@starci/eslint-canon-be 3.0.8 → 3.0.10

package/index.mjs

@@ -17,15 +17,21 @@
  * leave two names for one rule and no way to tell which a message came from.
  */
 import { buildBeConfig } from "./lib/config.mjs"
+import { pluginForEdition } from "./lib/edition.mjs"
+import { recommended as ambientIdRecommended, rules as ambientIdRules } from "./ambient-id.mjs"
 import { recommended as asyncDisciplineRecommended, rules as asyncDisciplineRules } from "./async-discipline.mjs"
 import { recommended as authorizationRecommended, rules as authorizationRules } from "./authorization.mjs"
 import { recommended as buildersRecommended, rules as buildersRules } from "./builders.mjs"
 import { recommended as commentsRecommended, rules as commentsRules } from "./comments.mjs"
 import { recommended as configOwnerRecommended, rules as configOwnerRules } from "./config-owner.mjs"
 import { recommended as connectionsRecommended, rules as connectionsRules } from "./connections.mjs"
+import { recommended as cookiesRecommended, rules as cookiesRules } from "./cookies.mjs"
 import { recommended as cqrsRecommended, rules as cqrsRules } from "./cqrs.mjs"
 import { recommended as dataAccessRecommended, rules as dataAccessRules } from "./data-access.mjs"
 import { recommended as defaultDenyRecommended, rules as defaultDenyRules } from "./default-deny.mjs"
+import { recommended as eventBusRecommended, rules as eventBusRules } from "./event-bus.mjs"
+import { recommended as jobsRecommended, rules as jobsRules } from "./jobs.mjs"
+import { recommended as projectionsRecommended, rules as projectionsRules } from "./projections.mjs"
 import { recommended as e2eFlowRecommended, rules as e2eFlowRules } from "./e2e-flow.mjs"
 import { recommended as errorHandlingRecommended, rules as errorHandlingRules } from "./error-handling.mjs"
 import { recommended as idempotencyRecommended, rules as idempotencyRules } from "./idempotency.mjs"
@@ -41,7 +47,9 @@ import { recommended as operationsRecommended, rules as operationsRules } from "
 import { recommended as querySafetyRecommended, rules as querySafetyRules } from "./query-safety.mjs"
 import { recommended as resilienceRecommended, rules as resilienceRules } from "./resilience.mjs"
 import { recommended as schemaAuthorityRecommended, rules as schemaAuthorityRules } from "./schema-authority.mjs"
+import { recommended as cliRecommended, rules as cliRules } from "./cli.mjs"
 import { recommended as serviceDepsRecommended, rules as serviceDepsRules } from "./service-deps.mjs"
+import { recommended as serviceIsolationRecommended, rules as serviceIsolationRules } from "./service-isolation.mjs"
 import { recommended as sizeBudgetRecommended, rules as sizeBudgetRules } from "./size-budget.mjs"
 import { recommended as specNoSkipRecommended, rules as specNoSkipRules } from "./spec-no-skip.mjs"
 import { recommended as specQualityRecommended, rules as specQualityRules } from "./spec-quality.mjs"
@@ -53,20 +61,29 @@ import { recommended as transportRecommended, rules as transportRules } from "./
 import { recommended as typeSafetyRecommended, rules as typeSafetyRules } from "./type-safety.mjs"
 import { recommended as unitSpecRecommended, rules as unitSpecRules } from "./unit-spec.mjs"
 import { recommended as userCopyRecommended, rules as userCopyRules } from "./user-copy.mjs"
+import { recommended as webhooksRecommended, rules as webhooksRules } from "./webhooks.mjs"
+import { recommended as realtimeRecommended, rules as realtimeRules } from "./realtime.mjs"
+import { recommended as featureThinRecommended, rules as featureThinRules } from "./feature-thin.mjs"
 import { recommended as projectGraphRecommended, rules as projectGraphRules } from "./project-graph.mjs"
 
