@starci/eslint-canon-be 3.0.8 → 3.0.9

package/runtime/packages/hfs/templates/app/package-scripts/package.json

@@ -2,21 +2,14 @@
   "scripts": {
     "prepare": "husky",
     {{appScripts}}
-    "build:be": "cd be && tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json",
-    "build:fe": "{{buildFe}}",
-    "codegen": "node scripts/codegen.mjs",
-    "typecheck": "{{typecheck}}",
+{{> app/package-scripts/core.json}}
     "typecheck:tests": "tsc -p be/src/tests/tsconfig.json",
-    "lint": "npm run codegen --silent && hfs lint",
-    "lint:fix": "npm run codegen --silent && hfs lint --fix",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
     "test": "cd be && jest --selectProjects unit --coverage",
     "test:affected": "cd be && jest --selectProjects unit --passWithNoTests",
     "test:integration": "npm run typecheck:tests && cd be && jest --selectProjects integration",
     "test:e2e": "npm run typecheck:tests && cd be && jest --selectProjects e2e",
     "test:contract": "npm run typecheck:tests && cd be && jest --selectProjects contract",
-    "test:stack": "cd be && starci-test-stack",
-    "contract:emit": "hfs emit-contracts"
+    "test:stack": "starci app stack",
+    "contract:emit": "starci app emit"
   }
 }

package/runtime/scripts/api/git/config-get.mjs

@@ -0,0 +1,10 @@
+// config-get.mjs — `git config [--local] --get <key>`: one configuration value of a checkout (empty when unset).
+import { gitRunner } from './lib.mjs';
+
+/**
+ * {ok, stdout, stderr}; `local` reads the repository's own config only; `env` replaces the process env (a caller drops
+ * git's repository-local variables). git: the caller's runner or null.
+ */
+export function configGet(cwd, key, { local = false, env = undefined, git = null } = {}) {
+  return gitRunner(git)(['config', ...(local ? ['--local'] : []), '--get', key], env ? { cwd, env } : { cwd });
+}

package/runtime/scripts/api/git/lib.mjs

@@ -1,12 +1,13 @@
 // scripts/api/git/lib.mjs — the one place the runtime spawns git (RT_EXTERNAL_OWNER of scripts/hfs/runtime-rules/external-owner.mjs enforces it).
 //
 // Every caller spelt the same options by hand - encoding:'utf8', windowsHide:true, sometimes a timeout - with two shapes:
-// `git args` in a cwd and `git -C dir args`. gitOutput is the throwing shape (stdout text, or an Error on a non-zero exit).
-// gitSpawn keeps the spawnSync(file, args, options) signature so an injected runner or a spec's fake takes the same three
-// arguments; runGit is the `-C` convenience; gitResult folds the result into the {ok, stdout, error} envelope; gitRunner
-// folds any caller's runner into {ok, stdout, stderr}. The call files beside this one (worktree-*.mjs, rev-parse.mjs, ...)
-// each name one git verb.
+// `git args` in a cwd and `git -C dir args`. gitSpawn keeps the spawnSync(file, args, options) signature so an injected
+// runner or a spec's fake takes the same three arguments; runGit is the `-C` / `-c` convenience; gitRunner folds any
+// caller's runner into {ok, stdout, stderr}. Only the call files beside this one import it: each names one git verb
+// (diff.mjs, ls-files.mjs, worktree-*.mjs, ...), and a caller folds the spawn result it gets back with the pure
+// helpers of scripts/lib/git.mjs (gitResultOf, gitOutputOf).
 import { spawnSync } from 'node:child_process';
+import { withoutGitLocalEnv } from '../../lib/git.mjs';
 
 /**
  * Spawn `file` (the git binary) once with `args`: utf8 text, a hidden window, never a shell.
@@ -20,27 +21,16 @@ export const gitSpawn = (file, args, options = {}) => {
   return spawnSync(file, args, spawn);
 };
 
