@starci/eslint-canon-be 2.1.2 → 3.0.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 3.0.1 - 2026-10-01
+
+- Changed: the bundled runtime copy of knowledge/hfs/canon-pins.yaml pins @starci/hfs 4.0.1 (the scaffold resolves a real lockfile) and this canon at 3.0.1. No rule changed.
+
+## 3.0.0 - 2026-10-01
+
+- Fixed (lane SHAPE): `source-suffix` (R89 `BE_SOURCE_FORM`) accepts `src/tests/world/fakes/<provider>/server.ts`: an allows entry of the owning slot whose last segment is the literal file name is that file's role (be.tests.world allows `fakes/<provider>/server.ts`). `fakes/<provider>/<name>.server.ts` is still refused (`server` is no role suffix).
+- Breaking: the app monorepo standard (hfs 4.0.0). `loadHfs(import.meta.url)` in `be/eslint.config.mjs` finds the app-root `hfs.json` (kind `app`) one level up and gives every linted file the view of the be side (paths relative to `be/`); a standalone back-end `hfs.json` (`profile: be`) is refused. The project graph (`project-graph` law) is built per side from the side folder. The config stays the managed one-liner.
+- New (lane c0-orphan): `replacement-throw-carries-cause` (R108 `BE_ERROR_CAUSE_DROPPED`, law error-handling). A `throw` that escapes a `catch` or a promise `.catch` handler rethrows the caught value or carries it (as `cause` of the capability error); a `catch` with no binding throws nothing new. A value the rule cannot see through (a parameter, a call handed the caught value, a variable built from it) counts as carrying. Replaces the unrun foreign-cause script adapter of the retired code-pattern folder.
+- New (lane c0-orphan): `require-public-member-jsdoc` (R109 `BE_MEMBER_DOC_MISSING`, law comments). Every public member of an exported class, interface or object type alias opens with JSDoc; private, protected and `#` members, the constructor, index signatures and a property set to a literal or a named constant are not judged, overloads share one doc, and the test tiers (`e2e`, `fixtures`) are out of scope. Replaces the unrun member-documentation script adapter of the retired code-pattern folder.
+- New `service-deps` law (lane SVC, restored by lane RESTORE after merge `9958cce38` dropped it): `provider-param-token` (R85: a constructor parameter of a class carrying a `@nestjs/*` class decorator is typed by a class or carries an `Inject<Thing>()`), `no-repository-class` (R83: a class, or an exported function taking an EntityManager first, outside an application handler, a domain service, a platform persistence capability, the migrate app, `src/tests` and a migration takes, holds or returns an `EntityManager`, `Repository`, `DataSource` or `QueryRunner`) and `no-test-double-in-source` (R89: no `Mock`, `Fake` or `Stub` word in the name of a class, function or exported constant outside specs and `src/tests`).
+- Changed: `named-entity-manager-only` (R83) also refuses a `DataSource`/`QueryRunner` written as a type, an awaited value or a `provide:` `useValue`/`useFactory` outside the platform database capability, the migrate app, the test world and migrations, and a constructor parameter typed by a class that exposes one.
+- Changed: `no-event-bus` (R87) also refuses `new EventEmitter()`/`extends EventEmitter`, `new Subject/BehaviorSubject/ReplaySubject/AsyncSubject` and a class that stores callbacks in a Set/Array/Map property and registers a callback parameter into it.
+- New (lane AUTHCHK): `auth-door-strict-rate-tier` (R42). A door opened for `PublicReason.AuthHandshake` or `PublicReason.SignedWebhook` (the reason's TYPE is the member of `PublicReason` of `domain/identity`) carries a decorator whose argument is `RateTier.Strict` of `platform/http-security`, on the method or on its class. BE-CONVENTION 1.7 made this a MUST, and nothing checked it until now.
+- New (lane AUTHCHK): `http-client-only-in-integrations` (R90). A call on the `HttpClient` port of `platform/http` (judged by the receiver's type) is made only in an `integrations` owner, in `platform/http` and in the test world. A domain service that calls an identity provider's token or admin endpoint, or a mailer API, directly is refused (BE-INFRA-3).
+- New (lane AUTHCHK): `no-secret-in-error` (R71). A `new X(...)` whose type derives from `Error` carries no value typed by the `Secret` brand, nor one read out of it. It also carries no text value whose own name, or whose key, says it is a credential. The name test is the one `secret-compare-timing-safe` uses, now exported as `isCredentialName`. Personal identifiers are not judged.
+- Changed (lane AUTHCHK): `secret-compare-timing-safe` (R41) also refuses an equality on a value typed by the `Secret` brand of `platform/config`, or read out of one (`secret.reveal() === x`), whatever it is called. Its credential words gain `authorization`.
+- Fixed (lane AUTHCHK): `config-parsed-in-main` (R43) is back. The merge `9958cce38` (merge main into lane/ut-int, round 2) resolved `config-owner.mjs` and its test to the blob from before the rule existed. That dropped the rule, the test world's `process.env` allowance and the removal of the name-based `envConfig()` check, together with its catalog enforcer, README row, failure-code text, code-patterns id and contract change `hfs-be-config-parsed-in-main`. The rule and its fixture files are restored exactly as `d5f11c337` left them.
+
 ## 2.1.2 - 2026-10-01
 
 - Fixed: a local export list (`export { x }`, no module specifier) crashed the backend machine behind the project-graph rules (`Cannot read properties of undefined (reading 'kind')` in every file of a repository that has one). The packed-load spec covers it.