 /** Each law's contribution, kept separate so a duplicate name is detectable rather than silent. */
 const CONTRIBUTIONS = [
     { law: "project-graph", rules: projectGraphRules, recommended: projectGraphRecommended },
+    { law: "ambient-id", rules: ambientIdRules, recommended: ambientIdRecommended },
     { law: "async-discipline", rules: asyncDisciplineRules, recommended: asyncDisciplineRecommended },
     { law: "authorization", rules: authorizationRules, recommended: authorizationRecommended },
     { law: "builders", rules: buildersRules, recommended: buildersRecommended },
+    { law: "cli", rules: cliRules, recommended: cliRecommended },
     { law: "comments", rules: commentsRules, recommended: commentsRecommended },
     { law: "config-owner", rules: configOwnerRules, recommended: configOwnerRecommended },
     { law: "connections", rules: connectionsRules, recommended: connectionsRecommended },
+    { law: "cookies", rules: cookiesRules, recommended: cookiesRecommended },
     { law: "cqrs", rules: cqrsRules, recommended: cqrsRecommended },
     { law: "data-access", rules: dataAccessRules, recommended: dataAccessRecommended },
     { law: "default-deny", rules: defaultDenyRules, recommended: defaultDenyRecommended },
+    { law: "event-bus", rules: eventBusRules, recommended: eventBusRecommended },
+    { law: "jobs", rules: jobsRules, recommended: jobsRecommended },
+    { law: "projections", rules: projectionsRules, recommended: projectionsRecommended },
     { law: "e2e-flow", rules: e2eFlowRules, recommended: e2eFlowRecommended },
     { law: "error-handling", rules: errorHandlingRules, recommended: errorHandlingRecommended },
     { law: "idempotency", rules: idempotencyRules, recommended: idempotencyRecommended },
@@ -83,6 +100,7 @@ const CONTRIBUTIONS = [
     { law: "resilience", rules: resilienceRules, recommended: resilienceRecommended },
     { law: "schema-authority", rules: schemaAuthorityRules, recommended: schemaAuthorityRecommended },
     { law: "service-deps", rules: serviceDepsRules, recommended: serviceDepsRecommended },
+    { law: "service-isolation", rules: serviceIsolationRules, recommended: serviceIsolationRecommended },
     { law: "size-budget", rules: sizeBudgetRules, recommended: sizeBudgetRecommended },
     { law: "spec-no-skip", rules: specNoSkipRules, recommended: specNoSkipRecommended },
     { law: "spec-quality", rules: specQualityRules, recommended: specQualityRecommended },
@@ -94,6 +112,9 @@ const CONTRIBUTIONS = [
     { law: "type-safety", rules: typeSafetyRules, recommended: typeSafetyRecommended },
     { law: "unit-spec", rules: unitSpecRules, recommended: unitSpecRecommended },
     { law: "user-copy", rules: userCopyRules, recommended: userCopyRecommended },
+    { law: "webhooks", rules: webhooksRules, recommended: webhooksRecommended },
+    { law: "realtime", rules: realtimeRules, recommended: realtimeRecommended },
+    { law: "feature-thin", rules: featureThinRules, recommended: featureThinRecommended },
 ]
 
 /** Every gathered law. */
@@ -154,7 +175,7 @@ export default plugin
  * @param {{ hfs: object }} input - The HFS view of the repository.
  * @returns {Promise<Array<object>>} The flat config.
  */
-export const starciBeConfig = ({ hfs }) => buildBeConfig({ hfs, plugin, recommended })
+export const starciBeConfig = ({ hfs }) => buildBeConfig({ hfs, plugin: pluginForEdition({ plugin, hfs }), recommended })
 
 export { linterOptions } from "./lib/config.mjs"
 export { loadHfs } from "./lib/hfs.mjs"

package/infra-owner.mjs

@@ -53,7 +53,7 @@ export const infraImportOwner = {
         schema: [],
         messages: {
             foreign: "`{{name}}` is owned by {{owners}}. Use that capability's port (injected with its `Inject*()` decorator) instead of the raw library, or move this code into the owner.",
-            nowhere: "`{{name}}` is not used in a back end: its job belongs to a platform port (config through the typed `<c>.config.ts`, events through the outbox, schedules through `platform/scheduling`). Remove it.",
+            nowhere: "`{{name}}` is not used in a back end: its job belongs to a platform port (config through the typed `<c>.config.ts`, events through `eventBus.publish(event, tx)` of `platform/event-bus`, schedules and background jobs through a queue's BullMQ job scheduler of `platform/queue`). Remove it.",
         },
     },
     create(context) {

package/injection.mjs

@@ -25,7 +25,7 @@
  */
 import { posix } from "node:path"
 import ts from "typescript"
-import { staticText } from "./lib/ast.mjs"
+import { paramParts, staticText } from "./lib/ast.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
 import { isImportedFrom } from "./lib/import-source.mjs"
 import { normalizePath } from "./lib/path.mjs"
@@ -133,13 +133,6 @@ const inComposition = (hfs, file) => {
     return owner !== null && posix.basename(owner) === "composition"
 }
 