-/** `git args` in `cwd`, or `git -C dir args` when `dir` is given. `git` overrides the binary. */
-export const runGit = (args, { cwd = null, dir = null, git = 'git', ...options } = {}) =>
-  gitSpawn(git, [...(dir ? ['-C', dir] : []), ...args], cwd ? { cwd, ...options } : options);
-
-/** runGit's stdout as text; throws the spawn error, or an Error carrying git's stderr and exit status, unless git exits 0. */
-export function gitOutput(args, options = {}) {
-  const r = runGit(args, options);
-  if (r.error) throw r.error;
-  if (r.status !== 0) throw Object.assign(new Error(`git ${args.join(' ')} exited ${r.status}: ${(r.stderr ?? '').trim()}`), { status: r.status, stderr: r.stderr });
-  return r.stdout;
-}
-
-/** runGit's result as {ok, stdout, error}: ok only on a clean exit, error from stderr or the spawn. */
-export function gitResult(args, options = {}) {
-  const r = runGit(args, options);
-  return {
-    ok: !r.error && r.status === 0,
-    stdout: r.stdout ?? '',
-    error: (r.stderr ?? '').trim() || String(r.error?.message ?? (r.status == null ? 'timed out' : `exit ${r.status}`)),
-  };
-}
+/**
+ * `git args` in `cwd`, or `git -C dir args` when `dir` is given. `git` overrides the binary; `config` ({key: value})
+ * prefixes one `-c key=value` per entry (core.quotepath=off, a committer identity). Scoped calls discard ambient
+ * hook repository variables; an explicit env remains authoritative, including an intentional temporary index.
+ */
+export const runGit = (args, { cwd = null, dir = null, git = 'git', config = null, ...options } = {}) =>
+  gitSpawn(git, [...(dir ? ['-C', dir] : []), ...Object.entries(config ?? {}).flatMap(([key, value]) => ['-c', `${key}=${value}`]), ...args], {
+    ...(cwd ? { cwd } : {}), ...options,
+    ...((cwd || dir) && options.env === undefined ? { env: withoutGitLocalEnv(process.env) } : {}),
+  });
 
 /**
  * A caller's git runner folded to (args, opts) -> {ok, stdout, stderr}. `git`: the caller's runner (args, {cwd}) ->

package/runtime/scripts/api/git/ls-files.mjs

@@ -0,0 +1,6 @@
+// ls-files.mjs — `git ls-files <args>`: the paths the index tracks (--cached), or the untracked / deleted / ignored ones
+// the flags ask for (-z keeps any file name intact).
+import { runGit } from './lib.mjs';
+
+/** The spawn result {status, stdout, stderr, error} of `git ls-files ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
+export const lsFiles = (args = [], options = {}) => runGit(['ls-files', ...args], options);

package/runtime/scripts/api/git/remote.mjs

@@ -0,0 +1,5 @@
+// remote.mjs — `git remote <args>`: the configured remotes (get-url <name>).
+import { runGit } from './lib.mjs';
+
+/** The spawn result {status, stdout, stderr, error} of `git remote ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
+export const remote = (args = [], options = {}) => runGit(['remote', ...args], options);

package/runtime/scripts/api/git/rev-parse-query.mjs

@@ -0,0 +1,5 @@
+// rev-parse-query.mjs — `git rev-parse <args>`: one rev-parse query (--show-toplevel, --git-common-dir, --git-path, a ref): the text it prints.
+import { runGit } from './lib.mjs';
+
+/** The spawn result {status, stdout, stderr, error} of `git rev-parse ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
+export const revParseQuery = (args = [], options = {}) => runGit(['rev-parse', ...args], options);