package/README.md

@@ -39,33 +39,34 @@ A sample, not the list:
 |---|---|
 | **Errors** | A `catch` rethrows, calls a method on a `Logger` receiver (typed, from `platform/logging`) or returns an outcome carrying its cause; a `DomainError` subclass lives only in `errors/<capability>.error.ts` of its owner, and that file is one code enum, one `Record<Code, ErrorKind>` table and one empty class; a `throw` throws a `DomainError`, never a bare `Error`, a framework exception or a platform error out of a domain (`catch-must-account`, `error-home`, `throw-domain-error`, `error-family-shape`) |
 | **Schema authority** | Migrations only: every DataSource or TypeORM options object states the literal `synchronize: false` (found by the contextual type), no `migrationsRun`, no DDL string outside a migration, no entity glob; no `@Entity` type reachable from a transport signature, a handler `execute`, a contract or a message, and no GraphQL or validator import in an entity file (`no-runtime-schema`, `no-entity-in-contract`) |
-| **Config and secrets** | `process.env` (any form), `@nestjs/config`, `dotenv` and `envConfig()` only in the file of `platform/config` that declares `EnvSource`; no default of any kind for a value typed `Secret` or `Url`; secrets compare with `timingSafeEqual` (`no-direct-env-read`, `no-secret-default`, `secret-compare-timing-safe`) |
+| **Config and secrets** | `process.env` (any form), `@nestjs/config`, `dotenv` only in the file of `platform/config` that declares `EnvSource` (and the test world, slot `be.tests.world`, for `process.env`); a function exported by a `<capability>.config.ts` is called only from `apps/<app>/src/main.ts` and `<app>.options.ts`, its own config file or spec, the test world and a provider contract spec (`config-parsed-in-main`); no default of any kind for a value typed `Secret` or `Url`; secrets compare with `timingSafeEqual` (`no-direct-env-read`, `config-parsed-in-main`, `no-secret-default`, `secret-compare-timing-safe`) |
 | **Default deny** | Typed bodies and arguments, no `GraphQLJSON` tunnel, no `switch (operation)`, `@Public` carries a `PublicReason` member of `domain/identity`, and no `@UseGuards` (the global `APP_GUARD` chain decides) (`no-untyped-body`, `public-needs-reason`, `no-auth-use-guards`) |
 | **Module shape** | No `@Global()`; `isGlobal: true` only in an app's `app.module.ts`; no import of another owner's module; typed `ConfigurableModuleBuilder`; `static register` is the only factory; a capability's representative module extends the `ConfigurableModuleClass` of its own module definition and every sub-module or feature module is plain (`capability-module-shape`); one module per file; no `new` of a provider; no module-level `let` (`no-global-decorator`, `is-global-only-in-app`, `no-cross-owner-module-import`, `static-module-register`) |
 | **Suppression** | No `eslint-disable`, `eslint-env`, `/* global */`, `@ts-ignore`, `@ts-expect-error`, `@ts-nocheck`, `istanbul`, `c8` or `v8 ignore`, `NOSONAR`, `sonar-disable`, `prettier-ignore` or `vn-ok` comment, anywhere (`no-inline-suppression`) |
 | **Size** | A source file, a spec included, over the manifest's line budget is not new and does not grow past its size at the parent commit; the rule takes no option (`file-size-growth`) |
 | **Query safety** | `.query(...)` takes only a `SqlText` built with the `sql` tag in a persistence `<name>.sql.ts`, and no query builder exists (`sql-text-only`, `no-query-builder`); the tag's only substitution is a `SqlIdent` and a `.query` string is never built by template or `+` (`no-interpolated-sql`); `find`, `findBy` and `findAndCount` on an `EntityManager` state `take` and no `EntityManager` read runs per loop element (`query-needs-limit`, `no-query-in-loop`) |
 | **Resilience** | An outbound HTTP call states a timeout or signal; `JSON.parse` of outside text sits in a `try`; a loop that catches and waits goes through `platform/retry` - the wait is `setTimeout`, `node:timers/promises` or a function outside `platform/retry` whose body waits, whatever it is called (`http-needs-timeout`, `json-parse-needs-guard`, `no-hand-rolled-retry`) |
-| **Log safety** | A call on the `Logger` port (found by the receiver's type) passes no `Secret` or `Pii` value and no value named like a credential or a personal identifier (`no-secret-in-log`) |
+| **Log safety** | A call on the `Logger` port (found by the receiver's type) passes no `Secret` or `Pii` value and no value named like a credential or a personal identifier (`no-secret-in-log`); a constructed error (its type derives from `Error`) carries no `Secret` value and no text value named like a credential (`no-secret-in-error`) |
 | **Async and types** | An `async` function awaits; handlers and public methods declare a return type; no `Function` type, no `eval`; an inline object type takes a name; no `const enum`. Casts, `x!` and `any` are refused in every file, specs included, by the typescript-eslint rules the factory turns on (`async-needs-await`, `explicit-handler-return-type`, `no-function-or-eval`, `no-inline-param-type`, `no-inline-object-type`, `no-const-enum`) |
-| **Migrations and input** | A migration's `down()` reverses its `up()`; every property of an input class has the `class-validator` decorators its type calls for (string `@MaxLength`, enum `@IsEnum`, array `@ArrayMaxSize`, nested `@ValidateNested()` and `@Type`); reads page by cursor, never by `skip`, `offset` or `OFFSET` (`migration-down-reversible`, `input-bounded`, `no-offset-pagination`) |
+| **Migrations and input** | A migration's `down()` reverses its `up()`; every property of an input class has the `class-validator` decorators its type calls for (string `@MaxLength`, enum `@IsEnum`, array `@ArrayMaxSize`, nested `@ValidateNested()` and `@Type`); reads page by cursor, never by `skip`, `offset` or `OFFSET`; a door opened for `PublicReason.AuthHandshake` or `PublicReason.SignedWebhook` carries `RateTier.Strict` of `platform/http-security` on the method or its class (`migration-down-reversible`, `input-bounded`, `no-offset-pagination`, `auth-door-strict-rate-tier`) |
 | **Spec quality** | A spec does not read repository source with `fs` (`spec-no-source-read`); the borrowed `consistent-type-assertions` (`never`) and `no-non-null-assertion` leave no `as` and no `x!` in a spec, and `no-ambient-clock` and `no-direct-env-read` cover specs, so no `Date.now()`, argless `new Date()` or `process.env`. A unit spec is `<name>.service.spec.ts`: it builds its subject with `Test.createTestingModule({ providers })` from `@nestjs/testing`, `.compile()` and `moduleRef.get(...)` (`spec-builds-with-testing-module`), never `new` on the service (`spec-no-new-subject`), no `imports` key and no `override*` (`spec-module-definition-only-providers`), no `jest.mock`/`doMock`/`unstable_mockModule`/`requireMock` of an own module or a library (`spec-no-module-mock`), no cast-laundering helper in a spec or fixture: a return-only generic, an `unknown` handed back as another type, `JSON.parse(JSON.stringify(x))`, `Object.assign(new X(), y)` returned as another type (`no-return-only-generic`); a provider `{ provide: TOKEN, useValue: X }` takes X from the matching `@starci/jest-preset` double, the token table being `ruleParams.be.specDoubles` of the slot manifest (`spec-infra-double-from-kit`); a unit spec asserts exact values, never `expect.any(String)`, `expect.any(Number)` or `expect.any(Date)` (`expect` being the jest global or the `@jest/globals` import): ids come from `fakeIds()` and dates from `FakeClock` (`spec-exact-values`); the EntityManager double is the kit's `mockEntityManager()`/`fakeTransaction()`, never ad hoc (`spec-typed-entity-manager`); test data goes through builders, see the **Test data builders** row |
 | **Test data builders** (R98 to R101) | Builders live only in `src/tests/fixtures/builders/<area>.builder.ts`: a module of the test tree that exports a function creating persisted rows through an EntityManager, DataSource or QueryRunner is a builder wherever it sits (`persisting-builder-in-builders-slot`, R98); a spec never runs a raw INSERT/UPDATE/DELETE or a direct write (`save`, `insert`, `upsert`, `update`, `delete`, `remove`) on a typeorm receiver and never builds the same `@Entity` class as an object literal twice (`spec-no-raw-insert`, `spec-no-repeated-row-literal`, R99); a builder never asserts and has deterministic defaults (`builder-arranges-only`, R101); nothing under `src/tests` disables or drops a constraint (`tests-keep-constraints`, R100) |
-| **CQRS** | A message extends `Command<R>` / `Query<R>` from `@nestjs/cqrs`, carries one `readonly params: ExecuteParams<X>` (no entity reachable from `X`), a handler extends `ICQRSHandler` and overrides `process`; a handler is thin: it injects only `*Service` classes and the Logger, and `process` is one `return this.<service>.<method>(...)` with no branch, loop, EntityManager or second call (`handler-is-thin`); no `*.use-case.ts`, no forwarder service, no `EventBus` or `@nestjs/event-emitter` (`handler-overrides-process`, `message-carries-params-only`, `message-typed-result`, `execute-params-shape`, `no-use-case`, `no-event-bus`) |
+| **CQRS** | A message extends `Command<R>` / `Query<R>` from `@nestjs/cqrs`, carries one `readonly params: ExecuteParams<X>` (no entity reachable from `X`), a handler extends `ICQRSHandler` and overrides `process`; a handler is thin: it injects only `*Service` classes and the Logger, and `process` is one `return this.<service>.<method>(...)` with no branch, loop, EntityManager or second call (`handler-is-thin`); no `*.use-case.ts`, no forwarder service, no `EventBus`, `@nestjs/event-emitter`, `EventEmitter` or RxJS `Subject` constructed or extended, and no class that stores callbacks other code registers (`handler-overrides-process`, `message-carries-params-only`, `message-typed-result`, `execute-params-shape`, `no-use-case`, `no-event-bus`) |
 | **Module layering** | Another owner is imported through its public `index.ts` (`@modules/domain/plan`, `@features/plan`), never through a path into it, and a same-owner import is relative and never through the own index (`import-owner-entry`); an owner has one `index.ts` (a nested one is refused) that holds only named `export { }` lines, with no `export *`, and a bounded number of names (`no-folder-reexport`); self-aliases and relative escapes are refused (`no-self-module-alias`, `no-relative-capability-escape`). Owners come from the HFS slots, aliases from the program's `compilerOptions.paths`. |