-/** The decorators of a constructor parameter: on the parameter, its wrapper (`private readonly x`) or its inner identifier. */
-const decoratorsOfParam = (param) => {
-    const inner = param.type === "TSParameterProperty" ? param.parameter : param
-    const target = inner.type === "AssignmentPattern" ? inner.left : inner
-    return { target, decorators: [...new Set([...(param.decorators ?? []), ...(inner.decorators ?? []), ...(target.decorators ?? [])])] }
-}
-
 /** The injected type `T` of a call typed `TypedParameterDecorator<T>`, else null. */
 const injectedTypeOf = (context, call) => {
     const { checker, toTs } = typed(context)
@@ -373,7 +366,7 @@ export const injectorTypeMatch = {
         return {
             MethodDefinition(node) {
                 for (const param of constructorParams(node)) {
-                    const { target, decorators } = decoratorsOfParam(param)
+                    const { target, decorators } = paramParts(param)
                     for (const decorator of decorators) {
                         if (decorator.expression.type !== "CallExpression") continue
                         const injected = injectedTypeOf(context, decorator.expression)
@@ -417,7 +410,25 @@ const isContainerBuilt = (context, constructor) => {
     const declaration = constructor.parent?.parent
     if (declaration?.type !== "ClassDeclaration" && declaration?.type !== "ClassExpression") return false
     if ((declaration.decorators ?? []).some((decorator) => packageOfExport(context, decorator.expression)?.startsWith("@nestjs/"))) return true
-    return constructorParams(constructor).some((param) => decoratorsOfParam(param).decorators.length > 0)
+    return constructorParams(constructor).some((param) => paramParts(param).decorators.length > 0)
+}
+
+/**
+ * The origin that makes an annotated type infrastructure: declared by a package, or by a `platform/*` or `integrations/*` owner other
+ * than `own`; null for a domain type, a type of the same owner or a language global.
+ */
+const infraOriginOf = (context, hfs, own, annotation) => {
+    const origins = typeOrigins(context, annotation)
+    // A language global (`ReadonlyArray`, `Array`) is declared in the TypeScript lib and may be augmented by a package
+    // (`@types/node`): the augmentation does not make it infrastructure.
+    const isLanguageGlobal = (origin) => origins.some((other) => other.name === origin.name && /\/node_modules\/typescript\/lib\//.test(other.file))
+    return origins.find((origin) => {
+        if (isLanguageGlobal(origin)) return false
+        if (origin.module !== null) return true
+        if (own !== null && hfs.ownerOf(origin.file) === own) return false
+        const tier = hfs.tierOf(origin.file)
+        return tier === "platform" || tier === "integrations"
+    }) ?? null
 }
 
 /** A constructor parameter of an infrastructure type carries an injector. */
@@ -441,20 +452,10 @@ export const infraNeedsInjector = {
                 // metadata. A plain class (a CQRS message, a factory-built adapter, a test fake) is never DI-constructed.
                 if (!isContainerBuilt(context, node)) return
                 for (const param of constructorParams(node)) {
-                    const { target, decorators } = decoratorsOfParam(param)
+                    const { target, decorators } = paramParts(param)
                     const annotation = target.typeAnnotation?.typeAnnotation
                     if (!annotation) continue
-                    const origins = typeOrigins(context, annotation)
-                    // A language global (`ReadonlyArray`, `Array`) is declared in the TypeScript lib and may be augmented by a package
-                    // (`@types/node`): the augmentation does not make it infrastructure.
-                    const isLanguageGlobal = (origin) => origins.some((other) => other.name === origin.name && /\/node_modules\/typescript\/lib\//.test(other.file))
-                    const infra = origins.find((origin) => {
-                        if (isLanguageGlobal(origin)) return false
-                        if (origin.module !== null) return true
-                        if (own !== null && hfs.ownerOf(origin.file) === own) return false
-                        const tier = hfs.tierOf(origin.file)
-                        return tier === "platform" || tier === "integrations"
-                    })
+                    const infra = infraOriginOf(context, hfs, own, annotation)
                     if (!infra) continue
                     const carries = decorators.some((decorator) => {
                         const expression = decorator.expression
@@ -470,6 +471,48 @@ export const infraNeedsInjector = {
     },
 }
 
+// -- injected-param-name --------------------------------------------------------------------------
+
+/** The `ruleParams.be.paramNames` entry for an origin's declared name, or null. */
+const paramEntryOf = (entries, name) => entries.find((entry) => (entry.type !== undefined ? entry.type === name : name.length > entry.typeSuffix.length && name.endsWith(entry.typeSuffix))) ?? null
+
+/** An injected port of the table of `paramNames` is named the way every class names it. */
+export const injectedParamName = {
+    meta: {
+        type: "problem",
+        docs: { description: "A constructor parameter that injects a port named in `ruleParams.be.paramNames` (`Clock`, `Logger`, `Cache`, `CommandBus`, `QueryBus`, `EntityManager`, `<Owner>Options`) carries the name that table gives it." },
+        schema: [],
+        messages: {
+            name: "`{{param}}` injects `{{type}}`, and every class names that port {{expected}}. Rename the parameter so a reader finds the same dependency under the same name in every class.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        const entries = hfs.ruleParams.paramNames
+        const own = hfs.ownerOf(context.filename || context.getFilename())
+        return {
+            MethodDefinition(node) {
+                if (!isContainerBuilt(context, node)) return
+                for (const param of constructorParams(node)) {
+                    const { target, decorators } = paramParts(param)
+                    if (target.type !== "Identifier") continue
+                    const annotation = target.typeAnnotation?.typeAnnotation
+                    if (!annotation) continue
+                    const injected = decorators.some((decorator) => decorator.expression.type === "CallExpression" && (INJECT_NAME.test(calleeOf(context, decorator.expression).name ?? "") || injectedTypeOf(context, decorator.expression) !== null))
+                    if (!injected) continue
+                    const infra = infraOriginOf(context, hfs, own, annotation)
+                    if (!infra) continue
+                    const entry = paramEntryOf(entries, infra.name)
+                    if (!entry || entry.names.includes(target.name)) continue
+                    if (entry.nameSuffix !== undefined && target.name.length > entry.nameSuffix.length && target.name.endsWith(entry.nameSuffix)) continue
+                    const expected = [...entry.names.map((name) => `\`${name}\``), ...(entry.nameSuffix !== undefined ? [`\`<name>${entry.nameSuffix}\``] : [])].join(" or ")
+                    context.report({ node: target, messageId: "name", data: { param: target.name, type: infra.name, expected } })
+                }
+            },
+        }
+    },
+}
+
 // -- no-module-ref ---------------------------------------------------------------------------------
 