package/runtime/scripts/hfs/architecture/ast-walks.mjs

@@ -0,0 +1,220 @@
+// ast-walks.mjs - AST walks the architecture checkers share (moved out of typescript.mjs, which keeps the program loading and module resolution).
+import { canonical, isInside } from './config.mjs';
+import { sourceLocation } from '../../lib/ts-ast.mjs';
+import { UNPROVEN_FRAMEWORK, isUnshadowedCommonJsRequire, relativePath, unwrapExpression } from './typescript.mjs';
+
+/** `expression` unwrapped by the caller's own predicate set (a predicate absent on an older ts reads as never). */
+export function unwrapEach(ts, expression, predicates) {
+  while (expression && predicates.some((predicate) => predicate?.(expression))) expression = expression.expression;
+  return expression;
+}
+
+/** `value` with every TS alias hop resolved (a re-exported import reads as its target symbol). */
+export function normalizedSymbolValue(ts, checker, value) {
+  let symbol = value ?? null;
+  const seen = new Set();
+  while (symbol && (symbol.flags & ts.SymbolFlags.Alias) && !seen.has(symbol)) {
+    seen.add(symbol);
+    const target = checker.getAliasedSymbol(symbol);
+    if (!target || target === symbol) break;
+    symbol = target;
+  }
+  return symbol;
+}
+
+/** The symbol `node` names, aliases resolved. */
+export function normalizedSymbol(ts, checker, node) {
+  return normalizedSymbolValue(ts, checker, checker?.getSymbolAtLocation(node) ?? null);
+}
+
+/** The identifier or member-name node an expression selects through unwrapExpression, or null. */
+export function selectedNode(ts, expression) {
+  expression = unwrapExpression(ts, expression);
+  if (ts.isIdentifier(expression)) return expression;
+  if (ts.isPropertyAccessExpression(expression)) return expression.name;
+  if (ts.isElementAccessExpression(expression) && ts.isStringLiteralLike(expression.argumentExpression)) return expression.argumentExpression;
+  return null;
+}
+
+/**
+ * The symbol `node` ultimately evaluates to: its own symbol, followed through a single `const` variable
+ * initializer (and so on). `unselected: 'null'` answers null when `node` selects no name at all.
+ */
+export function valueSymbol(ts, checker, node, seen = new Set(), { unselected = 'node' } = {}) {
+  const selected = selectedNode(ts, node);
+  if (!selected && unselected === 'null') return null;
+  const symbol = normalizedSymbol(ts, checker, selected ?? node);
+  if (!symbol || seen.has(symbol)) return symbol;
+  seen.add(symbol);
+  const declarations = symbol.getDeclarations?.() ?? [];
+  if (declarations.length === 1 && ts.isVariableDeclaration(declarations[0]) && declarations[0].initializer
+    && (ts.getCombinedNodeFlags(declarations[0].parent) & ts.NodeFlags.Const)) {
+    return valueSymbol(ts, checker, declarations[0].initializer, seen, { unselected });
+  }
+  return symbol;
+}
+
+/**
+ * The expressions `declaration` returns: its body when it is an expression-bodied arrow/function, else every
+ * `return`'s argument without descending into nested functions. `functionLike` overrides which node kinds bound
+ * that descent (default the four callable declaration kinds; pass `ts.isFunctionLike` for the wider set).
+ */
+export function returnedExpressions(ts, declaration, { functionLike = null } = {}) {
+  const boundary = functionLike ?? ((node) => ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)
+    || ts.isArrowFunction(node) || ts.isFunctionExpression(node));
+  if ((ts.isArrowFunction(declaration) || ts.isFunctionExpression(declaration)) && !ts.isBlock(declaration.body)) return [declaration.body];
+  const body = boundary(declaration) ? declaration.body : null;
+  if (!body || !ts.isBlock(body)) return [];
+  const returned = [];
+  const visit = (node) => {
+    if (node !== body && boundary(node)) return;
+    if (ts.isReturnStatement(node) && node.expression) returned.push(node.expression);
+    else ts.forEachChild(node, visit);
+  };
+  visit(body);
+  return returned;
+}
+
+/** A node's decorators across TS versions (ts.getDecorators, else the legacy `decorators` property). */
+export function nodeDecorators(ts, node) {
+  return ts.canHaveDecorators(node) ? ts.getDecorators(node) ?? [] : node.decorators ?? [];
+}
+
+/** One finding row: rule id, root-relative path, node position and message, plus rule extras. */
+export function violation(config, sourceFile, node, ruleId, message, extra = {}) {
+  return { ruleId, path: relativePath(config.root, sourceFile.fileName), ...sourceLocation(sourceFile, node), message, ...extra };
+}
+
+/** Whether `match` holds for `node` or a descendant (the walk stops at the first match). */
+export function anyDescendant(ts, node, match) {
+  let found = false;
+  const visit = (current) => {
+    if (found) return;
+    if (match(current)) { found = true; return; }
+    ts.forEachChild(current, visit);
+  };
+  visit(node);
+  return found;
+}
+
+/**
+ * The framework kinds `expression` can produce: `directOf(ts, checker, {symbol, selected, targets})` maps a
+ * selected node's symbols to a kind (default `targets.get(symbol)`); `shorthandOf` (when set) also resolves
+ * shorthand-property declarations and descends property assignments; `newExpression` descends `new X()` callees.
+ */
+export function tracedFrameworkKinds(ts, checker, expression, targets,
+  { seen = new Set(), depth = 0, directOf = null, shorthandOf = null, newExpression = false } = {}) {
+  if (!expression) return new Set();
+  if (depth > 10) return new Set([UNPROVEN_FRAMEWORK]);
+  expression = unwrapExpression(ts, expression);
+  const selected = selectedNode(ts, expression);
+  const symbol = selected ? normalizedSymbol(ts, checker, selected) : null;
+  const direct = symbol ? (directOf ?? ((ts2, c, { symbol: s, targets: t }) => t.get(s) ?? null))(ts, checker, { symbol, selected, targets }) : null;
+  if (direct) return new Set([direct]);
+  const opts = { depth: depth + 1, directOf, shorthandOf, newExpression };
+  if (ts.isArrowFunction(expression) || ts.isFunctionExpression(expression)) {