-| **Data access** | The database is reached through the shared `EntityManager` only, received as a constructor parameter with the named injector of a declared connection - a lookalike name, property injection, an injected `DataSource` or `QueryRunner` outside `platform/database` and the migrate app, `getRepository` and repository types are refused, specs included (`must-inject-entity-manager`, `named-entity-manager-only`, `no-injected-repository`); inside a transaction callback only the manager it received is used (`no-outer-manager-in-transaction`); no call through an integration, `HttpClient` or `MessagePublisher` typed receiver spans a transaction (`no-external-call-in-transaction`); the manager is injected only in application handlers, domain services and the platform database, inbox, outbox and lease capabilities (`em-injection-slots`) |
+| **Data access** | The database is reached through the shared `EntityManager` only, received as a constructor parameter with the named injector of a declared connection - a lookalike name, property injection, an injected `DataSource` or `QueryRunner` outside `platform/database` and the migrate app, `getRepository` and repository types are refused, specs included (`must-inject-entity-manager`, `named-entity-manager-only`, `no-injected-repository`); a `DataSource` or `QueryRunner` is not written as a type, awaited value or `provide:` token outside those places, and a class that receives a wrapper exposing one is refused (`named-entity-manager-only`); a class outside an application handler, a domain service and a platform persistence capability takes, holds or returns no `EntityManager`, `Repository`, `DataSource` or `QueryRunner` whatever it is called, and no exported function takes an `EntityManager` first (a statement module); `src/tests` is exempt (`no-repository-class`); a `DataSource` or `QueryRunner` is not written as a type, awaited value or `provide:` token outside those places, and a class that receives a wrapper exposing one is refused (`named-entity-manager-only`); a class outside an application handler, a domain service and a platform persistence capability takes, holds or returns no `EntityManager`, `Repository`, `DataSource` or `QueryRunner`, whatever it is called, and no exported function takes an `EntityManager` first (a statement module); the test tree (`src/tests`) is exempt (`no-repository-class`); inside a transaction callback only the manager it received is used (`no-outer-manager-in-transaction`); no call through an integration, `HttpClient` or `MessagePublisher` typed receiver spans a transaction (`no-external-call-in-transaction`); the manager is injected only in application handlers, domain services and the platform database, inbox, outbox and lease capabilities (`em-injection-slots`) |
 | **Connections** | One database is one connection and one `Inject<Conn>EntityManager()` injector: `InjectEntityManager(`, `InjectDataSource(` and `getEntityManagerToken(` are called only in `platform/database/<conn>.decorators.ts`, the migrate app and the test database fixture; an exported EntityManager injector is exactly the declared connection's; `TypeOrmModule.forRoot*` and `new DataSource(` live in the platform database capability and the migrate app; the connection name is written once, in its `<conn>.connection.ts`; a `<conn>.config.ts` reads only keys of its `envPrefix` (`one-connection-per-database`) |
 | **Operations** | A versioned operation is declared once in the app's typed operation table (`query<Input, Output, RefusalCode>()` / `mutation<...>()` registered by `defineOperations`, declared by the platform capability `operations`): its input and output are closed types (no `any`, `unknown`, `Record<string, unknown>`, unbound generic, function or `Date`) and its refusal codes a closed union of string literals; a route that takes or answers the table's types takes `OperationRequest<Table>` and answers `Promise<OperationReply<Table>>` of one table (`operation-contract-decidable`, `operation-route-driven-by-table`) |
 | **Transport** | A door injects only `CommandBus` / `QueryBus` (and `RequestLocale` in REST) and dispatches exactly one message per handler, holding no branch, loop, EntityManager or call other than the bus, and pure `*.mapper.ts` functions and `unwrapOutcome` of `platform/primitives` (`transport-is-thin`); no response envelope, no `GraphQLJSON`, no `unknown` body, no `switch (input.operation)`; a REST door lives in `transport/http` and shows a public reason, a byte stream or a redirect; a capability never imports a feature (`transport-is-thin`, `no-response-envelope`, `no-graphql-json`, `door-lives-in-features`, `rest-door-needs-a-reason`, `no-capability-imports-features`) |
-| **Infrastructure owners** | Each raw library (HTTP, cache, queue, scheduler, logger, date, config, events) is imported or reached as a global only inside the capability the manifest names for it (`ruleParams.be.infraOwners`); `@nestjs/config`, `dotenv` and `@nestjs/event-emitter` nowhere (`infra-import-owner`) |
+| **Infrastructure owners** | Each raw library (HTTP, cache, queue, scheduler, logger, date, config, events) is imported or reached as a global only inside the capability the manifest names for it (`ruleParams.be.infraOwners`); `@nestjs/config`, `dotenv` and `@nestjs/event-emitter` nowhere; the `HttpClient` port of `platform/http` (found by the receiver's type) is called only in an `integrations` owner, `platform/http` and the test world (`infra-import-owner`, `http-client-only-in-integrations`) |
 | **Observability** | Logs leave through the `Logger` port of `platform/logging`, never the framework's `Logger`; a log call's first argument is a member of an owner's `<owner>.log-events.ts` enum; a failure log carries the exception's identity, not only its wording (`no-framework-logger`, `no-interpolated-log-message`, `no-error-wording-as-log-identity`) |
 | **Testing** | Only services are unit-tested: every `<name>.service.ts` has its `<name>.service.spec.ts` beside it, a service spec has its service beside it, and any other `*.spec.ts` outside `src/tests/{e2e,integration,contract,world}` and `apps/migrate` (handler, resolver, controller, consumer, mapper, entity, guard, module, policy, helper, composition) is a finding; there is no `.test.ts`, `int-spec` or `harness-spec`; a spec asserts a result or a state, not only a call; an e2e reads persisted state back through a typeorm `EntityManager` and reaches no model provider outside `src/tests/e2e/live/` (`unit-test-colocated`, `no-call-only-spec`, `e2e-asserts-persisted-state`, `no-model-call-in-e2e`, `no-api-shaped-e2e-filename`, `no-marker-model-stub`) |
 | **End-to-end flows** | One file, one flow, named steps; the flow enters through transport (a `CommandBus`, `QueryBus` or a handler, consumer or job is never called), boots through `src/tests/e2e/setup` (no `Test.createTestingModule`), **never sleeps** — it polls with `waitFor` until the state settles, with a deadline — and takes no branch inside a step (`e2e-uses-production-transport`, `no-wiring-in-flow-spec`, `no-sleep-in-flow`, `no-branch-in-flow-step`) |
 | **CDC · event delivery** | Projections and events follow the declared delivery contract |
+| **Service dependencies · source form** | Production source declares no `Mock*`, `Fake*` or `Stub*` class, function or constant: the marker is a whole PascalCase or camelCase word of the identifier, a double lives in a spec or `src/tests`, and an offline driver is an options-driven adapter named for what it does (`no-test-double-in-source`); the provider, repository-class and connection rules of this law are listed under Dependency injection and Data access |
 | **Comments · naming · type safety** | Comments say why; no double cast through `unknown`; named exports only, the Jest `*.global-setup.ts` being the one default export; Vietnamese only in a message catalog or the `src/tests/fixtures/i18n/` fixtures slot (`be.tests.fixtures.i18n`), never in an identifier, string, comment or test title, specs included, in NFC or NFD spelling (`no-default-export`, `no-non-ascii-source`) |
 | **User copy** | A literal message of an error class (judged by the constructed type extending `Error`), a text property handed to an outbound port (a receiver typed from `integrations` or `platform/messaging`) or a response copy in a transport slot comes from the messages catalog through the typed `MessageCatalog` port, specs included (`user-copy-through-catalog`) |
 | **Temporal** | `Date.now`, a bare `new Date()`, `performance.now`, `process.hrtime` and `Temporal.Now` are referenced (not only called) only inside `platform/clock`, specs included (`no-ambient-clock`) |
-| **Dependency injection** | Raw `Inject(`, `InjectEntityManager(`, `InjectDataSource(`, `InjectQueue(`, `InjectRepository(` and any third-party `Inject*` are called only in a `<owner>.decorators.ts` at an owner root, and injectors decorate constructor parameters only; an injector is zero-argument, typed `TypedParameterDecorator<T>`, built with `injector<T>(token)`, documented, over a `unique symbol` token; `T` equals the parameter type; a parameter typed by a platform, integrations or package declaration carries an injector (only domain services and the same owner are class-injected); no `ModuleRef`, no `forwardRef`, no string token (`injector-only`, `injector-shape`, `injector-type-match`, `infra-needs-injector`, `no-module-ref`, `no-forward-ref`, `no-string-token`) |
+| **Dependency injection** | Raw `Inject(`, `InjectEntityManager(`, `InjectDataSource(`, `InjectQueue(`, `InjectRepository(` and any third-party `Inject*` are called only in a `<owner>.decorators.ts` at an owner root, and injectors decorate constructor parameters only; an injector is zero-argument, typed `TypedParameterDecorator<T>`, built with `injector<T>(token)`, documented, over a `unique symbol` token; `T` equals the parameter type; a parameter typed by a platform, integrations or package declaration carries an injector (only domain services and the same owner are class-injected); no `ModuleRef`, no `forwardRef`, no string token; a constructor parameter of a Nest provider is typed by a class or carries an `Inject<Thing>()`, never a bare primitive, `Map`, union or interface (`injector-only`, `injector-shape`, `injector-type-match`, `infra-needs-injector`, `provider-param-token`, `no-module-ref`, `no-forward-ref`, `no-string-token`) |
 | **Idempotency** | The first awaited expression of a public service method whose first parameter has an `eventId` is `claim(source, eventId)` on a receiver typed as the `Inbox` port, followed by an early return on `false`; doors are thin and claim nothing (`inbox-dedupe-required`) |
 