 const MODULE_REF_CALLS = new Set(["get", "resolve", "create"])
@@ -585,6 +628,7 @@ export const rules = {
     "injector-shape": injectorShape,
     "injector-type-match": injectorTypeMatch,
     "infra-needs-injector": infraNeedsInjector,
+    "injected-param-name": injectedParamName,
     "no-module-ref": noModuleRef,
     "no-forward-ref": noForwardRef,
     "no-string-token": noStringToken,
@@ -596,6 +640,7 @@ export const recommended = {
     "starci-be/injector-shape": "error",
     "starci-be/injector-type-match": "error",
     "starci-be/infra-needs-injector": "error",
+    "starci-be/injected-param-name": "error",
     "starci-be/no-module-ref": "error",
     "starci-be/no-forward-ref": "error",
     "starci-be/no-string-token": "error",

package/input-bounds.mjs

@@ -16,6 +16,7 @@
  *     argument is `RateTier.Strict` of `platform/http-security`, on the method or on its class. A sign-in, sign-up,
  *     password-reset or callback door on the default tier is the brute-force path the strict tier exists for.
  */
+import { isTransportSlot } from "./lib/transport-slots.mjs"
 import ts from "typescript"
 import { decoratorName, keyName, staticText } from "./lib/ast.mjs"
 import { importsFrom, isOwnedEnumMember, partsOf, presentParts, typeOf } from "./lib/declared.mjs"
@@ -26,7 +27,7 @@ import { isPackageType, typed } from "./lib/types.mjs"
 /** True when the file sits in a transport slot inside a `dto/` folder, judged by the slot and the owner-relative path. */
 const isTransportDto = (hfs, filename) => {
     const slot = hfs.slotOf(filename) ?? ""
-    if (!slot.startsWith("be.transport.") && !slot.startsWith("be.feature.transport.")) return false
+    if (!isTransportSlot(slot) && !slot.startsWith("be.feature.transport.")) return false
     return hfs.relative(filename).split("/").slice(0, -1).includes("dto")
 }
 

