@starci/eslint-canon-be 3.0.7 → 3.0.9

package/feature-thin.mjs

@@ -0,0 +1,237 @@
+/**
+ * The rule that holds the thin-feature law (R203 `BE_FEATURE_THIN`).
+ *
+ * A file of the feature tier whose role is one of `ruleParams.be.thinRoles` of the slot manifest
+ * (`<name>.handler.ts`, `<name>.resolver.ts`, `<name>.consumer.ts`, `<name>.processor.ts`, `<name>.step.ts`,
+ * `<name>.webhook.ts`, `<name>.mapper.ts`, ...) is a door: it maps its parameters and makes ONE delegating
+ * call into the modules (a service, the command or query bus, the event bus, a queue producer). No branch,
+ * loop, `try` or `throw` on business data and no computation lives in it - the logic belongs to the modules,
+ * where every file is unit-covered at 100, and orchestration (step order, compensation, claim, fencing,
+ * retry) belongs to the platform. A `mapper` file holds only property mapping: `*.mapper.ts` calls, `new`, and the shape conversions `map` and `toISOString`
+ * expressions, no delegating call at all.
+ *
+ * Kind comes from the SLOT and the TIER (`hfs.tierOf(filename)`, `hfs.ruleParams.thinRoles`), the role from
+ * the file-name suffix the closed role vocabulary defines - never a path regex. What a receiver is comes
+ * from its TYPE (`Logger` of `platform/logging`, `WebhookSignatureService` of `platform/http-security`) and
+ * from whether the member is injected (`injectedMembers`); what a free function is comes from the file its
+ * import resolves to. A job `step` records its fence through `JobClaims` (`advance`, `runKey`) and a webhook proves its signature through `verify`: those gate calls
+ * are free, the one effect each makes is the delegating call. `.spec.ts` and `.d.ts` are never judged, and neither is a file whose tier is not
+ * `feature` or whose role is not a thin role. A clean thin file is never flagged: that is the bar.
+ */
+import { keyName, walk } from "./lib/ast.mjs"
+import { aliasTarget, injectedMembers } from "./lib/doors.mjs"
+import { hfsOf } from "./lib/hfs.mjs"
+import { importOf } from "./lib/import-source.mjs"
+import { baseName, isLoggerType, isOwnedType } from "./lib/ports.mjs"
+
+/** The statements and expressions that are a decision, a repetition or an exit: none lives in a thin file. */
+const BRANCH_NODES = new Set(["IfStatement", "SwitchStatement", "ConditionalExpression", "ForStatement", "ForInStatement", "ForOfStatement", "WhileStatement", "DoWhileStatement", "TryStatement", "ThrowStatement", "LogicalExpression"])
+
+/** The expressions that compute a value (a `TemplateLiteral` with an expression joins them). */
+const COMPUTE_NODES = new Set(["BinaryExpression", "UnaryExpression", "UpdateExpression", "AssignmentExpression"])
+
+/** The nodes a function can be: the walk for calls and the nesting test use the same set. */
+const FUNCTION_NODES = new Set(["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression", "MethodDefinition"])
+
+/** What one decision or loop node is called in a message. */
+const BRANCH_WHAT = {
+    IfStatement: "an `if`",
+    SwitchStatement: "a `switch`",
+    ConditionalExpression: "a ternary",
+    ForStatement: "a `for`",
+    ForInStatement: "a `for-in`",
+    ForOfStatement: "a `for-of`",
+    WhileStatement: "a `while`",
+    DoWhileStatement: "a `do-while`",
+    TryStatement: "a `try`",
+    ThrowStatement: "a `throw`",
+}
+
+/** The wraps a call may sit under while still being the call of its statement. */
+const STATEMENT_WRAPPERS = new Set(["AwaitExpression", "TSAsExpression", "TSSatisfiesExpression", "TSNonNullExpression", "ChainExpression"])
+
+/** The closed-vocabulary role a file name carries (`<name>.<role>.ts` gives `<role>`), or null. */
+const roleOf = (filename) => /\.([a-z][a-z0-9-]*)\.ts$/.exec(baseName(filename))?.[1] ?? null
+
+/** The `WebhookSignatureService` of `platform/http-security` - the `verify` a webhook door may call. */