 Every rule names the law that declares it — `ruleOwners` maps rule name to law, so a failing build

package/comments.mjs

@@ -1,11 +1,15 @@
 /**
  * The rules that hold `comments.md`.
  *
- * Five rules, and each is careful about a different false positive:
+ * Six rules, and each is careful about a different false positive:
  *
  *   - `require-export-jsdoc` skips plain data constants. `export const MAX_ATTEMPTS = 3` is already
  *     fully described by its own name, and demanding a sentence there produces sentences that
  *     restate the name - which COMMENT-3 forbids. Only declarations with a surface get the check.
+ *   - `require-public-member-jsdoc` (R109) judges only what a caller reaches: a private, protected or `#` member, the
+ *     constructor and an index signature are not surface, overload signatures of one name share one doc, and a property
+ *     set to a literal or a named constant is a data constant (COMMENT-1's reason). Product source only: the test tiers
+ *     (`e2e`, `fixtures` of the slot manifest) document their spec-read shapes at the type.
  *   - `require-enum-member-jsdoc` can check that a doc EXISTS and never that it states a
  *     consequence. That half is read by a person, and the rule says so rather than pretending.
  *   - `no-non-ascii-source` takes no exemption marker: HFS removed `vn-ok`, so text a program depends on
@@ -20,6 +24,7 @@
  */
 
 import { hfsOf } from "./lib/hfs.mjs"
+import { normalizePath } from "./lib/path.mjs"
 import { hasSecondLanguage } from "./runtime/scripts/lib/language.mjs"
 
