join(SIBLING_HFS, specifier.slice("@starci/hfs/".length))
+        if (existsSync(join(SIBLING_HFS, "package.json")) && existsSync(sibling)) return pathToFileURL(sibling).href
+        throw new Error(`@starci/hfs is not installed (${specifier} does not resolve): add it to dependencies and reinstall. ${error.message}`)
+    }
+}
+
+const manifestFile = () => process.env.STARCI_HFS_SLOTS || fileURLToPath(hfsFile(HFS_SLOTS))
 
 const toCapability = (dir) => String(dir).replace(/^src\/modules\//, "").replace(/\/+$/, "")
 
@@ -52,7 +75,7 @@ export const paramsFromManifest = (manifest) => {
 const load = async () => {
     const file = manifestFile()
     if (!existsSync(file)) throw new Error(`HFS slot manifest not found at ${file}`)
-    const { parseYaml } = await import(new URL("../../../../engine/yaml.mjs", import.meta.url))
+    const { parseYaml } = await import(hfsFile(HFS_YAML))
     return paramsFromManifest(parseYaml(readFileSync(file, "utf8")))
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-be",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "The StarCi back-end lint canon: every rule its laws publish, gathered as one flat-config plugin.",
   "type": "module",
   "license": "UNLICENSED",
@@ -19,6 +19,9 @@
   "engines": {
     "node": ">=20.9.0"
   },
+  "dependencies": {
+    "@starci/hfs": "1.0.1"
+  },
   "peerDependencies": {
     "eslint": ">=9"
   },

package/schema-authority.mjs

@@ -7,8 +7,11 @@
  *     the schema: a `synchronize` that is not the literal `false`, a `dataSource.synchronize()` call, a
  *     `migrationsRun` that is not the literal `false`, a `CREATE|ALTER|DROP TABLE` string outside
  *     `persistence/migrations/`, and an entity or migration glob. Only `apps/migrate` runs migrations.
- *   - `sql-only-in-repository` (R36 `BE_SQL_OUTSIDE_REPOSITORY`) keeps raw SQL and query builders inside a
- *     `*.repository.ts` of a `persistence/` folder, so a use case or a service never contains SQL.
+ *   - `sql-text-only` (R36) keeps raw SQL text inside a `<name>.sql.ts` (the owning capability's `persistence/`,
+ *     or a test builder's `src/tests/fixtures/builders/<area>.sql.ts`): `.query(...)` elsewhere takes an imported
+ *     text constant, never a literal or template; `createQueryBuilder` is not used.
+ *   - `no-repository-file` (R36) refuses a `*.repository.ts` file: repositories are banned (owner rule); SQL text lives
+ *     in `<name>.sql.ts` and the capability's service runs it on the shared EntityManager.
  *   - `no-entity-in-contract` (R37 `BE_ENTITY_IN_CONTRACT`) keeps ORM entities out of the types that cross a
  *     boundary: `*.contracts.ts`, DTOs, resolver and controller signatures. A contract returns a projection.
  */
@@ -74,31 +77,33 @@ export const noRuntimeSchema = {
     },
 }
 
-const REPOSITORY_FILE = /\/persistence\/(?:[^/]+\/)*[^/]+\.repository\.[cm]?ts$/
+/** A file that holds SQL text: `<name>.sql.ts`. */
+const SQL_FILE = /\.sql\.[cm]?ts$/
+/** A repository file, banned. */
+const REPOSITORY_FILE = /\.repository\.[cm]?ts$/
 