+const isSignatureReceiver = (context, node) => isOwnedType(context, node, { name: "WebhookSignatureService", capability: "http-security", tier: "platform" })
+
+/** The shape conversions a mapper may make on a value it received: a collection mapped item by item and a date written as text. They decide nothing and compute nothing. */
+const MAPPER_SHAPE_METHODS = new Set(["map", "toISOString"])
+
+/** The `JobClaims` port of `platform/jobs` - the fence a job step records itself through (`advance`, `runKey`): bookkeeping the fenced-job pattern requires, free beside the step's one delegating call. */
+const isClaimsReceiver = (context, node) => isOwnedType(context, node, { name: "JobClaims", capability: "jobs", tier: "platform" })
+
+/** The `Logger` port of `platform/logging` - the one call that is always free. */
+const isLoggerReceiver = isLoggerType
+
+/** The name of a thin file's law is `feature-thin` (R203). */
+export const featureThin = {
+    meta: {
+        type: "problem",
+        docs: { description: "A feature-tier file of a thin role maps its parameters and makes one delegating call into the modules: no branch, loop, `try`, `throw` or computation, and no call other than the one delegate, a modules function in mapping position, a `*.mapper.ts` function or the Logger." },
+        schema: [],
+        messages: {
+            branch: "{{what}} is a decision or a repetition in a thin file. A feature `<name>.{{role}}.ts` maps its parameters and makes one delegating call into the modules; a branch, a loop, a `try` or a `throw` is business logic that belongs in a service of the modules (where a unit spec covers it) - and orchestration (step order, compensation, claim, fencing, retry) belongs to the platform.",
+            compute: "{{what}} computes a value in a thin file. A feature `<name>.{{role}}.ts` maps its parameters and hands them over; an expression that computes is logic that belongs in the modules. Map the value there and read it back.",
+            call: "`{{what}}` is a call a thin file does not make. It calls exactly one injected member (a service, a bus `execute`, an event bus, a queue producer) or one function of the modules, and pure `*.mapper.ts` functions and the `Logger` port are free{{webhook}}; everything else - parsing, mapping by hand, a helper, a second dependency - is logic that belongs in the modules.",
+            many: "`{{name}}` makes a second delegating call here. A thin file makes exactly one; a second is orchestration - step order, compensation, claim, fencing, retry - and belongs to a capability of the platform or inside the service the file calls.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        const name = baseName(context.filename)
+        if (name.endsWith(".spec.ts") || name.endsWith(".d.ts")) return {}
+        const role = roleOf(name)
+        if (role === null || !(hfs.ruleParams.thinRoles ?? []).includes(role)) return {}
+        if (hfs.tierOf(context.filename) !== "feature") return {}
+        const sourceCode = context.sourceCode
+        const mapperFile = role === "mapper"
+
+        /** The injected member names of a class: constructor parameter properties and properties carrying an injector decorator. */
+        const memberNames = new Map()
+        const injectedNamesOf = (classNode) => {
+            if (memberNames.has(classNode)) return memberNames.get(classNode)
+            const names = new Set()
+            for (const { node } of injectedMembers(context, classNode)) {
+                if (node.type === "TSParameterProperty" && node.parameter.type === "Identifier") names.add(node.parameter.name)
+                else if (node.type === "PropertyDefinition") {
+                    const key = keyName(node.key)
+                    if (key !== null) names.add(key)
+                }
+            }
+            memberNames.set(classNode, names)
+            return names
+        }
+
+        /**