 /** The slots of the per-owner message catalogs: the only source files that may hold Vietnamese. */
@@ -136,6 +141,102 @@ export const requireExportJsdoc = {
   },
 }
 
+// -- COMMENT-3 (R109) -----------------------------------------------------------------------------
+
+/** Class members a caller reaches: everything but the constructor, static blocks and index signatures. */
+const CLASS_MEMBER_KINDS = new Set([
+  "MethodDefinition",
+  "PropertyDefinition",
+  "AccessorProperty",
+  "TSAbstractMethodDefinition",
+  "TSAbstractPropertyDefinition",
+  "TSAbstractAccessorProperty",
+])
+
+/** Interface and type-literal members a caller reaches; call, construct and index signatures have no name to document. */
+const SIGNATURE_MEMBER_KINDS = new Set(["TSPropertySignature", "TSMethodSignature"])
+
+/**
+ * A property set to a literal or a named constant (`name = "CreatePlans1758"`, `readonly queue = PLAN_QUEUE`) is already
+ * described by its own name and value, the same reason COMMENT-1 leaves a data constant alone.
+ */
+const isDataProperty = (member) => {
+  if (member.type !== "PropertyDefinition" || !member.value) return false
+  const value = member.value
+  if (value.type === "Literal" || value.type === "Identifier") return true
+  if (value.type === "TemplateLiteral") return value.expressions.length === 0
+  return value.type === "MemberExpression" && !value.computed && value.object.type === "Identifier"
+}
+
+/** The test tiers of the slot manifest: spec-read shapes there are documented at the type, not field by field. */
+const TEST_TIERS = new Set(["e2e", "fixtures"])
+
+/** The members of an exported class, interface or object type alias that are its public surface. */
+const publicMembersOf = (declaration) => {
+  if (declaration.type === "ClassDeclaration") {
+    return declaration.body.body.filter((member) =>
+      CLASS_MEMBER_KINDS.has(member.type)
+      && member.kind !== "constructor"
+      && !isDataProperty(member)
+      && member.key?.type !== "PrivateIdentifier"
+      && member.accessibility !== "private"
+      && member.accessibility !== "protected")
+  }
+  if (declaration.type === "TSInterfaceDeclaration") return declaration.body.body.filter((member) => SIGNATURE_MEMBER_KINDS.has(member.type))
+  if (declaration.type === "TSTypeAliasDeclaration") {
+    const type = declaration.typeAnnotation
+    const literals = type.type === "TSTypeLiteral" ? [type]
+      : type.type === "TSIntersectionType" ? type.types.filter((part) => part.type === "TSTypeLiteral") : []
+    return literals.flatMap((literal) => literal.members.filter((member) => SIGNATURE_MEMBER_KINDS.has(member.type)))
+  }
+  return []
+}
+
+/** The name a member is reached by, with its static side kept apart; null for a computed key the rule cannot name. */
+const memberKey = (member) => {
+  if (member.computed) return null
+  const key = member.key
+  const name = key?.type === "Identifier" ? key.name : key?.type === "Literal" ? String(key.value) : null
+  return name === null ? null : `${member.static ? "static " : ""}${name}`
+}
+
+/** Every public member of an exported class, interface or object type opens with a doc block (BE-COMMENT-3). */
+export const requirePublicMemberJsdoc = {
+  meta: {
+    type: "suggestion",
+    docs: { description: "Every public member of an exported class, interface or object type alias opens with JSDoc." },
+    schema: [],
+    messages: {
+      jsdoc:
+        "`{{owner}}.{{name}}` is public surface with no doc block. A caller reaches the member, not the type's doc: say what it is for, what calling or reading it causes, or what it holds.",
+    },
+  },
+  create(context) {
+    const sourceCode = context.sourceCode || context.getSourceCode()
+    if (TEST_TIERS.has(hfsOf(context).tierOf(normalizePath(context.filename)))) return {}
+    const check = (node) => {
+      const declaration = node.declaration
+      if (!declaration || !declaration.id) return
+      // overload signatures share one name; a doc on any of them documents the member
+      const groups = new Map()
+      for (const member of publicMembersOf(declaration)) {
+        const key = memberKey(member)
+        if (key === null) continue
+        if (!groups.has(key)) groups.set(key, [])
+        groups.get(key).push(member)
+      }
+      for (const [key, members] of groups) {
+        if (members.some((member) => hasJsdocBefore(sourceCode, member))) continue
+        context.report({ node: members[0].key, messageId: "jsdoc", data: { owner: declaration.id.name, name: key.replace(/^static /, "") } })
+      }
+    }
+    return {
+      ExportNamedDeclaration: check,
+      ExportDefaultDeclaration: check,
+    }
+  },
+}
+
 // -- COMMENT-2 -------------------------------------------------------------------------------------
 
 /** Every member of an exported enum carries its own doc. */
@@ -305,6 +406,7 @@ export const noRestatedNameJsdoc = {
 export const rules = {
   "require-export-jsdoc": requireExportJsdoc,
   "require-enum-member-jsdoc": requireEnumMemberJsdoc,
+  "require-public-member-jsdoc": requirePublicMemberJsdoc,
   "no-non-ascii-source": noNonAsciiSource,
   "no-restated-name-jsdoc": noRestatedNameJsdoc,
 }
@@ -320,6 +422,7 @@ export const rules = {
 export const recommended = {
   "starci-be/require-export-jsdoc": "error",
   "starci-be/require-enum-member-jsdoc": "error",
+  "starci-be/require-public-member-jsdoc": "error",
   "starci-be/no-non-ascii-source": "error",
   "starci-be/no-restated-name-jsdoc": "error",
 }