+    const kinds = new Set();
+    for (const returned of returnedExpressions(ts, expression)) {
+      for (const kind of tracedFrameworkKinds(ts, checker, returned, targets, { ...opts, seen })) kinds.add(kind);
+    }
+    return kinds;
+  }
+  if (ts.isCallExpression(expression)) {
+    const kinds = tracedFrameworkKinds(ts, checker, expression.expression, targets, { ...opts, seen });
+    if (kinds.size) return kinds;
+  }
+  if (newExpression && ts.isNewExpression(expression)) {
+    return tracedFrameworkKinds(ts, checker, expression.expression, targets, { ...opts, seen });
+  }
+  if (!symbol || seen.has(symbol)) return new Set();
+  const nextSeen = new Set(seen).add(symbol);
+  const kinds = new Set();
+  for (const declaration of symbol.getDeclarations?.() ?? []) {
+    if (ts.isVariableDeclaration(declaration) && declaration.initializer) {
+      for (const kind of tracedFrameworkKinds(ts, checker, declaration.initializer, targets, { ...opts, seen: nextSeen })) kinds.add(kind);
+    }
+    if (shorthandOf && ts.isShorthandPropertyAssignment(declaration)) {
+      const target = normalizedSymbolValue(ts, checker, checker.getShorthandAssignmentValueSymbol?.(declaration));
+      const kind = shorthandOf(ts, checker, target, targets);
+      if (kind) kinds.add(kind);
+    }
+    if (shorthandOf && ts.isPropertyAssignment(declaration)) {
+      for (const kind of tracedFrameworkKinds(ts, checker, declaration.initializer, targets, { ...opts, seen: nextSeen })) kinds.add(kind);
+    }
+    for (const returned of returnedExpressions(ts, declaration)) {
+      for (const kind of tracedFrameworkKinds(ts, checker, returned, targets, { ...opts, seen: nextSeen })) kinds.add(kind);
+    }
+  }
+  return kinds;
+}
+
+/** 'unproven framework' | 'multiple framework' | the one kind | null, for a decorator whose expression constructs. */
+export function constructedDecoratorKind(ts, checker, decorator, targets, traceOpts = {}) {
+  const callee = ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
+  const kinds = tracedFrameworkKinds(ts, checker, callee, targets, traceOpts);
+  if (kinds.has(UNPROVEN_FRAMEWORK)) return 'unproven framework';
+  return kinds.size === 1 ? [...kinds][0] : kinds.size ? 'multiple framework' : null;
+}
+
+/** The target a decorator resolves to through a `let`/`var` alias's single initializer, or null. */
+export function mutableDecoratorKind(ts, checker, decorator, targets) {
+  const callee = ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
+  const selected = selectedNode(ts, callee);
+  const symbol = selected ? normalizedSymbol(ts, checker, selected) : null;
+  const declarations = symbol?.getDeclarations?.() ?? [];
+  if (declarations.length !== 1 || !ts.isVariableDeclaration(declarations[0]) || !declarations[0].initializer
+    || (ts.getCombinedNodeFlags(declarations[0].parent) & ts.NodeFlags.Const)) return null;
+  return targets.get(valueSymbol(ts, checker, declarations[0].initializer)) ?? null;
+}
+
+/** The callee expression of a decorator (the called expression of `@x(...)`, else the expression itself). */
+export function decoratorCallee(ts, decorator) {
+  return ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
+}
+
+/**
+ * The module `statement` (import, export-from or import-equals) statically binds: its specifier text, the
+ * module's symbol and its exported symbols by name (aliases resolved); `symbol` is null when the module does
+ * not resolve. Null when the statement names no static specifier.
+ */
+export function moduleExportsOf(ts, checker, statement) {
+  const moduleSpecifier = (ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement))
+    && statement.moduleSpecifier && ts.isStringLiteralLike(statement.moduleSpecifier) ? statement.moduleSpecifier : null;
+  const importEquals = ts.isImportEqualsDeclaration(statement) && ts.isExternalModuleReference(statement.moduleReference)
+    && statement.moduleReference.expression && ts.isStringLiteralLike(statement.moduleReference.expression)
+    ? statement.moduleReference.expression : null;
+  const specifierNode = moduleSpecifier ?? importEquals;
+  const specifier = specifierNode?.text;
+  if (specifier == null) return null;
+  const symbol = checker.getSymbolAtLocation(specifierNode) ?? null;
+  const exports = new Map((symbol ? checker.getExportsOfModule(symbol) : []).map(item => [item.getName(), normalizedSymbolValue(ts, checker, item)]));
+  return { specifierNode, specifier, symbol, exports };
+}
+
+/**
+ * The program source files a framework-target scan of `checker` judges: every file in `localFiles`, plus (when
+ * `root` is given) declaration files inside the root but outside node_modules. Null when no program of the
+ * context owns the checker.
+ */
+export function programSourcesOf(context, checker, localFiles, { root = null } = {}) {
+  const program = context.programs.find(candidate => candidate.getTypeChecker() === checker) ?? null;
+  if (!program) return null;
+  return program.getSourceFiles().filter(sourceFile => localFiles.has(canonical(sourceFile.fileName))
+    || (root && sourceFile.isDeclarationFile && isInside(root, sourceFile.fileName)
+      && !sourceFile.fileName.replaceAll('\\', '/').includes('/node_modules/')));
+}
+
+/**
+ * The CommonJS require() caveat every framework scan reports: each `require('<specifier>')` `accepted` pushes
+ * `${filePath} uses a CommonJS <label ?? specifier> <detail>` (the import-shape reasoning cannot prove that binding).
+ */
+export function commonJsRequireReasons(ts, checker, sourceFile, accepted, reasons, filePath, detail, label = null) {
+  const visit = node => {
+    if (ts.isCallExpression(node) && isUnshadowedCommonJsRequire(ts, checker, node.expression)
+      && node.arguments.length === 1 && ts.isStringLiteralLike(node.arguments[0]) && accepted(node.arguments[0].text)) {
+      reasons.push(`${filePath} uses a CommonJS ${label ?? node.arguments[0].text} ${detail}`);
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+}