+         * The class `this` binds at a node's position: the nearest enclosing class, or null when a non-arrow
+         * function or an object-literal method rebinds `this` in between (a method's own `FunctionExpression`
+         * value is skipped - a method's `this` is the class).
+         */
+        const thisClassOf = (node) => {
+            for (let parent = node.parent; parent; parent = parent.parent) {
+                if (parent.type === "ClassDeclaration" || parent.type === "ClassExpression") return parent
+                if (parent.type === "FunctionDeclaration") return null
+                if (parent.type === "FunctionExpression" && parent.parent?.type !== "MethodDefinition") return null
+            }
+            return null
+        }
+
+        /** The member name of `this.<member>` the call's receiver names, when it is an injected member of the enclosing class. */
+        const injectedMemberOf = (object, call) => {
+            if (object.type !== "MemberExpression" || object.computed || object.object.type !== "ThisExpression" || object.property.type !== "Identifier") return null
+            const classNode = thisClassOf(call)
+            if (classNode === null) return null
+            const member = object.property.name
+            return injectedNamesOf(classNode).has(member) ? member : null
+        }
+
+        /** True for a call `f(...)` where `f` is imported from a `*.mapper.ts` (the pure mapping functions). */
+        const isMapperCall = (callee) => {
+            if (callee.type !== "Identifier") return false
+            const found = importOf(context, callee)
+            return found !== null && /(?:^|\/)[^/]+\.mapper(?:\.[cm]?[jt]s)?$/.test(found.source.replace(/\\/g, "/"))
+        }
+
+        /** True for a call `f(...)` where `f` is imported and its declaration lives outside the feature tier (a function of the modules). */
+        const isModulesCall = (callee) => {
+            if (callee.type !== "Identifier" || importOf(context, callee) === null) return false
+            const symbol = aliasTarget(context, callee)
+            return (symbol?.getDeclarations() ?? []).some((declaration) => hfs.tierOf(declaration.getSourceFile().fileName) !== "feature")
+        }
+
+        /** True when the call IS the statement it sits in: `f(...)`, `await f(...)`, `return (await) f(...)`, or the whole body of a concise arrow. */
+        const isStatementCall = (call) => {
+            let current = call
+            while (STATEMENT_WRAPPERS.has(current.parent?.type)) current = current.parent
+            const parent = current.parent
+            return parent?.type === "ExpressionStatement" || parent?.type === "ReturnStatement" || (parent?.type === "ArrowFunctionExpression" && parent.body === current)
+        }
+
+        /**
+         * What one call is to a thin file: `delegating` (the one call into the modules a file may make),
+         * `free` (a mapper, a logger method, a webhook `verify`, a job step's `JobClaims` fence call, a modules function in a mapping position)
+         * or `call` (a call a thin file does not make). A `mapper` file holds only mapper calls and `new`.
+         */
+        const classify = (call) => {
+            const callee = call.callee
+            if (callee.type === "Identifier" && isMapperCall(callee)) return "free"
+            const member = callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" ? callee : null
+            if (mapperFile && member !== null && MAPPER_SHAPE_METHODS.has(member.property.name) && injectedMemberOf(member.object, call) === null) return "free"
+            // a cli group command shows its help without a sub-command: the `help` of the command nest-commander gives it
+            if (role === "cli" && member !== null && member.property.name === "help" && member.object.type === "MemberExpression" && member.object.object.type === "ThisExpression" && member.object.property.type === "Identifier" && member.object.property.name === "command") return "free"
