@starci/eslint-canon-be 1.8.1 → 2.0.0

package/config-owner.mjs

@@ -2,55 +2,124 @@
  * The rules that hold HFS configuration and secrets (catalog R43 `BE_CONFIG_OWNER`, R44 `BE_SECRET_DEFAULT`,
  * and the secret-comparison half of R41 `BE_DEFAULT_DENY`).
  *
- *   - `no-direct-env-read` keeps `process.env` inside `platform/config`. Everything else receives typed options
- *     from `<capability>.config.ts`; a `readEnvironment()` call inside a `useFactory` is the same read in
- *     disguise and is refused too.
- *   - `no-secret-default` refuses a literal default for a secret, password, token, key or URL: an `env.X ?? "..."`
- *     fallback, a property or variable of that name holding a non-empty string, a `.default("...")` on a
- *     schema of that name, and a path built from `process.cwd()` and `src` or `.starcistacks`. A missing value
- *     must stop the boot, naming the key.
+ *   - `no-direct-env-read` keeps the process environment inside the one file that declares the `EnvSource` class of
+ *     `platform/config`. Everything else receives typed options from `<capability>.config.ts`. `process.env` in any form
+ *     (member access, destructuring, `Reflect.get(process, "env")`, an `env` import of `node:process`), an import of
+ *     `@nestjs/config` or `dotenv`, a call of `envConfig()`, and a `process.cwd()` path joined into `src` or
+ *     `.starcistacks` are refused everywhere else.
+ *   - `no-secret-default` refuses a default for a value typed `Secret` or `Url` by `platform/config`: a default argument
+ *     to an `EnvSource` reader, a `??`/`||` fallback on such a value, and a string literal default (`""`, `"localhost"`,
+ *     `"127.0.0.1"`, `"0.0.0.0"`, `http(s)://...`) given to any reader that returns one. The TYPE decides; no key name is
+ *     matched. A missing value must stop the boot, naming the key.
  *   - `secret-compare-timing-safe` refuses `===` and `!==` on a secret-named identifier. A secret compares with
  *     `timingSafeEqual`, because the length of the matching prefix is a measurable side channel.
  *
- * Test lanes are outside the default and env rules: a spec arranges its own environment and fake credentials.
- * They are not outside the comparison rule.
+ * No test lane is exempt: a spec builds its `EnvSource` from a literal record and never touches the process environment.
  */
 import { keyName, staticText, walk, wordsOf } from "./lib/ast.mjs"
-import { isDeclarationFile, isTestLane, normalizePath } from "./lib/path.mjs"
+import { isOwnedBy, originsOf } from "./lib/declared.mjs"
+import { hfsOf } from "./lib/hfs.mjs"
+import { isDeclarationFile, normalizePath } from "./lib/path.mjs"
 
-const PLATFORM_CONFIG = /\/src\/modules\/platform\/config\//
+const PROCESS_MODULES = new Set(["process", "node:process"])
 
-/** `process.env` or `process["env"]`. */
-const isProcessEnv = (node) =>
+/** `@nestjs/config`, `dotenv` and their subpaths. */
+const isConfigPackage = (source) => /^(?:@nestjs\/config|dotenv)(?:\/|$)/.test(source)
+
+/** `globalThis.process` and `global.process`. */
+const isGlobalProcess = (node) =>
     node.type === "MemberExpression" &&
+    !node.computed &&
+    keyName(node.property) === "process" &&
     node.object.type === "Identifier" &&
-    node.object.name === "process" &&
-    (node.computed ? node.property.type === "Literal" && node.property.value === "env" : keyName(node.property) === "env")
+    (node.object.name === "globalThis" || node.object.name === "global")
+
+/** True when the property of a member expression spells `env`. */
+const spellsEnv = (node) => (node.computed ? staticText(node.property) === "env" : keyName(node.property) === "env")
 
-/** Only the platform config capability reads the process environment. */
+/** Only the file that declares `EnvSource` reads the process environment. */
 export const noDirectEnvRead = {
     meta: {
         type: "problem",
-        docs: { description: "`process.env` is read only inside `platform/config`." },
+        docs: { description: "The process environment is read only by the `EnvSource` class of `platform/config`." },
         schema: [],
         messages: {
-            env: "`process.env` is read outside `platform/config`. Add the key to the capability's `<capability>.config.ts` (zod) and receive the value through its `<capability>.options.ts`.",