package/jobs.mjs

@@ -0,0 +1,214 @@
+/**
+ * The rules that hold the fenced-job pattern (catalog R157 `BE_JOB_WRITE_OUTSIDE_OWNER`, R158 `BE_JOB_FENCE_REQUIRED`,
+ * R159 `BE_JOB_RUN_KEY`, R160 `BE_JOB_SHAPE`).
+ *
+ * A background job is a row whose `fencingToken` the claim bumps. A worker that lost its claim (a zombie) holds a stale token, so every
+ * write to the row is guarded by `expectedFencingToken` and an external effect carries an idempotency key that includes the token.
+ * `platform/jobs` is the ONE owner of the row: it declares the entity, the claim and the guarded writes, and nothing else writes it.
+ *
+ * Everything is found by TYPE ORIGIN (the `JobClaims`, `JobStep`, `RunKey` and `FencedProcessor` declared by `platform/jobs`, the entity
+ * class declared by that owner, typeorm receivers and query builders) and by the slot view (`be.feature.jobs.steps`, `be.feature.jobs`); the
+ * only names read are the contract's own members `runKey`, `jobId` and `expectedFencingToken`.
+ */
+import ts from "typescript"
+import { walk } from "./lib/ast.mjs"
+import { writtenEntityOrigins } from "./lib/entity-writes.mjs"
+import { hfsOf, inTestWorld } from "./lib/hfs.mjs"
+import { baseName, isOwnedType, ownerNameOf } from "./lib/ports.mjs"
+import { typeOrigins, typed } from "./lib/types.mjs"
+
+const isJobClaimsType = (context, node) => isOwnedType(context, node, { name: "JobClaims", capability: "jobs", tier: "platform" })
+const isJobStepType = (context, node) => isOwnedType(context, node, { name: "JobStep", capability: "jobs", tier: "platform" })
+const isFencedProcessorType = (context, node) => isOwnedType(context, node, { name: "FencedProcessor", capability: "jobs", tier: "platform" })
+const isRunKeyType = (context, node) => isOwnedType(context, node, { name: "RunKey", capability: "jobs", tier: "platform" })
+
+/** True for a file of the owner itself, and for the test composition. */
+const isOwnerOrTest = (hfs, file) => {
+    const tier = hfs.tierOf(file)
+    if (tier === "e2e" || tier === "fixtures" || inTestWorld(hfs, file)) return true
+    return tier === "platform" && ownerNameOf(hfs, file) === "jobs"
+}
+
+/** A write to an entity that `platform/jobs` declares (the job row) is made only by `platform/jobs`. */
+export const jobWriteOwner = {
+    meta: {
+        type: "problem",
+        docs: { description: "The job entity is written only by `platform/jobs`: no `update`, `increment`, `save`, `insert`, `delete` or query-builder write on it elsewhere." },
+        schema: [],
+        messages: {
+            foreign: "`{{call}}` writes the job row outside `platform/jobs`. The fencing token and the status of a job change only through `JobClaims` (`claim`, `advance`, `complete`, `fail`), each of which requires `expectedFencingToken`; a direct write lets a zombie worker overwrite the job a newer worker owns.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        if (isOwnerOrTest(hfs, context.filename)) return {}
+        return {
+            CallExpression(node) {
+                const origins = writtenEntityOrigins(context, node)
+                if (!origins.some((origin) => hfs.tierOf(origin.file) === "platform" && ownerNameOf(hfs, origin.file) === "jobs" && hfs.slotOf(origin.file) === "be.persistence")) return
+                context.report({ node, messageId: "foreign", data: { call: context.sourceCode.getText(node.callee) } })
+            },
+        }
+    },
+}
+
+/** The names the guarded-write contract fixes: the target job and the token the writer holds. */
+const TARGET = "jobId"
+const TOKEN = "expectedFencingToken"
+/** The property of a claimed job that holds the token it carries. */
+const CARRIED = "fencingToken"
+
+/** A property of a TypeScript type by name, or undefined. */
+const propertyOf = (type, name) => type.getProperty(name)
+
+/** True when the property is a required `number`. */
+const isRequiredNumber = (checker, property, location) => {
+    if (!property || (property.flags & ts.SymbolFlags.Optional) !== 0) return false
+    const type = checker.getTypeOfSymbolAtLocation(property, location)
+    return (type.flags & ts.TypeFlags.Number) !== 0
+}
+
+/** Calls on the `JobClaims` port, and what a guarded write is: required token, no cast to get around it, and `JobFencedOut` is not swallowed. */
+export const jobFenceRequired = {
+    meta: {
+        type: "problem",
+        docs: { description: "Every `JobClaims` method that writes an existing job declares a required `expectedFencingToken: number`, a call never casts around it, and a `catch` around a guarded write rethrows." },
+        schema: [],
+        messages: {
+            optionalToken: "`{{method}}` takes a job (`{{target}}`) but its parameter type does not require `{{token}}: number`. Every write to an existing job is guarded by the fencing token the caller holds: declare it required (non-optional, non-nullable) in the type.",
+            cast: "This argument of `{{call}}` uses a cast or a non-null assertion. The token a guarded write carries is the one the claim returned: pass it as typed, never `as`, `!` or `any` around it.",
+            swallowed: "This `catch` hides a failed guarded write: a `JobFencedOut` means a newer worker owns the job and this one must stop with no further effect. Do not catch around `JobClaims` writes in a step or processor; the `FencedProcessor` base class owns the failure path. Rethrow if you must catch.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        const owner = isOwnerOrTest(hfs, context.filename)
+        const { checker, toTs } = typed(context)
+        const claimsCall = (node) => node.type === "CallExpression" && node.callee.type === "MemberExpression" && !node.callee.computed && isJobClaimsType(context, node.callee.object)
+        return {
+            // The declaration side: in the owner, each member of the port that takes a job requires the token.
+            TSMethodSignature(node) {
+                if (!owner || hfs.tierOf(context.filename) !== "platform" || !isJobClaimsType(context, node.parent.parent?.id ?? node.parent)) return
+                const first = node.params?.[0]
+                if (!first) return
+                const tsNode = toTs(first)
+                const type = tsNode ? checker.getTypeAtLocation(tsNode) : undefined
+                // A parameter that already carries the token (the claimed job itself) is a derivation, not a write.
+                if (!type || !propertyOf(type, TARGET) || propertyOf(type, CARRIED)) return
+                if (!isRequiredNumber(checker, propertyOf(type, TOKEN), tsNode)) {
+                    context.report({ node: first, messageId: "optionalToken", data: { method: node.key?.name ?? "this method", target: TARGET, token: TOKEN } })