+            if (mapperFile) return "call"
+            if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && injectedMemberOf(callee.object, call) !== null) {
+                if (isLoggerReceiver(context, callee.object)) return "free"
+                if (role === "webhook" && callee.property.name === "verify" && isSignatureReceiver(context, callee.object)) return "free"
+                if (role === "step" && isClaimsReceiver(context, callee.object)) return "free"
+                return "delegating"
+            }
+            if (callee.type === "Identifier" && isModulesCall(callee)) return isStatementCall(call) ? "delegating" : "free"
+            return "call"
+        }
+
+        /** Every root function of the file (a method body, function or arrow not nested in another function and not inside a decorator subtree). */
+        const rootFunctionsOf = (program) => {
+            const roots = []
+            walk(program, (node) => {
+                if (!FUNCTION_NODES.has(node.type)) return
+                for (let parent = node.parent; parent; parent = parent.parent) {
+                    if (parent.type === "Decorator" || FUNCTION_NODES.has(parent.type)) return
+                }
+                if (node.type === "MethodDefinition" && node.kind === "constructor") return
+                roots.push(node)
+            })
+            return roots
+        }
+
+        /** The name a `many` message reports for a function root. */
+        const nameOf = (fn) => {
+            if (fn.type === "MethodDefinition") return keyName(fn.key) ?? "the method"
+            if (fn.type === "FunctionDeclaration" && fn.id?.type === "Identifier") return fn.id.name
+            const parent = fn.parent
+            if (parent?.type === "VariableDeclarator" && parent.id.type === "Identifier") return parent.id.name
+            if ((parent?.type === "PropertyDefinition" || parent?.type === "Property") && keyName(parent.key)) return keyName(parent.key)
+            return "the function"
+        }
+
+        const visitors = {}
+        for (const type of BRANCH_NODES) {
+            visitors[type] = (node) => context.report({ node, messageId: "branch", data: { what: type === "LogicalExpression" ? `a \`${node.operator}\`` : BRANCH_WHAT[type], role } })
+        }
+        for (const type of COMPUTE_NODES) {
+            visitors[type] = (node) => context.report({ node, messageId: "compute", data: { what: `an \`${node.operator}\``, role } })
+        }
+        visitors.TemplateLiteral = (node) => {
+            if (node.expressions.length > 0) context.report({ node, messageId: "compute", data: { what: "a template literal with an expression", role } })
+        }
+        visitors["Program:exit"] = (program) => {
+            for (const root of rootFunctionsOf(program)) {
+                const body = root.type === "MethodDefinition" ? root.value?.body : root.body
+                if (!body) continue
+                let delegating = 0
+                walk(body, (node) => {
+                    if (node.type !== "CallExpression") return
+                    const kind = classify(node)
+                    if (kind === "call") context.report({ node, messageId: "call", data: { what: sourceCode.getText(node.callee), webhook: role === "webhook" ? ", plus `verify` of the signature service" : "" } })
+                    else if (kind === "delegating") {
+                        delegating += 1
+                        if (delegating === 2) context.report({ node, messageId: "many", data: { name: nameOf(root) } })
+                    }
+                })
+            }
+        }
+        return visitors
+    },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+    "feature-thin": featureThin,
+}
+
+/** Every rule of this law at `error`. */
+export const recommended = {
+    "starci-be/feature-thin": "error",
+}