-            factory: "`readEnvironment()` inside a `useFactory` reads the environment per module. `main.ts` reads it once and passes options through `AppModule.register`.",
+            env: "The process environment is read outside the `EnvSource` of `platform/config`. Add the key to the capability's `<capability>.config.ts` (`parse<C>Config(env: EnvSource)`) and receive the value through its `<capability>.options.ts`.",
+            package: "`{{source}}` is a second config path. Configuration is parsed once in `main.ts` by `platform/config` typed readers and reaches a module through `register(options)`.",
+            envConfig: "`envConfig()` re-reads the environment per call site. Receive the value through the capability's options, read with `Inject<C>Options()`.",
+            cwdPath: "A path built from `process.cwd()` and `{{segment}}` depends on where the process was started. Resolve it from a configured root.",
         },
     },
     create(context) {
         const filename = normalizePath(context.filename || context.getFilename())
-        if (isDeclarationFile(filename) || isTestLane(filename) || PLATFORM_CONFIG.test(filename)) return {}
+        if (isDeclarationFile(filename)) return {}
+        const hfs = hfsOf(context)
+        const inConfigOwner = isOwnedBy(hfs, filename, "platform", "config")
+        let declaresEnvSource = false
+        const processNames = new Set(["process"])
+        const isLocal = (identifier) => {
+            for (let scope = context.sourceCode.getScope(identifier); scope; scope = scope.upper) {
+                const variable = scope.set.get(identifier.name)
+                if (variable) return variable.defs.length > 0 && !variable.defs.every((definition) => definition.type === "ImportBinding")
+            }
+            return false
+        }
+        const isProcess = (node) => (node.type === "Identifier" && processNames.has(node.name) && !isLocal(node)) || isGlobalProcess(node)
+        const isEnvSourceFile = () => inConfigOwner && declaresEnvSource
+        const reportEnv = (node) => {
+            if (!isEnvSourceFile()) context.report({ node, messageId: "env" })
+        }
+        const reportSource = (node, source) => {
+            if (isConfigPackage(source)) context.report({ node, messageId: "package", data: { source } })
+        }
         return {
+            Program(program) {
+                declaresEnvSource = program.body.some((statement) => {
+                    const declaration = statement.type === "ExportNamedDeclaration" || statement.type === "ExportDefaultDeclaration" ? statement.declaration : statement
+                    return declaration?.type === "ClassDeclaration" && declaration.id?.name === "EnvSource"
+                })
+            },
+            ImportDeclaration(node) {
+                const source = String(node.source.value)
+                reportSource(node, source)
+                if (!PROCESS_MODULES.has(source)) return
+                for (const specifier of node.specifiers) {
+                    if (specifier.type === "ImportSpecifier" && (specifier.imported.name ?? specifier.imported.value) === "env") reportEnv(specifier)
+                    else if (specifier.type !== "ImportSpecifier") processNames.add(specifier.local.name)
+                }
+            },
+            ImportExpression(node) {
+                const source = staticText(node.source)
+                if (source !== null) reportSource(node, source)
+            },
             MemberExpression(node) {
-                if (isProcessEnv(node)) context.report({ node, messageId: "env" })
+                if (isProcess(node.object) && spellsEnv(node)) reportEnv(node)
+            },
+            VariableDeclarator(node) {
+                if (!node.init || !isProcess(node.init) || node.id.type !== "ObjectPattern") return
+                if (node.id.properties.some((property) => property.type === "Property" && keyName(property.key) === "env")) reportEnv(node)
             },
             CallExpression(node) {
-                if (node.callee.type !== "Identifier" || node.callee.name !== "readEnvironment") return
-                for (let parent = node.parent; parent; parent = parent.parent) {
-                    if (parent.type === "Property" && keyName(parent.key) === "useFactory") {
-                        context.report({ node, messageId: "factory" })
-                        return
+                const callee = node.callee