+                }
+            },
+            CallExpression(node) {
+                if (owner || !claimsCall(node)) return
+                for (const argument of node.arguments) {
+                    walk(argument, (child) => {
+                        if (child.type === "TSAsExpression" || child.type === "TSTypeAssertion" || child.type === "TSNonNullExpression") context.report({ node: child, messageId: "cast", data: { call: context.sourceCode.getText(node.callee) } })
+                    })
+                }
+            },
+            TryStatement(node) {
+                if (owner || !node.handler) return
+                let writes = false
+                walk(node.block, (child) => { if (claimsCall(child)) writes = true })
+                if (!writes) return
+                let rethrows = false
+                walk(node.handler.body, (child) => { if (child.type === "ThrowStatement") rethrows = true })
+                if (!rethrows) context.report({ node: node.handler, messageId: "swallowed" })
+            },
+        }
+    },
+}
+
+/** The class of an external effect of a step passes the key `JobClaims.runKey` made. */
+export const jobRunKey = {
+    meta: {
+        type: "problem",
+        docs: { description: "In a job step every call on an integration port passes a `RunKey` (made by `JobClaims.runKey`, which includes the fencing token), never a cast or a literal." },
+        schema: [],
+        messages: {
+            missing: "`{{call}}` is an external call from a job step without a `RunKey` argument. An effect that a zombie worker may repeat must be idempotent at the provider: pass `this.claims.runKey(job, \"<step>\")` (it includes the fencing token) as the idempotency key. A read belongs in the application layer, not in a step.",
+            forged: "This `RunKey` is built with a cast. Only `JobClaims.runKey(job, step)` makes one, so the key always carries the fencing token of the claim.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        if (hfs.slotOf(context.filename) !== "be.feature.jobs.steps") return {}
+        return {
+            CallExpression(node) {
+                const callee = node.callee
+                if (callee.type !== "MemberExpression" || callee.computed) return
+                const origins = typeOrigins(context, callee.object)
+                if (!origins.some((origin) => origin.module === null && hfs.tierOf(origin.file) === "integrations")) return
+                const keyArguments = node.arguments.filter((argument) => isRunKeyType(context, argument))
+                if (keyArguments.length === 0) {
+                    context.report({ node, messageId: "missing", data: { call: context.sourceCode.getText(callee) } })
+                    return
+                }
+                for (const argument of keyArguments) {
+                    walk(argument, (child) => { if (child.type === "TSAsExpression" || child.type === "TSTypeAssertion") context.report({ node: child, messageId: "forged" }) })
+                }
+            },
+        }
+    },
+}
+
+/** A processor extends the fenced base and is named after its job; a step implements `JobStep` in `steps/`. */
+export const jobShape = {
+    meta: {
+        type: "problem",
+        docs: { description: "`<job>.processor.ts` of `features/jobs/<job>/transport/queue/` declares a class extending `FencedProcessor`; `steps/<step>.step.ts` declares a class implementing `JobStep`; neither role exists elsewhere." },
+        schema: [],
+        messages: {
+            processorPlacement: "`{{name}}` is in a `.processor.ts` file outside `features/jobs/<job>/transport/queue/`. A job processor lives only in the queue transport of its job, so the jobs kind stays one place.",
+            processorStem: "The processor of job `{{job}}` is `{{job}}.processor.ts`, but this file is `{{stem}}.processor.ts`.",
+            notFenced: "`{{name}}` is a job processor that does not extend `FencedProcessor` of `platform/jobs`. The base class claims the job with a bumped fencing token and settles it through the guarded writes; a processor without it has no fence.",
+            stepPlacement: "`{{name}}` implements `JobStep` outside `features/jobs/<job>/steps/<step>.step.ts`.",
+            notStep: "`{{name}}` is in a step file but does not implement `JobStep` of `platform/jobs`.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        const file = context.filename
+        const found = hfs.classify(file)
+        const base = baseName(file)
+        const isProcessorFile = base.endsWith(".processor.ts")
+        const isStepFile = base.endsWith(".step.ts")
+        const inJob = found.slot === "be.feature.jobs.queue"
+        const inSteps = found.slot === "be.feature.jobs.steps"
+        const inPlatform = hfs.tierOf(file) === "platform" && ownerNameOf(hfs, file) === "jobs"
+        const check = (node) => {
+            const name = node.id?.name ?? "this class"
+            const extendsFenced = node.superClass ? isFencedProcessorType(context, node.superClass) : false
+            const implementsStep = (node.implements ?? []).some((entry) => isJobStepType(context, entry))
+            if (isProcessorFile && !inPlatform) {
+                if (!inJob) context.report({ node: node.id ?? node, messageId: "processorPlacement", data: { name } })
+                else {
+                    const stem = base.slice(0, -".processor.ts".length)
+                    if (found.bindings?.job !== undefined && found.bindings.job !== stem) context.report({ node: node.id ?? node, messageId: "processorStem", data: { job: found.bindings.job, stem } })
+                    if (!extendsFenced) context.report({ node: node.id ?? node, messageId: "notFenced", data: { name } })
+                }
+            }
+            if (isStepFile) {
+                if (!inSteps) context.report({ node: node.id ?? node, messageId: "stepPlacement", data: { name } })
+                else if (!implementsStep) context.report({ node: node.id ?? node, messageId: "notStep", data: { name } })
+            } else if (implementsStep && !inPlatform) context.report({ node: node.id ?? node, messageId: "stepPlacement", data: { name } })
+        }
+        return { ClassDeclaration: check, ClassExpression: check }
+    },
+}
+
+export const rules = {
+    "job-write-owner": jobWriteOwner,
+    "job-fence-required": jobFenceRequired,
+    "job-run-key": jobRunKey,
+    "job-shape": jobShape,
+}
+
+/** The level these laws ask for: `error`, switched off nowhere. */
+export const recommended = {
+    "starci-be/job-write-owner": "error",
+    "starci-be/job-fence-required": "error",
+    "starci-be/job-run-key": "error",
+    "starci-be/job-shape": "error",
+}