-/** Raw SQL and query builders live in a `*.repository.ts` under `persistence/`, nowhere else. */
-export const sqlOnlyInRepository = {
+/** Raw SQL text is written only in a `<name>.sql.ts`; everywhere else `.query(...)` takes an imported constant. */
+export const sqlTextOnly = {
     meta: {
         type: "problem",
-        docs: { description: "`.query(<sql>)` and `createQueryBuilder` only inside a persistence `*.repository.ts`." },
+        docs: { description: "Raw SQL text only in a `<name>.sql.ts`; `.query(...)` elsewhere takes an imported text constant; no `createQueryBuilder`." },
         schema: [],
         messages: {
-            sql: "Raw SQL or a query builder outside a persistence repository. Move it into the `*.repository.ts` of the owning capability's `persistence/` and call that from the use case.",
+            sql: "Raw SQL text outside a `<name>.sql.ts`. Write the statement as an exported constant in the owning capability's `persistence/<name>.sql.ts` (a test builder's in `src/tests/fixtures/builders/<area>.sql.ts`), import it, and pass values as numbered parameters.",
+            builder: "`createQueryBuilder(...)` is banned. Use `manager.find(Entity, { where, take })`, or a SQL text constant from a `<name>.sql.ts` run with `manager.query(...)`.",
         },
     },
     create(context) {
         const filename = normalizePath(context.filename || context.getFilename())
-        if (isDeclarationFile(filename) || isMigrationFile(filename) || REPOSITORY_FILE.test(filename)) return {}
+        if (isDeclarationFile(filename) || isMigrationFile(filename)) return {}
+        const sqlFile = SQL_FILE.test(filename)
         return {
             CallExpression(node) {
                 const callee = node.callee
                 if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier") return
                 const name = callee.property.name
-                if (name === "createQueryBuilder") {
-                    context.report({ node, messageId: "sql" })
-                } else if (name === "query" && staticText(node.arguments[0]) !== null) {
-                    context.report({ node, messageId: "sql" })
-                } else if (name === "query" && node.arguments[0]?.type === "TemplateLiteral") {
+                if (name === "createQueryBuilder") context.report({ node, messageId: "builder" })
+                else if (!sqlFile && name === "query" && (staticText(node.arguments[0]) !== null || node.arguments[0]?.type === "TemplateLiteral")) {
                     context.report({ node, messageId: "sql" })
                 }
             },
@@ -106,6 +111,23 @@ export const sqlOnlyInRepository = {
     },
 }
 
+/** Repositories are banned: a `*.repository.ts` file is a finding. */
+export const noRepositoryFile = {
+    meta: {
+        type: "problem",
+        docs: { description: "No `*.repository.ts` file." },
+        schema: [],
+        messages: {
+            file: "Repository files are banned. Move the SQL text into the capability's `persistence/<name>.sql.ts` and run it from the capability's `*.service.ts` on the shared EntityManager.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename) || !REPOSITORY_FILE.test(filename)) return {}
+        return { Program(node) { context.report({ node, loc: { line: 1, column: 0 }, messageId: "file" }) } }
+    },
+}
+
 /** Files whose types cross a boundary: contracts, DTOs, resolvers, controllers. */
 const BOUNDARY_FILE = /\.contracts\.[cm]?ts$|\/dto\/|\.(?:request|response|input|type|args)\.[cm]?ts$|\.(?:resolver|controller)\.[cm]?ts$/
 
@@ -173,7 +195,8 @@ export const migrationDownReversible = {
 /** The rules this law contributes to the plugin. */
 export const rules = {
     "no-runtime-schema": noRuntimeSchema,
-    "sql-only-in-repository": sqlOnlyInRepository,
+    "sql-text-only": sqlTextOnly,
+    "no-repository-file": noRepositoryFile,
     "no-entity-in-contract": noEntityInContract,
     "migration-down-reversible": migrationDownReversible,
 }
@@ -181,7 +204,8 @@ export const rules = {
 /** All three start at error: HFS keeps no baseline and the schema migration lanes clear the debt first. */
 export const recommended = {
     "starci-be/no-runtime-schema": "error",
-    "starci-be/sql-only-in-repository": "error",
+    "starci-be/sql-text-only": "error",
+    "starci-be/no-repository-file": "error",
     "starci-be/no-entity-in-contract": "error",
     "starci-be/migration-down-reversible": "error",
 }