+                if (callee.type === "Identifier" && callee.name === "envConfig") context.report({ node, messageId: "envConfig" })
+                if (callee.type === "Identifier" && callee.name === "require") {
+                    const source = staticText(node.arguments[0])
+                    if (source !== null) reportSource(node, source)
+                }
+                if (callee.type !== "MemberExpression") return
+                if (callee.object.type === "Identifier" && callee.object.name === "Reflect" && keyName(callee.property) === "get") {
+                    if (node.arguments[0] && isProcess(node.arguments[0]) && staticText(node.arguments[1]) === "env") reportEnv(node)
+                }
+                if (["join", "resolve"].includes(keyName(callee.property) ?? "") && !isEnvSourceFile()) {
+                    let cwd = false
+                    walk(node, (child) => {
+                        if (child.type === "CallExpression" && child.callee.type === "MemberExpression" && isProcess(child.callee.object) && keyName(child.callee.property) === "cwd") cwd = true
+                    })
+                    if (!cwd) return
+                    for (const argument of node.arguments) {
+                        const text = staticText(argument)
+                        const segment = text === null ? null : text.split(/[\\/]/).find((part) => part === "src" || part === ".starcistacks")
+                        if (segment) context.report({ node, messageId: "cwdPath", data: { segment } })
                     }
                 }
             },
@@ -58,130 +127,63 @@ export const noDirectEnvRead = {
     },
 }
 
-const SECRET_WORDS = new Set(["password", "passwd", "passphrase", "secret", "token", "credential", "credentials", "apikey", "signature", "hmac"])
-const KEY_PREFIXES = new Set(["api", "secret", "private", "access", "signing", "encryption", "master", "auth", "jwt", "session"])
-const URL_WORDS = new Set(["url", "uri", "dsn", "endpoint"])
-const NOT_A_VALUE_WORDS = new Set(["type", "kind", "length", "count", "ttl", "name", "prefix", "header", "scheme", "field", "path", "regex", "pattern"])
-
-/** Whether a config name is a secret, or an infrastructure URL: `POSTGRES_PASSWORD`, `webhookSecret`, `redisUrl`. */
-const configKind = (name) => {
-    const words = wordsOf(name)
-    const last = words.at(-1)
-    if (!last || NOT_A_VALUE_WORDS.has(last)) return null
-    if (SECRET_WORDS.has(last)) return "secret"
-    if (last === "key" && words.length > 1 && KEY_PREFIXES.has(words.at(-2))) return "secret"
-    if (URL_WORDS.has(last)) return "url"
-    return null
-}
-
-/** The name an env read spells: `process.env.X`, `env.X`, `env["X"]`, `config.get("X")`. */
-const envReadName = (node) => {
-    if (node.type === "MemberExpression") {
-        const object = node.object
-        const isEnvObject = isProcessEnv(object) || (object.type === "Identifier" && /^env$/i.test(object.name))
-        if (!isEnvObject) return null
-        return node.computed ? staticText(node.property) : keyName(node.property)
-    }
-    if (node.type === "CallExpression" && node.callee.type === "MemberExpression" && keyName(node.callee.property) === "get") {
-        return staticText(node.arguments[0])
-    }
-    return null
-}
-
-const isNonEmptyText = (node) => {
-    const text = staticText(node)
-    return text !== null && text.trim() !== ""
-}
-
-/** An UPPER_SNAKE literal is the NAME of an environment key (`const API_KEY = "API_KEY"`), not a secret value. */
-const isKeyName = (node, name) => {
-    const text = staticText(node) ?? ""
-    if (/^[A-Z][A-Z0-9_]*$/.test(text)) return true
-    // `const MEDIA_SIGNING_SECRET_KEY = "mediaSigningSecret"`: a constant that names a lookup key holds the key's name
-    return /^[A-Z][A-Z0-9_]*_KEY$/.test(name ?? "") && /^[a-z][A-Za-z0-9]*$/.test(text)
-}
-
-const hasScheme = (node) => /^[a-z][a-z0-9+.-]*:\/\//i.test(staticText(node) ?? "")
-
-const targetName = (node) => {
-    if (node.type === "Property" || node.type === "PropertyDefinition") return keyName(node.key)
-    if (node.type === "VariableDeclarator" && node.id.type === "Identifier") return node.id.name
-    if (node.type === "AssignmentPattern" && node.left.type === "Identifier") return node.left.name
-    return null
-}
+/** The brand classes of `platform/config` a default must never be given to. */
+const BRANDS = new Set(["Secret", "Url"])