package/runtime/scripts/hfs/architecture/backend.mjs

@@ -1,7 +1,8 @@
 import path from 'node:path';
 import { isInside } from './config.mjs';
 import { slotAdmitsFile } from '../allows.mjs';
-import { reachableViolation, relativePath, sourceLocation } from './typescript.mjs';
+import { reachableViolation, relativePath } from './typescript.mjs';
+import { sourceLocation } from '../../lib/ts-ast.mjs';
 
 const FORBIDDEN_APP_ROLE = /(?:^|\.)(?:service|provider|providers|resolver|controller|handler|repository|entity|use-case|command|query|listener|consumer|processor)\.[cm]?[jt]sx?$/i;
 const FORBIDDEN_DECLARATION = /(?:Service|Provider|Resolver|Controller|Handler|Repository|Entity|UseCase|Command|Query|Listener|Consumer|Processor)$/;
@@ -73,6 +74,18 @@ function roleEvidence(ts, sourceFile) {
 
 function transportFrameworkEvidence(ts, sourceFile, checker) {
   const found = [];
+  // The destructured binding elements naming a transport export (or a computed binding, which cannot be
+  // proved to exclude one): `const { Controller, [x]: y } = ...`. `rest` elements are always opaque.
+  const destructuredBindings = (elements, detail) => elements.flatMap(element => {
+    const selected = element.dotDotDotToken
+      ? null
+      : ts.isIdentifier(element.propertyName ?? element.name)
+        ? (element.propertyName ?? element.name).text
+        : ts.isStringLiteralLike(element.propertyName)
+          ? element.propertyName.text
+          : null;
+    return selected === null || NEST_COMMON_TRANSPORT.has(selected) ? [{ node: element, detail: selected ?? detail }] : [];
+  });
   const namespaceUsages = binding => {
     const usages = [];
     const alias = binding.text;
@@ -90,18 +103,7 @@ function transportFrameworkEvidence(ts, sourceFile, checker) {
         if (!ts.isObjectBindingPattern(node.name)) {
           usages.push({ node: node.name, detail: 'escaped @nestjs/common namespace access' });
         } else {
-          for (const element of node.name.elements) {
-            const selected = element.dotDotDotToken
-              ? null
-              : ts.isIdentifier(element.propertyName ?? element.name)
-                ? (element.propertyName ?? element.name).text
-                : ts.isStringLiteralLike(element.propertyName)
-                  ? element.propertyName.text
-                  : null;
-            if (selected === null || NEST_COMMON_TRANSPORT.has(selected)) {
-              usages.push({ node: element, detail: selected ?? 'computed @nestjs/common namespace destructuring' });
-            }
-          }
+          usages.push(...destructuredBindings(node.name.elements, 'computed @nestjs/common namespace destructuring'));
         }
       }
       ts.forEachChild(node, visit);
@@ -168,16 +170,7 @@ function transportFrameworkEvidence(ts, sourceFile, checker) {
         if (ts.isIdentifier(node.name)) {
           found.push(...namespaceUsages(node.name).map(item => ({ ...item, specifier })));
         } else if (ts.isObjectBindingPattern(node.name)) {
-          for (const element of node.name.elements) {
-            const selected = element.dotDotDotToken
-              ? null
-              : ts.isIdentifier(element.propertyName ?? element.name)
-                ? (element.propertyName ?? element.name).text
-                : ts.isStringLiteralLike(element.propertyName)
-                  ? element.propertyName.text
-                  : null;
-            if (selected === null || NEST_COMMON_TRANSPORT.has(selected)) found.push({ node: element, specifier, detail: selected ?? 'computed @nestjs/common require destructuring' });
-          }
+          found.push(...destructuredBindings(node.name.elements, 'computed @nestjs/common require destructuring').map(item => ({ ...item, specifier })));
         }
       }
     }

package/runtime/scripts/hfs/architecture/background-unowned.mjs

@@ -3,29 +3,26 @@ import { machineKit } from './machine-ast.mjs';
 