package/idempotency.mjs

@@ -24,7 +24,7 @@
  */
 import { hfsOf } from "./lib/hfs.mjs"
 import { walk } from "./lib/ast.mjs"
-import { baseName, isOwnedType } from "./lib/ports.mjs"
+import { baseName, isOwnedType, ownerNameOf } from "./lib/ports.mjs"
 import { typed } from "./lib/types.mjs"
 
 /** The `Inbox` port of `platform/inbox`. */
@@ -99,6 +99,8 @@ export const inboxDedupeRequired = {
         const filename = context.filename || context.getFilename()
         const slot = hfs.slotOf(filename)
         if (!baseName(filename).endsWith(".service.ts") || !slot || slot.startsWith("be.tests.")) return {}
+        // The event bus publishes events (their shape carries an `eventId`) and its runtime claims the inbox before a consumer runs: no delivery method here.
+        if (slot.startsWith("be.platform") && ownerNameOf(hfs, filename) === "event-bus") return {}
         return {
             MethodDefinition(node) {
                 if (node.kind !== "method" || node.static || node.key.type === "PrivateIdentifier" || !node.value.body) return

package/index.mjs

@@ -17,15 +17,21 @@
  * leave two names for one rule and no way to tell which a message came from.
  */
 import { buildBeConfig } from "./lib/config.mjs"
+import { pluginForEdition } from "./lib/edition.mjs"
+import { recommended as ambientIdRecommended, rules as ambientIdRules } from "./ambient-id.mjs"
 import { recommended as asyncDisciplineRecommended, rules as asyncDisciplineRules } from "./async-discipline.mjs"
 import { recommended as authorizationRecommended, rules as authorizationRules } from "./authorization.mjs"
 import { recommended as buildersRecommended, rules as buildersRules } from "./builders.mjs"
 import { recommended as commentsRecommended, rules as commentsRules } from "./comments.mjs"
 import { recommended as configOwnerRecommended, rules as configOwnerRules } from "./config-owner.mjs"
 import { recommended as connectionsRecommended, rules as connectionsRules } from "./connections.mjs"
+import { recommended as cookiesRecommended, rules as cookiesRules } from "./cookies.mjs"
 import { recommended as cqrsRecommended, rules as cqrsRules } from "./cqrs.mjs"
 import { recommended as dataAccessRecommended, rules as dataAccessRules } from "./data-access.mjs"
 import { recommended as defaultDenyRecommended, rules as defaultDenyRules } from "./default-deny.mjs"
+import { recommended as eventBusRecommended, rules as eventBusRules } from "./event-bus.mjs"
+import { recommended as jobsRecommended, rules as jobsRules } from "./jobs.mjs"
+import { recommended as projectionsRecommended, rules as projectionsRules } from "./projections.mjs"
 import { recommended as e2eFlowRecommended, rules as e2eFlowRules } from "./e2e-flow.mjs"
 import { recommended as errorHandlingRecommended, rules as errorHandlingRules } from "./error-handling.mjs"
 import { recommended as idempotencyRecommended, rules as idempotencyRules } from "./idempotency.mjs"
@@ -41,7 +47,9 @@ import { recommended as operationsRecommended, rules as operationsRules } from "
 import { recommended as querySafetyRecommended, rules as querySafetyRules } from "./query-safety.mjs"
 import { recommended as resilienceRecommended, rules as resilienceRules } from "./resilience.mjs"
 import { recommended as schemaAuthorityRecommended, rules as schemaAuthorityRules } from "./schema-authority.mjs"
+import { recommended as cliRecommended, rules as cliRules } from "./cli.mjs"
 import { recommended as serviceDepsRecommended, rules as serviceDepsRules } from "./service-deps.mjs"
+import { recommended as serviceIsolationRecommended, rules as serviceIsolationRules } from "./service-isolation.mjs"
 import { recommended as sizeBudgetRecommended, rules as sizeBudgetRules } from "./size-budget.mjs"
 import { recommended as specNoSkipRecommended, rules as specNoSkipRules } from "./spec-no-skip.mjs"
 import { recommended as specQualityRecommended, rules as specQualityRules } from "./spec-quality.mjs"
@@ -53,20 +61,29 @@ import { recommended as transportRecommended, rules as transportRules } from "./
 import { recommended as typeSafetyRecommended, rules as typeSafetyRules } from "./type-safety.mjs"
 import { recommended as unitSpecRecommended, rules as unitSpecRules } from "./unit-spec.mjs"
 import { recommended as userCopyRecommended, rules as userCopyRules } from "./user-copy.mjs"
+import { recommended as webhooksRecommended, rules as webhooksRules } from "./webhooks.mjs"
+import { recommended as realtimeRecommended, rules as realtimeRules } from "./realtime.mjs"
+import { recommended as featureThinRecommended, rules as featureThinRules } from "./feature-thin.mjs"
 import { recommended as projectGraphRecommended, rules as projectGraphRules } from "./project-graph.mjs"
 