+const SECRET_READERS = new Set(["secret", "url", "host"])
+const DEFAULT_LITERAL = /^(?:|localhost|127\.0\.0\.1|0\.0\.0\.0|https?:\/\/.*)$/i
 
-/** No secret, password, token, key or URL config has a literal default; a missing value stops the boot. */
+/** No secret or URL value has a default of any kind: a missing value stops the boot. */
 export const noSecretDefault = {
     meta: {
         type: "problem",
-        docs: { description: "A secret or URL config value never has a literal default." },
+        docs: { description: "A value typed `Secret` or `Url` never has a default, argument or fallback." },
         schema: [],
         messages: {
-            fallback: "`{{name}}` falls back to a literal. A missing {{kind}} must stop the boot with an error naming `{{name}}`, not start the app with a value from source.",
-            literal: "`{{name}}` holds a literal {{kind}}. A {{kind}} is supplied by configuration, never written in source.",
-            schemaDefault: "`.default(...)` gives `{{name}}` a value in source. Remove the default so a missing {{kind}} fails validation at boot.",
-            cwdPath: "A path built from `process.cwd()` and `{{segment}}` depends on where the process was started. Resolve it from a configured root.",
+            fallback: "This `{{operator}}` gives a `Secret` or `Url` a value from source. A missing secret or URL must stop the boot with an error naming the key, not start the app with a fallback.",
+            argument: "`{{method}}` is given a default. A secret, credential, key, host or URL has no default of any kind: remove the second argument so a missing key fails naming itself.",
+            literal: "A string default (`\"\"`, `\"localhost\"`, `\"127.0.0.1\"`, `\"0.0.0.0\"` or an `http(s)://` URL) is given to a reader that returns a `Secret` or `Url`. Remove it so a missing key fails naming itself.",
         },
     },
     create(context) {
         const filename = normalizePath(context.filename || context.getFilename())
-        if (isDeclarationFile(filename) || isTestLane(filename)) return {}
-        const report = (node, messageId, name, kind) => context.report({ node, messageId, data: { name, kind: kind === "url" ? "URL" : "secret" } })
-        const checkLiteralTarget = (node, value) => {
-            const name = targetName(node)
-            const kind = name ? configKind(name) : null
-            if (kind && value && isNonEmptyText(value) && (kind === "url" ? hasScheme(value) : !isKeyName(value, name))) report(node, "literal", name, kind)
+        if (isDeclarationFile(filename)) return {}
+        const hfs = hfsOf(context)
+        /** True when the node's type is (or contains) `Secret` or `Url` as `platform/config` declares them. */
+        const isBrand = (node) => originsOf(context, node).some((origin) => BRANDS.has(origin.name) && isOwnedBy(hfs, origin.file, "platform", "config"))
+        const isEnvSource = (node) => originsOf(context, node).some((origin) => origin.name === "EnvSource" && isOwnedBy(hfs, origin.file, "platform", "config"))
+        const checkFallback = (node, operator, left) => {
+            if (isBrand(left)) context.report({ node, messageId: "fallback", data: { operator } })
         }
         return {
             LogicalExpression(node) {
-                if (node.operator !== "??" && node.operator !== "||") return
-                const name = envReadName(node.left)
-                const kind = name ? configKind(name) : null
-                if (kind && isNonEmptyText(node.right) && (kind === "url" ? hasScheme(node.right) : !isKeyName(node.right, name))) report(node, "fallback", name, kind)
+                if (node.operator === "??" || node.operator === "||") checkFallback(node, node.operator, node.left)
             },
-            Property(node) {
-                checkLiteralTarget(node, node.value)
-            },
-            PropertyDefinition(node) {
-                checkLiteralTarget(node, node.value)
-            },
-            VariableDeclarator(node) {
-                checkLiteralTarget(node, node.init)
-            },
-            AssignmentPattern(node) {
-                checkLiteralTarget(node, node.right)
+            AssignmentExpression(node) {
+                if (node.operator === "??=" || node.operator === "||=") checkFallback(node, node.operator, node.left)
             },
             CallExpression(node) {