 /**
  * R46 `background-unowned` (BE_BACKGROUND_UNOWNED, BE-CONVENTION 1.6 and 1.13). Background work is a transport that only
- * a worker app runs:
+ * a worker or api app runs (an api app composes the message transport of its own service; a separate worker is opt-in):
  *
- *   - every job (`*.job.ts`) and consumer (`*.consumer.ts`) is composed by an app of kind `worker`: the file is reachable,
- *     through runtime imports, from the root module of some worker app declared in hfs.json; one no worker reaches never runs;
- *   - no scheduler outside `platform/scheduling`: a `@Cron`, `@Interval` or `@Timeout` decorator of `@nestjs/schedule` and a
- *     `setInterval` call are refused everywhere else (platform/scheduling owns the lease, the fencing and the overlap guard);
+ *   - every job processor (`*.processor.ts`, the jobs kind) and consumer (`*.consumer.ts`) is composed by an app of kind `worker` or
+ *     `api`: the file is reachable, through runtime imports, from the root module of some such app declared in hfs.json; one no app
+ *     reaches never runs. A schedule is a BullMQ job scheduler of a queue, so no scheduler decorator or timer is judged here: `@nestjs/schedule`
+ *     and the timers are owned by platform capabilities (R90 BE_INFRA_OWNER);
  *   - a method whose name is one of the words the law names (`sweep`, `deliver`, `reconcile`, `retry`, alone or as the
- *     first word of a camelCase name) in a domain, integrations or feature class is reachable from a composed job or
- *     consumer: from the job or consumer files and everything they import, and from the files of the feature that holds them
- *     (its handlers are registered with the command bus, not imported by the job). Mechanisms of platform are exempt.
+ *     first word of a camelCase name) in a domain, integrations or feature class is reachable from a composed processor or
+ *     consumer: from the processor or consumer files and everything they import, and from the files of the feature that holds them
+ *     (its handlers are registered with the command bus, not imported by the processor). Mechanisms of platform are exempt.
  *
- * Reachability is static (imports, re-exports and the feature of the job); it proves a job or consumer could call the method,
+ * Reachability is static (imports, re-exports and the feature of the processor); it proves a processor or consumer could call the method,
  * not that it does.
  */
 export const BACKGROUND_UNOWNED_RULE_IDS = ['BE_BACKGROUND_UNOWNED'];
 
 const RULE = 'BE_BACKGROUND_UNOWNED';
-const BACKGROUND_ROLES = ['job', 'consumer'];
+const BACKGROUND_ROLES = ['processor', 'consumer'];
 /** The words the law names for background methods (knowledge/hfs/README.md 5.7). */
 const BACKGROUND_WORDS = ['sweep', 'deliver', 'reconcile', 'retry'];
-const SCHEDULER_DECORATORS = ['Cron', 'Interval', 'Timeout'];
-const SCHEDULER_PACKAGE = '@nestjs/schedule';
-const SCHEDULING_CAPABILITY = 'scheduling';
 
 const roleOf = rel => {
   const parts = path.posix.basename(rel).split('.');
@@ -52,17 +49,18 @@ export function checkBackgroundUnowned(input) {
     return seen;
   };
 
-  const workerRoots = resolver.repo.apps.filter(app => app.kind === 'worker').map(app => `apps/${app.name}/src/app.module.ts`).filter(rel => graph.files.has(rel));
-  const composed = closure(workerRoots);
+  const rootOf = app => `apps/${app.name}/src/app.module.ts`;
+  const workerRoots = resolver.repo.apps.filter(app => app.kind === 'worker').map(rootOf).filter(rel => graph.files.has(rel));
+  const composed = closure([...workerRoots, ...resolver.repo.apps.filter(app => app.kind === 'api').map(rootOf).filter(rel => graph.files.has(rel))]);
   const background = [...graph.files.values()].filter(file => roleOf(file.rel) && file.tier === 'feature');
   const running = background.filter(file => composed.has(file.rel));
   for (const file of background) {
     if (composed.has(file.rel)) continue;
     const role = roleOf(file.rel);
-    report(file, file.sourceFile, `${file.rel} is a ${role} that no worker app composes${workerRoots.length ? '' : ' (hfs.json declares no worker app)'}; a ${role} runs only when the ${role === 'job' ? 'schedule' : 'message'} module of its feature is imported by the root module of an app of kind worker.`, { role });
+    report(file, file.sourceFile, `${file.rel} is a ${role} that no service app composes${workerRoots.length ? '' : ' (hfs.json declares no worker app)'}; a ${role} runs only when the ${role === 'processor' ? 'job' : 'message'} module of its feature is imported by the root module of an app of kind worker or api.`, { role });
   }
 