package/config-owner.mjs

@@ -5,21 +5,33 @@
  *   - `no-direct-env-read` keeps the process environment inside the one file that declares the `EnvSource` class of
  *     `platform/config`. Everything else receives typed options from `<capability>.config.ts`. `process.env` in any form
  *     (member access, destructuring, `Reflect.get(process, "env")`, an `env` import of `node:process`), an import of
- *     `@nestjs/config` or `dotenv`, a call of `envConfig()`, and a `process.cwd()` path joined into `src` or
- *     `.starcistacks` are refused everywhere else.
+ *     `@nestjs/config` or `dotenv`, and a `process.cwd()` path joined into `src` or
+ *     `.starcistacks` are refused everywhere else. The test world (slot `be.tests.world`) may read and write `process.env`:
+ *     it hands the run state file path to the jest workers. A config getter that reads `process.env` itself is caught here at its
+ *     definition.
+ *   - `config-parsed-in-main` keeps the parsing of configuration in `main.ts`: a call of a function exported by a
+ *     `<capability>.config.ts` (or of a function returning a `<capability>.options.ts` type, at module scope) is refused
+ *     outside the app entry (`main.ts` and `<app>.options.ts`), the config file itself, its own spec, the test world and a provider contract spec. The callee is found through the type
+ *     checker, so no function name is matched.
  *   - `no-secret-default` refuses a default for a value typed `Secret` or `Url` by `platform/config`: a default argument
  *     to an `EnvSource` reader, a `??`/`||` fallback on such a value, and a string literal default (`""`, `"localhost"`,
  *     `"127.0.0.1"`, `"0.0.0.0"`, `http(s)://...`) given to any reader that returns one. The TYPE decides; no key name is
  *     matched. A missing value must stop the boot, naming the key.
- *   - `secret-compare-timing-safe` refuses `===` and `!==` on a secret-named identifier. A secret compares with
+ *   - `secret-compare-timing-safe` refuses `===` and `!==` on a value typed by the `Secret` brand of `platform/config` (or
+ *     read out of one, `secret.reveal()`) and on a secret-named identifier. A secret compares with
  *     `timingSafeEqual`, because the length of the matching prefix is a measurable side channel.
  *
  * No test lane is exempt: a spec builds its `EnvSource` from a literal record and never touches the process environment.
  */
+import ts from "typescript"
 import { keyName, staticText, walk, wordsOf } from "./lib/ast.mjs"
-import { isOwnedBy, originsOf } from "./lib/declared.mjs"
+import { isOwnedBy, isOwnedType, originsOf } from "./lib/declared.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
 import { isDeclarationFile, normalizePath } from "./lib/path.mjs"
+import { originsOfType, typed } from "./lib/types.mjs"
+
+/** The test composition root (slot `be.tests.world`): it composes app options like `main.ts` and hands run state to jest workers through the environment. */
+const isTestWorld = (hfs, file) => hfs.slotOf(file) === "be.tests.world"
 
 const PROCESS_MODULES = new Set(["process", "node:process"])
 
@@ -37,7 +49,7 @@ const isGlobalProcess = (node) =>
 /** True when the property of a member expression spells `env`. */
 const spellsEnv = (node) => (node.computed ? staticText(node.property) === "env" : keyName(node.property) === "env")
 
-/** Only the file that declares `EnvSource` reads the process environment. */
+/** Only the file that declares `EnvSource` (and the test world) reads the process environment. */
 export const noDirectEnvRead = {
     meta: {
         type: "problem",
@@ -46,7 +58,6 @@ export const noDirectEnvRead = {
         messages: {
             env: "The process environment is read outside the `EnvSource` of `platform/config`. Add the key to the capability's `<capability>.config.ts` (`parse<C>Config(env: EnvSource)`) and receive the value through its `<capability>.options.ts`.",
             package: "`{{source}}` is a second config path. Configuration is parsed once in `main.ts` by `platform/config` typed readers and reaches a module through `register(options)`.",
-            envConfig: "`envConfig()` re-reads the environment per call site. Receive the value through the capability's options, read with `Inject<C>Options()`.",
             cwdPath: "A path built from `process.cwd()` and `{{segment}}` depends on where the process was started. Resolve it from a configured root.",
         },
     },
@@ -66,8 +77,9 @@ export const noDirectEnvRead = {
         }
         const isProcess = (node) => (node.type === "Identifier" && processNames.has(node.name) && !isLocal(node)) || isGlobalProcess(node)
         const isEnvSourceFile = () => inConfigOwner && declaresEnvSource
+        const inWorld = isTestWorld(hfs, filename)
         const reportEnv = (node) => {
-            if (!isEnvSourceFile()) context.report({ node, messageId: "env" })
+            if (!isEnvSourceFile() && !inWorld) context.report({ node, messageId: "env" })
         }
         const reportSource = (node, source) => {
             if (isConfigPackage(source)) context.report({ node, messageId: "package", data: { source } })
@@ -101,7 +113,6 @@ export const noDirectEnvRead = {
             },
             CallExpression(node) {
                 const callee = node.callee
-                if (callee.type === "Identifier" && callee.name === "envConfig") context.report({ node, messageId: "envConfig" })
                 if (callee.type === "Identifier" && callee.name === "require") {
                     const source = staticText(node.arguments[0])
                     if (source !== null) reportSource(node, source)
@@ -127,6 +138,78 @@ export const noDirectEnvRead = {
     },
 }
 