+                if (node.arguments.length < 2) return
                 const callee = node.callee
-                if (callee.type === "MemberExpression" && keyName(callee.property) === "default" && isNonEmptyText(node.arguments[0])) {
-                    for (let parent = node.parent; parent; parent = parent.parent) {
-                        if (parent.type === "Property") {
-                            const name = keyName(parent.key)
-                            const kind = name ? configKind(name) : null
-                            if (kind && (kind !== "url" || hasScheme(node.arguments[0]))) report(node, "schemaDefault", name, kind)
-                            return
-                        }
-                    }
+                const method = callee.type === "MemberExpression" && !callee.computed ? keyName(callee.property) : null
+                const onEnvSource = method !== null && isEnvSource(callee.object)
+                if (onEnvSource && (SECRET_READERS.has(method) || isBrand(node))) {
+                    context.report({ node: node.arguments[1], messageId: "argument", data: { method } })
                     return
                 }
-                if (callee.type === "MemberExpression" && ["join", "resolve"].includes(keyName(callee.property) ?? "")) {
-                    let cwd = false
-                    walk(node, (child) => {
-                        if (child.type === "CallExpression" && child.callee.type === "MemberExpression" && keyName(child.callee.property) === "cwd") cwd = true
-                    })
-                    if (!cwd) return
-                    for (const argument of node.arguments) {
-                        const text = staticText(argument)
-                        const segment = text === null ? null : text.split(/[\\/]/).find((part) => part === "src" || part === ".starcistacks")
-                        if (segment) context.report({ node, messageId: "cwdPath", data: { segment } })
-                    }
-                }
+                if (!isBrand(node)) return
+                const literal = node.arguments.slice(1).find((argument) => {
+                    const text = staticText(argument)
+                    return text !== null && DEFAULT_LITERAL.test(text)
+                })
+                if (literal) context.report({ node: literal, messageId: "literal" })
             },
         }
     },
 }
 
 const SECRET_COMPARE_WORDS = new Set(["secret", "password", "passwd", "passphrase", "token", "signature", "hmac", "credential", "credentials", "apikey"])
+const KEY_PREFIXES = new Set(["api", "secret", "private", "access", "signing", "encryption", "master", "auth", "jwt", "session"])
+const NOT_A_VALUE_WORDS = new Set(["type", "kind", "length", "count", "ttl", "name", "prefix", "header", "scheme", "field", "path", "regex", "pattern"])
 
 /** The identifier or property a comparison operand ends in, else null. */
 const operandName = (node) => {

package/connections.mjs

@@ -0,0 +1,254 @@
+/**
+ * The rules that hold one database = one connection = one named injector (R84), and the slots that may hold an
+ * `EntityManager` (R88).
+ *
+ * - `one-connection-per-database` (R84 `BE_CONNECTION_DUPLICATE`) closes the ways a second door to a database appears:
+ *   `InjectEntityManager(`, `InjectDataSource(` and `getEntityManagerToken(` are called only in the
+ *   `<conn>.decorators.ts` of the platform database capability, in the migrate app and in the test database fixture; any
+ *   exported injector of an `EntityManager` (its declared type is `TypedParameterDecorator<EntityManager>`, whatever it
+ *   is called) is `Inject<Pascal(conn)>EntityManager` for a declared connection and lives in that connection's
+ *   `<conn>.decorators.ts`; `TypeOrmModule.forRoot*` and `new DataSource(` live in the platform database capability and
+ *   the migrate app; the literal connection name is written once, in `<conn>.connection.ts`; and a `<conn>.config.ts`
+ *   reads only keys that start with that connection's `envPrefix`.
+ * - `em-injection-slots` (R88 `BE_TRANSPORT_SHAPE`) lets a class receive the `EntityManager` only in an application
+ *   handler, a domain service and the platform capabilities that own a `persistence/` - never in transport,
+ *   integrations or an app.
+ *
+ * Every question about a receiver is a question about its TypeScript type, every question about a path is a question
+ * to the HFS slot view.