-  // Everything a composed job or consumer can reach: its imports, and the files of its own feature (command handlers).
+  // Everything a composed processor or consumer can reach: its imports, and the files of its own feature (command handlers).
   const roots = new Set();
   for (const file of running) {
     roots.add(file.rel);
@@ -73,31 +71,15 @@ export function checkBackgroundUnowned(input) {
 
   let methods = 0;
   for (const file of graph.files.values()) {
-    const checker = kit.checkerOf(file.sourceFile);
-    const inScheduling = file.owner?.slot === 'be.platform' && path.posix.basename(file.owner.root) === SCHEDULING_CAPABILITY;
     const mechanism = file.tier === 'platform';
     kit.walk(file.sourceFile, node => {
-      if (!inScheduling && ts.isDecorator(node)) {
-        const call = ts.isCallExpression(node.expression) ? node.expression.expression : node.expression;
-        const binding = kit.importBinding(checker, call);
-        if (binding && binding.module === SCHEDULER_PACKAGE && SCHEDULER_DECORATORS.includes(binding.name)) {
-          report(file, node, `@${binding.name} schedules work inside a class outside platform/scheduling. Write a job in transport/schedule/<job>.job.ts that dispatches one command or query, and let platform/scheduling and a worker app run it.`, { scheduler: binding.name });
-        }
-      }
-      if (!inScheduling && ts.isCallExpression(node)) {
-        const callee = node.expression;
-        const bare = ts.isIdentifier(callee) && callee.text === 'setInterval' && kit.declarationsOf(checker, callee).every(declaration => declaration.getSourceFile().isDeclarationFile);
-        const member = ts.isPropertyAccessExpression(callee) && callee.name.text === 'setInterval' && ts.isIdentifier(callee.expression) && ['globalThis', 'window', 'global'].includes(callee.expression.text);
-        const global = bare || member;
-        if (global) report(file, node, 'setInterval starts a scheduler outside platform/scheduling. Write a job in transport/schedule/<job>.job.ts and let platform/scheduling and a worker app run it.', { scheduler: 'setInterval' });
-      }
       if (!mechanism && ts.isClassDeclaration(node)) {
         for (const member of node.members) {
           if (!ts.isMethodDeclaration(member) || !member.name) continue;
           const name = kit.propertyNameText(member.name);
           if (!name || !isBackgroundName(name)) continue;
           methods += 1;
-          if (!reachable.has(file.rel)) report(file, member.name, `${name} is background work (a ${BACKGROUND_WORDS.join(', ')} method) that no job or consumer composed by a worker app can reach. Add a job in transport/schedule or a consumer in transport/message of a feature that runs it, and compose that transport module in a worker app.`, { method: name });
+          if (!reachable.has(file.rel)) report(file, member.name, `${name} is background work (a ${BACKGROUND_WORDS.join(', ')} method) that no processor or consumer composed by a worker or api app can reach. Add a processor in features/jobs/<job> or a consumer in transport/message of a feature that runs it, and compose its module in a worker or api app.`, { method: name });
         }
       }
       return true;

package/runtime/scripts/hfs/architecture/client-reaches-server.mjs

@@ -1,5 +1,6 @@
 import { builtinModules } from 'node:module';
-import { sourceLocation } from './typescript.mjs';
+import { sourceLocation } from '../../lib/ts-ast.mjs';
+import { isServerActionModule } from './server-action.mjs';
 
 /**
  * R55 `client-reaches-server` (FE_CLIENT_REACHES_SERVER), the repository half of the eslint rule `client-no-server-import`,
@@ -75,6 +76,7 @@ export function checkClientReachesServer({ graph, context }) {
     const queue = [entry.rel];
     for (let head = 0; head < queue.length; head += 1) {
       const rel = queue[head];
+      if (isServerActionModule(ts, graph.files.get(rel).sourceFile)) continue;
       const state = seen.get(rel);
       for (const hit of serverOf(rel)) {
         const at = state.first ?? sourceLocation(graph.files.get(rel).sourceFile, hit.node);

package/runtime/scripts/hfs/architecture/clones.mjs

@@ -16,7 +16,7 @@
  *
  * Two kinds of file are uniform by design and are not compared, both found through the slot resolver: the entry main.ts of
  * an app (slot appKind + its required main.ts) and the transport doors of a feature (a *.controller.ts, *.resolver.ts,
- * *.gateway.ts, *.consumer.ts, *.job.ts or *.cli.ts of a slot that a protocol app composes). This is not a loophole: logic
+ * *.gateway.ts, *.consumer.ts, *.processor.ts or *.cli.ts of a slot that a protocol app composes). This is not a loophole: logic
  * cannot live in either. A door body is dispatch only (eslint transport-is-thin, R88), and main.ts cannot share a
  * helper because NestFactory is allowed only in main.ts (BE_ENTRYPOINT_ONLY_IN_APPS), so what repeats there is the
  * canonical shape of section 5 of BE-CONVENTION. A door or main.ts that grows logic is refused by those enforcers, not
@@ -25,12 +25,12 @@
 export const CLONE_RULE_IDS = ['HFS_DUPLICATE_CODE'];
 
 const MAX_VIOLATIONS = 200;
-const DOOR_ROLES = new Set(['controller', 'resolver', 'gateway', 'consumer', 'job', 'cli']);
+const DOOR_ROLES = new Set(['controller', 'resolver', 'gateway', 'consumer', 'processor', 'cli']);
 const APP_ENTRY = 'main.ts';
 const ID = -1;
 const LIT = -2;
 