 /** Each law's contribution, kept separate so a duplicate name is detectable rather than silent. */
 const CONTRIBUTIONS = [
     { law: "project-graph", rules: projectGraphRules, recommended: projectGraphRecommended },
+    { law: "ambient-id", rules: ambientIdRules, recommended: ambientIdRecommended },
     { law: "async-discipline", rules: asyncDisciplineRules, recommended: asyncDisciplineRecommended },
     { law: "authorization", rules: authorizationRules, recommended: authorizationRecommended },
     { law: "builders", rules: buildersRules, recommended: buildersRecommended },
+    { law: "cli", rules: cliRules, recommended: cliRecommended },
     { law: "comments", rules: commentsRules, recommended: commentsRecommended },
     { law: "config-owner", rules: configOwnerRules, recommended: configOwnerRecommended },
     { law: "connections", rules: connectionsRules, recommended: connectionsRecommended },
+    { law: "cookies", rules: cookiesRules, recommended: cookiesRecommended },
     { law: "cqrs", rules: cqrsRules, recommended: cqrsRecommended },
     { law: "data-access", rules: dataAccessRules, recommended: dataAccessRecommended },
     { law: "default-deny", rules: defaultDenyRules, recommended: defaultDenyRecommended },
+    { law: "event-bus", rules: eventBusRules, recommended: eventBusRecommended },
+    { law: "jobs", rules: jobsRules, recommended: jobsRecommended },
+    { law: "projections", rules: projectionsRules, recommended: projectionsRecommended },
     { law: "e2e-flow", rules: e2eFlowRules, recommended: e2eFlowRecommended },
     { law: "error-handling", rules: errorHandlingRules, recommended: errorHandlingRecommended },
     { law: "idempotency", rules: idempotencyRules, recommended: idempotencyRecommended },
@@ -83,6 +100,7 @@ const CONTRIBUTIONS = [
     { law: "resilience", rules: resilienceRules, recommended: resilienceRecommended },
     { law: "schema-authority", rules: schemaAuthorityRules, recommended: schemaAuthorityRecommended },
     { law: "service-deps", rules: serviceDepsRules, recommended: serviceDepsRecommended },
+    { law: "service-isolation", rules: serviceIsolationRules, recommended: serviceIsolationRecommended },
     { law: "size-budget", rules: sizeBudgetRules, recommended: sizeBudgetRecommended },
     { law: "spec-no-skip", rules: specNoSkipRules, recommended: specNoSkipRecommended },
     { law: "spec-quality", rules: specQualityRules, recommended: specQualityRecommended },
@@ -94,6 +112,9 @@ const CONTRIBUTIONS = [
     { law: "type-safety", rules: typeSafetyRules, recommended: typeSafetyRecommended },
     { law: "unit-spec", rules: unitSpecRules, recommended: unitSpecRecommended },
     { law: "user-copy", rules: userCopyRules, recommended: userCopyRecommended },
+    { law: "webhooks", rules: webhooksRules, recommended: webhooksRecommended },
+    { law: "realtime", rules: realtimeRules, recommended: realtimeRecommended },
+    { law: "feature-thin", rules: featureThinRules, recommended: featureThinRecommended },
 ]
 
 /** Every gathered law. */
@@ -154,7 +175,7 @@ export default plugin
  * @param {{ hfs: object }} input - The HFS view of the repository.
  * @returns {Promise<Array<object>>} The flat config.
  */
-export const starciBeConfig = ({ hfs }) => buildBeConfig({ hfs, plugin, recommended })
+export const starciBeConfig = ({ hfs }) => buildBeConfig({ hfs, plugin: pluginForEdition({ plugin, hfs }), recommended })
 
 export { linterOptions } from "./lib/config.mjs"
 export { loadHfs } from "./lib/hfs.mjs"

package/infra-owner.mjs

@@ -53,7 +53,7 @@ export const infraImportOwner = {
         schema: [],
         messages: {
             foreign: "`{{name}}` is owned by {{owners}}. Use that capability's port (injected with its `Inject*()` decorator) instead of the raw library, or move this code into the owner.",
-            nowhere: "`{{name}}` is not used in a back end: its job belongs to a platform port (config through the typed `<c>.config.ts`, events through the outbox, schedules through `platform/scheduling`). Remove it.",
+            nowhere: "`{{name}}` is not used in a back end: its job belongs to a platform port (config through the typed `<c>.config.ts`, events through `eventBus.publish(event, tx)` of `platform/event-bus`, schedules and background jobs through a queue's BullMQ job scheduler of `platform/queue`). Remove it.",
         },
     },
     create(context) {

package/injection.mjs

@@ -25,7 +25,7 @@
  */
 import { posix } from "node:path"
 import ts from "typescript"
-import { staticText } from "./lib/ast.mjs"
+import { paramParts, staticText } from "./lib/ast.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
 import { isImportedFrom } from "./lib/import-source.mjs"
 import { normalizePath } from "./lib/path.mjs"
@@ -133,13 +133,6 @@ const inComposition = (hfs, file) => {
     return owner !== null && posix.basename(owner) === "composition"
 }
 