+ */
+import ts from "typescript"
+import { hfsOf } from "./lib/hfs.mjs"
+import {
+    baseNameOf,
+    connectionFileOf,
+    connectionsOf,
+    inDatabaseCapability,
+    inMigrateApp, inTestBootstrap,
+    infraTypeOf,
+    injectionSites,
+    injectorNameOf,
+} from "./lib/persistence.mjs"
+import { isPackageType, originsOfType, typed, typeOrigins } from "./lib/types.mjs"
+
+/** The `@nestjs/typeorm` calls that build a second door to a connection. */
+const RAW_CONNECTION_CALLS = new Set(["InjectEntityManager", "InjectDataSource", "getEntityManagerToken"])
+
+/** The platform capabilities that own a `persistence/` and so may hold an `EntityManager`. */
+const PERSISTENCE_CAPABILITIES = ["database", "inbox", "outbox", "lease"]
+
+/** The initializers that can be an injector factory; a plain value is never typed here. */
+const FUNCTION_LIKE = new Set(["ArrowFunctionExpression", "FunctionExpression", "CallExpression"])
+
+/** Whether a file may build connections: the platform database capability and the migrate app. */
+const mayBuildConnections = (hfs, file) => inDatabaseCapability(hfs, file) || inMigrateApp(hfs, file)
+
+/** `new DataSource(` also in the test world (`src/tests/world`), which owns the shared test infrastructure (owner ruling 2026-09-30). */
+const mayConstructDataSource = (hfs, file) => mayBuildConnections(hfs, file) || inTestBootstrap(hfs, file)
+
+/** The connection whose name a string literal spells, or undefined. */
+const connectionNamed = (hfs, node) =>
+    node?.type === "Literal" && typeof node.value === "string" ? connectionsOf(hfs).find((connection) => connection.name === node.value) : undefined
+
+/** Whether a symbol is the platform composition's `TypedParameterDecorator` alias. */
+const isTypedParameterDecorator = (hfs, checker, symbol) => {
+    const target = symbol.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol
+    const declaration = target.declarations?.find(ts.isTypeAliasDeclaration)
+    if (target.name !== "TypedParameterDecorator" || !declaration) return false
+    const found = hfs.classify(declaration.getSourceFile().fileName)
+    return found.slot === "be.platform" && found.bindings?.capability === "composition"
+}
+
+/** Whether a type argument is typeorm's `EntityManager`. */
+const isEntityManagerArgument = (checker, type) => originsOfType(checker, type).some((origin) => origin.module === "typeorm" && origin.name === "EntityManager")
+
+/** Whether a written type is `TypedParameterDecorator<EntityManager>`, following the aliases written over it. */
+const isEntityManagerDecoratorNode = (hfs, checker, node, depth) => {
+    if (!ts.isTypeReferenceNode(node) || depth > 4) return false
+    const symbol = checker.getSymbolAtLocation(node.typeName)
+    if (!symbol) return false
+    if (isTypedParameterDecorator(hfs, checker, symbol)) return Boolean(node.typeArguments?.[0]) && isEntityManagerArgument(checker, checker.getTypeFromTypeNode(node.typeArguments[0]))
+    const target = symbol.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol
+    const declaration = target.declarations?.find(ts.isTypeAliasDeclaration)
+    return Boolean(declaration) && isEntityManagerDecoratorNode(hfs, checker, declaration.type, depth + 1)
+}
+
+/** Whether a type is `TypedParameterDecorator<EntityManager>`, however an alias renamed it. */
+const isEntityManagerDecorator = (hfs, checker, type) => {
+    const alias = type?.aliasSymbol
+    if (!alias) return false
+    if (isTypedParameterDecorator(hfs, checker, alias)) return Boolean(type.aliasTypeArguments?.[0]) && isEntityManagerArgument(checker, type.aliasTypeArguments[0])
+    const declaration = alias.declarations?.find(ts.isTypeAliasDeclaration)
+    return Boolean(declaration) && isEntityManagerDecoratorNode(hfs, checker, declaration.type, 1)
+}
+
+/** Whether the value written at `node` is an EntityManager injector: it, or what it returns, is `TypedParameterDecorator<EntityManager>`. */
+const isEntityManagerInjector = (context, hfs, node) => {
+    const { checker, toTs } = typed(context)
+    const tsNode = toTs(node)
+    if (!tsNode) return false
+    const type = checker.getTypeAtLocation(tsNode)
+    return [type, ...type.getCallSignatures().map((signature) => signature.getReturnType())].some((candidate) => isEntityManagerDecorator(hfs, checker, candidate))
+}
+
+/** Whether a call reaches a value declared by `pkg` under one of `names`, however it was imported. */
+const callsPackage = (context, node, names, pkg) => typeOrigins(context, node).some((origin) => origin.module === pkg && names.has(origin.name))
+
+/** The constant a declared connection name is exported as: `expert-academy` gives `EXPERT_ACADEMY_CONNECTION`. */
+const constantOf = (name) => `${name.toUpperCase().replace(/-/g, "_")}_CONNECTION`
+
+/** The string an env key argument spells, or null when it is not a plain string. */
+const keyText = (node) => {