package/lib/ast.mjs

@@ -54,6 +54,13 @@ export const keyName = (node) => {
     return null
 }
 
+/** The decorators of a constructor parameter: on the parameter, its wrapper (`private readonly x`) or its inner identifier. */
+export const paramParts = (param) => {
+    const inner = param.type === "TSParameterProperty" ? param.parameter : param
+    const target = inner.type === "AssignmentPattern" ? inner.left : inner
+    return { target, decorators: [...new Set([...(param.decorators ?? []), ...(inner.decorators ?? []), ...(target.decorators ?? [])])] }
+}
+
 /** The name of a decorator (`@Foo` or `@Foo(...)`), else null. */
 export const decoratorName = (decorator) => {
     const expression = decorator?.expression

package/lib/config.mjs

@@ -1,7 +1,7 @@
 /**
  * The one flat config of a StarCi back end.
  *
- * A repository's `eslint.config.mjs` is a managed file (R05/R16), rendered by `hfs sync` as exactly:
+ * A repository's `eslint.config.mjs` is a managed file (R05/R16), rendered by `starci app sync` as exactly:
  *
  *     import { loadHfs, starciBeConfig } from "@starci/eslint-canon-be"
  *     export default starciBeConfig({ hfs: loadHfs(import.meta.url) })

package/lib/db-writes.mjs

@@ -6,7 +6,7 @@ import { staticText } from "./ast.mjs"
 import { isPackageType } from "./types.mjs"
 
 /** The `typeorm` types a call can write through. */
-export const RECEIVER_TYPES = Object.freeze(["EntityManager", "DataSource", "QueryRunner"])
+const RECEIVER_TYPES = Object.freeze(["EntityManager", "DataSource", "QueryRunner"])
 
 /** Statement text that changes rows. */
 export const WRITING_SQL = /(?:^|[\s;(])(?:insert\s+into|update\s+["`\w.]+\s+set|delete\s+from|truncate\b)/i