+const CONFIG_SUFFIX = ".config.ts"
+const OPTIONS_SUFFIX = ".options.ts"
+const CONFIG_SPEC_SUFFIX = ".config.spec.ts"
+
+const baseOf = (file) => normalizePath(file).split("/").at(-1) ?? ""
+
+/** A file in a slot of the repository whose role is `<c>.config.ts` (a file with the suffix that no slot claims is not one). */
+const isConfigFile = (hfs, file) => baseOf(file).endsWith(CONFIG_SUFFIX) && hfs.slotOf(file) !== null
+
+/** A file in a slot of the repository whose role is `<c>.options.ts`. */
+const isOptionsFile = (hfs, file) => baseOf(file).endsWith(OPTIONS_SUFFIX) && hfs.slotOf(file) !== null
+
+/** The declaration of a plain function (declaration, or arrow/function expression bound to a variable), else null: a method is not a getter. */
+const functionDeclarationOf = (declaration) => {
+    if (!declaration) return null
+    if (ts.isFunctionDeclaration(declaration)) return declaration
+    if ((ts.isArrowFunction(declaration) || ts.isFunctionExpression(declaration)) && ts.isVariableDeclaration(declaration.parent)) return declaration
+    return null
+}
+
+/** True when the node is evaluated when the module loads: no function, method or class member body encloses it. */
+const isModuleScope = (node) => {
+    for (let parent = node.parent; parent; parent = parent.parent) {
+        if (/Function|MethodDefinition|PropertyDefinition|StaticBlock/.test(parent.type)) return false
+    }
+    return true
+}
+
+/** Config is parsed once, in `main.ts`; nothing else calls a config parser or getter. */
+export const configParsedInMain = {
+    meta: {
+        type: "problem",
+        docs: { description: "A function of a `<capability>.config.ts` is called only from the app entry, its own config file or spec, and the test world." },
+        schema: [],
+        messages: {
+            parsed: "`{{name}}` is declared by `{{file}}` and parses configuration. Configuration is parsed once in `apps/<app>/src/main.ts` and reaches a module through `register(options)`; read it here with `Inject<C>Options()`.",
+            moduleScope: "`{{name}}` returns configuration options and is called when the module loads. Options are built once in `main.ts` and injected with `Inject<C>Options()`.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename)) return {}
+        const hfs = hfsOf(context)
+        const slot = hfs.slotOf(filename) ?? ""
+        // the composition roots: the app entry and its `<app>.options.ts` (which `main.ts` calls to build `AppOptions`), the test world,
+        // and a provider contract spec (it registers one module with options parsed from the declared sandbox keys, as the world does)
+        const isEntry = slot.startsWith("be.app.") && (baseOf(filename) === "main.ts" || baseOf(filename).endsWith(OPTIONS_SUFFIX))
+        const isComposingTest = isTestWorld(hfs, filename) || slot === "be.tests.contract"
+        const isOwnSpec = baseOf(filename).endsWith(CONFIG_SPEC_SUFFIX)
+        if (isEntry || isComposingTest || isOwnSpec) return {}
+        const { checker, toTs } = typed(context)
+        return {
+            CallExpression(node) {
+                const tsCall = toTs(node)
+                if (!tsCall) return
+                const signature = checker.getResolvedSignature(tsCall)
+                const declaration = functionDeclarationOf(signature?.declaration)
+                if (!declaration) return
+                const declaredIn = normalizePath(declaration.getSourceFile().fileName)
+                const name = context.sourceCode.getText(node.callee)
+                if (isConfigFile(hfs, declaredIn)) {
+                    if (declaredIn !== filename) context.report({ node, messageId: "parsed", data: { name, file: baseOf(declaredIn) } })
+                    return
+                }
+                if (!isModuleScope(node)) return
+                const returned = originsOfType(checker, checker.getReturnTypeOfSignature(signature))
+                if (returned.some((origin) => isOptionsFile(hfs, origin.file))) context.report({ node, messageId: "moduleScope", data: { name } })
+            },
+        }
+    },
+}
+
 /** The brand classes of `platform/config` a default must never be given to. */
 const BRANDS = new Set(["Secret", "Url"])
 const SECRET_READERS = new Set(["secret", "url", "host"])
@@ -181,7 +264,7 @@ export const noSecretDefault = {
     },
 }
 
-const SECRET_COMPARE_WORDS = new Set(["secret", "password", "passwd", "passphrase", "token", "signature", "hmac", "credential", "credentials", "apikey"])
+const SECRET_COMPARE_WORDS = new Set(["secret", "password", "passwd", "passphrase", "token", "signature", "hmac", "credential", "credentials", "apikey", "authorization"])
 const KEY_PREFIXES = new Set(["api", "secret", "private", "access", "signing", "encryption", "master", "auth", "jwt", "session"])
 const NOT_A_VALUE_WORDS = new Set(["type", "kind", "length", "count", "ttl", "name", "prefix", "header", "scheme", "field", "path", "regex", "pattern"])
 
@@ -195,7 +278,12 @@ const operandName = (node) => {
 /** Words before the last one that make a token a counter or a cursor, not a credential. */
 const NOT_A_CREDENTIAL_QUALIFIERS = new Set(["fencing", "idempotency", "cursor", "page", "next", "continuation", "pagination", "sync", "csrf"])
 
-const isSecretName = (name) => {
+/**
+ * Whether a value's own name says it IS a credential: its last word is one (`password`, `accessToken`, `clientSecret`,
+ * `signingKey`), unless the name is an UPPER_SNAKE constant naming a key or a counter or cursor qualifies it. Shared by the
+ * comparison rule here and the error rule of R71.
+ */
+export const isCredentialName = (name) => {
     // an UPPER_SNAKE name is a constant naming a key, not the value it names
     if (/^[A-Z][A-Z0-9_]*$/.test(name)) return false
     const words = wordsOf(name)
@@ -210,11 +298,17 @@ const isPresenceOperand = (node) =>
     (node.type === "Identifier" && node.name === "undefined") ||
     (node.type === "UnaryExpression" && node.operator === "typeof")
 
+/** A value typed by the `Secret` brand of `platform/config`, or read out of one (`secret.reveal()`, `secret.value`): the TYPE says it is a secret. */
+const isSecretValue = (context, node) => {
+    const holder = node.type === "CallExpression" && node.callee.type === "MemberExpression" ? node.callee.object : node.type === "MemberExpression" ? node.object : null
+    return isOwnedType(context, node, "Secret", "platform", "config") || (holder !== null && isOwnedType(context, holder, "Secret", "platform", "config"))
+}
+
 /** A secret is compared with `timingSafeEqual`, never with an equality operator. */
 export const secretCompareTimingSafe = {
     meta: {
         type: "problem",
-        docs: { description: "A secret-named value is compared with `timingSafeEqual`, not `===` or `!==`." },
+        docs: { description: "A `Secret`-typed or secret-named value is compared with `timingSafeEqual`, not `===` or `!==`." },
         schema: [],
         messages: {
             compare: "`{{name}}` is a secret compared with `{{operator}}`. Compare secrets with `crypto.timingSafeEqual` on equal-length buffers so the comparison time does not leak the match.",
@@ -228,8 +322,12 @@ export const secretCompareTimingSafe = {
                 if (!["===", "!==", "==", "!="].includes(node.operator)) return
                 if (isPresenceOperand(node.left) || isPresenceOperand(node.right)) return
                 for (const side of [node.left, node.right]) {
+                    if (isSecretValue(context, side)) {
+                        context.report({ node, messageId: "compare", data: { name: context.sourceCode.getText(side), operator: node.operator } })
+                        return
+                    }
                     const name = operandName(side)
-                    if (name && isSecretName(name)) {
+                    if (name && isCredentialName(name)) {
                         context.report({ node, messageId: "compare", data: { name, operator: node.operator } })
                         return
                     }
@@ -242,13 +340,15 @@ export const secretCompareTimingSafe = {
 /** The rules this law contributes to the plugin. */
 export const rules = {
     "no-direct-env-read": noDirectEnvRead,
+    "config-parsed-in-main": configParsedInMain,
     "no-secret-default": noSecretDefault,
     "secret-compare-timing-safe": secretCompareTimingSafe,
 }
 
-/** All three start at error: a secret in source or a timing leak is never a warning. */
+/** All four start at error: a secret in source or a timing leak is never a warning. */
 export const recommended = {
     "starci-be/no-direct-env-read": "error",
+    "starci-be/config-parsed-in-main": "error",
     "starci-be/no-secret-default": "error",
     "starci-be/secret-compare-timing-safe": "error",
 }

package/connections.mjs

@@ -28,15 +28,13 @@ import {
     infraTypeOf,
     injectionSites,
     injectorNameOf,
+    mayHoldEntityManager,
 } from "./lib/persistence.mjs"
 import { isPackageType, originsOfType, typed, typeOrigins } from "./lib/types.mjs"
 