+    if (node?.type === "Literal" && typeof node.value === "string") return node.value
+    return node?.type === "TemplateLiteral" && node.expressions.length === 0 ? node.quasis[0].value.cooked : null
+}
+
+/** Whether a call's receiver is an `EnvSource` instance (the reader), not the class itself. */
+const isEnvSourceReader = (context, hfs, object) => {
+    const isEnvSource = typeOrigins(context, object).some((origin) => {
+        const found = hfs.classify(origin.file)
+        return origin.name === "EnvSource" && found.slot === "be.platform" && found.bindings?.capability === "config"
+    })
+    if (!isEnvSource) return false
+    const { checker, toTs } = typed(context)
+    return checker.getTypeAtLocation(toTs(object)).getConstructSignatures().length === 0
+}
+
+/** One physical database is one connection, one injector, one config and one registration. */
+export const oneConnectionPerDatabase = {
+    meta: {
+        type: "problem",
+        docs: { description: "One database = one connection = one named `Inject<Conn>EntityManager` declared once in `platform/database`." },
+        schema: [],
+        messages: {
+            rawInjector:
+                "`{{name}}` is called here. A connection is reached only through its own injector: `{{name}}` is written in `platform/database/<connection>.decorators.ts`, the migrate app and the test database fixture, and nowhere else. Inject the shared EntityManager with `Inject<Connection>EntityManager()`.",
+            injectorHome:
+                "`{{name}}` is an EntityManager injector that is not the one injector of a declared connection. The only allowed injector is `Inject<Pascal(connection)>EntityManager`, exported from `platform/database/<connection>.decorators.ts` of a connection declared in `hfs.json`. A capability- or feature-specific injector, a second injector for one database and an alias are all a second door to the same database: use the connection's own injector.",
+            registration:
+                "`{{what}}` builds a connection outside the platform database capability and the migrate app. A connection is registered once, in `platform/database`; the migrate app builds its `DataSource` from the same `<connection>.config.ts`.",
+            literal:
+                "The connection name `{{name}}` is written as a string here. It is written once, as `export const {{constant}} = \"{{name}}\"` in `platform/database/{{name}}.connection.ts`; import that constant.",
+            envKey:
+                "`{{key}}` is read in the config of connection `{{connection}}`, whose environment keys all start with `{{prefix}}_`. A key of another prefix would point this connection at another connection's database. Read `{{prefix}}_<NAME>` only, spelled as a string literal.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        const filename = context.filename || context.getFilename()
+        const decoratorsFile = connectionFileOf(hfs, filename, "decorators")
+        const connectionFile = connectionFileOf(hfs, filename, "connection")
+        const configFile = connectionFileOf(hfs, filename, "config")
+        const fixtureDatabase = hfs.slotOf(filename) === "be.tests.fixtures" && baseNameOf(filename) === "database.ts"
+        const mayRawInject = Boolean(decoratorsFile) || inMigrateApp(hfs, filename) || fixtureDatabase
+        const declaredNames = new Set(connectionsOf(hfs).map((connection) => injectorNameOf(connection.name)))
+
+        /** Reports each injector-typed value written at `node`, unless it is the declared injector of this file's own connection. */
+        const checkInjector = (name, node, reportNode) => {
+            if (!isEntityManagerInjector(context, hfs, node)) return
+            if (decoratorsFile && name === injectorNameOf(decoratorsFile.name)) return
+            context.report({ node: reportNode, messageId: "injectorHome", data: { name } })
+        }
+        /** Reports a connection-name literal inside the options object of a registration. */
+        const checkOptionsName = (options) => {
+            if (options?.type !== "ObjectExpression") return
+            for (const property of options.properties) {
+                if (property.type !== "Property" || property.computed || property.key.name !== "name") continue
+                const named = connectionNamed(hfs, property.value)
+                if (named) context.report({ node: property.value, messageId: "literal", data: { name: named.name, constant: constantOf(named.name) } })
+            }
+        }
+        return {
+            CallExpression(node) {
+                const { callee } = node
+                if (callsPackage(context, callee, RAW_CONNECTION_CALLS, "@nestjs/typeorm")) {
+                    const name = typeOrigins(context, callee).find((origin) => RAW_CONNECTION_CALLS.has(origin.name)).name
+                    if (!mayRawInject) context.report({ node, messageId: "rawInjector", data: { name } })