-/** The decorators of a constructor parameter: on the parameter, its wrapper (`private readonly x`) or its inner identifier. */
-const decoratorsOfParam = (param) => {
-    const inner = param.type === "TSParameterProperty" ? param.parameter : param
-    const target = inner.type === "AssignmentPattern" ? inner.left : inner
-    return { target, decorators: [...new Set([...(param.decorators ?? []), ...(inner.decorators ?? []), ...(target.decorators ?? [])])] }
-}
-
 /** The injected type `T` of a call typed `TypedParameterDecorator<T>`, else null. */
 const injectedTypeOf = (context, call) => {
     const { checker, toTs } = typed(context)
@@ -373,7 +366,7 @@ export const injectorTypeMatch = {
         return {
             MethodDefinition(node) {
                 for (const param of constructorParams(node)) {
-                    const { target, decorators } = decoratorsOfParam(param)
+                    const { target, decorators } = paramParts(param)
                     for (const decorator of decorators) {
                         if (decorator.expression.type !== "CallExpression") continue
                         const injected = injectedTypeOf(context, decorator.expression)
@@ -417,7 +410,25 @@ const isContainerBuilt = (context, constructor) => {
     const declaration = constructor.parent?.parent
     if (declaration?.type !== "ClassDeclaration" && declaration?.type !== "ClassExpression") return false
     if ((declaration.decorators ?? []).some((decorator) => packageOfExport(context, decorator.expression)?.startsWith("@nestjs/"))) return true
-    return constructorParams(constructor).some((param) => decoratorsOfParam(param).decorators.length > 0)
+    return constructorParams(constructor).some((param) => paramParts(param).decorators.length > 0)
+}
+
+/**
+ * The origin that makes an annotated type infrastructure: declared by a package, or by a `platform/*` or `integrations/*` owner other
+ * than `own`; null for a domain type, a type of the same owner or a language global.
+ */
+const infraOriginOf = (context, hfs, own, annotation) => {
+    const origins = typeOrigins(context, annotation)
+    // A language global (`ReadonlyArray`, `Array`) is declared in the TypeScript lib and may be augmented by a package
+    // (`@types/node`): the augmentation does not make it infrastructure.
+    const isLanguageGlobal = (origin) => origins.some((other) => other.name === origin.name && /\/node_modules\/typescript\/lib\//.test(other.file))
+    return origins.find((origin) => {
+        if (isLanguageGlobal(origin)) return false
+        if (origin.module !== null) return true
+        if (own !== null && hfs.ownerOf(origin.file) === own) return false
+        const tier = hfs.tierOf(origin.file)
+        return tier === "platform" || tier === "integrations"
+    }) ?? null
 }
 
 /** A constructor parameter of an infrastructure type carries an injector. */
@@ -441,20 +452,10 @@ export const infraNeedsInjector = {
                 // metadata. A plain class (a CQRS message, a factory-built adapter, a test fake) is never DI-constructed.
                 if (!isContainerBuilt(context, node)) return
                 for (const param of constructorParams(node)) {
-                    const { target, decorators } = decoratorsOfParam(param)
+                    const { target, decorators } = paramParts(param)
                     const annotation = target.typeAnnotation?.typeAnnotation
                     if (!annotation) continue
-                    const origins = typeOrigins(context, annotation)
-                    // A language global (`ReadonlyArray`, `Array`) is declared in the TypeScript lib and may be augmented by a package
-                    // (`@types/node`): the augmentation does not make it infrastructure.
-                    const isLanguageGlobal = (origin) => origins.some((other) => other.name === origin.name && /\/node_modules\/typescript\/lib\//.test(other.file))
-                    const infra = origins.find((origin) => {
-                        if (isLanguageGlobal(origin)) return false
-                        if (origin.module !== null) return true
-                        if (own !== null && hfs.ownerOf(origin.file) === own) return false
-                        const tier = hfs.tierOf(origin.file)
-                        return tier === "platform" || tier === "integrations"
-                    })
+                    const infra = infraOriginOf(context, hfs, own, annotation)
                     if (!infra) continue
                     const carries = decorators.some((decorator) => {
                         const expression = decorator.expression
@@ -470,6 +471,48 @@ export const infraNeedsInjector = {
     },
 }
 