 /** The `@nestjs/typeorm` calls that build a second door to a connection. */
 const RAW_CONNECTION_CALLS = new Set(["InjectEntityManager", "InjectDataSource", "getEntityManagerToken"])
 
-/** The platform capabilities that own a `persistence/` and so may hold an `EntityManager`. */
-const PERSISTENCE_CAPABILITIES = ["database", "inbox", "outbox", "lease"]
-
 /** The initializers that can be an injector factory; a plain value is never typed here. */
 const FUNCTION_LIKE = new Set(["ArrowFunctionExpression", "FunctionExpression", "CallExpression"])
 
@@ -209,15 +207,6 @@ export const oneConnectionPerDatabase = {
     },
 }
 
-/** Whether a class in this file may receive an `EntityManager`. */
-const mayHoldEntityManager = (hfs, file) => {
-    const found = hfs.classify(file)
-    const base = baseNameOf(file)
-    if (found.slot === "be.feature.application") return base.endsWith(".handler.ts")
-    if (found.slot === "be.domain") return base.endsWith(".service.ts")
-    return found.slot === "be.platform" && PERSISTENCE_CAPABILITIES.includes(found.bindings?.capability)
-}
-
 /** An EntityManager is injected in an application handler, a domain service or a platform persistence capability only. */
 export const emInjectionSlots = {
     meta: {

package/cqrs.mjs

@@ -411,6 +411,29 @@ const EVENT_NAMES = new Set(["EventBus", "EventsHandler", "IEventHandler"])
 /** The package of the second in-process event system. */
 const EVENT_EMITTER_PACKAGE = "@nestjs/event-emitter"
 
+/** The Node and RxJS classes that are an in-process event bus when constructed or extended: package -> class names. */
+const BUS_CLASSES = { events: new Set(["EventEmitter"]), "node:events": new Set(["EventEmitter"]), rxjs: new Set(["Subject", "BehaviorSubject", "ReplaySubject", "AsyncSubject"]) }
+
+/** The bus class a constructed or extended expression is declared as (by declaration origin), else null. */
+const busClassOf = (context, node) => {
+    const origin = typeOrigins(context, node).find((entry) => entry.module !== null && BUS_CLASSES[entry.module]?.has(entry.name))
+    return origin ? origin.name : null
+}
+
+/** The methods that register a subscriber on a collection. */
+const REGISTER_METHODS = new Set(["add", "push", "unshift", "set"])
+
+/** True for a type that is a function: it has a call signature and no construct signature. */
+const isFunctionType = (type) => type.getCallSignatures().length > 0 && type.getConstructSignatures().length === 0
+
+/** True when a collection type (Set, Array, Map) holds functions. */
+const holdsFunctions = (checker, type) => {
+    const symbolName = type.getSymbol()?.getName()
+    if (!["Set", "Array", "ReadonlyArray", "Map", "WeakSet"].includes(symbolName ?? "")) return false
+    const args = checker.getTypeArguments(type)
+    return args.length > 0 && isFunctionType(args[args.length - 1])
+}
+
 /** No in-process events: a side effect that must happen anyway is an outbox message. */
 export const noEventBus = {
     meta: {
@@ -419,11 +442,56 @@ export const noEventBus = {
         schema: [],
         messages: {
             event: "`{{name}}` is an in-process event mechanism. Events die with the process and run outside the transaction: write an outbox message in the transaction and consume it in `transport/message/` instead.",
+            bus: "`{{name}}` is constructed or extended here as an in-process event bus. A `*TransitionEmitter`, a Subject used as a channel or an EventEmitter subclass has the same failure as `EventBus`: listeners live in one process and run outside the transaction. Write an outbox message in the transaction and consume it in `transport/message/`; a state a caller waits for is read from the database.",
+            registry: "`{{name}}` stores callbacks that other code registers and this class later calls: a hand-rolled listener list is an in-process event bus. Write an outbox message in the transaction and consume it in `transport/message/` instead.",
         },
     },
     create(context) {
         const report = (node, name) => context.report({ node, messageId: "event", data: { name } })
+        const { checker, toTs } = typed(context)
+        /** Collects, per class, the functions-collection properties and the registrations made on them. */
+        const checkClass = (classNode) => {
+            const collections = new Map()
+            for (const member of classNode.body.body) {
+                if (member.type !== "PropertyDefinition" || member.computed || member.key.type !== "Identifier") continue
+                const tsKey = toTs(member.key)
+                if (tsKey && holdsFunctions(checker, checker.getTypeAtLocation(tsKey))) collections.set(member.key.name, member.key)
+            }
+            if (collections.size === 0) return
+            const registered = new Set()
+            const visit = (node) => {
+                if (!node || typeof node.type !== "string") return
+                if (node.type === "CallExpression" && node.callee.type === "MemberExpression" && !node.callee.computed && node.callee.property.type === "Identifier" && REGISTER_METHODS.has(node.callee.property.name)) {
+                    const holder = node.callee.object
+                    if (holder.type === "MemberExpression" && holder.object.type === "ThisExpression" && !holder.computed && holder.property.type === "Identifier" && collections.has(holder.property.name)) {
+                        const callback = node.arguments[node.arguments.length - 1]
+                        const tsCallback = callback ? toTs(callback) : null
+                        if (tsCallback && isFunctionType(checker.getTypeAtLocation(tsCallback)) && callback.type === "Identifier") registered.add(holder.property.name)
+                    }
+                }
+                for (const key of Object.keys(node)) {
+                    if (key === "parent") continue
+                    const value = node[key]
+                    if (Array.isArray(value)) for (const child of value) visit(child)
+                    else if (value && typeof value.type === "string") visit(value)
+                }
+            }
+            visit(classNode.body)
+            for (const name of registered) context.report({ node: collections.get(name), messageId: "registry", data: { name } })
+        }
         return {
+            ClassDeclaration(node) {
+                checkClass(node)
+                if (node.superClass) {
+                    const name = busClassOf(context, node.superClass)
+                    if (name) context.report({ node: node.superClass, messageId: "bus", data: { name } })
+                }
+            },
+            ClassExpression(node) { checkClass(node) },
+            NewExpression(node) {
+                const name = busClassOf(context, node.callee)
+                if (name) context.report({ node, messageId: "bus", data: { name } })
+            },
             ...moduleReferences(({ node, source, value, names }) => {
                 if (value === EVENT_EMITTER_PACKAGE) report(source, value)
                 else if (value === CQRS_PACKAGE) for (const name of names) if (EVENT_NAMES.has(name)) report(node, name)