+                    for (const argument of node.arguments) {
+                        const named = connectionNamed(hfs, argument)
+                        if (named) context.report({ node: argument, messageId: "literal", data: { name: named.name, constant: constantOf(named.name) } })
+                    }
+                    return
+                }
+                if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && ["forRoot", "forRootAsync"].includes(callee.property.name)
+                    && isPackageType(context, callee.object, "TypeOrmModule", "@nestjs/typeorm")) {
+                    if (!mayBuildConnections(hfs, filename)) context.report({ node, messageId: "registration", data: { what: `TypeOrmModule.${callee.property.name}` } })
+                    checkOptionsName(node.arguments[0])
+                    return
+                }
+                if (configFile && callee.type === "MemberExpression" && isEnvSourceReader(context, hfs, callee.object)) {
+                    const key = keyText(node.arguments[0])
+                    if (key === null || !key.startsWith(`${configFile.envPrefix}_`)) {
+                        context.report({ node: node.arguments[0] ?? node, messageId: "envKey", data: { key: key ?? "<not a string literal>", connection: configFile.name, prefix: configFile.envPrefix } })
+                    }
+                }
+            },
+            NewExpression(node) {
+                if (!isPackageType(context, node.callee, "DataSource", "typeorm")) return
+                if (!mayConstructDataSource(hfs, filename)) context.report({ node, messageId: "registration", data: { what: "new DataSource(...)" } })
+                checkOptionsName(node.arguments[0])
+            },
+            VariableDeclarator(node) {
+                if (node.id.type !== "Identifier") return
+                const named = connectionNamed(hfs, node.init)
+                if (named && node.id.name === constantOf(named.name) && connectionFile?.name !== named.name) {
+                    context.report({ node: node.init, messageId: "literal", data: { name: named.name, constant: node.id.name } })
+                }
+                if (node.init && FUNCTION_LIKE.has(node.init.type)) checkInjector(node.id.name, node.id, node.id)
+            },
+            FunctionDeclaration(node) {
+                if (node.id) checkInjector(node.id.name, node.id, node.id)
+            },
+            ExportSpecifier(node) {
+                const exported = node.exported.name ?? node.exported.value
+                // Re-exporting a declared injector under its own name is the owner's public surface; an alias is a second injector.
+                if (declaredNames.has(exported) || (!node.parent.source && node.local.name === exported)) return
+                checkInjector(exported, node.local, node.exported)
+            },
+        }
+    },
+}
+
+/** Whether a class in this file may receive an `EntityManager`. */
+const mayHoldEntityManager = (hfs, file) => {
+    const found = hfs.classify(file)
+    const base = baseNameOf(file)
+    if (found.slot === "be.feature.application") return base.endsWith(".handler.ts")
+    if (found.slot === "be.domain") return base.endsWith(".service.ts")
+    return found.slot === "be.platform" && PERSISTENCE_CAPABILITIES.includes(found.bindings?.capability)
+}
+
+/** An EntityManager is injected in an application handler, a domain service or a platform persistence capability only. */
+export const emInjectionSlots = {
+    meta: {
+        type: "problem",
+        docs: { description: "An `EntityManager` is injected only in application handlers, domain services and the platform capabilities that own a `persistence/`." },
+        schema: [],
+        messages: {
+            slot:
+                "`EntityManager` is injected in a file of slot `{{slot}}`. Only an application `*.handler.ts`, a domain `*.service.ts` and the platform database, inbox, outbox and lease capabilities reach the database. Transport dispatches a command or query, an integration calls its provider, an app composes: move the data access into a handler or a domain service.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        const filename = context.filename || context.getFilename()
+        if (mayHoldEntityManager(hfs, filename)) return {}
+        return injectionSites(({ node, annotation }) => {
+            if (annotation && infraTypeOf(context, annotation) === "EntityManager") {
+                context.report({ node, messageId: "slot", data: { slot: hfs.slotOf(filename) ?? "no slot" } })
+            }
+        })
+    },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+    "one-connection-per-database": oneConnectionPerDatabase,
+    "em-injection-slots": emInjectionSlots,
+}
+
+/** Every rule of this law ships at `error`. */
+export const recommended = {
+    "starci-be/one-connection-per-database": "error",
+    "starci-be/em-injection-slots": "error",
+}