+// -- injected-param-name --------------------------------------------------------------------------
+
+/** The `ruleParams.be.paramNames` entry for an origin's declared name, or null. */
+const paramEntryOf = (entries, name) => entries.find((entry) => (entry.type !== undefined ? entry.type === name : name.length > entry.typeSuffix.length && name.endsWith(entry.typeSuffix))) ?? null
+
+/** An injected port of the table of `paramNames` is named the way every class names it. */
+export const injectedParamName = {
+    meta: {
+        type: "problem",
+        docs: { description: "A constructor parameter that injects a port named in `ruleParams.be.paramNames` (`Clock`, `Logger`, `Cache`, `CommandBus`, `QueryBus`, `EntityManager`, `<Owner>Options`) carries the name that table gives it." },
+        schema: [],
+        messages: {
+            name: "`{{param}}` injects `{{type}}`, and every class names that port {{expected}}. Rename the parameter so a reader finds the same dependency under the same name in every class.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        const entries = hfs.ruleParams.paramNames
+        const own = hfs.ownerOf(context.filename || context.getFilename())
+        return {
+            MethodDefinition(node) {
+                if (!isContainerBuilt(context, node)) return
+                for (const param of constructorParams(node)) {
+                    const { target, decorators } = paramParts(param)
+                    if (target.type !== "Identifier") continue
+                    const annotation = target.typeAnnotation?.typeAnnotation
+                    if (!annotation) continue
+                    const injected = decorators.some((decorator) => decorator.expression.type === "CallExpression" && (INJECT_NAME.test(calleeOf(context, decorator.expression).name ?? "") || injectedTypeOf(context, decorator.expression) !== null))
+                    if (!injected) continue
+                    const infra = infraOriginOf(context, hfs, own, annotation)
+                    if (!infra) continue
+                    const entry = paramEntryOf(entries, infra.name)
+                    if (!entry || entry.names.includes(target.name)) continue
+                    if (entry.nameSuffix !== undefined && target.name.length > entry.nameSuffix.length && target.name.endsWith(entry.nameSuffix)) continue
+                    const expected = [...entry.names.map((name) => `\`${name}\``), ...(entry.nameSuffix !== undefined ? [`\`<name>${entry.nameSuffix}\``] : [])].join(" or ")
+                    context.report({ node: target, messageId: "name", data: { param: target.name, type: infra.name, expected } })
+                }
+            },
+        }
+    },
+}
+
 // -- no-module-ref ---------------------------------------------------------------------------------
 
 const MODULE_REF_CALLS = new Set(["get", "resolve", "create"])
@@ -585,6 +628,7 @@ export const rules = {
     "injector-shape": injectorShape,
     "injector-type-match": injectorTypeMatch,
     "infra-needs-injector": infraNeedsInjector,
+    "injected-param-name": injectedParamName,
     "no-module-ref": noModuleRef,
     "no-forward-ref": noForwardRef,
     "no-string-token": noStringToken,
@@ -596,6 +640,7 @@ export const recommended = {
     "starci-be/injector-shape": "error",
     "starci-be/injector-type-match": "error",
     "starci-be/infra-needs-injector": "error",
+    "starci-be/injected-param-name": "error",
     "starci-be/no-module-ref": "error",
     "starci-be/no-forward-ref": "error",
     "starci-be/no-string-token": "error",

package/input-bounds.mjs

@@ -16,6 +16,7 @@
  *     argument is `RateTier.Strict` of `platform/http-security`, on the method or on its class. A sign-in, sign-up,
  *     password-reset or callback door on the default tier is the brute-force path the strict tier exists for.
  */
+import { isTransportSlot } from "./lib/transport-slots.mjs"
 import ts from "typescript"
 import { decoratorName, keyName, staticText } from "./lib/ast.mjs"
 import { importsFrom, isOwnedEnumMember, partsOf, presentParts, typeOf } from "./lib/declared.mjs"
@@ -26,7 +27,7 @@ import { isPackageType, typed } from "./lib/types.mjs"
 /** True when the file sits in a transport slot inside a `dto/` folder, judged by the slot and the owner-relative path. */
 const isTransportDto = (hfs, filename) => {
     const slot = hfs.slotOf(filename) ?? ""
-    if (!slot.startsWith("be.transport.") && !slot.startsWith("be.feature.transport.")) return false
+    if (!isTransportSlot(slot) && !slot.startsWith("be.feature.transport.")) return false
     return hfs.relative(filename).split("/").slice(0, -1).includes("dto")
 }