-function tokenize(ts, sourceFile) {
+export function tokenize(ts, sourceFile) {
   const { SyntaxKind } = ts;
   const literalKinds = new Set([SyntaxKind.StringLiteral, SyntaxKind.NumericLiteral, SyntaxKind.BigIntLiteral, SyntaxKind.RegularExpressionLiteral,
     SyntaxKind.NoSubstitutionTemplateLiteral, SyntaxKind.TemplateHead, SyntaxKind.TemplateMiddle, SyntaxKind.TemplateTail, SyntaxKind.JsxText]);
@@ -76,7 +76,7 @@ function uniformByDesign(resolver, rel) {
   const base = rel.slice(rel.lastIndexOf('/') + 1);
   if (slot.appKind !== undefined) return base === APP_ENTRY && (slot.requires ?? []).includes(APP_ENTRY);
   const role = base.split('.').at(-2);
-  return (slot.composedBy?.length ?? 0) > 0 && DOOR_ROLES.has(role) && base.endsWith('.ts');
+  return !slot.owner && (slot.composedBy?.length ?? 0) > 0 && DOOR_ROLES.has(role) && base.endsWith('.ts');
 }
 
 function homeText(profile, sameOwner, crossApp) {

package/runtime/scripts/hfs/architecture/config.mjs

@@ -120,9 +120,10 @@ function workspaceDirectories(root, { packageRoot: appPackageRoot = root, side =
         }
         candidates = next;
       }
-      if (!candidates.length) throw Error(`Workspace pattern matched no package directories: ${normalized}.`);
       // npm expands a `*` segment to the directories that hold a package.json and skips the rest (an empty or untracked folder is
-      // HFS_EMPTY_DIR / HFS_SLOT_UNDECLARED, never a reason to analyse nothing); a literal workspace path must resolve.
+      // HFS_EMPTY_DIR / HFS_SLOT_UNDECLARED, never a reason to analyse nothing); a literal workspace path must resolve. A `*`
+      // pattern may match nothing: every app declares the same workspaces (fe/apps/*, fe/packages/*, HFS_MONO_WORKSPACES) whether
+      // or not it has a package yet, and the root patterns are held to that fixed list by the rule, not here.
       const wildcard = segments.includes('*');
       for (const candidate of candidates) admit(candidate, `workspace ${normalized}`, !wildcard);
     }
@@ -262,13 +263,13 @@ const GRAMMAR_PACKAGE = '@starci/grammar';
 function derivedGrammar(root, packageRoot, workspaces, apps = []) {
   const styleSources = apps.map(app => `apps/${app.name}/src/app/globals.css`).filter(relative => existingRegularFile(root, relative));
   if (!styleSources.length) return null;
-  // The apps have no package.json of their own: the app root's one manifest declares their dependencies, and it is a consumer
-  // when it declares the Grammar package; so is every workspace package that does.
+  // Every fe app and package is an npm workspace that declares what it imports (HFS_MONO_WORKSPACE_DEP): each workspace that
+  // declares the Grammar package is a consumer, and so is the app root's manifest when it does.
   const declaresGrammar = (pkg) => Boolean(pkg && [pkg.dependencies, pkg.peerDependencies, pkg.devDependencies].some(section => section && Object.hasOwn(section, GRAMMAR_PACKAGE)));
   const appManifest = slash(path.relative(root, path.join(packageRoot, 'package.json')));
   const consumerManifests = declaresGrammar(readJson(path.join(packageRoot, 'package.json'))) ? [appManifest] : [];
   for (const workspace of workspaces) {
-    if (!workspace.startsWith('packages/')) continue;
+    if (!workspace.startsWith('packages/') && !workspace.startsWith('apps/')) continue;
     const manifest = `${workspace}/package.json`;
     const pkg = readJson(path.join(root, ...manifest.split('/')));
     if (declaresGrammar(pkg)) consumerManifests.push(manifest);
@@ -298,7 +299,9 @@ export function loadArchitectureConfig(repositoryRoot, { hfs } = {}) {
   if (!projects.length) throw Error('The repository has no tsconfig.json to derive a TypeScript project from.');
   const backend = {
     modules: ['src/modules'],
-    features: ['src/features'],
+    // The layered feature root is the api kind (src/features/api/<feature>/: application/ and transport/<protocol>/); the cli
+    // feature root (src/features/cli/) has its own shape, held by its slot and the cli rules.
+    features: ['src/features/api'],
     apps: ['apps'],
     moduleRegistration: { providerIdentity: 'exported-class-token', handlerDecorators: [...DECLARED_HANDLER_DECORATORS] },
   };