package/lib/doors.mjs

@@ -0,0 +1,81 @@
+/**
+ * What the door rules of the feature kinds (webhooks, realtime) read from a class: what is injected into it, which methods
+ * the framework enters, and which expression a call is made on. Every answer comes from a decorator's import, a value's
+ * declared type or a declaration's origin, never from a spelling.
+ */
+import ts from "typescript"
+import { walk } from "./ast.mjs"
+import { decoratorCallee, importOf, isImportedFrom } from "./import-source.mjs"
+import { typed } from "./types.mjs"
+
+/** True when the class carries a decorator that is `name` exported by `source`. */
+export const hasClassDecorator = (context, node, source, name) =>
+    (node.decorators ?? []).some((decorator) => isImportedFrom(context, decoratorCallee(decorator), source, name))
+
+/** The decorators of a method or class that are one of `names` exported by `source`. */
+export const decoratorsFrom = (context, node, source, names) =>
+    (node.decorators ?? []).filter((decorator) => isImportedFrom(context, decoratorCallee(decorator), source, names))
+
+/**
+ * Every value injected into a class: a constructor parameter (plain or a parameter property) and a property that
+ * carries a decorator which injects (`Inject` of Nest, a `@nestjs/typeorm` injector or a function declared in a
+ * `*.decorators.ts` file).
+ *
+ * @param {object} context - The ESLint rule context.
+ * @param {object} classNode - A `ClassDeclaration`.
+ * @returns {Array<{ node: object, annotation: object | undefined }>} The injected members, each with its declared type annotation.
+ */
+export const injectedMembers = (context, classNode) => {
+    const members = []
+    const constructor = classNode.body.body.find((member) => member.type === "MethodDefinition" && member.kind === "constructor")
+    for (const original of constructor?.value.params ?? []) {
+        const param = original.type === "TSParameterProperty" ? original.parameter : original
+        members.push({ node: original, annotation: param.typeAnnotation?.typeAnnotation })
+    }
+    for (const member of classNode.body.body) {
+        if (member.type !== "PropertyDefinition" || !(member.decorators ?? []).some((decorator) => isInjectorDecorator(context, decorator))) continue
+        members.push({ node: member, annotation: member.typeAnnotation?.typeAnnotation })
+    }
+    return members
+}
+
+/** True for a decorator that injects: `Inject` of Nest, a `@nestjs/typeorm` injector, or a function declared in a `*.decorators.ts` file. */
+const isInjectorDecorator = (context, decorator) => {
+    const callee = decoratorCallee(decorator)
+    if (callee?.type !== "Identifier") return false
+    const found = importOf(context, callee)
+    if (found?.source === "@nestjs/common" && found.imported === "Inject") return true
+    if (found?.source === "@nestjs/typeorm") return true
+    const symbol = aliasTarget(context, callee)
+    return (symbol?.getDeclarations() ?? []).some((declaration) => declaration.getSourceFile().fileName.split("\\").join("/").endsWith(".decorators.ts"))
+}
+
+/** The symbol an identifier names, with an import alias resolved to its target. */
+export const aliasTarget = (context, identifier) => {
+    const { checker, toTs } = typed(context)
+    const tsNode = toTs(identifier)
+    const symbol = tsNode && checker.getSymbolAtLocation(tsNode)
+    return symbol && (symbol.flags & ts.SymbolFlags.Alias) !== 0 ? checker.getAliasedSymbol(symbol) : symbol
+}
+
+/** The methods of a class (instance, non-constructor) that carry one of the decorators `names` of `source`. */
+export const methodsDecoratedBy = (context, classNode, source, names) =>
+    classNode.body.body.filter((member) => member.type === "MethodDefinition" && member.kind === "method" && !member.static && decoratorsFrom(context, member, source, names).length > 0)
+
+/**
+ * Every call made in a method body, closures included: `<receiver>.<method>(...)` as `{ call, receiver, method }`, and any
+ * other call as `{ call, receiver: null, method: null }`.
+ */
+export const callsOf = (method) => {
+    const calls = []
+    walk(method.value.body, (node) => {
+        if (node.type !== "CallExpression") return
+        const callee = node.callee
+        const member = callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" ? callee : null
+        calls.push({ call: node, receiver: member?.object ?? null, method: member?.property.name ?? null })
+    })
+    return calls
+}
+
+/** The parameters of a handler method, with the pattern a default value or a destructuring wraps unwrapped. */
+export const parametersOf = (method) => method.value.params.map((param) => (param.type === "TSParameterProperty" ? param.parameter : param))

package/lib/edition.mjs

@@ -0,0 +1,45 @@
+/**
+ * The edition gate of the back-end plugin.
+ *
+ * Edition applicability belongs to the HFS rule catalog, beside the law and its enforcer. A rule
+ * that the catalog does not judge in this app's edition still ships in the plugin, but its `create`
+ * returns no listeners. The plugin wiring therefore has one generic gate instead of edition checks
+ * scattered through rule bodies.
+ */
+import { dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+import { loadRuleCatalog } from "../runtime/scripts/hfs/slots.mjs"
+
+const RUNTIME = join(dirname(fileURLToPath(import.meta.url)), "..", "runtime")
+let catalogCache
+
+/** The bundled rule catalog, loaded once per lint process. */
+const bundledCatalog = () => {
+    catalogCache ??= loadRuleCatalog({ root: RUNTIME })
+    return catalogCache
+}
+
+/** A rule which intentionally registers no listeners in this edition. */
+const inactive = (rule) => Object.freeze({ ...rule, create: () => ({}) })
+
+/**
+ * The plugin view for one HFS edition.
+ *
+ * Full is the default edition and the catalog's superset, so it needs no runtime catalog read. This
+ * keeps the source checkout testable before `sync-runtime` refreshes the generated bundle; lite
+ * loads the package's bundled catalog in a published installation. Tests may inject a catalog to
+ * prove the generic filtering independently of generated copies.
+ */
+export const pluginForEdition = ({ plugin, hfs, catalog }) => {
+    const edition = hfs?.edition === undefined ? "full" : hfs.edition
+    if (edition !== "full" && edition !== "lite") {
+        throw new RangeError(`Unknown HFS edition ${JSON.stringify(edition)}; expected "full" or "lite"`)
+    }
+    if (edition === "full" && catalog === undefined) return plugin
+    const loaded = catalog ?? bundledCatalog()
+    const rules = Object.fromEntries(Object.entries(plugin.rules).map(([id, rule]) => [
+        id,
+        loaded.enforcerJudgedIn("eslint-be", id, edition) ? rule : inactive(rule),
+    ]))
+    return Object.freeze({ ...plugin, rules: Object.freeze(rules) })
+}