package/cdc.mjs

@@ -1,150 +0,0 @@
-const isProjectionListener = (filename) => /projection\.listener\.ts$/.test(
-  String(filename || "").replace(/\\/g, "/"),
-) && !String(filename || "").replace(/\\/g, "/").endsWith("/abstract-projection.listener.ts")
-
-const isProjectionService = (filename) => /-projection\.service\.ts$/.test(
-  String(filename || "").replace(/\\/g, "/"),
-)
-
-const memberName = (member) => member.key && (member.key.name || member.key.value)
-
-/** A groupId literal is safe: a plain string, or a template with no `${}` substitution. */
-const isStaticStringValue = (node) => {
-  if (!node) return false
-  if (node.type === "Literal" && typeof node.value === "string") return true
-  if (node.type === "TemplateLiteral" && node.expressions.length === 0) return true
-  return false
-}
-
-/** Flatten a function's parameter list to the names it binds, through destructuring/defaults/rest. */
-const collectParamNames = (params, names = []) => {
-  for (const param of params || []) {
-    if (!param) continue
-    if (param.type === "Identifier") {
-      names.push(param.name)
-    } else if (param.type === "AssignmentPattern") {
-      collectParamNames([param.left], names)
-    } else if (param.type === "RestElement") {
-      collectParamNames([param.argument], names)
-    } else if (param.type === "ObjectPattern") {
-      for (const prop of param.properties || []) {
-        if (prop.type === "Property" && prop.key) {
-          names.push(prop.key.name || prop.key.value)
-        } else if (prop.type === "RestElement") {
-          collectParamNames([prop.argument], names)
-        }
-      }
-    }
-  }
-  return names
-}
-
-const DELTA_LIKE_PARAMS = new Set(["amount", "delta", "points", "increment"])
-
-/** A projection listener declares mapping while AbstractProjectionListener owns Kafka lifecycle. */
-export const projectionListenerContract = {
-  meta: {
-    type: "problem",
-    docs: { description: "Projection CDC listeners share one Kafka lifecycle contract." },
-    schema: [],
-    messages: {
-      base: "A projection CDC listener extends AbstractProjectionListener; the shared base owns subscription, envelope parsing and failure isolation.",
-      member: "A projection CDC listener must declare `{{name}}`.",
-      lifecycle: "A concrete projection listener must not override `onModuleInit`; Kafka lifecycle belongs to AbstractProjectionListener.",
-    },
-  },
-  create(context) {
-    if (!isProjectionListener(context.filename || context.getFilename())) return {}
-    return {
-      ClassDeclaration(node) {
-        if (!node.superClass || node.superClass.name !== "AbstractProjectionListener") {
-          context.report({ node: node.id || node, messageId: "base" })
-        }
-        const members = node.body.body || []
-        const names = new Set(members.map(memberName))
-        for (const name of ["groupId", "topics", "deriveTargets", "recomputeTarget"]) {
-          if (!names.has(name)) {
-            context.report({ node: node.id || node, messageId: "member", data: { name } })
-          }
-        }
-        const lifecycle = members.find((member) => memberName(member) === "onModuleInit")
-        if (lifecycle) context.report({ node: lifecycle.key, messageId: "lifecycle" })
-      },
-    }
-  },
-}
-
-/** CDC Rule 3 (CDC-2): a projection's consumer group id is a constant, not computed at boot. */
-export const noDynamicProjectionGroupId = {
-  meta: {
-    type: "problem",
-    docs: {
-      description: "CDC Rule 3 (CDC-2): `groupId` is a stable string literal, not a value computed at boot.",
-    },
-    schema: [],
-    messages: {
-      dynamic: "CDC Rule 3 (CDC-2): `groupId` must be a constant string literal. A template substitution, a call (`Date.now()`, `randomUUID()`, `hostname()`), or an env/instance read makes the consumer group unstable across restarts, so each restart replays the whole history in a fresh group instead of resuming from the committed offset.",
-    },
-  },
-  create(context) {
-    if (!isProjectionListener(context.filename || context.getFilename())) return {}
-    return {
-      PropertyDefinition(node) {
-        if (memberName(node) !== "groupId") return
-        if (node.value && !isStaticStringValue(node.value)) {
-          context.report({ node: node.value, messageId: "dynamic" })
-        }
-      },
-    }
-  },
-}
-
-/** CDC Rules 1 and 6 (CDC-4): recompute rebuilds from source by UPSERT, never by applying a delta. */
-export const projectionRecomputeMustUpsert = {
-  meta: {
-    type: "problem",
-    docs: {
-      description: "CDC Rules 1 and 6 (CDC-4): a projection recomputes from source rows by UPSERT; it is never updated by applying an event's delta.",
-    },
-    schema: [],
-    messages: {
-      delta: "CDC Rules 1 and 6 (CDC-4): `recompute` must not take a `{{name}}` parameter. Recompute takes only the target's identity and rebuilds the value from authoritative source rows -- a delta/amount/points parameter means a duplicate delivery doubles the projection and a lost delivery never heals.",
-      upsert: "CDC Rules 1 and 6 (CDC-4): a projection service with a `recompute` method must write through an UPSERT (`ON CONFLICT`). A value assembled without one is not safe to replay, and replay is the one guarantee a broker actually offers.",
-    },
-  },
-  create(context) {
-    if (!isProjectionService(context.filename || context.getFilename())) return {}
-    let hasRecompute = false
-    return {
-      MethodDefinition(node) {
-        if (memberName(node) !== "recompute") return
-        hasRecompute = true
-        const params = collectParamNames(node.value.params)
-        for (const name of params) {
-          if (DELTA_LIKE_PARAMS.has(String(name).toLowerCase())) {
-            context.report({ node, messageId: "delta", data: { name } })
-          }
-        }
-      },
-      "Program:exit"(node) {
-        if (!hasRecompute) return
-        const source = context.sourceCode || context.getSourceCode()
-        if (!/on\s*conflict/i.test(source.getText())) {
-          context.report({ node, messageId: "upsert" })
-        }
-      },
-    }
-  },
-}
-
-export const rules = {
-  "projection-listener-contract": projectionListenerContract,
-  "no-dynamic-projection-group-id": noDynamicProjectionGroupId,
-  "projection-recompute-must-upsert": projectionRecomputeMustUpsert,
-}
-
-export const recommended = {
-  "starci-be/projection-listener-contract": "error",
-  "starci-be/no-dynamic-projection-group-id": "error",
-  "starci-be/projection-recompute-must-upsert": "error",
-}

package/event-delivery.mjs

@@ -1,93 +0,0 @@
-import { normalizePath } from "./lib/path.mjs"
-
-/** The NATS bridge rejects self-echo and claims redelivery before local fan-out. */
-export const natsBridgeDeliveryContract = {
-  meta: {
-    type: "problem",
-    docs: { description: "The central NATS bridge preserves cross-instance delivery invariants." },
-    schema: [],
-    messages: {
-      origin: "Drop envelopes whose producer id matches this instance before local emit.",
-      digest: "Claim/check the envelope digest before local emit so redelivery is idempotent.",
-    },
-  },
-  create(context) {
-    if (!normalizePath(context.filename || context.getFilename()).endsWith(
-      "/event/nats/nats-bridge.service.ts",
-    )) return {}
-    return {
-      "Program:exit"(node) {
-        const source = context.sourceCode || context.getSourceCode()
-        const text = source.getText()
-        const originIndex = text.search(/parsed\.id\s*===\s*this\.instanceService\.getId\(\)/)
-        const digestIndex = text.indexOf("parsed.digest")
-        const emitIndex = text.indexOf("this.eventEmitter.emit")
-        if (originIndex < 0 || emitIndex < 0 || originIndex > emitIndex) {
-          context.report({ node, messageId: "origin" })
-        }
-        if (digestIndex < 0 || emitIndex < 0 || digestIndex > emitIndex) {
-          context.report({ node, messageId: "digest" })
-        }
-      },
-    }
-  },
-}
-
-const isEmitCallOnEventEmitterService = (node) =>
-  node.callee.type === "MemberExpression" &&
-  !node.callee.computed &&
-  node.callee.property.type === "Identifier" &&
-  node.callee.property.name === "emit" &&
-  node.callee.object.type === "MemberExpression" &&
-  !node.callee.object.computed &&
-  node.callee.object.property.type === "Identifier" &&
-  node.callee.object.property.name === "eventEmitterService"
-
-const findObjectProperty = (objectExpression, name) => {
-  if (!objectExpression || objectExpression.type !== "ObjectExpression") return null
-  return objectExpression.properties.find(
-    (property) => property.type === "Property" &&
-      !property.computed &&
-      (property.key.name === name || property.key.value === name),
-  ) || null
-}
-
-/** DELIVERY Rule 2 (DELIVERY-2): transport is declared per event in one config, never at the call site. */
-export const noCallSiteTransportOverride = {
-  meta: {
-    type: "problem",
-    docs: {
-      description: "DELIVERY Rule 2 (DELIVERY-2): transport is declared per event in the central config; it is never chosen at the call site.",
-    },
-    schema: [],
-    messages: {
-      callsite: "DELIVERY Rule 2 (DELIVERY-2): do not pass `options.useLocal`/`options.useNats` to `eventEmitterService.emit(...)`. Transport is part of the event's definition in the central config, not a per-call decision -- a call site choosing it is a promise the config never made and a reader has to guess at.",
-    },
-  },
-  create(context) {
-    return {
-      CallExpression(node) {
-        if (!isEmitCallOnEventEmitterService(node)) return
-        const args = node.arguments[0]
-        const optionsProperty = findObjectProperty(args, "options")
-        if (!optionsProperty) return
-        const optionsValue = optionsProperty.value
-        const hasUseLocal = findObjectProperty(optionsValue, "useLocal")
-        const hasUseNats = findObjectProperty(optionsValue, "useNats")
-        if (hasUseLocal || hasUseNats) {
-          context.report({ node: optionsProperty, messageId: "callsite" })
-        }
-      },
-    }
-  },
-}
-
-export const rules = {
-  "nats-bridge-delivery-contract": natsBridgeDeliveryContract,
-  "no-call-site-transport-override": noCallSiteTransportOverride,
-}
-
-export const recommended = {
-  "starci-be/nats-bridge-delivery-contract": "error",
-  "starci-be/no-call-site-transport-override": "error",
-}